How to Set Up Traefik with Docker Compose and Let's Encrypt

To set up Traefik with Docker Compose and Let’s Encrypt, run the traefik:v3.7 image on ports 80 and 443 with the Docker provider, a websecure entry point and an ACME certificate resolver that stores certificates in acme.json. Then add labels such as traefik.http.routers.app.rule=Host(`app.example.com`) and tls.certresolver=le to each container. Traefik requests and renews the certificates by itself.

Difficulty	Time	Works on	Needs
Intermediate	30 minutes	Any Linux server with Docker	Docker with Compose, a domain, ports 80 and 443 free

Before you start

Traefik is a reverse proxy that watches Docker. When a container with Traefik labels starts, Traefik creates the route and the HTTPS certificate for it. You never edit a proxy config file.
Ports 80 and 443 must be free. Stop any Nginx, Apache, Caddy or Nginx Proxy Manager on the server first.
Create A (and AAAA) records for every domain, pointing at your server, before you start Traefik. See point a domain to your server.
Run the commands as a user in the docker group, or put sudo in front.

How to install Traefik with Let’s Encrypt

Create a project folder

mkdir -p ~/traefik/letsencrypt && cd ~/traefik

letsencrypt will hold acme.json, the file with your certificates and private keys.

Create a login for the dashboard

Install htpasswd (sudo apt install apache2-utils on Ubuntu/Debian, sudo dnf install httpd-tools on AlmaLinux/Rocky), then create a user called admin:

htpasswd -cB dashboard-users admin

Type a password twice. The file stores a bcrypt hash, not the password.

Create compose.yaml

Replace you@example.com and the domains with your own.

services:
  traefik:
    image: traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=proxy"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.le.acme.email=you@example.com"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./dashboard-users:/etc/traefik/dashboard-users:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=le"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.usersfile=/etc/traefik/dashboard-users"

  whoami:
    image: traefik/whoami:v1.12
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=le"

networks:
  proxy:
    name: proxy

Start Traefik

docker compose up -d
docker compose logs -f traefik

Press Ctrl+C to stop following the log. Errors about the certificate show up here.

What do the settings mean?

Setting	What it does
`providers.docker.exposedbydefault=false`	Only containers with `traefik.enable=true` get a route.
`providers.docker.network=proxy`	Traefik talks to your apps over the shared `proxy` network.
`entryPoints.web` / `websecure`	Traefik listens on ports 80 and 443.
`redirections.entryPoint.to=websecure`	Every HTTP request is redirected to HTTPS.
`certificatesresolvers.le.acme.*`	A Let’s Encrypt resolver called `le`, using the HTTP challenge on port 80.
`api@internal` + `basicauth`	The dashboard, behind your username and password.
`/var/run/docker.sock:ro`	Lets Traefik see your containers. Treat Traefik as having root-level access.

The whoami container is a small test app. Remove it from compose.yaml once your own app works.

How to put another app behind Traefik

Add the proxy network and labels to the app’s own compose.yaml. This example serves Uptime Kuma on status.example.com:

services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    restart: unless-stopped
    volumes:
      - ./data:/app/data
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kuma.rule=Host(`status.example.com`)"
      - "traefik.http.routers.kuma.entrypoints=websecure"
      - "traefik.http.routers.kuma.tls.certresolver=le"
      - "traefik.http.services.kuma.loadbalancer.server.port=3001"

networks:
  proxy:
    external: true

The app has no ports: section, so it is reachable only through Traefik. The loadbalancer.server.port label tells Traefik which port inside the container to use. Each router name (kuma, whoami) must be unique on the server.

How to check it worked

curl -I http://whoami.example.com
curl https://whoami.example.com

The first command returns a redirect with Location: https://whoami.example.com/. The second prints the whoami output, starting with Hostname:. Open https://traefik.example.com and log in to see your routers on the dashboard.

Frequently asked questions

Why does my site show “TRAEFIK DEFAULT CERT”?

Traefik couldn’t get a Let’s Encrypt certificate yet. Check docker compose logs traefik for ACME errors. The usual causes are a DNS record that doesn’t point at this server, port 80 being blocked, or a missing tls.certresolver=le label. While testing, add --certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory so you don’t hit Let’s Encrypt’s rate limits, then remove it and delete acme.json.

Why do I get “404 page not found”?

No router matches the domain. Check that the container has traefik.enable=true, that its Host() rule matches the domain exactly, and that it is on the proxy network.

Do I need to publish the dashboard on port 8080?

No. Traefik’s examples use --api.insecure=true on port 8080 for local testing. On a public server, keep the dashboard on a domain behind authentication as shown above, or leave out --api.dashboard=true.

Where are the certificates stored?

In ~/traefik/letsencrypt/acme.json. Back up that folder with the rest of the project and keep it private, because it contains the private keys.

VPS and dedicated server guides

Every guide in this section.

Nginx Proxy Manager

A reverse proxy you manage in a web interface.

Docker Compose tutorial

The compose.yaml format.

Secure Docker on a VPS

Firewalls, the docker group and the socket.

Install Dokploy

A deploy platform built on Traefik.

Checked against the official Traefik documentation (Docker setup, Let’s Encrypt and middlewares and BasicAuth) on 4 November 2026; compose.yaml files validated with Docker Compose v5.6.1 and htpasswd tested on Ubuntu 24.04 LTS. Traefik itself was not run, because image downloads were not available in our test environment.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Live Chat: Quick assistance via our website.
Support Ticket: Open a Ticket
Discord: Join our Community
Email: support@freakhosting.com

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026

Start here

Connect to your server

Linux basics

Linux security

Networking

Web servers & websites

Databases

Docker & self-hosting

Backups & storage

Performance & monitoring

Linux troubleshooting

Windows Server basics

Windows Server security & networking

Windows Server troubleshooting

Account & notifications

How to Set Up Traefik with Docker Compose and Let's Encrypt

Before you start

How to install Traefik with Let’s Encrypt

What do the settings mean?

How to put another app behind Traefik

How to check it worked

Frequently asked questions

Why does my site show “TRAEFIK DEFAULT CERT”?

Why do I get “404 page not found”?

Do I need to publish the dashboard on port 8080?

Where are the certificates stored?

VPS and dedicated server guides

Nginx Proxy Manager

Docker Compose tutorial

Secure Docker on a VPS

Install Dokploy

Need Extra Help?

Save on Your Hosting

​Before you start

​How to install Traefik with Let’s Encrypt

​What do the settings mean?

​How to put another app behind Traefik

​How to check it worked

​Frequently asked questions

​Why does my site show “TRAEFIK DEFAULT CERT”?

​Why do I get “404 page not found”?

​Do I need to publish the dashboard on port 8080?

​Where are the certificates stored?

​Related guides

VPS and dedicated server guides

Nginx Proxy Manager

Docker Compose tutorial

Secure Docker on a VPS

Install Dokploy

​Need Extra Help?

​Save on Your Hosting

Before you start

How to install Traefik with Let’s Encrypt

What do the settings mean?

How to put another app behind Traefik

How to check it worked

Frequently asked questions

Why does my site show “TRAEFIK DEFAULT CERT”?

Why do I get “404 page not found”?

Do I need to publish the dashboard on port 8080?

Where are the certificates stored?

Related guides

Need Extra Help?

Save on Your Hosting