index

How to Setup Traefik with Wildcard SSL Certificates and Dynamic Routing

Building a multi-tenant system with automatic subdomain provisioning made simple

When I started building a multi-tenant application that required dynamic subdomain allocation, I quickly realized that traditional reverse proxy setups weren’t going to cut it. I needed something that could automatically handle SSL certificates for an unlimited number of subdomains and route traffic intelligently based on the incoming domain.

Initially, I was using Cloudflare Tunnel—and I’ll admit, it’s an incredible tool that makes this kind of setup almost effortless. But as my project grew, I wanted more control and independence from external services. That’s when I discovered Traefik, and after wrestling with its configuration for longer than I’d like to admit, I finally cracked the code.

The Challenge: Multi-Tenant Subdomain Management

Picture this scenario: you’re building a SaaS application where each customer gets their own subdomain. When someone signs up for your service, you want to instantly give them access to customer1.yourdomain.com, startup-x.yourdomain.com, or whatever subdomain they choose.

The traditional approach would involve manually configuring nginx or Apache for each new subdomain, updating SSL certificates, and restarting services. Not exactly scalable when you’re hoping to onboard hundreds or thousands of tenants.

What we need is a system that can:

Automatically issue SSL certificates for any subdomain
Route traffic based on the incoming domain
Handle HTTPS redirection seamlessly
Scale without manual intervention

This is where Traefik shines.

Why Traefik for Dynamic Routing?

Traefik is a modern reverse proxy and load balancer that’s designed specifically for dynamic environments like Docker and Kubernetes. Unlike traditional proxies that require manual configuration updates, Traefik automatically discovers services and configures routing rules based on labels and annotations.

The magic happens through its integration with Let’s Encrypt and DNS providers. Instead of managing individual certificates for each subdomain, Traefik can request a single wildcard certificate that covers your entire domain and all its subdomains.

Setting Up the Foundation

Before diving into the configuration, you’ll need a few things in place. First, your domain needs to be managed by Cloudflare (we’ll use their DNS API for certificate validation). You’ll also need Docker and Docker Compose installed on your server.

The setup revolves around three main components: the Traefik container itself, its configuration file, and your application containers with proper labeling.

Getting Your Cloudflare Credentials

Head over to the Cloudflare dashboard and create an API token with DNS editing permissions. This token allows Traefik to create temporary DNS records that Let’s Encrypt uses to verify domain ownership. Store this token in an environment file:

CF_DNS_API_TOKEN=your_cloudflare_api_token_here

The Traefik Container Configuration

The heart of our setup is the Traefik container. Here’s how I configure it:

1
version: '3.8'
2

3
services:
4
  traefik:
5
    image: traefik:v3.0
6
    container_name: traefik
7
    restart: unless-stopped
8

9
    # Security hardening
10
    security_opt:
11
      - no-new-privileges:true
12

13
    networks:
14
      - shared_net
15

16
    ports:
17
      - '80:80' # HTTP traffic
18
      - '443:443' # HTTPS traffic
19

20
    environment:
21
      CF_API_TOKEN: ${CF_DNS_API_TOKEN}
22
    env_file: .env
23

24
    volumes:
25
      - /etc/localtime:/etc/localtime:ro
26
      - /var/run/docker.sock:/var/run/docker.sock:ro
27
      - ./data/traefik.yml:/traefik.yml:ro
28
      - ./data/acme.json:/acme.json
29

30
    labels:
31
      - 'traefik.enable=true'
32
      - 'traefik.http.routers.traefik.entrypoints=http'
33
      - 'traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https'
34
      - 'traefik.http.routers.traefik.middlewares=traefik-https-redirect'
35
      - 'traefik.http.routers.traefik-secure.entrypoints=https'
36
      - 'traefik.http.routers.traefik-secure.tls=true'
37
      - 'traefik.http.routers.traefik-secure.tls.certresolver=cloudflare'
38
      - 'traefik.http.routers.traefik-secure.service=api@internal'
39

40
networks:
41
  shared_net:
42
    external: true

The key insight here is the volume mount for /var/run/docker.sock. This gives Traefik access to the Docker daemon, allowing it to automatically discover new containers and their configurations.

The Configuration Deep Dive

The real magic happens in the traefik.yml configuration file. This is where we define how Traefik should behave, how it should obtain certificates, and how it should route traffic.

1
api:
2
  dashboard: true
3
  debug: true
4

5
entryPoints:
6
  http:
7
    address: ':80'
8
    http:
9
      redirections:
10
        entryPoint:
11
          to: https
12
          scheme: https
13
  https:
14
    address: ':443'
15

16
serversTransport:
17
  insecureSkipVerify: true
18

19
providers:
20
  docker:
21
    endpoint: 'unix:///var/run/docker.sock'
22
    exposedByDefault: false
23

24
certificatesResolvers:
25
  cloudflare:
26
    acme:
27
      email: [email protected]
28
      storage: acme.json
29
      caServer: https://acme-v02.api.letsencrypt.org/directory
30
      dnsChallenge:
31
        provider: cloudflare
32
        disablePropagationCheck: true
33
        delayBeforeCheck: 60s
34
        resolvers:
35
          - '1.1.1.1:53'
36
          - '1.0.0.1:53'
37

38
log:
39
  level: DEBUG

The certificatesResolvers section is where the wildcard SSL magic happens. By using the DNS challenge method with Cloudflare, Traefik can obtain certificates for domains that don’t even exist yet. This is perfect for our dynamic subdomain scenario.

Configuring Your Application

Now comes the interesting part—configuring your application to work with this setup. The beauty of Traefik is that all the routing logic is defined through Docker labels:

1
services:
2
  myapp:
3
    build:
4
      context: .
5
      dockerfile: Dockerfile
6
    env_file:
7
      - .env
8

9
    labels:
10
      - 'traefik.enable=true'
11
      - "traefik.http.routers.myapp-web.rule=HostRegexp(`[a-z0-9-]+\\.yourdomain\\.com`) || Host(`yourdomain.com`)"
12
      - 'traefik.http.routers.myapp-web.tls=true'
13
      - 'traefik.http.routers.myapp-web.tls.certresolver=cloudflare'
14
      - 'traefik.http.routers.myapp-web.tls.domains[0].main=yourdomain.com'
15
      - 'traefik.http.routers.myapp-web.tls.domains[0].sans=*.yourdomain.com'
16
      - 'traefik.http.services.myapp-web.loadbalancer.server.port=80'
17

18
    restart: unless-stopped
19
    networks:
20
      - shared_net
21

22
networks:
23
  shared_net:
24
    external: true

The routing rule HostRegexp(\[a-z0-9-]+\.yourdomain\.com`) || Host(`yourdomain.com`)` is doing the heavy lifting here. It tells Traefik to route any request that matches either:

A subdomain pattern (like tenant1.yourdomain.com or my-app.yourdomain.com)
The apex domain (yourdomain.com)

Handling Multi-Tenancy in Your Application

With the infrastructure in place, your application needs to be smart about handling different subdomains. In most cases, this means extracting the subdomain from the incoming request and using it to determine which tenant’s data to serve.

Here’s a simple example of how you might handle this in a Node.js application:

1
app.use((req, res, next) => {
2
  const host = req.get('host')
3
  const subdomain = host.split('.')[0]
4

5
  if (subdomain !== 'yourdomain') {
6
    req.tenant = subdomain
7
  }
8

9
  next()
10
})

This middleware extracts the subdomain and makes it available throughout your application, allowing you to customize the experience for each tenant.

The Deployment Process

Getting everything running is straightforward once you have all the pieces in place:

Create the shared Docker network:
Terminal window
```
docker network create shared_net
```
Ensure your certificate storage file exists and has proper permissions:
Terminal window
```
mkdir -p data
touch data/acme.json
chmod 600 data/acme.json
```
Start Traefik:
Terminal window
```
docker-compose up -d
```
Deploy your application containers with the appropriate labels

The first time you start this setup, you’ll see Traefik reaching out to Let’s Encrypt to obtain your wildcard certificate. This process usually takes a minute or two, but once complete, all your subdomains will be automatically secured with HTTPS.

What Happens Behind the Scenes

When a request comes in for customer1.yourdomain.com, here’s what happens:

Traefik receives the request and checks its routing rules
The request matches your HostRegexp pattern
Traefik forwards the request to your application container
Your application extracts the subdomain and serves tenant-specific content
The response is sent back through Traefik with proper SSL encryption

The entire process is seamless and happens in milliseconds.

Monitoring and Troubleshooting

One of Traefik’s best features is its built-in dashboard, which gives you real-time visibility into your routing rules, SSL certificates, and service health. You can access it by configuring a route to the internal API service.

When things go wrong (and they sometimes do), the logs are your friend:

docker-compose logs -f traefik

Common issues I’ve encountered include:

Certificate generation failures due to incorrect API tokens
Routing problems caused by network configuration issues
Port conflicts when applications aren’t listening on the expected ports

Performance Considerations

This setup scales remarkably well. I’ve run systems handling hundreds of subdomains without any performance degradation. Traefik’s routing is extremely efficient, and the wildcard certificate approach means you’re not hitting Let’s Encrypt’s rate limits as you add new tenants.

The main bottleneck is usually your application’s ability to handle multi-tenancy efficiently, not the proxy layer.

Security Implications

While this setup is generally secure, there are a few considerations:

The acme.json file contains your SSL certificates and private keys—protect it with appropriate file permissions
Consider implementing rate limiting and access controls for production deployments
The Traefik dashboard should be secured or disabled in production environments

Beyond Basic Routing

Once you have this foundation in place, Traefik opens up a world of possibilities. You can add middleware for authentication, implement circuit breakers, set up blue-green deployments, and much more. The label-based configuration system makes it easy to add these features without complex configuration files.

The Payoff

After wrestling with the initial configuration complexity, I now have a system that automatically handles SSL certificates for any subdomain I throw at it. New tenants can be onboarded instantly without any infrastructure changes. The entire setup is declarative and version-controlled, making it easy to replicate across different environments.

What started as a frustrating configuration challenge has become one of the most reliable parts of my infrastructure. And the best part? It just works, silently handling thousands of requests across dozens of subdomains without any manual intervention.

If you’re building a multi-tenant application or just need dynamic subdomain handling, this Traefik setup provides a robust foundation that scales with your needs. The upfront investment in understanding the configuration pays dividends as your application grows.

How to setup traefik with wildcard SSL certificates and routing