# Traefik TCP Load Balancer

Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.

## What it does

- publishes `443/tcp` on the Docker host;
- forwards TCP TLS traffic to backend IP addresses and ports;
- leaves SSL certificates and private keys on the backends;
- stores Traefik configuration in the host `./config` directory;
- uses the Traefik file provider, without mounting the Docker socket.

## Configuration

Edit backend targets in `config/dynamic/tcp-services.yml`:

```yaml
tcp:
  services:
    ssl-backends:
      loadBalancer:
        servers:
          - address: "192.0.2.10:443"
          - address: "192.0.2.11:443"
```

The example addresses use the documentation-only `192.0.2.0/24` range. Replace them with the real backend IP addresses and ports before deploying. If a backend listens on the Docker host itself, use `host.docker.internal:PORT`.

## Run

Validate the Compose file:

```bash
docker compose config
```

Start Traefik:

```bash
docker compose up -d
```

View logs:

```bash
docker compose logs -f traefik
```

Stop the service:

```bash
docker compose down
```

## Documentation

- Architecture: `docs/architecture.md`
- Deployment: `docs/deployment.md`
- Operations: `docs/operations.md`
- Security: `docs/security.md`
- Testing: `docs/testing.md`
- Runbook: `docs/runbook.md`
- ADR: `docs/adr/0001-traefik-tcp-tls-passthrough.md`