Deployment

Requirements

Docker Engine with Docker Compose plugin.
Backend services reachable from the Docker host or container by IP address and port.
Backend services must terminate TLS and present valid SSL certificates for the expected client names.

Update config/dynamic/tcp-services.yml with the real backend addresses:

servers:
  - address: "10.0.0.10:443"
  - address: "10.0.0.11:443"

If a backend listens on the Docker host, use host.docker.internal:PORT. Compose maps that name through Docker's host-gateway feature.

The ./config directory is the host-based configuration volume. It is mounted read-only into the container:

volumes:
  - ./config:/etc/traefik:ro

Host 443/tcp -> container 8443/tcp: public TCP TLS passthrough load-balancer entrypoint.
Container 8082/tcp: internal Traefik ping entrypoint used only by the container healthcheck.

Validate the Compose configuration:

docker compose config

Start the stack:

docker compose up -d

Check status:

docker compose ps
docker compose logs traefik

Stop the stack:

docker compose down

Then revert the deployment commit or restore the previous load-balancer configuration.