doc: structural review

- user-guide review.
- add DataDog and StatD configuration.
- sync sample.toml and doc.
- split entry points doc.
- Deprecated.
This commit is contained in:
Fernandez Ludovic 2017-08-26 12:12:44 +02:00 committed by Traefiker
parent 24862402e5
commit 7c2ba62b56
32 changed files with 848 additions and 695 deletions

View file

@ -1,166 +0,0 @@
# Marathon backend
Træfik can be configured to use Marathon as a backend configuration:
```toml
################################################################
# Mesos/Marathon configuration backend
################################################################
# Enable Marathon configuration backend
#
# Optional
#
[marathon]
# Marathon server endpoint.
# You can also specify multiple endpoint for Marathon:
# endpoint := "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
#
# Required
#
endpoint = "http://127.0.0.1:8080"
# Enable watch Marathon changes
#
# Optional
#
watch = true
# Default domain used.
#
# Required
#
domain = "marathon.localhost"
# Override default configuration template. For advanced users :)
#
# Optional
#
# filename = "marathon.tmpl"
# Expose Marathon apps by default in traefik
#
# Optional
# Default: true
#
# exposedByDefault = true
# Convert Marathon groups to subdomains
# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain}
# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain}
#
# Optional
# Default: false
#
# groupsAsSubDomains = true
# Enable compatibility with marathon-lb labels
#
# Optional
# Default: false
#
# marathonLBCompatibility = true
# Enable Marathon basic authentication
#
# Optional
#
# [marathon.basic]
# httpBasicAuthUser = "foo"
# httpBasicPassword = "bar"
# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
#
# Optional
#
# [marathon.TLS]
# CA = "/etc/ssl/ca.crt"
# Cert = "/etc/ssl/marathon.cert"
# Key = "/etc/ssl/marathon.key"
# InsecureSkipVerify = true
# DCOSToken for DCOS environment, This will override the Authorization header
#
# Optional
#
# dcosToken = "xxxxxx"
# Override DialerTimeout
# Amount of time to allow the Marathon provider to wait to open a TCP connection
# to a Marathon master.
# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# values (digits). If no units are provided, the value is parsed assuming
# seconds.
#
# Optional
# Default: "60s"
# dialerTimeout = "60s"
# Set the TCP Keep Alive interval for the Marathon HTTP Client.
# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# values (digits). If no units are provided, the value is parsed assuming
# seconds.
#
# Optional
# Default: "10s"
#
# keepAlive = "10s"
# By default, a task's IP address (as returned by the Marathon API) is used as
# backend server if an IP-per-task configuration can be found; otherwise, the
# name of the host running the task is used.
# The latter behavior can be enforced by enabling this switch.
#
# Optional
# Default: false
#
# forceTaskHostname = false
# Applications may define readiness checks which are probed by Marathon during
# deployments periodically and the results exposed via the API. Enabling the
# following parameter causes Traefik to filter out tasks whose readiness checks
# have not succeeded.
# Note that the checks are only valid at deployment times. See the Marathon
# guide for details.
#
# Optional
# Default: false
#
# respectReadinessChecks = false
```
Labels can be used on containers to override default behaviour:
- `traefik.backend=foo`: assign the application to `foo` backend
- `traefik.backend.maxconn.amount=10`: set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.
- `traefik.backend.maxconn.extractorfunc=client.ip`: set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect.
- `traefik.backend.loadbalancer.method=drr`: override the default `wrr` load balancer algorithm
- `traefik.backend.loadbalancer.sticky=true`: enable backend sticky sessions
- `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5`: create a [circuit breaker](/basics/#backends) to be used against the backend
- `traefik.backend.healthcheck.path=/health`: set the Traefik health check path [default: no health checks]
- `traefik.backend.healthcheck.interval=5s`: sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s]
- `traefik.portIndex=1`: register port by index in the application's ports array. Useful when the application exposes multiple ports.
- `traefik.port=80`: register the explicit application port value. Cannot be used alongside `traefik.portIndex`.
- `traefik.protocol=https`: override the default `http` protocol
- `traefik.weight=10`: assign this weight to the application
- `traefik.enable=false`: disable this application in Træfik
- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`).
- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend.
- `traefik.frontend.priority=10`: override default frontend priority
- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.
- `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0`: Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively
If several ports need to be exposed from a container, the services labels can be used
- `traefik.<service-name>.port=443`: create a service binding with frontend/backend using this port. Overrides `traefik.port`.
- `traefik.<service-name>.portIndex=1`: create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`.
- `traefik.<service-name>.protocol=https`: assign `https` protocol. Overrides `traefik.protocol`.
- `traefik.<service-name>.weight=10`: assign this service weight. Overrides `traefik.weight`.
- `traefik.<service-name>.frontend.backend=fooBackend`: assign this service frontend to `foobackend`. Default is to assign to the service backend.
- `traefik.<service-name>.frontend.entryPoints=http`: assign this service entrypoints. Overrides `traefik.frontend.entrypoints`.
- `traefik.<service-name>.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` Sets a Basic Auth for that frontend with the users test:test and test2:test2.
- `traefik.<service-name>.frontend.passHostHeader=true`: Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`.
- `traefik.<service-name>.frontend.priority=10`: assign the service frontend priority. Overrides `traefik.frontend.priority`.
- `traefik.<service-name>.frontend.rule=Path:/foo`: assign the service frontend rule. Overrides `traefik.frontend.rule`.

View file

@ -1,117 +0,0 @@
# Rancher backend
Træfik can be configured to use Rancher as a backend configuration:
```toml
################################################################
# Rancher configuration backend
################################################################
# Enable Rancher configuration backend
#
# Optional
#
[rancher]
# Default domain used.
# Can be overridden by setting the "traefik.domain" label on an service.
#
# Required
#
domain = "rancher.localhost"
# Enable watch Rancher changes
#
# Optional
# Default: true
#
Watch = true
# Polling interval (in seconds)
#
# Optional
#
RefreshSeconds = 15
# Expose Rancher services by default in traefik
#
# Optional
# Default: true
#
ExposedByDefault = false
# Filter services with unhealthy states and inactive states
#
# Optional
# Default: false
#
EnableServiceHealthFilter = true
```
```toml
# Enable Rancher metadata service configuration backend instead of the API
# configuration backend
#
# Optional
# Default: false
#
[rancher.metadata]
# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds`
# NOTE: this is less accurate than the default long polling technique which
# will provide near instantaneous updates to Traefik
#
# Optional
# Default: false
#
IntervalPoll = true
# Prefix used for accessing the Rancher metadata service
#
# Optional
# Default: "/latest"
#
Prefix = "/2016-07-29"
```
```toml
# Enable Rancher API configuration backend
#
# Optional
# Default: true
#
[rancher.api]
# Endpoint to use when connecting to the Rancher API
#
# Required
Endpoint = "http://rancherserver.example.com/v1"
# AccessKey to use when connecting to the Rancher API
#
# Required
AccessKey = "XXXXXXXXXXXXXXXXXXXX"
# SecretKey to use when connecting to the Rancher API
#
# Required
SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```
If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters.
To enable traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`.
This can be found within the API Key advanced options.
Labels can be used on task containers to override default behaviour:
- `traefik.protocol=https`: override the default `http` protocol
- `traefik.weight=10`: assign this weight to the container
- `traefik.enable=false`: disable this container in Træfik
- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`).
- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend.
- `traefik.frontend.priority=10`: override default frontend priority
- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.
- `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0`: Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively

View file

@ -1,5 +1,6 @@
# Basics
# Concepts ## Concepts
Let's take our example from the [overview](https://docs.traefik.io/#overview) again: Let's take our example from the [overview](https://docs.traefik.io/#overview) again:
@ -24,7 +25,7 @@ Routes are created using requests fields (`Host`, `Path`, `Headers`...) and can
- The [frontend](#frontends) will then send the request to a [backend](#backends). A backend can be composed by one or more [servers](#servers), and by a load-balancing strategy. - The [frontend](#frontends) will then send the request to a [backend](#backends). A backend can be composed by one or more [servers](#servers), and by a load-balancing strategy.
- Finally, the [server](#servers) will forward the request to the corresponding microservice in the private network. - Finally, the [server](#servers) will forward the request to the corresponding microservice in the private network.
## Entrypoints ### Entrypoints
Entrypoints are the network entry points into Træfik. Entrypoints are the network entry points into Træfik.
They can be defined using: They can be defined using:
@ -71,13 +72,13 @@ And here is another example with client certificate authentication:
- One or several files containing Certificate Authorities in PEM format are added. - One or several files containing Certificate Authorities in PEM format are added.
- It is possible to have multiple CA:s in the same file or keep them in separate files. - It is possible to have multiple CA:s in the same file or keep them in separate files.
## Frontends ### Frontends
A frontend consists of a set of rules that determine how incoming requests are forwarded from an entrypoint to a backend. A frontend consists of a set of rules that determine how incoming requests are forwarded from an entrypoint to a backend.
Rules may be classified in one of two groups: Modifiers and matchers. Rules may be classified in one of two groups: Modifiers and matchers.
### Modifiers #### Modifiers
Modifier rules only modify the request. They do not have any impact on routing decisions being made. Modifier rules only modify the request. They do not have any impact on routing decisions being made.
@ -86,7 +87,7 @@ Following is the list of existing modifier rules:
- `AddPrefix: /products`: Add path prefix to the existing request path prior to forwarding the request to the backend. - `AddPrefix: /products`: Add path prefix to the existing request path prior to forwarding the request to the backend.
- `ReplacePath: /serverless-path`: Replaces the path and adds the old path to the `X-Replaced-Path` header. Useful for mapping to AWS Lambda or Google Cloud Functions. - `ReplacePath: /serverless-path`: Replaces the path and adds the old path to the `X-Replaced-Path` header. Useful for mapping to AWS Lambda or Google Cloud Functions.
### Matchers #### Matchers
Matcher rules determine if a particular request should be forwarded to a backend. Matcher rules determine if a particular request should be forwarded to a backend.
@ -115,7 +116,7 @@ In order to use regular expressions with Host and Path matchers, you must declar
(Note that the variable has no special meaning; however, it is required by the gorilla/mux dependency which embeds the regular expression and defines the syntax.) (Note that the variable has no special meaning; however, it is required by the gorilla/mux dependency which embeds the regular expression and defines the syntax.)
#### Path Matcher Usage Guidelines ##### Path Matcher Usage Guidelines
This section explains when to use the various path matchers. This section explains when to use the various path matchers.
@ -128,7 +129,7 @@ If your backend is serving assets (e.g., images or Javascript files), chances ar
Instead of distinguishing your backends by path only, you can add a Host matcher to the mix. That way, namespacing of your backends happens on the basis of hosts in addition to paths. Instead of distinguishing your backends by path only, you can add a Host matcher to the mix. That way, namespacing of your backends happens on the basis of hosts in addition to paths.
### Examples #### Examples
Here is an example of frontends definition: Here is an example of frontends definition:
@ -157,7 +158,7 @@ Here is an example of frontends definition:
- `frontend2` will forward the traffic to the `backend1` if the rule `Host:localhost,{subdomain:[a-z]+}.localhost` is matched (forwarding client `Host` header to the backend) - `frontend2` will forward the traffic to the `backend1` if the rule `Host:localhost,{subdomain:[a-z]+}.localhost` is matched (forwarding client `Host` header to the backend)
- `frontend3` will forward the traffic to the `backend2` if the rules `Host:test3.localhost` **AND** `Path:/test` are matched - `frontend3` will forward the traffic to the `backend2` if the rules `Host:test3.localhost` **AND** `Path:/test` are matched
### Combining multiple rules #### Combining multiple rules
As seen in the previous example, you can combine multiple rules. As seen in the previous example, you can combine multiple rules.
In TOML file, you can use multiple routes: In TOML file, you can use multiple routes:
@ -193,7 +194,7 @@ Finally, you can create a rule to bind multiple domains or Path to a frontend, u
rule = "Path:/test1,/test2" rule = "Path:/test1,/test2"
``` ```
### Rules Order #### Rules Order
When combining `Modifier` rules with `Matcher` rules, it is important to remember that `Modifier` rules **ALWAYS** apply after the `Matcher` rules. When combining `Modifier` rules with `Matcher` rules, it is important to remember that `Modifier` rules **ALWAYS** apply after the `Matcher` rules.
The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portion of the rule will apply first, and the `Modifier` will apply later. The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portion of the rule will apply first, and the `Modifier` will apply later.
@ -212,7 +213,7 @@ The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portio
5. `AddPrefix` 5. `AddPrefix`
6. `ReplacePath` 6. `ReplacePath`
### Priorities #### Priorities
By default, routes will be sorted (in descending order) using rules length (to avoid path overlap): By default, routes will be sorted (in descending order) using rules length (to avoid path overlap):
`PathPrefix:/12345` will be matched before `PathPrefix:/1234` that will be matched before `PathPrefix:/1`. `PathPrefix:/12345` will be matched before `PathPrefix:/1234` that will be matched before `PathPrefix:/1`.
@ -237,7 +238,7 @@ You can customize priority by frontend:
Here, `frontend1` will be matched before `frontend2` (`10 > 5`). Here, `frontend1` will be matched before `frontend2` (`10 > 5`).
### Custom headers #### Custom headers
Custom headers can be configured through the frontends, to add headers to either requests or responses that match the frontend's rules. This allows for setting headers such as `X-Script-Name` to be added to the request, or custom headers to be added to the response: Custom headers can be configured through the frontends, to add headers to either requests or responses that match the frontend's rules. This allows for setting headers such as `X-Script-Name` to be added to the request, or custom headers to be added to the response:
@ -255,7 +256,7 @@ Custom headers can be configured through the frontends, to add headers to either
In this example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, and the `X-Custom-Response-Header` added to the response. In this example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, and the `X-Custom-Response-Header` added to the response.
### Security headers #### Security headers
Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above. This functionality allows for some easy security features to quickly be set. An example of some of the security headers: Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above. This functionality allows for some easy security features to quickly be set. An example of some of the security headers:
@ -277,7 +278,7 @@ Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc
In this example, traffic routed through the first frontend will have the `X-Frame-Options` header set to `DENY`, and the second will only allow HTTPS request through, otherwise will return a 301 HTTPS redirect. In this example, traffic routed through the first frontend will have the `X-Frame-Options` header set to `DENY`, and the second will only allow HTTPS request through, otherwise will return a 301 HTTPS redirect.
## Backends ### Backends
A backend is responsible to load-balance the traffic coming from one or more frontends to a set of http servers. A backend is responsible to load-balance the traffic coming from one or more frontends to a set of http servers.
Various methods of load-balancing are supported: Various methods of load-balancing are supported:
@ -364,7 +365,7 @@ To use a different port for the healthcheck:
port = 8080 port = 8080
``` ```
## Servers ### Servers
Servers are simply defined using a `URL`. You can also apply a custom `weight` to each server (this will be used by load-balancing). Servers are simply defined using a `URL`. You can also apply a custom `weight` to each server (this will be used by load-balancing).
@ -397,7 +398,7 @@ Here is an example of backends and servers definition:
- `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2` using `drr` load-balancing strategy. - `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2` using `drr` load-balancing strategy.
- a circuit breaker is added on `backend1` using the expression `NetworkErrorRatio() > 0.5`: watch error ratio over 10 second sliding window - a circuit breaker is added on `backend1` using the expression `NetworkErrorRatio() > 0.5`: watch error ratio over 10 second sliding window
## Custom Error pages ### Custom Error pages
Custom error pages can be returned, in lieu of the default, according to frontend-configured ranges of HTTP Status codes. Custom error pages can be returned, in lieu of the default, according to frontend-configured ranges of HTTP Status codes.
In the example below, if a 503 status is returned from the frontend "website", the custom error page at http://2.3.4.5/503.html is returned with the actual status code set in the HTTP header. In the example below, if a 503 status is returned from the frontend "website", the custom error page at http://2.3.4.5/503.html is returned with the actual status code set in the HTTP header.
@ -430,7 +431,7 @@ Instead, the query parameter can also be set to some generic error page like so:
Now the 500s.html error page is returned for the configured code range. Now the 500s.html error page is returned for the configured code range.
The configured status code ranges are inclusive; that is, in the above example, the 500s.html page will be returned for status codes 500 through, and including, 599. The configured status code ranges are inclusive; that is, in the above example, the 500s.html page will be returned for status codes 500 through, and including, 599.
# Configuration ## Configuration
Træfik's configuration has two parts: Træfik's configuration has two parts:
@ -438,7 +439,7 @@ Træfik's configuration has two parts:
- The [dynamic Træfik configuration](/basics#dynamic-trfk-configuration) which can be hot-reloaded (no need to restart the process). - The [dynamic Træfik configuration](/basics#dynamic-trfk-configuration) which can be hot-reloaded (no need to restart the process).
## Static Træfik configuration ### Static Træfik configuration
The static configuration is the global configuration which is setting up connections to configuration backends and entrypoints. The static configuration is the global configuration which is setting up connections to configuration backends and entrypoints.
@ -454,7 +455,7 @@ It means that arguments override configuration file, and key-value store overrid
Note that the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider. It must not be used if a configuration source with less precedence wants to set a non-default provider value. Note that the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider. It must not be used if a configuration source with less precedence wants to set a non-default provider value.
### Configuration file #### Configuration file
By default, Træfik will try to find a `traefik.toml` in the following places: By default, Træfik will try to find a `traefik.toml` in the following places:
@ -470,7 +471,7 @@ $ traefik --configFile=foo/bar/myconfigfile.toml
Please refer to the [global configuration](/toml/#global-configuration) section to get documentation on it. Please refer to the [global configuration](/toml/#global-configuration) section to get documentation on it.
### Arguments #### Arguments
Each argument (and command) is described in the help section: Each argument (and command) is described in the help section:
@ -480,7 +481,7 @@ $ traefik --help
Note that all default values will be displayed as well. Note that all default values will be displayed as well.
### Key-value stores #### Key-value stores
Træfik supports several Key-value stores: Træfik supports several Key-value stores:
@ -491,7 +492,7 @@ Træfik supports several Key-value stores:
Please refer to the [User Guide Key-value store configuration](/user-guide/kv-config/) section to get documentation on it. Please refer to the [User Guide Key-value store configuration](/user-guide/kv-config/) section to get documentation on it.
## Dynamic Træfik configuration ### Dynamic Træfik configuration
The dynamic configuration concerns : The dynamic configuration concerns :
@ -506,7 +507,7 @@ Routes to services will be created and updated instantly at any changes.
Please refer to the [configuration backends](/toml/#configuration-backends) section to get documentation on it. Please refer to the [configuration backends](/toml/#configuration-backends) section to get documentation on it.
# Commands ## Commands
Usage: `traefik [command] [--flag=flag_argument]` Usage: `traefik [command] [--flag=flag_argument]`
@ -530,7 +531,7 @@ Note that each command is described at the beginning of the help section:
$ traefik --help $ traefik --help
``` ```
## Command: bug ### Command: bug
Here is the easiest way to submit a pre-filled issue on [Træfik GitHub](https://github.com/containous/traefik). Here is the easiest way to submit a pre-filled issue on [Træfik GitHub](https://github.com/containous/traefik).
@ -540,7 +541,7 @@ $ traefik bug
See https://www.youtube.com/watch?v=Lyz62L8m93I. See https://www.youtube.com/watch?v=Lyz62L8m93I.
## Command: healthcheck ### Command: healthcheck
This command allows to check the health of Traefik. Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy. This command allows to check the health of Traefik. Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy.
This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism. This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism.
@ -552,7 +553,7 @@ $ traefik healthcheck
OK: http://:8082/ping OK: http://:8082/ping
``` ```
# Log Rotation ## Log Rotation
Traefik will close and reopen its log files, assuming they're configured, on receipt of a USR1 signal. This allows the logs Traefik will close and reopen its log files, assuming they're configured, on receipt of a USR1 signal. This allows the logs
to be rotated and processed by an external program, such as `logrotate`. to be rotated and processed by an external program, such as `logrotate`.

View file

@ -1,4 +1,4 @@
# BoltDB backend # BoltDB Backend
Træfik can be configured to use BoltDB as a backend configuration: Træfik can be configured to use BoltDB as a backend configuration:
@ -8,9 +8,6 @@ Træfik can be configured to use BoltDB as a backend configuration:
################################################################ ################################################################
# Enable BoltDB configuration backend # Enable BoltDB configuration backend
#
# Optional
#
[boltdb] [boltdb]
# BoltDB file # BoltDB file
@ -35,5 +32,5 @@ prefix = "/traefik"
# #
# Optional # Optional
# #
# filename = "boltdb.tmpl" filename = "boltdb.tmpl"
``` ```

View file

@ -1,4 +1,5 @@
# Consul backend # Consul Backend
## Consul Key-Value backend ## Consul Key-Value backend
Træfik can be configured to use Consul as a backend configuration: Træfik can be configured to use Consul as a backend configuration:
@ -9,9 +10,6 @@ Træfik can be configured to use Consul as a backend configuration:
################################################################ ################################################################
# Enable Consul KV configuration backend # Enable Consul KV configuration backend
#
# Optional
#
[consul] [consul]
# Consul server endpoint # Consul server endpoint
@ -61,9 +59,6 @@ Træfik can be configured to use service discovery catalog of Consul as a backen
################################################################ ################################################################
# Enable Consul Catalog configuration backend # Enable Consul Catalog configuration backend
#
# Optional
#
[consulCatalog] [consulCatalog]
# Consul server endpoint # Consul server endpoint
@ -81,7 +76,6 @@ domain = "consul.localhost"
# Expose Consul catalog services by default in traefik # Expose Consul catalog services by default in traefik
# #
# Optional # Optional
# Default: true
# #
exposedByDefault = false exposedByDefault = false
@ -92,17 +86,18 @@ exposedByDefault = false
prefix = "traefik" prefix = "traefik"
# Default frontEnd Rule for Consul services # Default frontEnd Rule for Consul services
# The format is a Go Template with ".ServiceName", ".Domain" and ".Attributes" available #
# "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available # The format is a Go Template with:
# "getAttribute(...)" function uses prefixed tag names based on "prefix" value # - ".ServiceName", ".Domain" and ".Attributes" available
# - "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available
# - "getAttribute(...)" function uses prefixed tag names based on "prefix" value
# #
# Optional # Optional
# #
frontEndRule = "Host:{{.ServiceName}}.{{Domain}}" #frontEndRule = "Host:{{.ServiceName}}.{{Domain}}"
``` ```
This backend will create routes matching on hostname based on the service name This backend will create routes matching on hostname based on the service name used in consul.
used in consul.
Additional settings can be defined using Consul Catalog tags: Additional settings can be defined using Consul Catalog tags:

View file

@ -1,6 +1,8 @@
# Docker backend # Docker Backend
Træfik can be configured to use Docker as a backend configuration: Træfik can be configured to use Docker as a backend configuration.
## Docker
```toml ```toml
################################################################ ################################################################
@ -8,9 +10,6 @@ Træfik can be configured to use Docker as a backend configuration:
################################################################ ################################################################
# Enable Docker configuration backend # Enable Docker configuration backend
#
# Optional
#
[docker] [docker]
# Docker server endpoint. Can be a tcp or a unix socket endpoint. # Docker server endpoint. Can be a tcp or a unix socket endpoint.
@ -47,12 +46,12 @@ watch = true
exposedbydefault = true exposedbydefault = true
# Use the IP address from the binded port instead of the inner network one. For specific use-case :) # Use the IP address from the binded port instead of the inner network one. For specific use-case :)
# #
# Optional # Optional
# Default: false # Default: false
# #
usebindportip = true usebindportip = true
# Use Swarm Mode services as data provider # Use Swarm Mode services as data provider
# #
# Optional # Optional
@ -60,9 +59,10 @@ usebindportip = true
# #
swarmmode = false swarmmode = false
# Enable docker TLS connection # Enable docker TLS connection
# #
# Optional
#
# [docker.tls] # [docker.tls]
# ca = "/etc/ssl/ca.crt" # ca = "/etc/ssl/ca.crt"
# cert = "/etc/ssl/docker.crt" # cert = "/etc/ssl/docker.crt"
@ -70,7 +70,65 @@ swarmmode = false
# insecureskipverify = true # insecureskipverify = true
``` ```
### Labels can be used on containers to override default behaviour ## Docker Swarm Mode
```toml
################################################################
# Docker Swarmmode configuration backend
################################################################
# Enable Docker configuration backend
[docker]
# Docker server endpoint. Can be a tcp or a unix socket endpoint.
#
# Required
# Default: "unix:///var/run/docker.sock"
#
endpoint = "tcp://127.0.0.1:2375"
# Default domain used.
# Can be overridden by setting the "traefik.domain" label on a services.
#
# Optional
# Default: ""
#
domain = "docker.localhost"
# Enable watch docker changes
#
# Optional
#
watch = true
# Use Docker Swarm Mode as data provider
swarmmode = true
# Override default configuration template. For advanced users :)
#
# Optional
#
# filename = "docker.tmpl"
# Expose services by default in traefik
#
# Optional
# Default: true
#
exposedbydefault = false
# Enable docker TLS connection
#
# Optional
#
# [swarm.tls]
# ca = "/etc/ssl/ca.crt"
# cert = "/etc/ssl/docker.crt"
# key = "/etc/ssl/docker.key"
# insecureskipverify = true
```
## Labels can be used on containers to override default behaviour
| Label | Description | | Label | Description |
|---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|

View file

@ -1,17 +1,13 @@
# DynamoDB backend # DynamoDB Backend
Træfik can be configured to use Amazon DynamoDB as a backend configuration: Træfik can be configured to use Amazon DynamoDB as a backend configuration:
```toml ```toml
################################################################ ################################################################
# DynamoDB configuration backend # DynamoDB configuration backend
################################################################ ################################################################
# Enable DynamoDB configuration backend # Enable DynamoDB configuration backend
#
# Optional
#
[dynamodb] [dynamodb]
# DyanmoDB Table Name # DyanmoDB Table Name
@ -55,14 +51,13 @@ SecretAccessKey = "123"
# Optional # Optional
# #
Endpoint = "http://localhost:8080" Endpoint = "http://localhost:8080"
``` ```
Items in the `dynamodb` table must have three attributes: Items in the `dynamodb` table must have three attributes:
- `id` : string - `id` (string): The id is the primary key.
- The id is the primary key. - `name`(string): The name is used as the name of the frontend or backend.
- `name` : string - `frontend` or `backend` (map): This attribute's structure matches exactly the structure of a Frontend or Backend type in traefik.
- The name is used as the name of the frontend or backend. See `types/types.go` for details.
- `frontend` or `backend` : map The presence or absence of this attribute determines its type.
- This attribute's structure matches exactly the structure of a Frontend or Backend type in traefik. See `types/types.go` for details. The presence or absence of this attribute determines its type. So an item should never have both a `frontend` and a `backend` attribute. So an item should never have both a `frontend` and a `backend` attribute.

View file

@ -1,22 +1,18 @@
# ECS backend # ECS Backend
Træfik can be configured to use Amazon ECS as a backend configuration: Træfik can be configured to use Amazon ECS as a backend configuration:
```toml ```toml
################################################################ ################################################################
# ECS configuration backend # ECS configuration backend
################################################################ ################################################################
# Enable ECS configuration backend # Enable ECS configuration backend
#
# Optional
#
[ecs] [ecs]
# ECS Cluster Name # ECS Cluster Name
# #
# Deprecated - Please use Clusters # DEPRECATED - Please use Clusters
# #
Cluster = "default" Cluster = "default"
@ -73,19 +69,26 @@ AccessKeyID = "abc"
# #
SecretAccessKey = "123" SecretAccessKey = "123"
# Override default configuration template. For advanced users :)
#
# Optional
#
# filename = "ecs.tmpl"
``` ```
Labels can be used on task containers to override default behaviour: Labels can be used on task containers to override default behaviour:
- `traefik.protocol=https`: override the default `http` protocol | Label | Description |
- `traefik.weight=10`: assign this weight to the container |----------------------------------------------|------------------------------------------------------------------------------------------|
- `traefik.enable=false`: disable this container in Træfik | `traefik.protocol=https` | override the default `http` protocol |
- `traefik.backend.loadbalancer.method=drr`: override the default `wrr` load balancer algorithm | `traefik.weight=10` | assign this weight to the container |
- `traefik.backend.loadbalancer.sticky=true`: enable backend sticky sessions | `traefik.enable=false` | disable this container in Træfik |
- `traefik.frontend.rule=Host:test.traefik.io`: override the default frontend rule (Default: `Host:{containerName}.{domain}`). | `traefik.backend.loadbalancer.method=drr` | override the default `wrr` load balancer algorithm |
- `traefik.frontend.passHostHeader=true`: forward client `Host` header to the backend. | `traefik.backend.loadbalancer.sticky=true` | enable backend sticky sessions |
- `traefik.frontend.priority=10`: override default frontend priority | `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). |
- `traefik.frontend.entryPoints=http,https`: assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. | `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. |
| `traefik.frontend.priority=10` | override default frontend priority |
| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
If `AccessKeyID`/`SecretAccessKey` is not given credentials will be resolved in the following order: If `AccessKeyID`/`SecretAccessKey` is not given credentials will be resolved in the following order:

View file

@ -1,4 +1,4 @@
# Etcd backend # Etcd Backend
Træfik can be configured to use Etcd as a backend configuration: Træfik can be configured to use Etcd as a backend configuration:
@ -8,9 +8,6 @@ Træfik can be configured to use Etcd as a backend configuration:
################################################################ ################################################################
# Enable Etcd configuration backend # Enable Etcd configuration backend
#
# Optional
#
[etcd] [etcd]
# Etcd server endpoint # Etcd server endpoint

View file

@ -1,17 +1,13 @@
# Eureka backend # Eureka Backend
Træfik can be configured to use Eureka as a backend configuration: Træfik can be configured to use Eureka as a backend configuration:
```toml ```toml
################################################################ ################################################################
# Eureka configuration backend # Eureka configuration backend
################################################################ ################################################################
# Enable Eureka configuration backend # Enable Eureka configuration backend
#
# Optional
#
[eureka] [eureka]
# Eureka server endpoint. # Eureka server endpoint.

View file

@ -1,8 +1,10 @@
# File backends # File Backends
Like any other reverse proxy, Træfik can be configured with a file. You have three choices: Like any other reverse proxy, Træfik can be configured with a file. You have three choices:
- simply add your configuration at the end of the global configuration file `traefik.toml`: ## Simple
Add your configuration at the end of the global configuration file `traefik.toml`:
```toml ```toml
# traefik.toml # traefik.toml
@ -74,7 +76,9 @@ defaultEntryPoints = ["http", "https"]
rule = "Path:/test" rule = "Path:/test"
``` ```
- or put your rules in a separate file, for example `rules.toml`: ## Rules in a Separate File
Put your rules in a separate file, for example `rules.toml`:
```toml ```toml
# traefik.toml # traefik.toml
@ -141,7 +145,9 @@ filename = "rules.toml"
rule = "Path:/test" rule = "Path:/test"
``` ```
- or you could have multiple .toml files in a directory: ## Multiple .toml Files
You could have multiple `.toml` files in a directory:
```toml ```toml
[file] [file]

View file

@ -1,5 +1,4 @@
# Kubernetes Ingress backend # Kubernetes Ingress Backend
Træfik can be configured to use Kubernetes Ingress as a backend configuration: Træfik can be configured to use Kubernetes Ingress as a backend configuration:
@ -8,9 +7,6 @@ Træfik can be configured to use Kubernetes Ingress as a backend configuration:
# Kubernetes Ingress configuration backend # Kubernetes Ingress configuration backend
################################################################ ################################################################
# Enable Kubernetes Ingress configuration backend # Enable Kubernetes Ingress configuration backend
#
# Optional
#
[kubernetes] [kubernetes]
# Kubernetes server endpoint # Kubernetes server endpoint

View file

@ -0,0 +1,167 @@
# Marathon Backend
Træfik can be configured to use Marathon as a backend configuration:
```toml
################################################################
# Mesos/Marathon configuration backend
################################################################
# Enable Marathon configuration backend
[marathon]
# Marathon server endpoint.
# You can also specify multiple endpoint for Marathon:
# endpoint := "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
#
# Required
#
endpoint = "http://127.0.0.1:8080"
# Enable watch Marathon changes
#
# Optional
#
watch = true
# Default domain used.
# Can be overridden by setting the "traefik.domain" label on an application.
#
# Required
#
domain = "marathon.localhost"
# Override default configuration template. For advanced users :)
#
# Optional
#
# filename = "marathon.tmpl"
# Expose Marathon apps by default in traefik
#
# Optional
# Default: true
#
# exposedByDefault = true
# Convert Marathon groups to subdomains
# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain}
# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain}
#
# Optional
# Default: false
#
# groupsAsSubDomains = true
# Enable compatibility with marathon-lb labels
#
# Optional
# Default: false
#
# marathonLBCompatibility = true
# Enable Marathon basic authentication
#
# Optional
#
# [marathon.basic]
# httpBasicAuthUser = "foo"
# httpBasicPassword = "bar"
# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
#
# Optional
#
# [marathon.TLS]
# CA = "/etc/ssl/ca.crt"
# Cert = "/etc/ssl/marathon.cert"
# Key = "/etc/ssl/marathon.key"
# InsecureSkipVerify = true
# DCOSToken for DCOS environment, This will override the Authorization header
#
# Optional
#
# dcosToken = "xxxxxx"
# Override DialerTimeout
# Amount of time to allow the Marathon provider to wait to open a TCP connection
# to a Marathon master.
# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# values (digits). If no units are provided, the value is parsed assuming
# seconds.
#
# Optional
# Default: "60s"
# dialerTimeout = "60s"
# Set the TCP Keep Alive interval for the Marathon HTTP Client.
# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# values (digits). If no units are provided, the value is parsed assuming
# seconds.
#
# Optional
# Default: "10s"
#
# keepAlive = "10s"
# By default, a task's IP address (as returned by the Marathon API) is used as
# backend server if an IP-per-task configuration can be found; otherwise, the
# name of the host running the task is used.
# The latter behavior can be enforced by enabling this switch.
#
# Optional
# Default: false
#
# forceTaskHostname = false
# Applications may define readiness checks which are probed by Marathon during
# deployments periodically and the results exposed via the API. Enabling the
# following parameter causes Traefik to filter out tasks whose readiness checks
# have not succeeded.
# Note that the checks are only valid at deployment times. See the Marathon
# guide for details.
#
# Optional
# Default: false
#
# respectReadinessChecks = false
```
Labels can be used on containers to override default behaviour:
| Label | Description |
|----------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.backend=foo` | assign the application to `foo` backend |
| `traefik.backend.maxconn.amount=10` | set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect. |
| `traefik.backend.maxconn.extractorfunc=client.ip` | set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
| `traefik.backend.loadbalancer.method=drr` | override the default `wrr` load balancer algorithm |
| `traefik.backend.loadbalancer.sticky=true` | enable backend sticky sessions |
| `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | create a [circuit breaker](/basics/#backends) to be used against the backend |
| `traefik.backend.healthcheck.path=/health` | set the Traefik health check path [default: no health checks] |
| `traefik.backend.healthcheck.interval=5s` | sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s] |
| `traefik.portIndex=1` | register port by index in the application's ports array. Useful when the application exposes multiple ports. |
| `traefik.port=80` | register the explicit application port value. Cannot be used alongside `traefik.portIndex`. |
| `traefik.protocol=https` | override the default `http` protocol |
| `traefik.weight=10` | assign this weight to the application |
| `traefik.enable=false` | disable this application in Træfik |
| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). |
| `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. |
| `traefik.frontend.priority=10` | override default frontend priority |
| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
| `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively |
If several ports need to be exposed from a container, the services labels can be used:
| Label | Description |
|-------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|
| `traefik.<service-name>.port=443` | create a service binding with frontend/backend using this port. Overrides `traefik.port`. |
| `traefik.<service-name>.portIndex=1` | create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. |
| `traefik.<service-name>.protocol=https` | assign `https` protocol. Overrides `traefik.protocol`. |
| `traefik.<service-name>.weight=10` | assign this service weight. Overrides `traefik.weight`. |
| `traefik.<service-name>.frontend.backend=fooBackend` | assign this service frontend to `foobackend`. Default is to assign to the service backend. |
| `traefik.<service-name>.frontend.entryPoints=http` | assign this service entrypoints. Overrides `traefik.frontend.entrypoints`. |
| `traefik.<service-name>.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets a Basic Auth for that frontend with the users test:test and test2:test2. |
| `traefik.<service-name>.frontend.passHostHeader=true` | Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`. |
| `traefik.<service-name>.frontend.priority=10` | assign the service frontend priority. Overrides `traefik.frontend.priority`. |
| `traefik.<service-name>.frontend.rule=Path:/foo` | assign the service frontend rule. Overrides `traefik.frontend.rule`. |

View file

@ -1,17 +1,13 @@
# Mesos generic backend # Mesos Generic Backend
Træfik can be configured to use Mesos as a backend configuration: Træfik can be configured to use Mesos as a backend configuration:
```toml ```toml
################################################################ ################################################################
# Mesos configuration backend # Mesos configuration backend
################################################################ ################################################################
# Enable Mesos configuration backend # Enable Mesos configuration backend
#
# Optional
#
[mesos] [mesos]
# Mesos server endpoint. # Mesos server endpoint.

View file

@ -0,0 +1,122 @@
# Rancher Backend
Træfik can be configured to use Rancher as a backend configuration:
```toml
################################################################
# Rancher configuration backend
################################################################
# Enable Rancher configuration backend
[rancher]
# Default domain used.
# Can be overridden by setting the "traefik.domain" label on an service.
#
# Required
#
domain = "rancher.localhost"
# Enable watch Rancher changes
#
# Optional
# Default: true
#
Watch = true
# Polling interval (in seconds)
#
# Optional
#
RefreshSeconds = 15
# Expose Rancher services by default in traefik
#
# Optional
# Default: true
#
ExposedByDefault = false
# Filter services with unhealthy states and inactive states
#
# Optional
# Default: false
#
EnableServiceHealthFilter = true
```
## Rancher Metadata Service
```toml
# Enable Rancher metadata service configuration backend instead of the API
# configuration backend
#
# Optional
# Default: false
#
[rancher.metadata]
# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds`
# NOTE: this is less accurate than the default long polling technique which
# will provide near instantaneous updates to Traefik
#
# Optional
# Default: false
#
IntervalPoll = true
# Prefix used for accessing the Rancher metadata service
#
# Optional
# Default: "/latest"
#
Prefix = "/2016-07-29"
```
## Rancher API
```toml
# Enable Rancher API configuration backend
#
# Optional
# Default: true
#
[rancher.api]
# Endpoint to use when connecting to the Rancher API
#
# Required
Endpoint = "http://rancherserver.example.com/v1"
# AccessKey to use when connecting to the Rancher API
#
# Required
AccessKey = "XXXXXXXXXXXXXXXXXXXX"
# SecretKey to use when connecting to the Rancher API
#
# Required
SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
```
## Notes
If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters.
To enable traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`.
This can be found within the API Key advanced options.
## Labels
Labels can be used on task containers to override default behaviour:
| Label | Description |
|----------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| `traefik.protocol=https` | override the default `http` protocol |
| `traefik.weight=10` | assign this weight to the container |
| `traefik.enable=false` | disable this container in Træfik |
| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`). |
| `traefik.frontend.passHostHeader=true` | forward client `Host` header to the backend. |
| `traefik.frontend.priority=10` | override default frontend priority |
| `traefik.frontend.entryPoints=http,https` | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
| `traefik.frontend.auth.basic=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | Sets basic authentication for that frontend with the usernames and passwords test:test and test2:test2, respectively |

View file

@ -1,66 +1,38 @@
# API backend # Web Backend
Træfik can be configured using a RESTful api. Træfik can be configured:
- using a RESTful api.
- to use a metric system (like Prometheus, DataDog or StatD, ...).
- to expose a Web Dashboard.
## Configuration ## Configuration
### CLI
| Flag | Description | Default |
|------------------------------------|----------------------------------|---------------------|
| `--web` | Enable Web backend | `"true"` |
| `--web.address` | Web administration port | `":8080"` |
| `--web.certfile` | SSL certificate | |
| `--web.keyfile` | SSL key | |
| `--web.metrics` | Enable a metrics exporter | `"true"` |
| `--web.metrics.prometheus` | Prometheus metrics exporter type | `"true"` |
| `--web.metrics.prometheus.buckets` | Buckets for latency metrics | `"[0.1 0.3 1.2 5]"` |
| `--web.path` | Root path for dashboard and API | |
| `--web.readonly` | Enable read only API | `"false"` |
| `--web.statistics` | Enable more detailed statistics | `"false"` |
| `--web.statistics.recenterrors` | Number of recent errors logged | `"10"` |
### traefik.toml:
```toml ```toml
[web] [web]
# Web administration port
#
# Required
#
address = ":8080" address = ":8080"
# Set the root path for webui and API
#
# Optional
#
# path = "/mypath"
#
# SSL certificate and key used # SSL certificate and key used
# #
# Optional # Optional
# #
# CertFile = "traefik.crt" # CertFile = "traefik.crt"
# KeyFile = "traefik.key" # KeyFile = "traefik.key"
#
# Set REST API to read-only mode # Set REST API to read-only mode
# #
# Optional # Optional
# ReadOnly = false # ReadOnly = false
#
# To enable more detailed statistics # Enable more detailed statistics
# [web.statistics] # [web.statistics]
# RecentErrors = 10 # RecentErrors = 10
#
# To enable Traefik to export internal metrics to Prometheus
# [web.metrics.prometheus]
# Buckets=[0.1,0.3,1.2,5.0]
#
# To enable Traefik to export internal metics to DataDog
# [web.metrics.datadog]
# Address = localhost:8125
# PushInterval = "10s"
#
# To enable Traefik to export internal metics to StatsD
# [web.metrics.statsd]
# Address = localhost:8125
# PushInterval = "10s"
#
# To enable basic auth on the webui # To enable basic auth on the webui
# with 2 user/pass: test:test and test2:test2 # with 2 user/pass: test:test and test2:test2
# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones # Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones
@ -78,10 +50,31 @@ address = ":8080"
``` ```
## Web UI ## Web UI
![Web UI Providers](/img/web.frontend.png) ![Web UI Providers](/img/web.frontend.png)
![Web UI Health](/img/traefik-health.png) ![Web UI Health](/img/traefik-health.png)
## Metrics
You can enable Traefik to export internal metrics to different monitoring systems.
```toml
# To enable Traefik to export internal metrics to Prometheus
# [web.metrics.prometheus]
# Buckets=[0.1,0.3,1.2,5.0]
# DataDog metrics exporter type
# [web.metrics.datadog]
# Address = "localhost:8125"
# Pushinterval = "10s"
# StatsD metrics exporter type
# [web.metrics.statsd]
# Address = "localhost:8125"
# Pushinterval = "10s"
```
## API ## API
| Path | Method | Description | | Path | Method | Description |
@ -102,16 +95,14 @@ address = ":8080"
| `/api/providers/{provider}/frontends/{frontend}/routes/{route}` | `GET` | Get a route in a frontend | | `/api/providers/{provider}/frontends/{frontend}/routes/{route}` | `GET` | Get a route in a frontend |
| `/metrics` | `GET` | Export internal metrics | | `/metrics` | `GET` | Export internal metrics |
> You can enable Traefik to export internal metrics to different monitoring systems (Only Prometheus is supported at the moment).
>```bash
>$ traefik --web.metrics.prometheus --web.metrics.prometheus.buckets="0.1,0.3,1.2,5.0"
>```
### Example ### Example
#### Ping #### Ping
```shell ```shell
$ curl -sv "http://localhost:8080/ping" $ curl -sv "http://localhost:8080/ping"
```
```shell
* Trying ::1... * Trying ::1...
* Connected to localhost (::1) port 8080 (#0) * Connected to localhost (::1) port 8080 (#0)
> GET /ping HTTP/1.1 > GET /ping HTTP/1.1
@ -129,8 +120,11 @@ OK
``` ```
#### Health #### Health
```shell ```shell
$ curl -s "http://localhost:8080/health" | jq . $ curl -s "http://localhost:8080/health" | jq .
```
```json
{ {
// Træfik PID // Træfik PID
"pid": 2458, "pid": 2458,
@ -187,8 +181,11 @@ $ curl -s "http://localhost:8080/health" | jq .
``` ```
#### Provider configurations #### Provider configurations
```shell ```shell
$ curl -s "http://localhost:8080/api" | jq . $ curl -s "http://localhost:8080/api" | jq .
```
```json
{ {
"file": { "file": {
"frontends": { "frontends": {

View file

@ -1,4 +1,4 @@
# Zookeeper backend # Zookeeper Backend
Træfik can be configured to use Zookeeper as a backend configuration: Træfik can be configured to use Zookeeper as a backend configuration:
@ -8,9 +8,6 @@ Træfik can be configured to use Zookeeper as a backend configuration:
################################################################ ################################################################
# Enable Zookeeperconfiguration backend # Enable Zookeeperconfiguration backend
#
# Optional
#
[zookeeper] [zookeeper]
# Zookeeper server endpoint # Zookeeper server endpoint

View file

@ -1,10 +1,8 @@
# Global Configuration
# Global configuration ## Main Section
## Main section
```toml ```toml
# traefik.toml
################################################################ ################################################################
# Global configuration # Global configuration
################################################################ ################################################################
@ -42,7 +40,7 @@
# Access logs file # Access logs file
# #
# Deprecated - see [accessLog] lower down # DEPRECATED - see [accessLog] lower down
# Optional # Optional
# #
# accessLogsFile = "log/access.log" # accessLogsFile = "log/access.log"
@ -70,7 +68,7 @@
# IdleTimeout # IdleTimeout
# #
# Deprecated - see [respondingTimeouts] section. In the case both settings are configured, the deprecated option will # DEPRECATED - see [respondingTimeouts] section. In the case both settings are configured, the deprecated option will
# be overwritten. # be overwritten.
# #
# IdleTimeout is the maximum amount of time an idle (keep-alive) connection will remain idle before closing itself. # IdleTimeout is the maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.
@ -145,28 +143,29 @@ Supported filters:
# #
# Simple matching constraint # Simple matching constraint
# constraints = ["tag==api"] # constraints = ["tag==api"]
#
# Simple mismatching constraint # Simple mismatching constraint
# constraints = ["tag!=api"] # constraints = ["tag!=api"]
#
# Globbing # Globbing
# constraints = ["tag==us-*"] # constraints = ["tag==us-*"]
#
# Backend-specific constraint
# [consulCatalog]
# endpoint = 127.0.0.1:8500
# constraints = ["tag==api"]
#
# Multiple constraints # Multiple constraints
# - "tag==" must match with at least one tag # - "tag==" must match with at least one tag
# - "tag!=" must match with none of tags # - "tag!=" must match with none of tags
# constraints = ["tag!=us-*", "tag!=asia-*"] # constraints = ["tag!=us-*", "tag!=asia-*"]
# Backend-specific constraint
# [consulCatalog]
# endpoint = 127.0.0.1:8500
# constraints = ["tag==api"]
# [consulCatalog] # [consulCatalog]
# endpoint = 127.0.0.1:8500 # endpoint = 127.0.0.1:8500
# constraints = ["tag==api", "tag!=v*-beta"] # constraints = ["tag==api", "tag!=v*-beta"]
``` ```
## Access log definition ## Access Log Definition
Access logs are written when `[accessLog]` is defined. Access logs are written when `[accessLog]` is defined.
By default it will write to stdout and produce logs in the textual Common Log Format (CLF), extended with additional fields. By default it will write to stdout and produce logs in the textual Common Log Format (CLF), extended with additional fields.
@ -189,41 +188,57 @@ To write JSON format logs, specify `json` as the format:
format = "json" format = "json"
``` ```
## Entrypoints definition ## Entry Points Definition
```toml ```toml
# Entrypoints definition # Entrypoints definition
# #
# Optional
# Default: # Default:
# [entryPoints] # [entryPoints]
# [entryPoints.http] # [entryPoints.http]
# address = ":80" # address = ":80"
# #
[entryPoints]
[entryPoints.http]
address = ":80"
```
### Redirect HTTP to HTTPS
```toml
# To redirect an http entrypoint to an https entrypoint (with SNI support): # To redirect an http entrypoint to an https entrypoint (with SNI support):
# [entryPoints]
# [entryPoints.http]
# address = ":80"
# [entryPoints.http.redirect]
# entryPoint = "https"
# [entryPoints.https]
# address = ":443"
# [entryPoints.https.tls]
# [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.com.cert"
# KeyFile = "integration/fixtures/https/snitest.com.key"
# [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.org.cert"
# KeyFile = "integration/fixtures/https/snitest.org.key"
# #
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
[[entryPoints.https.tls.certificates]]
CertFile = "integration/fixtures/https/snitest.com.cert"
KeyFile = "integration/fixtures/https/snitest.com.key"
[[entryPoints.https.tls.certificates]]
CertFile = "integration/fixtures/https/snitest.org.cert"
KeyFile = "integration/fixtures/https/snitest.org.key"
```
### Rewriting URL
```toml
# To redirect an entrypoint rewriting the URL: # To redirect an entrypoint rewriting the URL:
# [entryPoints] [entryPoints]
# [entryPoints.http] [entryPoints.http]
# address = ":80" address = ":80"
# [entryPoints.http.redirect] [entryPoints.http.redirect]
# regex = "^http://localhost/(.*)" regex = "^http://localhost/(.*)"
# replacement = "http://mydomain/$1" replacement = "http://mydomain/$1"
# ```
### TLS Mutual Authentication
```toml
# Only accept clients that present a certificate signed by a specified # Only accept clients that present a certificate signed by a specified
# Certificate Authority (CA) # Certificate Authority (CA)
# ClientCAFiles can be configured with multiple CA:s in the same file or # ClientCAFiles can be configured with multiple CA:s in the same file or
@ -232,78 +247,101 @@ To write JSON format logs, specify `json` as the format:
# The requirement will apply to all server certs in the entrypoint # The requirement will apply to all server certs in the entrypoint
# In the example below both snitest.com and snitest.org will require client certs # In the example below both snitest.com and snitest.org will require client certs
# #
# [entryPoints] [entryPoints]
# [entryPoints.https] [entryPoints.https]
# address = ":443" address = ":443"
# [entryPoints.https.tls] [entryPoints.https.tls]
# ClientCAFiles = ["tests/clientca1.crt", "tests/clientca2.crt"] ClientCAFiles = ["tests/clientca1.crt", "tests/clientca2.crt"]
# [[entryPoints.https.tls.certificates]] [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.com.cert" CertFile = "integration/fixtures/https/snitest.com.cert"
# KeyFile = "integration/fixtures/https/snitest.com.key" KeyFile = "integration/fixtures/https/snitest.com.key"
# [[entryPoints.https.tls.certificates]] [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.org.cert" CertFile = "integration/fixtures/https/snitest.org.cert"
# KeyFile = "integration/fixtures/https/snitest.org.key" KeyFile = "integration/fixtures/https/snitest.org.key"
# ```
### Basic & Digest Authentication
```toml
# To enable basic auth on an entrypoint # To enable basic auth on an entrypoint
#
# with 2 user/pass: test:test and test2:test2 # with 2 user/pass: test:test and test2:test2
# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones # Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones.
# Users can be specified directly in the toml file, or indirectly by referencing an external file; if both are provided, the two are merged, with external file contents having precedence # Users can be specified directly in the toml file, or indirectly by referencing an external file;
# [entryPoints] # if both are provided, the two are merged, with external file contents having precedence.
# [entryPoints.http]
# address = ":80"
# [entryPoints.http.auth.basic]
# users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
# usersFile = "/path/to/.htpasswd"
#
# To enable digest auth on an entrypoint
# with 2 user/realm/pass: test:traefik:test and test2:traefik:test2
# You can use htdigest to generate those ones
# Users can be specified directly in the toml file, or indirectly by referencing an external file; if both are provided, the two are merged, with external file contents having precedence
# [entryPoints]
# [entryPoints.http]
# address = ":80"
# [entryPoints.http.auth.basic]
# users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
# usersFile = "/path/to/.htdigest"
#
# To specify an https entrypoint with a minimum TLS version, and specifying an array of cipher suites (from crypto/tls):
# [entryPoints]
# [entryPoints.https]
# address = ":443"
# [entryPoints.https.tls]
# MinVersion = "VersionTLS12"
# CipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"]
# [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.com.cert"
# KeyFile = "integration/fixtures/https/snitest.com.key"
# [[entryPoints.https.tls.certificates]]
# CertFile = "integration/fixtures/https/snitest.org.cert"
# KeyFile = "integration/fixtures/https/snitest.org.key"
# To enable compression support using gzip format:
# [entryPoints]
# [entryPoints.http]
# address = ":80"
# compress = true
# To enable IP whitelisting at the entrypoint level:
# [entryPoints]
# [entryPoints.http]
# address = ":80"
# whiteListSourceRange = ["127.0.0.1/32"]
# To enable ProxyProtocol support (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt):
# [entryPoints]
# [entryPoints.http]
# address = ":80"
# proxyprotocol = true
[entryPoints] [entryPoints]
[entryPoints.http] [entryPoints.http]
address = ":80" address = ":80"
[entryPoints.http.auth.basic]
users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
usersFile = "/path/to/.htpasswd"
``` ```
## Retry configuration ```toml
# To enable digest auth on an entrypoint
#
# with 2 user/realm/pass: test:traefik:test and test2:traefik:test2
# You can use htdigest to generate those ones
# Users can be specified directly in the toml file, or indirectly by referencing an external file;
# if both are provided, the two are merged, with external file contents having precedence
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.auth.basic]
users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
usersFile = "/path/to/.htdigest"
```
### Specify Minimum TLS Version
```toml
# To specify an https entrypoint with a minimum TLS version,
# and specifying an array of cipher suites (from crypto/tls):
[entryPoints]
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
MinVersion = "VersionTLS12"
CipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"]
[[entryPoints.https.tls.certificates]]
CertFile = "integration/fixtures/https/snitest.com.cert"
KeyFile = "integration/fixtures/https/snitest.com.key"
[[entryPoints.https.tls.certificates]]
CertFile = "integration/fixtures/https/snitest.org.cert"
KeyFile = "integration/fixtures/https/snitest.org.key"
```
### Compression
```toml
# To enable compression support using gzip format:
[entryPoints]
[entryPoints.http]
address = ":80"
compress = true
```
### Whitelisting
```toml
# To enable IP whitelisting at the entrypoint level:
[entryPoints]
[entryPoints.http]
address = ":80"
whiteListSourceRange = ["127.0.0.1/32"]
```
### ProxyProtocol Support
```toml
# To enable ProxyProtocol support (https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt):
[entryPoints]
[entryPoints.http]
address = ":80"
proxyprotocol = true
```
## Retry Configuration
```toml ```toml
# Enable retry sending request if network error # Enable retry sending request if network error
@ -320,7 +358,8 @@ To write JSON format logs, specify `json` as the format:
# attempts = 3 # attempts = 3
``` ```
## Health check configuration ## Health Check Configuration
```toml ```toml
# Enable custom health check options. # Enable custom health check options.
# #
@ -341,8 +380,9 @@ To write JSON format logs, specify `json` as the format:
# interval = "30s" # interval = "30s"
``` ```
## Responding timeouts ## Responding Timeouts
```
```toml
# respondingTimeouts are timeouts for incoming requests to the Traefik instance. # respondingTimeouts are timeouts for incoming requests to the Traefik instance.
# #
# Optional # Optional
@ -382,8 +422,9 @@ To write JSON format logs, specify `json` as the format:
``` ```
## Forwarding timeouts ## Forwarding Timeouts
```
```toml
# forwardingTimeouts are timeouts for requests forwarded to the backend servers. # forwardingTimeouts are timeouts for requests forwarded to the backend servers.
# #
# Optional # Optional

Binary file not shown.

Before

Width:  |  Height:  |  Size: 100 KiB

After

Width:  |  Height:  |  Size: 52 KiB

View file

@ -2,7 +2,7 @@
<img src="img/traefik.logo.png" alt="Træfik" title="Træfik" /> <img src="img/traefik.logo.png" alt="Træfik" title="Træfik" />
</p> </p>
[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/add-ldez-maintainers/shields_badge.svg)](https://semaphoreci.com/containous/traefik) [![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io) [![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io)
[![Go Report Card](https://goreportcard.com/badge/kubernetes/helm)](http://goreportcard.com/report/containous/traefik) [![Go Report Card](https://goreportcard.com/badge/kubernetes/helm)](http://goreportcard.com/report/containous/traefik)
[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)

View file

@ -16,5 +16,6 @@ Please refer to [this section](/user-guide/kv-config/#store-configuration-in-key
Once your Træfik configuration is uploaded on your KV store, you can start each Træfik instance. Once your Træfik configuration is uploaded on your KV store, you can start each Træfik instance.
A Træfik cluster is based on a manager/worker model. A Træfik cluster is based on a manager/worker model.
When starting, Træfik will elect a manager. If this instance fails, another manager will be automatically elected. When starting, Træfik will elect a manager.
If this instance fails, another manager will be automatically elected.

View file

@ -1,4 +1,3 @@
# Examples # Examples
You will find here some configuration examples of Træfik. You will find here some configuration examples of Træfik.

View file

@ -1,11 +1,20 @@
# Docker & Traefik # Docker & Traefik
In this use case, we want to use Traefik as a *layer-7* load balancer with SSL termination for a set of microservices used to run a webapplication. We also want to automatically *discover any services* on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly. In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname.
## Setting up In this use case, we want to use Traefik as a _layer-7_ load balancer with SSL termination for a set of micro-services used to run a web application.
In order for this to work, you'll need a server with a public IP address, with Docker installed on it. In this example, we're using the fictitious domain *my-awesome-app.org*. In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address. We also want to automatically _discover any services_ on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly.
In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname.
## Setting Up
In order for this to work, you'll need a server with a public IP address, with Docker installed on it.
In this example, we're using the fictitious domain _my-awesome-app.org_.
In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address.
## Networking ## Networking
Docker containers can only communicate with each other over TCP when they share at least one network. This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers *unless you'd want to*. In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in.
Docker containers can only communicate with each other over TCP when they share at least one network.
This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers _unless you'd want to_.
In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in.
On the Docker host, run the following command: On the Docker host, run the following command:
@ -23,7 +32,8 @@ $ touch /opt/traefik/acme.json && chmod 600 /opt/traefik/acme.json
$ touch /opt/traefik/traefik.toml $ touch /opt/traefik/traefik.toml
``` ```
The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik. The contents of the file is as follows: The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik.
The contents of the file is as follows:
```yaml ```yaml
version: '2' version: '2'
@ -48,8 +58,11 @@ networks:
external: true external: true
``` ```
As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container. Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down). As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container.
Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted). We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on. Finally, we're giving this container a static name called `traefik`. Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down).
Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted).
We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on.
Finally, we're giving this container a static name called `traefik`.
Let's take a look at a simply `traefik.toml` configuration as well before we'll create the Traefik container: Let's take a look at a simply `traefik.toml` configuration as well before we'll create the Traefik container:
@ -87,16 +100,17 @@ This is the minimum configuration required to do the following:
- Log `ERROR`-level messages (or more severe) to the console, but silence `DEBUG`-level messagse - Log `ERROR`-level messages (or more severe) to the console, but silence `DEBUG`-level messagse
- Check for new versions of Traefik periodically - Check for new versions of Traefik periodically
- Create two entrypoints, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`. - Create two entry points, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`.
- Enable the Docker configuration backend and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Traefik by default, we'll get into this in a bit!** - Enable the Docker configuration backend and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Traefik by default, we'll get into this in a bit!**
- Enable automatic request and configuration of SSL certificates using Let's Encrypt. These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises. - Enable automatic request and configuration of SSL certificates using Let's Encrypt. These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises.
Alright, let's boot the container. From the `/opt/traefik` directory, run `$ docker-compose up -d` which will create and start the Traefik container. Alright, let's boot the container. From the `/opt/traefik` directory, run `$ docker-compose up -d` which will create and start the Traefik container.
## Exposing your webservices to the outside world ## Exposing Web Services to the Outside World
Now that we've fully configured and started Traefik, it's time to get our applications running! Now that we've fully configured and started Traefik, it's time to get our applications running!
Let's take a simple example of a microservice project consisting of various services, where some will be exposed to the outside world and some will not. The `docker-compose.yml` of our project looks like this: Let's take a simple example of a micro-service project consisting of various services, where some will be exposed to the outside world and some will not. The `docker-compose.yml` of our project looks like this:
```yaml ```yaml
version: "2.1" version: "2.1"
@ -155,10 +169,17 @@ networks:
external: true external: true
``` ```
Here, we can see a set of services with two applications that we're actually exposing to the outside world. Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks. Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document. Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers. Here, we can see a set of services with two applications that we're actually exposing to the outside world.
Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks.
Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document.
Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers.
### Labels ### Labels
As mentioned earlier, we don't want containers exposed automatically by Traefik. The reason behind this is simple: we want to have control over this process ourselves. Thanks to Docker labels, we can tell Traefik how to create it's internal routing configuration. Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000:
As mentioned earlier, we don't want containers exposed automatically by Traefik.
The reason behind this is simple: we want to have control over this process ourselves.
Thanks to Docker labels, we can tell Traefik how to create it's internal routing configuration.
Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000:
```yaml ```yaml
- "traefik.backend=my-awesome-app-app" - "traefik.backend=my-awesome-app-app"
@ -168,14 +189,25 @@ As mentioned earlier, we don't want containers exposed automatically by Traefik.
- "traefik.port=9000" - "traefik.port=9000"
``` ```
First, we specify the `backend` name which corresponds to the actual service we're routing **to**. We also tell Traefik to use the `web` network to route HTTP traffic to this container. With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`. Essentially, this is the actual rule used for Layer-7 load balancing. With the `traefik.enable` label, we tell Traefik to include this container in it's internal configuration. Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on. First, we specify the `backend` name which corresponds to the actual service we're routing **to**.
We also tell Traefik to use the `web` network to route HTTP traffic to this container. With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`.
Essentially, this is the actual rule used for Layer-7 load balancing.
With the `traefik.enable` label, we tell Traefik to include this container in it's internal configuration.
Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on.
#### Gotchas and tips #### Gotchas and tips
- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label. If a container exposes multiple ports, Traefik may forward traffic to the wrong port. Even if a container only exposes one port, you should always write configuration defensively and explicitly.
- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see. Usually, this is a bad idea. - Always specify the correct port where the container expects HTTP traffic using `traefik.port` label.
If a container exposes multiple ports, Traefik may forward traffic to the wrong port.
Even if a container only exposes one port, you should always write configuration defensively and explicitly.
- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see.
Usually, this is a bad idea.
- With the `traefik.frontend.auth.basic` label, it's possible for Traefik to provide a HTTP basic-auth challenge for the endpoints you provide the label for. - With the `traefik.frontend.auth.basic` label, it's possible for Traefik to provide a HTTP basic-auth challenge for the endpoints you provide the label for.
- Traefik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics - Traefik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics
- Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol. Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS) - Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol.
Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS)
### Final thoughts ### Final thoughts
Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, performant and self-configuring solution for your projects. With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well.
Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, performant and self-configuring solution for your projects.
With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well.

View file

@ -14,11 +14,9 @@ on your machine, as it is the quickest way to get a local Kubernetes cluster set
### Role Based Access Control configuration (Kubernetes 1.6+ only) ### Role Based Access Control configuration (Kubernetes 1.6+ only)
Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/admin/authorization/rbac/) in 1.6+ to allow fine-grained control of Kubernetes resources and api.
of Kubernetes resources and api.
If your cluster is configured with RBAC, you may need to authorize Træfik to use the If your cluster is configured with RBAC, you may need to authorize Træfik to use the Kubernetes API using ClusterRole and ClusterRoleBinding resources:
Kubernetes API using ClusterRole and ClusterRoleBinding resources:
_Note: your cluster may have suitable ClusterRoles already setup, but the following should work everywhere_ _Note: your cluster may have suitable ClusterRoles already setup, but the following should work everywhere_
@ -71,20 +69,15 @@ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/exa
## Deploy Træfik using a Deployment or DaemonSet ## Deploy Træfik using a Deployment or DaemonSet
It is possible to use Træfik with a It is possible to use Træfik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object,
[Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) whereas both options have their own pros and cons:
or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DeaemonSet.
object, whereas both options have their own pros and cons: The scalability is much better when It is possible to exclusively run a Service on a dedicated set of machines using taints and tolerations with a DaemonSet.
using a Deployment, because you will have a Single-Pod-per-Node model when using On the other hand the DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with a Deployment.
the DeaemonSet. It is possible to exclusively run a Service on a dedicated
set of machines using taints and tolerations with a DaemonSet. On the other hand the
DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a
[Service](https://kubernetes.io/docs/concepts/services-networking/service/) object
with a Deployment.
The Deployment objects looks like this: The Deployment objects looks like this:
```yaml ```yml
--- ---
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
@ -207,10 +200,11 @@ $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/e
$ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml $ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml
``` ```
There are some significant differences between using Deployments and DaemonSets. The Deployment has easier There are some significant differences between using Deployments and DaemonSets.
up and down scaling possibilities. It can implement full pod lifecycle and supports rolling updates from The Deployment has easier up and down scaling possibilities. It can implement full pod lifecycle and supports rolling updates from Kubernetes 1.2.
Kubernetes 1.2. At least one Pod is needed to run the Deployment. The DaemonSet automatically scales to all nodes that At least one Pod is needed to run the Deployment.
meets a specific selector and guarantees to fill nodes one at a time. Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well. The DaemonSet automatically scales to all nodes that meets a specific selector and guarantees to fill nodes one at a time.
Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well.
@ -229,24 +223,21 @@ kubernetes-dashboard-s8krj 1/1 Running 0 4h
traefik-ingress-controller-678226159-eqseo 1/1 Running 0 7m traefik-ingress-controller-678226159-eqseo 1/1 Running 0 7m
``` ```
You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched a Pod, and it is now running.
a Pod, and it is now running. _It might take a few moments for kubernetes to pull _It might take a few moments for kubernetes to pull the Træfik image and start the container._
the Træfik image and start the container._
> You could also check the deployment with the Kubernetes dashboard, run > You could also check the deployment with the Kubernetes dashboard, run
> `minikube dashboard` to open it in your browser, then choose the `kube-system` > `minikube dashboard` to open it in your browser, then choose the `kube-system`
> namespace from the menu at the top right of the screen. > namespace from the menu at the top right of the screen.
You should now be able to access Træfik on port 80 of your Minikube instance when using You should now be able to access Træfik on port 80 of your Minikube instance when using the DaemonSet:
the DaemonSet:
```sh ```sh
curl $(minikube ip) curl $(minikube ip)
404 page not found 404 page not found
``` ```
If you decided to use the deployment, then you need to target the correct NodePort, which can If you decided to use the deployment, then you need to target the correct NodePort, which can be seen then you execute `kubectl get services --namespace=kube-system`.
be seen then you execute `kubectl get services --namespace=kube-system`.
```sh ```sh
curl $(minikube ip):<NODEPORT> curl $(minikube ip):<NODEPORT>
@ -257,10 +248,8 @@ curl $(minikube ip):<NODEPORT>
## Deploy Træfik using Helm Chart ## Deploy Træfik using Helm Chart
Instead of installing Træfik via an own object, you can also use the Træfik Helm chart. This Instead of installing Træfik via an own object, you can also use the Træfik Helm chart.
allows more complex configuration via Kubernetes This allows more complex configuration via Kubernetes [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/) and enabled TLS certificates.
[ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/) and enabled
TLS certificates.
Install Træfik chart by: Install Træfik chart by:
@ -272,8 +261,7 @@ For more information, check out [the doc](https://github.com/kubernetes/charts/t
## Submitting An Ingress to the cluster. ## Submitting An Ingress to the cluster.
Lets start by creating a Service and an Ingress that will expose the Lets start by creating a Service and an Ingress that will expose the [Træfik Web UI](https://github.com/containous/traefik#web-ui).
[Træfik Web UI](https://github.com/containous/traefik#web-ui).
```yaml ```yaml
apiVersion: v1 apiVersion: v1
@ -310,8 +298,7 @@ spec:
kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/ui.yaml kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/ui.yaml
``` ```
Now lets setup an entry in our /etc/hosts file to route `traefik-ui.minikube` Now lets setup an entry in our /etc/hosts file to route `traefik-ui.minikube` to our cluster.
to our cluster.
> In production you would want to set up real dns entries. > In production you would want to set up real dns entries.
@ -325,8 +312,7 @@ We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube)
## Name based routing ## Name based routing
In this example we are going to setup websites for 3 of the United Kingdoms In this example we are going to setup websites for 3 of the United Kingdoms best loved cheeses, Cheddar, Stilton and Wensleydale.
best loved cheeses, Cheddar, Stilton and Wensleydale.
First lets start by launching the 3 pods for the cheese websites. First lets start by launching the 3 pods for the cheese websites.
@ -534,12 +520,9 @@ spec:
kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml
``` ```
Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host. Along with a backend listing for each service with a Server set up for each pod.
see a frontend for each host. Along with a backend listing for each service
with a Server set up for each pod.
If you edit your `/etc/hosts` again you should be able to access the cheese If you edit your `/etc/hosts` again you should be able to access the cheese websites in your browser.
websites in your browser.
```shell ```shell
echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | sudo tee -a /etc/hosts echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | sudo tee -a /etc/hosts
@ -551,9 +534,7 @@ echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | s
## Path based routing ## Path based routing
Now lets suppose that our fictional client has decided that while they are Now lets suppose that our fictional client has decided that while they are super happy about our cheesy web design, when they asked for 3 websites they had not really bargained on having to buy 3 domain names.
super happy about our cheesy web design, when they asked for 3 websites
they had not really bargained on having to buy 3 domain names.
No problem, we say, why don't we reconfigure the sites to host all 3 under one domain. No problem, we say, why don't we reconfigure the sites to host all 3 under one domain.
@ -646,7 +627,8 @@ spec:
## Forwarding to ExternalNames ## Forwarding to ExternalNames
When specifying an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors), When specifying an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors),
Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443. This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port. Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443.
This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port.
## Disable passing the Host header ## Disable passing the Host header
@ -663,8 +645,7 @@ disablePassHostHeaders = true
### Disable per ingress ### Disable per ingress
To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` annotation on your ingress to `false`.
annotation on your ingress to `false`.
Here is an example ingress definition: Here is an example ingress definition:
```yaml ```yaml
@ -700,9 +681,7 @@ spec:
externalName: static.otherdomain.com externalName: static.otherdomain.com
``` ```
If you were to visit example.com/static the request would then be passed onto If you were to visit `example.com/static` the request would then be passed onto `static.otherdomain.com/static` and s`tatic.otherdomain.com` would receive the request with the Host header being `static.otherdomain.com`.
static.otherdomain.com/static and static.otherdomain.com would receive the
request with the Host header being static.otherdomain.com.
Note: The per ingress annotation overides whatever the global value is set to. Note: The per ingress annotation overides whatever the global value is set to.
So you could set `disablePassHostHeaders` to `true` in your toml file and then enable passing So you could set `disablePassHostHeaders` to `true` in your toml file and then enable passing

View file

@ -1,4 +1,3 @@
# Key-value store configuration # Key-value store configuration
Both [static global configuration](/user-guide/kv-config/#static-configuration-in-key-value-store) and [dynamic](/user-guide/kv-config/#dynamic-configuration-in-key-value-store) configuration can be sorted in a Key-value store. Both [static global configuration](/user-guide/kv-config/#static-configuration-in-key-value-store) and [dynamic](/user-guide/kv-config/#dynamic-configuration-in-key-value-store) configuration can be sorted in a Key-value store.
@ -12,7 +11,7 @@ Træfik supports several Key-value stores:
- [ZooKeeper](https://zookeeper.apache.org/) - [ZooKeeper](https://zookeeper.apache.org/)
- [boltdb](https://github.com/boltdb/bolt) - [boltdb](https://github.com/boltdb/bolt)
# Static configuration in Key-value store ## Static configuration in Key-value store
We will see the steps to set it up with an easy example. We will see the steps to set it up with an easy example.
Note that we could do the same with any other Key-value Store. Note that we could do the same with any other Key-value Store.

View file

@ -1,4 +1,3 @@
# Marathon # Marathon
This guide explains how to integrate Marathon and operate the cluster in a reliable way from Traefik's standpoint. This guide explains how to integrate Marathon and operate the cluster in a reliable way from Traefik's standpoint.

View file

@ -73,11 +73,9 @@ docker-machine ssh manager "docker network create --driver=overlay traefik-net"
## Deploy Træfik ## Deploy Træfik
Let's deploy Træfik as a docker service in our cluster. The only Let's deploy Træfik as a docker service in our cluster.
requirement for Træfik to work with swarm mode is that it needs to run The only requirement for Træfik to work with swarm mode is that it needs to run on a manager node — we are going to use a
on a manager node — we are going to use a [constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for that.
[constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for
that.
```shell ```shell
docker-machine ssh manager "docker service create \ docker-machine ssh manager "docker service create \
@ -96,24 +94,17 @@ docker-machine ssh manager "docker service create \
Let's explain this command: Let's explain this command:
- `--publish 80:80 --publish 8080:8080`: we publish port `80` and - `--publish 80:80 --publish 8080:8080`: we publish port `80` and `8080` on the cluster.
`8080` on the cluster. - `--constraint=node.role==manager`: we ask docker to schedule Træfik on a manager node.
- `--constraint=node.role==manager`: we ask docker to schedule Træfik
on a manager node.
- `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock`: - `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock`:
we bind mount the docker socket where Træfik is scheduled to be able we bind mount the docker socket where Træfik is scheduled to be able to speak to the daemon.
to speak to the daemon. - `--network traefik-net`: we attach the Træfik service (and thus the underlying container) to the `traefik-net` network.
- `--network traefik-net`: we attach the Træfik service (and thus - `--docker`: enable docker backend, and `--docker.swarmmode` to enable the swarm mode on Træfik.
the underlying container) to the `traefik-net` network.
- `--docker`: enable docker backend, and `--docker.swarmmode` to
enable the swarm mode on Træfik.
- `--web`: activate the webUI on port 8080 - `--web`: activate the webUI on port 8080
## Deploy your apps ## Deploy your apps
We can now deploy our app on the cluster, We can now deploy our app on the cluster, here [whoami](https://github.com/emilevauge/whoami), a simple web server in Go. We start 2 services, on the `traefik-net` network.
here [whoami](https://github.com/emilevauge/whoami), a simple web
server in Go. We start 2 services, on the `traefik-net` network.
```shell ```shell
docker-machine ssh manager "docker service create \ docker-machine ssh manager "docker service create \
@ -184,8 +175,7 @@ X-Forwarded-Proto: http
X-Forwarded-Server: 8fbc39271b4c X-Forwarded-Server: 8fbc39271b4c
``` ```
Note that as Træfik is published, you can access it from any machine Note that as Træfik is published, you can access it from any machine and not only the manager.
and not only the manager.
```shell ```shell
curl -H Host:whoami0.traefik http://$(docker-machine ip worker1) curl -H Host:whoami0.traefik http://$(docker-machine ip worker1)
@ -245,7 +235,8 @@ dtpl249tfghc traefik 1/1 traefik --docker --docker.swarmmode
``` ```
## Access to your whoami0 through Træfik multiple times. ## Access to your whoami0 through Træfik multiple times.
Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks. Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks:
```shell ```shell
curl -H Host:whoami0.traefik http://$(docker-machine ip manager) curl -H Host:whoami0.traefik http://$(docker-machine ip manager)
Hostname: 8147a7746e7a Hostname: 8147a7746e7a
@ -266,7 +257,8 @@ X-Forwarded-Proto: http
X-Forwarded-Server: 8fbc39271b4c X-Forwarded-Server: 8fbc39271b4c
``` ```
Do the same against whoami1. Do the same against whoami1:
```shell ```shell
curl -H Host:whoami1.traefik http://$(docker-machine ip manager) curl -H Host:whoami1.traefik http://$(docker-machine ip manager)
Hostname: ba2c21488299 Hostname: ba2c21488299
@ -289,6 +281,7 @@ X-Forwarded-Server: 8fbc39271b4c
Wait, I thought we added the sticky flag to whoami1? Traefik relies on a cookie to maintain stickyness so you'll need to test this with a browser. Wait, I thought we added the sticky flag to whoami1? Traefik relies on a cookie to maintain stickyness so you'll need to test this with a browser.
First you need to add whoami1.traefik to your hosts file: First you need to add whoami1.traefik to your hosts file:
```ssh ```ssh
if [ -n "$(grep whoami1.traefik /etc/hosts)" ]; if [ -n "$(grep whoami1.traefik /etc/hosts)" ];
then then

View file

@ -45,30 +45,29 @@ extra_css:
pages: pages:
- Getting Started: index.md - Getting Started: index.md
- Basics: basics.md - Basics: basics.md
- Configration: - Configuration:
- 'traefik.toml': 'configuration/toml.md' - 'Commons': 'configuration/commons.md'
- 'Let''s Encrypt': 'configuration/acme.md' - 'Let''s Encrypt': 'configuration/acme.md'
- Backends: - 'Web Backend': 'configuration/backends/web.md'
- 'API backend': 'backends/api.md' - 'BoltDB Backend': 'configuration/backends/boltdb.md'
- 'BoltDB backend': 'backends/boltdb.md' - 'Consul Backend': 'configuration/backends/consul.md'
- 'Consul backend': 'backends/consul.md' - 'Docker Backend': 'configuration/backends/docker.md'
- 'Docker backend': 'backends/docker.md' - 'DynamoDB Backend': 'configuration/backends/dynamodb.md'
- 'DynamoDB backend': 'backends/dynamodb.md' - 'ECS Backend': 'configuration/backends/ecs.md'
- 'ECS backend': 'backends/ecs.md' - 'Etcd Backend': 'configuration/backends/etcd.md'
- 'Etcd backend': 'backends/etcd.md' - 'Eureka Backend': 'configuration/backends/eureka.md'
- 'Eureka backend': 'backends/eureka.md' - 'File Backend': 'configuration/backends/file.md'
- 'File backend': 'backends/file.md' - 'Kubernetes Ingress Backend': 'configuration/backends/kubernetes.md'
- 'Kubernetes Ingress backend': 'backends/kubernetes.md' - 'Marathon Backend': 'configuration/backends/marathon.md'
- 'Marathon backend': 'backends/marathon.md' - 'Rancher Backend': 'configuration/backends/rancher.md'
- 'Rancher backend': 'backends/rancher.md' - 'Zookeeper Backend': 'configuration/backends/zookeeper.md'
- 'Zookeeper backend': 'backends/zookeeper.md'
- User Guide: - User Guide:
- 'Configuration examples': 'user-guide/examples.md' - 'Configuration Examples': 'user-guide/examples.md'
- 'Swarm cluster': 'user-guide/swarm.md' - 'Swarm Cluster': 'user-guide/swarm.md'
- 'Swarm mode cluster': 'user-guide/swarm-mode.md' - 'Swarm Mode Cluster': 'user-guide/swarm-mode.md'
- 'Kubernetes': 'user-guide/kubernetes.md' - 'Kubernetes': 'user-guide/kubernetes.md'
- 'Marathon': 'user-guide/marathon.md' - 'Marathon': 'user-guide/marathon.md'
- 'Key-value store configuration': 'user-guide/kv-config.md' - 'Key-value Store Configuration': 'user-guide/kv-config.md'
- 'Clustering/HA': 'user-guide/cluster.md' - 'Clustering/HA': 'user-guide/cluster.md'
- 'Getting started with Docker & Lets Encrypt': 'user-guide/getting-started-with-docker-and-lets-encrypt.md' - 'Getting Started with Docker & Lets Encrypt': 'user-guide/getting-started-with-docker-and-lets-encrypt.md'
- Benchmarks: benchmarks.md - Benchmarks: benchmarks.md

View file

@ -359,7 +359,7 @@ func (p *CatalogProvider) getConstraintTags(tags []string) []string {
var list []string var list []string
for _, tag := range tags { for _, tag := range tags {
// If 'AllTagsConstraintFiltering' is disabled, we look for a Consul tag named 'traefik.tags' (unless different 'prefix' is configured) // We look for a Consul tag named 'traefik.tags' (unless different 'prefix' is configured)
if strings.Index(strings.ToLower(tag), p.getPrefixedName("tags=")) == 0 { if strings.Index(strings.ToLower(tag), p.getPrefixedName("tags=")) == 0 {
// If 'traefik.tags=' tag is found, take the tag value and split by ',' adding the result to the list to be returned // If 'traefik.tags=' tag is found, take the tag value and split by ',' adding the result to the list to be returned
splitedTags := strings.Split(tag[len(p.getPrefixedName("tags=")):], ",") splitedTags := strings.Split(tag[len(p.getPrefixedName("tags=")):], ",")

View file

@ -22,7 +22,7 @@ import (
const resyncPeriod = time.Minute * 5 const resyncPeriod = time.Minute * 5
// Client is a client for the Provider master. // Client is a client for the Provider master.
// WatchAll starts the watch of the Provider ressources and updates the stores. // WatchAll starts the watch of the Provider resources and updates the stores.
// The stores can then be accessed via the Get* functions. // The stores can then be accessed via the Get* functions.
type Client interface { type Client interface {
GetIngresses(namespaces Namespaces) []*v1beta1.Ingress GetIngresses(namespaces Namespaces) []*v1beta1.Ingress

View file

@ -36,7 +36,7 @@
# Access logs file # Access logs file
# #
# Optional # Optional
# Deprecated - see [accessLog] lower down # DEPRECATED - see [accessLog] lower down
# #
# accessLogsFile = "log/access.log" # accessLogsFile = "log/access.log"
@ -433,6 +433,7 @@
# #
# responseHeaderTimeout = "0s" # responseHeaderTimeout = "0s"
################################################################ ################################################################
# Web configuration backend # Web configuration backend
################################################################ ################################################################
@ -455,21 +456,31 @@
# #
# CertFile = "traefik.crt" # CertFile = "traefik.crt"
# KeyFile = "traefik.key" # KeyFile = "traefik.key"
#
# Set REST API to read-only mode # Set REST API to read-only mode
# #
# Optional # Optional
# ReadOnly = false # ReadOnly = false
#
# Enable more detailed statistics # Enable more detailed statistics
# [web.statistics] # [web.statistics]
# RecentErrors = 10 # RecentErrors = 10
#
# To enable Traefik to export internal metrics to Prometheus # To enable Traefik to export internal metrics to Prometheus
# [web.metrics.prometheus] # [web.metrics.prometheus]
# Buckets=[0.1,0.3,1.2,5.0] # Buckets=[0.1,0.3,1.2,5.0]
# #
# DataDog metrics exporter type
# [web.metrics.datadog]
# Address = "localhost:8125"
# Pushinterval = "10s"
# StatsD metrics exporter type
# [web.metrics.statsd]
# Address = "localhost:8125"
# Pushinterval = "10s"
# To enable basic auth on the webui # To enable basic auth on the webui
# with 2 user/pass: test:test and test2:test2 # with 2 user/pass: test:test and test2:test2
# Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones # Passwords can be encoded in MD5, SHA1 and BCrypt: you can use htpasswd to generate those ones
@ -511,7 +522,6 @@
# #
# directory = "/path/to/config/" # directory = "/path/to/config/"
# Enable watch file changes # Enable watch file changes
# #
# Optional # Optional
@ -572,7 +582,6 @@
# insecureskipverify = true # insecureskipverify = true
################################################################ ################################################################
# Docker Swarmmode configuration backend # Docker Swarmmode configuration backend
################################################################ ################################################################
@ -693,16 +702,12 @@
# #
# groupsAsSubDomains = true # groupsAsSubDomains = true
# Override DialerTimeout # Enable compatibility with marathon-lb labels
# Amount of time to allow the Marathon provider to wait to open a TCP connection
# to a Marathon master.
# Can be provided in a format supported by Go's time.ParseDuration function or
# as raw values (digits). If no units are provided, the value is parsed assuming
# seconds.
# #
# Optional # Optional
# Default: "60s" # Default: false
# dialerTimeout = "60s" #
# marathonLBCompatibility = true
# Enable Marathon basic authentication # Enable Marathon basic authentication
# #
@ -712,16 +717,36 @@
# httpBasicAuthUser = "foo" # httpBasicAuthUser = "foo"
# httpBasicPassword = "bar" # httpBasicPassword = "bar"
# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
#
# Optional
#
# [marathon.TLS]
# CA = "/etc/ssl/ca.crt"
# Cert = "/etc/ssl/marathon.cert"
# Key = "/etc/ssl/marathon.key"
# InsecureSkipVerify = true
# DCOSToken for DCOS environment, This will override the Authorization header # DCOSToken for DCOS environment, This will override the Authorization header
# #
# Optional # Optional
# #
# dcosToken = "xxxxxx" # dcosToken = "xxxxxx"
# Override DialerTimeout
# Amount of time to allow the Marathon provider to wait to open a TCP connection
# to a Marathon master.
# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# values (digits). If no units are provided, the value is parsed assuming
# seconds.
#
# Optional
# Default: "60s"
# dialerTimeout = "60s"
# Set the TCP Keep Alive interval for the Marathon HTTP Client. # Set the TCP Keep Alive interval for the Marathon HTTP Client.
# Can be provided in a format supported by Go's time.ParseDuration function or # Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
# as raw values (digits). If no units are provided, the value is parsed assuming # values (digits). If no units are provided, the value is parsed assuming
# seconds. # seconds.
# #
# Optional # Optional
@ -751,6 +776,7 @@
# #
# respectReadinessChecks = false # respectReadinessChecks = false
################################################################ ################################################################
# Mesos configuration backend # Mesos configuration backend
################################################################ ################################################################
@ -830,6 +856,7 @@
# #
# StateTimeoutSecond = "30" # StateTimeoutSecond = "30"
################################################################ ################################################################
# Kubernetes Ingress configuration backend # Kubernetes Ingress configuration backend
################################################################ ################################################################
@ -881,9 +908,15 @@
# #
# namespaces = ["default"] # namespaces = ["default"]
# See: http://kubernetes.io/docs/user-guide/labels/#list-and-watch-filtering # Ingress label selector to identify Ingress objects that should be processed.
# See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors for details.
#
# Optional
# Default: empty (process all Ingresses)
#
# labelselector = "A and not B" # labelselector = "A and not B"
################################################################ ################################################################
# Consul KV configuration backend # Consul KV configuration backend
################################################################ ################################################################
@ -928,6 +961,7 @@
# key = "/etc/ssl/consul.key" # key = "/etc/ssl/consul.key"
# insecureskipverify = true # insecureskipverify = true
################################################################ ################################################################
# Consul Catalog configuration backend # Consul Catalog configuration backend
################################################################ ################################################################
@ -963,20 +997,16 @@
# prefix = "traefik" # prefix = "traefik"
# Default frontEnd Rule for Consul services # Default frontEnd Rule for Consul services
# - The format is a Go Template with ".ServiceName", ".Domain" and ".Attributes" available #
# -- "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available # The format is a Go Template with:
# --- "getAttribute(...)" function uses prefixed tag names based on "prefix" value # - ".ServiceName", ".Domain" and ".Attributes" available
# - "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available
# - "getAttribute(...)" function uses prefixed tag names based on "prefix" value
# #
# Optional # Optional
# #
#frontEndRule = "Host:{{.ServiceName}}.{{Domain}}" #frontEndRule = "Host:{{.ServiceName}}.{{Domain}}"
# Should use all Consul catalog tags for constraint filtering
#
# Optional
#
#allTagsConstraintFiltering = false
# Constraints # Constraints
# #
# Optional # Optional
@ -984,6 +1014,7 @@
# constraints = ["tag==api", "tag==he*ld"] # constraints = ["tag==api", "tag==he*ld"]
# Matching with containers having this tag: "traefik.tags=api,helloworld" # Matching with containers having this tag: "traefik.tags=api,helloworld"
################################################################ ################################################################
# Etcd configuration backend # Etcd configuration backend
################################################################ ################################################################
@ -1035,6 +1066,37 @@
# key = "/etc/ssl/etcd.key" # key = "/etc/ssl/etcd.key"
# insecureskipverify = true # insecureskipverify = true
################################################################
# Eureka configuration backend
################################################################
# Enable Eureka configuration backend
#
# Optional
#
# [eureka]
# Eureka server endpoint.
# endpoint := "http://my.eureka.server/eureka"
#
# Required
#
# endpoint = "http://my.eureka.server/eureka"
# Override default configuration time between refresh
#
# Optional
# default 30s
# delay = "1m"
# Override default configuration template. For advanced users :)
#
# Optional
#
# filename = "eureka.tmpl"
################################################################ ################################################################
# Zookeeper configuration backend # Zookeeper configuration backend
################################################################ ################################################################
@ -1117,7 +1179,7 @@
# ECS Cluster Name # ECS Cluster Name
# #
# Deprecated - Please use Clusters # DEPRECATED - Please use Clusters
# #
# Cluster = "default" # Cluster = "default"
@ -1135,6 +1197,13 @@
# #
# Watch = true # Watch = true
# Enable auto discover ECS clusters
#
# Optional
# Default: false
#
# AutoDiscoverClusters = false
# Polling interval (in seconds) # Polling interval (in seconds)
# #
# Optional # Optional
@ -1173,6 +1242,7 @@
# #
# filename = "ecs.tmpl" # filename = "ecs.tmpl"
################################################################ ################################################################
# Rancher configuration backend # Rancher configuration backend
################################################################ ################################################################
@ -1263,6 +1333,7 @@
# Required # Required
# SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" # SecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
################################################################ ################################################################
# DynamoDB configuration backend # DynamoDB configuration backend
################################################################ ################################################################

View file

@ -354,7 +354,7 @@ type Prometheus struct {
// Datadog contains address and metrics pushing interval configuration // Datadog contains address and metrics pushing interval configuration
type Datadog struct { type Datadog struct {
Address string `description:"DataDog's Dogstatsd address"` Address string `description:"DataDog's address"`
PushInterval string `description:"DataDog push interval"` PushInterval string `description:"DataDog push interval"`
} }