Skip to content

Traefik for Mere Mortals

A plain-language guide to Traefik, the reverse proxy that gives several services one front door — proper names instead of port numbers, HTTPS handled in one place, and routing that updates itself when things change. It walks the whole job: what the moving parts are, a first router behind a real name, the rules that split traffic by host and path, middleware, TLS with a certificate authority of your own, the dashboard and API, load balancing with health checks, and the troubleshooting that begins with asking whose 404 you are looking at.

You run a real proxy along the way. The lab chapter-by-chapter puts two small backends behind Traefik's official binary, moves traffic between them by rule, locks one with a password, balances across two copies of the other, watches a health check retire and restore a server, adds HTTPS and a redirect with a local CA, and adds a whole new site by writing one file while the proxy never restarts. What could not honestly run in a sandbox — Docker labels, and Let's Encrypt certificates from the public internet — is labelled documented-only wherever it appears, and the notes say exactly what ran.

Who this is for

Anyone who runs — or is about to run — more than one service on a machine and is tired of remembering ports: a home server with a wiki and a photo library, a small VPS with a site and its admin page, a household's worth of dashboards. No container platform, cloud account or existing proxy experience is assumed; Docker enters late, as one provider among several, and is marked documented only because the lab sandbox has no Docker to run it on.

Chapters

  1. What Traefik Is — the front-door job, and what a reverse proxy is not.
  2. The Moving Parts — entrypoints, providers, routers, services and middleware; static versus dynamic.
  3. Installing Traefik — the single binary, verified against the project's checksums, and a static config read line by line.
  4. Your First Router — one backend given a name, the forwarding headers, and the informative 404.
  5. Routing Rules — Host, PathPrefix and friends; two backends under one name; why the longer rule wins.
  6. Middleware — headers, path stripping and basic authentication, each proved against a live backend.
  7. TLS and HTTPS — a local CA and certificate, the redirect to HTTPS, and Let's Encrypt described honestly.
  8. The Dashboard and API — what Traefik can tell you about itself, and why the insecure mode is named that.
  9. Docker and Labels — the container provider and label-based routing. Documented only; the lab has no Docker, and the chapter says so.
  10. Load Balancing and Health — round robin, active health checks retiring and restoring a server, sticky sessions.
  11. Backup and Upgrade — the small folder that is the whole estate, and replacing the binary without drama.
  12. Recipes — household services, a public site with a private admin page, retirement redirects, staging twins.
  13. The Neighbours — Nginx, Caddy, HAProxy, Apache, cloud load balancers, and Kubernetes ingress, honestly.
  14. Limits — no file serving, trust in forwarded headers, the single binary as a single point, and the narrower TCP/UDP world.
  15. Troubleshooting — whose error it is: 404s from both sides of the proxy, 502, 503, refused edits, certificate warnings, redirect loops.
  16. Glossary — every term used, defined once.

How the guide is organised

Chapters are numbered in reading order in the navigation. Example configuration files, the lab backend's source, the working notes and the command list live in examples/; transcripts of the verification runs live in traefik-lab/transcripts/. The writing standards the guide is held to are in criteria.md, including the verification notes — what ran for real, what is documented only, and the errors hit along the way.

Verifying the guide

Everything in the lab chapters ran on the project's own current release at build time, Traefik v3.7.16, downloaded as the official binary and checksum-verified before use. The Docker and Let's Encrypt parts follow the project's official documentation and are labelled as such; nothing in those sections is presented as observed behaviour.

Part of the series

This guide is one of the For Mere Mortals guides: plain-language guides to the tools programmers and makers use.

Related guides:

License

The writing in this guide is licensed under CC BY 4.0. Code examples and lab scripts are licensed under the MIT License.