Traefik doesn’t get configured — it discovers your Docker containers and gives them HTTPS before you lift a finger

Traefik shipped v3.7.0 in May 2026, sitting on 64,000 GitHub stars and a philosophy unchanged since Emile Vauge started the project in 2015: a reverse proxy shouldn’t need to be configured. It should discover services, provision their certificates, and route traffic while you write the docker-compose.yml for your next container. By June 2026, releases were landing at a weekly cadence — v3.7.3, v3.7.4, v3.7.5 — and the message was unmistakable: Traefik had won the cloud-native reverse proxy war.

Most homelabs start with Nginx Proxy Manager, and that’s the right call. NPM turns reverse proxy configuration into three form fields and a click, with zero nginx.conf editing. But past ten or fifteen services, the model frays: every new container means a visit to the admin UI, every port change a manual edit. Traefik inverts the problem: instead of declaring routes in a central tool, it reads them straight from the containers it’s supposed to proxy.

A reverse proxy that listens to Docker, not a config file

The idea is simple and radical. Traefik connects to the Docker socket (/var/run/docker.sock) and watches daemon events: a container starts, it reads its labels; a container stops, it drops its route. No reload, no nginx -s reload, no static file to maintain. The configuration lives where the service lives — in the docker-compose.yml that defines it.

Here’s what it looks like to expose Whoogle behind a subdomain with automatic Let’s Encrypt:

services:
  whoogle:
    image: benbusby/whoogle-search:latest
    networks: [traefik]
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoogle.rule=Host(`search.yourdomain.com`)"
      - "traefik.http.routers.whoogle.entrypoints=websecure"
      - "traefik.http.routers.whoogle.tls.certresolver=letsencrypt"
      - "traefik.http.services.whoogle.loadbalancer.server.port=5000"

Five labels. No Nginx config file, no admin form, no reload. You run docker compose up -d and thirty seconds later, search.yourdomain.com answers over HTTPS with a valid certificate. Tear down the container, the route vanishes. This is the behaviour that orchestrators like Kubernetes offer natively, pulled down to a single Docker host.

Installation: a compose file you never touch again

Traefik’s core fits in three files: a static configuration (traefik.yml), a dynamic configuration (dynamic.yml), and a docker-compose.yml. The static config defines entrypoints (ports 80 and 443), providers (Docker, file), and certificate resolvers (Let’s Encrypt). Once written, it never changes.

# traefik.yml
api:
  dashboard: true

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address: ":443"

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
    network: traefik
  file:
    filename: /etc/traefik/config/dynamic.yml
    watch: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: "[email protected]"
      storage: /etc/traefik/acme.json
      httpChallenge:
        entryPoint: web

Two critical safeguards in that file. exposedByDefault: false prevents Traefik from auto-routing every container on the network — only those carrying the traefik.enable=true label get exposed. network: traefik limits discovery to containers explicitly attached to the traefik network: a container isolated on a different Docker network is invisible to the proxy, reducing the attack surface.

Traefik’s own docker-compose.yml is minimal:

services:
  traefik:
    image: traefik:v3.7
    container_name: traefik
    networks: [traefik]
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./config:/etc/traefik/config:ro
      - ./acme.json:/etc/traefik/acme.json
    restart: unless-stopped

networks:
  traefik:
    external: true

Deploy this compose once and never touch it again. All operational configuration — routes, middleware, certificates — is driven by your application containers’ labels or the dynamic file.

Middleware: the processing chain that replaces nginx.conf

Where Nginx Proxy Manager gives you checkboxes (SSL, force SSL, block common exploits), Traefik exposes a declarative middleware system. A middleware is a transformation applied to a request before it reaches the target service — and you chain them like building blocks.

Here are the most useful ones for a homelab:

• Rate limiting: traefik.http.middlewares.ratelimit.ratelimit.average=100 caps each IP at 100 requests per second. Essential in front of an exposed API.
• Basic Auth: traefik.http.middlewares.auth.basicauth.users=admin:$2y$… protects the dashboard or any service without native authentication.
• Security headers: traefik.http.middlewares.secureheaders.headers.sslredirect=true adds missing security headers (HSTS, X-Frame-Options, Content-Security-Policy).
• Redirect regex: redirects /old-path to /new-path, strips www, or enforces a canonical URL.
• IP whitelist: traefik.http.middlewares.internalip.ipwhitelist.sourcerange=192.168.0.0/16 locks a service to the local network.
• Compression: enables gzip or Brotli compression on the fly for text responses.

Each middleware is defined in dynamic.yml or directly as a Docker label, then attached to a router by name. The syntax is verbose — that’s the price of declarative mode — but it’s self-documenting: six months later, you read the label and know exactly what it does.

Traefik vs Nginx Proxy Manager: the right tool at the right time

The table below summarises a comparison you should read as a progression, not a fight.

Nginx Proxy Manager is the ideal entry point. Traefik is the next stage — the one where the number of services makes manual management counter-productive. The threshold sits around ten exposed containers: below that, NPM does the job friction-free; above it, Traefik turns each new service into three labels instead of a configuration session.

The good news: both coexist perfectly on separate entrypoints. You can migrate service by service without a big-bang switch.

Dashboard, metrics, and observability

Traefik ships a web dashboard that displays routers, services, and middleware state in real time. It’s not a configuration tool — it’s a visual diagnostics panel. Enable it locally, lock it behind Basic Auth or an IP whitelist, and keep it for debugging sessions.

For those pushing observability further, Traefik exposes natively:

• A Prometheus endpoint (/metrics) publishing request counts, HTTP status codes, and response times per service and router.
• OpenTelemetry traces to follow a request end-to-end through the middleware chain and backend services.
• Access logs in Apache combined format, with tunable verbosity and rotation.

These three pillars turn Traefik into the central traffic observation point. In a homelab where five to twenty services share ports 80 and 443, knowing which one is cascading 502 errors or saturating the rate limiter becomes invaluable.

Pitfalls to know before migrating

The Docker socket is an attack surface. Mounting /var/run/docker.sock into a container gives that container root access to the Docker daemon. In production, prefer Docker Swarm mode or a socket proxy (docker-socket-proxy) that filters allowed API calls. For a single-host homelab, the risk is acceptable as long as the Traefik container is the only one mounting the socket and the dashboard is not exposed to the internet without authentication.

The label syntax is verbose. traefik.http.routers.myservice.middlewares=auth,ratelimit,secureheaders@file isn’t as readable as a Caddyfile. The counterpoint: the verbosity is predictable and scriptable. Once you’ve written three services with Traefik, the fourth is a copy-paste of labels where you change the name and port.

TLS-ALPN-01 requires port 443 reachable. If your ISP blocks port 443 or you’re behind CGNAT, switch to the DNS-01 challenge — Traefik supports over forty DNS providers (Cloudflare, OVH, Route 53) to provision wildcard certificates without exposing port 443.

Verdict

Choose Nginx Proxy Manager if you have fewer than ten exposed services and want a reverse proxy you configure in three clicks. Choose Traefik if you regularly exceed ten containers, want your services to self-register with the reverse proxy, or need a middleware chain you can version in a Git repository.

Traefik isn’t harder than NPM — it’s different. Where NPM centralises configuration in an interface, Traefik distributes it across every container. The result is a reverse proxy you no longer administer: you describe the service, it handles the rest. That’s the definition of cloud-native, and it works just as well on a Raspberry Pi as on a fifty-node Kubernetes cluster.

References

• Traefik v3.7.0 Release Notes — GitHub, May 5 2026
• Traefik as a Reverse Proxy for Docker — GnTech Blog, May 9 2026
• Nginx Proxy Manager vs Traefik (2026) — HomelabCompass, 2026
• Nginx Proxy Manager vs Traefik vs Caddy 2026 — Selfhostr, May 28 2026
• Traefik Official Documentation — traefik.io
• Nginx Proxy Manager gives your homelab a domain name and HTTPS in three clicks — ETTAYEB, May 15 2026