Deploy Traefik with Dokploy

Dokploy is an open-source server management platform that simplifies deploying Docker Compose applications on your VPS. It handles reverse proxy configuration, SSL certificates, and deployment management. Notably, Dokploy itself uses Traefik internally as its reverse proxy — this guide deploys a separate, standalone Traefik instance for advanced routing scenarios or custom configurations beyond Dokploy's built-in proxy.

This guide walks you through deploying Traefik with its dashboard, automatic Let's Encrypt certificates, and persistent ACME storage.

Prerequisites

• A VPS with at least 1 vCPU, 1 GB RAM, and 5 GB storage
• Dokploy installed and running on your server (installation docs)
• A domain name (e.g., traefik.yourdomain.com) with DNS A record pointing to your server's IP
• Understanding that Dokploy already includes Traefik — only deploy a standalone instance if you need custom routing rules

Docker Compose Configuration

Create a new Compose project in Dokploy and paste the following configuration:

version: "3.8"

services:
  traefik:
    image: traefik:v3.3
    restart: unless-stopped
    ports:
      - "8880:80"
      - "8843:443"
      - "8880:8080"
    command:
      - "--api.dashboard=true"
      - "--api.insecure=false"
      - "--ping=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/acme/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--providers.file.watch=true"
      - "--log.level=INFO"
    volumes:
      - ../files/traefik-acme:/acme
      - ../files/traefik-config:/etc/traefik/dynamic
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 10s
      retries: 3

Note: This deploys a standalone Traefik instance on non-standard ports (8880/8843) to avoid conflicting with Dokploy's built-in Traefik on ports 80/443. Adjust the port mappings based on your network setup. The dashboard is exposed via the API on port 8080 internally.

Environment Variables

Set these in Dokploy's Environment tab for your compose project:

Variable	Purpose	Example
ACME_EMAIL	Email for Let's Encrypt certificate registration	admin@yourdomain.com

In Dokploy, environment variables are set via the Environment editor in the project settings. Do not create a .env file manually — Dokploy manages this for you. Most Traefik configuration is done via command-line flags and dynamic configuration files.

Volumes & Data Persistence

This setup uses Dokploy's ../files convention for bind-mounted volumes:

• ../files/traefik-acme — ACME/Let's Encrypt certificate storage (acme.json)
• ../files/traefik-config — Dynamic configuration files for routers, middlewares, and services

The ../files path is relative to the compose file inside Dokploy's project directory. This ensures your data persists across redeployments. Avoid using absolute paths (e.g., /opt/traefik) because Dokploy may clean them during redeployment.

Important: The acme.json file must have 600 permissions. If Traefik logs permission warnings, run chmod 600 ../files/traefik-acme/acme.json on your server.

Domain & SSL Setup

1. In your Dokploy project, navigate to the Domains tab
2. Click Add Domain and enter your domain (e.g., traefik.yourdomain.com)
3. Set the container port to 8080 (Traefik dashboard/API port)
4. Enable HTTPS — Dokploy automatically provisions a Let's Encrypt SSL certificate
5. Save and wait for the certificate to be issued (usually under a minute)

Dokploy's built-in Traefik reverse proxy handles TLS termination for the dashboard. Your standalone Traefik instance manages its own certificates for services it proxies.

Verifying the Deployment

1. In Dokploy, go to your project's Deployments tab and click Deploy
2. Watch the build logs — you should see the traefik container pull and start
3. Check the Logs tab for the traefik service. Look for: Configuration loaded from flags
4. Open https://traefik.yourdomain.com in your browser — you should see the Traefik dashboard
5. Verify the entrypoints (web/websecure) are listed and active
6. Add a dynamic configuration file in ../files/traefik-config/ to route traffic to your services

Troubleshooting

Port conflicts with Dokploy's Traefik Dokploy's built-in Traefik already binds to ports 80 and 443. This standalone instance uses alternative ports (8880/8843) to avoid conflicts. If you need ports 80/443, stop Dokploy's Traefik first — but this will break Dokploy's own domain routing.

ACME certificate errors Ensure acme.json has 600 permissions and the ACME email is valid. Check Traefik logs for certificate resolver errors. If using HTTP challenge, the standalone Traefik must be reachable on its HTTP port from the internet.

Dashboard returns 404 The dashboard requires --api.dashboard=true in the command flags. If you set --api.insecure=false, the dashboard is only available through a properly configured router with authentication middleware.

SSL certificate not issuing Ensure your domain's DNS A record points to your server's IP and has propagated. Dokploy uses Let's Encrypt HTTP-01 challenges, so port 80 must be accessible. Check Traefik logs in Dokploy for certificate-related errors.

---

Learn more about Traefik in our complete overview.

Need a VPS? Hostinger VPS starts at $4.99/mo — perfect for running Traefik.

---

For more on Docker Compose deployments in Dokploy, see the Dokploy Docker Compose documentation.

App data sourced from selfh.st open-source directory.