Deployment

Requirements

Docker Engine with Docker Compose plugin.
Backend services reachable from the Docker host or container by IP address and port.
Backend services must terminate TLS and present valid SSL certificates for the expected client names.

Configuration

Update config/dynamic/tcp-services.yml with the required SNI hostnames and backend addresses:

tcp:
  routers:
    example:
      rule: "HostSNI(`example.org`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - address: "127.0.0.1:8443"

This deployment uses host networking so Traefik can reach services bound to host loopback addresses such as 127.0.0.1:8443.

HTTP traffic is routed separately with HTTP Host(...) rules on port 80. Configure the HTTP services in config/dynamic/tcp-services.yml to point at the local backend port that should handle redirects and ACME challenge paths.

The ./config directory is the host-based configuration volume. It is mounted read-only into the container:

volumes:
  - ./config:/etc/traefik:ro

Ports

Host 80/tcp: public HTTP entrypoint handled directly by Traefik through host networking.
Host 443/tcp: public TCP TLS passthrough entrypoint handled directly by Traefik through host networking.
Host 8082/tcp: Traefik ping entrypoint for the container healthcheck; restrict this port with host firewall rules if needed.

Deploy

Validate the Compose configuration:

docker compose config

Start the stack:

docker compose up -d

Check status:

docker compose ps
docker compose logs traefik

Rollback

Stop the stack:

docker compose down

Then revert the deployment commit or restore the previous load-balancer configuration.

1.8 KiB Raw Blame History