Traefik as the single entry point

Stage 2traefikdockerreverse-proxy

Starting point

The shared nginx was web server, proxy and certificate manager in one. Every new application would have bloated it further.

Decision

Traefik v3 becomes the only service that occupies ports 80 and 443 on the host. Everything else sits in internal Docker networks and is reachable only through Traefik.

Implementation

  • Traefik runs as its own container, with its configuration in a Git repository.
  • Applications register themselves with labels, instead of me maintaining central config files.
  • I work directly on the server with VS Code Remote-SSH, so changes end up in the repository.
  • I rotated the database passwords as part of the rebuild.

Takeaway

A reverse proxy is an interface: whoever adds a new application only has to set labels and does not touch anyone else’s configuration.