For anyone interested. This works with TCP routers.
I was able to access rancher behind Traefik while using rancher's default certificates.
version: '3.3'
services:
rancher:
image: rancher/rancher:v2.3.0-rc9
restart: always
networks:
- traefik
labels:
- traefik.enable=true
# rancher router
- traefik.tcp.routers.rancher.rule=HostSNI(`rancher.thinkpad.tld`)
- traefik.tcp.routers.rancher.tls.passthrough=true
- traefik.tcp.routers.rancher.service=rancher
- traefik.tcp.services.rancher.loadbalancer.server.port=443
volumes:
- ./data:/var/lib/rancher
container_name: 'rancher'
networks:
traefik:
external: true