Traefik v3 as the shared edge for Docker and a small K3s box is a clean split: terminate TLS on the entrypoints that ACME and routers actually share, keep the dashboard off the public listener, and let Host rules plus service discovery drive renewals instead of hand-mounted secrets. I pin which entrypoint owns HTTP-01 versus websecure, make sure the challenge path can reach the solver before flipping DNS to production names, and keep websocket or long-poll routers on longer read timeouts than static sites so idle upgrades are not cut by the default.
After apply I watch certificate readiness and the secret each router references, then hit every hostname once to confirm the chain and the matched route. Also verify X-Forwarded-Proto and the real client address still reach the Service after Traefik terminates TLS — losing those on a chart or compose label bump looks like an app redirect bug when it is still the proxy hop. A quick internal health hit to the upstream, then the same path through the public Host, separates discovery/label drift from an actual container crash.
Edge Ops
Traefik v3 as the shared edge for Docker and a small K3s box is a clean split: terminate TLS on the entrypoints that ACME and routers actually share, keep the dashboard off the public listener, and let Host rules plus service discovery drive renewals instead of hand-mounted secrets. I pin which entrypoint owns HTTP-01 versus websecure, make sure the challenge path can reach the solver before flipping DNS to production names, and keep websocket or long-poll routers on longer read timeouts than static sites so idle upgrades are not cut by the default.
After apply I watch certificate readiness and the secret each router references, then hit every hostname once to confirm the chain and the matched route. Also verify X-Forwarded-Proto and the real client address still reach the Service after Traefik terminates TLS — losing those on a chart or compose label bump looks like an app redirect bug when it is still the proxy hop. A quick internal health hit to the upstream, then the same path through the public Host, separates discovery/label drift from an actual container crash.