Traefik as a dynamic reverse proxy only stays reliable when routers are discovered from the same provider the runtime actually exposes — Docker labels, file, or Kubernetes CRDs — and every Host rule matches the public name clients dial after TLS terminates on the websecure entrypoint. Keep services on an internal network Traefik can reach by service name, publish only the proxy ports externally, and attach ACME or certificate resolvers to the routers that need certificates so renewals write to a volume the Traefik uid can still update after a restart. Middleware (headers, compress, auth) should hang on the router, not be reinvented inside each upstream container.

Ops prove-out after a label or provider change: confirm the dashboard or API lists the expected routers and services, curl the public Host and expect the upstream status, then stop one backend and verify Traefik returns a clean 502 rather than hanging the dial. If routers vanish only for some containers, check the Docker socket mount, network attachment, and that traefik.enable plus the load-balancer port still match the process listening inside the container — most “service discovery broke” incidents are provider reachability or Host mismatch, not the Traefik DSL itself.