Skip to content

What Traefik Is

Traefik is a reverse proxy: one public door in front of several services, which looks at each arriving request, decides which service it is for, and passes it over. The visitor sees one address. Behind the door there might be a wiki, a photo library, a home-automation page and an API, each running on its own port, in its own container, on its own machine — the proxy is what makes them look like one tidy place with proper names and proper HTTPS.

It is free, open-source software, a single program written in Go, first released in 2015 by the company now called Traefik Labs. It runs on a home server, a small VPS, or a Kubernetes cluster at a scale this guide will not pretend to cover.

The problem it solves

Every self-hosted service arrives with the same awkward shape: it listens on some port — 8080, 9001, 3579 — and it speaks plain HTTP. To share three of them with your household you can hand out addresses like 192.168.1.20:9001, and people will cope, until you want names instead of numbers, one certificate instead of three warnings, or the service moved to another machine without everyone's bookmarks breaking. A reverse proxy is the standard answer: names point at the proxy, the proxy knows where things really live.

What distinguishes Traefik from the older answers (chapter 13) is where it learns that knowledge. An Nginx configuration says it in a file you wrote and must reload. Traefik prefers to be told by the environment: it watches Docker, Kubernetes, or a folder of configuration files, and rebuilds its routing the moment something changes — a container starts, a file is edited — without a restart and without dropping the requests in flight. Chapter 4 proves that with a stopwatch-free test: a new site answers while the proxy process never restarts.

What it is not

  • Not a web server. Traefik serves no files of its own. Something behind it does the serving; Traefik only directs traffic. (Its built-in dashboard is the one exception, and chapter 8 treats it carefully.)
  • Not a firewall. It will happily forward a malicious request to a service that can't handle it. Basic authentication and rate limits exist as middleware (chapter 6); they are not a security programme.
  • Not a certificate authority. It can fetch and renew Let's Encrypt certificates for you — chapter 7 — but only for names the public internet can verify are yours.
  • Not magic about bad backends. If the service behind it is down, Traefik answers 502 and says so. Health checks (chapter 10) let it stop trying a dead server; they do not revive it.

The one-sentence version

If your services currently live at addresses only you can remember, Traefik gives them names, one front door, and one place to handle HTTPS — at the price of one more program to understand, which is what the rest of this guide is for.