loadbalancer/docs/deployment.md

Deployment

Requirements

• Docker Engine with Docker Compose plugin.
• Backend services reachable from the Docker host or container by IP address and port.
• Backend services must terminate TLS and present valid SSL certificates for the expected client names.

Configuration

Update config/dynamic/tcp-services.yml with the required SNI hostnames and backend addresses:

tcp:
  routers:
    example:
      rule: "HostSNI(`example.org`)"
      service: example
      tls:
        passthrough: true

  services:
    example:
      loadBalancer:
        servers:
          - address: "host.docker.internal:8443"

If a backend listens on the Docker host, use host.docker.internal:PORT. Compose maps that name through Docker's host-gateway feature.

HTTP-01 certificate challenges are routed separately with HTTP Host(...) rules on port 80. Configure the *-acme services in config/dynamic/tcp-services.yml to point at the local port where the challenge responder listens.

The ./config directory is the host-based configuration volume. It is mounted read-only into the container:

volumes:
  - ./config:/etc/traefik:ro

Ports

• Host 80/tcp -> container 8080/tcp: public HTTP entrypoint for ACME HTTP-01 challenge paths.
• Host 443/tcp -> container 8443/tcp: public TCP TLS passthrough load-balancer entrypoint.
• Container 8082/tcp: internal Traefik ping entrypoint used only by the container healthcheck.

Deploy

Validate the Compose configuration:

docker compose config

Start the stack:

docker compose up -d

Check status:

docker compose ps
docker compose logs traefik

Rollback

Stop the stack:

docker compose down

Then revert the deployment commit or restore the previous load-balancer configuration.