Security

TLS and certificates

Traefik is configured for TCP TLS passthrough. It does not terminate TLS and does not require certificate files or private keys.

Backend services are responsible for:

presenting SSL certificates;
protecting private keys;
renewing certificates;
enforcing any application-layer authentication and authorization.

Network exposure

Compose publishes 80/tcp for HTTP-01 certificate challenges and 443/tcp for TLS passthrough traffic. The Traefik ping entrypoint listens inside the container for healthchecks and is not published on the host.

The HTTP routers only match /.well-known/acme-challenge/ paths for configured hostnames.

Container hardening

The Traefik service:

does not mount the Docker socket;
is not privileged;
drops Linux capabilities;
enables no-new-privileges;
mounts configuration read-only;
uses an explicit Traefik image tag instead of latest.

Secrets

No secrets should be stored in this repository. Do not add certificates, private keys, API tokens, or passwords to config/ or documentation.

Logging

Traefik logs operational events to stdout. Do not enable debug logging in production unless needed for a time-limited investigation.

Relevant ADRs

docs/adr/0001-traefik-tcp-tls-passthrough.md

1.3 KiB Raw Blame History