Operations

Startup and shutdown

Start Traefik:

docker compose up -d

Stop Traefik:

docker compose down

Restart after static configuration changes in config/traefik.yml:

docker compose restart traefik

Dynamic configuration changes under config/dynamic/ are watched by Traefik and normally do not require a restart.

Health checks

The container healthcheck runs:

traefik healthcheck --ping

Check health with:

docker compose ps

Logs

Traefik logs to container stdout:

docker compose logs -f traefik

Backend maintenance

To remove a backend from rotation, edit config/dynamic/tcp-services.yml and remove or comment out its address entry. Keep at least one reachable backend configured before applying the change.

For backends running on the Docker host, use host.docker.internal:PORT rather than 127.0.0.1:PORT, because 127.0.0.1 inside the container refers to the container itself.

For HTTP-01 challenges, update the *-acme HTTP services in config/dynamic/tcp-services.yml to match the local challenge responder ports.

Known operational risks

TLS passthrough prevents Traefik from inspecting HTTP paths, headers, or certificate contents.
Backend certificates and renewal jobs must be monitored on each backend.
SNI routing depends on clients sending the expected hostname during the TLS handshake. Clients that connect by IP address or omit SNI will not match hostname-specific routers.
Public port 80/tcp is only intended for /.well-known/acme-challenge/ traffic in this configuration.

1.6 KiB Raw Blame History