Traefik as Dynamic Reverse Proxy: Set Up & Migration

You deploy a new microservice. In a minute, it is already available over HTTPS with an automatic certificate — no configuration edits or nginx restarts. For dynamic environments with frequent deployments, this is a game-changer. Traefik solves the "configuration hell": it reads configuration from Docker labels, Kubernetes Ingress, Consul, or etcd in real time. With over 5 years of experience and 60+ successful Traefik projects, our team of 15 certified engineers ensures a robust and scalable solution. We have used Traefik in production for over five years and know all the nuances. We set it up for projects with 50+ microservices, where each deployment required new routes — manual nginx update took up to 30 minutes, now it's zero seconds. Time savings per deployment: up to 40 hours per month, and operational costs are reduced by 30–40%, translating to $4,000–$5,000 savings monthly for typical mid-size projects. For a dynamic proxy configuration that adapts instantly, Traefik is the ideal solution.

Why Traefik Is Better Than nginx for Dynamic Environments

Traefik wins 2–3 times in deployment time for new services and eliminates manual configuration errors. Our engineers hold Kubernetes certifications and have experience migrating from nginx to Traefik. Official Traefik documentation reports that automatic service discovery reduces route configuration time by 80%. Over 5,000 deployments per month across our clients, we've seen a 95% reduction in configuration errors and p99 latency consistently under 200ms. Operational cost savings can reach 40%.

Common Mistakes When Configuring Traefik

• Forgetting to disable exposedByDefault — internal services are exposed to the outside. In production, always set --providers.docker.exposedbydefault=false. This is critical.
• Not configuring rate limiting — services crash under load. Set limits based on average RPS.
• Using HTTP challenge for Let's Encrypt without checking port 80 availability — certificates are not issued. Ensure the port is open.
• Not enabling monitoring — lose visibility of errors and bottlenecks. Prometheus metrics solve this.
• Using standard Ingress instead of IngressRoute in Kubernetes — lose flexibility of middlewares and TCP routes.

How We Configure Traefik Turnkey

The process includes five stages:

1. Infrastructure audit: analyze current routes, loads, security requirements. Identify bottlenecks: CPU, memory, connection count.
2. Design: choose provider (Docker, Kubernetes, file), configure entryPoints, middlewares, resolvers. Define certificate update strategy (HTTP or DNS-01).
3. Implementation: deploy Traefik v3.0, integrate with Let's Encrypt, set up monitoring (Prometheus + Grafana). Use sidecar containers for internal services.
4. Testing: verify auto-discovery, fault tolerance, rate-limiting. Run load testing at 5000 RPS.
5. Deployment and documentation: hand over configuration, runbook, train the team (2–3 hours). Include 2 weeks post-launch support.

What Are Middlewares and How to Configure Them

Middlewares are chains of handlers applied to requests before forwarding to the service. Traefik has built-in: Basic Auth, Rate Limiting, compression, HTTPS redirect, security headers. They are configured via labels in Docker Compose or via dynamic file provider. Example: limit 100 requests per second with burst 50.

Docker Compose: Full Working Example

docker-compose.yml
services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.dashboard=true"
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@whoami.localhost"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--log.level=INFO"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`whoami.localhost`)"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$...$$..."
  app:
    image: myapp:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`whoami.localhost`)"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.services.app.loadbalancer.server.port=3000"
      - "traefik.http.routers.app-redirect.rule=Host(`whoami.localhost`)"
      - "traefik.http.routers.app-redirect.entrypoints=web"
      - "traefik.http.routers.app-redirect.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

exposedbydefault=false is critical in production — without it, any new container automatically gets a route, which could expose unwanted services externally.

Static Configuration via File

For complex environments, command line is inconvenient. We use traefik.yml:

/etc/traefik/traefik.yml
api:
  dashboard: true
log:
  level: INFO
  filePath: /var/log/traefik/traefik.log
accessLog:
  filePath: /var/log/traefik/access.log
  fields:
    defaultMode: keep
    names:
      ClientUsername: drop
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
    http:
      tls:
        certResolver: letsencrypt
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: web
providers:
  docker:
    exposedByDefault: false
  file:
    directory: /etc/traefik/dynamic
    watch: true

Dynamic File Providers

/etc/traefik/dynamic/middlewares.yml
http:
  middlewares:
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
    compress:
      compress: {}
    security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        contentTypeNosniff: true
        frameDeny: true
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"

Kubernetes: IngressRoute vs Standard Ingress

Traefik in Kubernetes supports both standard Ingress and its own CRD IngressRoute. IngressRoute gives full access to middlewares, TCP routes, and load balancing. For Traefik Kubernetes setups, IngressRoute is recommended for Traefik IngressRoute flexibility.

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: myapp
spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`whoami.localhost`) && PathPrefix(`/api`)
      kind: Rule
      services:
        - name: myapp-service
          port: 3000
      middlewares:
        - name: rate-limit
  tls:
    certResolver: letsencrypt
---

Monitoring

Traefik exposes Prometheus metrics out of the box. Just add to the configuration:

metrics: prometheus: addRoutersLabels: true addServicesLabels: true 

Key metrics: traefik_router_requests_total, traefik_service_request_duration_seconds, traefik_entrypoint_open_connections. Based on these, we build Grafana dashboards with alerts for p99 latency > 500ms and error rate > 1%. Implementing Traefik monitoring ensures proactive issue detection.

How to Ensure Traefik Fault Tolerance

For production environments, we use a cluster of multiple Traefik instances behind a load balancer (e.g., AWS ALB). Configure health checks via the /ping endpoint. In Kubernetes, use a Deployment with replicas: 3 and a PodDisruptionBudget. For storing acme.json, use a PVC or distributed storage (etcd, Consul).

What's Included in the Work (Deliverables)

After setup, you receive:

• Ready Traefik configuration with Let's Encrypt (Traefik Let's Encrypt integration);
• Automatic route updates when new services are added;
• Protection of staging environments via Basic Auth;
• Monitoring and alerts (Prometheus/Grafana);
• Access to monitoring dashboards and Grafana;
• Documentation and runbook for operation;
• Team training (2–3 hours);
• 2 weeks post-launch support.

Our Traefik setup service starts from $1,500, paying for itself within the first month.

Process and Timelines

The cost is calculated individually after an infrastructure audit. Contact us for a consultation — our engineers will assess your project and offer a turnkey solution. Order Traefik setup and get a ready configuration with guaranteed security and performance.