Traefik: Self-Hosted Cloud-Native Reverse Proxy

Traefik is a modern reverse proxy and load balancer designed for cloud-native environments. With over 61,000 GitHub stars, it has become the default edge router for Docker and Kubernetes deployments. What sets Traefik apart is automatic service discovery — it watches your Docker daemon, Kubernetes API, or other orchestrators and automatically configures routing rules as services start and stop. No manual configuration files to update when you deploy a new service.

Self-hosting Traefik gives you a production-grade traffic management layer that adapts to your infrastructure in real time.

Key Features

• Automatic service discovery for Docker, Kubernetes, Consul, Rancher, and more
• Let's Encrypt integration with automatic certificate provisioning and renewal
• HTTP/2 and HTTP/3 (QUIC) support for modern protocol performance
• Built-in middleware for rate limiting, authentication, headers, circuit breakers, and retries
• Weighted round-robin and sticky session load balancing across backends
• Real-time dashboard showing all routes, services, and middleware in your cluster
• TCP and UDP routing alongside HTTP for non-web services
• Canary deployments and traffic mirroring for safe rollouts

Why Self-Host Traefik?

Zero-configuration service routing. When you deploy a new Docker container with the right labels, Traefik automatically creates the route, obtains an SSL certificate, and starts serving traffic. No config files to edit, no proxy reload needed. This is transformative for teams deploying services frequently.

Docker-native architecture. Traefik integrates directly with the Docker socket to discover containers. Self-hosting Traefik on your VPS alongside Docker Compose gives you a powerful, automated reverse proxy that understands your service topology.

Middleware without complexity. Need rate limiting on one service and basic auth on another? Traefik's middleware chain lets you compose traffic policies per-route using simple labels or configuration. No separate WAF or API gateway needed for common traffic management tasks.

Production-proven reliability. Traefik handles millions of requests per second at organizations worldwide. Self-hosting gives you this enterprise-grade traffic management on your own VPS with no SaaS fees.

System Requirements

Resource	Minimum	Recommended
CPU	1 vCPU	2 vCPUs
RAM	256 MB	1 GB
Storage	5 GB SSD	10 GB SSD
OS	Ubuntu 22.04+	Ubuntu 24.04

Traefik is a single Go binary that uses minimal resources. Memory usage scales with the number of routes and active connections. For a typical self-hosted setup with 10-20 services, Traefik barely uses 100 MB of RAM.

Getting Started

Deploy Traefik on your VPS using Docker Compose through Dokploy. Our guide covers Docker provider configuration, automatic HTTPS with Let's Encrypt, dashboard access, middleware setup, and routing to multiple backend services.

Deploy Traefik with Dokploy →

Alternatives

• Caddy — Web server with automatic HTTPS and a simple Caddyfile configuration format
• Nginx Proxy Manager — GUI-based Nginx reverse proxy for users who prefer a visual interface
• HAProxy — High-performance load balancer for demanding TCP/HTTP traffic scenarios
• Envoy — Cloud-native proxy designed for service mesh architectures

FAQ

How does Traefik discover services automatically? Traefik connects to provider APIs (Docker socket, Kubernetes API, Consul catalog) and watches for changes. When a new container starts with Traefik labels, it reads the routing rules from those labels and configures the route instantly. When the container stops, the route is removed automatically.

What is the difference between Traefik and Nginx? Nginx requires manual configuration files that you edit and reload when services change. Traefik discovers services automatically through container labels or API integration. Nginx is faster for static file serving; Traefik is more powerful for dynamic container environments where services come and go.

Does Traefik support automatic HTTPS? Yes. Traefik integrates with Let's Encrypt and supports HTTP and DNS challenge types for automatic certificate provisioning. Certificates are obtained when routes are created and renewed before expiration without manual intervention.

Can Traefik handle TCP and UDP traffic? Yes. Beyond HTTP routing, Traefik can route raw TCP and UDP connections to backend services. This is useful for databases, game servers, DNS, and other non-HTTP services that need load balancing or TLS termination.

---

App data sourced from selfh.st open-source directory.