Automatic HTTPS is one of those things that feels like magic until you've set it up once, and then it's just a compose file. Here's the whole setup.
Why Traefik specifically
Nginx works, but every new app means editing a config file and reloading. Traefik watches Docker directly — label a container, and Traefik picks up the route with no config file edits and no reload. For anyone running more than one app on a box, that difference compounds fast.
1. Create a shared Docker network
Every app container and Traefik itself need to sit on the same network so Traefik can route to them by container name:
docker network create edge
2. Run Traefik itself
A minimal Traefik compose service needs: the Docker socket mounted (read-only) so it can watch containers, ports 80 and 443 exposed, and a volume for the Let's Encrypt certificate store. Configure the certificatesResolvers block with your email and the HTTP challenge — Traefik requests, validates, and renews certificates entirely on its own after that.
3. Label your app containers
On each app's container, add labels declaring the router rule (Host(yourapp.com)), the entrypoint (websecure), and the cert resolver. Traefik reads these on container start and configures routing automatically — no restart of Traefik itself required.
4. Point DNS at the box
An A record for your domain pointing at the VPS's IP. Once DNS propagates, hit the domain — Traefik requests a certificate on first request (or on startup, depending on config) and HTTPS just works.
5. Repeat for every app, on one Traefik instance
This is the actual payoff: one Traefik container in front of an arbitrary number of app containers, each getting its own domain and its own certificate, with zero incremental proxy configuration per app.
The parts that go wrong in practice
Rate limits on Let's Encrypt if you're testing repeatedly (use the staging endpoint while iterating), forgetting to put both Traefik and the app on the same Docker network (routes silently fail), and certificate volume persistence across container restarts (mount it, don't let it live in the container's writable layer).
Skipping the setup
If you'd rather not hand-write the compose files, labels, and cert resolver config, DeployOS generates all of this automatically for every app you deploy — Traefik or Caddy, your choice — including the network wiring and label generation described above. It's the same architecture this guide walks through, just automated end to end from a desktop app.