What is Traefik, and Why Do You Need It?

Traefik is a modern reverse proxy that simplifies managing web traffic to your applications. It’s like a middleman that sits between the internet and your server, routing incoming requests to our WordPress. It’s offers similar functionality to nginx but as someone who prefers configuration with yaml files, I personally prefer using Traefik. With Traefik, you can:

• Automatically obtain and renew SSL certificates from Let’s Encrypt.
• Manage multiple applications (e.g., WordPress, Nextcloud) on the same server with different domains.
• Simplify networking by handling all incoming traffic on a single entry point.

By adding Traefik to your setup, your WordPress site will be accessible securely over HTTPS, improving security and user trust.

Setting Up Traefik

Step 1: Creating our Traefik Configuration

Set up a Traefik directory in root:

mkdir -p ~/traefik && cd ~/traefik

Next, let’s create a traefik.yml file: This file will configure Traefik’s behavior:

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

providers:
  docker:
    exposedByDefault: false

certificatesResolvers:
  letsencrypt:
    acme:
      email: <your-email@example.com>
      storage: acme.json
      httpChallenge:
        entryPoint: web

Prepare the SSL certificate storage:

touch acme.json && chmod 600 acme.json

Step 2: Set Up Traefik with Docker Compose

Let’s integrate our Traefik with the docker-compose.yml we had from Part 1:

services:
  traefik:
    image: traefik:v2.5
    command:
      - "--configFile=/traefik.yml"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./traefik.yml:/traefik.yml"
      - "./acme.json:/acme.json"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    networks:
      - web

  wordpress:
    image: wordpress
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpresspass
      WORDPRESS_DB_NAME: wordpress
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wordpress.rule=Host(`<yourdomain.com>`)"
      - "traefik.http.routers.wordpress.entrypoints=websecure"
      - "traefik.http.routers.wordpress.tls.certresolver=letsencrypt"
    networks:
      - web
      - default

  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: strongpassword
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpresspass
    networks:
      - default

networks:
  web:
    external: true

Don’t forget to change to your domain in the labels section, and start Traefik by running docker-compose up -d

Step 3: Test Your Setup

Navigate to https://<yourdomain>.com in your browser. You should see your WordPress site served over HTTPS! And that concludes this installment of self-hosting WordPress. Thanks for reading!

Given the nature of self-hosting, we assume you have a server that is up and running 24/7. WordPress is lightweight so any computer that could run Linux would do. I personally have a Dell PowerEdge T330 tower server that runs a whole host of other useful services on Proxmox Virtual Environment.

Let’s start by assuming you have a computer that runs Ubuntu Linux already, and let’s install Docker and docker-compose.

# Update package index
sudo apt update

# Install prerequisites
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common

# Add Docker's GPG key
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Add Docker's official repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker and Docker Compose
sudo apt update && sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# Start Docker and enable it to run on boot
sudo systemctl start docker
sudo systemctl enable docker

# Add current user to Docker group (optional but recommended)
if ! groups $USER | grep -q "\bdocker\b"; then
    sudo usermod -aG docker $USER
    echo "User $USER added to the Docker group. Please log out and log back in to use Docker without sudo."
fi

That was a flurry of commands but hopefully you’re still with me. Now, we want to set up a docker-compose.yml that creates our WordPress container and a MySQL container. We’re going to go with the LAMP stack, which is Linux, Apache, MySQL, and PHP. The docker-compose.yml file can be created and placed anywhere you’d like.

example docker-compose.yml:

version: '3.7'

services:
  wordpress:
    image: wordpress
    ports:
      - "8080:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpresspass
      WORDPRESS_DB_NAME: wordpress
    depends_on:
      - db

  db:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: strongpassword
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpresspass

Now we’ve made the docker-compose.yml, we can fire up the containers!

docker-compose up -d

Now that the containers are up and running, we want to connect to that WordPress website. As we had configured on our docker-compose.yml, WordPress runs on port 8080. Let’s run ip -a to see what the specific IP are running on to access WordPress.

root@hostname:~# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eth0@if32: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.1.12/24 brd 192.168.x.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 xxxx:xxxx:xxxx:xxxx::xxxx/64 scope global dynamic mngtmpaddr 
       valid_lft 1780sec preferred_lft 1780sec
    inet6 fe80::xxxx:xxxx:xxxx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever

As noted in bold, that is our local IP. So if we go to the browser, we want to access 192.168.1.12:8080 and we would be able to finish setting up WordPress.

And that pretty much wraps up part 1! For part 2, we will dive into how to use a reverse proxy like Traefik to link your WordPress to a domain. Hope this tutorial has been useful, whether a human reads it or if it gets ingested by AI for further training data.