[{"data":1,"prerenderedAt":219},["ShallowReactive",2],{"seo-verification":3,"blog-traefik-v3-vps-docker-reverse-proxy-https-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-traefik-v3-vps-docker-reverse-proxy-https-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":29,"ctaBody":29,"ctaButton":150,"ctaUrl":151,"relatedPosts":152},434,"traefik-v3-vps-docker-reverse-proxy-https",{"fr":12,"en":10,"ar":13,"es":14},"traefik-v3-vps-reverse-proxy","traefik-v3-على-vps-ريفرس-بروكسي-docker","traefik-v3-vps-reverse-proxy-docker-https","Traefik v3 on VPS: Docker Reverse Proxy with Automatic HTTPS","Deploy Traefik v3 on your VPS: automatic HTTPS with Let's Encrypt, Docker label routing, secured dashboard.",9,0,false,"2026-10-12T00:00:00+00:00","2026-10-13T14:10:28+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},3,"Deployment","deploiement","bg-success\u002F10 text-success",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Ftraefik-v3-vps-reverse-proxy-poster.svg","You have three Docker containers on your VPS: a Node app, a Python backend, an admin tool. Each one listens on a different port, you manage certificates manually, and every new service means editing nginx and reloading the config. Traefik v3 solves exactly this: it reads Docker labels from your containers, configures routes in real time, autonomously renews Let's Encrypt certificates, and exposes a monitoring dashboard — without a single line of nginx configuration.",[34,38,49,52,74,77,84,87,90,98,137,140,147],{"type":35,"title":36,"body":37},"h2","Why Traefik v3 over nginx for your Docker stack","nginx is an excellent HTTP server, but its configuration is static: every new service requires a new vhost file, a process reload and often a manual update to ACME renewal. Traefik was built for containerized environments where topology changes constantly. In version 3, it takes this further with native HTTP\u002F3 (QUIC) support, a simplified middleware syntax, and a stricter runtime that rejects ambiguous configurations.",{"type":39,"items":40},"ul",[41,42,43,44,45,46,47,48],"Automatic container discovery via Docker labels — no manual reload when you add a service.","Automatic HTTPS with Let's Encrypt (TLS-ALPN-01 or HTTP-01 challenge): certificates obtained, stored and renewed without intervention.","Native middlewares declarable by label: BasicAuth, rate-limit, security headers, redirects — no nginx module to write.","Built-in real-time dashboard: view all routes, middlewares and certificate status from a browser.","HTTP\u002F3 (QUIC) support in a single config line: improves performance on high-latency connections.","Routing by Host, PathPrefix, Headers or any combination — rules are written in expressive Go template syntax.","Internal REST API: query router state, inspect active backends, automate CI\u002FCD integrations.","Compatible with Docker Swarm, Kubernetes and Nomad — migrate without changing your labels.",{"type":35,"title":50,"body":51},"Technical prerequisites before you start","This installation requires a VPS running Debian 12 or Ubuntu 22.04\u002F24.04 (commands are identical), Docker Engine 25+ and Docker Compose v2.24+ (the `docker compose` command without a hyphen). Check that ports 80 and 443 are open inbound from the Internet in your firewall. You need a domain name whose DNS you control: point an A record to your VPS IP before starting, otherwise Let's Encrypt cannot issue the certificate. A valid email address is required for ACME expiry notifications.",{"type":53,"title":54,"steps":55},"steps","Complete Traefik v3 installation step by step",[56,58,60,62,64,66,68,70,72],{"body":57},"**Create the shared Docker network.** Traefik must be on the same network as the services it proxies. Create it once: `docker network create traefik-public`. This network will be referenced in every service `docker-compose.yml`.",{"body":59},"**Create the `acme.json` file for certificates.** Let's Encrypt will write its certificates into this file. It must be owned by root with strictly 600 permissions: `touch \u002Fopt\u002Ftraefik\u002Facme.json && chmod 600 \u002Fopt\u002Ftraefik\u002Facme.json`. If permissions are wrong, Traefik will refuse to start.",{"body":61},"**Create the Traefik `docker-compose.yml`.** Place this file at `\u002Fopt\u002Ftraefik\u002Fdocker-compose.yml` with the full configuration including TLS entrypoints, the Let's Encrypt ACME resolver, and the protected dashboard labels.",{"body":63},"**Generate the BasicAuth hash for the dashboard.** Replace the hardcoded string with a real bcrypt hash: `echo $(htpasswd -nB admin) | sed -e 's\u002F\\$\u002F\\$\\$\u002Fg'`. The `htpasswd` command is in the `apache2-utils` package on Debian\u002FUbuntu. Dollar signs must be doubled (`$$`) in Docker Compose label values.",{"body":65},"**Start Traefik.** From `\u002Fopt\u002Ftraefik\u002F`: `docker compose up -d`. Check logs: `docker compose logs -f traefik`. You should see `\"Starting provider\" providerType=Docker` then `\"Attaching router\" routerName=dashboard`. An error on `acme.json` means wrong permissions.",{"body":67},"**Add a service behind Traefik.** In your application's `docker-compose.yml`, join the `traefik-public` network (as external) and add the four key labels: `traefik.enable=true`, the `Host()` rule, the `websecure` entrypoint, the `letsencrypt` certresolver, and the backend port. Traefik detects the container immediately after `docker compose up -d`.",{"body":69},"**Verify Let's Encrypt certificates.** Inspect `acme.json`: `cat \u002Fopt\u002Ftraefik\u002Facme.json | python3 -m json.tool | grep -A3 'domain'`. You should see your domains listed with an expiry 90 days out. Alternatively, the Traefik dashboard lists all active certificates under the *Routers* tab.",{"body":71},"**Validate the HTTP→HTTPS redirect.** Test with curl: `curl -v http:\u002F\u002Fapp.your-domain.com`. You must receive a `301 Moved Permanently` to `https:\u002F\u002F`. A connection refused on port 80 means firewall rules are blocking the port.",{"body":73},"**Enable HTTP\u002F3 on the browser side.** Add the `Alt-Svc` header via a global middleware in your Traefik labels or a static `traefik.yml` config file. The header `Alt-Svc: h3=\":443\"; ma=86400` tells the browser your server supports QUIC. Verify with `curl --http3 https:\u002F\u002Fapp.your-domain.com -v`.",{"type":35,"title":75,"body":76},"Essential middlewares: BasicAuth, rate-limit and security headers","Traefik middlewares are applied via Docker labels directly on the service router. Here are the three most useful middlewares in production, declared on the service itself without touching Traefik's central configuration.",{"type":39,"items":78},[79,80,81,82,83],"**BasicAuth on a private route** — to protect an admin tool (Adminer, Flower, etc.): add `traefik.http.middlewares.adminauth.basicauth.users=admin:$$hash$$` and `traefik.http.routers.myadmin.middlewares=adminauth` labels on the service.","**Rate-limit against abuse** — protects an API or contact form: set `ratelimit.average=100` (100 req\u002Fs average) and `ratelimit.burst=50` (burst of 50 tolerated), then apply the middleware on the router.","**HTTP security headers** — `X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`: Traefik's `headers` middleware accepts all these values directly as labels, no separate nginx config file needed.","**Redirect Regex** — to redirect `www.your-domain.com` to `your-domain.com`: use the `redirectregex` middleware with `permanent=true` and a regex `^https:\u002F\u002Fwww\\.(.+)` → `https:\u002F\u002F${1}`.","**Compress** — enable gzip\u002Fbrotli compression on all text responses with a single label: `traefik.http.middlewares.compress.compress=true`. Apply globally by adding it as a default middleware in the static configuration.",{"type":85,"body":86},"tip","**HTTP\u002F3 (QUIC) in two lines.** In the `command` section of Traefik's `docker-compose.yml`, add `--entrypoints.websecure.http3=true` and expose UDP port 443 (`443:443\u002Fudp`). QUIC establishes connections up to 30% faster on lossy networks and eliminates TLS-over-TCP head-of-line blocking. Modern browsers (Chrome 87+, Firefox 88+, Safari 16.4+) activate it automatically after the first exchange via the `Alt-Svc` header. No application-side changes are needed.",{"type":35,"title":88,"body":89},"Migrating from Traefik v2: breaking changes","Traefik v3 introduces intentional breaks with v2 to clean up accumulated ambiguities. The good news: migration is progressive — v2 and v3 configurations can coexist during the transition. Here are the most frequently breaking points.",{"type":39,"items":91},[92,93,94,95,96,97],"**`docker.swarmMode` renamed to `docker.swarmmode`** (all lowercase). If your v2 config uses the old casing, Traefik v3 silently ignores it and Swarm discovery doesn't work.","**`PathPrefix` rule without trailing slash**: in v3, `PathPrefix('\u002Fapi')` is equivalent to `PathPrefix('\u002Fapi\u002F')` — the trailing slash is normalized. If you had rules that depended on this behavior to distinguish `\u002Fapi` from `\u002Fapiv2`, revise them.","**`tls.certificates` in dynamic configuration**: in v2, you could define manual certificates directly in a file provider's dynamic config. In v3, this section must be in the static configuration (`traefik.yml`) or via a dedicated provider.","**`errors` middleware**: the `query` parameter is renamed to `url`. Any config using `errors.query` must be updated to `errors.url`.","**Removal of `spiffe` protocol support**: if you used SPIFFE authentication in a Consul infrastructure, migrate to a standard mTLS solution before upgrading to v3.","**Docker `constraints` configuration**: the constraints syntax has changed to align with the standard Docker tag format. Check your constraint list if you were filtering services by tag.",{"type":99,"title":100,"headers":101,"rows":106},"comparison","Traefik v3 vs nginx vs Caddy: which reverse proxy for Docker?",[102,103,104,105],"Criterion","Traefik v3","nginx","Caddy v2",[107,112,117,122,127,132],[108,109,110,111],"Configuration","Docker labels, TOML or YAML — automatic hot reload","Static vhost files — manual reload (`nginx -s reload`)","Declarative Caddyfile — automatic hot reload",[113,114,115,116],"Automatic HTTPS","Natively built-in (ACME v2, TLS-ALPN or HTTP-01 challenge)","Requires certbot + cron + reload script","Natively built-in, simplest to configure (one line)",[118,119,120,121],"Dynamic Docker routing","Native: real-time container discovery via Docker socket","Not native: requires nginx-proxy or manual modification","Native via caddy-docker-proxy plugin (unofficial)",[123,124,125,126],"HTTP\u002F3 (QUIC)","Natively supported since v3 (2024), one-line activation","Supported since nginx 1.25 (2023), extra configuration needed","Natively supported since Caddy 2.6 (2022)",[128,129,130,131],"Raw performance","Slightly below nginx at very high throughput (>50k req\u002Fs)","Industry reference for high throughput and concurrency","Comparable to nginx for most standard web workloads",[133,134,135,136],"Learning curve","Moderate — router\u002Fservice\u002Fmiddleware concepts to understand","High for HTTPS + Docker — fragmented documentation","Low — most concise configuration for simple cases",{"type":35,"title":138,"body":139},"Troubleshooting: the five most common errors","The majority of Traefik production issues come from three sources: `acme.json` file permissions, missing Docker network, and incorrectly escaped labels in Compose. Here are the errors with their actual messages.",{"type":39,"items":141},[142,143,144,145,146],"**`level=error msg=\"Unable to obtain ACME certificate\" error=\"acme: error 403\"` or `unauthorized`** — Let's Encrypt can't verify your domain. Check that port 80 is open from the Internet and that your domain's DNS points to your VPS IP.","**`level=error msg=\"The acme.json file has bad file permissions\"` then Traefik refuses to start** — file permissions are not 600. Fix: `chmod 600 \u002Fopt\u002Ftraefik\u002Facme.json`. This check is intentionally blocking: a world-readable file would expose your private keys.","**Service visible in Traefik dashboard but 502 Bad Gateway** — the service container is not on the `traefik-public` network. Check with `docker inspect \u003Ccontainer> | grep -A20 Networks`. Add the network in the service's `docker-compose.yml` and recreate the container.","**Labels silently ignored, route absent from dashboard** — you forgot `traefik.enable=true` on the service, or `--providers.docker.exposedbydefault=false` is active (recommended) and the label is missing. Also check that the router name in `traefik.http.routers.\u003Cname>.rule` is unique across all your services.","**`invalid character '$' in label value`** — dollar signs in BasicAuth hashes are not doubled in the Compose file. The correct syntax is `$$2y$$10$$...` (each `$` becomes `$$`) when the value is in a `docker-compose.yml`. If you pass the value via an environment variable, a single `$` is enough.",{"type":35,"title":148,"body":149},"Next step: harden your Docker stack for production","Traefik v3 handles routing and TLS, but a production-ready Docker stack requires more: healthchecks on containers, restart policy, centralized logs, secret rotation, volume backups. See our **docker-compose-production-checklist** guide for a complete checklist to apply before going live with any containerized service on your VPS.","Discover our Cloud VPS","\u002Fvps-cloud",[153,169,189,204],{"id":154,"slug":155,"slugs":156,"title":160,"excerpt":161,"readTime":23,"views":162,"isPinned":19,"publishedAt":163,"updatedAt":164,"category":165,"categories":166,"featuredImage":29,"bgImage":30,"posterImage":168,"relatedSolution":29},38,"deploy-your-applications-with-traefik-on-a-vps",{"fr":157,"en":155,"ar":158,"es":159},"deployer-avec-traefik","انشر-تطبيقاتك-باستخدام-traefik-على-خادم-vps","desplegar-con-traefik","Deploy your applications with Traefik on a VPS","Deploy Traefik as a reverse proxy on your VPS: automatic routing of Docker containers, Let's Encrypt SSL certificates and load balancing.",2,"2026-05-13T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[167],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-traefik-poster.svg",{"id":170,"slug":171,"slugs":172,"title":176,"excerpt":177,"readTime":178,"views":179,"isPinned":19,"publishedAt":180,"updatedAt":164,"category":181,"categories":186,"featuredImage":29,"bgImage":30,"posterImage":188,"relatedSolution":29},227,"caddy-traefik-or-nginx-proxy-manager-which-to-choose",{"fr":173,"en":171,"ar":174,"es":175},"choisir-reverse-proxy-vps-caddy-traefik-nginx","caddy-أم-traefik-أم-nginx-proxy-manager-أيهما-تختار","elegir-reverse-proxy-vps-caddy-traefik-nginx","Caddy, Traefik or Nginx Proxy Manager: which to choose?","Caddy, Traefik or Nginx Proxy Manager for your VPS? A practical comparison to choose the right reverse proxy for your Docker stack.",10,1,"2026-08-06T00:00:00+00:00",{"id":182,"name":183,"slug":184,"color":185,"icon":184},5,"Comparison","comparatif","bg-info\u002F10 text-info",[187],{"id":182,"name":183,"slug":184,"color":185,"icon":184},"\u002Fblog\u002Fcovers\u002Fchoisir-reverse-proxy-vps-caddy-traefik-nginx-poster.svg",{"id":190,"slug":191,"slugs":192,"title":196,"excerpt":197,"readTime":17,"views":18,"isPinned":19,"publishedAt":198,"updatedAt":199,"category":200,"categories":201,"featuredImage":29,"bgImage":30,"posterImage":203,"relatedSolution":29},384,"nginx-proxy-manager-vps-reverse-proxy-setup",{"fr":193,"en":191,"ar":194,"es":195},"nginx-proxy-manager-vps-reverse-proxy","nginx-proxy-manager-على-vps-إعداد-reverse-proxy","nginx-proxy-manager-vps-proxy-inverso","Nginx Proxy Manager on VPS: Reverse Proxy with Auto SSL","Set up a visual reverse proxy on your VPS with Nginx Proxy Manager: automatic Let's Encrypt SSL, multi-app Docker routing, no nginx.conf editing required.","2026-09-26T00:00:00+00:00","2026-09-29T14:40:42+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[202],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fnginx-proxy-manager-vps-reverse-proxy-poster.svg",{"id":205,"slug":206,"slugs":207,"title":211,"excerpt":212,"readTime":213,"views":18,"isPinned":19,"publishedAt":180,"updatedAt":214,"category":215,"categories":216,"featuredImage":29,"bgImage":30,"posterImage":218,"relatedSolution":29},229,"docker-compose-in-production-10-point-checklist",{"fr":208,"en":206,"ar":209,"es":210},"docker-compose-production-checklist","docker-compose-في-الإنتاج-قائمة-التحقق-من-10-نقاط","checklist-docker-compose-en-produccion","Docker Compose in Production: 10-Point Checklist","Docker Compose production checklist: 10 essential settings, health checks, secrets without downtime, rollback strategy, common error troubleshooting, CVE-2026-17106.",12,"2026-09-29T14:40:45+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[217],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fdocker-compose-production-checklist-poster.svg",1791901057395]