Operations

Startup and shutdown

Start Traefik:

docker compose up -d

Stop Traefik:

docker compose down

Restart after static configuration changes in config/traefik.yml:

docker compose restart traefik

Dynamic configuration changes under config/dynamic/ are watched by Traefik and normally do not require a restart.

Health checks

The Traefik container healthcheck runs:

traefik healthcheck --ping

Check health with:

docker compose ps

Backend services also define Traefik load-balancer health checks in each file under config/dynamic/. HTTP checks call / with the configured hostname; TCP checks verify that the local TLS port accepts connections.

Logs

Traefik logs to container stdout:

docker compose logs -f traefik

Backend maintenance

To remove a backend from rotation, edit that site's file under config/dynamic/ and remove or comment out its address entry. Keep at least one reachable backend configured before applying the change.

This deployment uses host networking. For backends running on the Docker host, use 127.0.0.1:PORT when the service is bound to host loopback.

For HTTP on port 80, update the HTTP services in the relevant site file under config/dynamic/ to match the local backend ports that handle redirects and ACME challenge paths.

Known operational risks

TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
Backend certificates and renewal jobs must be monitored on each backend.
SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
Public port 80/tcp forwards all HTTP paths for configured hostnames to the matching backend.
TCP health checks verify reachability, not certificate validity or application-level correctness.

1.9 KiB Raw Permalink Blame History