Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Run Traefik as the public edge proxy, place your application replicas on a private Docker network, and let Docker labels define how requests are routed. Traefik listens on ports 80 and 443, terminates HTTPS, distributes requests among healthy containers, and removes a backend when its readiness check fails. This design keeps application ports off the public internet while allowing you to scale a service on one VPS.
The guide below uses Docker Compose, a hostname such as app.example.com, and an application that listens on port 8080 inside its container. Replace those example values with your own domain, image, and internal port.
How the Traefik load-balancing path works
Traefik separates traffic handling into five parts:
- Providers discover infrastructure. With the Docker provider enabled, Traefik watches container metadata and labels.
- Entrypoints are listening sockets, such as HTTP on port 80 and HTTPS on port 443.
- Routers inspect a request and decide whether a rule, such as a hostname match, applies.
- Services forward matching requests to one or more backend servers and perform load balancing.
- Middlewares can redirect, rewrite, authenticate, rate-limit, or otherwise modify requests before they reach the service.
For a typical VPS deployment, the browser connects to the VPS address, Traefik accepts the connection, and the selected application container receives the request over a user-defined Docker network. The application containers do not need published host ports.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Traefik’s Docker provider can create routers and services from labels. The label traefik.http.services.<service>.loadbalancer.server.port tells Traefik which container port to use; it is the port inside the container, not a host port.
What you need before starting
- A VPS with Docker Engine and Docker Compose installed.
- A DNS A or AAAA record for your application hostname pointing to the VPS public IP address.
- Inbound TCP 80 and 443 allowed by both the VPS firewall and your hosting provider’s firewall.
- An application image that can run more than one instance and listens on a known internal port.
- A readiness endpoint, for example
/readyor/healthz, that returns success only when the instance can serve traffic. - Persistent storage for Traefik’s ACME certificate state if you will use automatic Let’s Encrypt certificates.
Use a current Traefik image and check the current v3 rule syntax before copying examples from older tutorials. Older rule-syntax options are deprecated, and v1/v2 snippets may not work as written with current releases.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prepare the VPS and DNS
Install the container runtime
Install Docker Engine and the Compose plugin using the instructions for your VPS operating system. Confirm that both commands work:
docker version
docker compose versionRun the deployment from a directory dedicated to this stack, such as /opt/traefik-app. Keep the Compose file, environment files, and ACME storage there, and restrict access to the directory to administrators.
Point the hostname at the VPS
Create a DNS record for the exact hostname used by your router rule. For example, app.example.com must resolve to the VPS address before certificate issuance can succeed. If you use both IPv4 and IPv6, verify that each address reaches this VPS and that the firewall allows the corresponding traffic.
Open only the edge ports
Allow TCP 80 and 443 at the provider firewall and the operating-system firewall. Do not open the application’s internal port, such as 8080, unless you have a specific operational reason. Traefik should be the only container publishing public web ports.
Create a private Docker network
Traefik and every application replica must share a user-defined Docker network. A shared network lets Traefik resolve containers and connect to their internal addresses without exposing those addresses on the VPS.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Create the network once:
docker network create webIf the network is declared in Compose, mark it as external when it is created separately:
networks:
web:
external: trueAlternatively, let Compose create it by omitting external. Whichever method you choose, attach Traefik and the application service to the same network. If a container is connected to several networks, explicitly tell Traefik which one to use with the Docker provider’s network setting or the appropriate label; otherwise it may select an unintended address.
Define Traefik’s static configuration
Static settings tell Traefik which entrypoints and providers exist. A compact Compose service looks like this:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallservices:
traefik:
image: traefik:v3.0
restart: unless-stopped
command:
- --providers.docker=true
- --providers.docker.exposedbydefault=false
- --providers.docker.network=web
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --certificatesresolvers.letsencrypt.acme.email=admin@example.com
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./letsencrypt:/letsencrypt
networks:
- web
networks:
web:
external: trueThe example enables the Docker provider, disables automatic exposure, creates web and websecure entrypoints, and stores ACME state on a mounted directory. Pin the image to a version you have reviewed rather than relying on an unqualified floating tag.
Protect the Docker socket
Traefik needs Docker API visibility to discover containers, but the Docker socket is highly privileged. Mounting it read-only reduces accidental writes but does not make the API harmless. For higher isolation, place a socket-proxy between Traefik and Docker and allow only the API operations required for discovery. Keep the socket and proxy off the public network.
Add the application service and labels
Attach the application to the same network and define one logical Traefik service. This example assumes the application listens on port 8080 and exposes a readiness endpoint at /ready:
services:
app:
image: example/app:1.4.2
restart: unless-stopped
networks:
- web
labels:
- traefik.enable=true
- traefik.http.routers.app.rule=Host(`app.example.com`)
- traefik.http.routers.app.entrypoints=websecure
- traefik.http.routers.app.tls=true
- traefik.http.routers.app.tls.certresolver=letsencrypt
- traefik.http.services.app.loadbalancer.server.port=8080
- traefik.http.services.app.loadbalancer.healthcheck.path=/ready
- traefik.http.services.app.loadbalancer.healthcheck.interval=10s
- traefik.http.services.app.loadbalancer.healthcheck.timeout=3s
networks:
web:
external: trueThese labels do the following:
traefik.enable=trueopts this container into publication whenexposedByDefault=falseis active.- The router’s
Hostrule limits matching toapp.example.com. - The
websecureentrypoint andtls=truerequire HTTPS. certresolver=letsencryptselects the ACME resolver defined in the static configuration.- The service port label points Traefik at port 8080 inside the container.
- The health-check labels tell Traefik to probe a readiness path and stop sending traffic when the check fails.
Use backticks inside the Host rule exactly as shown. YAML quoting around the complete label prevents the backticks and punctuation from being interpreted by the YAML parser.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Run multiple replicas behind one logical service
Traefik load-balances the servers it discovers for the same logical service. Start one instance first and verify it works, then run additional instances using Compose scaling or separately named containers.
docker compose up -d app
docker compose up -d --scale app=3Do not set a fixed container_name on a service you intend to scale; Compose needs distinct names for each replica. Each replica must expose the same internal port, share the web network, and implement the readiness endpoint consistently.
Before directing production traffic to all replicas, test each instance independently from inside the network or by temporarily targeting it. A replica that starts successfully but has a broken database connection, missing migration, or unusable dependency should fail its readiness check rather than receive requests.
Configure active health checks
An active check asks each backend whether it is ready. Configure the path, interval, timeout, method, status expectations, port, scheme, and redirect behavior as needed for your application. The exact option names available depend on the Traefik version, so verify them against the current Docker-provider reference.
Choose a meaningful readiness endpoint
A process-only check, such as testing whether a TCP socket is open, can leave a running but unusable application in rotation. A readiness endpoint should verify the conditions required to serve a real request, such as database connectivity, required migrations, or access to a critical dependency. Keep the endpoint fast and avoid exposing sensitive diagnostics in its response.
Understand removal and recovery
When a backend fails its configured checks, Traefik removes it from the active server set. Once checks pass again, Traefik can add it back. The check interval and timeout determine how quickly this happens; overly aggressive values can cause flapping when the application is merely busy, while very slow values delay failure detection.
Redirect HTTP and issue HTTPS certificates
Add an HTTP-to-HTTPS redirect
ACME’s HTTP challenge needs port 80 reachable, and users should end up on HTTPS. Add a redirect middleware and an HTTP router:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
command:
- --entrypoints.web.http.redirections.entrypoint.to=websecure
- --entrypoints.web.http.redirections.entrypoint.scheme=httpsWith this entrypoint redirect, requests arriving on port 80 are sent to HTTPS while the ACME challenge remains handled by Traefik’s configured resolver. If you use a more specific redirect middleware instead, ensure that the challenge path is still reachable during issuance and renewal.
Persist ACME state
Traefik stores certificates and account data in the file configured by acme.storage. The mounted directory must survive container recreation. Create the file with restrictive permissions before the first start:
mkdir -p letsencrypt
touch letsencrypt/acme.json
chmod 600 letsencrypt/acme.jsonBack up this file securely. Losing it repeatedly can trigger unnecessary certificate reissuance and may run into certificate-authority rate limits. Do not commit it to source control or make it downloadable through a web server.
Automatic issuance requires correct DNS, reachable port 80 for the HTTP challenge, and a router associated with the resolver. For a first deployment, watch Traefik logs while requesting the hostname and correct DNS or firewall errors before troubleshooting the application.
Free tools Windows power users keep installed
One-click scans. No signup required.
Start the stack and verify it
- Validate the Compose file:
docker compose config. Fix YAML, interpolation, and label errors before starting. - Start Traefik and one application instance:
docker compose up -d. - Review startup and provider logs:
docker compose logs -f traefik. - Confirm that DNS resolves to the VPS and request
http://app.example.com. It should redirect to HTTPS if the redirect is enabled. - Open
https://app.example.comand verify the certificate hostname and validity. - Scale the service:
docker compose up -d --scale app=3. - Generate repeated requests and inspect application logs to confirm that more than one replica receives traffic. Do not infer distribution from a single request; connection reuse and browser behavior can make one client appear sticky.
- Make one replica fail its readiness check, then verify that new requests avoid it. Restore the check and verify that the replica returns only after it becomes ready.
These checks test routing, certificate issuance, replica discovery, distribution, and failure recovery—the behaviors that matter more than merely seeing containers in a running state.
Route by path or host when one VPS serves several apps
Host-based routing
Use separate host rules when applications have distinct domains:
- traefik.http.routers.api.rule=Host(`api.example.com`)
- traefik.http.routers.dashboard.rule=Host(`dashboard.example.com`)Give each router its own service labels and, where appropriate, its own middleware and certificate configuration.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Path-based routing
A path rule can send requests such as example.com/api to a separate service:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- traefik.http.routers.api.rule=Host(`example.com`) && PathPrefix(`/api`)
- traefik.http.routers.api.entrypoints=websecure
- traefik.http.routers.api.tls=true
- traefik.http.services.api.loadbalancer.server.port=8080If the backend expects the path without the /api prefix, add a StripPrefix middleware and attach it to the router. Test links, redirects, static assets, and API documentation because path rewriting can affect all of them.
Choose labels or a file provider
| Approach | Strength | Trade-off |
|---|---|---|
| Docker labels | Configuration travels with the container definition and updates when Docker services change. | Long labels can become difficult to review, and application deployment files contain routing details. |
| File provider | Dynamic routing, middleware, and TLS settings stay in versioned configuration files separate from application metadata. | You must manage file mounting, reloads, and synchronization with the containers that the file references. |
Labels are usually the shortest path for a Compose-only VPS. A file provider is useful when one routing configuration spans several deployment tools or when operators need a central configuration review.
Understand load-balancing and availability choices
| Choice | What it does | When to use it |
|---|---|---|
| Round-robin service | Sends successive requests across discovered servers. | The normal starting point when replicas are equivalent. |
| Weighted or advanced service | Assigns different proportions or composes multiple services. | Gradual rollouts, canaries, or unequal capacity. |
| Passive failure handling | Responds to observed request failures. | A complement to active checks, not a replacement for readiness checks. |
| Active health checks | Probes a configured endpoint and removes failing servers before normal traffic reaches them. | Applications with a reliable readiness signal. |
| One VPS | One Traefik instance and one host provide a simple edge. | Small deployments where simplicity is more important than eliminating host failure. |
| Multiple edge instances | Places the proxy layer across more than one failure domain. | Services that require resilience beyond a single VPS. |
Scaling replicas on one VPS improves process-level resilience but does not remove the VPS, network, disk, or Traefik failure domain. A single Traefik instance on a single VPS remains a single point of failure. Removing that limitation requires a second edge and an external mechanism to direct traffic between edges; it is a different architecture, not a setting in the Compose file.
Security and operational hardening
- Expose only Traefik. Publish ports 80 and 443 from Traefik. Keep application ports private on the Docker network.
- Disable implicit publication. Keep
exposedByDefault=falseand addtraefik.enable=trueonly to services intended for routing. - Protect the dashboard. Never expose the Traefik dashboard publicly without authentication and network restrictions. If you do not need it, do not enable it.
- Restrict Docker access. Use a read-only socket mount or a socket-proxy design, and keep both away from public interfaces.
- Pin and update deliberately. Pin Traefik and application image versions, read release notes, and test rule syntax before upgrading.
- Back up ACME state. Protect the storage file permissions and include it in a secure backup plan.
- Log centrally. Retain Traefik access and error logs long enough to correlate routing failures with application events.
- Separate readiness from diagnostics. Return a simple success or failure from the readiness path and keep detailed health information restricted.
Troubleshooting by symptom
Traefik reports no available server
- Confirm the application and Traefik share the same Docker network.
- Check that the internal port label matches the port the process actually listens on.
- Inspect the container’s own logs and test the readiness URL from the Docker network.
- Ensure the health-check scheme and port match the backend; an HTTPS check against an HTTP endpoint will fail.
The router never matches
- Verify the DNS name exactly matches the
Hostrule. - Confirm the router is attached to the entrypoint receiving the request.
- Check that the label is under the intended service and that
traefik.enable=trueis present when automatic exposure is disabled. - Review Traefik logs for label parsing or rule-syntax errors, especially after a version upgrade.
HTTP works but HTTPS or certificates fail
- Confirm TCP 443 is open and the secure router has
tls=true. - Verify the resolver name in the router exactly matches the static resolver name.
- Ensure DNS points to this VPS and port 80 reaches Traefik for the HTTP challenge.
- Check that the ACME directory is mounted, writable by Traefik, and contains the protected storage file.
Only one replica appears to receive requests
- Verify that Compose actually created multiple containers and that all are on the shared network.
- Send repeated requests from a client that does not reuse one long-lived connection.
- Check whether the application or an upstream client is maintaining session affinity; Traefik’s basic service does not make every individual request visibly alternate.
A failed instance keeps receiving traffic
- Check that the health-check labels are attached to the correct logical service.
- Make the readiness endpoint return a failing status while the instance is unusable.
- Review interval and timeout settings so the check is not pointed at a slow or redirecting path unintentionally.
Maintenance checklist
- Test certificate renewal before expiry rather than waiting for an outage.
- Review Traefik and Docker release notes before upgrades.
- Revalidate router rules and health checks after changing application ports or paths.
- Exercise the unhealthy-backend scenario after major configuration changes.
- Confirm backups can restore the ACME storage file and any file-provider configuration.
- Document the public hostname, entrypoints, internal service ports, readiness paths, and firewall rules for the next operator.
Frequently Asked Questions
Can Traefik balance containers that do not publish a host port?
Yes. Traefik connects to containers over the shared Docker network. Set the internal destination with traefik.http.services.<service>.loadbalancer.server.port and publish only Traefik’s edge ports.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How many replicas should I run on a VPS?
There is no universal number in this design. Run enough replicas to tolerate the failures you expect while leaving CPU, memory, and dependency capacity for each instance. The documentation-backed setup does not provide a throughput or replica-count benchmark.
Do health checks replace application monitoring?
No. Traefik health checks decide whether a backend should receive traffic. Keep separate monitoring for latency, error rates, resource exhaustion, certificate expiry, and the VPS itself.
Does scaling replicas on one VPS provide high availability?
It protects against some process-level failures, but the VPS, its network, and the single Traefik edge remain shared failure domains. Higher availability requires more than one edge or host.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
