This documentation is under development. Expect changes!

Traefik

Setup Directory Structure

Start by creating a folder to store all Traefik configuration files:

1
mkdir traefik
2
cd traefik
3
mkdir dynamic

Configuration Files

1. Docker Compose Configuration

Create a compose.yml file with the following content:

1
services:
2
    traefik:
3
        image: traefik:v3.6.14
4
        container_name: traefik
5
        restart: always
6
        volumes:
7
            - ./traefik.yml:/etc/traefik/traefik.yml
8
            - ./acme.json:/etc/traefik/certs/acme.json
9
            - ./dynamic:/etc/traefik/dynamic
10
            - /var/run/docker.sock:/var/run/docker.sock
11
        ports:
12
          - "80:80"
13
          - "443:443"
14
        networks:
15
          - proxy-net
16
        labels:
17
            traefik.enable: true
18
            traefik.http.routers.proxy.entrypoints: web,websecure
19
            traefik.http.routers.proxy.tls: true
20
            traefik.http.routers.proxy.tls.certresolver: production
21
            traefik.http.routers.proxy.rule: Host(`proxy.example.com`)
22
            traefik.http.routers.proxy.service: api@internal
23
            traefik.http.routers.proxy.middlewares: proxy-auth@file, me@file
24

25

26
networks:
27
    proxy-net:
28
        name: proxy-network
29
        driver: bridge


4 collapsed lines
17
...
18
            traefik.http.routers.proxy.entrypoints: web,websecure
19
            traefik.http.routers.proxy.tls: true
20
            traefik.http.routers.proxy.tls.certresolver: production
21
            traefik.http.routers.proxy.rule: Host(`proxy.example.com`)
4 collapsed lines
22
            traefik.http.routers.proxy.service: api@internal
23
            traefik.http.routers.proxy.middlewares: proxy-auth@file, me@file
24

25
...

2. Main Traefik Configuration

Create a traefik.yml file with the following content:

1
################################################################
2
# Global configuration
3
################################################################
4
global:
5
    checkNewVersion: true
6
    sendAnonymousUsage: false
7

8
################################################################
9
# EntryPoints configuration
10
################################################################
11
entryPoints:
12
    web:
13
        address: :80
14
        http:
15
          redirections:
16
            entryPoint:
17
              to: websecure
18
              scheme: https
19
    websecure:
20
        address: :443
21
    metrics:
22
        address: :8082
23

24
################################################################
25
# Traefik logs configuration
26
################################################################
27
log:
28
  level: INFO
29

30
#############################################################
31
# Access Log
32
#############################################################
33
accessLog: {}
34

35
##############################################################
36
# Metrics
37
##############################################################
38
metrics:
39
  prometheus:
40
    addEntryPointsLabels: true
41
    addServicesLabels: true
42
    addRoutersLabels: true
43
    entryPoint: metrics
44

45
##############################################################
46
# Plugin
47
##############################################################
48
experimental:
49
  plugins:
50
    umami-plugin:
51
      moduleName: github.com/astappiev/traefik-umami-feeder
52
      version: v1.4.1
53

54
################################################################
55
# API and dashboard configuration
56
################################################################
57
api:
58
    # Disable the API in insecure mode
59
    insecure: false
60

61
    # Enabled Dashboard
62
    dashboard: true
63

64
################################################################
65
# Ping configuration
66
################################################################
67

68
serversTransport:
69
  insecureSkipVerify: true
70

71
################################################################
72
# Docker configuration backend
73
################################################################
74
providers:
75
    # Enable Docker configuration backend
76
    docker:
77
        exposedByDefault: false
78
    file:
79
        filename: /etc/traefik/dynamic/conf.yml
80

81
################################################################
82
# -- Configure your CertificateResolver here...
83
################################################################
84
certificatesResolvers:
85
    staging:
86
        acme:
87
            email: your-email@example.com
88
            storage: /etc/traefik/certs/acme.json
89
            caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
90
            #-- (Optional) Remove this section, when using DNS Challenge
91
            httpChallenge:
92
                entryPoint: web
93
    production:
94
        acme:
95
            email: your-email@example.com
96
            storage: /etc/traefik/certs/acme.json
97
            caServer: "https://acme-v02.api.letsencrypt.org/directory"
98
            #-- (Optional) Remove this section, when using DNS Challenge
99
            httpChallenge:
100
                entryPoint: web

Update the Umami Plugin Version: Check the latest plugin version and update accordingly:

47
...
48
experimental:
49
  plugins:
50
    umami-plugin:
51
      moduleName: github.com/astappiev/traefik-umami-feeder
52
      version: v1.4.1
53
...

Update Your Email: Change the email address for ACME certificate generation to your email:

83
...
84
certificatesResolvers:
85
    staging:
86
        acme:
87
            email: your-email@example.com
88
            storage: /etc/traefik/certs/acme.json
89
            caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
90
            #-- (Optional) Remove this section, when using DNS Challenge
91
            httpChallenge:
92
                entryPoint: web
93
    production:
94
        acme:
95
            email: your-email@example.com
96
            storage: /etc/traefik/certs/acme.json
97
            caServer: "https://acme-v02.api.letsencrypt.org/directory"
98
            #-- (Optional) Remove this section, when using DNS Challenge
99
            httpChallenge:
100
                entryPoint: web

3. Dynamic Configuration with Middlewares

Create the file dynamic/conf.yml with the following content:

1
http:
2
    middlewares:
3
        my-umami:
4
            plugin:
5
                umami-plugin:
6
                    umamiHost: "https://umami.example.com"
7
                    umamiUsername: "username"
8
                    umamiPassword: "password"
9
                    createNewWebsites: true
10
                    ignoreUserAgents: ["Uptime-Kuma"]
11

12
        proxy-auth:
13
            basicauth:
14
                users: user:password
15
        me:
16
            ipAllowList:
17
                sourceRange:
18
                    - "1.2.3.4"

Understanding Middlewares

The conf.yml file defines several security middlewares that protect and monitor your Traefik instance:

my-umami Middleware

Integrates the Umami analytics plugin for traffic tracking:

1
...
2
    middlewares:
3
        my-umami:
4
            plugin:
5
                umami-plugin:
6
                    umamiHost: "https://umami.example.com"
7
                    umamiUsername: "username"
8
                    umamiPassword: "password"
9
                    createNewWebsites: true
10
                    ignoreUserAgents: ["Uptime-Kuma"]
11
...

What it does: Sends detailed metrics about every request passing through Traefik to your Umami analytics instance. Useful for monitoring traffic patterns and usage statistics.

proxy-auth Middleware

Protects your Traefik dashboard with HTTP Basic Authentication:

11
...
12
        proxy-auth:
13
            basicauth:
14
                users: user:password
15
...

MD5 (deprecated, not recommended):
Terminal window
```
1
openssl passwd -apr1 password
```
SHA1 (good):
Terminal window
```
1
openssl passwd -1 password
```

Bcrypt (most secure, recommended):

1
htpasswd -nbB admin mypassword
2
# Output: admin:$2y$05$abcdef...

Copy the hashed output and replace user:password in your configuration.

me Middleware

Restricts access by IP address to enhance security:

15
...
16
            ipAllowList:
17
                sourceRange:
18
                    - "1.2.3.4"
19
...

What it does: Only allows traffic from specified IP addresses. Perfect for restricting dashboard access to your local network or specific public IPs.

SSL Certificate Setup

The acme.json file stores your SSL certificates. Create it with the following command:

1
touch acme.json
2
echo "{}" > acme.json
3
chmod 600 acme.json

Verify Your Setup

Your final folder structure should look like this:

Directorytraefik/
- Directorydynamic/
  - conf.yml
- acme.json
- compose.yaml
- traefik.yml

Start Traefik

Once all configuration files are in place and you’ve updated the necessary values, start Traefik:

1
docker compose up -d

Access your Traefik dashboard at: https://proxy.your-domain.com/dashboard/ (or your configured domain)

Use your Basic Auth credentials to log in.