Production Self-Hosting with Docker Compose, Traefik v3 & Automated TLS
Step-by-step blueprint for hosting enterprise services with Traefik reverse proxy, automated Let’s Encrypt wildcard certificates via Cloudflare DNS challenge, and hardened security headers.
Self-hosting enterprise services shouldn’t mean compromising on TLS hygiene or operational security. By combining Docker Compose with Traefik v3, edge routing is configured dynamically using container labels, eliminating manual Nginx configurations.
1. Dynamic Edge Discovery with Traefik v3
Traefik listens to the Docker daemon socket (shielded via a read-only socket proxy container) to automatically discover running containers and configure HTTP/HTTPS entrypoints, load balancing, and middleware chains on the fly.
2. Wildcard TLS via Cloudflare DNS Challenge
Using Cloudflare API tokens, Traefik completes ACME DNS-01 challenges to generate wildcard certificates (*.ironbear.win) without opening port 80 to the public web. Internal services remain 100% private while benefiting from trusted TLS certificates.
3. Hardened Security Middleware
Reusable Traefik middleware injects strict security headers across every route: HSTS with preload, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and rate limiting to thwart brute-force attempts.
Written by Derek Kaelin-Lock
Exploring the intersection of modern frontend architectures, CMS patterns, and developer experience.