Traefik

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Traefik Proxy. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.medium or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that opens port 22 from your management network, port 80 for the dashboard and web entrypoint, and port 443 for the websecure entrypoint. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialization takes a few seconds after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Traefik Proxy Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing. Replace <key-name> with your EC2 key pair name and <subnet-id> with your subnet ID. Replace <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.medium \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=traefik}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name. You can find it in the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair. The login user on the Ubuntu 24.04 variant is ubuntu:

ssh -i <key-name>.pem ubuntu@<public-ip>

The dashboard password is unique to your instance and was generated on first boot. Read it as root:

sudo cat /root/traefik-credentials.txt

The file lists the dashboard URL, the dashboard user (admin) and the generated password, along with usage notes. Keep this password in a safe place.

The dashboard and API are served on port 80 under the /dashboard and /api path prefixes, behind an HTTP Basic authentication middleware. In a browser, go to:

http://<instance-public-ip>/dashboard/

The browser prompts you for credentials. Sign in as admin with the password from the credentials file. The dashboard home shows your entrypoints (the web entrypoint on :80, the websecure entrypoint on :443, and the loopback traefik and ping entrypoints) and a live count of HTTP and TCP routers, services and middlewares.

Select HTTP Routers in the sidebar to list every configured router with its rule, entrypoints, service and priority. Out of the box, you see the router that publishes the dashboard and API, and the ACME and ping routers that Traefik provides by default.

Select HTTP Services to inspect the backend services, their load-balancer servers and their health status. Routers reference services by name, and a service is what actually load-balances across your backend servers.

Over SSH, confirm that the service is active, the health endpoint answers, and the entrypoints are listening:

sudo systemctl is-active traefik curl -s http://127.0.0.1:8082/ping

The first command reports active and the ping endpoint returns OK. Confirm the binary version and that the entrypoints are bound:

traefik version
sudo ss -tlnp | grep -E ':(80|443|8080|8082) '

The output shows Traefik listening on :80 (the web entrypoint) and :443 (the websecure entrypoint). The dashboard entrypoint on 127.0.0.1:8080 and the ping entrypoint on 127.0.0.1:8082 are bound to loopback only.

Traefik is configured in two parts. The static configuration at /etc/traefik/traefik.yml defines the entrypoints, providers, the API and dashboard, and the certificate resolvers. Traefik reads it once at startup. The dynamic configuration is in /etc/traefik/dynamic/ and is watched by the file provider, so adding, editing or removing routers, services and middlewares there takes effect without a service restart.

sudo ls -la /etc/traefik/dynamic/

The listing includes dashboard.yml, which publishes the dashboard and API behind the HTTP Basic authentication middleware. Add your own YAML files alongside it to publish your backends.

To route traffic to one of your backends, create a router and a service in a new file under the watched dynamic configuration directory. The following example, saved as /etc/traefik/dynamic/my-app.yml, routes requests whose Host header is app.example.com on the web entrypoint to a backend at 10.0.0.10:8080:

http: routers: my-app: rule: "Host(`app.example.com`)" entryPoints: - web service: my-app services: my-app: loadBalancer: servers: - url: "http://10.0.0.10:8080"

Save the file, and Traefik reloads it within a second. Refresh the HTTP Routers and HTTP Services views in the dashboard, and your new router and service appear. Define weighted load balancing, health checks, sticky sessions, rate limiting, headers, redirects and circuit breakers the same way. See the Traefik routing documentation for the full set of options.

The Traefik API is published alongside the dashboard on port 80 under /api, behind the same HTTP Basic authentication. From outside the instance, send requests to http://<instance-public-ip>/api/... with basic authentication user admin and the generated password. For example, fetch the routers overview:

curl -s -u admin:<password> http://<instance-public-ip>/api/http/routers

The /api/overview endpoint returns the counts shown on the dashboard home, and /api/http/routers, /api/http/services and /api/http/middlewares return the full live configuration as JSON.

The static configuration, the dynamic configuration directory and the Let's Encrypt certificate store all live on a dedicated EBS volume mounted at /etc/traefik. This keeps your routing configuration and certificates off the operating system disk and lets you resize or snapshot them independently. Confirm the mount:

df -h /etc/traefik

To grow the volume, expand the EBS volume in the AWS console, then grow the file system on the instance by running sudo resize2fs on the underlying device. Because the dynamic configuration and the ACME store live here, your routers and issued certificates survive replacing the instance.

A Let's Encrypt certificate resolver named letsencrypt is preconfigured in the static configuration using the ACME HTTP-01 challenge, with its store at /etc/traefik/acme.json. It stays inactive until you attach it to a router with a real domain. To enable HTTPS for a backend, point a DNS A record at the instance's public IP, then add a router on the websecure entrypoint with TLS and the resolver, for example in /etc/traefik/dynamic/my-app.yml:

http: routers: my-app-secure: rule: "Host(`app.example.com`)" entryPoints: - websecure service: my-app tls: certResolver: letsencrypt

Before you request certificates for real domains, set the resolver email in /etc/traefik/traefik.yml to your own address. On the first request for the domain, Traefik obtains and stores the certificate automatically and renews it before expiry. Restrict the security group so that only the networks that need to reach your services can connect to ports 80 and 443.

To back up your configuration and certificates, snapshot the /etc/traefik EBS volume. The snapshot captures the static configuration, the dynamic configuration directory and the ACME store. Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Traefik starts automatically on boot. To upgrade Traefik itself, replace the binary at /usr/local/bin/traefik with a newer release and restart the service with sudo systemctl restart traefik.