What is a reverse proxy in simple terms?

A reverse proxy is a single entry point that sits in front of all your services and forwards each incoming request to the right one based on the hostname. Instead of remembering that Grafana is on port 3000 and your wiki is on port 3001, you visit grafana.homelab.lan and wiki.homelab.lan and the proxy routes each to the correct backend. It also handles HTTPS certificates in one place.

What makes Traefik different from Nginx or Caddy?

Traefik discovers your services automatically. When you run a Docker container with a few labels, Traefik sees it and starts routing to it with no config file edits or reloads — ideal for a homelab where you add services often. Nginx Proxy Manager offers a friendly GUI, and Caddy has the simplest config file, but Traefik's dynamic Docker discovery is its standout feature. All three do automatic Let's Encrypt certificates.

Do I need a real domain name to use Traefik?

For public HTTPS certificates from Let's Encrypt, yes — you need a domain you control, though it can be a cheap one and the services can still stay private. For a purely internal setup you can use a local domain like homelab.lan with a DNS challenge and a wildcard certificate, or run Traefik with self-signed certificates. Many homelabbers buy a cheap domain purely to get trusted certificates on internal services.

Is a reverse proxy more secure than opening ports?

Yes, meaningfully. A reverse proxy means only one service is exposed instead of many, it terminates HTTPS so all traffic is encrypted, and it is the natural place to add a single sign-on layer or IP allow-lists in front of everything. It does not replace a firewall or a VPN, but it shrinks your attack surface and centralises where you enforce access.

What Is Traefik? Reverse Proxies Explained for Homelabs

By the time your homelab is running a handful of services, you’re juggling a spreadsheet of IP addresses and port numbers: 10.0.0.20:3000 for Grafana, 10.0.0.21:8080 for something else, none of them on HTTPS. A reverse proxy fixes all of that. This post explains what a reverse proxy is, why Traefik is a great fit for homelabs, and how the pieces fit together. A hands-on Traefik deployment guide is the next post in this series.

The problem a reverse proxy solves

Without a reverse proxy, every service is a different IP:port, each with its own untrusted certificate warning (or no HTTPS at all). You memorise ports, browsers nag, and nothing has a real name.

With a reverse proxy, everything lives behind one HTTPS endpoint and gets routed by name.

Why Traefik for a homelab

There are three common choices — all good, with different strengths:

Traefik — discovers services automatically. Add a Docker container with a few labels and Traefik starts routing to it instantly, no config reload. Perfect when you add services often.
Nginx Proxy Manager — a friendly web GUI for people who’d rather click than edit YAML.
Caddy — the simplest static config file, HTTPS on by default.

Traefik’s edge is that dynamic discovery. Because your Docker apps declare their own routing via labels, the proxy config effectively maintains itself. That pairs naturally with a Docker host, which is why it’s the reverse proxy this series sets up.

How auto-discovery looks

You don’t write a route for each app — the app describes itself. A container just adds labels like these and Traefik does the rest:

Traefik router labels on a Docker service


labels:
- "traefik.enable=true"
- "traefik.http.routers.wiki.rule=Host(`wiki.homelab.lan`)"
- "traefik.http.routers.wiki.tls.certresolver=letsencrypt"

The three pieces you need

To go from “IP and port” to https://service.homelab.lan, three things work together:

1Local DNS — resolve the names

Your devices need to know that wiki.homelab.lan points at the proxy. That’s exactly what Pi-hole local DNS records provide — point every service hostname at the Traefik host’s IP.

2Traefik — route the names

Traefik receives every request on port 443 and forwards it to the correct backend based on the Host() rule — the routing layer in the diagram above.

3Let's Encrypt — trust the certificates

Let’s Encrypt issues free, browser-trusted certificates so there are no more security warnings. Traefik requests and renews them automatically via its ACME/Let’s Encrypt integration.

What’s next

Now that you understand the why, the next post in this series puts it into practice: deploying Traefik, wiring up automatic certificates, and routing your first service to a clean HTTPS URL. In the meantime, the official Traefik documentation is the best reference.

Related posts:

Docker on Proxmox: LXC vs VM, Done Right — the host Traefik discovers services on.
Pi-hole on Proxmox LXC — the local DNS names Traefik routes.
Proxmox Firewall: Zone-Based Rules — the layer a reverse proxy complements, not replaces.
Tailscale Subnet Router — reach your proxied services securely from anywhere.
Vaultwarden on Proxmox LXC — a great first service to put behind Traefik.