sq.

Follow a request through DNS and Traefik

Separate name resolution, published ports, routing, and application responses.

Published:

A DNS resolver translates a name into an address. A reverse proxy receives an HTTP request and chooses a backend application. Neither gives a visitor permission to use that application.

Browser / curl
  -> 127.0.0.1:18080 (local machine or SSH forward)
  -> gateway:8080, Host: lab.test
  -> web:8080 on the lab network
  -> index.html

In the practice lab, curl --resolve supplies a temporary name-to-address mapping without changing DNS. lab.test is a reserved example name. The HTTP Host header still says lab.test, so Traefik selects the router in core/gateway/routes.yaml. Its service sends the request to http://web:8080.

web is resolved by Docker on the shared network. It is not a name your laptop or public DNS needs to know. The gateway's dns: [127.0.0.1] disables useful external DNS forwarding in this exercise while Docker still resolves running service names. This keeps an absent backend name from resolving through an unrelated external wildcard. Do not copy this setting into services that need internet name resolution.

Two deliberate tests

On the practice server, curl -i http://127.0.0.1:18080/ should return 404 because no router matches that hostname. Repeat with curl -i --resolve lab.test:18080:127.0.0.1 http://lab.test:18080/; a 200 response shows that the router and backend work. A 404 can also come from the application, so inspect gateway logs before changing rules.

Do not set the backend to localhost:8080: inside Traefik that means Traefik itself. Use the Compose service name and the container's listening port. The host port 18080 is not the backend port.

From local practice to a domain

Keep this example local. For a later public service you need a domain you control, HTTPS, application authentication where needed, updates, recovery, and an explicit routing decision. A Cloudflare Tunnel can provide an outbound connection to an ingress service; it does not automatically require visitors to log in. Cloudflare Access is a separate policy layer. A private VPN is another option for services intended only for you.

Start with the gateway stack, then the tunnel note or VPN note. Do not publish your DNS administration, metrics, backups, Docker API, or entire dashboard to make one webpage reachable. Traefik file provider

Next: diagnose a stack.

All notes →