Learn Traefik - Traefik Architecture & Core Concepts

#Introduction

Now that you understand why Traefik was born, it is time to dissect the engine from the inside. Episode 2 introduces the five core components of Traefik architecture: entrypoints, routers, middlewares, services, and providers. Every Traefik configuration — from the simplest to the most complex — is just a combination of these five concepts.

In addition, we will cover the two configuration layers: static, which is set at startup, and dynamic, which changes at runtime. Understanding this split is important because it determines where a setting must be written. By the end of the episode, you will follow the complete journey of a request from the client and back, passing through each component in order.

#The Five Core Components

#Entrypoint

An entrypoint is the network entry point: a combination of port and protocol that Traefik listens on. For example, the web entrypoint on port 80 for HTTP and websecure on port 443 for HTTPS. Requests are only processed by Traefik if they arrive through one of the defined entrypoints.

#Router and Rule

A router is the logical unit that connects an entrypoint to a service based on a rule — a matching condition. Rules can be Host, Path, Method, and more. When a rule is satisfied, the router forwards the request to the destination service, with the option of passing through middlewares first.

#Middleware and Service

Middleware modifies requests or responses between the router and the service: authentication, rate limiting, compression, headers, and more. A service is the final destination: the list of backend servers that receive requests, usually with automatic load balancing built in.

#Provider

A provider is the source of dynamic configuration. Traefik does not keep all configuration in a single file; it reads from providers such as Docker, Kubernetes, or configuration files, then translates them into active routing.

client -> entrypoint -> router -> middleware -> service -> backend
                <- response <- middleware <- service <- backend

#Static vs. Dynamic Configuration

#Two Configuration Layers

Traefik separates configuration into two:

• Static configuration: values set at startup — entrypoints, active providers, API/dashboard, logs, and certificate resolvers. Cannot be changed without a restart.
• Dynamic configuration: live routing — routers, services, middlewares. Delivered by providers and can change at any time.

An example of minimal static configuration using the traefik.yml file:

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
 
api:
  dashboard: true
 
providers:
  docker:
    exposedByDefault: false

Notice that there is no endpoint line in the Docker provider. Traefik uses its default value, the Docker socket at unix:///var/run/docker.sock — we will change this detail as needed in episode 5.

Notice that there are no routers or services here at all. All of that arrives dynamically from the Docker provider — let's look at the dynamic side:

services:
  app:
    image: nginx:alpine
    labels:
      - traefik.enable=true
      - traefik.http.routers.app.rule=Host(`app.localhost`)
      - traefik.http.services.app.loadbalancer.server.port=80

#The Service Discovery Mechanism

With providers.docker enabled, Traefik monitors the Docker daemon through the Docker socket. Every container that appears with the traefik.enable=true label immediately produces a new router and service automatically — no restart, no manual reload. That is the essence of dynamic configuration.

#Routers, Rules, and Providers in Detail

#Concepts Often Confused

The four terms that most often confuse beginners:

• Entrypoint = the entrance, where Traefik accepts connections.
• Router = the logic that decides where a request goes.
• Rule = the matching criteria the router uses (Host, Path, and so on).
• Service = the destination address that receives the final request.

Meanwhile a provider is not part of the request pipeline; it is the "news source" that tells Traefik about the outside world. Without providers, Traefik is just an empty box that does not know what to route.

#Certificate Resolver

One additional concept used in the TLS phase: the certificate resolver. This is the ACME (Let's Encrypt) configuration attached to the websecure entrypoint for issuing certificates automatically. We will dissect it deeply in episode 15, but recognize its existence here first.

#The Complete Request Flow

#Step by Step

When a client opens http://app.localhost, here is what happens:

1. The connection arrives at the web entrypoint (port 80).
2. Traefik checks all routers bound to the web entrypoint.
3. The Host(app.localhost) rule matches, so the app router is selected.
4. The router's middleware chain runs in sequence.
5. Traefik picks a server from the app service using load balancing.
6. Traefik opens a connection to the backend container nginx:alpine.
7. The response from the backend passes through the middlewares once more before being sent to the client.

#Why Middlewares Are Bidirectional

Traefik middlewares wrap a service, not just a request. That means the response from the backend also passes through the same middlewares. The clearest example: the compress middleware marks a response for compression, and the Content-Encoding: gzip header is added on the response path. Understanding this bidirectional nature helps you debug unexpected behavior later.

#Closing

Key takeaways:

• Five core components: entrypoint, router, middleware, service, provider.
• Static configuration for startup settings; dynamic configuration for routing.
• Providers (Docker, Kubernetes, File) fill in dynamic configuration automatically.
• Rules determine matching: Host, Path, Method, and more.
• Request flow: entrypoint, router, middleware, service, backend, then back.
• Middlewares wrap a service and run bidirectionally.

In episode 3 next we will install Traefik — from the binary, the most common way with a Docker container, a tidy Docker Compose setup, to the first run and access to your first dashboard. After that, all the abstract concepts in this episode will feel concrete.