如何将指定域名的请求通过Traefik转发至其他物理服务器

基于你当前的Traefik Docker配置，有两种简单的实现方式：

方式一：通过Docker容器标签配置（无需修改Traefik主配置） #

创建一个仅用于承载转发配置的轻量容器，利用Traefik的Docker Provider自动加载规则：

# 添加到你的docker-compose.yml中，或者单独创建一个docker-compose文件
domain2-proxy:
  image: alpine:latest
  container_name: domain2-proxy
  restart: always
  networks:
    - main_net  # 必须和Traefik使用同一个网络
  command: sleep infinity  # 保持容器运行，让Traefik能检测到
  labels:
    - "traefik.enable=true"
    # 匹配所有*.domain2.tech子域名，如需包含根域名可添加Host(`domain2.tech`) || 
    - "traefik.http.routers.domain2-router.rule=HostRegexp(`{subdomain:[a-z0-9-]+}.domain2.tech`)"
    - "traefik.http.routers.domain2-router.entrypoints=websecure"
    # 自动申请通配符SSL证书
    - "traefik.http.routers.domain2-router.tls.certresolver=myresolver"
    - "traefik.http.routers.domain2-router.tls.domains[0].main=domain2.tech"
    - "traefik.http.routers.domain2-router.tls.domains[0].sans=*.domain2.tech"
    # 定义转发目标：替换为你的局域网服务器IP和端口
    - "traefik.http.services.domain2-service.loadbalancer.server.url=http://192.168.1.100:80"
    # 目标服务器用HTTPS时的配置（取消注释并修改）
    # - "traefik.http.services.domain2-service.loadbalancer.server.scheme=https"
    # - "traefik.http.services.domain2-service.loadbalancer.server.port=443"
    # - "traefik.http.services.domain2-service.loadbalancer.tls.insecureSkipVerify=true"

执行docker-compose up -d启动容器后，Traefik会自动加载该路由规则，将所有*.domain2.tech的请求转发到指定的局域网服务器。

方式二：启用文件Provider配置 #

如果不想创建额外容器，可以通过Traefik的文件Provider直接添加转发规则：

1. 修改Traefik主配置 #

在Traefik的command和volumes中添加文件Provider相关配置：

traefik:
  image: "traefik:latest"
  container_name: "traefik"
  restart: "always"
  command:
    - "--api.insecure=true"
    - "--providers.docker=true"
    - "--providers.docker.network=main_net"
    - "--providers.docker.exposedbydefault=false"
    - "--entrypoints.web.address=:80"
    - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
    - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
    - "--entrypoints.websecure.address=:443"
    - "--certificatesresolvers.myresolver.acme.httpchallenge=true"
    - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"
    - "--certificatesresolvers.myresolver.acme.email=my@email.com"
    - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
    # 新增文件Provider配置
    - "--providers.file.directory=/etc/traefik/config"
    - "--providers.file.watch=true"
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - "/volumes/letsencrypt:/letsencrypt"
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
    # 映射配置目录到容器内
    - "/opt/traefik/config:/etc/traefik/config:ro"
  labels:
    - "traefik.enable=true"
    - "traefik.http.middlewares.traefik-compress.compress=true"
    - "traefik.http.routers.traefik.rule=Host(`traefik.domain1.local`)"
    - "traefik.http.services.traefik.loadbalancer.server.port=8080"
    - "traefik.http.routers.traefik.entrypoints=websecure"
    - "traefik.http.routers.traefik.tls.certresolver=myresolver"
    - "traefik.http.routers.traefik.service=api@internal"

2. 创建转发规则配置文件 #

在/opt/traefik/config目录下创建domain2.yml：

http:
  routers:
    domain2-router:
      rule: "HostRegexp(`{subdomain:[a-z0-9-]+}.domain2.tech`)"
      entryPoints:
        - websecure
      tls:
        certResolver: myresolver
        domains:
          - main: domain2.tech
            sans: ["*.domain2.tech"]
      service: domain2-service

  services:
    domain2-service:
      loadBalancer:
        servers:
          - url: "http://192.168.1.100:80"
        # HTTPS目标服务器配置（取消注释并修改）
        # scheme: https
        # port: 443
        # tls:
        #   insecureSkipVerify: true

3. 重启Traefik #

执行docker-compose restart traefik，新的转发规则会自动生效。

注意事项 #

• 确保Traefik所在服务器能ping通目标局域网服务器，且目标服务器的对应端口没有防火墙限制
• 通配符证书依赖ACME的HTTP挑战，当前Traefik配置的web入口点已经支持该挑战，无需额外调整
• 如需包含domain2.tech根域名的转发，将路由规则修改为：

  Host(`domain2.tech`) || HostRegexp(`{subdomain:[a-z0-9-]+}.domain2.tech`)
  

内容的提问来源于stack exchange，提问作者alexanderzhirov