Replace Nginx with Traefik v3: Docker SSL Made Easy

Running many Docker containers behind a single reverse proxy can become tedious, especially when each service needs its own SSL certificate. While Nginx has been the default choice, Traefik v3 offers built‑in, automatic TLS handling that works natively with Docker. This guide walks you through a clean migration from Nginx to Traefik, covering installation, configuration, and verification so you can enjoy zero‑touch HTTPS on your AtoZNode VPS or dedicated server.

1. Why Switch to Traefik v3?

Traefik is built for dynamic, container‑centric environments. Compared to a static Nginx setup, its main benefits are:

• Automatic Let’s Encrypt certificates with background renewal.
• Docker integration that discovers containers, reads labels, and updates routing without a reload.
• Built‑in middleware for redirection, rate limiting, authentication, and more.
• Real‑time dashboard that shows routes, services, and health.

If you already use Nginx, the migration mainly involves removing the static proxy, installing Traefik, and adding a few Docker labels to each container.

2. Preparing the Server

Before installing Traefik, stop and disable the existing Nginx service to avoid port conflicts (both listen on ports 80/443 by default).

Stop Nginx

The following commands work on both Debian‑based and RHEL‑based systems; only the package manager differs.

Debian / Ubuntu (apt)

# Stop the running Nginx service
sudo systemctl stop nginx

# Prevent it from starting on boot
sudo systemctl disable nginx

AlmaLinux / Rocky Linux / RHEL (dnf)

# Stop the running Nginx service
sudo systemctl stop nginx

# Prevent it from starting on boot
sudo systemctl disable nginx

If you are using Windows Server, stop the service with net stop nginx and set its startup type to disabled in the Services console.

3. Installing Traefik v3

Running Traefik as a Docker container is the simplest approach on a Docker host. No extra system packages are required beyond Docker Engine.

Create a Dedicated Network

Traefik and your application containers should share a private Docker network so that Traefik can reach them directly.

# Create an isolated bridge network named "traefik-net"
docker network create traefik-net

Deploy Traefik with Docker Compose

Save the following docker-compose.yml in a directory such as /opt/traefik. Replace you@example.com with your own e‑mail address for Let’s Encrypt notifications.

version: "3.9"

services:
  traefik:
    image: traefik:v3.0
    container_name: traefik
    command:
      - "--api.dashboard=true"                     # Enable the dashboard
      - "--providers.docker=true"                  # Enable Docker provider
      - "--providers.docker.network=traefik-net"   # Use the shared network
      - "--providers.docker.exposedbydefault=false" # Only expose containers with explicit label
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.email=you@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"   # Dashboard (optional, protect with auth)
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro" # Docker socket for provider
      - "./letsencrypt:/letsencrypt"                  # Persistent storage for certificates
    networks:
      - traefik-net
    restart: unless-stopped

networks:
  traefik-net:
    external: true

Key lines explained:

• --providers.docker.exposedbydefault=false – only containers with traefik.enable=true are routed.
• --certificatesresolvers.myresolver.acme.tlschallenge=true – uses TLS‑ALPN‑01, which works behind most firewalls.
• The letsencrypt volume stores acme.json; keeping it outside the container ensures certificates survive restarts.

Start Traefik

# Navigate to the directory containing docker-compose.yml
cd /opt/traefik

# Pull the image and start the service
docker compose up -d

After a few seconds, Traefik will listen on ports 80, 443, and (optionally) 8080. Verify with:

curl -I http://localhost

You should see a 200 OK response from Traefik’s default 404 page, confirming it’s active.

4. Updating Your Docker Containers

Each container that previously relied on Nginx now needs a few Traefik labels. Below is a generic example for a web application listening on port 8080 inside the container.

Docker‑Compose Example

version: "3.9"

services:
  myapp:
    image: myorg/myapp:latest
    container_name: myapp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.myapp.rule=Host(`app.example.com`)"
      - "traefik.http.routers.myapp.entrypoints=websecure"
      - "traefik.http.routers.myapp.tls=true"
      - "traefik.http.routers.myapp.tls.certresolver=myresolver"
      - "traefik.http.services.myapp.loadbalancer.server.port=8080"
    networks:
      - traefik-net
    restart: unless-stopped

networks:
  traefik-net:
    external: true

Label breakdown:

• traefik.enable=true – makes the container visible to Traefik.
• traefik.http.routers.myapp.rule=Host(`app.example.com`) – matches the request’s Host header.
• entrypoints=websecure – routes traffic to the TLS entry point (port 443).
• tls.certresolver=myresolver – tells Traefik to obtain a certificate using the resolver defined earlier.
• loadbalancer.server.port=8080 – internal port where the app listens.

Repeat the label block for each service, changing the Host(...) value and internal port as needed. After updating the compose files, redeploy:

docker compose up -d

Traefik will detect the new labels, request certificates from Let’s Encrypt, and start routing traffic automatically.

5. Securing the Traefik Dashboard (Optional but Recommended)

Exposing the dashboard on :8080 without protection is a security risk. The simplest method is to enable HTTP basic authentication using a middleware.

Add Middleware to docker-compose.yml

services:
  traefik:
    # ... existing configuration ...
    command:
      # ... existing commands ...
      - "--api.dashboard=true"
      - "--entrypoints.dashboard.address=:8080"
      - "--serversTransport.insecureSkipVerify=true"
      - "--log.level=INFO"
    labels:
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefik-dashboard.entrypoints=dashboard"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/"

Explanation:

• The dashboard entrypoint listens on port 8080.
• Replace the admin:… hash with a value generated by htpasswd -nbB admin password on any Linux box.
• The router traefik-dashboard is only reachable via the subdomain traefik.example.com, which you should point to your server’s IP.

After applying the changes and restarting Traefik, visiting https://traefik.example.com:8080 will prompt for the credentials you set.

6. Verifying the Migration

Once all containers are labeled and Traefik is running, perform these checks:

1. Certificate issuance: curl -v https://app.example.com and look for SSL certificate verify ok. The first request may take a few seconds while Let’s Encrypt issues the cert.
2. Routing: Ensure each domain serves the correct application. A 404 from Traefik indicates a missing or mis‑typed label.
3. Dashboard: Log into https://traefik.example.com:8080 (or the IP address) to view active routers and services.
4. Renewal: Let’s Encrypt automatically renews certificates 30 days before expiry. You can force a renewal test with docker exec traefik traefik certs renew --dry-run.

If any service still responds with the old Nginx 404 page, double‑check that Nginx is fully stopped and that the container is attached to the traefik-net network.

Conclusion

Moving from a static Nginx reverse proxy to Traefik v3 simplifies SSL management for Dockerised workloads on your AtoZNode server. By running Traefik as a container, creating a shared Docker network, and adding a handful of labels to each service, you gain automatic Let’s Encrypt certificates, live configuration updates, and a handy dashboard—all without manual reloads. The steps above work on both Debian/Ubuntu and AlmaLinux/Rocky/RHEL flavours, ensuring a smooth transition regardless of your Linux distribution. Once verified, you can retire the old Nginx configuration and enjoy a more resilient, self‑maintaining proxy layer.