I wanted to share my experience with switching from Nginx to Traefik in my TrueNAS Scale setup after encountering a frustrating bug in Nginx. Nginx had been working fine for routing traffic and handling SSL certificates, but after a recent update, I started facing issues that I couldn’t resolve, including:
- SSL certificate handling failures.
- Traffic routing problems.
- Configuration corruption, making it difficult to maintain the reverse proxy setup.
After spending a considerable amount of time troubleshooting, I decided to switch to Traefik . While I’m glad to have it working, the process was far from easy, and I wouldn’t describe it as seamless. That said, it’s now running and managing my services, which is a relief.
Why I Made the Switch
The decision to switch from Nginx to Traefik was driven entirely by the bug in Nginx. Here’s a summary of the issues I faced with Nginx:
- SSL certificate renewals were no longer working after a recent update.
- Failed requests to the backend services that were previously routed fine.
- Configuration corruption, resulting in additional routing errors and downtime.
Since I was already using Docker containers via Docker on TrueNAS Scale, Traefik was a natural fit. It’s a more modern solution that comes with automatic SSL management, dynamic routing based on Docker labels, and simplified configuration that I didn’t have with Nginx.
Traefik Setup in Dockge on TrueNAS Scale
1. Setting Up Traefik in Dockge
I started by setting up Traefik as a reverse proxy in Dockge. Below is the configuration for the Traefik service in docker-compose.yml:
version: '3.7'
services:
traefik:
image: traefik:v2.6
container_name: traefik
command:
- "--api.insecure=true" # Enables Traefik dashboard on a local network (not recommended for production)
- "--providers.docker=true" # Use Docker as the provider
- "--entryPoints.web.address=:80" # HTTP entry point
- "--entryPoints.websecure.address=:443" # HTTPS entry point
- "--certificatesresolvers.cloudflare.acme.dnsChallenge=true" # Use Cloudflare for ACME
- "--certificatesresolvers.cloudflare.acme.dnsChallenge.provider=cloudflare" # Set up DNS challenge
ports:
- "80:80" # HTTP port
- "443:443" # HTTPS port
volumes:
- "/var/run/docker.sock:/var/run/docker.sock" # Needed for Docker integration
- "./acme.json:/letsencrypt/acme.json" # Mount acme.json for SSL certificates
- "./cloudflare.env:/etc/traefik/cloudflare.env" # Mount Cloudflare credentials
labels:
- "traefik.enable=true"
2. Creating the Necessary Files
You’ll need to create a few files manually in your Traefik configuration directory. Here’s what you’ll need:
acme.json:
This file stores the SSL certificates that Traefik generates using the ACME protocol (via Let’s Encrypt or Cloudflare). Make sure to set proper permissions for this file:
touch acme.json
chmod 600 acme.json
cloudflare.env:
This file contains your Cloudflare API credentials. It allows Traefik to request SSL certificates via the DNS challenge. The file should look like this:
CLOUDFLARE_EMAIL=your-email@example.com
CLOUDFLARE_API_KEY=your-api-key
Create the file and add your Cloudflare API token or Global API Key with DNS management permissions.
3. docker-compose.yml:
This file defines the services Traefik will route traffic to (such as Nextcloud, Vaultwarden, Home Assistant, etc.). It’s where you’ll configure Traefik’s Docker integration.
4. dynamic.yml:
This file contains the dynamic routing configuration for your services, including SSL configuration and how traffic should be routed to each service. Here’s an example for Nextcloud:
http:
routers:
nextcloud:
rule: "Host(`cloud.nextcloud.com`)"
entryPoints:
- websecure
service: nextcloud-svc
tls:
certResolver: cloudflare
This file instructs Traefik on how to route traffic to Nextcloud, enforce HTTPS, and utilize Cloudflare for SSL certificates.
5. traefik.yml:
This file contains the static configuration for Traefik, like entry points, certificate resolvers, and logging settings. Here’s a basic configuration:
api:
dashboard: true
log:
level: DEBUG
entryPoints:
web:
address: ":80"
websecure:
address: ":443"
certificatesResolvers:
cloudflare:
acme:
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
This configures Traefik to listen on HTTP (port 80) and HTTPS (port 443) with automatic SSL certificate management via Cloudflare.
3. Manual Edits in dynamic.yml
Although Traefik allows dynamic routing via labels in the Docker configuration, I still had to manually edit the dynamic.yml file to ensure proper routing and SSL management for each service.
I had to:
- Add routing rules manually for each service (e.g., Nextcloud, Vaultwarden, Home Assistant).
- Specify the domain name and TLS settings for each service.
- Configure Cloudflare for SSL management for every service.
This step isn’t fully automatic in Traefik, but once configured, it’s much easier to manage new services by simply adding them to dynamic.yml.
4. Configuring Services with Traefik Labels
Next, I configured each of my services to be routed through Traefik by adding Traefik labels in the Docker configurations. Here’s an example for Nextcloud:
services:
nextcloud:
image: nextcloud
container_name: nextcloud
labels:
- "traefik.enable=true"
- "traefik.http.routers.nextcloud.rule=Host(`cloud.nextcloud.com`)"
- "traefik.http.routers.nextcloud.entryPoints=websecure"
- "traefik.http.routers.nextcloud.tls.certResolver=cloudflare" # Use Cloudflare for SSL
networks:
- proxy
volumes:
- nextcloud_data:/var/www/html
# Define the shared proxy network used by Traefik and all routed services
networks:
proxy:
name: proxy
driver: bridge
I used Traefik labels to specify routing rules for each container, including the domain name and TLS settings.
5. Configuring Cloudflare for SSL Certificates
I’m using Cloudflare to manage SSL certificates with Traefik’s ACME DNS challenge. Here’s how I set it up in Traefik:
certificatesresolvers:
cloudflare:
acme:
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
email: "your-email@example.com"
storage: /letsencrypt/acme.json
This ensures Traefik automatically handles SSL certificate issuance and renewal via Cloudflare.
6. Restarting Traefik and Services
Once I updated the configuration, I restarted Traefik and my other containers (Nextcloud, Vaultwarden, Home Assistant) for the changes to take effect:
docker-compose down
docker-compose up -d
7. Verifying HTTPS and Access
After restarting everything, I was able to access my services over HTTPS without any login prompts. Traefik handled the SSL certificates automatically, and the traffic was routed correctly to my Docker containers.
Why Traefik Over Nginx?
- Automatic SSL Handling: Traefik automatically manages SSL certificates through Cloudflare, eliminating the need for manual configuration and certificate renewal.
- Dynamic Routing: With Docker labels, I can easily route traffic to new services without manually editing configuration files.
- Simpler Configuration: Traefik’s configuration is cleaner and simpler, especially when using Docker.
- Scalability: Adding new services is easy—apply the correct labels, and Traefik handles the rest.
Final Thoughts
Switching to Traefik was ultimately the right decision, but I won’t sugarcoat it—it was a huge pain in the ass. While Traefik solved the issues I was facing with Nginx, the setup process involved a significant amount of manual configuration, troubleshooting, and trial and error. The automatic SSL handling, dynamic routing, and simpler configuration are all nice, but they didn’t come without their challenges.
If you’re facing similar issues with Nginx or need a modern and scalable solution for managing your reverse proxy, Traefik could be the way to go. Just be prepared for some headaches along the way.
Feel free to reach out if you have any questions or need help with setting it up in your TrueNAS Scale environment. You’re not alone in this!
But here’s the real kicker: when Nginx made some breaking changes (I mean, who doesn’t love a little change with no second option), the community was left with ‘fix it yourself’ vibes. 
