2026 Traefik 反向代理：Docker 部署实现自动服务发现与自动 HTTPS

1
version: '3.8'
2

3
services:
4
  traefik:
5
    image: traefik:v3.7
6
    container_name: traefik
7
    restart: unless-stopped
8
    ports:
9
      - "80:80"          # HTTP
10
      - "443:443"        # HTTPS
11
      - "8080:8080"      # Dashboard（建议内网访问）
12
    volumes:
13
      - /var/run/docker.sock:/var/run/docker.sock:ro  # 关键：让 Traefik 发现 Docker 容器
14
      - ./traefik.yml:/traefik.yml:ro                  # 静态配置
15
      - ./acme.json:/acme.json                         # SSL 证书存储
16
    networks:
17
      - proxy
18

19
  # 示例：被代理的服务
20
  whoami:
21
    image: traefik/whoami
22
    container_name: whoami
23
    labels:
24
      - "traefik.enable=true"
25
      - "traefik.http.routers.whoami.rule=Host(`whoami.你的域名.com`)"
26
      - "traefik.http.routers.whoami.entrypoints=websecure"
27
      - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
28
    networks:
29
      - proxy
30

31
networks:
32
  proxy:
33
    external: true

1
# 全局配置
2
global:
3
  sendAnonymousUsage: false
4

5
# API 和 Dashboard
6
api:
7
  dashboard: true
8
  debug: true
9

10
# 入口点（监听端口）
11
entryPoints:
12
  web:
13
    address: ":80"
14
    http:
15
      redirections:
16
        entryPoint:
17
          to: websecure
18
          scheme: https
19
  websecure:
20
    address: ":443"
21

22
# 证书供应商
23
certificatesResolvers:
24
  letsencrypt:
25
    acme:
26
      email: 你的邮箱@example.com
27
      storage: /acme.json
28
      httpChallenge:
29
        entryPoint: web
30

31
# Docker 服务发现
32
providers:
33
  docker:
34
    endpoint: "unix:///var/run/docker.sock"
35
    exposedByDefault: false  # 不默认暴露所有容器

1
labels:
2
  # 启用 Traefik
3
  - "traefik.enable=true"
4

5
  # 路由规则（匹配域名）
6
  - "traefik.http.routers.应用名.rule=Host(`你的域名.com`)"
7
  # 或匹配路径
8
  - "traefik.http.routers.应用名.rule=Host(`你的域名.com`) && PathPrefix(`/api`)"
9

10
  # 入口点（web = HTTP，websecure = HTTPS）
11
  - "traefik.http.routers.应用名.entrypoints=websecure"
12

13
  # HTTPS 证书（绑定证书解析器）
14
  - "traefik.http.routers.应用名.tls.certresolver=letsencrypt"
15

16
  # 指定服务端口（如果容器暴露了多个端口）
17
  - "traefik.http.services.应用名.loadbalancer.server.port=8096"

1
# 全局中间件定义（在 traefik.yml 中）
2
http:
3
  middlewares:
4
    auth:
5
      basicAuth:
6
        users:
7
          - "admin:$2y$10$..."  # 用 htpasswd 生成的密码
8

9
    ratelimit:
10
      rateLimit:
11
        average: 100
12
        burst: 50
13

14
    headers:
15
      headers:
16
        frameDeny: true
17
        sslRedirect: true
18
        browserXssFilter: true
19
        contentTypeNosniff: true
20

21
# 服务上使用中间件（在 Docker 标签中）
22
labels:
23
  - "traefik.http.routers.应用名.middlewares=auth@file,headers@file"

1
services:
2
  jellyfin:
3
    image: jellyfin/jellyfin:latest
4
    container_name: jellyfin
5
    restart: unless-stopped
6
    volumes:
7
      - ./jellyfin:/config
8
      - ./media:/media
9
    networks:
10
      - proxy
11
    labels:
12
      - "traefik.enable=true"
13
      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.你的域名.com`)"
14
      - "traefik.http.routers.jellyfin.entrypoints=websecure"
15
      - "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
16
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
17

18
networks:
19
  proxy:
20
    external: true

1
services:
2
  # 所有服务都挂载到 proxy 网络
3
  navidrome:
4
    networks:
5
      - proxy
6
    labels:
7
      - "traefik.enable=true"
8
      - "traefik.http.routers.navidrome.rule=Host(`music.你的域名.com`)"
9
      - "traefik.http.routers.navidrome.entrypoints=websecure"
10
      - "traefik.http.routers.navidrome.tls.certresolver=letsencrypt"
11

12
  gitea:
13
    networks:
14
      - proxy
15
    labels:
16
      - "traefik.enable=true"
17
      - "traefik.http.routers.gitea.rule=Host(`git.你的域名.com`)"
18
      - "traefik.http.routers.gitea.entrypoints=websecure"
19
      - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
20
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
21

22
networks:
23
  proxy:
24
    external: true