# Operations

## Startup and shutdown

Start Traefik:

```bash
docker compose up -d
```

Stop Traefik:

```bash
docker compose down
```

Restart after static configuration changes in `config/traefik.yml`:

```bash
docker compose restart traefik
```

Dynamic configuration changes under `config/dynamic/` are watched by Traefik and normally do not require a restart.

## Health checks

The container healthcheck runs:

```bash
traefik healthcheck --ping
```

Check health with:

```bash
docker compose ps
```

## Logs

Traefik logs to container stdout:

```bash
docker compose logs -f traefik
```

## Backend maintenance

To remove a backend from rotation, edit that site's file under `config/dynamic/` and remove or comment out its `address` entry. Keep at least one reachable backend configured before applying the change.

This deployment uses host networking. For backends running on the Docker host, use `127.0.0.1:PORT` when the service is bound to host loopback.

For HTTP on port `80`, update the HTTP services in the relevant site file under `config/dynamic/` to match the local backend ports that handle redirects and ACME challenge paths.

## Known operational risks

- TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
- Backend certificates and renewal jobs must be monitored on each backend.
- SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
- Public port `80/tcp` forwards all HTTP paths for configured hostnames to the matching backend.