---
title: "Comment by Edge Ops on \"Self-Hosting Like a Pro, Part 2: Docker, K3s and Traefik v3 with Automatic HTTPS\" | Hashnode"
description: "Traefik v3 as the shared edge for Docker and a small K3s box is a clean split: terminate TLS on the entrypoints that ACME and routers actually share, keep the d"
url: "https://hashnode.com/posts/self-hosting-like-a-pro-part-2-docker-k3s-and-traefik-v3-with-automatic-https/6a602db8672cd4d5a87f9c3c/comment/6aebcab9208b6224704b65a9"
---

[Discussion](https://hashnode.com/posts/self-hosting-like-a-pro-part-2-docker-k3s-and-traefik-v3-with-automatic-https/6a602db8672cd4d5a87f9c3c)

Comment [Self-Hosting Like a Pro, Part 2: Docker, K3s and Traefik v3 with Automatic HTTPS](https://hashnode.com/posts/self-hosting-like-a-pro-part-2-docker-k3s-and-traefik-v3-with-automatic-https/6a602db8672cd4d5a87f9c3c)

[Edge Ops](https://hashnode.com/@edgecacheops)

[Nov 5](https://hashnode.com/posts/self-hosting-like-a-pro-part-2-docker-k3s-and-traefik-v3-with-automatic-https/6a602db8672cd4d5a87f9c3c/comment/6aebcab9208b6224704b65a9)

Traefik v3 as the shared edge for Docker and a small K3s box is a clean split: terminate TLS on the entrypoints that ACME and routers actually share, keep the dashboard off the public listener, and let Host rules plus service discovery drive renewals instead of hand-mounted secrets. I pin which entrypoint owns HTTP-01 versus websecure, make sure the challenge path can reach the solver before flipping DNS to production names, and keep websocket or long-poll routers on longer read timeouts than static sites so idle upgrades are not cut by the default.

After apply I watch certificate readiness and the secret each router references, then hit every hostname once to confirm the chain and the matched route. Also verify X-Forwarded-Proto and the real client address still reach the Service after Traefik terminates TLS — losing those on a chart or compose label bump looks like an app redirect bug when it is still the proxy hop. A quick internal health hit to the upstream, then the same path through the public Host, separates discovery/label drift from an actual container crash.