Operations

Startup and shutdown

Start Traefik:

docker compose up -d

Stop Traefik:

docker compose down

Restart after static configuration changes in config/traefik.yml:

docker compose restart traefik

Dynamic configuration changes under config/dynamic/ are watched by Traefik and normally do not require a restart.

Health checks

The container healthcheck runs:

traefik healthcheck --ping

Check health with:

docker compose ps

Logs

Traefik logs to container stdout:

docker compose logs -f traefik

Backend maintenance

To remove a backend from rotation, edit config/dynamic/tcp-services.yml and remove or comment out its address entry. Keep at least one reachable backend configured before applying the change.

This deployment uses host networking. For backends running on the Docker host, use 127.0.0.1:PORT when the service is bound to host loopback.

For HTTP on port 80, update the HTTP services in config/dynamic/tcp-services.yml to match the local backend ports that handle redirects and ACME challenge paths.

Known operational risks

TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
Backend certificates and renewal jobs must be monitored on each backend.
SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
Public port 80/tcp forwards all HTTP paths for configured hostnames to the matching backend.

1.6 KiB Raw Blame History