Traefik on VPS: Auto-SSL for All Your Docker Apps

Introduction

Setting up and managing a self-hosted environment can be a rewarding endeavor, especially when you utilize a Virtual Private Server (VPS) to host your applications. Traefik, a modern reverse proxy and load balancer for microservices, can simplify your routing needs. In this guide, we will explore how to set up Traefik to automatically manage SSL certificates for all your Docker applications on a VPS.

Setting Up Traefik on Your VPS

Follow these steps to get Traefik up and running on your VPS.

Requirements

• A VPS (check our full VPS comparison)
• Docker and Docker Compose installed on your VPS
• Basic knowledge of Docker and networking

Step 1: Choose Your VPS Provider

Selecting the right VPS provider impacts your self-hosting experience. Here is a comparison of top providers:

Step 2: Install Docker and Docker Compose

For most Linux distributions, you can install Docker and Docker Compose using the following commands:

# Update package index
sudo apt-get update

# Install Docker
sudo apt-get install -y docker.io

# Install Docker Compose
sudo apt-get install -y docker-compose

Step 3: Docker Network Configuration

Create a Docker network for Traefik and your apps:

docker network create web

Step 4: Traefik Configuration

To install Traefik, create a directory for it:

mkdir traefik && cd traefik

Now create a docker-compose.yml file with the following content:

version: '3.7'

services:
  reverse_proxy:
    image: traefik:v2.5
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=your-email@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "./letsencrypt:/letsencrypt"
    networks:
      - web

networks:
  web:
    external: true

Make sure to replace [email protected] with your actual email for Let’s Encrypt notifications.

Step 5: Start Traefik

Run the following command to start Traefik:

docker-compose up -d

You can verify that Traefik is running by accessing http://YOUR_VPS_IP:8080 where you’ll find the Traefik dashboard.

Step 6: Deploying Docker Applications

With Traefik running, you can deploy other Docker applications using labels to integrate with Traefik for routing and SSL. Here’s an example of an application configuration:

version: '3.7'

services:
  my_app:
    image: my_app_image
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.my_app.rule=Host(`yourdomain.com`)"
      - "traefik.http.routers.my_app.entrypoints=websecure"
      - "traefik.http.routers.my_app.tls=true"
      - "traefik.http.routers.my_app.tls.certresolver=myresolver"
    networks:
      - web

Step 7: Accessing Your Application

With your application deployed, you can access it securely via https://yourdomain.com.

FAQs

What if my application doesn’t have a domain or subdomain?

Using Traefik requires you to set a domain or subdomain for SSL issuance through Let’s Encrypt. If you lack a domain, consider registering one through a domain registrar. Another option is to use a dynamic DNS service, which many providers support, allowing you to route traffic reliably without a static domain.

How does Traefik manage SSL certificates?

Traefik integrates seamlessly with Let’s Encrypt, an automatic certificate authority that issues SSL certificates for free. By configuring Traefik with specific settings in the docker-compose.yml file as shown above, it requests and renews your SSL certificates automatically. This ensures your connections to Docker applications remain secure without manual intervention.

Is Traefik suitable for a production environment?

Yes, Traefik is designed for production use, offering seamless SSL management and support for microservices architecture. With features like load balancing, automatic redirection, and an easy-to-understand dashboard, it’s a powerful tool for any production environment. Companies, developers, and homelabbers have successfully used Traefik in various self-hosted environments.

Conclusion

Using Traefik to automate SSL for your Docker apps on a VPS streamlines the management process, enhances security, and saves time. With the increasing importance of HTTPS, this setup is a worthwhile investment for any developer or homelabber. Happy self-hosting!