How to Set Up Traefik with Docker Compose and Automatic HTTPS

If you run self-hosted apps and want HTTPS without the complexity, learning how to set up Traefik with Docker Compose is one of the best things you can do for your stack. Traefik acts as a reverse proxy that sits in front of your containers, handles routing by reading Docker labels, and automatically gets free SSL certificates from Let's Encrypt.

This guide will show you how to set up Traefik with Docker Compose on Ubuntu, and you will get automatic HTTPS, proper folder structure, a working sample app, and basic hardening, all without Kubernetes.

Before you begin to set up Traefik with Docker Compose, make sure to prepare these prerequisites:

• A Linux VPS or dedicated server running Ubuntu 22.04 or 24.04. You can easily deploy your reverse proxy stack on a PerLod Linux VPS.
• Docker and Docker Compose are installed. A public domain name with DNS access.
• Ports 80 and 443 are open on your server's firewall.
• An email address for Let's Encrypt registration.

Before Traefik can get a certificate, your domain must point to your server's IP. If you don't have a Domain, you can register a Domain on PerLod.

You can create an A record like this in your DNS panel:

Let DNS propagate before running Traefik. You can verify it with:

It is better to keep things clean and organized. Here is the folder layout used in this guide:

Run this to create the required folders and permissions for Traefik:

Remember to set the correct permission; Traefik will refuse to start if acme.json has loose permissions.

Once you are done with these prerequisites, you can proceed to the following steps to set up Traefik with Docker Compose.

Traefik needs to communicate with your app containers. You must create a shared external network that all services will join:

All containers that Traefik should route to must be on this network.

This is the core step where you set up Traefik with Docker Compose for the first time. Use the command below to create the Traefik compose file:

Paste the following content into the file with your actual email and with your real domain:

You can use the command below to generate the password hash and then replace it in the above config. Remember to double every $ sign when pasting into a compose file:

If you need Apache utils, you can install them first:

Explore key settings in the Traefik Docker Compose file:

Once you are finished creating the Docker Compose, you can use the command below to bring up the Traefik stack:

Check that it started cleanly with the command below:

You should see lines like Configuration loaded from flags and no errors. After 30 to 60 seconds, visit:

You should get a login prompt for the dashboard.

Now you will see why it is so easy to set up Traefik with Docker Compose for multiple apps. Each new app just needs Docker labels and no Traefik config edits required.

For example, create the whoami app compose file with the command below:

Add the following content with your actual subdomain and make sure its A record points to your server IP:

Start it with the commands below:

Now visit your subdomain:

Traefik will request a certificate automatically, and you will see the whoami output with your request headers.

When you set up Traefik with Docker Compose, each label tells Traefik something specific about how to route traffic. Here are the labels and what they do:

1. Tell Traefik to watch this container:

2. Route requests for this hostname to this container:

3. Only accept traffic on the HTTPS entrypoint port 443:

4. Use Let's Encrypt to get and renew the certificate automatically:

5. Forward traffic to port 80 inside the container:

Note: You do not publish ports on the app container; only Traefik exposes ports 80 and 443. App containers expose only their ports for internal Docker networking.

When you are finished setting up Traefik with Docker Compose, you must verify everything works correctly.

1. Check the certificate with the command below:

In the output, you must see:

2. Check HTTPS redirect with:

You should get 301 Moved Permanently with:

3. Check Traefik dashboard:

Open the following URL in your browser, log in with the credentials you set up, and you should see your routers and services listed under the HTTP section:

4. Check Traefik logs with:

Look for any level=error lines. A healthy setup shows only level=info or level=debug messages.

When you set up Traefik with Docker Compose for production, these hardening steps matter a lot:

• Never expose port 8080: This is the insecure dashboard port. This guide routes the dashboard through HTTPS with basic auth instead.
• Mount the Docker socket as read-only, :ro at the end of the volume line: Traefik only needs to watch events, not control Docker.
• Use security_opt: no-new-privileges:true: Stops container processes from escalating privileges.
• Set exposedbydefault=false: Prevents accidentally exposing containers without labels.
• Keep Traefik updated: The project releases security patches regularly. Pin to a minor version like traefik:v3.7 and update on new releases.
• Use strong passwords for basic auth and consider replacing it with an SSO solution like Authentik or Authelia for the dashboard.
• Enable access logs: The --accesslog=true gives you visibility into all traffic hitting your proxy.

The power of this setup is that adding a new self-hosted app is just a matter of joining it to the Traefik Proxy network and adding the right labels. Here is the template for any new service:

Note: No changes to the Traefik container needed; it detects new containers automatically.

With Traefik Docker Compose setup, you get automatic HTTPS and dynamic routing through Docker labels, all without touching Nginx configs or managing certificates manually. Once the traefik-proxy network is ready and Traefik is running, adding a new app takes less than a minute.

We hope you enjoy this guide. To see all Docker labels and providers, you can check the official Traefik Docker Provider Documentation.