> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Set Up Traefik with Docker Compose and Let's Encrypt

> Set up Traefik with Docker Compose and Let's Encrypt: run traefik:v3.7, add a certificate resolver, then route each container to its domain with HTTPS labels.

To set up Traefik with Docker Compose and Let's Encrypt, run the `traefik:v3.7` image on ports 80 and 443 with the Docker provider, a `websecure` entry point and an ACME certificate resolver that stores certificates in `acme.json`. Then add labels such as ``traefik.http.routers.app.rule=Host(`app.example.com`)`` and `tls.certresolver=le` to each container. Traefik requests and renews the certificates by itself.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 30 minutes | Any Linux server with Docker | [Docker with Compose](https://help.freakhosting.com/portals/other/how-to-install-docker.md), a domain, ports 80 and 443 free |

## Before you start

* **Traefik** is a reverse proxy that watches Docker. When a container with Traefik labels starts, Traefik creates the route and the HTTPS certificate for it. You never edit a proxy config file.
* Ports 80 and 443 must be free. Stop any Nginx, Apache, Caddy or [Nginx Proxy Manager](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-proxy-manager.md) on the server first.
* Create `A` (and `AAAA`) records for every domain, pointing at your server, before you start Traefik. See [point a domain to your server](https://help.freakhosting.com/portals/other/how-to-point-a-domain-to-your-server.md).
* Run the commands as a user in the `docker` group, or put `sudo` in front.

## How to install Traefik with Let's Encrypt

**1. Create a project folder**

```bash theme={null}
mkdir -p ~/traefik/letsencrypt && cd ~/traefik
```

`letsencrypt` will hold `acme.json`, the file with your certificates and private keys.

**2. Create a login for the dashboard**

Install `htpasswd` (`sudo apt install apache2-utils` on Ubuntu/Debian, `sudo dnf install httpd-tools` on AlmaLinux/Rocky), then create a user called `admin`:

```bash theme={null}
htpasswd -cB dashboard-users admin
```

Type a password twice. The file stores a bcrypt hash, not the password.

**3. Create compose.yaml**

Replace `you@example.com` and the domains with your own.

```yaml theme={null}
services:
  traefik:
    image: traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=proxy"
      - "--entryPoints.web.address=:80"
      - "--entryPoints.websecure.address=:443"
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.le.acme.email=you@example.com"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./dashboard-users:/etc/traefik/dashboard-users:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=le"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.usersfile=/etc/traefik/dashboard-users"

  whoami:
    image: traefik/whoami:v1.12
    restart: unless-stopped
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.example.com`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=le"

networks:
  proxy:
    name: proxy
```

**4. Start Traefik**

```bash theme={null}
docker compose up -d
docker compose logs -f traefik
```

Press `Ctrl+C` to stop following the log. Errors about the certificate show up here.

## What do the settings mean?

| Setting | What it does |
| - | - |
| `providers.docker.exposedbydefault=false` | Only containers with `traefik.enable=true` get a route. |
| `providers.docker.network=proxy` | Traefik talks to your apps over the shared `proxy` network. |
| `entryPoints.web` / `websecure` | Traefik listens on ports 80 and 443. |
| `redirections.entryPoint.to=websecure` | Every HTTP request is redirected to HTTPS. |
| `certificatesresolvers.le.acme.*` | A Let's Encrypt resolver called `le`, using the HTTP challenge on port 80. |
| `api@internal` + `basicauth` | The dashboard, behind your username and password. |
| `/var/run/docker.sock:ro` | Lets Traefik see your containers. Treat Traefik as having root-level access. |

The `whoami` container is a small test app. Remove it from `compose.yaml` once your own app works.

## How to put another app behind Traefik

Add the `proxy` network and labels to the app's own `compose.yaml`. This example serves [Uptime Kuma](https://help.freakhosting.com/portals/other/how-to-set-up-uptime-kuma.md) on `status.example.com`:

```yaml theme={null}
services:
  uptime-kuma:
    image: louislam/uptime-kuma:2
    restart: unless-stopped
    volumes:
      - ./data:/app/data
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kuma.rule=Host(`status.example.com`)"
      - "traefik.http.routers.kuma.entrypoints=websecure"
      - "traefik.http.routers.kuma.tls.certresolver=le"
      - "traefik.http.services.kuma.loadbalancer.server.port=3001"

networks:
  proxy:
    external: true
```

The app has no `ports:` section, so it is reachable only through Traefik. The `loadbalancer.server.port` label tells Traefik which port inside the container to use. Each router name (`kuma`, `whoami`) must be unique on the server.

## How to check it worked

```bash theme={null}
curl -I http://whoami.example.com
curl https://whoami.example.com
```

The first command returns a redirect with `Location: https://whoami.example.com/`. The second prints the whoami output, starting with `Hostname:`. Open `https://traefik.example.com` and log in to see your routers on the dashboard.

## Frequently asked questions

### Why does my site show "TRAEFIK DEFAULT CERT"?

Traefik couldn't get a Let's Encrypt certificate yet. Check `docker compose logs traefik` for ACME errors. The usual causes are a DNS record that doesn't point at this server, port 80 being blocked, or a missing `tls.certresolver=le` label. While testing, add `--certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory` so you don't hit Let's Encrypt's rate limits, then remove it and delete `acme.json`.

### Why do I get "404 page not found"?

No router matches the domain. Check that the container has `traefik.enable=true`, that its `Host()` rule matches the domain exactly, and that it is on the `proxy` network.

### Do I need to publish the dashboard on port 8080?

No. Traefik's examples use `--api.insecure=true` on port 8080 for local testing. On a public server, keep the dashboard on a domain behind authentication as shown above, or leave out `--api.dashboard=true`.

### Where are the certificates stored?

In `~/traefik/letsencrypt/acme.json`. Back up that folder with the rest of the project and keep it private, because it contains the private keys.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Nginx Proxy Manager](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-proxy-manager.md)
>
> A reverse proxy you manage in a web interface.

> [card] [Docker Compose tutorial](https://help.freakhosting.com/portals/other/how-to-use-docker-compose.md)
>
> The compose.yaml format.

> [card] [Secure Docker on a VPS](https://help.freakhosting.com/portals/other/how-to-secure-docker-on-a-vps.md)
>
> Firewalls, the docker group and the socket.

> [card] [Install Dokploy](https://help.freakhosting.com/portals/other/how-to-install-dokploy.md)
>
> A deploy platform built on Traefik.

***

> [!NOTE]
>
> **Checked against the official Traefik documentation ([Docker setup](https://doc.traefik.io/traefik/expose/docker/basic/), [Let's Encrypt and middlewares](https://doc.traefik.io/traefik/expose/docker/advanced/) and [BasicAuth](https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/basicauth/))** on 4 November 2026; `compose.yaml` files validated with Docker Compose v5.6.1 and `htpasswd` tested on Ubuntu 24.04 LTS. Traefik itself was not run, because image downloads were not available in our test environment.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.