# Operations

## Startup and shutdown

Start Traefik:

```bash
docker compose up -d
```

Stop Traefik:

```bash
docker compose down
```

Restart after static configuration changes in `config/traefik.yml`:

```bash
docker compose restart traefik
```

Dynamic configuration changes under `config/dynamic/` are watched by Traefik and normally do not require a restart.

## Health checks

The container healthcheck runs:

```bash
traefik healthcheck --ping
```

Check health with:

```bash
docker compose ps
```

## Logs

Traefik logs to container stdout:

```bash
docker compose logs -f traefik
```

## Backend maintenance

To remove a backend from rotation, edit `config/dynamic/tcp-services.yml` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.

For backends running on the Docker host, use `host.docker.internal:PORT` rather than `127.0.0.1:PORT`, because `127.0.0.1` inside the container refers to the container itself.

## Known operational risks

- TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
- Backend certificates and renewal jobs must be monitored on each backend.
- The default configuration routes all SNI names to the same backend pool. Use more specific `HostSNI(...)` rules if different names need different pools.