Three €5 servers behind one domain beat one €40 server in every way that matters: a reboot is not an outage, a noisy neighbour is one third of your capacity, and scaling is “add a server”. dockxo makes this a service kind.
Setting it up
- Deploy the same service on two or more servers (clone it, pick a different server).
- Create a service of kind Load balancer, pick the members, add the domain.
- Point the domain’s A record at the balancer’s server (or let the Cloudflare integration do it).
That is it. The balancer gets the Let’s Encrypt certificate; members never need one for the balanced domain.
What the members expose
Members expose the balanced domain only on Traefik’s :8099 entrypoint, restricted by an IP allow-list to the balancer’s address. Nobody can hit a member directly by name, and if the members are marked private their IPs are not in DNS or certificate-transparency logs at all. The balancer is the single public door.
Health checks and real traffic
The balancer health-checks every member with the balanced hostname; a member that stops answering leaves the rotation until it recovers. The Balancer tab probes every member from the balancer host with the same request and shows the answer, its latency and stopped containers, and reads the proxy’s access log to show how the last quarter hour of real requests was spread.
Sticky sessions, done properly
The balancer can pin a visitor to a server with a cookie. But a server running several containers of the same service would still alternate between them on every request. That second hop now carries the balancer’s own stickiness (dx_lbc) and health check, so a visitor stays on one container and a container that stops answering leaves the rotation.
Add a cache
A cache proxy can sit in front of a load balancer. The balancer gains an internal X-Dockxo-Via router for its caches, so cached responses are served without touching the members at all.