Ghost deployment port mapping NOT working

Traefik Traefik v3 (latest)
1

I used Dokploy to deploy a ghost blog instance with docker compose and traefik (reverse proxy). I have a problem accessing a ghost blog deployment from my browser: giving Bad Gateway error.
If I use the default 2368 port of ghost deployment then everything works fine but if I use port mapping 3204:2368 to access it on a different port then I receive Bad Gateway error.

docker-compose.yml:

name: ghost-live-1
services:
  ghost:
    image: ghost:5-alpine
    container_name: ghost_serv_live_k
    restart: always
    environment:
      database__client: mysql
      database__connection__host: ghst_db
      database__connection__user: ghost
      database__connection__password: ghost
      database__connection__database: ghost
      url: https://blog.mydomain.com
      NODE_ENV: production
    ports:
      - '3204:2368'
    labels:
      - traefik.docker.network=dokploy-network
      - traefik.enable=true
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-web.rule=Host(`blog.mydomain.com`)
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-web.entrypoints=web
      - traefik.http.services.ghostlive-ghost-2e1bbd-50-web.loadbalancer.server.port=3204
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-web.service=ghostlive-ghost-2e1bbd-50-web
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-web.middlewares=redirect-to-https@file
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-websecure.rule=Host(`blog.mydomain.com`)
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-websecure.entrypoints=websecure
      - traefik.http.services.ghostlive-ghost-2e1bbd-50-websecure.loadbalancer.server.port=3204
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-websecure.service=ghostlive-ghost-2e1bbd-50-websecure
      - traefik.http.routers.ghostlive-ghost-2e1bbd-50-websecure.tls.certresolver=letsencrypt
    volumes:
      - ghost_serv:/var/lib/ghost/content
    depends_on:
      ghst_db:
        condition: service_healthy
    networks:
      - dokploy-network
  ghst_db:
    image: mysql:9
    container_name: ghost_db_live_k
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD=example
      MYSQL_DATABASE=ghost
      MYSQL_USER=ghost
      MYSQL_PASSWORD=ghost
    networks:
      - dokploy-network
    volumes:
      - ghost_db:/var/lib/mysql
    healthcheck:
      test:
        - CMD
        - mysqladmin
        - ping
        - '-h'
        - 127.0.0.1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s
volumes:
  ghost_serv:
    driver: local
  ghost_db:
    driver: local
networks:
  dokploy-network:
    external: true

Am I missing some key config as to why the ghost container is inaccessible to traefik reverse proxy?

2

Traefik usually connects to target services via a Docker network. Within a Docker network all ports are reachable.

Your port remapping has no influence on the port Traefik is using, so loadbalancer.server.port needs to be the original internal port, not the external port you publish additionally.

In general target services should not publish ports (using ports:), as then Traefik (security) middlewares could potentially be circumvented by accessing the service directly.