traefik

Best Practices

• Define entryPoints for HTTP (port 80) and HTTPS (port 443) with HTTP-to-HTTPS redirection
• Configure automatic HTTPS with Let's Encrypt via certificatesResolvers using httpChallenge or tlsChallenge
• Use middleware chains for authentication, rate limiting, security headers, and request transformation
• Enable access logging with structured format for observability and debugging
• Set exposedByDefault to false for Docker provider to prevent unintended service exposure
• Never expose the Traefik dashboard without authentication middleware (basicAuth or forwardAuth)
• Configure health checks on loadBalancer services with path, interval, and timeout
• Use file provider with directory watching for dynamic configuration without restarts