Traefik API Gateway Setup for Microservices

Imagine: you have 20 microservices, and every time you add a new one, you need to edit the Nginx config and reload it. One mistake and the entire routing goes down. We configure Traefik — a reverse proxy that automatically discovers services via Docker labels and updates routes in seconds. This speeds up deployment by 2-3x, reduces error risks by 40%, and saves up to 30% of your DevOps budget. With over 5 years working with Traefik, we've accumulated experience on projects with loads up to 10,000 RPS. For example, for a client with 50 microservices, we configured an API Gateway with canary deployments and JWT authentication, cutting rollout time from 30 to 10 minutes.

Why Traefik is Better Than Nginx for High Loads

Traefik is a reverse proxy written in Go, built for microservices. Its main advantage is automatic discovery via Docker, Kubernetes, or Consul. No need for complex configs: just add labels to containers. Traefik uses Docker events instead of polling, so routes update in under 100 ms. Compare with Nginx where manual editing and reloading causes 30 seconds of downtime. At 10,000 RPS, Traefik shows a latency of 25 ms vs. 30 ms for Nginx and consumes 20% less CPU. It supports SSL via Let's Encrypt, load balancing, middleware (rate limiting, JWT authentication), and canary deployments out of the box.

How to Set Up SSL Certificates with Let's Encrypt

Traefik automatically obtains and renews certificates via ACME provider. For the HTTP challenge, expose ports 80 and 443, specify email and challenge type. The static configuration in YAML or command line is minimal. The example below shows basic setup: certificate issues in seconds, renewal happens automatically, no admin intervention required.

How We Do It

We have over 5 years of experience with Traefik. We've configured API Gateways for projects with loads up to 10,000 RPS. Our stack includes Traefik v3.2, Docker Compose or Kubernetes, and Prometheus for monitoring. Static configuration is stored in YAML; dynamic rules come from providers.

Basic Installation via Docker Compose

---
version: '3.8'
services:
  traefik:
    image: traefik:v3.2
    command:
      - --api.dashboard=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - [email protected]
      - --certificatesresolvers.letsencrypt.acme.storage=/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --log.level=INFO
      - --accesslog=true
      - --metrics.prometheus=true
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./acme.json:/acme.json
    labels:
      - traefik.enable=true
      - traefik.http.routers.dashboard.rule=Host(`traefik.company.com`)
      - traefik.http.routers.dashboard.tls.certresolver=letsencrypt
      - traefik.http.routers.dashboard.middlewares=auth
      - traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$hash
  api-users:
    image: company/users-api:latest
    labels:
      - traefik.enable=true
      - traefik.http.routers.users-api.rule=Host(`api.company.com`) && PathPrefix(`/v1/users`)
      - traefik.http.routers.users-api.entrypoints=websecure
      - traefik.http.routers.users-api.tls.certresolver=letsencrypt
      - traefik.http.services.users-api.loadbalancer.server.port=3000
---

Static Configuration (traefik.yml)

---
api:
  dashboard: true
  insecure: false
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
providers:
  docker:
    exposedByDefault: false
    network: traefik
  file:
    directory: /etc/traefik/dynamic
    watch: true
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /acme.json
      tlsChallenge: {}
log:
  level: INFO
  format: json
accessLog:
  filePath: /var/log/traefik/access.log
  format: json
metrics:
  prometheus:
    addEntryPointsLabels: true
    addServicesLabels: true
    addRoutersLabels: true

Comparison of built-in Traefik middleware:

Dynamic Configuration with Traefik Middleware

# /etc/traefik/dynamic/services.yml
http:
  routers:
    legacy-api:
      rule: "Host(`api.company.com`) && PathPrefix(`/v0`)"
      service: legacy-backend
      middlewares: [strip-prefix-v0, rate-limit, add-headers]
      tls: {}
  services:
    legacy-backend:
      loadBalancer:
        servers:
          - url: "http://192.168.1.10:8080"
          - url: "http://192.168.1.11:8080"
        healthCheck:
          path: /health
          interval: 10s
          timeout: 3s
  middlewares:
    strip-prefix-v0:
      stripPrefix:
        prefixes: ["/v0"]
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1s
    add-headers:
      headers:
        customRequestHeaders:
          X-Internal-Source: traefik
        customResponseHeaders:
          X-Frame-Options: DENY
          X-Content-Type-Options: nosniff
        accessControlAllowMethods: [GET, POST, PUT, DELETE, OPTIONS]
        accessControlAllowHeaders: [Authorization, Content-Type]
        accessControlAllowOriginList:
          - https://app.company.com
    circuit-breaker:
      circuitBreaker:
        expression: "LatencyAtQuantileMS(50.0) > 100 || NetworkErrorRatio() > 0.30"

JWT Forward Auth

Traefik delegates JWT validation to an external service:

# dynamic/middlewares.yml
http:
  middlewares:
    jwt-auth:
      forwardAuth:
        address: "http://auth-service:4000/validate"
        trustForwardHeader: true
        authResponseHeaders:
          - X-User-ID
          - X-User-Role
          - X-Tenant-ID

The service returns 200 to allow, 401 to reject. Response headers are passed upstream.

How to Set Up Canary Deployment with Traefik

For canary deployments, use the weighted load balancer:

http:
  services:
    api-weighted:
      weighted:
        services:
          - name: api-v1
            weight: 90
          - name: api-v2
            weight: 10
    api-v1:
      loadBalancer:
        servers:
          - url: "http://api-v1:3000"
    api-v2:
      loadBalancer:
        servers:
          - url: "http://api-v2:3000"

Compare approaches: Nginx requires a reload after any change; Traefik updates rules in seconds. This is critical for CI/CD.

Process of Work

1. Analyze current architecture and requirements.
2. Develop static and dynamic configurations.
3. Set up SSL, middleware, monitoring.
4. Test in a staging environment.
5. Deploy to production with gradual traffic shifting.

What's Included

• Complete Traefik configuration (Docker Compose or Kubernetes).
• Let's Encrypt setup with automatic renewal.
• Middleware integration: rate limit, JWT, CORS.
• Prometheus and Grafana integration (dashboard ID 17347).
• Documentation of routes and access.
• 3 days of post-deployment support.

Timeline

Basic setup for Docker — from 1 working day. Full integration with Kubernetes, canary deployments, and JWT — up to 3 days. Exact timeline determined after project analysis.

Typical Mistakes

• Forgetting to secure Dashboard in production — always use basic auth or VPN.
• Not configuring healthCheck — the load balancer will send traffic to dead instances.
• Overly permissive CORS — only allow trusted origins.
• Ignoring circuit breaker — without it, a single service failure can break the whole system.

Compare for yourself: Traefik is 2-3 times faster to set up than Nginx and saves up to 30% on operational time. Get a consultation on API Gateway setup — we guarantee stable operation. See the quality: our engineers are certified and have implemented Traefik on 50+ projects. Order Traefik setup today.

Official Traefik Documentation