A working Traefik setup needs four things: a Docker provider that only routes services you opt in, a web entrypoint on port 80 and a websecure entrypoint on port 443, an ACME certificate resolver with persistent storage, and a router label that attaches that resolver to your hostname. Traefik then requests and renews the certificate itself. The steps below build that setup in order, then cover how to pick a challenge type, move from staging to production, protect the dashboard, and debug the failures you are most likely to hit.
Before you start
- A host with Docker and Docker Compose installed, and ports 80 and 443 free (nothing else, such as Apache or nginx, bound to them).
- A public domain you control, with a DNS
Arecord (orAAAAfor IPv6) pointing to the host’s public address. For example,whoami.example.com. - Inbound TCP 80 and 443 open on the host and any upstream firewall or router. Let’s Encrypt’s HTTP-01 check connects to port 80 from the public internet, so a private LAN address will not work for public certificates.
- An application container that listens on a known port. This guide uses
traefik/whoamias a stand-in backend.
Confirm the DNS record before anything else. From a machine outside your network, run dig +short whoami.example.com and check that the answer matches the host’s public IP. If it does not, certificate issuance will fail no matter how the proxy is configured.
How Traefik divides its configuration
Traefik reads two kinds of configuration. Static configuration is set once at startup: entrypoints, providers, and certificate resolvers. In this guide it is passed as command-line flags on the Traefik service. Dynamic configuration changes while Traefik runs: routers, services, and middlewares. With the Docker provider, you declare these as labels on your application containers. Traefik watches the Docker API and picks up new containers without a restart.
That split explains most setup mistakes. A router label that references a certificate resolver does nothing if the resolver is not defined in the static flags. A router that points at an entrypoint Traefik never opened will never match a request.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Step 1: Create the shared network
Traefik and each backend must share a Docker network so Traefik can reach the backend on its container port. Create one named proxy:
docker network create proxyEach backend you want Traefik to route joins this network. Backends that also sit on a private database network can stay connected to both, but Traefik needs to know which network to use. Step 3 sets that option.
Step 2: Write the Traefik and backend Compose file
Create a project directory, then a compose.yaml file. The examples use Traefik v3 flag syntax. Pin the image to one exact tag and check the option names against the documentation for that release before you deploy. The quick-start page currently shows traefik:v3.7, but the detailed configuration pages you will read use older tags for some examples, and a few option names have changed across releases.
services:
traefik:
image: traefik:v3.7
command:
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --providers.docker.network=proxy
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=https
- [email protected]
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
- --api.dashboard=true
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
networks:
- proxy
restart: unless-stopped
whoami:
image: traefik/whoami
networks:
- proxy
labels:
- traefik.enable=true
- traefik.http.routers.whoami.rule=Host(`whoami.example.com`)
- traefik.http.routers.whoami.entrypoints=websecure
- traefik.http.routers.whoami.tls.certresolver=letsencrypt
- traefik.http.services.whoami.loadbalancer.server.port=80
restart: unless-stopped
networks:
proxy:
external: trueEach block does a specific job:
providers.docker.exposedbydefault=falsemeans Traefik ignores any container that lackstraefik.enable=true. Without it, every container on the network is published through the proxy.entrypoints.webandentrypoints.websecureare the listeners. The redirection flags send plain HTTP to HTTPS. The HTTP-01 challenge is still answered onweb, so the redirect does not block validation.certificatesresolvers.letsencryptdefines the ACME account and the path where certificates are stored. The resolver name,letsencrypt, is what routers reference../letsencrypt:/letsencryptkeepsacme.jsonon the host, so certificates survive container recreation.- The Docker socket is mounted read-only. Note that this is a limit on file writes, not on API power: anything that can talk to the Docker API can control the host. Treat socket access as root-equivalent.
Replace [email protected] with a mailbox you monitor, since Let’s Encrypt sends expiry and account notices there.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Step 3: Prepare the certificate storage file
Traefik writes ACME account data and certificates to acme.json. It expects that file to exist with permissions set to 600, and it refuses to store certificates if the permissions are looser. Create it before the first start:
mkdir -p letsencrypt
touch letsencrypt/acme.json
chmod 600 letsencrypt/acme.jsonDo not delete this file between restarts. Deleting it forces Traefik to request new certificates, and repeated issuance can hit Let’s Encrypt rate limits.
Step 4: Start the stack and check the proxy
docker compose up -d
docker compose logs -f traefikLook for lines that show the web and websecure entrypoints starting and the Docker provider connecting. Then test plain HTTP from outside your network:
curl -I http://whoami.example.comYou should see a 301 or 308 response pointing to https://whoami.example.com/. If you get a 404 from Traefik, the router did not match; see the troubleshooting section below.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
Step 5: Use the staging server first
Let’s Encrypt’s production issuance is rate limited. While you are still fixing DNS, ports, or labels, point the resolver at the staging directory. Add this flag to the Traefik command list:
- --certificatesresolvers.letsencrypt.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directoryRestart Traefik, then check the logs for a successful challenge and a certificate. Staging certificates come from an untrusted test CA, so a browser will show a warning. That is expected, and it confirms that the challenge path works. Once the staging result looks right, remove the caserver line, stop the stack, and delete the staging entries before going live. The simplest reliable method is to empty the file again:
docker compose down
: > letsencrypt/acme.json
chmod 600 letsencrypt/acme.json
docker compose up -dKeep this sequence in mind: you may need to reset the file after each change of CA. Do not do this repeatedly against production, because each fresh issuance counts toward Let’s Encrypt’s limits.
Step 6: Verify the production certificate
After the stack restarts with production settings, wait about a minute and check the certificate the server presents:
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐑𝐞𝐚𝐝𝐲 𝐖𝐢-𝐅𝐢 𝟕 - Designed with the latest Wi-Fi 7 technology, featuring Multi-Link Operation (MLO), Multi-RUs, and 4K-QAM. Achieve optimized performance on latest WiFi 7 laptops and devices, like the iPhone 16 Pro, and Samsung Galaxy S24 Ultra.
- 𝟔-𝐒𝐭𝐫𝐞𝐚𝐦, 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝐰𝐢𝐭𝐡 𝟔.𝟓 𝐆𝐛𝐩𝐬 𝐓𝐨𝐭𝐚𝐥 𝐁𝐚𝐧𝐝𝐰𝐢𝐝𝐭𝐡 - Achieve full speeds of up to 5764 Mbps on the 5GHz band and 688 Mbps on the 2.4 GHz band with 6 streams. Enjoy seamless 4K/8K streaming, AR/VR gaming, and incredibly fast downloads/uploads.
- 𝐖𝐢𝐝𝐞 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐰𝐢𝐭𝐡 𝐒𝐭𝐫𝐨𝐧𝐠 𝐂𝐨𝐧𝐧𝐞𝐜𝐭𝐢𝐨𝐧 - Get up to 2,400 sq. ft. max coverage for up to 90 devices at a time. 6x high performance antennas and Beamforming technology, ensures reliable connections for remote workers, gamers, students, and more.
- 𝐔𝐥𝐭𝐫𝐚-𝐅𝐚𝐬𝐭 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐖𝐢𝐫𝐞𝐝 𝐏𝐞𝐫𝐟𝐨𝐫𝐦𝐚𝐧𝐜𝐞 - 1x 2.5 Gbps WAN/LAN port, 1x 2.5 Gbps LAN port and 3x 1 Gbps LAN ports offer high-speed data transmissions.³ Integrate with a multi-gig modem for gigplus internet.
- 𝐎𝐮𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐂𝐨𝐦𝐦𝐢𝐭𝐦𝐞𝐧𝐭 - TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
openssl s_client -connect whoami.example.com:443 -servername whoami.example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject -datesThe issuer should name a publicly trusted Let’s Encrypt intermediate, and the subject should match your hostname. Until a real certificate is issued, Traefik serves its built-in default certificate, which is not tied to your domain. Seeing that certificate means issuance has not yet succeeded.
Choosing a challenge method
The Compose example uses HTTP-01. That is the simplest option when port 80 is reachable from the internet. The other two methods solve different network constraints.
| Challenge | What must be publicly reachable | Traefik setting | Credentials | Wildcard certificates | Best fit |
|---|---|---|---|---|---|
| HTTP-01 | Port 80 on the Traefik host | acme.httpchallenge.entrypoint=web |
None | Not supported; the ACME protocol requires DNS-01 for wildcards | Single hostnames on a host with open port 80 |
| TLS-ALPN-01 | Port 443 on the Traefik host | acme.tlschallenge=true |
None | Not supported; the ACME protocol requires DNS-01 for wildcards | Hosts where port 80 is blocked but 443 is open |
| DNS-01 | No inbound port needed; the DNS provider must be reachable by Traefik | acme.dnschallenge.provider=<provider> |
Provider API token, stored as an environment variable or Docker secret; variable names differ per provider | Supported | Hosts that cannot accept inbound challenges, or any wildcard certificate |
Choose based on what your network allows, not on which method sounds more advanced. DNS-01 is the only option that works without inbound challenge ports, but it introduces a DNS API token that must be protected. Keep those credentials out of the Compose file in plain text. The exact environment variable names required by each DNS provider are listed in Traefik’s ACME documentation for that provider, so check them there rather than copying a name from another example.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Securing the dashboard
The dashboard shows every router, service, and certificate, and it can expose internal hostnames. The quick-start example enables an insecure dashboard on port 8080 with no login. That is a local demonstration setting. Do not expose it on a public host.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
The safer approach is to route the dashboard through HTTPS on a hostname of its own and protect it with a basic-auth middleware. Generate a bcrypt password hash:
htpasswd -nB adminCopy the output, which looks like admin:$2y$05$.... In a Compose file, every $ must be doubled, so the value becomes admin:$$2y$$05$$.... Add these labels to the traefik service:
labels:
- traefik.enable=true
- traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)
- traefik.http.routers.dashboard.entrypoints=websecure
- traefik.http.routers.dashboard.tls.certresolver=letsencrypt
- traefik.http.routers.dashboard.service=api@internal
- traefik.http.routers.dashboard.middlewares=dashauth
- traefik.http.middlewares.dashauth.basicauth.users=admin:$$2y$$05$$REPLACE_WITH_YOUR_HASHCreate a DNS record for traefik.example.com as well, and the dashboard certificate will be issued by the same resolver. Do not add --api.insecure=true to the production command.
Troubleshooting
Start with the Traefik logs, then test each layer in order: DNS, port reachability, router match, backend reachability, and certificate.
- Traefik returns 404 on the hostname. No router matched. Check that the rule’s hostname exactly matches the request, that the router names the
websecureentrypoint, and that the container hastraefik.enable=true. Rundocker compose logs traefikand search for the router name. - 502 or 504 from Traefik. The router matched, but Traefik cannot reach the backend. Confirm the backend and Traefik share the
proxynetwork, thatproviders.docker.network=proxyis set, and thatloadbalancer.server.portmatches the port the application listens on inside the container. - The browser shows Traefik’s default certificate. Issuance has not succeeded. Search the logs for
acme. Common causes are DNS not yet pointing at the host, port 80 blocked upstream, or a missingtls.certresolverlabel on the router. - Traefik logs a permissions error about
acme.json. Runchmod 600 letsencrypt/acme.jsonand restart. - Issuance fails with rate-limit errors. Stop retrying. Return to the staging endpoint until the configuration is correct, then wait for the limit window to pass before requesting production certificates again.
- Local tests show a warning in the browser. A local self-signed certificate or a staging certificate is not publicly trusted. For public hosts, verify with the
opensslcommand in Step 6 rather than relying on a browser warning from earlier tests.
Once HTTPS works, keep acme.json in a backed-up location, rotate the dashboard password when staff change, and review which containers carry traefik.enable=true whenever you add a service.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
