We use Docker Swarm and have Traefik running on all 3 manager nodes. Traefik needs to run on the manager to be able to use Traefik Docker Configuration Discovery. Furthermore we have servers for the apps/services and the DB.
You should make sure to run Traefik on a manager node, you can use a placement constraint for that. If you want it running on a single dedicated machine, you can use another constraint for that.
Having a single Traefik instance makes it easier with DNS. You just point your domain to the single IP of your Traefik server. LetsEncrypt works very well that way.
The issue is high availability. When the Traefik node dies, everything is offline. We have a managed load balancer in front of our 3 Traefik instances to ensure high availability. We use purchased TLS certs, as LetsEncrypt is a bit problematic with distributed Traefik.
So it really depends on your setup and what you want to achieve, if high availability is important to you.
