Traefik
A cloud native reverse proxy that reads Docker labels to route traffic automatically, with built-in support for Let's Encrypt SSL certificates.
Traefik is an open source reverse proxy and load balancer designed to work natively with Docker. Rather than requiring a separate configuration file for each service, it reads labels attached to Docker containers and updates its routing rules automatically.
The problem it solves
Running multiple Docker containers on a single machine means each service sits behind a different port. Traefik sits in front of all of them and routes incoming requests to the right container based on the domain name in the request. A request to home.example.com goes to Home Assistant. A request to media.example.com goes to Jellyfin. Adding a new service to the routing table means adding a few labels to the container definition rather than editing a central configuration file.
SSL certificates
Traefik includes a built-in ACME client that communicates directly with Let's Encrypt. When a new service is added with the correct labels, Traefik requests a certificate automatically and handles renewal. SSL/TLS management that would otherwise require a separate tool is absorbed into the proxy layer.
How it is deployed
Traefik runs as a Docker container alongside the services it routes. It is configured through a combination of a static configuration file and dynamic configuration via Docker labels on each container it manages. At the time of writing, the community edition is available under the MIT licence at traefik.io.
Traefik has a steeper learning curve than some other tools in a home lab stack. The label-based configuration approach is powerful but requires careful reading of the documentation. The official documentation at doc.traefik.io is the right place to start.