{"id":1877,"date":"2026-09-05T09:36:13","date_gmt":"2026-09-05T04:06:13","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-setup-traefik-reverse-proxy-docker-ssl\/"},"modified":"2026-09-05T12:58:49","modified_gmt":"2026-09-05T07:28:49","slug":"how-to-setup-traefik-reverse-proxy-docker-ssl","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-setup-traefik-reverse-proxy-docker-ssl\/","title":{"rendered":"How to Set Up Traefik Reverse Proxy with Docker and Auto Let’s Encrypt SSL"},"content":{"rendered":"

Why Traefik Has Revolutionized Container Routing<\/h2>\n

In traditional multi-container web architectures, deploying a new microservice behind Nginx or Apache requires manually writing a new virtual host configuration file, obtaining SSL certificates via Certbot, and reloading the web server daemon. When containers are scaled up or down frequently in Docker Compose, this manual configuration process is error-prone and tedious.<\/p>\n

Traefik<\/strong> is a modern HTTP reverse proxy and ingress controller designed specifically for containerized microservices. By listening directly to the Docker socket API, Traefik dynamically discovers newly created containers, parses their metadata labels, creates routing rules on the fly, and automatically provisions Let’s Encrypt SSL certificates without requiring a single server reload.<\/p>\n

In this production-ready deployment guide, we will configure Traefik v3 on Ubuntu 24.04\/22.04 LTS using Docker Compose, secure the Traefik management dashboard, and route traffic to backend containers using dynamic Docker labels.<\/p>\n

Step 1: Preparing Directory Structure & ACME Storage<\/h2>\n

Create a dedicated directory for Traefik and initialize the acme.json<\/code> certificate store with strict 600<\/code> permissions:<\/p>\n

# Create Traefik directory structure\nsudo mkdir -p \/var\/www\/traefik\ncd \/var\/www\/traefik\n\n# Create acme.json file with restricted permissions\ntouch acme.json\nchmod 600 acme.json\n\n# Create dedicated Docker network\ndocker network create web-gateway<\/code><\/pre>\n
Step 2: Creating Traefik Docker Compose Stack<\/h2>\n
Create \/var\/www\/traefik\/docker-compose.yml<\/code>:<\/p>\n
services:\n  traefik:\n    image: traefik:v3.1\n    container_name: traefik_router\n    restart: always\n    command:\n      - \"--api.dashboard=true\"\n      - \"--providers.docker=true\"\n      - \"--providers.docker.exposedbydefault=false\"\n      - \"--entryPoints.web.address=:80\"\n      - \"--entryPoints.websecure.address=:443\"\n      # Global HTTP to HTTPS Redirection\n      - \"--entryPoints.web.http.redirections.entryPoint.to=websecure\"\n      - \"--entryPoints.web.http.redirections.entryPoint.scheme=https\"\n      # ACME Let's Encrypt Automated SSL\n      - \"--certificatesresolvers.myresolver.acme.tlschallenge=true\"\n      - \"--certificatesresolvers.myresolver.acme.email=admin@example.com\"\n      - \"--certificatesresolvers.myresolver.acme.storage=\/acme.json\"\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n    networks:\n      - web-gateway\n    volumes:\n      - \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\n      - .\/acme.json:\/acme.json\n    labels:\n      - \"traefik.enable=true\"\n      # Dashboard Routing & Basic Auth Protection\n      - \"traefik.http.routers.traefik-dashboard.rule=Host(`traefik.example.com`)\"\n      - \"traefik.http.routers.traefik-dashboard.service=api@internal\"\n      - \"traefik.http.routers.traefik-dashboard.entrypoints=websecure\"\n      - \"traefik.http.routers.traefik-dashboard.tls.certresolver=myresolver\"\n      - \"traefik.http.routers.traefik-dashboard.middlewares=auth\"\n      # Generate hashed password with: htpasswd -nb admin yourpassword\n      - \"traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz$$randomhash\"\n\nnetworks:\n  web-gateway:\n    external: true<\/code><\/pre>\n
Step 3: Launching Traefik Gateway<\/h2>\n
# Start Traefik in detached daemon mode\ndocker compose up -d\n\n# Verify Traefik logs and ACME challenges\ndocker compose logs -f<\/code><\/pre>\n
Step 4: Deploying Microservice Containers with Traefik Labels<\/h2>\n
To expose any application container (e.g. Next.js, WordPress, or Go API) through Traefik with automated HTTPS, simply attach the web-gateway<\/code> network and declare Traefik labels in its compose file:<\/p>\n
services:\n  whoami_app:\n    image: traefik\/whoami\n    container_name: demo_whoami\n    restart: always\n    networks:\n      - web-gateway\n    labels:\n      - \"traefik.enable=true\"\n      - \"traefik.http.routers.whoami.rule=Host(`demo.example.com`)\"\n      - \"traefik.http.routers.whoami.entrypoints=websecure\"\n      - \"traefik.http.routers.whoami.tls.certresolver=myresolver\"\n      - \"traefik.http.services.whoami.loadbalancer.server.port=80\"\n\nnetworks:\n  web-gateway:\n    external: true<\/code><\/pre>\n
When you run docker compose up -d<\/code> on the application, Traefik immediately discovers the new container, issues a Let’s Encrypt certificate, and begins routing HTTPS traffic to https:\/\/demo.example.com<\/code> in seconds!<\/p>\n
Traefik vs Traditional Nginx Routing Comparison<\/h2>\n\n\n\n\n\n\n\n
Feature \/ Workflow<\/th>\nTraefik Dynamic Proxy<\/th>\nTraditional Static Nginx<\/th>\n<\/tr>\n<\/thead>\n
Adding New Microservices<\/strong><\/td>\nAutomatic via Docker Labels<\/strong><\/td>\nManual vhost config file creation<\/td>\n<\/tr>\n
SSL Certificate Management<\/strong><\/td>\nBuilt-in ACME Automated Issuance<\/strong><\/td>\nRequires Certbot cron configuration<\/td>\n<\/tr>\n
Server Reloads on Changes<\/strong><\/td>\nZero Reloads (Live Dynamic Config)<\/strong><\/td>\nRequires systemctl reload nginx<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Implementing Rate Limiting & Security Middlewares in Traefik<\/h2>\n
Protect your containerized microservices from denial-of-service floods and brute-force scans using Traefik’s built-in rate-limiting and security header middlewares:<\/p>\n
# Add Security & Rate-Limit Middlewares in docker-compose.yml\nlabels:\n  # Rate limit: Maximum 30 requests per second with burst capacity of 50\n  - \"traefik.http.middlewares.rate-limit.ratelimit.average=30\"\n  - \"traefik.http.middlewares.rate-limit.ratelimit.burst=50\"\n  \n  # Security Headers (HSTS, XSS Protection, Frame Options)\n  - \"traefik.http.middlewares.sec-headers.headers.stsSeconds=31536000\"\n  - \"traefik.http.middlewares.sec-headers.headers.browserXssFilter=true\"\n  - \"traefik.http.middlewares.sec-headers.headers.contentTypeNosniff=true\"\n  - \"traefik.http.middlewares.sec-headers.headers.customFrameOptionsValue=SAMEORIGIN\"\n  \n  # Apply Middlewares to Router\n  - \"traefik.http.routers.whoami.middlewares=rate-limit,sec-headers\"<\/code><\/pre>\n
Enabling HTTP\/3 (QUIC) Support in Traefik v3<\/h2>\n
Accelerate mobile connection speeds over UDP by enabling HTTP\/3 support on entrypoint websecure<\/code>:<\/p>\n
command:\n  - \"--entryPoints.websecure.address=:443\/tcp\"\n  - \"--entryPoints.websecure.http3=true\"\n  - \"--entryPoints.websecure.http3.advertisedPort=443\"\nports:\n  - \"443:443\/tcp\"\n  - \"443:443\/udp\" # Required for UDP QUIC packets<\/code><\/pre>\n
Traefik Diagnostic Commands<\/h2>\n