Nice!
Is there a way to make this work with TLS ?

Nice!
Is there a way to make this work with TLS ?

From what I know yes but I never tried with MQTT and I'm still experimenting with Traefik.
Normally you have to set up a proper Traefik entrypoint with TLS enabled, manually in the dynamic configuration or in another way (like Let's Encrypt auto TLS https://docs.traefik.io/https/acme/ ).

Found a way to use TLS !
example here:
https://gist.github.com/natcl/ed8253a34e7b87d879baabeba82cb846

You should not expose the ports(in docker) if you want traefik to handle the routing. Exposing the ports binds them to the IP of the host, hence you will be able to access it even without traefik.

  mqtt:
    container_name: mqtt
    image: eclipse-mosquitto
    networks:
      - mqtt
    restart: always
    expose:
      - 1883
      - 9001

You should not expose the ports(in docker) if you want traefik to handle the routing. Exposing the ports binds them to the IP of the host, hence you will be able to access it even without traefik.

  mqtt:
    container_name: mqtt
    image: eclipse-mosquitto
    networks:
      - mqtt
    restart: always
    expose:
      - 1883
      - 9001

Yes you're right, this is exactly what I did in the docker-compose (y)

You should not expose the ports(in docker) if you want traefik to handle the routing. Exposing the ports binds them to the IP of the host, hence you will be able to access it even without traefik.

  mqtt:
    container_name: mqtt
    image: eclipse-mosquitto
    networks:
      - mqtt
    restart: always
    expose:
      - 1883
      - 9001

Yes you're right, this is exactly what I did in the docker-compose (y)

You've bound the ports within the reverse-proxy, though, which has the same net effect as binding them within mqtt, no? I'm still learning the ropes for traefik myself, and it doesn't seem like this setup is actually doing any reverse-proxying?

You should not expose the ports(in docker) if you want traefik to handle the routing. Exposing the ports binds them to the IP of the host, hence you will be able to access it even without traefik.

That’s not true, expose does not open up the ports on the host, it’s only metadata,
See https://docs.docker.com/engine/reference/builder/#expose

You should not expose the ports(in docker) if you want traefik to handle the routing. Exposing the ports binds them to the IP of the host, hence you will be able to access it even without traefik.

That’s not true, expose does not open up the ports on the host, it’s only metadata, See https://docs.docker.com/engine/reference/builder/#expose

+1

expose does not open the ports to the host and additionally it can be useful to Traefik.

Traefik relies on this metadata to do port discovery if you don't specify it yourself in Traefik config.
See https://doc.traefik.io/traefik/providers/docker/#port-detection

Alternatively, if the meaning here is that you don't need to publish the ports to the host with the ports option in the docker-compose.yml then that is very true. You can let Traefik handle all of the routing. Perhaps by "expose" you did not mean expose. Just leaving this here for disambiguation.

May I ask why you would like to configure the mqtt behind traefik? If I get it right, it only makes a difference when you have multiple instance of mqtt or the mqtt server is on another host.

The goal is to easily setup SSL certificates via Let’s Encrypt. It’s very useful when you’re trying to secure multiple services and don’t want to configure SSL for every service individually.

The goal is to easily setup SSL certificates via Let’s Encrypt. It’s very useful when you’re trying to secure multiple services and don’t want to configure SSL for every service individually.

I see. Thanks!

https://github.com/synoniem/mosquitto-traefik-letsencrypt/blob/main/docker-compose.yml worked well for me with all traffic going through TLS via Traefik and to insecure ports on Mosquitto.