[{"data":1,"prerenderedAt":196},["ShallowReactive",2],{"guide-\u002Fguides\u002Fnginx-vs-traefik-vps":3},{"id":4,"title":5,"body":6,"date":178,"description":179,"draft":180,"extension":181,"featured":180,"keyTakeaway":182,"meta":183,"navigation":184,"path":185,"primaryKeyword":186,"seo":187,"service":188,"stem":189,"tags":190,"__hash__":195},"guides\u002Fguides\u002Fnginx-vs-traefik-vps.md","Reverse proxy on a VPS — nginx vs Traefik for one Linux host",{"type":7,"value":8,"toc":166},"minimark",[9,13,17,22,30,34,50,54,59,73,79,83,88,99,104,108,111,115,137,141,150,154],[10,11,5],"h1",{"id":12},"reverse-proxy-on-a-vps-nginx-vs-traefik-for-one-linux-host",[14,15,16],"p",{},"For people running one Linux VPS with one or more apps who need a single public front door for HTTP(S) — and keep hitting TLS, Host header, or \"wrong upstream\" problems.",[18,19,21],"h2",{"id":20},"key-takeaway","Key takeaway",[14,23,24,25,29],{},"On a ",[26,27,28],"strong",{},"single host",", both nginx and Traefik can work well. Pick the one you can operate confidently: nginx if you want explicit config files; Traefik if Docker label-driven routing is already how you deploy. The lead goal is one clear public entry on 80\u002F443 — not collecting proxies.",[18,31,33],{"id":32},"what-the-reverse-proxy-is-for","What the reverse proxy is for",[35,36,37,41,44,47],"ul",{},[38,39,40],"li",{},"Terminate TLS (Let's Encrypt or similar)",[38,42,43],{},"Route by hostname\u002Fpath to the right app",[38,45,46],{},"Keep app and database ports off the public internet",[38,48,49],{},"Give you one place to reason about access logs and headers",[18,51,53],{"id":52},"nginx-when-it-fits","nginx — when it fits",[14,55,56],{},[26,57,58],{},"Choose nginx when:",[35,60,61,64,67,70],{},[38,62,63],{},"You prefer a static config you can read end-to-end",[38,65,66],{},"The stack is simple (a few vhosts)",[38,68,69],{},"You already know certbot \u002F ACME with nginx",[38,71,72],{},"You want minimal moving parts",[14,74,75,78],{},[26,76,77],{},"Watch-outs:"," config drift across files; forgetting to reload after edits; upstream still published publicly \"for testing.\"",[18,80,82],{"id":81},"traefik-when-it-fits","Traefik — when it fits",[14,84,85],{},[26,86,87],{},"Choose Traefik when:",[35,89,90,93,96],{},[38,91,92],{},"Apps are Docker Compose services and you like label-based routes",[38,94,95],{},"You want automatic certificate handling wired into the proxy",[38,97,98],{},"Services come and go and you do not want to hand-edit a big nginx file each time",[14,100,101,103],{},[26,102,77],{}," labels become the source of truth (document them); dashboard\u002FAPI must not be public; mislabelled routers expose the wrong service.",[18,105,107],{"id":106},"caddy-brief-note","Caddy — brief note",[14,109,110],{},"Caddy is a strong third option for automatic HTTPS with a short Caddyfile. If your team already standardised on nginx or Traefik, switching proxies mid-incident rarely helps — fix routing first, rethink later.",[18,112,114],{"id":113},"common-failure-modes-any-proxy","Common failure modes (any proxy)",[35,116,117,120,123,126,134],{},[38,118,119],{},"DNS A\u002FAAAA not pointing at this VPS",[38,121,122],{},"App bound only to localhost but proxy pointing at the wrong port",[38,124,125],{},"HTTP→HTTPS redirect loops",[38,127,128,129,133],{},"Docker publishing the app port ",[130,131,132],"em",{},"and"," the proxy (two public doors)",[38,135,136],{},"Stale certificates \u002F wrong certificate for the Host header",[18,138,140],{"id":139},"when-a-150-session-is-enough","When a £150 session is enough",[14,142,143,144,149],{},"If the problem is \"one site won't route \u002F TLS won't issue \u002F wrong upstream\" on a reachable host, a bounded ",[145,146,148],"a",{"href":147},"\u002Flinux-server-support#troubleshooting","troubleshooting session"," is often the right first step. If the public surface is a mess of published ports and SSH risk, you may need hardening after the immediate outage is clear.",[18,151,153],{"id":152},"practical-next-step","Practical next step",[14,155,156,157,160,161,165],{},"Stuck on nginx, Traefik, or TLS on one VPS? Start with a ",[145,158,159],{"href":147},"£150 troubleshooting session",", or ",[145,162,164],{"href":163},"\u002Fcontact","book a free 15-minute intro call",".",{"title":167,"searchDepth":168,"depth":168,"links":169},"",2,[170,171,172,173,174,175,176,177],{"id":20,"depth":168,"text":21},{"id":32,"depth":168,"text":33},{"id":52,"depth":168,"text":53},{"id":81,"depth":168,"text":82},{"id":106,"depth":168,"text":107},{"id":113,"depth":168,"text":114},{"id":139,"depth":168,"text":140},{"id":152,"depth":168,"text":153},"2026-09-11","When to pick nginx or Traefik as the public front door on a single Linux VPS — TLS, routing, Docker fit — and when a short troubleshooting session is enough.",false,"md",null,{},true,"\u002Fguides\u002Fnginx-vs-traefik-vps","nginx vs traefik vps",{"title":5,"description":179},"troubleshooting","guides\u002Fnginx-vs-traefik-vps",[191,192,193,194],"nginx","traefik","reverse-proxy","docker","bPYAqHGe0ncPd13aGEp9U-TeQeHFgRxerpqyPiskJj0",1792571462637]