WIUNIX ACADEMY
Set up Traefik with Let’s Encrypt and HTTP/3 on Ubuntu and Debian
Page 6 of 6. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment11 editable values
LET’S BUILD
Take a consistent protected recovery copy
After successful production acceptance, use a NEW root-only recovery directory outside the origin. This maintenance pause stops only this dedicated proxy while state is copied; the trap restarts it on failure too. The backup contains ACME account/private certificate keys: keep it root-only, encrypted off-host, and never upload it as tutorial evidence. Copy exact configuration, state, binary, units and marker with original absolute paths; compare bytes without printing secrets. This is not an application-data or DNS-account backup.
Dedicated Linux host
sudo bash -eu <<'BACKUP'
test ! -e '/var/backups/traefik-academy'
install -d -m 0700 '/var/backups/traefik-academy'
systemctl stop traefik-academy.service
trap 'systemctl start traefik-academy.service' EXIT
cp -a --parents '/etc/traefik-academy' '/var/lib/traefik-academy' /usr/local/bin/traefik /etc/systemd/system/traefik-academy.service /etc/systemd/system/academy-traefik-origin.service '/srv/traefik-academy-origin/health.txt' '/var/backups/traefik-academy/'
cmp '/var/lib/traefik-academy/acme-production.json' '/var/backups/traefik-academy/var/lib/traefik-academy/acme-production.json'
cmp '/etc/traefik-academy/dynamic/routes.yml' '/var/backups/traefik-academy/etc/traefik-academy/dynamic/routes.yml'
cmp /usr/local/bin/traefik '/var/backups/traefik-academy/usr/local/bin/traefik'
printf 'Protected recovery copy verified\n'
BACKUP
Protected recovery copy verified and proxy restarted; verify trusted external marker again.
LET’S BUILD
Rehearse and restore without reissuing blindly
Rehearse in a separate disposable environment first, with no public CA egress and private test certificates. The following restore is for the SAME dedicated host, selected paths, DNS identity and existing service accounts, during an approved outage. Check backup age, binary version/security advisories and the exact saved source paths before proceeding. Stop the proxy and origin; restore only the listed files, preserving ACME bytes and permissions. Do not run two writers against one state file or restore onto another workload. If state was compromised, follow CA revocation/key-rotation guidance rather than treating an old backup as a cure. For host loss, recreate verified accounts/directories and permissions through the reviewed setup in a recovery plan before restoring.
Dedicated Linux host
sudo bash -eu <<'RESTORE'
test -d '/var/backups/traefik-academy'
test -d '/etc/traefik-academy/dynamic'
test -d '/var/lib/traefik-academy'
getent passwd traefik-academy >/dev/null
files=('/etc/traefik-academy/traefik.yml' '/etc/traefik-academy/dynamic/routes.yml' '/var/lib/traefik-academy/acme-staging.json' '/var/lib/traefik-academy/acme-production.json' /usr/local/bin/traefik /etc/systemd/system/traefik-academy.service /etc/systemd/system/academy-traefik-origin.service '/srv/traefik-academy-origin/health.txt')
for file in "${files[@]}"; do test -f "/var/backups/traefik-academy$file"; done
systemctl stop traefik-academy.service academy-traefik-origin.service
for file in "${files[@]}"; do cp -a "/var/backups/traefik-academy$file" "$file"; cmp "/var/backups/traefik-academy$file" "$file"; done
chown traefik-academy:traefik-academy '/var/lib/traefik-academy/acme-staging.json' '/var/lib/traefik-academy/acme-production.json'
chmod 0600 '/var/lib/traefik-academy/acme-staging.json' '/var/lib/traefik-academy/acme-production.json'
systemd-analyze verify /etc/systemd/system/traefik-academy.service /etc/systemd/system/academy-traefik-origin.service
systemctl daemon-reload
systemctl start academy-traefik-origin.service traefik-academy.service
RESTORE
Exact saved bytes restored and services active; repeat external trusted TLS/body, HTTP3 and private-admin boundary checks.
Update deliberately and keep rollback inputs
Check current official releases/advisories and v3 minor migration notes. Download a separately named candidate with the same architecture/checksum review as the installation panel; do not overwrite the running binary during investigation. Test configuration and actual routing/TLS/QUIC in an isolated environment, then take a protected recovery copy, stop only this proxy and install the approved binary in a maintenance window. Repeat acceptance and keep the prior binary/config/state together. Do not downgrade across state/config incompatibilities; restore the compatible set after review. Old pinned binaries do not receive unattended updates from APT.
LET’S BUILD
Retire only the tutorial services
First move/remove the tutorial DNS record through your normal DNS process and confirm no real application depends on this proxy. The command stops only the two owned units and removes no data. Retain protected recovery material under your retention policy. Remove only the exact three firewall allowances you added, preserving SSH and unrelated rules. Close the workstation tunnel with Ctrl+C in its terminal. Certificate revocation after compromise is a separate CA action; stopping a process does not revoke a certificate.
Dedicated Linux host
sudo systemctl disable --now traefik-academy.service academy-traefik-origin.service
sudo ss -lntup
Owned services stopped; their listeners absent; unrelated workloads and retained files unchanged.
Acceptance and next steps
Acceptance requires a trusted production certificate for app.example.com, the exact external marker, a genuine HTTP3-only response on a capable client, working TCP fallback, loopback-only origin/admin and a rehearsed protected recovery path. Default examples, a green process status or Alt-Svc alone are not acceptance. Next replace the marker only after designing the application’s authentication, authorization, data backups, origin trust and observability. The related Nginx HTTP/3 and Caddy guides compare other edge approaches; the upcoming Docker Compose monitoring article addresses a different deployment boundary.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.
KEEP LEARNING