FAQ: Traefik edge proxy

[arnab]

Frequently asked questions about Traefik, the shared edge proxy. See also Stack & Infrastructure and Architecture.

What is Traefik's role?

Traefik is the only shared component across sites. It sits at the edge as a reverse proxy, terminates SSL via Let's Encrypt, and routes traffic to each site's Nginx container. Every site attaches its own network to Traefik — Traefik never gets broad write access to site data.

Why one Traefik, not one per site?

A single shared Traefik lets all sites share automatic SSL, HTTP→HTTPS redirects, and a unified routing config without each site needing its own edge proxy. Site isolation is preserved because Traefik only proxies — it doesn't read or write site files or databases.

The Docker socket risk

Traefik reads the Docker socket to discover site containers dynamically. This is a known residual risk: a Traefik compromise could affect container discovery. Mitigations and the open question of socket-proxy adoption are tracked in the project's security docs. See Security.

How do I check Traefik is running?

wpfy stack status
wpfy debug

wpfy debug audits Traefik alongside Docker and every site.

Traefik won't start / 502 errors

1. wpfy debug — look for Traefik-specific checks.
2. Check the proxy Docker network exists: docker network ls | grep proxy.
3. Check Traefik logs: docker logs traefik --tail 50.
4. Confirm ports 80/443 are free on the host (no other web server bound).

Can I replace Traefik with Caddy/Nginx?

Not without an ADR. wpfy's architecture is Traefik-first. The edge proxy is part of the documented design; swapping it is an architecture change that requires updating docs/DECISION-LOG.md and the relevant ADR. See Architecture.