What's the actual difference between static and dynamic configuration?

Static configuration sets up things Traefik needs at startup and can't change without a restart: which ports it listens on (entryPoints) and where it discovers services from (providers, like Docker or Kubernetes). Dynamic configuration, routers, services, and middlewares, can be added, changed, or removed at runtime without restarting Traefik, which is why routing rules live there instead of the static file.

Why choose the Docker provider over Kubernetes CRD?

Use the Docker provider when Traefik runs alongside plain Docker or Docker Compose containers and picks up routing from container labels. Use kubernetesCRD when Traefik runs inside a Kubernetes cluster and you want to define routing with Traefik's own IngressRoute custom resources instead of (or alongside) standard Ingress objects.

Why does exposedByDefault: false matter for the Docker provider?

Without it, Traefik's Docker provider automatically creates a router for every running container, which quickly gets noisy and can accidentally expose something you didn't intend to route traffic to. Setting it to false means only containers with an explicit `traefik.enable=true` label get routed, an opt-in rather than opt-out model.

Why is tls: {} present on the router in dynamic mode?

An empty `tls: {}` block tells Traefik to terminate TLS for this router using its default certificate resolver (or Traefik's own self-signed default certificate if none is configured), rather than serving the router over plain HTTP. It's the minimal way to opt a router into HTTPS without specifying per-router certificate details.

Traefik Config Generator - Static traefik.yml or Dynamic Routers

Overview

Introduction

Traefik splits its configuration into two layers, static (set once at startup) and dynamic (changeable at runtime), which is powerful once you understand it but confusing on a first config, since entryPoints and providers go in one file while routers/services/middlewares go in another.

This tool generates either layer directly, so you get a correct traefik.yml or a correct dynamic routers/services/middlewares YAML depending on which one you actually need.

What Is Traefik Config Generator?

A generator for Traefik's two configuration layers: static configuration (entryPoints for web/websecure, a Docker or kubernetesCRD provider, and an optional API dashboard) and dynamic configuration (an HTTP router matching a Host rule, a load-balanced service pointing at a backend URL, and a basic security-headers middleware).

Static mode targets traefik.yml (or an equivalent Kubernetes ConfigMap/CLI flags); dynamic mode targets a file provider entry or an IngressRoute-adjacent dynamic config, both expressed as plain YAML.

How Traefik Config Generator Works

In static mode, you pick a provider (Docker or Kubernetes CRD) and toggle the dashboard; the generator emits entryPoints for :80/:443 and the chosen provider block.

In dynamic mode, you provide a host and backend target URL; the generator validates both and emits a router matching `Host(\`<host>\`)`, a service with a loadBalancer pointing at the backend, and an example security-headers middleware, in Traefik's dynamic configuration YAML shape.

When To Use Traefik Config Generator

Use static mode when first setting up Traefik itself, choosing its entrypoints and how it discovers services.

Use dynamic mode when adding or documenting a specific route for one host/backend once Traefik is already running.

Often used alongside Load Balancer Config Generator, Rate Limiting Config Generator and Let's Encrypt Config Generator.

Features

Advantages

Keeps static and dynamic configuration cleanly separated instead of mixing entryPoints/providers with router definitions in one confusing block.
Defaults the Docker provider to `exposedByDefault: false`, the safer opt-in behavior most production setups actually want.
Includes a working TLS opt-in (`tls: {}`) and a basic security-headers middleware in the dynamic example, not just a bare router/service pair.

Limitations

The dynamic example is a single router/service/middleware set; a real multi-service setup needs one router+service block per route, following the same pattern.
Doesn't configure a certificate resolver (e.g. Let's Encrypt via ACME) in static mode; pair it with the Let's Encrypt generator's concepts if you need automatic certificates.

Examples

Dynamic router/service for app.example.com

Input

mode: dynamic, host: app.example.com, backendTarget: http://127.0.0.1:3000

Output

http:
  routers:
    my-router:
      rule: "Host(`app.example.com`)"
      service: my-service
      entryPoints:
        - websecure
      tls: {}

  services:
    my-service:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:3000"

The router only matches the given host and routes to the one named service, which load-balances (trivially, with one server) to the backend URL.

Best Practices & Notes

Best Practices

Keep static configuration in a version-controlled traefik.yml and dynamic configuration in separate files (or Docker labels/IngressRoute CRDs), matching Traefik's own separation of concerns.
Set `exposedByDefault: false` on the Docker provider in anything beyond a quick local test, and opt containers in explicitly with `traefik.enable=true`.
Attach a real certificate resolver in static config once you move past `tls: {}`'s default self-signed behavior, so browsers don't warn on the dynamic router's HTTPS.

Developer Notes

Traefik's static configuration can only be changed by restarting Traefik (whether set via traefik.yml, CLI flags, or environment variables), while dynamic configuration is watched and hot-reloaded from its configured providers (file, Docker labels, Kubernetes CRDs, etc.) without a restart, this is the core architectural split the mode toggle here reflects. The Docker provider's `exposedByDefault` and the dynamic router's `tls: {}` both default to Traefik's documented recommended settings rather than the provider's raw defaults.

Traefik Config Generator Use Cases

Bootstrapping Traefik's entryPoints and service-discovery provider for a new deployment
Adding a documented, correct dynamic route for a new host/backend pair
Comparing the Docker-label-based and Kubernetes-CRD-based provider setups side by side

Common Mistakes

Putting router/service definitions into the static traefik.yml file, where Traefik won't hot-reload changes to them.
Leaving exposedByDefault at its provider default (true) with the Docker provider, unintentionally exposing every container Traefik can see.

Tips

If you're running Traefik via Docker Compose with labels instead of a separate dynamic config file, use this tool's static-mode output for the Traefik service itself, and translate the dynamic-mode router/service into `traefik.http.routers.*`/`traefik.http.services.*` labels on your app container instead.

Traefik Config Generator