# traefik

Deploys Traefik with Docker Compose, a shared proxy network, static config, and
UFW rules for HTTP and HTTPS.

Traefik can use the Docker provider for local label-based routing, the file
provider for central edge-to-internal-Traefik routing, or both:

```yaml
traefik_docker_provider_enabled: false
traefik_file_provider_enabled: true
traefik_dynamic_inventory_group: nbops
```

When the file provider is enabled, the role renders
`{{ traefik_dir }}/dynamic/http-services.yml` from `nbops_traefik_file_routes`
declared in host variables across the inventory group. In the normal multi-VM
topology those routes point at each downstream VM's internal Traefik entrypoint,
not directly at application containers.

Routes can set `servers_transport` to reference entries in
`traefik_dynamic_servers_transports`, which is intended for the future
edge-to-internal mTLS path.

Tags: `traefik`, `docker`, `config`, `compose`, `firewall`.