traefik

Version	2026.167.1315
Repo	superproject

Reverse proxy with TLS termination, HTTP-to-HTTPS redirect, and dynamic file-provider routing traefik downloads the pinned v3.4.0 release binary to /usr/local/bin/traefik and stages a static config at /etc/traefik/traefik.yml: a web entrypoint on :8000 that redirects to HTTPS, a websecure entrypoint on :8443 backed by the letsencrypt ACME resolver, an insecure API/dashboard on :8080, and a watched dynamic-provider directory at /etc/traefik/dynamic. It runs as a supervisord service, so every install artifact and the live API are independently verifiable.

Services

• traefik

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	download=https://github.com/traefik/traefik/releases/download/${TRAEFIK_VERSION}/traefik_${TRAEFIK_VERSION}_linux_${ARCH}.tar.gz
run	mkdir=/etc/traefik/dynamic
run	copy=traefik.yml
run	resolve ${HOME} in the ACME storage path — traefik does NOT expand env vars in static config, so the literal must be substituted at build time (getent works under both create and adopt user policies)
check	the traefik release binary is installed at /usr/local/bin/traefik
check	running the binary reports the pinned 3.4.0 release
check	the static configuration is staged at /etc/traefik/traefik.yml with mode 0644 and the letsencrypt resolver
check	the ACME storage path is resolved to an absolute /home/ path at build time (traefik does not expand env in static config; an unsubstituted literal would read “storage:” without a “/home/” prefix and fail this match)
check	the watched dynamic-provider directory exists
check	the insecure API and dashboard answer with HTTP 200 on the API port
agent-check	a plain HTTP request to the web entrypoint is redirected to the TLS websecure entrypoint
check	service=traefik
check	addr=127.0.0.1:${HOST_PORT:8000}
check	the websecure entrypoint binds on the rootless-safe :8443 port