How to Install and Configure Traefik as a Reverse Proxy on a Linux VPS: Complete Guide — CLIQHOST

Running multiple web applications on a single NVMe VPS and tired of manually managing Nginx configs, SSL certificates, and port forwarding? Traefik is the modern, cloud-native solution that automates all of that.

Traefik is an open-source reverse proxy and load balancer designed for microservices and containerised environments. It integrates natively with Docker and Kubernetes, automatically discovers new services, issues Let's Encrypt certificates on the fly, and never requires a restart to update routing rules. This guide walks you through a complete Traefik setup on Ubuntu 22.04.

What Is Traefik and Why Use It?

Traefik stands out from traditional reverse proxies for several reasons:

Auto-discovery: automatically detects Docker containers and configures routes
Automatic SSL: built-in Let's Encrypt support — no Certbot needed
Dynamic configuration: routes update live without downtime
Built-in dashboard: real-time web UI for monitoring routes and services
Powerful middleware: rate limiting, compression, security headers, authentication

If you have an SSD VPS running multiple Docker containers — WordPress, Nextcloud, custom apps — Traefik becomes an incredibly efficient traffic orchestrator.

Prerequisites

Before starting, make sure you have:

A Linux VPS running Ubuntu 22.04 (recommended: CLIQHOST NVMe VPS)
Root or sudo access
Docker and Docker Compose installed
A domain name with DNS pointing to your server's IP
Ports 80 and 443 open in your firewall

Installing Docker

apt update && apt upgrade -y
apt install -y ca-certificates curl gnupg
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
  > /etc/apt/sources.list.d/docker.list
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Verify the installation:

docker --version
docker compose version

Step 1: Prepare the Directory Structure

Create a dedicated directory for Traefik:

mkdir -p /opt/traefik/data
cd /opt/traefik

Create the SSL certificate storage file:

touch /opt/traefik/data/acme.json
chmod 600 /opt/traefik/data/acme.json

Important: The 600 permission on acme.json is mandatory. Traefik will refuse to start if this file is accessible to other users.

Step 2: Create the traefik.yml Configuration File

nano /opt/traefik/data/traefik.yml

api:
  dashboard: true
  insecure: false

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"

certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /data/acme.json
      httpChallenge:
        entryPoint: web

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik-net

log:
  level: INFO

accessLog: {}

Key settings explained:

redirections: automatically redirects all HTTP traffic to HTTPS
exposedByDefault: false: containers are only exposed when explicitly labelled
network: traefik-net: dedicated Docker network for Traefik

Step 3: Create the Docker Network and docker-compose.yml

Create the external Docker network:

docker network create traefik-net

Create docker-compose.yml:

nano /opt/traefik/docker-compose.yml

version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /opt/traefik/data/traefik.yml:/traefik.yml:ro
      - /opt/traefik/data/acme.json:/data/acme.json
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.yourdomain.com`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$xyz..."

networks:
  traefik-net:
    external: true

Generating the Dashboard Password

apt install -y apache2-utils
htpasswd -nb admin YourSecurePassword123
# Example output: admin:$apr1$8Kv...Hash

In docker-compose.yml, replace every $ in the hash with $$ (Docker Compose escaping).

Step 4: Start Traefik

cd /opt/traefik
docker compose up -d

Verify it's running:

docker ps
docker logs traefik --tail=50

The dashboard will be available at https://traefik.yourdomain.com within seconds after the SSL certificate is issued.

Step 5: Adding Your First Application

Let's add a simple Nginx container to demonstrate dynamic routing:

mkdir -p /opt/apps/mysite
nano /opt/apps/mysite/docker-compose.yml

version: '3.8'

services:
  mysite:
    image: nginx:alpine
    container_name: mysite
    restart: unless-stopped
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mysite.rule=Host(`site.yourdomain.com`)"
      - "traefik.http.routers.mysite.entrypoints=websecure"
      - "traefik.http.routers.mysite.tls.certresolver=letsencrypt"

networks:
  traefik-net:
    external: true

cd /opt/apps/mysite
docker compose up -d

Traefik automatically detects the new container, issues an SSL certificate for site.yourdomain.com, and routes traffic — with no Traefik restart and no config file changes.

Step 6: Useful Middleware in Traefik

Middleware lets you enhance routes with additional functionality:

Rate Limiting

labels:
  - "traefik.http.middlewares.ratelimit.ratelimit.average=100"
  - "traefik.http.middlewares.ratelimit.ratelimit.burst=50"
  - "traefik.http.routers.mysite.middlewares=ratelimit"

Security Headers

labels:
  - "traefik.http.middlewares.secheaders.headers.stsSeconds=31536000"
  - "traefik.http.middlewares.secheaders.headers.stsIncludeSubdomains=true"
  - "traefik.http.middlewares.secheaders.headers.contentTypeNosniff=true"
  - "traefik.http.middlewares.secheaders.headers.browserXssFilter=true"
  - "traefik.http.routers.mysite.middlewares=secheaders"

Gzip Compression

labels:
  - "traefik.http.middlewares.compress.compress=true"
  - "traefik.http.routers.mysite.middlewares=compress"

Chain multiple middleware with a comma:

- "traefik.http.routers.mysite.middlewares=ratelimit,secheaders,compress"

Step 7: Logging and Monitoring

View live logs:

docker logs traefik -f

To persist logs to files, add to traefik.yml:

log:
  level: WARNING
  filePath: /data/traefik.log

accessLog:
  filePath: /data/access.log
  bufferingSize: 100

Traefik natively exposes Prometheus metrics, making it easy to integrate with a Prometheus and Grafana monitoring stack:

metrics:
  prometheus:
    entryPoint: metrics

entryPoints:
  metrics:
    address: ":8082"

Step 8: Updating and Maintaining Traefik

Updating to a new version:

cd /opt/traefik
docker compose pull
docker compose up -d

Check the current version:

docker exec traefik traefik version

Always back up your certificates before major updates:

cp /opt/traefik/data/acme.json /opt/traefik/data/acme.json.bak

Traefik vs Nginx Proxy Manager: Quick Comparison

Feature	Traefik	Nginx Proxy Manager
Docker auto-discovery	✅ Native	❌ Manual
Automatic SSL	✅	✅
Dashboard	✅ Built-in	✅ Web UI
Configuration method	Docker Labels	Web interface
Advanced middleware	✅	Limited
Best suited for	DevOps, containers	Non-technical users

Common Issues and Solutions

SSL certificate not issuing

Confirm port 80 is publicly accessible: curl http://yourdomain.com
Check acme.json permissions: chmod 600
Review logs: docker logs traefik 2>&1 | grep -i acme

Container not appearing in Traefik

Confirm the traefik.enable=true label is set
Make sure the container is on the traefik-net network
Restart the container and check logs

Dashboard inaccessible

Verify DNS for the subdomain is correctly configured
Double-check the password hash uses $$ instead of $

Conclusion

Traefik dramatically simplifies traffic management for multi-application Docker environments. With automatic SSL, live dynamic routing, and a rich middleware ecosystem, it is a cornerstone tool in any modern DevOps stack.

To get the most out of Traefik, you need a reliable, high-performance server. CLIQHOST NVMe VPS plans offer fast NVMe storage, solid connectivity, and the resources needed to run complex containerised workloads without compromise.

For production-grade infrastructure with maximum performance, explore CLIQHOST managed dedicated servers — fully administered, enterprise-ready solutions.

Need expert help setting up or managing your server? The CLIQHOST server management service handles all the technical heavy lifting for you. Get in touch — we respond quickly.

How to Install and Configure Traefik as a Reverse Proxy on a Linux VPS: Complete Guide — CLIQHOST