{"id":4315,"date":"2026-09-12T15:50:31","date_gmt":"2026-09-12T10:20:31","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-configure-traefik-docker-reverse-proxy-ssl\/"},"modified":"2026-09-12T15:52:13","modified_gmt":"2026-09-12T10:22:13","slug":"how-to-configure-traefik-docker-reverse-proxy-ssl","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-configure-traefik-docker-reverse-proxy-ssl\/","title":{"rendered":"How to Configure Traefik as a Dynamic Reverse Proxy for Docker Containers"},"content":{"rendered":"
\n Quick Technical Answer:<\/strong><\/p>\n

\n To configure Traefik v3<\/strong> as a dynamic Docker reverse proxy: Deploy Traefik via Docker Compose, mounting \/var\/run\/docker.sock<\/code> and listening on ports 80 and 443. Enable the Docker provider (--providers.docker=true<\/code>) and ACME resolver. For any application container (e.g. Nextcloud, WordPress, or Node.js), simply attach Docker labels: traefik.enable=true<\/code>, traefik.http.routers.myapp.rule=Host(`myapp.yourdomain.com`)<\/code>, and traefik.http.routers.myapp.tls.certresolver=myresolver<\/code>. Traefik auto-discovers the container, routes traffic, and provisions SSL instantly with zero reload downtime.\n <\/p>\n<\/div>\n

The Container Orchestration Dilemma: Why Static Proxies Fall Short<\/h2>\n

In traditional hosting environments, adding a new web service required a tedious manual checklist: spin up the application, find its internal port, open Nginx configuration, write a new location<\/code> block, test syntax, reload Nginx, and run Certbot.<\/p>\n

In containerized Docker environments where microservices, staging builds, and databases dynamically launch, terminate, and scale across internal bridge networks with ephemeral IP addresses, maintaining static Nginx configuration files becomes an administrative nightmare.<\/p>\n

Traefik (The Cloud-Native Application Proxy)<\/strong> was engineered specifically for microservices and containers. Traefik listens directly to the Docker socket API. When a new container spins up with Traefik labels, Traefik dynamically registers the route, maps the backend port, generates a Let’s Encrypt TLS certificate, and routes public traffic\u2014without ever touching a configuration file or restarting the proxy daemon<\/strong>.<\/p>\n

Step 1: Setting Up the Shared Docker Bridge Network<\/h2>\n

To allow Traefik to route traffic to independent Docker Compose projects, create a dedicated external bridge network:<\/p>\n

# Create shared external network for reverse proxy traffic\ndocker network create web-gateway<\/code><\/pre>\n
Step 2: Deploying Traefik v3 with Docker Compose<\/h2>\n
Create a dedicated directory for Traefik and initialize the ACME certificate storage file with strict permissions:<\/p>\n
# Create directory and acme.json file\nmkdir -p ~\/traefik && cd ~\/traefik\ntouch acme.json && chmod 600 acme.json\n\n# Create docker-compose.yml\nnano docker-compose.yml<\/code><\/pre>\n
Insert the following production Traefik v3 Compose file:<\/p>\n
version: '3.8'\n\nservices:\n  traefik:\n    image: traefik:v3.1\n    container_name: traefik\n    restart: always\n    security_opt:\n      - no-new-privileges:true\n    networks:\n      - web-gateway\n    ports:\n      - \"80:80\"\n      - \"443:443\"\n    environment:\n      - CF_DNS_API_TOKEN=your_optional_cloudflare_token\n    volumes:\n      - \/etc\/localtime:\/etc\/localtime:ro\n      - \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\n      - .\/acme.json:\/acme.json\n    command:\n      # API & Dashboard\n      - \"--api.dashboard=true\"\n      # EntryPoints\n      - \"--entrypoints.web.address=:80\"\n      - \"--entrypoints.websecure.address=:443\"\n      # Global HTTP to HTTPS Redirect\n      - \"--entrypoints.web.http.redirections.entrypoint.to=websecure\"\n      - \"--entrypoints.web.http.redirections.entrypoint.scheme=https\"\n      # Docker Provider Configuration\n      - \"--providers.docker=true\"\n      - \"--providers.docker.exposedbydefault=false\"\n      - \"--providers.docker.network=web-gateway\"\n      # Let's Encrypt TLS Resolver\n      - \"--certificatesresolvers.letsencrypt.acme.tlschallenge=true\"\n      - \"--certificatesresolvers.letsencrypt.acme.email=admin@yourdomain.com\"\n      - \"--certificatesresolvers.letsencrypt.acme.storage=\/acme.json\"\n    labels:\n      - \"traefik.enable=true\"\n      # Secure Traefik Dashboard Route\n      - \"traefik.http.routers.traefik-dashboard.rule=Host(`traefik.yourdomain.com`)\"\n      - \"traefik.http.routers.traefik-dashboard.service=api@internal\"\n      - \"traefik.http.routers.traefik-dashboard.entrypoints=websecure\"\n      - \"traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt\"\n      # Basic Auth Protection (Generate with: htpasswd -nb admin password)\n      - \"traefik.http.routers.traefik-dashboard.middlewares=auth\"\n      - \"traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz$$encryptedpassword\"\n\nnetworks:\n  web-gateway:\n    external: true<\/code><\/pre>\n
Launch Traefik:<\/p>\n
docker compose up -d<\/code><\/pre>\n
Step 3: Deploying Any Application Behind Traefik in 5 Lines<\/h2>\n
Now, any container you launch on your server can be instantly exposed with zero proxy configuration. For example, to deploy a Whoami<\/strong> diagnostic test container:<\/p>\n
version: '3.8'\n\nservices:\n  whoami:\n    image: traefik\/whoami\n    container_name: test-app\n    restart: always\n    networks:\n      - web-gateway\n    labels:\n      - \"traefik.enable=true\"\n      - \"traefik.http.routers.testapp.rule=Host(`test.yourdomain.com`)\"\n      - \"traefik.http.routers.testapp.entrypoints=websecure\"\n      - \"traefik.http.routers.testapp.tls.certresolver=letsencrypt\"\n      - \"traefik.http.services.testapp.loadbalancer.server.port=80\"\n\nnetworks:\n  web-gateway:\n    external: true<\/code><\/pre>\n
The moment you execute docker compose up -d<\/code> on this test service, Traefik automatically notices the new labels, provisions an SSL certificate for test.yourdomain.com<\/code>, and routes incoming HTTPS traffic directly to port 80 of the container.<\/p>\n
Step 4: Architectural Flow & Middleware Pipeline<\/h2>\n
Traefik processes incoming requests through a clear four-stage pipeline:<\/p>\n
    \n
  1. EntryPoints:<\/strong> The network listener ports (port 80 HTTP and port 443 HTTPS).<\/li>\n
  2. Routers:<\/strong> Match request attributes (Host header, path prefix, or method) and map them to a service.<\/li>\n
  3. Middlewares:<\/strong> Modify requests before they reach the backend (e.g. rate limiting, basic authentication, stripping path prefixes, or adding security headers).<\/li>\n
  4. Services:<\/strong> Forward requests to healthy backend container IP addresses with integrated health checking.<\/li>\n<\/ol>\n
    Frequently Asked Questions (FAQ)<\/h2>\n
    \n
    Why does acme.json require permissions 600?<\/h3>\n
    Traefik stores private cryptographic SSL keys inside acme.json<\/code>. If the file has loose permissions (readable by non-root users), Traefik refuses to launch to protect your server security. Always enforce chmod 600 acme.json<\/code>.<\/p>\n
    Can Traefik handle Wildcard SSL certificates?<\/h3>\n
    Yes. To generate wildcard certificates (e.g. *.yourdomain.com<\/code>), switch the ACME challenge method from tlschallenge<\/code> to DNS Challenge<\/strong> (using Cloudflare, DigitalOcean, or Namecheap API tokens in environment variables).<\/p>\n<\/div>\n
    \n
    \ud83d\udd17 Recommended Related Technical Guides<\/h3>\n