DPTCloud
Back to articles
Technology Insight

Scaling Modern Architecture: Configuring Traefik v3 as an Automated Reverse Proxy for Multi-VPS Docker Swarm Clusters

May 30, 2026

Introduction: The Evolution of Microservices Routing

In the contemporary cloud-native landscape, managing traffic efficiently across distributed environments is a foundational challenge for DevOps engineers and system architects. As businesses outgrow single-server deployments, migrating to a Multi-VPS Docker Swarm cluster offers a pragmatic, cost-effective path to high availability and horizontal scaling without the operational complexity of Kubernetes.

However, orchestrating traffic across multiple virtual private servers introduces a major hurdle: dynamic service routing. Manually updating upstream server blocks every time a container scales or shifts nodes is inefficient and error-prone. This is where Traefik v3 excels. Unlike traditional reverse proxies like Nginx or Apache, Traefik was built specifically for containerized ecosystems. It natively integrates with the Docker Swarm API to listen for cluster events and automatically update its routing configuration in real-time. This guide provides an enterprise-ready blueprint for configuring Traefik v3 as an automated, secure reverse proxy on a Multi-VPS Docker Swarm cluster.

1. Why Traefik v3 and Docker Swarm for Multi-VPS Infrastructure?

Before diving into the configuration, it is essential to understand why the combination of Traefik v3 and Docker Swarm represents a powerful architecture for medium-to-large scale business applications.

  • Native Service Discovery: Traefik constantly polls the Docker Swarm manager node. When a new service is deployed across the Multi-VPS network, Traefik immediately detects its internal overlay IP and port, generating routing rules on the fly.
  • Zero-Downtime Reconfiguration: Traditional proxies require a configuration reload (e.g., nginx -s reload), which can drop active connections. Traefik v3 utilizes a dynamic configuration engine that updates routing hot-swappingly.
  • Let's Encrypt Automation: Traefik features built-in ACME protocol support, automatically provisioning and renewing TLS certificates via HTTP-01 or DNS-01 challenges across your entire domain fleet.
  • Traefik v3 Improvements: Version 3 brings mature support for HTTP/3, enhanced web traffic middleware, native OpenTelemetry integration, and a completely overhauled Docker configuration syntax optimized for modern security standards.

2. Prerequisites and Architectural Overview

To successfully implement this architecture, ensure your infrastructure meets the following baseline prerequisites:

  1. A functional Docker Swarm cluster consisting of at least one Manager Node and two Worker Nodes distributed across distinct VPS instances.
  2. A public overlay network (e.g., traefik-public) initialized with the --attachable driver to facilitate cross-node communication.
  3. A registered domain name with wildcard A records pointing to the public IP addresses of your Swarm manager/ingress nodes.
  4. SSH and root/sudo access to all nodes, with ports 80, 443, and 8080 open on external firewalls.
Security Note: In a multi-VPS setup, Docker Swarm utilizes an encrypted VXLAN overlay network for inter-node communication. Ensure that UDP port 4789, TCP/UDP port 7946, and TCP port 2377 are allowed between your VPS instances via a private network or secure firewall rules.

3. Step-by-Step Production Configuration for Traefik v3

In Docker Swarm, services must be defined using a Docker Compose file format v3 or higher and deployed as a stack. Because Traefik needs to communicate with the Docker daemon to discover services, it must run strictly on a Swarm Manager node.

Create a deployment directory on your manager node named /opt/traefik and define the following docker-compose.yml file:

version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    command:
      - "--global.checknewversion=false"
      - "--global.sendanonymoususage=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--providers.docker=true"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.docker.network=traefik-public"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@yourenterprise.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/certificates/acme.json"
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: ingress
      - target: 443
        published: 443
        protocol: tcp
        mode: ingress
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/certificates
    networks:
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.role == manager
      restart_policy:
        condition: on-failure
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.api.rule=Host(`traefik.yourenterprise.com`)"
        - "traefik.http.routers.api.service=api@internal"
        - "traefik.http.routers.api.entrypoints=websecure"
        - "traefik.http.routers.api.tls.certresolver=letsencrypt"
        - "traefik.http.services.dummy.loadbalancer.server.port=9999"

networks:
  traefik-public:
    external: true

volumes:
  traefik-certificates:
    driver: local

Deconstructing Key Traefik v3 Configurations

Let us look closely at the essential arguments that make auto-discovery functional in a multi-node environment:

  • --providers.docker.swarmMode=true: Instructs Traefik to query the Swarm tasks API rather than standalone container APIs, ensuring it aggregates container IPs from worker nodes across the Multi-VPS mesh.
  • --providers.docker.exposedByDefault=false: A defensive security control. It prevents Traefik from exposing internal services to the public internet unless explicitly instructed via labels.
  • /var/run/docker.sock: Mounted as read-only (ro) to allow Traefik to listen to Swarm cluster event streams securely.

4. Deploying and Verifying the Traefik Stack

Before launching the stack, create the external overlay network across your multi-VPS infrastructure by running the following command on the manager node:

docker network create --driver=overlay --attachable traefik-public

Execute the deployment command to spin up Traefik v3:

docker stack deploy -c docker-compose.yml traefik

Verify that the service is running across your cluster with docker stack ps traefik. Traefik will automatically bind to ports 80 and 443 across the entire Swarm ingress routing mesh, routing requests to the correct container regardless of which physical VPS hosts it.

5. Deploying a Target Microservice with Auto-Discovery

To demonstrate the power of automated service discovery, let us deploy an isolated target application (an Nginx-based corporate website) on the worker nodes. Notice how we do not write any configurations inside Traefik; instead, we declare configuration entirely via Swarm labels on the target application.

Create a file named app-stack.yml:

version: '3.8'

services:
  web-app:
    image: nginx:alpine
    networks:
      - traefik-public
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.webapp.rule=Host(`app.yourenterprise.com`)"
        - "traefik.http.routers.webapp.entrypoints=websecure"
        - "traefik.http.routers.webapp.tls.certresolver=letsencrypt"
        - "traefik.http.services.webapp.loadbalancer.server.port=80"

networks:
  traefik-public:
    external: true

Deploy the application stack: docker stack deploy -c app-stack.yml company-app.

Within seconds, Traefik v3 detects the three replicas distributing across the Multi-VPS nodes. It maps the domain app.yourenterprise.com to the application's internal overlay network ports, contacts Let's Encrypt to provision a free SSL certificate, and initiates round-robin load balancing seamlessly.

6. Enterprise Best Practices for Production Environments

Operating a Multi-VPS cluster requires adherence to high-availability patterns. Consider integrating the following modifications before launching into live production:

Enforcing Global HTTPS Redirects

Avoid serving non-secure traffic by attaching a global middleware definition to Traefik's web entrypoint. This forces all port 80 traffic to upgrade natively to port 443 with an HTTP 301 Redirect status code.

Persistent Certificate Storage

Because Docker Swarm tasks are ephemeral, if the manager node fails and Traefik reschedules, your acme.json file could be lost, resulting in Let's Encrypt rate limits. Always restrict Traefik to a single primary manager node or utilize a distributed network filesystem (like GlusterFS or Ceph) to safely share the volume state across management nodes.

Conclusion: A Scalable, Zero-Maintenance Pipeline

By leveraging Traefik v3 within a Multi-VPS Docker Swarm cluster, you eliminate the operational friction of updating proxy rules manually. When your application experiences sudden traffic surges, scaling your services with docker service scale company-app_web-app=10 prompts Traefik to instantaneously detect all ten instances across multiple physical servers. Embracing this GitOps-friendly pattern ensures your team spends less time configuring infrastructure pipelines and more time delivering scalable business logic.