Traefik — Reverse Proxy

If you like this project, consider supporting me on Buy Me a Coffee ☕️

tags:

• web
• traefik
• proxy
• ingress
• sysadmin

• linux

  🚦 Traefik Cheatsheet

Description

Traefik is a modern reverse proxy and ingress controller with automatic service discovery (Docker labels, Kubernetes IngressRoute). It auto-generates TLS certificates via Let's Encrypt. / Traefik — современный reverse proxy и ingress controller с авто-discovery сервисов и автоматическими TLS-сертификатами Let's Encrypt.

Common use cases / Типовые сценарии:

• Docker Compose reverse proxy / Reverse proxy для Docker Compose
• Kubernetes Ingress / Ingress для Kubernetes
• Automatic HTTPS with ACME / Автоматический HTTPS через ACMTraffic routing with middleware / Маршрутизация трафика с middleware

Status: Actively maintained (Traefik Labs / CNCF). Alternatives: Nginx, HAProxy, Caddy, Envoy. / Статус: активно развивается; альтернативы — Nginx, HAProxy, Caddy, Envoy.

Default ports: 80/tcp (HTTP), 443/tcp (HTTPS), 8080/tcp (dashboard/API).
Paths: config traefik.yml or Docker labels; data /etc/traefik/.

Cross-reference: Nginx, Caddy, HAProxy, Certbot, Docker.

Installation

Install Traefik / Установка Traefik

# Docker (most common)
docker pull traefik:v3.1
docker run -d \
  --name traefik \
  -p 80:80 -p 443:443 -p 8080:8080 \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  -v /etc/traefik/traefik.yml:/etc/traefik/traefik.yml:ro \
  traefik:v3.1

# Debian/Ubuntu
apt install traefik

traefik version

Configuration

Main files / Основные файлы

/etc/traefik/traefik.yml

/etc/traefik/dynamic/

/etc/traefik/certs/

Static config / Статическая конфигурация

/etc/traefik/traefik.yml

api:
  dashboard: true
  insecure: true

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /etc/traefik/dynamic
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: <ADMIN_EMAIL>
      storage: /etc/traefik/certs/acme.json
      httpChallenge:
        entryPoint: web

Dynamic middleware / Динамический middleware

/etc/traefik/dynamic/middleware.yml

http:
  middlewares:
    secure-headers:
      headers:
        frameDeny: true
        stsSeconds: 31536000
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
    retry:
      retry:
        attempts: 3

Docker labels / Docker labels

# docker-compose service labels
labels:
  - "traefik.enable=true"
  - "traefik.http.routers.myapp.rule=Host(`<HOST>`)"
  - "traefik.http.routers.myapp.entrypoints=websecure"
  - "traefik.http.routers.myapp.tls.certresolver=letsencrypt"
  - "traefik.http.services.myapp.loadbalancer.server.port=8080"
  - "traefik.http.routers.myapp.middlewares=secure-headers@file"

Core Management

Status / Статус

curl -s http://127.0.0.1:8080/api/overview
docker logs traefik --tail=50

API queries / Запросы к API

curl -s http://127.0.0.1:8080/api/http/routers | jq .
curl -s http://127.0.0.1:8080/api/http/services | jq .
curl -s http://127.0.0.1:8080/api/overview | jq '.http, .tcp, .udp'

Sysadmin Operations

Logs / Логи

docker logs -f traefik
journalctl -u traefik --no-pager -n 50

Logrotate / Ротация логов

/etc/logrotate.d/traefik

/var/log/traefik/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
}

Note: Docker deployments typically use json-file logging driver — rotate via Docker daemon config. / При Docker-развёртывании используйте json-file logging driver.

Security

Hardening checklist / Чек-лист ужесточения

1. Disable dashboard in production or bind to localhost / Отключите dashboard в проде
2. Enable TLS on entrypoints / Включите TLS
3. Use exposedByDefault: false / Не выставляйте контейнеры по умолчанию
4. Add rate limiting and security headers / Добавьте rate-limit и security headers
5. Restrict Docker socket access (read-only) / Ограничьте доступ к Docker socket
6. Keep Traefik updated (CVEs) / Обновляйте Traefik

# Disable dashboard in production
# api:
#   dashboard: false

Backup and Restore

Backup / Резервное копирование

tar czf /var/backups/traefik-$(date +%F).tar.gz /etc/traefik

Restore / Восстановление

systemctl stop traefik   # or docker stop traefik
tar xzf /var/backups/traefik-<DATE>.tar.gz -C /
systemctl start traefik  # or docker start traefik

Troubleshooting

curl -s http://127.0.0.1:8080/api/http/routers | jq '.[] | {name, rule, status}'
docker logs traefik --tail=100

Comparison Tables

Reverse proxies / Reverse proxy

Production Runbooks

Runbook: New service behind Traefik / Новый сервис за Traefik

1. Deploy service with Traefik labels / Развернуть сервис с labels
2. Confirm router appears in API / Проверить router в API
3. Verify HTTPS cert issued / Проверить выпуск TLS
4. Test security headers / Проверить security headers
5. Document router name and domain / Зафиксировать router и домен

Runbook: ACME cert renewal failure / Сбой продления ACME

1. Check rate limits on Let's Encrypt / Проверить rate limits
2. Verify port 80 reachable for challenge / Проверить доступность port 80
3. Inspect acme.json permissions (600) / Проверить права acme.json
4. Force renew via Traefik restart / Принудительно продлить
5. Consider staging endpoint for testing / Используйте staging для тестов

Documentation Links

• Traefik docs — https://doc.traefik.io/traefik/
• Traefik GitHub — https://github.com/traefik/traefik
• Traefik ACME — https://doc.traefik.io/traefik/https/acme/
• Traefik Docker provider — https://doc.traefik.io/traefik/providers/docker/