2022-04-15 13:44:08 +00:00
---
title: "Traefik EntryPoints Documentation"
description: "For routing and load balancing in Traefik Proxy, EntryPoints define which port will receive packets and whether in UDP or TCP. Read the technical documentation."
---
2019-02-26 13:50:07 +00:00
# EntryPoints
2019-03-25 15:54:03 +00:00
Opening Connections for Incoming Requests
2019-02-26 13:50:07 +00:00
{: .subtitle }
2019-07-01 09:30:05 +00:00
![entryPoints ](../assets/img/entrypoints.png )
2019-02-26 13:50:07 +00:00
2019-04-05 09:32:04 +00:00
EntryPoints are the network entry points into Traefik.
2020-02-11 00:26:04 +00:00
They define the port which will receive the packets,
and whether to listen for TCP or UDP.
2019-02-26 13:50:07 +00:00
## Configuration Examples
2019-03-14 08:30:04 +00:00
??? example "Port 80 only"
2019-02-26 13:50:07 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2019-02-26 13:50:07 +00:00
```
2019-03-14 08:30:04 +00:00
We define an `entrypoint` called `web` that will listen on port `80` .
2019-02-26 13:50:07 +00:00
2021-06-18 22:08:08 +00:00
??? example "Port 80 & 443"
2019-02-26 13:50:07 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
2021-06-18 22:08:08 +00:00
2020-01-01 00:56:04 +00:00
websecure:
2019-07-01 09:30:05 +00:00
address: ":443"
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.websecure]
address = ":443"
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2020-01-01 00:56:04 +00:00
--entryPoints.websecure.address=:443
2019-07-01 09:30:05 +00:00
```
2019-02-26 13:50:07 +00:00
2020-01-01 00:56:04 +00:00
- Two entrypoints are defined: one called `web` , and the other called `websecure` .
2021-06-18 22:08:08 +00:00
- `web` listens on port `80` , and `websecure` on port `443` .
2019-09-23 12:32:04 +00:00
2020-02-11 00:26:04 +00:00
??? example "UDP on port 1704"
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
streaming:
address: ":1704/udp"
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.streaming]
address = ":1704/udp"
```
2020-02-11 00:26:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.streaming.address=:1704/udp
```
2019-02-26 13:50:07 +00:00
## Configuration
### General
2019-04-05 09:32:04 +00:00
EntryPoints are part of the [static configuration ](../getting-started/configuration-overview.md#the-static-configuration ).
2021-06-18 22:08:08 +00:00
They can be defined by using a file (YAML or TOML) or CLI arguments.
2019-04-05 09:32:04 +00:00
2019-09-23 12:32:04 +00:00
??? info "See the complete reference for the list of available options"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
2020-02-11 00:26:04 +00:00
address: ":8888" # same as ":8888/tcp"
2022-04-04 09:46:07 +00:00
http2:
maxConcurrentStreams: 42
2021-09-10 12:58:13 +00:00
http3:
advertisedPort: 8888
2019-09-23 12:32:04 +00:00
transport:
lifeCycle:
requestAcceptGraceTimeout: 42
graceTimeOut: 42
respondingTimeouts:
readTimeout: 42
writeTimeout: 42
idleTimeout: 42
proxyProtocol:
insecure: true
trustedIPs:
2019-09-23 15:00:06 +00:00
- "127.0.0.1"
- "192.168.0.1"
2019-09-23 12:32:04 +00:00
forwardedHeaders:
insecure: true
trustedIPs:
2019-09-23 15:00:06 +00:00
- "127.0.0.1"
- "192.168.0.1"
2019-09-23 12:32:04 +00:00
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888" # same as ":8888/tcp"
2022-04-04 09:46:07 +00:00
[entryPoints.name.http2]
maxConcurrentStreams = 42
2021-09-10 12:58:13 +00:00
[entryPoints.name.http3]
advertisedPort = 8888
2021-06-18 22:08:08 +00:00
[entryPoints.name.transport]
[entryPoints.name.transport.lifeCycle]
requestAcceptGraceTimeout = 42
graceTimeOut = 42
[entryPoints.name.transport.respondingTimeouts]
readTimeout = 42
writeTimeout = 42
idleTimeout = 42
[entryPoints.name.proxyProtocol]
insecure = true
trustedIPs = ["127.0.0.1", "192.168.0.1"]
[entryPoints.name.forwardedHeaders]
insecure = true
trustedIPs = ["127.0.0.1", "192.168.0.1"]
```
2019-09-23 12:32:04 +00:00
```bash tab="CLI"
## Static configuration
2020-02-11 00:26:04 +00:00
--entryPoints.name.address=:8888 # same as :8888/tcp
2022-04-04 09:46:07 +00:00
--entryPoints.name.http2.maxConcurrentStreams=42
2021-09-10 12:58:13 +00:00
--entryPoints.name.http3.advertisedport=8888
2019-09-23 12:32:04 +00:00
--entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
--entryPoints.name.transport.lifeCycle.graceTimeOut=42
--entryPoints.name.transport.respondingTimeouts.readTimeout=42
--entryPoints.name.transport.respondingTimeouts.writeTimeout=42
--entryPoints.name.transport.respondingTimeouts.idleTimeout=42
--entryPoints.name.proxyProtocol.insecure=true
2019-11-19 09:18:05 +00:00
--entryPoints.name.proxyProtocol.trustedIPs=127.0.0.1,192.168.0.1
2019-09-23 12:32:04 +00:00
--entryPoints.name.forwardedHeaders.insecure=true
2019-11-19 09:18:05 +00:00
--entryPoints.name.forwardedHeaders.trustedIPs=127.0.0.1,192.168.0.1
2019-09-23 12:32:04 +00:00
```
2019-08-26 12:40:04 +00:00
2020-02-11 00:26:04 +00:00
### Address
The address defines the port, and optionally the hostname, on which to listen for incoming connections and packets.
It also defines the protocol to use (TCP or UDP).
If no protocol is specified, the default is TCP.
The format is:
```bash
[host]:port[/tcp|/udp]
```
If both TCP and UDP are wanted for the same port, two entryPoints definitions are needed, such as in the example below.
2020-07-16 10:38:03 +00:00
??? example "Both TCP and UDP on Port 3179"
2020-02-11 00:26:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
tcpep:
address: ":3179"
udpep:
address: ":3179/udp"
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.tcpep]
address = ":3179"
[entryPoints.udpep]
address = ":3179/udp"
```
2020-02-11 00:26:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.tcpep.address=:3179
--entryPoints.udpep.address=:3179/udp
```
2020-07-16 10:38:03 +00:00
??? example "Listen on Specific IP Addresses Only"
```yaml tab="File (yaml)"
entryPoints:
specificIPv4:
address: "192.168.2.7:8888"
specificIPv6:
address: "[2001:db8::1]:8888"
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.specificIPv4]
address = "192.168.2.7:8888"
[entryPoints.specificIPv6]
address = "[2001:db8::1]:8888"
```
2020-07-16 10:38:03 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.specificIPv4.address=192.168.2.7:8888
--entryPoints.specificIPv6.address=[2001:db8::1]:8888
2020-07-16 10:38:03 +00:00
```
2021-06-18 22:08:08 +00:00
2020-07-16 10:38:03 +00:00
Full details for how to specify `address` can be found in [net.Listen ](https://golang.org/pkg/net/#Listen ) (and [net.Dial ](https://golang.org/pkg/net/#Dial )) of the doc for go.
2024-09-13 13:54:04 +00:00
### AllowACMEByPass
_Optional, Default=false_
`allowACMEByPass` determines whether a user defined router can handle ACME TLS or HTTP challenges instead of the Traefik dedicated one.
This option can be used when a Traefik instance has one or more certificate resolvers configured,
but is also used to route challenges connections/requests to services that could also initiate their own ACME challenges.
??? info "No Certificate Resolvers configured"
It is not necessary to use the `allowACMEByPass' option certificate option if no certificate resolver is defined.
In fact, Traefik will automatically allow ACME TLS or HTTP requests to be handled by custom routers in this case, since there can be no concurrency with its own challenge handlers.
```yaml tab="File (YAML)"
entryPoints:
foo:
allowACMEByPass: true
```
```toml tab="File (TOML)"
[entryPoints.foo]
[entryPoints.foo.allowACMEByPass]
allowACMEByPass = true
```
```bash tab="CLI"
--entryPoints.name.allowACMEByPass=true
```
2022-04-04 09:46:07 +00:00
### HTTP/2
#### `maxConcurrentStreams`
_Optional, Default=250_
`maxConcurrentStreams` specifies the number of concurrent streams per connection that each client is allowed to initiate.
The `maxConcurrentStreams` value must be greater than zero.
```yaml tab="File (YAML)"
entryPoints:
foo:
http2:
maxConcurrentStreams: 250
```
```toml tab="File (TOML)"
[entryPoints.foo]
[entryPoints.foo.http2]
maxConcurrentStreams = 250
```
```bash tab="CLI"
--entryPoints.name.http2.maxConcurrentStreams=250
```
2022-01-25 09:48:05 +00:00
### HTTP/3
2021-01-07 13:48:04 +00:00
2021-09-10 12:58:13 +00:00
#### `http3`
2022-01-25 09:48:05 +00:00
`http3` enables HTTP/3 protocol on the entryPoint.
HTTP/3 requires a TCP entryPoint, as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP.
In most scenarios, this entryPoint is the same as the one used for TLS traffic.
2021-01-07 13:48:04 +00:00
2022-01-25 09:48:05 +00:00
??? info "HTTP/3 uses UDP+TLS"
2021-01-07 13:48:04 +00:00
2022-01-25 09:48:05 +00:00
As HTTP/3 uses UDP, you can't have a TCP entryPoint with HTTP/3 on the same port as a UDP entryPoint.
Since HTTP/3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP/3.
2021-01-07 13:48:04 +00:00
2022-01-25 09:48:05 +00:00
!!! warning "Enabling Experimental HTTP/3"
2021-01-07 13:48:04 +00:00
2022-01-25 09:48:05 +00:00
As the HTTP/3 spec is still in draft, HTTP/3 support in Traefik is an experimental feature and needs to be activated
2021-06-22 12:05:57 +00:00
in the experimental section of the static configuration.
2021-01-07 13:48:04 +00:00
```yaml tab="File (YAML)"
experimental:
http3: true
2021-09-10 12:58:13 +00:00
entryPoints:
name:
http3: {}
```
```toml tab="File (TOML)"
[experimental]
http3 = true
[entryPoints.name.http3]
```
2021-01-07 13:48:04 +00:00
2021-09-10 12:58:13 +00:00
```bash tab="CLI"
2022-03-23 09:38:09 +00:00
--experimental.http3=true
2024-04-22 15:24:04 +00:00
--entryPoints.name.http3
2021-09-10 12:58:13 +00:00
```
#### `advertisedPort`
2022-01-25 09:48:05 +00:00
`http3.advertisedPort` defines which UDP port to advertise as the HTTP/3 authority.
It defaults to the entryPoint's address port.
2021-09-10 12:58:13 +00:00
It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik is listening.
!!! info "http3.advertisedPort"
```yaml tab="File (YAML)"
experimental:
http3: true
2021-01-07 13:48:04 +00:00
entryPoints:
name:
2021-09-10 12:58:13 +00:00
http3:
advertisedPort: 443
2021-01-07 13:48:04 +00:00
```
2021-06-22 12:05:57 +00:00
```toml tab="File (TOML)"
[experimental]
http3 = true
2021-09-10 12:58:13 +00:00
[entryPoints.name.http3]
advertisedPort = 443
2021-06-22 12:05:57 +00:00
```
2021-01-07 13:48:04 +00:00
```bash tab="CLI"
2022-03-23 09:38:09 +00:00
--experimental.http3=true
2024-04-22 15:24:04 +00:00
--entryPoints.name.http3.advertisedport=443
2021-01-07 13:48:04 +00:00
```
2020-01-17 16:30:07 +00:00
### Forwarded Headers
2019-08-26 12:40:04 +00:00
2019-09-23 12:32:04 +00:00
You can configure Traefik to trust the forwarded headers information (`X-Forwarded-*`).
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
??? info "`forwardedHeaders.trustedIPs`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Trusting Forwarded Headers from specific IPs.
2019-02-26 13:50:07 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
2019-09-23 12:32:04 +00:00
forwardedHeaders:
2019-07-01 09:30:05 +00:00
trustedIPs:
2019-09-23 15:00:06 +00:00
- "127.0.0.1/32"
- "192.168.1.7"
2019-07-01 09:30:05 +00:00
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2019-09-23 12:32:04 +00:00
--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7
2019-07-01 09:30:05 +00:00
```
2019-09-23 12:32:04 +00:00
??? info "`forwardedHeaders.insecure`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Insecure Mode (Always Trusting Forwarded Headers).
2019-02-26 13:50:07 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
2019-09-23 12:32:04 +00:00
forwardedHeaders:
2019-07-01 09:30:05 +00:00
insecure: true
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
insecure = true
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2019-09-23 12:32:04 +00:00
--entryPoints.web.forwardedHeaders.insecure
2019-07-01 09:30:05 +00:00
```
2024-09-16 09:10:04 +00:00
??? info "`forwardedHeaders.connection`"
As per RFC7230, Traefik respects the Connection options from the client request.
By doing so, it removes any header field(s) listed in the request Connection header and the Connection header field itself when empty.
The removal happens as soon as the request is handled by Traefik,
thus the removed headers are not available when the request passes through the middleware chain.
The `connection` option lists the Connection headers allowed to passthrough the middleware chain before their removal.
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
web:
address: ":80"
forwardedHeaders:
connection:
- foobar
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
connection = ["foobar"]
```
```bash tab="CLI"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.connection=foobar
```
2019-09-23 12:32:04 +00:00
### Transport
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
#### `respondingTimeouts`
2024-04-11 13:48:04 +00:00
`respondingTimeouts` are timeouts for incoming requests to the Traefik instance.
Setting them has no effect for UDP entryPoints.
2019-09-23 12:32:04 +00:00
2024-04-11 13:48:04 +00:00
??? info "`transport.respondingTimeouts.readTimeout`"
2024-04-08 15:16:04 +00:00
2024-04-11 15:18:03 +00:00
_Optional, Default=60s_
2021-06-18 22:08:08 +00:00
`readTimeout` is the maximum duration for reading the entire request, including the body.
2019-09-23 12:32:04 +00:00
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration ](https://golang.org/pkg/time/#ParseDuration ) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds.
2024-11-12 09:14:04 +00:00
We strongly suggest adapting this value accordingly to your needs.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
respondingTimeouts:
2024-04-11 13:48:04 +00:00
readTimeout: 42
2019-09-23 12:32:04 +00:00
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
2024-04-11 13:48:04 +00:00
[entryPoints.name.transport]
[entryPoints.name.transport.respondingTimeouts]
readTimeout = 42
2021-06-18 22:08:08 +00:00
```
2019-09-23 12:32:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
2024-04-11 13:48:04 +00:00
--entryPoints.name.transport.respondingTimeouts.readTimeout=42
2019-09-23 12:32:04 +00:00
```
2024-04-11 13:48:04 +00:00
??? info "`transport.respondingTimeouts.writeTimeout`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
_Optional, Default=0s_
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
`writeTimeout` is the maximum duration before timing out writes of the response.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
It covers the time from the end of the request header read to the end of the response write.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration ](https://golang.org/pkg/time/#ParseDuration ) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
respondingTimeouts:
2024-04-11 13:48:04 +00:00
writeTimeout: 42
2019-09-23 12:32:04 +00:00
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
2024-04-11 13:48:04 +00:00
[entryPoints.name.transport]
[entryPoints.name.transport.respondingTimeouts]
writeTimeout = 42
2019-09-23 12:32:04 +00:00
```
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
2024-04-11 13:48:04 +00:00
--entryPoints.name.transport.respondingTimeouts.writeTimeout=42
2019-09-23 12:32:04 +00:00
```
2024-04-11 13:48:04 +00:00
??? info "`transport.respondingTimeouts.idleTimeout`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
_Optional, Default=180s_
2021-06-18 22:08:08 +00:00
`idleTimeout` is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.
2019-09-23 12:32:04 +00:00
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration ](https://golang.org/pkg/time/#ParseDuration ) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
respondingTimeouts:
2024-04-11 13:48:04 +00:00
idleTimeout: 42
2024-04-08 15:16:04 +00:00
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
2024-04-11 13:48:04 +00:00
[entryPoints.name.transport]
[entryPoints.name.transport.respondingTimeouts]
idleTimeout = 42
2024-04-08 15:16:04 +00:00
```
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
2024-04-11 13:48:04 +00:00
--entryPoints.name.transport.respondingTimeouts.idleTimeout=42
2019-09-23 12:32:04 +00:00
```
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
#### `lifeCycle`
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
Controls the behavior of Traefik during the shutdown phase.
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
??? info "`lifeCycle.requestAcceptGraceTimeout`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
_Optional, Default=0s_
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Duration to keep accepting requests prior to initiating the graceful termination period (as defined by the `graceTimeOut` option).
This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Can be provided in a format supported by [time.ParseDuration ](https://golang.org/pkg/time/#ParseDuration ) or as raw values (digits).
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
If no units are provided, the value is parsed assuming seconds.
The zero duration disables the request accepting grace period, i.e., Traefik will immediately proceed to the grace period.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
lifeCycle:
requestAcceptGraceTimeout: 42
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
[entryPoints.name.transport]
[entryPoints.name.transport.lifeCycle]
requestAcceptGraceTimeout = 42
```
2019-09-23 12:32:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
```
2019-02-26 13:50:07 +00:00
2019-09-23 12:32:04 +00:00
??? info "`lifeCycle.graceTimeOut`"
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
_Optional, Default=10s_
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Duration to give active requests a chance to finish before Traefik stops.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
Can be provided in a format supported by [time.ParseDuration ](https://golang.org/pkg/time/#ParseDuration ) or as raw values (digits).
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
If no units are provided, the value is parsed assuming seconds.
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
!!! warning "In this time frame no new requests are accepted."
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
lifeCycle:
graceTimeOut: 42
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
[entryPoints.name.transport]
[entryPoints.name.transport.lifeCycle]
graceTimeOut = 42
```
2019-09-23 12:32:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.lifeCycle.graceTimeOut=42
```
2024-01-02 15:40:06 +00:00
#### `keepAliveMaxRequests`
_Optional, Default=0_
The maximum number of requests Traefik can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.
2024-03-06 13:12:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
keepAliveMaxRequests: 42
```
2024-01-02 15:40:06 +00:00
2024-03-06 13:12:04 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
[entryPoints.name.transport]
keepAliveMaxRequests = 42
```
2024-01-02 15:40:06 +00:00
2024-03-06 13:12:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.keepAliveMaxRequests=42
```
2024-01-02 15:40:06 +00:00
#### `keepAliveMaxTime`
_Optional, Default=0s_
The maximum duration Traefik can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.
2024-03-06 13:12:04 +00:00
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
name:
address: ":8888"
transport:
keepAliveMaxTime: 42s
```
2024-01-02 15:40:06 +00:00
2024-03-06 13:12:04 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.name]
address = ":8888"
[entryPoints.name.transport]
2024-07-01 12:08:04 +00:00
keepAliveMaxTime = "42s"
2024-03-06 13:12:04 +00:00
```
2024-01-02 15:40:06 +00:00
2024-03-06 13:12:04 +00:00
```bash tab="CLI"
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.keepAliveMaxTime=42s
```
2024-01-02 15:40:06 +00:00
2019-09-23 12:32:04 +00:00
### ProxyProtocol
2024-01-02 15:40:06 +00:00
Traefik supports [PROXY protocol ](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt ) version 1 and 2.
2019-09-23 12:32:04 +00:00
2024-01-02 15:40:06 +00:00
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
2019-09-23 12:32:04 +00:00
2024-01-02 15:40:06 +00:00
If the PROXY protocol header is passed, then the version is determined automatically.
2019-09-23 12:32:04 +00:00
2021-06-18 22:08:08 +00:00
??? info "`proxyProtocol.trustedIPs`"
2024-01-02 15:40:06 +00:00
Enabling PROXY protocol with Trusted IPs.
2019-09-23 12:32:04 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
2019-09-23 12:32:04 +00:00
proxyProtocol:
2019-07-01 09:30:05 +00:00
trustedIPs:
2019-09-23 15:00:06 +00:00
- "127.0.0.1/32"
- "192.168.1.7"
2019-07-01 09:30:05 +00:00
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.proxyProtocol]
trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2019-09-23 12:32:04 +00:00
--entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.7
2019-07-01 09:30:05 +00:00
```
2019-09-23 12:32:04 +00:00
IPs in `trustedIPs` only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.
??? info "`proxyProtocol.insecure`"
Insecure Mode (Testing Environment Only).
2021-06-18 22:08:08 +00:00
2019-09-23 12:32:04 +00:00
In a test environments, you can configure Traefik to trust every incoming connection.
Doing so, every remote client address will be replaced (`trustedIPs` won't have any effect)
2019-02-26 13:50:07 +00:00
2019-07-01 09:30:05 +00:00
```yaml tab="File (YAML)"
2019-09-23 12:32:04 +00:00
## Static configuration
2019-07-01 09:30:05 +00:00
entryPoints:
web:
address: ":80"
2019-09-23 12:32:04 +00:00
proxyProtocol:
2019-07-01 09:30:05 +00:00
insecure: true
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.proxyProtocol]
insecure = true
```
2019-07-02 15:36:04 +00:00
```bash tab="CLI"
2019-07-01 09:30:05 +00:00
--entryPoints.web.address=:80
2019-09-23 12:32:04 +00:00
--entryPoints.web.proxyProtocol.insecure
2019-02-26 13:50:07 +00:00
```
2019-09-23 12:32:04 +00:00
!!! warning "Queuing Traefik behind Another Load Balancer"
2024-01-02 15:40:06 +00:00
When queuing Traefik behind another load-balancer, make sure to configure PROXY protocol on both sides.
2019-09-23 12:32:04 +00:00
Not doing so could introduce a security risk in your system (enabling request forgery).
2020-03-05 11:46:05 +00:00
## HTTP Options
This whole section is dedicated to options, keyed by entry point, that will apply only to HTTP routing.
### Redirection
??? example "HTTPS redirection (80 to 443)"
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
```yaml tab="File (YAML)"
entryPoints:
web:
address: :80
http:
redirections:
entryPoint:
to: websecure
2020-03-12 08:48:04 +00:00
scheme: https
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
websecure:
address: :443
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections]
[entryPoints.web.http.redirections.entryPoint]
to = "websecure"
scheme = "https"
[entryPoints.websecure]
address = ":443"
```
2020-03-05 11:46:05 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.web.address=:80
--entryPoints.web.http.redirections.entryPoint.to=websecure
--entryPoints.web.http.redirections.entryPoint.scheme=https
--entryPoints.websecure.address=:443
2020-03-05 11:46:05 +00:00
```
#### `entryPoint`
2020-03-18 14:48:04 +00:00
This section is a convenience to enable (permanent) redirecting of all incoming requests on an entry point (e.g. port `80` ) to another entry point (e.g. port `443` ) or an explicit port (`:443`).
2020-03-05 11:46:05 +00:00
??? info "`entryPoint.to`"
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
_Required_
2021-06-18 22:08:08 +00:00
2020-03-18 14:48:04 +00:00
The target element, it can be:
2021-06-18 22:08:08 +00:00
2020-03-18 14:48:04 +00:00
- an entry point name (ex: `websecure` )
- a port (`:443`)
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
```yaml tab="File (YAML)"
entryPoints:
foo:
# ...
http:
redirections:
entryPoint:
2020-03-18 14:48:04 +00:00
to: websecure
2020-03-05 11:46:05 +00:00
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.foo]
# ...
[entryPoints.foo.http.redirections]
[entryPoints.foo.http.redirections.entryPoint]
to = "websecure"
```
2020-03-05 11:46:05 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.foo.http.redirections.entryPoint.to=websecure
2020-03-05 11:46:05 +00:00
```
??? info "`entryPoint.scheme`"
2021-06-18 22:08:08 +00:00
2020-03-18 14:48:04 +00:00
_Optional, Default="https"_
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
The redirection target scheme.
```yaml tab="File (YAML)"
entryPoints:
foo:
# ...
http:
redirections:
entryPoint:
# ...
scheme: https
```
2020-03-18 14:48:04 +00:00
```toml tab="File (TOML)"
[entryPoints.foo]
# ...
[entryPoints.foo.http.redirections]
[entryPoints.foo.http.redirections.entryPoint]
# ...
2021-06-18 22:08:08 +00:00
scheme = "https"
2020-03-18 14:48:04 +00:00
```
2021-06-18 22:08:08 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.foo.http.redirections.entryPoint.scheme=https
2021-06-18 22:08:08 +00:00
```
??? info "`entryPoint.permanent`"
_Optional, Default=true_
To apply a permanent redirection.
2020-03-18 14:48:04 +00:00
```yaml tab="File (YAML)"
entryPoints:
foo:
# ...
http:
redirections:
entryPoint:
# ...
permanent: true
```
```toml tab="File (TOML)"
[entryPoints.foo]
# ...
[entryPoints.foo.http.redirections]
[entryPoints.foo.http.redirections.entryPoint]
# ...
2021-06-18 22:08:08 +00:00
permanent = true
2020-03-18 14:48:04 +00:00
```
2021-06-18 22:08:08 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.foo.http.redirections.entrypoint.permanent=true
2020-03-18 14:48:04 +00:00
```
2021-06-18 22:08:08 +00:00
??? info "`entryPoint.priority`"
2024-02-15 15:40:05 +00:00
_Optional, Default=MaxInt-1_
2021-06-18 22:08:08 +00:00
Priority of the generated router.
2020-03-18 14:48:04 +00:00
```yaml tab="File (YAML)"
entryPoints:
foo:
# ...
http:
redirections:
entryPoint:
# ...
priority: 10
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.foo]
# ...
[entryPoints.foo.http.redirections]
[entryPoints.foo.http.redirections.entryPoint]
# ...
priority = 10
```
2020-03-18 14:48:04 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.foo.http.redirections.entrypoint.priority=10
2020-03-18 14:48:04 +00:00
```
2023-06-15 16:20:06 +00:00
### EncodeQuerySemicolons
_Optional, Default=false_
The `encodeQuerySemicolons` option allows to enable query semicolons encoding.
One could use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik.
When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.
```yaml tab="File (YAML)"
entryPoints:
websecure:
address: ':443'
http:
encodeQuerySemicolons: true
```
```toml tab="File (TOML)"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http]
encodeQuerySemicolons = true
```
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.websecure.address=:443
--entryPoints.websecure.http.encodequerysemicolons=true
2023-06-15 16:20:06 +00:00
```
#### Examples
| EncodeQuerySemicolons | Request Query | Resulting Request Query |
|-----------------------|---------------------|-------------------------|
| false | foo=bar;baz=bar | foo=bar& baz=bar |
| true | foo=bar;baz=bar | foo=bar%3Bbaz=bar |
| false | foo=bar&baz=bar; foo | foo=bar& baz=bar& foo |
| true | foo=bar&baz=bar; foo | foo=bar& baz=bar%3Bfoo |
2020-03-05 11:46:05 +00:00
### Middlewares
The list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.
```yaml tab="File (YAML)"
entryPoints:
websecure:
address: ':443'
http:
middlewares:
- auth@file
- strip@file
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http]
middlewares = ["auth@file", "strip@file"]
```
2020-03-05 11:46:05 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.websecure.address=:443
--entryPoints.websecure.http.middlewares=auth@file,strip@file
2020-03-05 11:46:05 +00:00
```
### TLS
This section is about the default TLS configuration applied to all routers associated with the named entry point.
If a TLS section (i.e. any of its fields) is user-defined, then the default configuration does not apply at all.
The TLS section is the same as the [TLS section on HTTP routers ](./routers/index.md#tls ).
```yaml tab="File (YAML)"
entryPoints:
websecure:
address: ':443'
http:
tls:
options: foobar
certResolver: leresolver
domains:
- main: example.com
sans:
- foo.example.com
- bar.example.com
- main: test.com
sans:
- foo.test.com
- bar.test.com
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http.tls]
options = "foobar"
certResolver = "leresolver"
[[entryPoints.websecure.http.tls.domains]]
main = "example.com"
sans = ["foo.example.com", "bar.example.com"]
[[entryPoints.websecure.http.tls.domains]]
main = "test.com"
sans = ["foo.test.com", "bar.test.com"]
```
2020-03-05 11:46:05 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.websecure.address=:443
--entryPoints.websecure.http.tls.options=foobar
--entryPoints.websecure.http.tls.certResolver=leresolver
--entryPoints.websecure.http.tls.domains[0].main=example.com
--entryPoints.websecure.http.tls.domains[0].sans=foo.example.com,bar.example.com
--entryPoints.websecure.http.tls.domains[1].main=test.com
--entryPoints.websecure.http.tls.domains[1].sans=foo.test.com,bar.test.com
2020-03-05 11:46:05 +00:00
```
??? example "Let's Encrypt"
2021-06-18 22:08:08 +00:00
2020-03-05 11:46:05 +00:00
```yaml tab="File (YAML)"
entryPoints:
websecure:
address: ':443'
http:
tls:
certResolver: leresolver
```
2021-06-18 22:08:08 +00:00
```toml tab="File (TOML)"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http.tls]
certResolver = "leresolver"
```
2020-03-05 11:46:05 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.websecure.address=:443
--entryPoints.websecure.http.tls.certResolver=leresolver
2020-03-05 11:46:05 +00:00
```
2021-01-07 16:16:03 +00:00
## UDP Options
This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing.
### Timeout
_Optional, Default=3s_
Timeout defines how long to wait on an idle session before releasing the related resources.
The Timeout value must be greater than zero.
```yaml tab="File (YAML)"
entryPoints:
foo:
address: ':8000/udp'
udp:
timeout: 10s
```
2021-06-22 12:05:57 +00:00
```toml tab="File (TOML)"
[entryPoints.foo]
address = ":8000/udp"
[entryPoints.foo.udp]
timeout = "10s"
```
2021-01-07 16:16:03 +00:00
```bash tab="CLI"
2024-04-22 15:24:04 +00:00
--entryPoints.foo.address=:8000/udp
--entryPoints.foo.udp.timeout=10s
2021-01-07 16:16:03 +00:00
```
2022-07-05 08:02:09 +00:00
2022-09-09 15:17:53 +00:00
{!traefik-for-business-applications.md!}