Traefik - Reverse Proxy
Single entry point for all services in the stack. Handles HTTP/HTTPS routing, automatic TLS certificates via Let's Encrypt (ACME), and security middleware.
Access
Configuration
- Static config:
./traefik/config/traefik.yml
- Dynamic config:
./traefik/config/dynamic_conf.yml
- ACME certs:
./traefik/letsencrypt/acme.json (must be chmod 600)
- ACME email: rewelacyjny.rower@gmail.com
- Services auto-register via Docker labels (
traefik.enable=true)
Middleware
| Middleware |
Purpose |
crowdsec@file |
CrowdSec integration (ForwardAuth to traefik-bouncer:8080) |
my-geoblock |
Geographic block - allows only Switzerland (CH) + local ranges |
Plugin
Storage
| Path |
Contents |
./traefik/config/ |
traefik.yml, dynamic_conf.yml |
./traefik/letsencrypt/acme.json |
TLS certificates |
./traefik/logs/access.log |
Access logs (consumed by CrowdSec and Promtail) |
Dependencies
- CrowdSec - analyzes
access.log, bouncer blocks bad IPs
- Promtail - ships
access.log to Loki
- Prometheus - built-in Traefik metrics
- Every service with
traefik.enable=true is auto-registered
Useful Commands
# Follow Traefik logs
docker compose logs -f traefik
# Check certificate file permissions (must be 600)
ls -la traefik/letsencrypt/acme.json
# Dynamic config reload (no restart needed)
# Traefik auto-detects changes in dynamic_conf.yml
# Restart
docker compose restart traefik
blasebast
9b069a15c4