WIUNIX ACADEMY
Set up Traefik with Let’s Encrypt and HTTP/3 on Ubuntu and Debian
Build a dedicated Traefik edge with verified TLS, a loopback origin and private dashboard. Separate staging from production, prove HTTP/3 and protect certificate recovery.
Make this guide yoursYOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment11 editable values
THE OUTCOME
What will you have at the end?
A verified TLS edge with HTTP/3, private administration and recoverable ACME state.
Supported operating systems and versions
Five OS paths are documented, not full installation tests. Public ACME issuance/renewal, DNS ownership, internet QUIC and SSH identity acceptance remain reader checks; isolated executable evidence is recorded separately. Custom settings are untested inputs. Generated DEMO studio images are not staff, facilities or test evidence.
Before you begin
- Fresh dedicated Linux amd64/arm64 host, sudo and independent console/SSH access.
- Owned DNS hostname and directly reachable public IPv4; no competing proxy or unintended AAAA.
- Approved TCP80/TCP443/UDP443 ingress, resolver and HTTPS egress; CA terms reviewed.
- Existing independent TLS/HTTP3-capable client and protected encrypted recovery storage.
Traefik at the public edge
Build one dedicated Linux reverse proxy for https://app.example.com/health.txt, with automatic ACME certificates and HTTP/3 alongside HTTP/1.1 and HTTP/2. This guide is for administrators comfortable with DNS, SSH and systemd. Allow about 65 minutes plus DNS and certificate provisioning. A harmless loopback marker makes the routed response identifiable; replacing it with a real application requires that application’s own security and operations design.
Choose the trust boundaries first
Use a fresh dedicated host with a directly reachable public IPv4 address 203.0.113.10 and no existing web proxy. Public TCP/80 is fixed for HTTP-01; TCP/443 and UDP/443 are fixed for HTTPS/HTTP3. No arbitrary public-port switch is offered because certificate validation and client discovery depend on these ports. Both origin and admin bind invariant 127.0.0.1. This is a single-host design, not high availability. No CDN, NAT port translation, wildcard certificate or IPv6 publication is configured here. Do not publish an AAAA record unless you separately implement and test its complete path.
Set public examples before copying
Set a new hostname, public server IP, unused distinct origin/admin ports and dedicated absolute directories. Use paths starting with /, with no directory nested inside another; the preflight below checks this before creating anything. The marker URL path may be nested and must name a file. SSH user/port describe your existing authorized access, not a new account. Applied values and custom progress stay in sessionStorage in this tab/language/article/environment; default progress uses localStorage. They never enter share URLs or server configuration. Custom values are not a tested deployment. Never enter secrets, passwords, keys or tokens here.
LET’S BUILD
Inspect the unused host and selected paths
Keep independent console access. Stop if Traefik, either named tutorial unit, the target binary, or any selected directory already belongs to another workload. Read OS, architecture, clock and listeners. The documentation addresses amd64 and arm64 Linux only. Expected missing-path messages are not an instruction to remove anything.
Dedicated Linux host
cat /etc/os-release
dpkg --print-architecture
timedatectl status
systemctl list-unit-files 'traefik*' 'academy-traefik-origin*'
sudo ss -lntup
ls -l /usr/local/bin/traefik
sudo ls -ld '/etc/traefik-academy' '/var/lib/traefik-academy' '/srv/traefik-academy-origin' '/var/backups/traefik-academy'
Correct supported OS/architecture/time; no competing listeners or owned tutorial files.
LET’S BUILD
Reject overlapping or existing directories
This read-only guard rejects root, home shortcuts, existing paths and nested directories. Resolve symlinked parents with your administrator too; a text path cannot prove filesystem ownership. Do not bypass a failure by deleting an existing directory.
Dedicated Linux host
sudo bash -eu <<'CHECK'
paths=('/etc/traefik-academy' '/var/lib/traefik-academy' '/srv/traefik-academy-origin' '/var/backups/traefik-academy')
for a in "${paths[@]}"; do
[[ "$a" = /* && "$a" != / && ! -e "$a" && ! -L "$a" ]]
for b in "${paths[@]}"; do
[[ "$a" = "$b" ]] && continue
case "$a/" in "$b/"*) printf 'Nested directory rejected\n' >&2; exit 1;; esac
done
done
printf 'Directory preflight passed\n'
CHECK
Directory preflight passed; stop on any nonzero exit.
LET’S BUILD
Prepare DNS and the firewall without losing SSH
At your DNS provider set an A record for app.example.com to 203.0.113.10, DNS-only with no CDN proxy; remove an unintended AAAA through your normal change process. From an independent client, confirm A/AAAA/CAA. CAA, if present, must permit letsencrypt.org. In both the provider firewall and existing host firewall allow inbound TCP/80, TCP/443 and UDP/443, preserving existing SSH/management policy. Allow DNS to your resolver and outbound HTTPS for downloads/ACME. Do not flush rules, enable a new firewall blindly, or open 8081/8080 publicly. A local listener does not prove internet reachability.
Independent client and DNS/firewall consoles
dig +short A app.example.com
dig +short AAAA app.example.com
dig CAA app.example.com
A resolves to 203.0.113.10, no unintended AAAA, appropriate CAA; all three public transport rules approved.