Traefik避坑指南

Router Basics

• - Router must have rule AND service — missing either = not working
• Rule priority: longer rules win by default — explicit priority to override
• INLINECODE3 is case-insensitive — Host(\example.com\) matches Example.com
• Multiple hosts: Host(\a.com\) || Host(\b.com\) — OR logic

Docker Labels Syntax

• - Labels on container, not compose service level — deploy.labels for Swarm
• Backticks for rules in Docker Compose — Host(\example.com\) with escaping
• Enable per-container: traefik.enable=true — if INLINECODE13
• Service name auto-generated from container — or set explicitly with INLINECODE14

TLS and Certificates

• - EntryPoint websecure needs TLS config — otherwise plain HTTP on 443
• Let's Encrypt: certificatesResolvers.myresolver.acme.email required — registration fails without
• HTTP challenge needs port 80 open — DNS challenge for wildcard or closed 80
• INLINECODE17 on router activates TLS — tls.certresolver=myresolver for auto-cert
• Staging ACME for testing — caServer to staging URL, avoids rate limits

EntryPoints

• - Define in static config — INLINECODE20
• Redirect HTTP to HTTPS at entrypoint level — cleaner than per-router middleware
• Router binds to entrypoint with entryPoints=web,websecure — comma-separated list

Middlewares

• - Chain order matters — first middleware wraps all following
• Middleware defined once, used by many routers — INLINECODE22
• Common: stripPrefix, redirectScheme, basicAuth, INLINECODE26
• BasicAuth: use htpasswd format — escape $ in Docker Compose with INLINECODE29

Service Configuration

• - loadbalancer.server.port when container exposes multiple — Traefik can't guess
• Health check: healthcheck.path=/health — removes unhealthy from rotation
• Sticky sessions: loadbalancer.sticky.cookie.name=srv_id — for stateful apps

Common Mistakes

• - Router without entryPoint — defaults may not be what you expect
• Forgetting traefik.docker.network with multiple networks — Traefik picks wrong one
• ACME storage not persisted — certificates regenerated, hits rate limit
• Dashboard exposed without auth — api.insecure=true is dangerous in production
• PathPrefix without StripPrefix — backend receives full path, may 404
• Services on different ports — each needs explicit port label

File Provider

• - watch=true for hot reload — otherwise restart Traefik on changes
• Can coexist with Docker provider — useful for external services
• Define routers, services, middlewares in YAML — same concepts as labels

Debugging

• - --log.level=DEBUG for troubleshooting — verbose but helpful
• Dashboard shows routers, services, middlewares — verify configuration
• INLINECODE37 for local dev only — secure with auth in production