<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Stack & Infrastructure]]></title><description><![CDATA[Traefik, Docker, architecture, server layout.

Maps to KB: https://docs.wpfy.org/stack-commands/ and https://docs.wpfy.org/reference/]]></description><link>https://forum.wpfy.org/category/9</link><generator>RSS for Node</generator><lastBuildDate>Fri, 21 Aug 2026 16:47:47 GMT</lastBuildDate><atom:link href="https://forum.wpfy.org/category/9.rss" rel="self" type="application/rss+xml"/><pubDate>Thu, 25 Jun 2026 02:46:06 GMT</pubDate><ttl>60</ttl><item><title><![CDATA[FAQ: Traefik edge proxy]]></title><description><![CDATA[Frequently asked questions about Traefik, the shared edge proxy. See also Stack &amp; Infrastructure and Architecture.
What is Traefik's role?
Traefik is the only shared component across sites. It sits at the edge as a reverse proxy, terminates SSL via Let's Encrypt, and routes traffic to each site's Nginx container. Every site attaches its own network to Traefik — Traefik never gets broad write access to site data.
Why one Traefik, not one per site?
A single shared Traefik lets all sites share automatic SSL, HTTP→HTTPS redirects, and a unified routing config without each site needing its own edge proxy. Site isolation is preserved because Traefik only proxies — it doesn't read or write site files or databases.
The Docker socket risk
Traefik reads the Docker socket to discover site containers dynamically. This is a known residual risk: a Traefik compromise could affect container discovery. Mitigations and the open question of socket-proxy adoption are tracked in the project's security docs. See Security.
How do I check Traefik is running?
wpfy stack status
wpfy debug

wpfy debug audits Traefik alongside Docker and every site.
Traefik won't start / 502 errors

wpfy debug — look for Traefik-specific checks.
Check the proxy Docker network exists: docker network ls | grep proxy.
Check Traefik logs: docker logs traefik --tail 50.
Confirm ports 80/443 are free on the host (no other web server bound).

Can I replace Traefik with Caddy/Nginx?
Not without an ADR. wpfy's architecture is Traefik-first. The edge proxy is part of the documented design; swapping it is an architecture change that requires updating docs/DECISION-LOG.md and the relevant ADR. See Architecture.
]]></description><link>https://forum.wpfy.org/topic/8/faq-traefik-edge-proxy</link><guid isPermaLink="true">https://forum.wpfy.org/topic/8/faq-traefik-edge-proxy</guid><dc:creator><![CDATA[arnab]]></dc:creator><pubDate>Thu, 25 Jun 2026 02:46:06 GMT</pubDate></item></channel></rss>