Docs
TCP & UDP routing
Layer-4 routes through Traefik: entrypoints, HostSNI, TLS modes.
Postgres, Redis, SMTP, a game server, a DNS resolver — anything that is not HTTP can still go through the proxy. Set a domain's Protocol to TCP or UDP and Traefik forwards the raw stream instead of parsing requests.
Entrypoints
Layer-4 routing needs a dedicated entrypoint, because Traefik cannot tell two TCP services apart on one port unless they use TLS with SNI. Settings → Server → TCP and UDP entrypoints (instance admin only) defines one: a name, a port and a protocol, for example pg-15432 on 15432/tcp.
- The entrypoint is written into Traefik's static configuration and the port is published on the proxy service
- Host ports are one shared namespace across tenants, which is why entrypoints are instance-level
- Privileged ports, the well-known database ports and the platform's own ports are rejected
- Deleting an entrypoint is refused while a domain still routes through it
- web (:80) and websecure (:443) are reserved built-ins and cannot be used by a tcp/udp domain
Both halves of that change restart the proxy — Traefik reads its static configuration once at start, and a published-port change recreates the task anyway. Nixploy issues a single update so it happens once, but every route on the instance is unavailable for a few seconds (~9 s measured on a local swarm). Plan an entrypoint change like a restart, not like a config edit.
TLS modes
A TCP router can only match on the hostname in the TLS handshake (SNI). The domain's TLS setting decides both the rule and what Traefik does with the stream.
- None — the router matches everything on that entrypoint and the host you typed is ignored, so one entrypoint serves exactly one service. This is what you want for Postgres, Redis or MySQL (and a wildcard host is refused, because there is nothing to match on)
- Terminate — Traefik presents the certificate (Let's Encrypt, custom or the self-signed default) and speaks plaintext to the container, so several services can share one port, told apart by SNI
- Passthrough — the encrypted stream is forwarded untouched and the backend owns the certificate; Traefik never sees plaintext
- UDP has no TLS and no rule at all — the entrypoint is the match, so one UDP entrypoint serves one service
What does not apply
Paths, internal-path rewrites, redirects, basic auth, the HTTPS toggle and the whole middleware chain are HTTP concepts. The domain form hides them for tcp/udp rows and the server rejects them rather than ignoring them, so a route never silently does less than the form suggested.
Databases
A managed database still has its own external port (Settings → General on the database), which publishes the port directly on the host and does not involve Traefik at all. Reach for a TCP domain when you want several services behind one port with SNI, or when the database is an application or compose service you deploy yourself.
Also see the repository guides under docs/ · REST API reference