to start it:

docker run -v '/home/$USER/traefik:/etc/traefik' \
    -v '/var/run/docker.sock:/var/run/docker.sock:ro' \
    -p "80:80" -p "443:443" -p "8080:8080" --restart always \
    -e "DO_AUTH_TOKEN=$DO_AUTH_TOKEN" \
    --name traefik -d $@ traefik


# rules.toml

[http.middlewares]
  [http.middlewares.changehost.headers]
    [http.middlewares.changehost.headers.customRequestHeaders]
       Host = "hass.example.com"

[backends]
  [backends.backend-hass]
    [backends.backend-hass.servers]
      [backends.backend-hass.servers.server-hass-ext]
        url = "http://backend-server-ip:8123"
        weight = 0

[frontends]
  [frontends.frontend-hass]
    backend = "backend-hass"

    passHostHeader = true
    [frontends.frontend-hass.routes]
       [frontends.frontend-hass.routes.route-hass-ext]
          rule = "Host:hass.example.com"
  [frontends.frontend-hass-public]
    backend = "backend-hass"
    passHosHeader = false
    middlewares = ["changehost"]

#traefik.toml

debug = false
logLevel = "ERROR"
InsecureSkipVerify = true
defaultEntryPoints = ["https", "http"]

# WEB interface of Traefik - it will show web page with overview of frontend and backend configurations
[api]
  entryPoint = "traefik"
  dashboard = true
  address = ":8080"

# Force HTTPS
[entryPoints]
  [entryPoints.http]
    address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
    [entryPoints.web.forwardedHeaders]
      trustedIPs = ["10.0.0.1/32", "172.17.0.2/32"]
  [entryPoints.https]
    address = ":443"
    [entryPoints.https.tls]

[file]
  watch = true
  filename = "/etc/traefik/rules.toml"

# Let's encrypt configuration
[acme]
email = "user@example.com" #any email id will work
storage="/etc/traefik/acme/acme.json"
entryPoint = "https"
acmeLogging=true
onDemand = false #create certificate when container is created
[acme.dnsChallenge]
  provider = "digitalocean"
  delayBeforeCheck = 0
  [[acme.domains]]
    main = "hass.example.com"

# Connection to docker host system (docker.sock)
[docker]
endpoint = "unix:///var/run/docker.sock"
domain = "hass.example.com"
watch = true
# This will hide all docker containers that don't have explicitly
# set label to "enable"
exposedbydefault = false