Frequently asked questions about Traefik, the shared edge proxy. See also Stack & Infrastructure and Architecture. What is Traefik's role? Traefik is the only shared component across sites. It sits at the edge as a reverse proxy, terminates SSL via Let's Encrypt, and routes traffic to each site's Nginx container. Every site attaches its own network to Traefik — Traefik never gets broad write access to site data. Why one Traefik, not one per site? A single shared Traefik lets all sites share automatic SSL, HTTP→HTTPS redirects, and a unified routing config without each site needing its own edge proxy. Site isolation is preserved because Traefik only proxies — it doesn't read or write site files or databases. The Docker socket risk Traefik reads the Docker socket to discover site containers dynamically. This is a known residual risk: a Traefik compromise could affect container discovery. Mitigations and the open question of socket-proxy adoption are tracked in the project's security docs. See Security. How do I check Traefik is running? wpfy stack status wpfy debug wpfy debug audits Traefik alongside Docker and every site. Traefik won't start / 502 errors wpfy debug — look for Traefik-specific checks. Check the proxy Docker network exists: docker network ls | grep proxy. Check Traefik logs: docker logs traefik --tail 50. Confirm ports 80/443 are free on the host (no other web server bound). Can I replace Traefik with Caddy/Nginx? Not without an ADR. wpfy's architecture is Traefik-first. The edge proxy is part of the documented design; swapping it is an architecture change that requires updating docs/DECISION-LOG.md and the relevant ADR. See Architecture.