Traefik TCP Load Balancer

Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.

What it does

• publishes 443/tcp on the Docker host;
• forwards TCP TLS traffic to backend IP addresses and ports;
• leaves SSL certificates and private keys on the backends;
• stores Traefik configuration in the host ./config directory;
• uses the Traefik file provider, without mounting the Docker socket.

Configuration

Edit backend targets in config/dynamic/tcp-services.yml:

tcp:
  services:
    ssl-backends:
      loadBalancer:
        servers:
          - address: "192.0.2.10:443"
          - address: "192.0.2.11:443"

The example addresses use the documentation-only 192.0.2.0/24 range. Replace them with the real backend IP addresses and ports before deploying. If a backend listens on the Docker host itself, use host.docker.internal:PORT.

Run

Validate the Compose file:

docker compose config

Start Traefik:

docker compose up -d

View logs:

docker compose logs -f traefik

Stop the service:

docker compose down

Documentation

• Architecture: docs/architecture.md
• Deployment: docs/deployment.md
• Operations: docs/operations.md
• Security: docs/security.md
• Testing: docs/testing.md
• Runbook: docs/runbook.md
• ADR: docs/adr/0001-traefik-tcp-tls-passthrough.md