VibeWarden vs Traefik

General-purpose proxy vs security sidecar

Traefik is designed to sit at the edge of your infrastructure and route traffic to many services. It auto-discovers containers, manages load balancing, and integrates with Kubernetes, Docker, Consul, and more.

VibeWarden is designed to sit next to one app and secure it. It does not care about your container orchestrator or service mesh. You point it at your app's port and it handles TLS, auth, WAF, rate limiting, and egress control.

This means Traefik gives you features you do not need for a single app, while VibeWarden gives you security features that Traefik does not have.

Setup: side by side

Here is what it takes to get a secured reverse proxy running with each tool.

# docker-compose.yml
services:
  traefik:
    image: traefik:v3
    ports:
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.yml:/traefik.yml
      - ./acme.json:/acme.json

  app:
    image: my-app
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`app.example.com`)"
      - "traefik.http.routers.app.tls.certresolver=le"
      - "traefik.http.routers.app.middlewares=rate-limit"
      - "traefik.http.middlewares.rate-limit.ratelimit.average=60"

# traefik.yml
entryPoints:
  websecure:
    address: :443
certificatesResolvers:
  le:
    acme:
      email: you@example.com
      storage: acme.json
      httpChallenge:
        entryPoint: web
providers:
  docker:
    exposedByDefault: false

# Install
curl -sS https://vibewarden.dev/install.sh | sh

# Generate config
vibew init \
  --upstream 3000 \
  --auth \
  --rate-limit

# Start
vibew dev

# That's it. Your vibewarden.yaml:
domain: app.example.com
upstream: http://127.0.0.1:3000
tls:
  auto: true
kratos:
  enabled: true
rate_limit:
  per_ip:
    requests: 60
    window: 1m

Traefik requires a docker-compose file, a Traefik config file, Docker labels on every service, and an understanding of entrypoints, routers, and middlewares. VibeWarden needs one YAML file.

Feature comparison

What VibeWarden adds that Traefik does not have

• Built-in authentication -- Traefik's ForwardAuth middleware requires you to deploy and maintain a separate auth service. VibeWarden bundles Kratos, giving you OAuth2, API key validation, and JWT verification without extra infrastructure.
• WAF with OWASP rules -- Traefik has no built-in WAF. You need a plugin or an external service. VibeWarden blocks SQLi, XSS, and path traversal out of the box.
• Prompt injection detection -- if your app uses an LLM, VibeWarden inspects inbound requests for injection patterns.
• Egress proxy -- control and audit your app's outbound traffic. Allowlist which external APIs it can call. Traefik only handles inbound traffic.
• AI-readable structured logs -- every event follows a published JSON schema that AI agents can parse without custom code.

When Traefik is the better choice

Traefik is a great tool. It is the better choice when:

• You run many services -- Traefik excels at routing traffic to dozens of containers using auto-discovery and Docker labels. VibeWarden secures one app at a time.
• You need load balancing -- round-robin, weighted, sticky sessions across multiple instances. VibeWarden proxies to a single upstream.
• You use Kubernetes -- Traefik integrates as an Ingress controller. VibeWarden is a sidecar, not an infrastructure component.
• You need the plugin ecosystem -- Traefik has a marketplace of middleware plugins for various needs. VibeWarden is opinionated about what it includes.