diff --git a/docs/backends/marathon.md b/docs/backends/marathon.md deleted file mode 100644 index 9475b7d8b..000000000 --- a/docs/backends/marathon.md +++ /dev/null @@ -1,166 +0,0 @@ -# Marathon backend - -Træfik can be configured to use Marathon as a backend configuration: - - -```toml -################################################################ -# Mesos/Marathon configuration backend -################################################################ - -# Enable Marathon configuration backend -# -# Optional -# -[marathon] - -# Marathon server endpoint. -# You can also specify multiple endpoint for Marathon: -# endpoint := "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080" -# -# Required -# -endpoint = "http://127.0.0.1:8080" - -# Enable watch Marathon changes -# -# Optional -# -watch = true - -# Default domain used. -# -# Required -# -domain = "marathon.localhost" - -# Override default configuration template. For advanced users :) -# -# Optional -# -# filename = "marathon.tmpl" - -# Expose Marathon apps by default in traefik -# -# Optional -# Default: true -# -# exposedByDefault = true - -# Convert Marathon groups to subdomains -# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain} -# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain} -# -# Optional -# Default: false -# -# groupsAsSubDomains = true - -# Enable compatibility with marathon-lb labels -# -# Optional -# Default: false -# -# marathonLBCompatibility = true - -# Enable Marathon basic authentication -# -# Optional -# -# [marathon.basic] -# httpBasicAuthUser = "foo" -# httpBasicPassword = "bar" - -# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config -# -# Optional -# -# [marathon.TLS] -# CA = "/etc/ssl/ca.crt" -# Cert = "/etc/ssl/marathon.cert" -# Key = "/etc/ssl/marathon.key" -# InsecureSkipVerify = true - -# DCOSToken for DCOS environment, This will override the Authorization header -# -# Optional -# -# dcosToken = "xxxxxx" - -# Override DialerTimeout -# Amount of time to allow the Marathon provider to wait to open a TCP connection -# to a Marathon master. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). If no units are provided, the value is parsed assuming -# seconds. -# -# Optional -# Default: "60s" -# dialerTimeout = "60s" - -# Set the TCP Keep Alive interval for the Marathon HTTP Client. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). If no units are provided, the value is parsed assuming -# seconds. -# -# Optional -# Default: "10s" -# -# keepAlive = "10s" - -# By default, a task's IP address (as returned by the Marathon API) is used as -# backend server if an IP-per-task configuration can be found; otherwise, the -# name of the host running the task is used. -# The latter behavior can be enforced by enabling this switch. -# -# Optional -# Default: false -# -# forceTaskHostname = false - -# Applications may define readiness checks which are probed by Marathon during -# deployments periodically and the results exposed via the API. Enabling the -# following parameter causes Traefik to filter out tasks whose readiness checks -# have not succeeded. -# Note that the checks are only valid at deployment times. See the Marathon -# guide for details. -# -# Optional -# Default: false -# -# respectReadinessChecks = false -``` - -Labels can be used on containers to override default behaviour: - -- `traefik.backend=foo`: assign the application to `foo` backend -- `traefik.backend.maxconn.amount=10`: set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect. -- `traefik.backend.maxconn.extractorfunc=client.ip`: set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. -- `traefik.backend.loadbalancer.method=drr`: override the default `wrr` load balancer algorithm -- `traefik.backend.loadbalancer.sticky=true`: enable backend sticky sessions -- `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5`: create a [circuit breaker](/basics/#backends) to be used against the backend -- `traefik.backend.healthcheck.path=/health`: set the Traefik health check path [default: no health checks] -- `traefik.backend.healthcheck.interval=5s`: sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s] -- `traefik.portIndex=1`: register port by index in the application's ports array. Useful when the application exposes multiple ports. -- `traefik.port=80`: register the explicit application port value. Cannot be used alongside `traefik.portIndex`. -- `traefik.protocol=https`: override the default `http` protocol -- `traefik.weight=10`: assign this weight to the application -- `traefik.enable=false`: disable this application in Træfik -- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`). -- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend. -- `traefik.frontend.priority=10`: override default frontend priority -- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. -- `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0`: Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively - -If several ports need to be exposed from a container, the services labels can be used - -- `traefik..port=443`: create a service binding with frontend/backend using this port. Overrides `traefik.port`. -- `traefik..portIndex=1`: create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. -- `traefik..protocol=https`: assign `https` protocol. Overrides `traefik.protocol`. -- `traefik..weight=10`: assign this service weight. Overrides `traefik.weight`. -- `traefik..frontend.backend=fooBackend`: assign this service frontend to `foobackend`. Default is to assign to the service backend. -- `traefik..frontend.entryPoints=http`: assign this service entrypoints. Overrides `traefik.frontend.entrypoints`. -- `traefik..frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` Sets a Basic Auth for that frontend with the users test:test and test2:test2. -- `traefik..frontend.passHostHeader=true`: Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`. -- `traefik..frontend.priority=10`: assign the service frontend priority. Overrides `traefik.frontend.priority`. -- `traefik..frontend.rule=Path:/foo`: assign the service frontend rule. Overrides `traefik.frontend.rule`. \ No newline at end of file diff --git a/docs/backends/rancher.md b/docs/backends/rancher.md deleted file mode 100644 index 8f34eca51..000000000 --- a/docs/backends/rancher.md +++ /dev/null @@ -1,117 +0,0 @@ -# Rancher backend - -Træfik can be configured to use Rancher as a backend configuration: - - -```toml -################################################################ -# Rancher configuration backend -################################################################ - -# Enable Rancher configuration backend -# -# Optional -# -[rancher] - -# Default domain used. -# Can be overridden by setting the "traefik.domain" label on an service. -# -# Required -# -domain = "rancher.localhost" - -# Enable watch Rancher changes -# -# Optional -# Default: true -# -Watch = true - -# Polling interval (in seconds) -# -# Optional -# -RefreshSeconds = 15 - -# Expose Rancher services by default in traefik -# -# Optional -# Default: true -# -ExposedByDefault = false - -# Filter services with unhealthy states and inactive states -# -# Optional -# Default: false -# -EnableServiceHealthFilter = true -``` - -```toml -# Enable Rancher metadata service configuration backend instead of the API -# configuration backend -# -# Optional -# Default: false -# -[rancher.metadata] - -# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds` -# NOTE: this is less accurate than the default long polling technique which -# will provide near instantaneous updates to Traefik -# -# Optional -# Default: false -# -IntervalPoll = true - -# Prefix used for accessing the Rancher metadata service -# -# Optional -# Default: "/latest" -# -Prefix = "/2016-07-29" -``` - -```toml -# Enable Rancher API configuration backend -# -# Optional -# Default: true -# -[rancher.api] - -# Endpoint to use when connecting to the Rancher API -# -# Required -Endpoint = "http://rancherserver.example.com/v1" - -# AccessKey to use when connecting to the Rancher API -# -# Required -AccessKey = "XXXXXXXXXXXXXXXXXXXX" - -# SecretKey to use when connecting to the Rancher API -# -# Required -SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -``` - -If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters. - -To enable traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`. -This can be found within the API Key advanced options. - -Labels can be used on task containers to override default behaviour: - -- `traefik.protocol=https`: override the default `http` protocol -- `traefik.weight=10`: assign this weight to the container -- `traefik.enable=false`: disable this container in Træfik -- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`). -- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend. -- `traefik.frontend.priority=10`: override default frontend priority -- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. -- `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0`: Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively - diff --git a/docs/basics.md b/docs/basics.md index 0094065f9..5b0e584f6 100644 --- a/docs/basics.md +++ b/docs/basics.md @@ -1,5 +1,6 @@ +# Basics -# Concepts +## Concepts Let's take our example from the [overview](https://docs.traefik.io/#overview) again: @@ -24,7 +25,7 @@ Routes are created using requests fields (`Host`, `Path`, `Headers`...) and can - The [frontend](#frontends) will then send the request to a [backend](#backends). A backend can be composed by one or more [servers](#servers), and by a load-balancing strategy. - Finally, the [server](#servers) will forward the request to the corresponding microservice in the private network. -## Entrypoints +### Entrypoints Entrypoints are the network entry points into Træfik. They can be defined using: @@ -71,13 +72,13 @@ And here is another example with client certificate authentication: - One or several files containing Certificate Authorities in PEM format are added. - It is possible to have multiple CA:s in the same file or keep them in separate files. -## Frontends +### Frontends A frontend consists of a set of rules that determine how incoming requests are forwarded from an entrypoint to a backend. Rules may be classified in one of two groups: Modifiers and matchers. -### Modifiers +#### Modifiers Modifier rules only modify the request. They do not have any impact on routing decisions being made. @@ -86,7 +87,7 @@ Following is the list of existing modifier rules: - `AddPrefix: /products`: Add path prefix to the existing request path prior to forwarding the request to the backend. - `ReplacePath: /serverless-path`: Replaces the path and adds the old path to the `X-Replaced-Path` header. Useful for mapping to AWS Lambda or Google Cloud Functions. -### Matchers +#### Matchers Matcher rules determine if a particular request should be forwarded to a backend. @@ -115,7 +116,7 @@ In order to use regular expressions with Host and Path matchers, you must declar (Note that the variable has no special meaning; however, it is required by the gorilla/mux dependency which embeds the regular expression and defines the syntax.) -#### Path Matcher Usage Guidelines +##### Path Matcher Usage Guidelines This section explains when to use the various path matchers. @@ -128,7 +129,7 @@ If your backend is serving assets (e.g., images or Javascript files), chances ar Instead of distinguishing your backends by path only, you can add a Host matcher to the mix. That way, namespacing of your backends happens on the basis of hosts in addition to paths. -### Examples +#### Examples Here is an example of frontends definition: @@ -157,7 +158,7 @@ Here is an example of frontends definition: - `frontend2` will forward the traffic to the `backend1` if the rule `Host:localhost,{subdomain:[a-z]+}.localhost` is matched (forwarding client `Host` header to the backend) - `frontend3` will forward the traffic to the `backend2` if the rules `Host:test3.localhost` **AND** `Path:/test` are matched -### Combining multiple rules +#### Combining multiple rules As seen in the previous example, you can combine multiple rules. In TOML file, you can use multiple routes: @@ -193,7 +194,7 @@ Finally, you can create a rule to bind multiple domains or Path to a frontend, u rule = "Path:/test1,/test2" ``` -### Rules Order +#### Rules Order When combining `Modifier` rules with `Matcher` rules, it is important to remember that `Modifier` rules **ALWAYS** apply after the `Matcher` rules. The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portion of the rule will apply first, and the `Modifier` will apply later. @@ -212,7 +213,7 @@ The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portio 5. `AddPrefix` 6. `ReplacePath` -### Priorities +#### Priorities By default, routes will be sorted (in descending order) using rules length (to avoid path overlap): `PathPrefix:/12345` will be matched before `PathPrefix:/1234` that will be matched before `PathPrefix:/1`. @@ -237,7 +238,7 @@ You can customize priority by frontend: Here, `frontend1` will be matched before `frontend2` (`10 > 5`). -### Custom headers +#### Custom headers Custom headers can be configured through the frontends, to add headers to either requests or responses that match the frontend's rules. This allows for setting headers such as `X-Script-Name` to be added to the request, or custom headers to be added to the response: @@ -255,7 +256,7 @@ Custom headers can be configured through the frontends, to add headers to either In this example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, and the `X-Custom-Response-Header` added to the response. -### Security headers +#### Security headers Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above. This functionality allows for some easy security features to quickly be set. An example of some of the security headers: @@ -277,7 +278,7 @@ Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc In this example, traffic routed through the first frontend will have the `X-Frame-Options` header set to `DENY`, and the second will only allow HTTPS request through, otherwise will return a 301 HTTPS redirect. -## Backends +### Backends A backend is responsible to load-balance the traffic coming from one or more frontends to a set of http servers. Various methods of load-balancing are supported: @@ -364,7 +365,7 @@ To use a different port for the healthcheck: port = 8080 ``` -## Servers +### Servers Servers are simply defined using a `URL`. You can also apply a custom `weight` to each server (this will be used by load-balancing). @@ -397,7 +398,7 @@ Here is an example of backends and servers definition: - `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2` using `drr` load-balancing strategy. - a circuit breaker is added on `backend1` using the expression `NetworkErrorRatio() > 0.5`: watch error ratio over 10 second sliding window -## Custom Error pages +### Custom Error pages Custom error pages can be returned, in lieu of the default, according to frontend-configured ranges of HTTP Status codes. In the example below, if a 503 status is returned from the frontend "website", the custom error page at http://2.3.4.5/503.html is returned with the actual status code set in the HTTP header. @@ -430,7 +431,7 @@ Instead, the query parameter can also be set to some generic error page like so: Now the 500s.html error page is returned for the configured code range. The configured status code ranges are inclusive; that is, in the above example, the 500s.html page will be returned for status codes 500 through, and including, 599. -# Configuration +## Configuration Træfik's configuration has two parts: @@ -438,7 +439,7 @@ Træfik's configuration has two parts: - The [dynamic Træfik configuration](/basics#dynamic-trfk-configuration) which can be hot-reloaded (no need to restart the process). -## Static Træfik configuration +### Static Træfik configuration The static configuration is the global configuration which is setting up connections to configuration backends and entrypoints. @@ -454,7 +455,7 @@ It means that arguments override configuration file, and key-value store overrid Note that the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider. It must not be used if a configuration source with less precedence wants to set a non-default provider value. -### Configuration file +#### Configuration file By default, Træfik will try to find a `traefik.toml` in the following places: @@ -470,7 +471,7 @@ $ traefik --configFile=foo/bar/myconfigfile.toml Please refer to the [global configuration](/toml/#global-configuration) section to get documentation on it. -### Arguments +#### Arguments Each argument (and command) is described in the help section: @@ -480,7 +481,7 @@ $ traefik --help Note that all default values will be displayed as well. -### Key-value stores +#### Key-value stores Træfik supports several Key-value stores: @@ -491,7 +492,7 @@ Træfik supports several Key-value stores: Please refer to the [User Guide Key-value store configuration](/user-guide/kv-config/) section to get documentation on it. -## Dynamic Træfik configuration +### Dynamic Træfik configuration The dynamic configuration concerns : @@ -506,7 +507,7 @@ Routes to services will be created and updated instantly at any changes. Please refer to the [configuration backends](/toml/#configuration-backends) section to get documentation on it. -# Commands +## Commands Usage: `traefik [command] [--flag=flag_argument]` @@ -530,7 +531,7 @@ Note that each command is described at the beginning of the help section: $ traefik --help ``` -## Command: bug +### Command: bug Here is the easiest way to submit a pre-filled issue on [Træfik GitHub](https://github.com/containous/traefik). @@ -540,7 +541,7 @@ $ traefik bug See https://www.youtube.com/watch?v=Lyz62L8m93I. -## Command: healthcheck +### Command: healthcheck This command allows to check the health of Traefik. Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy. This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism. @@ -552,7 +553,7 @@ $ traefik healthcheck OK: http://:8082/ping ``` -# Log Rotation +## Log Rotation Traefik will close and reopen its log files, assuming they're configured, on receipt of a USR1 signal. This allows the logs to be rotated and processed by an external program, such as `logrotate`. diff --git a/docs/backends/boltdb.md b/docs/configuration/backends/boltdb.md similarity index 90% rename from docs/backends/boltdb.md rename to docs/configuration/backends/boltdb.md index 1a872b4d3..ce44ea67e 100644 --- a/docs/backends/boltdb.md +++ b/docs/configuration/backends/boltdb.md @@ -1,4 +1,4 @@ -# BoltDB backend +# BoltDB Backend Træfik can be configured to use BoltDB as a backend configuration: @@ -8,9 +8,6 @@ Træfik can be configured to use BoltDB as a backend configuration: ################################################################ # Enable BoltDB configuration backend -# -# Optional -# [boltdb] # BoltDB file @@ -35,5 +32,5 @@ prefix = "/traefik" # # Optional # -# filename = "boltdb.tmpl" +filename = "boltdb.tmpl" ``` \ No newline at end of file diff --git a/docs/backends/consul.md b/docs/configuration/backends/consul.md similarity index 91% rename from docs/backends/consul.md rename to docs/configuration/backends/consul.md index 8aac5cea4..c92fd59e4 100644 --- a/docs/backends/consul.md +++ b/docs/configuration/backends/consul.md @@ -1,4 +1,5 @@ -# Consul backend +# Consul Backend + ## Consul Key-Value backend Træfik can be configured to use Consul as a backend configuration: @@ -9,9 +10,6 @@ Træfik can be configured to use Consul as a backend configuration: ################################################################ # Enable Consul KV configuration backend -# -# Optional -# [consul] # Consul server endpoint @@ -61,9 +59,6 @@ Træfik can be configured to use service discovery catalog of Consul as a backen ################################################################ # Enable Consul Catalog configuration backend -# -# Optional -# [consulCatalog] # Consul server endpoint @@ -81,7 +76,6 @@ domain = "consul.localhost" # Expose Consul catalog services by default in traefik # # Optional -# Default: true # exposedByDefault = false @@ -92,17 +86,18 @@ exposedByDefault = false prefix = "traefik" # Default frontEnd Rule for Consul services -# The format is a Go Template with ".ServiceName", ".Domain" and ".Attributes" available -# "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available -# "getAttribute(...)" function uses prefixed tag names based on "prefix" value +# +# The format is a Go Template with: +# - ".ServiceName", ".Domain" and ".Attributes" available +# - "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available +# - "getAttribute(...)" function uses prefixed tag names based on "prefix" value # # Optional # -frontEndRule = "Host:{{.ServiceName}}.{{Domain}}" +#frontEndRule = "Host:{{.ServiceName}}.{{Domain}}" ``` -This backend will create routes matching on hostname based on the service name -used in consul. +This backend will create routes matching on hostname based on the service name used in consul. Additional settings can be defined using Consul Catalog tags: diff --git a/docs/backends/docker.md b/docs/configuration/backends/docker.md similarity index 91% rename from docs/backends/docker.md rename to docs/configuration/backends/docker.md index cfc5d541d..e29b451ec 100644 --- a/docs/backends/docker.md +++ b/docs/configuration/backends/docker.md @@ -1,6 +1,8 @@ -# Docker backend +# Docker Backend -Træfik can be configured to use Docker as a backend configuration: +Træfik can be configured to use Docker as a backend configuration. + +## Docker ```toml ################################################################ @@ -8,9 +10,6 @@ Træfik can be configured to use Docker as a backend configuration: ################################################################ # Enable Docker configuration backend -# -# Optional -# [docker] # Docker server endpoint. Can be a tcp or a unix socket endpoint. @@ -47,12 +46,12 @@ watch = true exposedbydefault = true # Use the IP address from the binded port instead of the inner network one. For specific use-case :) - # # Optional # Default: false # usebindportip = true + # Use Swarm Mode services as data provider # # Optional @@ -60,9 +59,10 @@ usebindportip = true # swarmmode = false - # Enable docker TLS connection # +# Optional +# # [docker.tls] # ca = "/etc/ssl/ca.crt" # cert = "/etc/ssl/docker.crt" @@ -70,7 +70,65 @@ swarmmode = false # insecureskipverify = true ``` -### Labels can be used on containers to override default behaviour +## Docker Swarm Mode + +```toml +################################################################ +# Docker Swarmmode configuration backend +################################################################ + +# Enable Docker configuration backend +[docker] + +# Docker server endpoint. Can be a tcp or a unix socket endpoint. +# +# Required +# Default: "unix:///var/run/docker.sock" +# +endpoint = "tcp://127.0.0.1:2375" + +# Default domain used. +# Can be overridden by setting the "traefik.domain" label on a services. +# +# Optional +# Default: "" +# +domain = "docker.localhost" + +# Enable watch docker changes +# +# Optional +# +watch = true + +# Use Docker Swarm Mode as data provider +swarmmode = true + +# Override default configuration template. For advanced users :) +# +# Optional +# +# filename = "docker.tmpl" + +# Expose services by default in traefik +# +# Optional +# Default: true +# +exposedbydefault = false + +# Enable docker TLS connection +# +# Optional +# +# [swarm.tls] +# ca = "/etc/ssl/ca.crt" +# cert = "/etc/ssl/docker.crt" +# key = "/etc/ssl/docker.key" +# insecureskipverify = true +``` + +## Labels can be used on containers to override default behaviour | Label | Description | |---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/docs/backends/dynamodb.md b/docs/configuration/backends/dynamodb.md similarity index 65% rename from docs/backends/dynamodb.md rename to docs/configuration/backends/dynamodb.md index 17d9a9d5a..65065a33f 100644 --- a/docs/backends/dynamodb.md +++ b/docs/configuration/backends/dynamodb.md @@ -1,17 +1,13 @@ -# DynamoDB backend +# DynamoDB Backend Træfik can be configured to use Amazon DynamoDB as a backend configuration: - ```toml ################################################################ # DynamoDB configuration backend ################################################################ # Enable DynamoDB configuration backend -# -# Optional -# [dynamodb] # DyanmoDB Table Name @@ -55,14 +51,13 @@ SecretAccessKey = "123" # Optional # Endpoint = "http://localhost:8080" - ``` Items in the `dynamodb` table must have three attributes: -- `id` : string - - The id is the primary key. -- `name` : string - - The name is used as the name of the frontend or backend. -- `frontend` or `backend` : map - - This attribute's structure matches exactly the structure of a Frontend or Backend type in traefik. See `types/types.go` for details. The presence or absence of this attribute determines its type. So an item should never have both a `frontend` and a `backend` attribute. \ No newline at end of file +- `id` (string): The id is the primary key. +- `name`(string): The name is used as the name of the frontend or backend. +- `frontend` or `backend` (map): This attribute's structure matches exactly the structure of a Frontend or Backend type in traefik. + See `types/types.go` for details. + The presence or absence of this attribute determines its type. + So an item should never have both a `frontend` and a `backend` attribute. diff --git a/docs/backends/ecs.md b/docs/configuration/backends/ecs.md similarity index 55% rename from docs/backends/ecs.md rename to docs/configuration/backends/ecs.md index 0501ce0e8..72c7768bc 100644 --- a/docs/backends/ecs.md +++ b/docs/configuration/backends/ecs.md @@ -1,22 +1,18 @@ -# ECS backend +# ECS Backend Træfik can be configured to use Amazon ECS as a backend configuration: - ```toml ################################################################ # ECS configuration backend ################################################################ # Enable ECS configuration backend -# -# Optional -# [ecs] # ECS Cluster Name # -# Deprecated - Please use Clusters +# DEPRECATED - Please use Clusters # Cluster = "default" @@ -73,19 +69,26 @@ AccessKeyID = "abc" # SecretAccessKey = "123" +# Override default configuration template. For advanced users :) +# +# Optional +# +# filename = "ecs.tmpl" ``` Labels can be used on task containers to override default behaviour: -- `traefik.protocol=https`: override the default `http` protocol -- `traefik.weight=10`: assign this weight to the container -- `traefik.enable=false`: disable this container in Træfik -- `traefik.backend.loadbalancer.method=drr`: override the default `wrr` load balancer algorithm -- `traefik.backend.loadbalancer.sticky=true`: enable backend sticky sessions -- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`). -- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend. -- `traefik.frontend.priority=10`: override default frontend priority -- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. +| Label | Description | +|----------------------------------------------|------------------------------------------------------------------------------------------| +| `traefik.protocol=https` | override the default `http` protocol | +| `traefik.weight=10` | assign this weight to the container | +| `traefik.enable=false` | disable this container in Træfik | +| `traefik.backend.loadbalancer.method=drr` | override the default `wrr` load balancer algorithm | +| `traefik.backend.loadbalancer.sticky=true` | enable backend sticky sessions | +| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). | +| `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. | +| `traefik.frontend.priority=10` | override default frontend priority | +| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. | If `AccessKeyID`/`SecretAccessKey` is not given credentials will be resolved in the following order: diff --git a/docs/backends/etcd.md b/docs/configuration/backends/etcd.md similarity index 97% rename from docs/backends/etcd.md rename to docs/configuration/backends/etcd.md index e621739e4..568bcfb94 100644 --- a/docs/backends/etcd.md +++ b/docs/configuration/backends/etcd.md @@ -1,4 +1,4 @@ -# Etcd backend +# Etcd Backend Træfik can be configured to use Etcd as a backend configuration: @@ -8,9 +8,6 @@ Træfik can be configured to use Etcd as a backend configuration: ################################################################ # Enable Etcd configuration backend -# -# Optional -# [etcd] # Etcd server endpoint diff --git a/docs/backends/eureka.md b/docs/configuration/backends/eureka.md similarity index 95% rename from docs/backends/eureka.md rename to docs/configuration/backends/eureka.md index 25e5053fc..2cf2c9d33 100644 --- a/docs/backends/eureka.md +++ b/docs/configuration/backends/eureka.md @@ -1,17 +1,13 @@ -# Eureka backend +# Eureka Backend Træfik can be configured to use Eureka as a backend configuration: - ```toml ################################################################ # Eureka configuration backend ################################################################ # Enable Eureka configuration backend -# -# Optional -# [eureka] # Eureka server endpoint. diff --git a/docs/backends/file.md b/docs/configuration/backends/file.md similarity index 94% rename from docs/backends/file.md rename to docs/configuration/backends/file.md index 06ad47dda..3ba267922 100644 --- a/docs/backends/file.md +++ b/docs/configuration/backends/file.md @@ -1,8 +1,10 @@ -# File backends +# File Backends Like any other reverse proxy, Træfik can be configured with a file. You have three choices: -- simply add your configuration at the end of the global configuration file `traefik.toml`: +## Simple + +Add your configuration at the end of the global configuration file `traefik.toml`: ```toml # traefik.toml @@ -74,7 +76,9 @@ defaultEntryPoints = ["http", "https"] rule = "Path:/test" ``` -- or put your rules in a separate file, for example `rules.toml`: +## Rules in a Separate File + +Put your rules in a separate file, for example `rules.toml`: ```toml # traefik.toml @@ -141,7 +145,9 @@ filename = "rules.toml" rule = "Path:/test" ``` -- or you could have multiple .toml files in a directory: +## Multiple .toml Files + +You could have multiple `.toml` files in a directory: ```toml [file] diff --git a/docs/backends/kubernetes.md b/docs/configuration/backends/kubernetes.md similarity index 98% rename from docs/backends/kubernetes.md rename to docs/configuration/backends/kubernetes.md index 23392a242..822d14f4a 100644 --- a/docs/backends/kubernetes.md +++ b/docs/configuration/backends/kubernetes.md @@ -1,5 +1,4 @@ -# Kubernetes Ingress backend - +# Kubernetes Ingress Backend Træfik can be configured to use Kubernetes Ingress as a backend configuration: @@ -8,9 +7,6 @@ Træfik can be configured to use Kubernetes Ingress as a backend configuration: # Kubernetes Ingress configuration backend ################################################################ # Enable Kubernetes Ingress configuration backend -# -# Optional -# [kubernetes] # Kubernetes server endpoint diff --git a/docs/configuration/backends/marathon.md b/docs/configuration/backends/marathon.md new file mode 100644 index 000000000..3f0599f99 --- /dev/null +++ b/docs/configuration/backends/marathon.md @@ -0,0 +1,167 @@ +# Marathon Backend + +Træfik can be configured to use Marathon as a backend configuration: + +```toml +################################################################ +# Mesos/Marathon configuration backend +################################################################ + +# Enable Marathon configuration backend +[marathon] + +# Marathon server endpoint. +# You can also specify multiple endpoint for Marathon: +# endpoint := "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080" +# +# Required +# +endpoint = "http://127.0.0.1:8080" + +# Enable watch Marathon changes +# +# Optional +# +watch = true + +# Default domain used. +# Can be overridden by setting the "traefik.domain" label on an application. +# +# Required +# +domain = "marathon.localhost" + +# Override default configuration template. For advanced users :) +# +# Optional +# +# filename = "marathon.tmpl" + +# Expose Marathon apps by default in traefik +# +# Optional +# Default: true +# +# exposedByDefault = true + +# Convert Marathon groups to subdomains +# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain} +# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain} +# +# Optional +# Default: false +# +# groupsAsSubDomains = true + +# Enable compatibility with marathon-lb labels +# +# Optional +# Default: false +# +# marathonLBCompatibility = true + +# Enable Marathon basic authentication +# +# Optional +# +# [marathon.basic] +# httpBasicAuthUser = "foo" +# httpBasicPassword = "bar" + +# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config +# +# Optional +# +# [marathon.TLS] +# CA = "/etc/ssl/ca.crt" +# Cert = "/etc/ssl/marathon.cert" +# Key = "/etc/ssl/marathon.key" +# InsecureSkipVerify = true + +# DCOSToken for DCOS environment, This will override the Authorization header +# +# Optional +# +# dcosToken = "xxxxxx" + +# Override DialerTimeout +# Amount of time to allow the Marathon provider to wait to open a TCP connection +# to a Marathon master. +# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw +# values (digits). If no units are provided, the value is parsed assuming +# seconds. +# +# Optional +# Default: "60s" +# dialerTimeout = "60s" + +# Set the TCP Keep Alive interval for the Marathon HTTP Client. +# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw +# values (digits). If no units are provided, the value is parsed assuming +# seconds. +# +# Optional +# Default: "10s" +# +# keepAlive = "10s" + +# By default, a task's IP address (as returned by the Marathon API) is used as +# backend server if an IP-per-task configuration can be found; otherwise, the +# name of the host running the task is used. +# The latter behavior can be enforced by enabling this switch. +# +# Optional +# Default: false +# +# forceTaskHostname = false + +# Applications may define readiness checks which are probed by Marathon during +# deployments periodically and the results exposed via the API. Enabling the +# following parameter causes Traefik to filter out tasks whose readiness checks +# have not succeeded. +# Note that the checks are only valid at deployment times. See the Marathon +# guide for details. +# +# Optional +# Default: false +# +# respectReadinessChecks = false +``` + +Labels can be used on containers to override default behaviour: + +| Label | Description | +|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `traefik.backend=foo` | assign the application to `foo` backend | +| `traefik.backend.maxconn.amount=10` | set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect. | +| `traefik.backend.maxconn.extractorfunc=client.ip` | set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. | +| `traefik.backend.loadbalancer.method=drr` | override the default `wrr` load balancer algorithm | +| `traefik.backend.loadbalancer.sticky=true` | enable backend sticky sessions | +| `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | create a [circuit breaker](/basics/#backends) to be used against the backend | +| `traefik.backend.healthcheck.path=/health` | set the Traefik health check path [default: no health checks] | +| `traefik.backend.healthcheck.interval=5s` | sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s] | +| `traefik.portIndex=1` | register port by index in the application's ports array. Useful when the application exposes multiple ports. | +| `traefik.port=80` | register the explicit application port value. Cannot be used alongside `traefik.portIndex`. | +| `traefik.protocol=https` | override the default `http` protocol | +| `traefik.weight=10` | assign this weight to the application | +| `traefik.enable=false` | disable this application in Træfik | +| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). | +| `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. | +| `traefik.frontend.priority=10` | override default frontend priority | +| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. | +| `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively | + +If several ports need to be exposed from a container, the services labels can be used: + +| Label | Description | +|-------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------| +| `traefik..port=443` | create a service binding with frontend/backend using this port. Overrides `traefik.port`. | +| `traefik..portIndex=1` | create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. | +| `traefik..protocol=https` | assign `https` protocol. Overrides `traefik.protocol`. | +| `traefik..weight=10` | assign this service weight. Overrides `traefik.weight`. | +| `traefik..frontend.backend=fooBackend` | assign this service frontend to `foobackend`. Default is to assign to the service backend. | +| `traefik..frontend.entryPoints=http` | assign this service entrypoints. Overrides `traefik.frontend.entrypoints`. | +| `traefik..frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets a Basic Auth for that frontend with the users test:test and test2:test2. | +| `traefik..frontend.passHostHeader=true` | Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`. | +| `traefik..frontend.priority=10` | assign the service frontend priority. Overrides `traefik.frontend.priority`. | +| `traefik..frontend.rule=Path:/foo` | assign the service frontend rule. Overrides `traefik.frontend.rule`. | diff --git a/docs/backends/mesos.md b/docs/configuration/backends/mesos.md similarity index 97% rename from docs/backends/mesos.md rename to docs/configuration/backends/mesos.md index 17aa1e7e1..86484b80d 100644 --- a/docs/backends/mesos.md +++ b/docs/configuration/backends/mesos.md @@ -1,17 +1,13 @@ -# Mesos generic backend +# Mesos Generic Backend Træfik can be configured to use Mesos as a backend configuration: - ```toml ################################################################ # Mesos configuration backend ################################################################ # Enable Mesos configuration backend -# -# Optional -# [mesos] # Mesos server endpoint. diff --git a/docs/configuration/backends/rancher.md b/docs/configuration/backends/rancher.md new file mode 100644 index 000000000..786000d95 --- /dev/null +++ b/docs/configuration/backends/rancher.md @@ -0,0 +1,122 @@ +# Rancher Backend + +Træfik can be configured to use Rancher as a backend configuration: + +```toml +################################################################ +# Rancher configuration backend +################################################################ + +# Enable Rancher configuration backend +[rancher] + +# Default domain used. +# Can be overridden by setting the "traefik.domain" label on an service. +# +# Required +# +domain = "rancher.localhost" + +# Enable watch Rancher changes +# +# Optional +# Default: true +# +Watch = true + +# Polling interval (in seconds) +# +# Optional +# +RefreshSeconds = 15 + +# Expose Rancher services by default in traefik +# +# Optional +# Default: true +# +ExposedByDefault = false + +# Filter services with unhealthy states and inactive states +# +# Optional +# Default: false +# +EnableServiceHealthFilter = true +``` + +## Rancher Metadata Service + +```toml +# Enable Rancher metadata service configuration backend instead of the API +# configuration backend +# +# Optional +# Default: false +# +[rancher.metadata] + +# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds` +# NOTE: this is less accurate than the default long polling technique which +# will provide near instantaneous updates to Traefik +# +# Optional +# Default: false +# +IntervalPoll = true + +# Prefix used for accessing the Rancher metadata service +# +# Optional +# Default: "/latest" +# +Prefix = "/2016-07-29" +``` + +## Rancher API + +```toml +# Enable Rancher API configuration backend +# +# Optional +# Default: true +# +[rancher.api] + +# Endpoint to use when connecting to the Rancher API +# +# Required +Endpoint = "http://rancherserver.example.com/v1" + +# AccessKey to use when connecting to the Rancher API +# +# Required +AccessKey = "XXXXXXXXXXXXXXXXXXXX" + +# SecretKey to use when connecting to the Rancher API +# +# Required +SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +``` + +## Notes + +If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters. + +To enable traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`. +This can be found within the API Key advanced options. + +## Labels + +Labels can be used on task containers to override default behaviour: + +| Label | Description | +|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------| +| `traefik.protocol=https` | override the default `http` protocol | +| `traefik.weight=10` | assign this weight to the container | +| `traefik.enable=false` | disable this container in Træfik | +| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). | +| `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. | +| `traefik.frontend.priority=10` | override default frontend priority | +| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. | +| `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively | diff --git a/docs/backends/api.md b/docs/configuration/backends/web.md similarity index 80% rename from docs/backends/api.md rename to docs/configuration/backends/web.md index c9f5001ec..5a7d1d3f0 100644 --- a/docs/backends/api.md +++ b/docs/configuration/backends/web.md @@ -1,66 +1,38 @@ -# API backend +# Web Backend -Træfik can be configured using a RESTful api. +Træfik can be configured: + +- using a RESTful api. +- to use a metric system (like Prometheus, DataDog or StatD, ...). +- to expose a Web Dashboard. ## Configuration -### CLI - -| Flag | Description | Default | -|------------------------------------|----------------------------------|---------------------| -| `--web` | Enable Web backend | `"true"` | -| `--web.address` | Web administration port | `":8080"` | -| `--web.certfile` | SSL certificate | | -| `--web.keyfile` | SSL key | | -| `--web.metrics` | Enable a metrics exporter | `"true"` | -| `--web.metrics.prometheus` | Prometheus metrics exporter type | `"true"` | -| `--web.metrics.prometheus.buckets` | Buckets for latency metrics | `"[0.1 0.3 1.2 5]"` | -| `--web.path` | Root path for dashboard and API | | -| `--web.readonly` | Enable read only API | `"false"` | -| `--web.statistics` | Enable more detailed statistics | `"false"` | -| `--web.statistics.recenterrors` | Number of recent errors logged | `"10"` | - -### traefik.toml: ```toml [web] + +# Web administration port +# +# Required +# address = ":8080" -# Set the root path for webui and API -# -# Optional -# -# path = "/mypath" -# # SSL certificate and key used # # Optional # # CertFile = "traefik.crt" # KeyFile = "traefik.key" -# + # Set REST API to read-only mode # # Optional # ReadOnly = false -# -# To enable more detailed statistics + +# Enable more detailed statistics # [web.statistics] # RecentErrors = 10 -# -# To enable Traefik to export internal metrics to Prometheus -# [web.metrics.prometheus] -# Buckets=[0.1,0.3,1.2,5.0] -# -# To enable Traefik to export internal metics to DataDog -# [web.metrics.datadog] -# Address = localhost:8125 -# PushInterval = "10s" -# -# To enable Traefik to export internal metics to StatsD -# [web.metrics.statsd] -# Address = localhost:8125 -# PushInterval = "10s" -# + # To enable basic auth on the webui # with 2 user/pass: test:test and test2:test2 # Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones @@ -78,10 +50,31 @@ address = ":8080" ``` ## Web UI + ![Web UI Providers](/img/web.frontend.png) ![Web UI Health](/img/traefik-health.png) +## Metrics + +You can enable Traefik to export internal metrics to different monitoring systems. + +```toml +# To enable Traefik to export internal metrics to Prometheus +# [web.metrics.prometheus] +# Buckets=[0.1,0.3,1.2,5.0] + +# DataDog metrics exporter type +# [web.metrics.datadog] +# Address = "localhost:8125" +# Pushinterval = "10s" + +# StatsD metrics exporter type +# [web.metrics.statsd] +# Address = "localhost:8125" +# Pushinterval = "10s" +``` + ## API | Path | Method | Description | @@ -102,16 +95,14 @@ address = ":8080" | `/api/providers/{provider}/frontends/{frontend}/routes/{route}` | `GET` | Get a route in a frontend | | `/metrics` | `GET` | Export internal metrics | -> You can enable Traefik to export internal metrics to different monitoring systems (Only Prometheus is supported at the moment). - ->```bash ->$ traefik --web.metrics.prometheus --web.metrics.prometheus.buckets="0.1,0.3,1.2,5.0" ->``` - ### Example + #### Ping + ```shell $ curl -sv "http://localhost:8080/ping" +``` +```shell * Trying ::1... * Connected to localhost (::1) port 8080 (#0) > GET /ping HTTP/1.1 @@ -129,8 +120,11 @@ OK ``` #### Health + ```shell $ curl -s "http://localhost:8080/health" | jq . +``` +```json { // Træfik PID "pid": 2458, @@ -187,8 +181,11 @@ $ curl -s "http://localhost:8080/health" | jq . ``` #### Provider configurations + ```shell $ curl -s "http://localhost:8080/api" | jq . +``` +```json { "file": { "frontends": { diff --git a/docs/backends/zookeeper.md b/docs/configuration/backends/zookeeper.md similarity index 95% rename from docs/backends/zookeeper.md rename to docs/configuration/backends/zookeeper.md index 51a6a698c..c35e3e37e 100644 --- a/docs/backends/zookeeper.md +++ b/docs/configuration/backends/zookeeper.md @@ -1,4 +1,4 @@ -# Zookeeper backend +# Zookeeper Backend Træfik can be configured to use Zookeeper as a backend configuration: @@ -8,9 +8,6 @@ Træfik can be configured to use Zookeeper as a backend configuration: ################################################################ # Enable Zookeeperconfiguration backend -# -# Optional -# [zookeeper] # Zookeeper server endpoint diff --git a/docs/configuration/toml.md b/docs/configuration/commons.md similarity index 73% rename from docs/configuration/toml.md rename to docs/configuration/commons.md index af11da7ff..bacc24e40 100644 --- a/docs/configuration/toml.md +++ b/docs/configuration/commons.md @@ -1,10 +1,8 @@ +# Global Configuration -# Global configuration - -## Main section +## Main Section ```toml -# traefik.toml ################################################################ # Global configuration ################################################################ @@ -42,7 +40,7 @@ # Access logs file # -# Deprecated - see [accessLog] lower down +# DEPRECATED - see [accessLog] lower down # Optional # # accessLogsFile = "log/access.log" @@ -70,7 +68,7 @@ # IdleTimeout # -# Deprecated - see [respondingTimeouts] section. In the case both settings are configured, the deprecated option will +# DEPRECATED - see [respondingTimeouts] section. In the case both settings are configured, the deprecated option will # be overwritten. # # IdleTimeout is the maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. @@ -145,28 +143,29 @@ Supported filters: # # Simple matching constraint # constraints = ["tag==api"] -# + # Simple mismatching constraint # constraints = ["tag!=api"] -# + # Globbing # constraints = ["tag==us-*"] -# -# Backend-specific constraint -# [consulCatalog] -# endpoint = 127.0.0.1:8500 -# constraints = ["tag==api"] -# + # Multiple constraints # - "tag==" must match with at least one tag # - "tag!=" must match with none of tags # constraints = ["tag!=us-*", "tag!=asia-*"] + +# Backend-specific constraint +# [consulCatalog] +# endpoint = 127.0.0.1:8500 +# constraints = ["tag==api"] + # [consulCatalog] # endpoint = 127.0.0.1:8500 # constraints = ["tag==api", "tag!=v*-beta"] ``` -## Access log definition +## Access Log Definition Access logs are written when `[accessLog]` is defined. By default it will write to stdout and produce logs in the textual Common Log Format (CLF), extended with additional fields. @@ -189,41 +188,57 @@ To write JSON format logs, specify `json` as the format: format = "json" ``` -## Entrypoints definition +## Entry Points Definition ```toml # Entrypoints definition # -# Optional # Default: # [entryPoints] # [entryPoints.http] # address = ":80" # +[entryPoints] + [entryPoints.http] + address = ":80" +``` + +### Redirect HTTP to HTTPS + +```toml # To redirect an http entrypoint to an https entrypoint (with SNI support): -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# [entryPoints.http.redirect] -# entryPoint = "https" -# [entryPoints.https] -# address = ":443" -# [entryPoints.https.tls] -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.com.cert" -# KeyFile = "integration/fixtures/https/snitest.com.key" -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.org.cert" -# KeyFile = "integration/fixtures/https/snitest.org.key" # +[entryPoints] + [entryPoints.http] + address = ":80" + [entryPoints.http.redirect] + entryPoint = "https" + [entryPoints.https] + address = ":443" + [entryPoints.https.tls] + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.com.cert" + KeyFile = "integration/fixtures/https/snitest.com.key" + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.org.cert" + KeyFile = "integration/fixtures/https/snitest.org.key" +``` + +### Rewriting URL + +```toml # To redirect an entrypoint rewriting the URL: -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# [entryPoints.http.redirect] -# regex = "^http://localhost/(.*)" -# replacement = "http://mydomain/$1" -# +[entryPoints] + [entryPoints.http] + address = ":80" + [entryPoints.http.redirect] + regex = "^http://localhost/(.*)" + replacement = "http://mydomain/$1" +``` + +### TLS Mutual Authentication + +```toml # Only accept clients that present a certificate signed by a specified # Certificate Authority (CA) # ClientCAFiles can be configured with multiple CA:s in the same file or @@ -232,78 +247,101 @@ To write JSON format logs, specify `json` as the format: # The requirement will apply to all server certs in the entrypoint # In the example below both snitest.com and snitest.org will require client certs # -# [entryPoints] -# [entryPoints.https] -# address = ":443" -# [entryPoints.https.tls] -# ClientCAFiles = ["tests/clientca1.crt", "tests/clientca2.crt"] -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.com.cert" -# KeyFile = "integration/fixtures/https/snitest.com.key" -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.org.cert" -# KeyFile = "integration/fixtures/https/snitest.org.key" -# +[entryPoints] + [entryPoints.https] + address = ":443" + [entryPoints.https.tls] + ClientCAFiles = ["tests/clientca1.crt", "tests/clientca2.crt"] + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.com.cert" + KeyFile = "integration/fixtures/https/snitest.com.key" + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.org.cert" + KeyFile = "integration/fixtures/https/snitest.org.key" +``` + +### Basic & Digest Authentication + +```toml # To enable basic auth on an entrypoint +# # with 2 user/pass: test:test and test2:test2 -# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones -# Users can be specified directly in the toml file, or indirectly by referencing an external file; if both are provided, the two are merged, with external file contents having precedence -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# [entryPoints.http.auth.basic] -# users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"] -# usersFile = "/path/to/.htpasswd" -# -# To enable digest auth on an entrypoint -# with 2 user/realm/pass: test:traefik:test and test2:traefik:test2 -# You can use htdigest to generate those ones -# Users can be specified directly in the toml file, or indirectly by referencing an external file; if both are provided, the two are merged, with external file contents having precedence -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# [entryPoints.http.auth.basic] -# users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"] -# usersFile = "/path/to/.htdigest" -# -# To specify an https entrypoint with a minimum TLS version, and specifying an array of cipher suites (from crypto/tls): -# [entryPoints] -# [entryPoints.https] -# address = ":443" -# [entryPoints.https.tls] -# MinVersion = "VersionTLS12" -# CipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"] -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.com.cert" -# KeyFile = "integration/fixtures/https/snitest.com.key" -# [[entryPoints.https.tls.certificates]] -# CertFile = "integration/fixtures/https/snitest.org.cert" -# KeyFile = "integration/fixtures/https/snitest.org.key" - -# To enable compression support using gzip format: -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# compress = true - -# To enable IP whitelisting at the entrypoint level: -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# whiteListSourceRange = ["127.0.0.1/32"] - -# To enable ProxyProtocol support (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt): -# [entryPoints] -# [entryPoints.http] -# address = ":80" -# proxyprotocol = true - +# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones. +# Users can be specified directly in the toml file, or indirectly by referencing an external file; +# if both are provided, the two are merged, with external file contents having precedence. [entryPoints] [entryPoints.http] address = ":80" + [entryPoints.http.auth.basic] + users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"] + usersFile = "/path/to/.htpasswd" ``` -## Retry configuration +```toml +# To enable digest auth on an entrypoint +# +# with 2 user/realm/pass: test:traefik:test and test2:traefik:test2 +# You can use htdigest to generate those ones +# Users can be specified directly in the toml file, or indirectly by referencing an external file; +# if both are provided, the two are merged, with external file contents having precedence +[entryPoints] + [entryPoints.http] + address = ":80" + [entryPoints.http.auth.basic] + users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"] + usersFile = "/path/to/.htdigest" +``` + +### Specify Minimum TLS Version + +```toml +# To specify an https entrypoint with a minimum TLS version, +# and specifying an array of cipher suites (from crypto/tls): +[entryPoints] + [entryPoints.https] + address = ":443" + [entryPoints.https.tls] + MinVersion = "VersionTLS12" + CipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"] + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.com.cert" + KeyFile = "integration/fixtures/https/snitest.com.key" + [[entryPoints.https.tls.certificates]] + CertFile = "integration/fixtures/https/snitest.org.cert" + KeyFile = "integration/fixtures/https/snitest.org.key" +``` + +### Compression + +```toml +# To enable compression support using gzip format: +[entryPoints] + [entryPoints.http] + address = ":80" + compress = true +``` + +### Whitelisting + +```toml +# To enable IP whitelisting at the entrypoint level: +[entryPoints] + [entryPoints.http] + address = ":80" + whiteListSourceRange = ["127.0.0.1/32"] +``` + +### ProxyProtocol Support + +```toml +# To enable ProxyProtocol support (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt): +[entryPoints] + [entryPoints.http] + address = ":80" + proxyprotocol = true +``` + +## Retry Configuration ```toml # Enable retry sending request if network error @@ -320,7 +358,8 @@ To write JSON format logs, specify `json` as the format: # attempts = 3 ``` -## Health check configuration +## Health Check Configuration + ```toml # Enable custom health check options. # @@ -341,8 +380,9 @@ To write JSON format logs, specify `json` as the format: # interval = "30s" ``` -## Responding timeouts -``` +## Responding Timeouts + +```toml # respondingTimeouts are timeouts for incoming requests to the Traefik instance. # # Optional @@ -382,8 +422,9 @@ To write JSON format logs, specify `json` as the format: ``` -## Forwarding timeouts -``` +## Forwarding Timeouts + +```toml # forwardingTimeouts are timeouts for requests forwarded to the backend servers. # # Optional diff --git a/docs/img/traefik-health.png b/docs/img/traefik-health.png index bfcf2799f..608174ac7 100644 Binary files a/docs/img/traefik-health.png and b/docs/img/traefik-health.png differ diff --git a/docs/index.md b/docs/index.md index 2d61e8926..fc52c7b4b 100644 --- a/docs/index.md +++ b/docs/index.md @@ -2,7 +2,7 @@ Træfik

-[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/add-ldez-maintainers/shields_badge.svg)](https://semaphoreci.com/containous/traefik) +[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik) [![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io) [![Go Report Card](https://goreportcard.com/badge/kubernetes/helm)](http://goreportcard.com/report/containous/traefik) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md) diff --git a/docs/user-guide/cluster.md b/docs/user-guide/cluster.md index 99769cb63..6d21a6b0a 100644 --- a/docs/user-guide/cluster.md +++ b/docs/user-guide/cluster.md @@ -16,5 +16,6 @@ Please refer to [this section](/user-guide/kv-config/#store-configuration-in-key Once your Træfik configuration is uploaded on your KV store, you can start each Træfik instance. A Træfik cluster is based on a manager/worker model. -When starting, Træfik will elect a manager. If this instance fails, another manager will be automatically elected. +When starting, Træfik will elect a manager. +If this instance fails, another manager will be automatically elected. diff --git a/docs/user-guide/examples.md b/docs/user-guide/examples.md index 8089a8ec4..f07cdbc12 100644 --- a/docs/user-guide/examples.md +++ b/docs/user-guide/examples.md @@ -1,4 +1,3 @@ - # Examples You will find here some configuration examples of Træfik. diff --git a/docs/user-guide/getting-started-with-docker-and-lets-encrypt.md b/docs/user-guide/getting-started-with-docker-and-lets-encrypt.md index 5bf7893bd..ca57997fe 100644 --- a/docs/user-guide/getting-started-with-docker-and-lets-encrypt.md +++ b/docs/user-guide/getting-started-with-docker-and-lets-encrypt.md @@ -1,11 +1,20 @@ # Docker & Traefik -In this use case, we want to use Traefik as a *layer-7* load balancer with SSL termination for a set of microservices used to run a webapplication. We also want to automatically *discover any services* on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly. In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname. -## Setting up -In order for this to work, you'll need a server with a public IP address, with Docker installed on it. In this example, we're using the fictitious domain *my-awesome-app.org*. In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address. +In this use case, we want to use Traefik as a _layer-7_ load balancer with SSL termination for a set of micro-services used to run a web application. +We also want to automatically _discover any services_ on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly. +In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname. + +## Setting Up + +In order for this to work, you'll need a server with a public IP address, with Docker installed on it. +In this example, we're using the fictitious domain _my-awesome-app.org_. +In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address. ## Networking -Docker containers can only communicate with each other over TCP when they share at least one network. This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers *unless you'd want to*. In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in. + +Docker containers can only communicate with each other over TCP when they share at least one network. +This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers _unless you'd want to_. +In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in. On the Docker host, run the following command: @@ -23,7 +32,8 @@ $ touch /opt/traefik/acme.json && chmod 600 /opt/traefik/acme.json $ touch /opt/traefik/traefik.toml ``` -The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik. The contents of the file is as follows: +The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik. +The contents of the file is as follows: ```yaml version: '2' @@ -48,8 +58,11 @@ networks: external: true ``` -As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container. Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down). -Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted). We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on. Finally, we're giving this container a static name called `traefik`. +As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container. +Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down). +Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted). +We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on. +Finally, we're giving this container a static name called `traefik`. Let's take a look at a simply `traefik.toml` configuration as well before we'll create the Traefik container: @@ -87,16 +100,17 @@ This is the minimum configuration required to do the following: - Log `ERROR`-level messages (or more severe) to the console, but silence `DEBUG`-level messagse - Check for new versions of Traefik periodically -- Create two entrypoints, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`. +- Create two entry points, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`. - Enable the Docker configuration backend and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Traefik by default, we'll get into this in a bit!** - Enable automatic request and configuration of SSL certificates using Let's Encrypt. These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises. Alright, let's boot the container. From the `/opt/traefik` directory, run `$ docker-compose up -d` which will create and start the Traefik container. -## Exposing your webservices to the outside world +## Exposing Web Services to the Outside World + Now that we've fully configured and started Traefik, it's time to get our applications running! -Let's take a simple example of a microservice project consisting of various services, where some will be exposed to the outside world and some will not. The `docker-compose.yml` of our project looks like this: +Let's take a simple example of a micro-service project consisting of various services, where some will be exposed to the outside world and some will not. The `docker-compose.yml` of our project looks like this: ```yaml version: "2.1" @@ -155,10 +169,17 @@ networks: external: true ``` -Here, we can see a set of services with two applications that we're actually exposing to the outside world. Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks. Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document. Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers. +Here, we can see a set of services with two applications that we're actually exposing to the outside world. +Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks. +Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document. +Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers. ### Labels -As mentioned earlier, we don't want containers exposed automatically by Traefik. The reason behind this is simple: we want to have control over this process ourselves. Thanks to Docker labels, we can tell Traefik how to create it's internal routing configuration. Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000: + +As mentioned earlier, we don't want containers exposed automatically by Traefik. +The reason behind this is simple: we want to have control over this process ourselves. +Thanks to Docker labels, we can tell Traefik how to create it's internal routing configuration. +Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000: ```yaml - "traefik.backend=my-awesome-app-app" @@ -168,14 +189,25 @@ As mentioned earlier, we don't want containers exposed automatically by Traefik. - "traefik.port=9000" ``` -First, we specify the `backend` name which corresponds to the actual service we're routing **to**. We also tell Traefik to use the `web` network to route HTTP traffic to this container. With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`. Essentially, this is the actual rule used for Layer-7 load balancing. With the `traefik.enable` label, we tell Traefik to include this container in it's internal configuration. Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on. +First, we specify the `backend` name which corresponds to the actual service we're routing **to**. +We also tell Traefik to use the `web` network to route HTTP traffic to this container. With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`. +Essentially, this is the actual rule used for Layer-7 load balancing. +With the `traefik.enable` label, we tell Traefik to include this container in it's internal configuration. +Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on. #### Gotchas and tips -- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label. If a container exposes multiple ports, Traefik may forward traffic to the wrong port. Even if a container only exposes one port, you should always write configuration defensively and explicitly. -- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see. Usually, this is a bad idea. + +- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label. + If a container exposes multiple ports, Traefik may forward traffic to the wrong port. + Even if a container only exposes one port, you should always write configuration defensively and explicitly. +- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see. + Usually, this is a bad idea. - With the `traefik.frontend.auth.basic` label, it's possible for Traefik to provide a HTTP basic-auth challenge for the endpoints you provide the label for. - Traefik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics -- Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol. Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS) +- Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol. + Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS) ### Final thoughts -Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, performant and self-configuring solution for your projects. With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well. + +Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, performant and self-configuring solution for your projects. +With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well. diff --git a/docs/user-guide/kubernetes.md b/docs/user-guide/kubernetes.md index 523e94f1c..44f73efcd 100644 --- a/docs/user-guide/kubernetes.md +++ b/docs/user-guide/kubernetes.md @@ -14,11 +14,9 @@ on your machine, as it is the quickest way to get a local Kubernetes cluster set ### Role Based Access Control configuration (Kubernetes 1.6+ only) -Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control -of Kubernetes resources and api. +Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control of Kubernetes resources and api. -If your cluster is configured with RBAC, you may need to authorize Træfik to use the -Kubernetes API using ClusterRole and ClusterRoleBinding resources: +If your cluster is configured with RBAC, you may need to authorize Træfik to use the Kubernetes API using ClusterRole and ClusterRoleBinding resources: _Note: your cluster may have suitable ClusterRoles already setup, but the following should work everywhere_ @@ -71,20 +69,15 @@ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/exa ## Deploy Træfik using a Deployment or DaemonSet -It is possible to use Træfik with a -[Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) -or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) -object, whereas both options have their own pros and cons: The scalability is much better when -using a Deployment, because you will have a Single-Pod-per-Node model when using -the DeaemonSet. It is possible to exclusively run a Service on a dedicated -set of machines using taints and tolerations with a DaemonSet. On the other hand the -DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a -[Service](https://kubernetes.io/docs/concepts/services-networking/service/) object -with a Deployment. +It is possible to use Træfik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object, + whereas both options have their own pros and cons: + The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DeaemonSet. +It is possible to exclusively run a Service on a dedicated set of machines using taints and tolerations with a DaemonSet. +On the other hand the DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with a Deployment. The Deployment objects looks like this: -```yaml +```yml --- apiVersion: v1 kind: ServiceAccount @@ -207,10 +200,11 @@ $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/e $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml ``` -There are some significant differences between using Deployments and DaemonSets. The Deployment has easier -up and down scaling possibilities. It can implement full pod lifecycle and supports rolling updates from -Kubernetes 1.2. At least one Pod is needed to run the Deployment. The DaemonSet automatically scales to all nodes that -meets a specific selector and guarantees to fill nodes one at a time. Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well. +There are some significant differences between using Deployments and DaemonSets. +The Deployment has easier up and down scaling possibilities. It can implement full pod lifecycle and supports rolling updates from Kubernetes 1.2. +At least one Pod is needed to run the Deployment. +The DaemonSet automatically scales to all nodes that meets a specific selector and guarantees to fill nodes one at a time. +Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well. @@ -229,24 +223,21 @@ kubernetes-dashboard-s8krj 1/1 Running 0 4h traefik-ingress-controller-678226159-eqseo 1/1 Running 0 7m ``` -You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched -a Pod, and it is now running. _It might take a few moments for kubernetes to pull -the Træfik image and start the container._ +You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched a Pod, and it is now running. +_It might take a few moments for kubernetes to pull the Træfik image and start the container._ > You could also check the deployment with the Kubernetes dashboard, run > `minikube dashboard` to open it in your browser, then choose the `kube-system` > namespace from the menu at the top right of the screen. -You should now be able to access Træfik on port 80 of your Minikube instance when using -the DaemonSet: +You should now be able to access Træfik on port 80 of your Minikube instance when using the DaemonSet: ```sh curl $(minikube ip) 404 page not found ``` -If you decided to use the deployment, then you need to target the correct NodePort, which can -be seen then you execute `kubectl get services --namespace=kube-system`. +If you decided to use the deployment, then you need to target the correct NodePort, which can be seen then you execute `kubectl get services --namespace=kube-system`. ```sh curl $(minikube ip): @@ -257,10 +248,8 @@ curl $(minikube ip): ## Deploy Træfik using Helm Chart -Instead of installing Træfik via an own object, you can also use the Træfik Helm chart. This -allows more complex configuration via Kubernetes -[ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/) and enabled -TLS certificates. +Instead of installing Træfik via an own object, you can also use the Træfik Helm chart. +This allows more complex configuration via Kubernetes [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/) and enabled TLS certificates. Install Træfik chart by: @@ -272,8 +261,7 @@ For more information, check out [the doc](https://github.com/kubernetes/charts/t ## Submitting An Ingress to the cluster. -Lets start by creating a Service and an Ingress that will expose the -[Træfik Web UI](https://github.com/containous/traefik#web-ui). +Lets start by creating a Service and an Ingress that will expose the [Træfik Web UI](https://github.com/containous/traefik#web-ui). ```yaml apiVersion: v1 @@ -310,8 +298,7 @@ spec: kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/ui.yaml ``` -Now lets setup an entry in our /etc/hosts file to route `traefik-ui.minikube` -to our cluster. +Now lets setup an entry in our /etc/hosts file to route `traefik-ui.minikube` to our cluster. > In production you would want to set up real dns entries. @@ -325,8 +312,7 @@ We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) ## Name based routing -In this example we are going to setup websites for 3 of the United Kingdoms -best loved cheeses, Cheddar, Stilton and Wensleydale. +In this example we are going to setup websites for 3 of the United Kingdoms best loved cheeses, Cheddar, Stilton and Wensleydale. First lets start by launching the 3 pods for the cheese websites. @@ -534,12 +520,9 @@ spec: kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml ``` -Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should -see a frontend for each host. Along with a backend listing for each service -with a Server set up for each pod. +Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host. Along with a backend listing for each service with a Server set up for each pod. -If you edit your `/etc/hosts` again you should be able to access the cheese -websites in your browser. +If you edit your `/etc/hosts` again you should be able to access the cheese websites in your browser. ```shell echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | sudo tee -a /etc/hosts @@ -551,9 +534,7 @@ echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | s ## Path based routing -Now lets suppose that our fictional client has decided that while they are -super happy about our cheesy web design, when they asked for 3 websites -they had not really bargained on having to buy 3 domain names. +Now lets suppose that our fictional client has decided that while they are super happy about our cheesy web design, when they asked for 3 websites they had not really bargained on having to buy 3 domain names. No problem, we say, why don't we reconfigure the sites to host all 3 under one domain. @@ -646,7 +627,8 @@ spec: ## Forwarding to ExternalNames When specifying an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors), -Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443. This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port. +Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443. +This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port. ## Disable passing the Host header @@ -663,8 +645,7 @@ disablePassHostHeaders = true ### Disable per ingress -To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` -annotation on your ingress to `false`. +To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` annotation on your ingress to `false`. Here is an example ingress definition: ```yaml @@ -700,9 +681,7 @@ spec: externalName: static.otherdomain.com ``` -If you were to visit example.com/static the request would then be passed onto -static.otherdomain.com/static and static.otherdomain.com would receive the -request with the Host header being static.otherdomain.com. +If you were to visit `example.com/static` the request would then be passed onto `static.otherdomain.com/static` and s`tatic.otherdomain.com` would receive the request with the Host header being `static.otherdomain.com`. Note: The per ingress annotation overides whatever the global value is set to. So you could set `disablePassHostHeaders` to `true` in your toml file and then enable passing diff --git a/docs/user-guide/kv-config.md b/docs/user-guide/kv-config.md index b62578523..1ba3cc949 100644 --- a/docs/user-guide/kv-config.md +++ b/docs/user-guide/kv-config.md @@ -1,4 +1,3 @@ - # Key-value store configuration Both [static global configuration](/user-guide/kv-config/#static-configuration-in-key-value-store) and [dynamic](/user-guide/kv-config/#dynamic-configuration-in-key-value-store) configuration can be sorted in a Key-value store. @@ -12,7 +11,7 @@ Træfik supports several Key-value stores: - [ZooKeeper](https://zookeeper.apache.org/) - [boltdb](https://github.com/boltdb/bolt) -# Static configuration in Key-value store +## Static configuration in Key-value store We will see the steps to set it up with an easy example. Note that we could do the same with any other Key-value Store. diff --git a/docs/user-guide/marathon.md b/docs/user-guide/marathon.md index 2a10922c5..834b0d2aa 100644 --- a/docs/user-guide/marathon.md +++ b/docs/user-guide/marathon.md @@ -1,4 +1,3 @@ - # Marathon This guide explains how to integrate Marathon and operate the cluster in a reliable way from Traefik's standpoint. diff --git a/docs/user-guide/swarm-mode.md b/docs/user-guide/swarm-mode.md index 6c0b9c412..c8e0d80be 100644 --- a/docs/user-guide/swarm-mode.md +++ b/docs/user-guide/swarm-mode.md @@ -73,11 +73,9 @@ docker-machine ssh manager "docker network create --driver=overlay traefik-net" ## Deploy Træfik -Let's deploy Træfik as a docker service in our cluster. The only -requirement for Træfik to work with swarm mode is that it needs to run -on a manager node — we are going to use a -[constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for -that. +Let's deploy Træfik as a docker service in our cluster. +The only requirement for Træfik to work with swarm mode is that it needs to run on a manager node — we are going to use a +[constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for that. ```shell docker-machine ssh manager "docker service create \ @@ -96,24 +94,17 @@ docker-machine ssh manager "docker service create \ Let's explain this command: -- `--publish 80:80 --publish 8080:8080`: we publish port `80` and - `8080` on the cluster. -- `--constraint=node.role==manager`: we ask docker to schedule Træfik - on a manager node. +- `--publish 80:80 --publish 8080:8080`: we publish port `80` and `8080` on the cluster. +- `--constraint=node.role==manager`: we ask docker to schedule Træfik on a manager node. - `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock`: - we bind mount the docker socket where Træfik is scheduled to be able - to speak to the daemon. -- `--network traefik-net`: we attach the Træfik service (and thus - the underlying container) to the `traefik-net` network. -- `--docker`: enable docker backend, and `--docker.swarmmode` to - enable the swarm mode on Træfik. + we bind mount the docker socket where Træfik is scheduled to be able to speak to the daemon. +- `--network traefik-net`: we attach the Træfik service (and thus the underlying container) to the `traefik-net` network. +- `--docker`: enable docker backend, and `--docker.swarmmode` to enable the swarm mode on Træfik. - `--web`: activate the webUI on port 8080 ## Deploy your apps -We can now deploy our app on the cluster, -here [whoami](https://github.com/emilevauge/whoami), a simple web -server in Go. We start 2 services, on the `traefik-net` network. +We can now deploy our app on the cluster, here [whoami](https://github.com/emilevauge/whoami), a simple web server in Go. We start 2 services, on the `traefik-net` network. ```shell docker-machine ssh manager "docker service create \ @@ -184,8 +175,7 @@ X-Forwarded-Proto: http X-Forwarded-Server: 8fbc39271b4c ``` -Note that as Træfik is published, you can access it from any machine -and not only the manager. +Note that as Træfik is published, you can access it from any machine and not only the manager. ```shell curl -H Host:whoami0.traefik http://$(docker-machine ip worker1) @@ -245,7 +235,8 @@ dtpl249tfghc traefik 1/1 traefik --docker --docker.swarmmode ``` ## Access to your whoami0 through Træfik multiple times. -Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks. +Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks: + ```shell curl -H Host:whoami0.traefik http://$(docker-machine ip manager) Hostname: 8147a7746e7a @@ -266,7 +257,8 @@ X-Forwarded-Proto: http X-Forwarded-Server: 8fbc39271b4c ``` -Do the same against whoami1. +Do the same against whoami1: + ```shell curl -H Host:whoami1.traefik http://$(docker-machine ip manager) Hostname: ba2c21488299 @@ -289,6 +281,7 @@ X-Forwarded-Server: 8fbc39271b4c Wait, I thought we added the sticky flag to whoami1? Traefik relies on a cookie to maintain stickyness so you'll need to test this with a browser. First you need to add whoami1.traefik to your hosts file: + ```ssh if [ -n "$(grep whoami1.traefik /etc/hosts)" ]; then diff --git a/mkdocs.yml b/mkdocs.yml index 766ec38a0..484556291 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -45,30 +45,29 @@ extra_css: pages: - Getting Started: index.md - Basics: basics.md - - Configration: - - 'traefik.toml': 'configuration/toml.md' + - Configuration: + - 'Commons': 'configuration/commons.md' - 'Let''s Encrypt': 'configuration/acme.md' - - Backends: - - 'API backend': 'backends/api.md' - - 'BoltDB backend': 'backends/boltdb.md' - - 'Consul backend': 'backends/consul.md' - - 'Docker backend': 'backends/docker.md' - - 'DynamoDB backend': 'backends/dynamodb.md' - - 'ECS backend': 'backends/ecs.md' - - 'Etcd backend': 'backends/etcd.md' - - 'Eureka backend': 'backends/eureka.md' - - 'File backend': 'backends/file.md' - - 'Kubernetes Ingress backend': 'backends/kubernetes.md' - - 'Marathon backend': 'backends/marathon.md' - - 'Rancher backend': 'backends/rancher.md' - - 'Zookeeper backend': 'backends/zookeeper.md' + - 'Web Backend': 'configuration/backends/web.md' + - 'BoltDB Backend': 'configuration/backends/boltdb.md' + - 'Consul Backend': 'configuration/backends/consul.md' + - 'Docker Backend': 'configuration/backends/docker.md' + - 'DynamoDB Backend': 'configuration/backends/dynamodb.md' + - 'ECS Backend': 'configuration/backends/ecs.md' + - 'Etcd Backend': 'configuration/backends/etcd.md' + - 'Eureka Backend': 'configuration/backends/eureka.md' + - 'File Backend': 'configuration/backends/file.md' + - 'Kubernetes Ingress Backend': 'configuration/backends/kubernetes.md' + - 'Marathon Backend': 'configuration/backends/marathon.md' + - 'Rancher Backend': 'configuration/backends/rancher.md' + - 'Zookeeper Backend': 'configuration/backends/zookeeper.md' - User Guide: - - 'Configuration examples': 'user-guide/examples.md' - - 'Swarm cluster': 'user-guide/swarm.md' - - 'Swarm mode cluster': 'user-guide/swarm-mode.md' - - 'Kubernetes': 'user-guide/kubernetes.md' - - 'Marathon': 'user-guide/marathon.md' - - 'Key-value store configuration': 'user-guide/kv-config.md' - - 'Clustering/HA': 'user-guide/cluster.md' - - 'Getting started with Docker & Lets Encrypt': 'user-guide/getting-started-with-docker-and-lets-encrypt.md' + - 'Configuration Examples': 'user-guide/examples.md' + - 'Swarm Cluster': 'user-guide/swarm.md' + - 'Swarm Mode Cluster': 'user-guide/swarm-mode.md' + - 'Kubernetes': 'user-guide/kubernetes.md' + - 'Marathon': 'user-guide/marathon.md' + - 'Key-value Store Configuration': 'user-guide/kv-config.md' + - 'Clustering/HA': 'user-guide/cluster.md' + - 'Getting Started with Docker & Lets Encrypt': 'user-guide/getting-started-with-docker-and-lets-encrypt.md' - Benchmarks: benchmarks.md diff --git a/provider/consul/consul_catalog.go b/provider/consul/consul_catalog.go index e221c8e1a..b058ee7e5 100644 --- a/provider/consul/consul_catalog.go +++ b/provider/consul/consul_catalog.go @@ -359,7 +359,7 @@ func (p *CatalogProvider) getConstraintTags(tags []string) []string { var list []string for _, tag := range tags { - // If 'AllTagsConstraintFiltering' is disabled, we look for a Consul tag named 'traefik.tags' (unless different 'prefix' is configured) + // We look for a Consul tag named 'traefik.tags' (unless different 'prefix' is configured) if strings.Index(strings.ToLower(tag), p.getPrefixedName("tags=")) == 0 { // If 'traefik.tags=' tag is found, take the tag value and split by ',' adding the result to the list to be returned splitedTags := strings.Split(tag[len(p.getPrefixedName("tags=")):], ",") diff --git a/provider/kubernetes/client.go b/provider/kubernetes/client.go index 45be10f20..d2f55fe14 100644 --- a/provider/kubernetes/client.go +++ b/provider/kubernetes/client.go @@ -22,7 +22,7 @@ import ( const resyncPeriod = time.Minute * 5 // Client is a client for the Provider master. -// WatchAll starts the watch of the Provider ressources and updates the stores. +// WatchAll starts the watch of the Provider resources and updates the stores. // The stores can then be accessed via the Get* functions. type Client interface { GetIngresses(namespaces Namespaces) []*v1beta1.Ingress diff --git a/traefik.sample.toml b/traefik.sample.toml index a30417562..5910be48d 100644 --- a/traefik.sample.toml +++ b/traefik.sample.toml @@ -36,7 +36,7 @@ # Access logs file # # Optional -# Deprecated - see [accessLog] lower down +# DEPRECATED - see [accessLog] lower down # # accessLogsFile = "log/access.log" @@ -433,6 +433,7 @@ # # responseHeaderTimeout = "0s" + ################################################################ # Web configuration backend ################################################################ @@ -455,21 +456,31 @@ # # CertFile = "traefik.crt" # KeyFile = "traefik.key" -# + # Set REST API to read-only mode # # Optional # ReadOnly = false -# + # Enable more detailed statistics # [web.statistics] # RecentErrors = 10 -# + # To enable Traefik to export internal metrics to Prometheus # [web.metrics.prometheus] # Buckets=[0.1,0.3,1.2,5.0] # +# DataDog metrics exporter type +# [web.metrics.datadog] +# Address = "localhost:8125" +# Pushinterval = "10s" + +# StatsD metrics exporter type +# [web.metrics.statsd] +# Address = "localhost:8125" +# Pushinterval = "10s" + # To enable basic auth on the webui # with 2 user/pass: test:test and test2:test2 # Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones @@ -511,7 +522,6 @@ # # directory = "/path/to/config/" - # Enable watch file changes # # Optional @@ -572,7 +582,6 @@ # insecureskipverify = true - ################################################################ # Docker Swarmmode configuration backend ################################################################ @@ -693,16 +702,12 @@ # # groupsAsSubDomains = true -# Override DialerTimeout -# Amount of time to allow the Marathon provider to wait to open a TCP connection -# to a Marathon master. -# Can be provided in a format supported by Go's time.ParseDuration function or -# as raw values (digits). If no units are provided, the value is parsed assuming -# seconds. +# Enable compatibility with marathon-lb labels # # Optional -# Default: "60s" -# dialerTimeout = "60s" +# Default: false +# +# marathonLBCompatibility = true # Enable Marathon basic authentication # @@ -712,16 +717,36 @@ # httpBasicAuthUser = "foo" # httpBasicPassword = "bar" +# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config +# +# Optional +# +# [marathon.TLS] +# CA = "/etc/ssl/ca.crt" +# Cert = "/etc/ssl/marathon.cert" +# Key = "/etc/ssl/marathon.key" +# InsecureSkipVerify = true + # DCOSToken for DCOS environment, This will override the Authorization header # # Optional # # dcosToken = "xxxxxx" +# Override DialerTimeout +# Amount of time to allow the Marathon provider to wait to open a TCP connection +# to a Marathon master. +# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw +# values (digits). If no units are provided, the value is parsed assuming +# seconds. +# +# Optional +# Default: "60s" +# dialerTimeout = "60s" # Set the TCP Keep Alive interval for the Marathon HTTP Client. -# Can be provided in a format supported by Go's time.ParseDuration function or -# as raw values (digits). If no units are provided, the value is parsed assuming +# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw +# values (digits). If no units are provided, the value is parsed assuming # seconds. # # Optional @@ -751,6 +776,7 @@ # # respectReadinessChecks = false + ################################################################ # Mesos configuration backend ################################################################ @@ -830,6 +856,7 @@ # # StateTimeoutSecond = "30" + ################################################################ # Kubernetes Ingress configuration backend ################################################################ @@ -881,9 +908,15 @@ # # namespaces = ["default"] -# See: http://kubernetes.io/docs/user-guide/labels/#list-and-watch-filtering +# Ingress label selector to identify Ingress objects that should be processed. +# See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors for details. +# +# Optional +# Default: empty (process all Ingresses) +# # labelselector = "A and not B" + ################################################################ # Consul KV configuration backend ################################################################ @@ -928,6 +961,7 @@ # key = "/etc/ssl/consul.key" # insecureskipverify = true + ################################################################ # Consul Catalog configuration backend ################################################################ @@ -963,20 +997,16 @@ # prefix = "traefik" # Default frontEnd Rule for Consul services -# - The format is a Go Template with ".ServiceName", ".Domain" and ".Attributes" available -# -- "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available -# --- "getAttribute(...)" function uses prefixed tag names based on "prefix" value +# +# The format is a Go Template with: +# - ".ServiceName", ".Domain" and ".Attributes" available +# - "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available +# - "getAttribute(...)" function uses prefixed tag names based on "prefix" value # # Optional # #frontEndRule = "Host:{{.ServiceName}}.{{Domain}}" -# Should use all Consul catalog tags for constraint filtering -# -# Optional -# -#allTagsConstraintFiltering = false - # Constraints # # Optional @@ -984,6 +1014,7 @@ # constraints = ["tag==api", "tag==he*ld"] # Matching with containers having this tag: "traefik.tags=api,helloworld" + ################################################################ # Etcd configuration backend ################################################################ @@ -1035,6 +1066,37 @@ # key = "/etc/ssl/etcd.key" # insecureskipverify = true + +################################################################ +# Eureka configuration backend +################################################################ + +# Enable Eureka configuration backend +# +# Optional +# +# [eureka] + +# Eureka server endpoint. +# endpoint := "http://my.eureka.server/eureka" +# +# Required +# +# endpoint = "http://my.eureka.server/eureka" + +# Override default configuration time between refresh +# +# Optional +# default 30s +# delay = "1m" + +# Override default configuration template. For advanced users :) +# +# Optional +# +# filename = "eureka.tmpl" + + ################################################################ # Zookeeper configuration backend ################################################################ @@ -1117,7 +1179,7 @@ # ECS Cluster Name # -# Deprecated - Please use Clusters +# DEPRECATED - Please use Clusters # # Cluster = "default" @@ -1135,6 +1197,13 @@ # # Watch = true +# Enable auto discover ECS clusters +# +# Optional +# Default: false +# +# AutoDiscoverClusters = false + # Polling interval (in seconds) # # Optional @@ -1173,6 +1242,7 @@ # # filename = "ecs.tmpl" + ################################################################ # Rancher configuration backend ################################################################ @@ -1263,6 +1333,7 @@ # Required # SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" + ################################################################ # DynamoDB configuration backend ################################################################ diff --git a/types/types.go b/types/types.go index 73854d280..c22b8044b 100644 --- a/types/types.go +++ b/types/types.go @@ -354,7 +354,7 @@ type Prometheus struct { // Datadog contains address and metrics pushing interval configuration type Datadog struct { - Address string `description:"DataDog's Dogstatsd address"` + Address string `description:"DataDog's address"` PushInterval string `description:"DataDog push interval"` }