Traefik TCP Load Balancer

Docker Compose deployment for Traefik used as a TCP load balancer with TLS passthrough.

What it does

• publishes 443/tcp on the Docker host;
• publishes 80/tcp on the Docker host for HTTP-01 certificate challenges;
• forwards TCP TLS traffic to backend IP addresses and ports;
• leaves SSL certificates and private keys on the backends;
• stores Traefik configuration in the host ./config directory;
• uses the Traefik file provider, without mounting the Docker socket.

Configuration

Edit SNI routes and backend targets in config/dynamic/tcp-services.yml:

tcp:
  routers:
    lab-younerd:
      rule: "HostSNI(`lab.younerd.org`)"
      service: lab-younerd
      tls:
        passthrough: true

  services:
    lab-younerd:
      loadBalancer:
        servers:
          - address: "host.docker.internal:8443"

HostSNI(...) matches the hostname sent by the client during the TLS handshake. If a backend listens on the Docker host itself, use host.docker.internal:PORT.

HTTP-01 certificate challenges use normal HTTP routing on port 80, not SNI. The included example forwards:

lab.younerd.org/.well-known/acme-challenge/* -> host.docker.internal:8080
azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080
www.azionelab.org/.well-known/acme-challenge/* -> host.docker.internal:9080

Adjust 8080 and 9080 to the local ports where the Certbot challenge responder or webroot service is listening.

Run

Validate the Compose file:

docker compose config

Start Traefik:

docker compose up -d

View logs:

docker compose logs -f traefik

Stop the service:

docker compose down

Documentation

• Architecture: docs/architecture.md
• Deployment: docs/deployment.md
• Operations: docs/operations.md
• Security: docs/security.md
• Testing: docs/testing.md
• Runbook: docs/runbook.md
• ADR: docs/adr/0001-traefik-tcp-tls-passthrough.md