Traefik as reverse proxy: installation, configuration and use

Traefik as a reverse proxy: installation, configuration, and usage

This article explains how to install and configure Traefik as an HTTP reverse proxy and load balancer, for both local development and Kubernetes environments.

Prerequisites

- Docker (version 20.10 or higher) for local development - Kubernetes cluster (version 1.24 or higher) for production deployments - Helm (version 3.0 or higher) for Kubernetes installation - Access to a domain or wildcard DNS for HTTPS configuration

Steps

1. Install Traefik locally with Docker

Start Traefik with the default settings. This runs the reverse proxy on port 80 and 8080 (dashboard).

docker run -d -p 80:80 -p 8080:8080 --name traefik traefik:v3.1

2. Configure Traefik with a configuration file

Create a configuration file in TOML format for more advanced setups. This file defines entrypoints, providers, and the dashboard.

[entryPoints]
  [entryPoints.web]
    address = ":80"
  [entryPoints.websecure]
    address = ":443"</p><p>[providers]
  [providers.docker]
    endpoint = "unix:///var/run/docker.sock"
    exposedByDefault = false</p><p>[api]
  dashboard = true

Start Traefik with this configuration file:

docker run -d -p 80:80 -p 443:443 -p 8080:8080 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd)/traefik.toml:/etc/traefik/traefik.toml \
  --name traefik traefik:v3.1

3. Route traffic to services via Docker labels

Add Docker labels to containers to detect them automatically. Traefik reads these labels and routes traffic to the correct service.

docker run -d \
  --label "traefik.enable=true" \
  --label "traefik.http.routers.api.rule=Host(\`api.localhost\`)" \
  --label "traefik.http.services.api.loadbalancer.server.port=5000" \
  --name api my-api-image:latest

4. Configure HTTPS with automatic certificates

Enable automatic TLS certificates via Let's Encrypt. Traefik requests certificates and renews them automatically.

[certificatesResolvers.letsencrypt]
  [certificatesResolvers.letsencrypt.acme]
    email = "admin@example.com"
    storage = "/letsencrypt/acme.json"
    [certificatesResolvers.letsencrypt.acme.tlsChallenge]

5. Add middleware for authentication and rate limiting

Define middleware in the configuration file for traffic management. This adds authentication, rate limiting, and header manipulation.

[http.middlewares]
  [http.middlewares.rate-limit]
    [http.middlewares.rate-limit.rateLimit]
      average = 100
      burst = 50</p><p>  [http.middlewares.auth]
    [http.middlewares.auth.basicAuth]
      users = ["admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]

6. Install Traefik as an Ingress Controller in Kubernetes

Use Helm to install Traefik in your cluster. This installs Traefik as an Ingress Controller with automatic configuration.

helm repo add traefik https://helm.traefik.io/traefik
helm repo update
helm install traefik traefik/traefik --values values-prod.yaml

7. Define Ingress routes in Kubernetes

Create Ingress resources to route traffic to services within your cluster.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
spec:
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 5000

8. Update Traefik with atomic rollback

Update Traefik with Helm. The `--atomic` flag ensures that if an error occurs, it automatically rolls back to the previous version.

helm upgrade traefik traefik/traefik --atomic --values values-prod.yaml

Verification

Check that Traefik works correctly. The dashboard shows active routers, services, and middleware.

Local: check if the dashboard is reachable
curl -I http://localhost:8080</p><p>Kubernetes: check the status of the Traefik pod
kubectl get pods -n default -l app.kubernetes.io/name=traefik</p><p>Kubernetes: check the Ingress resources
kubectl get ingress

Common issues

1. Traefik does not detect Docker containers

Check that the Docker socket is correctly mounted and that the `exposedByDefault` setting is not set to `true`. Add `traefik.enable=true` explicitly to each container you want to expose.

2. HTTPS certificates are not created

Check that port 443 is open and that the `acme.json` file is writable. Note: Let's Encrypt has rate limits per domain — too many requests within an hour blocks new certificates.

3. CORS errors during local development

This happens when services run on different ports. Use Traefik with subdomains (for example, `api.localhost` and `app.localhost`) so that all requests go through the same domain. Configure CORS middleware if you need cross-origin requests.

Traefik continues to evolve — the next major version adds support for service mesh integrations and improved observability.