Configure Traefik labels for routing, SSL/TLS with LetsEncrypt, and advanced routing patterns including Cloudflare DNS challenge. Use when adding web access to Dokploy services.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
dokploy-traefik-routing
description
Configure Traefik labels for routing, SSL/TLS with LetsEncrypt, and advanced routing patterns including Cloudflare DNS challenge. Use when adding web access to Dokploy services.
version
1.0.0
author
Home Lab Infrastructure Team
Dokploy Traefik Routing
When to Use This Skill
When adding web-accessible services to Dokploy templates
When configuring SSL/TLS certificates via LetsEncrypt
When setting up custom routing rules (path-based, subdomain)
When enabling Cloudflare DNS challenge for wildcard certs
When user asks about "traefik routing" or "SSL setup"
When NOT to Use This Skill
For non-HTTP services (raw TCP/UDP ports) - use port mapping instead
For internal-only services (databases, caches) - no Traefik needed
For services behind Cloudflare Tunnel - different configuration
Prerequisites
Service must connect to dokploy-network
Domain name configured in environment variables
LetsEncrypt resolver configured in Traefik (standard in Dokploy)
Note: Requires Cloudflare API credentials in Traefik configuration.
Pattern 3: Path-Based Routing
Route different paths to different services:
# Main applabels:-"traefik.http.routers.app.rule=Host(`${DOMAIN}`)"# ...# API servicelabels:-"traefik.http.routers.api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"-"traefik.http.routers.api.entrypoints=websecure"-"traefik.http.routers.api.tls.certresolver=letsencrypt"-"traefik.http.services.api.loadbalancer.server.port=8080"-"traefik.docker.network=dokploy-network"
Pattern 4: Subdomain Routing
Route subdomains to different services:
# Main app at example.comlabels:-"traefik.http.routers.app.rule=Host(`${DOMAIN}`)"# ...# Admin at admin.example.comlabels:-"traefik.http.routers.admin.rule=Host(`admin.${DOMAIN}`)"-"traefik.http.routers.admin.entrypoints=websecure"-"traefik.http.routers.admin.tls.certresolver=letsencrypt"-"traefik.http.services.admin.loadbalancer.server.port=9000"-"traefik.docker.network=dokploy-network"
Pattern 5: Multiple Routers per Service
When a service needs different ports exposed:
labels:# Web UI-"traefik.http.routers.service-web.rule=Host(`${DOMAIN}`)"-"traefik.http.routers.service-web.entrypoints=websecure"-"traefik.http.routers.service-web.tls.certresolver=letsencrypt"-"traefik.http.services.service-web.loadbalancer.server.port=3000"# API endpoint-"traefik.http.routers.service-api.rule=Host(`api.${DOMAIN}`)"-"traefik.http.routers.service-api.entrypoints=websecure"-"traefik.http.routers.service-api.tls.certresolver=letsencrypt"-"traefik.http.services.service-api.loadbalancer.server.port=8080"-"traefik.docker.network=dokploy-network"
labels:-"traefik.enable=true"-"traefik.http.routers.api.rule=Host(`api.${DOMAIN}`)"-"traefik.http.routers.api.entrypoints=websecure"-"traefik.http.routers.api.tls.certresolver=letsencrypt"-"traefik.http.routers.api.middlewares=cors@docker"# CORS middleware-"traefik.http.middlewares.cors.headers.accessControlAllowMethods=GET,POST,PUT,DELETE,OPTIONS"-"traefik.http.middlewares.cors.headers.accessControlAllowHeaders=Content-Type,Authorization"-"traefik.http.middlewares.cors.headers.accessControlAllowOriginList=https://${DOMAIN}"-"traefik.http.middlewares.cors.headers.accessControlMaxAge=100"-"traefik.http.services.api.loadbalancer.server.port=8080"-"traefik.docker.network=dokploy-network"
services:forgejo:image:codeberg.org/forgejo/forgejo:9ports:-"${SSH_PORT:-2222}:22"# SSH access (raw port, not Traefik)networks:-forgejo-net-dokploy-networklabels:-"traefik.enable=true"-"traefik.http.routers.forgejo.rule=Host(`${FORGEJO_DOMAIN}`)"-"traefik.http.routers.forgejo.entrypoints=websecure"-"traefik.http.routers.forgejo.tls.certresolver=letsencrypt"-"traefik.http.services.forgejo.loadbalancer.server.port=3000"-"traefik.docker.network=dokploy-network"
Example 3: Service with Admin Subdomain
services:app:image:myapp:1.0.0networks:-app-net-dokploy-networklabels:# Main application-"traefik.enable=true"-"traefik.http.routers.app.rule=Host(`${DOMAIN}`)"-"traefik.http.routers.app.entrypoints=websecure"-"traefik.http.routers.app.tls.certresolver=letsencrypt"-"traefik.http.services.app.loadbalancer.server.port=8080"# Admin panel on subdomain-"traefik.http.routers.app-admin.rule=Host(`admin.${DOMAIN}`)"-"traefik.http.routers.app-admin.entrypoints=websecure"-"traefik.http.routers.app-admin.tls.certresolver=letsencrypt"-"traefik.http.services.app-admin.loadbalancer.server.port=9000"-"traefik.docker.network=dokploy-network"
Service Port Reference
Common service ports to use in loadbalancer configuration:
Use service name as router name (e.g., paaster, forgejo)
For multiple routers on one service, append suffix (e.g., app-web, app-api)
Security Requirements
Always use websecure entrypoint (HTTPS)
Always use letsencrypt or cloudflare certresolver
Consider adding security headers middleware for sensitive apps
Common Pitfalls
Pitfall 1: Missing dokploy-network label
Issue: Traefik can't reach service
Solution: Always include traefik.docker.network=dokploy-network
Pitfall 2: Duplicate router names
Issue: Routing conflicts, unpredictable behavior
Solution: Ensure each router name is unique across all compose files
Pitfall 3: Wrong port in loadbalancer
Issue: 502 Bad Gateway errors
Solution: Use the internal container port, not the exposed port
Pitfall 4: Service not on dokploy-network
Issue: Traefik can't route to service
Solution: Service must be connected to dokploy-network
Pitfall 5: Using HTTP entrypoint
Issue: Unencrypted traffic
Solution: Always use websecure, never web for production
Integration
Skills-First Approach (v2.0+)
This skill is part of the skills-first architecture - loaded during Generation phase to add Traefik routing labels after base compose structure is created.
Related Skills
dokploy-compose-structure: Network setup
dokploy-cloudflare-integration: Cloudflare DNS challenge, Zero Trust
