# MySQL/Mariadb behind Traefik Reverse Proxy **URL:** \ **Category:** Traefik v2\ **Tags:** tcp, docker\ **Created:** [July 6, 2020, 9:41pm UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794 "2020-07-06T21:41:22Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![tam481](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tam481/32/2310_2.png) [@tam481](https://community.traefik.io/u/tam481)\ **Post date:** [July 6, 2020, 9:41pm UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794/1 "2020-07-06T21:41:22Z")
Hello all, I'm trying to reverse-proxy connections to a mariadb docker image running behind Traefik with TLS offloading. The idea is that clients would connect to Traefik, do the TLS exchange and connect to mariadb behind Traefik. The config is as follows: The Traefik Endpoint is tls-ep (Port 443) > # Mariadb > > services: > mariadb: > image: mariadb:latest > restart: unless-stopped > container\_name: mariadb > volumes: > - "$PWD/mariadb:/var/lib/mysql" > - "$PWD/mariadb/mariadb.cnf:/etc/mysql/mariadb.cnf:ro" > networks: > - backend > environment: > - MYSQL\_ROOT\_PASSWORD=mypassword > labels: > - "traefik.enable=true" > - "traefik.docker.network=backend" > - "traefik.tcp.routers.mariadb-rtr.entrypoints=tls-ep" > - "traefik.tcp.routers.mariadb-rtr.rule=HostSNI(`*`)" > - "traefik.tcp.routers.mariadb-rtr.tls=true" > - "traefik.tcp.routers.mariadb-rtr.service=mariadb-svc" > - "traefik.tcp.services.mariadb-svc.loadbalancer.server.port=3306" I can't seem to get it to work. In the Traefik Dashboard everything appears OK but clients are not able to connect. Running mysql -u root -p xxxx -h mariadb.domain.name --port 443 --ssl causes the connection to hang and I don't see any longs in Traefik. What am I doing wrong? ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [July 7, 2020, 1:17am UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794/2 "2020-07-07T01:17:16Z")
First, you can only use [`HostSNI(`*`)`](https://docs.traefik.io/routing/routers/#rule_1) with a router that does not use TLS. Second Mysql/Maria does not use TLS in a compatible manner. Your best bet is to remove the ` - "traefik.tcp.routers.mariadb-rtr.tls=true"` label and use the mariadb/msql tls options. It may be possible to encapsulate msql using a product like stunnel on the client end along with a name HostSNI rule with tls enable. ---
**Author:** ![tam481](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tam481/32/2310_2.png) [@tam481](https://community.traefik.io/u/tam481)\ **Post date:** [July 7, 2020, 6:34pm UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794/3 "2020-07-07T18:34:51Z")
Hi @cakiwi I tried changing the router host to Host(`*`) and removed the tls label but now I get "unknown rule Host(`*`)" If I specify a host like mariadb.domain.tld it errors out because it's a TCP connection. ---
**Author:** ![hrvoj3e](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/hrvoj3e/32/4077_2.png) [@hrvoj3e](https://community.traefik.io/u/hrvoj3e)\ **Post date:** [August 10, 2021, 11:42am UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794/4 "2021-08-10T11:42:55Z")
Did you manage to solve this? Did you try without TLS? For me it does not work with plain TCP. > [@Tcp mariadb with file provider does not work (no docker)](https://community.traefik.io/t/tcp-mariadb-with-file-provider-does-not-work-no-docker/11402): > > Problem with traefik:v2.4 and traefik:v2.5: cannot connect to mariadb over tcp without tls transport endpoint is not connected Static conf entryPoints: stackdb: address: ':63001' proxyProtocol: insecure: true Dynamic conf tcp: routers: stackdb: rule: "HostSNI(`*`)" service: stackdb entryPoints: - stackdb services: stackdb: loadBalancer: servers: - address: "192.168.54.112:3306" [mariadb] bind\_address = 0.0.0.0 … ---
**Author:** ![granxavi](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@granxavi](https://community.traefik.io/u/granxavi)\ **Post date:** [May 24, 2024, 2:58am UTC](https://community.traefik.io/t/mysql-mariadb-behind-traefik-reverse-proxy/6794/5 "2024-05-24T02:58:36Z")
Did you find the answer to this?