Traefik + Docker Compose

Traefik is configured with labels on the container rather than a separate config file, which makes it a natural fit if you already run it in front of your other containers. If you do not, Caddy is less work for the same result. If you are not sure what a reverse proxy is or why she needs one, Domain and HTTPS explains it first.

Which port, and why

Route to her	Port	Reason
Traefik, on this page	`5000`	Traefik does not go through the host. It reaches the container directly over the Docker network, so it uses the port she actually listens on inside the container.
Everywhere else in these guides	`4007`	That is where Docker Compose publishes her on the host.

Both numbers are right, for different routes to the same place.

Set it up

Add Traefik to your Docker Compose file

version: '3.8'
services:
  postqueen:
    ##
    ## Include all the other configuration from the standard compose example.
    ##

    labels:
      # Required. The Traefik service below runs with exposedbydefault=false,
      # so without this line Traefik ignores the container entirely and the
      # four labels underneath never become a router.
      - "traefik.enable=true"
      # Router for main PostQueen entrypoint (on port 5000)
      - "traefik.http.routers.postqueen.rule=Host(`postqueen.example.com`)"  # Replace with your domain
      - "traefik.http.services.postqueen.loadbalancer.server.port=5000"  # Internal port for postqueen
      - "traefik.http.routers.postqueen.entrypoints=websecure"  # PostQueen requires HTTPS
      - "traefik.http.routers.postqueen.tls=true"


  traefik:
    image: "traefik:v2.9"
    container_name: "traefik"
    command:
      #- "--log.level=DEBUG"
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
    ports:
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - postqueen-network

Because Traefik reaches her over the Docker network, the ports: mapping on the PostQueen service is no longer needed and is worth removing. Leaving it in place publishes her on host port 4007 as well, which bypasses your proxy and your HTTPS.

Tell PostQueen her address

Routing alone is not enough. She also has to know the address people use, because sign-in origins and every social network’s return address are built from it. In the same docker-compose.yaml, on the postqueen service:

    environment:
      MAIN_URL: 'https://postqueen.example.com'
      FRONTEND_URL: 'https://postqueen.example.com'
      NEXT_PUBLIC_BACKEND_URL: 'https://postqueen.example.com/api'

Keep the /api suffix, and leave no trailing slashes.

Apply it with docker compose down && docker compose up -d.

Check it

curl -I https://postqueen.example.com

HTTP/2 200 means the router and PostQueen are both working.

This block does not get you a real certificate. tls=true turns TLS on, but with no certificate resolver configured Traefik serves its own self-signed default, so browsers warn and curl needs -k. Add a resolver, usually ACME against Let’s Encrypt, and name it on the router with traefik.http.routers.postqueen.tls.certresolver. Traefik’s own ACME documentation has the entrypoint and storage settings that go with it.Caddy does this part for you, which is why it is the shorter path.

A 404 from Traefik instead is usually a missing traefik.enable=true label, since the service above runs with exposedbydefault=false.

Next steps

Caddy

The shorter path, with certificates handled for you.

Nginx

The right choice when you already run Nginx for other things.

WebSockets and dev tunnels

Path routing for split deployments, and HMR behind a tunnel.

Self-host gotchas

What tends to break once she is behind a proxy.

Start here

Install

Domain and HTTPS

Configuration

Connect your channels

Operations

Other install methods

Extend PostQueen

Which port, and why

Set it up

Next steps

Caddy

Nginx

WebSockets and dev tunnels

Self-host gotchas

​Which port, and why

​Set it up

​Next steps

Caddy

Nginx

WebSockets and dev tunnels

Self-host gotchas

Which port, and why

Set it up

Next steps