traefik-best-practice/docker-traefik-tcp/README.md

# docker-traefik-tcp

Simple `docker-compose.yml` template to run Traefik in Docker with TCP routers. 

Port 443 is TCP-router enabled, it will use LetsEncrypt to create a cert for `HostSNI()`, you can connect to it via TLS, for example using `openssl s_client -connect tcp.example.com:443`. With this multiple (sub-)domains can be used, Traefik managing TLS and forwarding data stream un-encrypted.

Port 9000 is TCP-router enabled, just for plain TCP. Traefik can not see anything inside that connection, so only ```HostSNI(`*`)``` can be used for a single service. If you enable any TLS on the router, then Traefik will create a default cert, unless you load a custom TLS cert via `provider.file`. The target service can use plain TCP or create it's own custom TLS cert. Note that LetsEncrypt with httpChallenge and tlsChallenge only works with ports 80/443, so if the service wants to create a LE cert, it needs to use dnsChallenge.

## Features:

- Traefik is listening on ports 80 (http), 443 (https) and 9000 (plain TCP)
- All http requests will be redirected to secure https requests
- Docker services with label `traefik.enable=true` will automatically be discovered by Traefik
- Letsencrypt will automatically generate TLS/SSL certificates for all domains in `Host()` and `HostSNI()`
- Traefik log (`level=INFO`) and access log are enabled to container stdout/stderr
- Traefik dashboard is enabled at `https://traefik.example.com/dashboard/` with user/pass test/test

## Deployment:

- Adapt all domain names in `Host()` and `HostSNI()`
- Adapt `acme.email`
- Adapt dashboard username/password
- For production: write logs files to mounted folder on host
- Run `docker compose up -d`

## Notes:

- `websecure` entrypoint has LetsEncrypt for http(s), but the TCP router needs an additional LE assignment