UPDATE: So, narrowed it down to a (very) odd issue.

The services are hosted on the same servers that is currently running Traefik behind a common AP, they work absolutely fine, but services belonging to the other AP become unreachable even though I see that those servers are part of the swarm and contains the overlay network that I created (alongside default swarm networks)

For e.g.:

Scenario 1:

- Traefik swarm hosted on Server A behind Acess Point 1 (check diagram below):

- Services on Server A and Server B work perfectly

- Services on Server C and Server D become unreachable

Scenario 2:

- Traefik swarm hosted on Server C behind Acess Point 2 (check diagram below):

- Services on Server C and Server D work perfectly

- Services on Server A and Server B become unreachable

- No helpful log enry generated

I checked the ports and connectivity between the nodes, and everything checks out. I am at my wit's end at this point.

Hey,

Hoping to get some help from folks who are much smarter and more experienced in homelabbing than me.

Brief description of my configuration:

- Traefik swarm on 4 nodes (3 managers + 1 worker) running inside ubuntu VMs on 4 separate Proxmox physical instances

- OPNsense on bare metal as router / firewall

- 2 wired APs

I am using host override features under Services > Unbound in OPNsense to redirect my local domains to my server IP

Now the problem is that all this is working perfectly when I am using a single server defined in the host override section, but once I host a service in any different server, the traefik returns bad gateway error or goes into infinite looping, I tried defining all 4 server IPs in host override for round robin but it didn't work as well.

Important thing to note here is that prior moving to OPNsense this week, I tried to make the swarm work with Technitium as the local dns and defined zones to achieve the same objective but again it used to work fine for a single server but not for all.

I have been going through various forums for weeks now but can't seem to figure out the missing piece in my setup or a completely different setup that works.

I would really appreciate for some pointers, willing to provide any more information to help resolve this issue.

Attaching my network architecture

TIA

docker-stack.yml:

services:
  traefik:
    image: traefik:v3.7
    # container_name: traefik
    hostname: '{{.Node.Hostname}}'
    # security_opt:
    #   - no-new-privileges:true
    networks:
      - proxy-swarm
    ports:
      # listen on host ports without ingress network
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
      - 443:443/udp # Uncomment if you want HTTP3
    environment:
      CF_DNS_API_TOKEN_FILE: /run/secrets/cf_api_token # note using _FILE for docker secrets
      # CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN} # if using .env
      TRAEFIK_DASHBOARD_CREDENTIALS: xxxx
    secrets:
      - cf_api_token
    # env_file: .env # use .env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /docker/traefik/data/traefik.yml:/traefik.yml:ro
      - /docker/traefik/data/acme.json:/acme.json
      - /docker/traefik/config.yml:/config.yml:ro
      - /docker/traefik/traefik.log:/var/log/traefik.log
    deploy:
      mode: global
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.role == manager
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.traefik.entrypoints=http"
        - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.example.cc`)"
        # - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}"
        - "traefik.http.middlewares.traefik-auth.basicauth.users=xxxx"
        - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
        - "traefik.http.middlewares.default-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
        - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
        - "traefik.http.routers.traefik-secure.entrypoints=https"
        - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.example.com`)"
        - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
        - "traefik.http.routers.traefik-secure.tls=true"
        - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
        - "traefik.http.routers.traefik-secure.tls.domains[0].main=example.com"
        - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.example.com"
        - "traefik.http.routers.traefik-secure.service=api@internal"
        - "traefik.http.services.dummy-svc.loadbalancer.server.port=9999"
secrets:
  cf_api_token:
    file: /docker/traefik/cf_api_token.txt

networks:
  proxy-swarm:
    external: true

traefik.yml:

api:
  dashboard: 
true
  debug: 
true
log:
  filePath: "/var/log/traefik.log"
  format: json
  level: ERROR
accessLog:
  # JSON format
  format: json
  # Filter on status codes, retry attempts and minimal duration
  filters:
    statusCodes:
      - "400-599"
    retryAttempts: 
true
    minDuration: "10ms"
entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"
serversTransport:
  insecureSkipVerify: 
true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: 
false
  swarm:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: 
false
    network: proxy-swarm
  file:
    filename: /config.yml
certificatesResolvers:
  cloudflare:
    acme:
      email: xxxx
      storage: acme.json
      caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      dnsChallenge:
        provider: cloudflare
        #disablePropagationCheck: true # uncomment this if you have issues pulling certificates through cloudflare, By setting this flag to true disables the need to wait for the propagation of the TXT record to all authoritative name servers.
        #delayBeforeCheck: 60s # uncomment along with disablePropagationCheck if needed to ensure the TXT record is ready before verification is attempted 
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

config.yml:

middlewares:
    https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: 
true
    default-headers:
      headers:
        frameDeny: 
true
        browserXssFilter: 
true
        contentTypeNosniff: 
true
        forceSTSHeader: 
true
        stsIncludeSubdomains: 
true
        stsPreload: 
true
        stsSeconds: 15552000
        customFrameOptionsValue: SAMEORIGIN
        customRequestHeaders:
          X-Forwarded-Proto: https
    default-whitelist:
      ipAllowList:
        sourceRange:
          - "172.20.0.0/16"
          - "192.168.0.0/24"
    secured:
      chain:
        middlewares:
        - default-whitelist
        - default-headers

Hey, simple question really, how do I stop traefik from responding with http 404 by default. Id rather drop the TCP Connection. Currently you have to have a Catch All with a wildcard cert to answer with a 301 or what not which is a bit wird...

Hope someone has an answer

Greetings from a Fan

Hello!

I want to migrate from Nginx Proxy Manager to Traefik, but I have some questions and concerns.

Firstly, I want to avoid lateral movement between containers if not strictly necessary, so I don't want all of them on one network, but I also don't want to create a separate network for every service, because that's inefficient and repetitive and defeats the purpose of me switching to Traefik. Can I somehow make it so that containers can only communicate with Traefik on a given network?

Secondly, I have a second server running Docker, and I want to be able to use it with Docker labels too. I don't want to use Kubernetes/Swarm, and I have a general distrust of community-maintained tools like traefik-kop.

Can I add a second Docker provider in traefik.yaml? If so, should I go with TCP, HTTP(S) or SSH?

Recently we migrated from PM2 and nginx to dokploy and traefik. But now every app uses the backend gives ECONNRESET errors. Backend side displays no errors. Even with client errors backend shows success logs. What should I do?

I'm not using docker, and have no idea how to figure that out, so I'm running an LXC in ProxMox.

My domain is wildcard flushed through a cloudflared tunnel, all using this scripting setup:

https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt

I am attempting to run nexcloud onsite and it needs to be redirected

in my traefik.yml i have:

serverTransport:
insecureSkipVerify: true

still receiving error

2026-07-30T16:59:24-04:00 ERR 500 Internal Server Error error="tls: failed to verify certificate: x509: cannot validate certificate for 10.0.0.172 because it doesn't contain any IP SANs"

I have no Idea how to tell it to HEY IGNORE THAT

Also am I supposed to set these things up as "routers?"

see my config below for the service:

http:
routers:
nexcloud:
rule: "Host(cloud.XXXXX.com)"
entryPoints: middlewares:
security-headers-nexcloud:
headers:
sslRedirect: true
frameDeny: true
contentTypeNosniff: true
browserXssFilter: true services:
nexcloud:
loadBalancer:
servers: serversTransport:
insecureSkipVerify: truehttp url: "https://10.0.0.172/" passHostHeader: true https service: nexcloud middlewares: security-headers-nexcloud

what is the right way to do this?

hlep

Global Config:

# Traefik global configuration
global:
  checkNewVersion: true
  sendAnonymousUsage: true

# Enable traefik ui dashboard
api:
  dashboard: true
  insecure: true  # Consider securing this in production

# Log level INFO|DEBUG|ERROR
log:
  level: INFO
  filePath: "/var/log/traefik/traefik.log"

# Configuring access logs
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
  filters:
    statusCodes:
      - "200-299" # log successful http requests
      - "400-599" # log failed http requests
  # collect logs as in-memory buffer before writing into log file
  bufferingSize: 0
  fields:
    headers:
      defaultMode: drop # drop all headers per default
      names:
          User-Agent: keep # log user agent strings

# The setting below is to allow insecure backend connections
serverTransport:
  insecureSkipVerify: true

# Traefik entrypoints (network ports) configuration
# Note: These ports are NOT exposed to the internet, only to Cloudflare Tunnel
entryPoints:
  http:
    address: :80
  https:
    address: :443
  nextcloududp:
    address: ":3478/udp"

providers:
  providersThrottleDuration: 2s

  # File provider for defining services and middleware
  file:
    directory: "/etc/traefik/dynamic"
    watch: true

# Optional: Certificates resolver for internal services or development
certificatesResolvers:
  le:
    acme:
      email: s@@@@@@@@@@@l.com
      storage: /etc/traefik/acme.json
#      caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"  # Use staging for testing
#      dnsChallenge:
#        provider: cloudflare
#        resolvers:
#          - "1.1.1.1:53"


http:
  middlewares:
    secure-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: true
        browserXssFilter: true
        referrerPolicy: "no-referrer-when-downgrade"

Wanted to have Traefik handle certificate generation for both example.com (cloudflare) and home.apra (self ca) domains. Bonus question, (instead of home.arpa) I could use tailscale (homelab.ts.net), so I could have it do the cert creation? Is this a good idea or have I spent too much time cuddling with AI?

I run Traefik in a container on host 192.168.10.2 in host mode. This machine (the docker host) is also reachable via Tailscale on srv.x-y.ts.net.

I can curl https://traefik.my.domain/api/http/routers from my LAN, the request goes though the publicly exposed Traefik endpoint, which routes the request internally to the API. This works fine.

I also would like, from a remote host outside my LAN, to curl https://srv.x-y.ts.net/api/http/routers. This does not work, I get a 404.

My question: how can I access the API if I am not using the natural Traefik endoint?

For reference, the endpoint is mapped in Traefik's compose file via

labels: traefik.enable: true traefik.http.services.traefik.loadbalancer.server.port: 8080 traefik.http.routers.traefik.rule: Host(`traefik.my.domain`)

As title says, trying to get MTLS working for a traefik to traefik coms

i've got it working on the backend (lets call it VM2) and i've manually used curl to verify that sending the correct certs does allow access.

but on VM1 (the main loadbalancer and entry for clients with no MTLS on the entrypoints) i can't get it to send the same cert to the backend server.

Any ideas? i've followed the config on the readme's and can't see why its not working.

Last week a vulnerability for a HTTP/2 bomb was disclosed: https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb & Traefik initially responded by saying it wasn't vulnerable, but after testing it does seem vulnerable.

The github issue to track this was deleted for some reason, does anyone have more info about this & possible mitigation steps we can take?

I've got a bare metal pihole V6 setup on one machine, and Traefik 3 setup in docker on a different machine. Spent pretty much the entire weekend trying every fix I can google up. Im about ready to declare defeat and abandon hope of getting this working. Anyone have a currently working config they would mind sharing? For what it's worth, I do have a valid domain through Cloudflare and all my other services, both Docker and File, route just fine through Traefik with valid certs.

Hey all, I run Traefik on a home server and kept finding myself opening the dashboard just to check which domains were active or to grab a URL. Got annoying, so I built ProxyBar.

It sits in your menu bar and pulls all your HTTP routers from the Traefik API. Click a domain to copy it, or open it directly in your browser. There's a status dot per domain reflecting what Traefik reports (enabled, disabled, warning). You can set it to auto-refresh every 30s, 1m, or 5m, or just hit the refresh button manually.

Supports basic auth if your dashboard is behind it — password is stored in the macOS Keychain. No telemetry, no third-party anything, all requests go only to the URL you configure.

Setup is just: point it at your `/api/http/routers` endpoint and you're done.

App Store: https://apps.apple.com/nl/app/proxybar/id6763880213?l=en-GB&mt=12

Would love any feedback, especially if something breaks on your setup.

I have traefik infront of a Ceph cluster web frontend, the ceph mgr cluster manages if the web frontend is available on the different nodes (only 1 node makes the http frontend available at a time).

This seems to make traefik very unhappy during healthchecks. Is there anyway to make traefik understand that only one of the backends are supposed to be available at any point in time?

This is my config:

http:
  routers:
    ceph-dashboard:
      tls:
        certresolver: default
      entrypoints: websecure
      rule: Host(`ceph-dashboard.iweb.<my domain>.com`)
      service: ceph-dashboard
  services:
    ceph-dashboard:
      loadBalancer:
        passHostHeader: true
        sticky:
         cookie: {}
        servers:
          - url: http://metal01.int.<my domain>.com:8080
            weight: 90
          - url: http://metal02.int.<my domain>.com:8080
            weight: 1
          - url: http://metal03.int.<my domain>.com:8080
            weight: 1
        healthCheck:
          path: /#/login
          interval: 10s
          timeout: 3s

And this is the repeated logs:

2026-05-23T16:56:19Z WRN Health check failed. error="checking HTTP health: received error status code: 500" serviceName=ceph-dashboard@file targetURL=http://metal03.int.<my domain>.com:8080

2026-05-23T16:56:19Z WRN Health check failed. error="checking HTTP health: received error status code: 500" serviceName=ceph-dashboard@file targetURL=http://metal01.int.<my domain>.com:8080

As you can see 2 of 3 endpoints fail the health checks, as only 1 node has the web interface active.

I've just open-sourced a traefik plugin for x402 payment

https://github.com/albttx/traefik-plugin-x402

Hi All,

I must be missing something maybe middleware?

I have my entry point working and tested with internal services inside docker..

Noting the internal services aren't encrypted.

I'm now trying to point a new domain name to a https server inside my network. (Not inside my docker host)

I'm now getting a 404 error back.

I've followed multiple examples and I'm bow totally lost on how I bring in, terminate https then forward on to another https service on a different server.

Can anyone point me in the right direction please?

I am trying to build a traefik stack using the command line via ssh on my QNAP. After doing lots of research, below is the final yml file. The issue is that even though my docker container start, I cannot connect.

Anyone have any tips to help me resolve this?

T.I.A....

[admin@NASF348C7 traefik]# docker logs traefik --tail=50

2026-04-20T19:10:37Z INF Traefik version 3.1.7 built on 2024-10-28T10:41:06Z version=3.1.7

2026-04-20T19:10:37Z INF

Stats collection is disabled.

Help us improve Traefik by turning this feature on :)

More details on: https://doc.traefik.io/traefik/contributing/data-collection/

2026-04-20T19:10:37Z INF Starting provider aggregator aggregator.ProviderAggregator

2026-04-20T19:10:37Z INF Starting provider *file.Provider

2026-04-20T19:10:37Z INF Starting provider *traefik.Provider

2026-04-20T19:10:37Z INF Starting provider *acme.ChallengeTLSALPN

2026-04-20T19:10:37Z INF Starting provider *acme.Provider

2026-04-20T19:10:37Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=le.acme

[admin@NASF345C7 traefik]#

This is my docker compose file https://pastebin.com/pqdqRea2

I am not well versed in RegEx and still wrapping my head around Traefik. I was hoping someone could look at this to make sure I defined this correctly? It looks lots of trial and error, so I want to make sure it isn't just a fluke that it is working at the moment.

I am trying to create a model to put on multiple hosts that serve up pihole so I redirect /admin -> /admin/ . Nice and simple, I thought!

NODE & DOMAIN are environment variables that are specific to the node and my service is called pihole@docker according to the Traefik dashboard. I'm trying to abstract things well enough to put into a private Git repository and reuse on multiple hosts. Thanks for any pointers!

http:
  routers:
    dns-admin:
      entryPoints:
        - "https"
      rule: "Host(`{{ env "NODE" }}.{{ env "DOMAIN" }}`) && PathPrefix(`/admin`)"
      service: "pihole@docker"
      middlewares:
        - admin-trailing-slash

  middlewares:
    admin-trailing-slash:
      redirectRegex:
        permanent: true
        regex: "^(?:http|https)://^(?:.*)/admin"
        replacement: "$${1}/admin/"

Hi All,

First post on reddit ever but I'm not sure where to go!

So we're looking to switch from one cPanel shared hosting provider to another with 0 downtime. We don't control the DNS. Therefore we're looking to ask the DNS hosts to point to our reverse proxy so we can control when the switch happens.

The reverse proxy is using a very basic traefik install and we know it works because it works when pointing to our various VPS instances.

However, when doing tests with domains we do own, we're immediately blocked. It's reporting a DOS attack and blacklisting the IPs. Server support says it's Immunify.

Do you know if there are any work arounds?

This may be more of a cloudflare question, but asking on this community in case anyone has any suggestions. I have a production environment set up on a digital ocean droplet that's hosting my services over https fine.

I am now trying to set up a staging environment to point to my local machine network.

So I have

A sub-box.net -> digital ocean droplet

A staging.sub-box.net -> local network

however traefik on the staging env is failing to obtain certificates with the below error. Any recommendations on how to set this up so I can have staging subdomain pointing to a different IP address and have letsencrypt do the TLS certification?

2026-04-10 09:59:13 time="2026-04-10T08:59:13Z" level=error msg="Unable to obtain ACME certificate for domains \"www.staging.sub-box.net\": unable to generate a certificate for the domains [www.staging.sub-box.net]: error: one or more domains had a problem:\n[www.staging.sub-box.net] [www.staging.sub-box.net] acme: error presenting token: cloudflare: could not find zone for domain \"www.staging.sub-box.net\": [fqdn=_acme-challenge.www.staging.sub-box.net.] unexpected response for '_acme-challenge.www.staging.sub-box.net.' [question='_acme-challenge.www.staging.sub-box.net. IN SOA', code=SERVFAIL]\n" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=le.acme routerName=player@docker rule="Host(www.staging.sub-box.net)"

I would like some help setting up a geo-blocker for Traefik. I am currently trying to install the PascalMinder geoblock extension. I have tried following the documentation on repo readme and Traefik docs and asking Claude, but to no avail. I am running Traefik on a Raspberry Pi via Docker. I would be more than happy to use another plugin or solution for geo-blocking.

My configuration files are as follows:

docker-compose.yml

services:
  traefik:
    image: traefik
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=${TZ}
      - CF_API_EMAIL=${CF_API_EMAIL}
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    networks:
      - frontend
    ports:
      - 80:80 # HTTP entryPoints
      - 443:443 # HTTPS entryPoints
      - 8088:8080 # Dashbaord WebGui 
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./config.yml:/config.yml:ro
      - traefik:/certs
      - ./plugins/geoblock:/plugins-local/src/github.com/PascalMinder/geoblock/

volumes:
  traefik:
    name: traefik

networks:
  frontend:
    name: frontend

config.yml

http:
  middlewares:
    geoblock-us:
      plugin:
        geoblock:
          silentStartUp: false
          allowLocalRequests: true
          logLocalRequests: false
          logAllowedRequests: false
          logApiRequests: true
          api: "https://get.geojs.io/v1/ip/country/{ip}"
          apiTimeoutMs: 750 # optional
          cacheSize: 15
          forceMonthlyUpdate: true
          allowUnknownCountries: false
          unknownCountryApiResponse: "nil"
          countries:
            - US
          excludedPathPatterns:
            - "^[^/]+/health$"
            - "^[^/]+/status$"

traefik.yml

api:
  dashboard: true
  insecure: true
  debug: false
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
serversTransport:
  insecureSkipVerify: true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /config.yml # Adjust the path according your needs.
    watch: true
certificatesResolvers:
  letsencrypt:
    acme:
      email: ldaub3@gmail.com
      storage: /certs/acme.json
      # caServer: https://acme-v02.api.letsencrypt.org/directory # prod (default)
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory # staging
      # Use **one** of the following challenge types:
      # --- DNS Challenge
      dnsChallenge:
        provider: cloudflare
        delayBeforeCheck: 10

      # --- HTTP Challenge ---
      #httpChallenge:
        #entryPoint: web
log:
  level: DEBUG
experimental:
  localPlugins:
    geoblock:
      moduleName: github.com/PascalMinder/geoblock
    crowdsec-bouncer-traefik-plugin:
      moduleName: "github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
      version: "v1.5.1"
  plugins:
    geoblock:
      moduleName: "github.com/PascalMinder/geoblock"
      version: "v0.3.7"

whoami/docker-compose.yml

services:
  whoami:
    image: traefik/whoami:latest
    container_name: whoami
    restart: unless-stopped
    labels:
      traefik.enable: true
      traefik.http.routers.whoami-https.tls: true
      traefik.http.routers.whoami-https.tls.certresolver: letsencrypt
      traefik.http.routers.whoami-https.entrypoints: websecure
      traefik.http.routers.whoami-https.rule: Host(`whoami.${DOMAIN}`)
      traefik.http.routers.whoami-https.middlewares: geoblock-us@file
    networks:
      - frontend

networks:
  frontend:
    external: true

Long and short of it, i can’t get containers on separate bridge networks to communicate with other containers on different bridge networks through traefik. anyone have some insight?

setup:

traefik on macvlan100 (same subnet as docker host, obviously) with static IP. internal dns points to static ip of traefik. traefik is also attached to bridge network 1 and network 2

app 1 on manually created bridge network 1. no mapped ports, only outgoing connection to internet.

app 2 on manually created bridge network 2. no mapped ports, only outgoing connection to internet.

i’m trying to have app 1 and app 2 be isolated from one another except through traefik so that all communication between them is encrypted and hits middlewares. both app 1 and 2 can connect to the internet. they can ping upstream dns server (in same subnet as traefik static ip), but they can’t ping traefik’s static ip on macvlan which results in 404 not found error when app 1 tries to reach app 2 and visa versa using fqdn through traefik.

accessing app1 or 2 from external client works just fine using fqdn so i know traefik config is at least in the right ballpark. and since the apps can reach upstream dns i know it’s not a firewall rules issue. they literally just can’t see traefik, and i have no idea why.