# Traefik TCP Load Balancer

Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.

## What it does

- publishes `443/tcp` on the Docker host;
- publishes `80/tcp` on the Docker host for HTTP-01 certificate challenges;
- forwards TCP TLS traffic to backend IP addresses and ports;
- leaves SSL certificates and private keys on the backends;
- stores Traefik configuration in the host `./config` directory;
- uses the Traefik file provider, without mounting the Docker socket.

## Configuration

Edit SNI routes and backend targets in `config/dynamic/tcp-services.yml`:

```yaml
tcp:
  routers:
    lab-younerd:
      rule: "HostSNI(`lab.younerd.org`)"
      service: lab-younerd
      tls:
        passthrough: true

  services:
    lab-younerd:
      loadBalancer:
        servers:
          - address: "host.docker.internal:8443"
```

`HostSNI(...)` matches the hostname sent by the client during the TLS handshake. If a backend listens on the Docker host itself, use `host.docker.internal:PORT`.

HTTP-01 certificate challenges use normal HTTP routing on port `80`, not SNI. The included example forwards:

```text
lab.younerd.org/.well-known/acme-challenge/* -> host.docker.internal:8080
azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
www.azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
```

Adjust `8080` and `9080` to the local ports where the Certbot challenge responder or webroot service is listening.

## Run

Validate the Compose file:

```bash
docker compose config
```

Start Traefik:

```bash
docker compose up -d
```

View logs:

```bash
docker compose logs -f traefik
```

Stop the service:

```bash
docker compose down
```

## Documentation

- Architecture: `docs/architecture.md`
- Deployment: `docs/deployment.md`
- Operations: `docs/operations.md`
- Security: `docs/security.md`
- Testing: `docs/testing.md`
- Runbook: `docs/runbook.md`
- ADR: `docs/adr/0001-traefik-tcp-tls-passthrough.md`