How can I configure Traefik with letsencrypt and multiple services

Question

I am trying to understand Traefik but I am not sure I understan how it works due to my lack of knowledge. I am tying to create following scenario

Frontend --> Static. www.example.com example.com with LE
Backend --> api.example.com LE
Redis --> Local network only
Mongodb --> Local network only.

I read the documentation and I came up with following docker-compose.yml file but I don't know it is correct or not. I am not sure about how nginx will map to port 80 and how traefik will create LE certificates.

version: '3'

services:
    redis:
      restart: always
      image: redis:alpine
      networks:
        - internal

    mongo:
      restart: always
      image: mongodb
      networks:
        - internal

    frontend:
      image: nginx:1-alpine
      command: [nginx-debug, '-g', 'daemon off; error_log /dev/stdout info;']
      volumes:
        - "./static_assets:/usr/share/nginx/html:ro"
        - "./nginx_config/default.conf:/etc/nginx/conf.d/default.conf"
      labels:
        - "traefik.enable=true"
        - "traefik.frontend.rule=PathPrefixStrip: /assets"
        - "traefik.port=80"
        - "traefik.frontend.rule=Host:example.com,www.example.com"

    api:
      image: MYAPIIMAGE
      ports:
        - "3000:3000"
      networks:
        - web
        - internal
      labels:
        - "traefik.backend=api"
        - "traefik.docker.network=web"
        - "traefik.enable=true"
        - "traefik.port=3000"
        - "traefik.frontend.rule=Host:api.example.com"
    traefik:
      image: traefik:1.4.5
      restart: always
      ports:
        - 80:80
        - 443:443
      networks:
        - web
      volumes:
        - "./acme.toml:/etc/traefik/conf/acme.toml:ro"
        - "/var/run/docker.sock:/var/run/docker.sock:ro"
        - "./acme.json:/etc/traefik/conf/acme.json:rw"
      container_name: traefik

networks:
  web:
    external:
      name: web
  internal:
    external:
      name: internal

Answer 1

Traefik will take a request and map it to a container's port based on your frontend rules. Unless otherwise specified in your Traefik config, traefik will always map its port 80 to you whatever port you specify in traefik.port. These are configured in the entrypoints.http configuration for Traefik.

Any time you specify a host, Traefik will attempt to get a Let's Encrypt cert for it as long as in the traefik config you have acme.OnHostRule set to true.