I'm learning Docker Swarm in a homelab and want to run Traefik on a dedicated machine while keeping applications such as Jellyfin on separate hosts. Traefik is deployed with `docker stack deploy`, uses the Swarm provider and an external overlay network, and receives forwarded traffic on ports 80 and 443. The application stacks on my media server are started with regular `docker compose up -d` rather than as Swarm stacks.
Traefik appears to discover the Jellyfin container and display it in the dashboard, but the Let's Encrypt certificate resolver never seems to be used. `acme.json` remains empty despite having mode 600, and clients receive Traefik's default certificate. The Jellyfin container has regular Docker labels such as `traefik.http.routers.jellyfin.tls.certresolver=letsencrypt`, but those labels are not under a `deploy` section. I'm also running Traefik globally and mounting the local Docker socket and local `acme.json` file on each node.
Do the application services need to be deployed with `docker stack deploy` and use `deploy.labels`, or is there a supported way to keep them as standalone Compose containers on another host while having a centralized Swarm Traefik instance discover and proxy them?
3 Answers
If you use Swarm, convert the application definitions to stack files and put the Traefik labels under `deploy.labels`. Attach the services to an attachable external overlay network and use placement constraints to keep media workloads on the media node. If you want to keep ordinary Compose deployments, don’t use the Swarm provider for them; define their backend addresses through Traefik’s file provider or another suitable provider instead.
The fact that the service appears in the dashboard does not prove that ACME successfully issued a certificate. An empty `acme.json` means no certificate was stored. Check Traefik’s debug logs for the ACME challenge and confirm that the requested hostname resolves publicly to the Traefik host, port 80 reaches Traefik, and the HTTP-01 path is not being blocked or redirected incorrectly. Until issuance succeeds, Traefik will serve its default certificate.
The configuration is mixing two different Docker modes. The Swarm provider reads Swarm services, not ordinary containers created with `docker compose up`. For a Swarm service, labels belong under `deploy.labels`, for example `services: jellyfin: deploy: labels:`. Regular Compose labels are container labels and are not the same thing from Traefik’s Swarm provider’s perspective.
`deploy` settings only affect Swarm deployments. They do not make a standalone container a Swarm service, so they won’t solve discovery if Jellyfin continues to run with regular Compose.
That was the confusing part: the service showed up as discovered and the router appeared in the dashboard, but the certificate storage stayed empty and browsers continued seeing the default certificate.