Traefik Routing

Overview

Traefik v3 runs as the gateway for all WeekendBuilder apps. It listens on ports 80 and 443, reads Docker labels to discover services, and provisions TLS certificates automatically via Let’s Encrypt.

Config Files

File	Purpose
infrastructure/traefik/traefik.yml	Static config: entrypoints, Docker provider, ACME
infrastructure/traefik/dynamic/middlewares.yml	Dynamic config: secure-headers and gzip middleware

Entrypoints

• web (port 80): Redirects all HTTP to HTTPS — no content is served over plain HTTP.
• websecure (port 443): Serves all apps over TLS.

Certificate Resolver

Traefik uses the letsencrypt resolver with HTTP-01 challenge:

certificatesResolvers:
  letsencrypt:
    acme:
      email: you@example.com
      storage: /letsencrypt/acme.json
      httpChallenge:
        entryPoint: web

Certificates are stored in infrastructure/traefik/letsencrypt/acme.json on the VPS (bind-mounted into the Traefik container). This file is git-ignored and persists across restarts.

App Labels

Every app declares its routing via Docker Compose labels:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.wb-docs.rule=Host(`docs.weekendbuilder.io`)"
  - "traefik.http.routers.wb-docs.entrypoints=websecure"
  - "traefik.http.routers.wb-docs.tls.certresolver=letsencrypt"
  - "traefik.http.routers.wb-docs.middlewares=secure-headers@file,gzip@file"
  - "traefik.http.services.wb-docs.loadbalancer.server.port=80"

The router name (wb-docs) must be unique across all apps.

Docker Network

All apps attach to the external web network. Traefik watches this network for containers with traefik.enable=true.

networks:
  web:
    external: true

The network is created once:

docker network create web

and referenced as external: true in every docker-compose.yml.