Skip to content

Recipes

Small complete arrangements, each built from pieces the earlier chapters proved. Names and ports are the lab's; substitute your own services throughout.

Several household services, one server

The home-server standard: a wiki, a photo library and a media page on one machine, each on its own port, given names under one internal domain. One router and service per name (chapter 4), a local-CA certificate covering all the names (chapter 7's SAN list is built for exactly this), the HTTP routers carrying the redirect middleware, and real names served by your router or a small DNS resolver on the LAN. Nothing here is published to the internet — Traefik routes what arrives, and nothing arrives except from your network, because the entrypoints are only reachable there.

A public site and a private admin page

One service, two doors with different locks. The public router matches the site name on the websecure entrypoint. The admin router matches the same name plus PathPrefix(/admin) — longer rule, higher priority (chapter 5) — and carries basicAuth (chapter 6) on top of the service's own login. The point is depth, not novelty: the admin path gets a password before the application is even told a visitor exists. If the admin interface can instead live on a separate internal-only name that public DNS never mentions, prefer that; a door the internet cannot name is quieter than a locked one it knocks on daily.

A service moves to a new name. For the overlap season, the old name's router gets a redirectRegex middleware — rewrite the old host (and any moved paths) to the new address permanently (permanent: true sends a 301) — while the new name serves the service. When the logs show the old name receiving only robots and nostalgia, delete the router. The redirect is middleware like any other: defined once, attached to the old router, removed by deleting lines, not by downtime.

Everything-in-HTTPS, enforced at the door

Instead of remembering the redirect middleware on every HTTP router (the chapter 7 way, visible and easy to forget), static configuration can give the web entrypoint itself an HTTP redirection to websecure. Every plain request is redirected before any router sees it. Choose one style per installation: entrypoint-wide for uniform public sites, per-router when some names must stay HTTP-reachable (health checks from other systems, old devices, an ACME challenge path you are handling yourself).

A staging twin beside the real site

Same service, second name — preview beside the real one — pointing at a second backend instance, guarded by basicAuth so the public never wanders in. When the preview earns promotion, promotion is a one-line change of the real router's service, and the health check (chapter 10) makes even that change cautious: point the real service at both servers, watch both answer, then remove the old one. Most "deployment" needs at this scale are exactly that sequence, performed slowly.