diff --git a/old/docs/CNAME b/old/docs/CNAME deleted file mode 100644 index f4446d431..000000000 --- a/old/docs/CNAME +++ /dev/null @@ -1 +0,0 @@ -docs.traefik.io \ No newline at end of file diff --git a/old/docs/benchmarks.md b/old/docs/benchmarks.md deleted file mode 100644 index 4565d0449..000000000 --- a/old/docs/benchmarks.md +++ /dev/null @@ -1,214 +0,0 @@ -# Benchmarks - -## Configuration - -I would like to thanks [vincentbernat](https://github.com/vincentbernat) from [exoscale.ch](https://www.exoscale.ch) who kindly provided the infrastructure needed for the benchmarks. - -I used 4 VMs for the tests with the following configuration: - -- 32 GB RAM -- 8 CPU Cores -- 10 GB SSD -- Ubuntu 14.04 LTS 64-bit - -## Setup - -1. One VM used to launch the benchmarking tool [wrk](https://github.com/wg/wrk) -2. One VM for Traefik (v1.0.0-beta.416) / nginx (v1.4.6) -3. Two VMs for 2 backend servers in go [whoami](https://github.com/containous/whoami/) - -Each VM has been tuned using the following limits: - -```bash -sysctl -w fs.file-max="9999999" -sysctl -w fs.nr_open="9999999" -sysctl -w net.core.netdev_max_backlog="4096" -sysctl -w net.core.rmem_max="16777216" -sysctl -w net.core.somaxconn="65535" -sysctl -w net.core.wmem_max="16777216" -sysctl -w net.ipv4.ip_local_port_range="1025 65535" -sysctl -w net.ipv4.tcp_fin_timeout="30" -sysctl -w net.ipv4.tcp_keepalive_time="30" -sysctl -w net.ipv4.tcp_max_syn_backlog="20480" -sysctl -w net.ipv4.tcp_max_tw_buckets="400000" -sysctl -w net.ipv4.tcp_no_metrics_save="1" -sysctl -w net.ipv4.tcp_syn_retries="2" -sysctl -w net.ipv4.tcp_synack_retries="2" -sysctl -w net.ipv4.tcp_tw_recycle="1" -sysctl -w net.ipv4.tcp_tw_reuse="1" -sysctl -w vm.min_free_kbytes="65536" -sysctl -w vm.overcommit_memory="1" -ulimit -n 9999999 -``` - -### Nginx - -Here is the config Nginx file use `/etc/nginx/nginx.conf`: - -``` -user www-data; -worker_processes auto; -worker_rlimit_nofile 200000; -pid /var/run/nginx.pid; - -events { - worker_connections 10000; - use epoll; - multi_accept on; -} - -http { - sendfile on; - tcp_nopush on; - tcp_nodelay on; - keepalive_timeout 300; - keepalive_requests 10000; - types_hash_max_size 2048; - - open_file_cache max=200000 inactive=300s; - open_file_cache_valid 300s; - open_file_cache_min_uses 2; - open_file_cache_errors on; - - server_tokens off; - dav_methods off; - - include /etc/nginx/mime.types; - default_type application/octet-stream; - - access_log /var/log/nginx/access.log combined; - error_log /var/log/nginx/error.log warn; - - gzip off; - gzip_vary off; - - include /etc/nginx/conf.d/*.conf; - include /etc/nginx/sites-enabled/*.conf; -} -``` - -Here is the Nginx vhost file used: - -``` -upstream whoami { - server IP-whoami1:80; - server IP-whoami2:80; - keepalive 300; -} - -server { - listen 8001; - server_name test.traefik; - access_log off; - error_log /dev/null crit; - if ($host != "test.traefik") { - return 404; - } - location / { - proxy_pass http://whoami; - proxy_http_version 1.1; - proxy_set_header Connection ""; - proxy_set_header X-Forwarded-Host $host; - } -} -``` - -### Traefik - -Here is the `traefik.toml` file used: - -```toml -maxIdleConnsPerHost = 100000 -defaultEntryPoints = ["http"] - -[entryPoints] - [entryPoints.http] - address = ":8000" - -[file] -[backends] - [backends.backend1] - [backends.backend1.servers.server1] - url = "http://IP-whoami1:80" - weight = 1 - [backends.backend1.servers.server2] - url = "http://IP-whoami2:80" - weight = 1 - -[frontends] - [frontends.frontend1] - backend = "backend1" - [frontends.frontend1.routes.test_1] - rule = "Host: test.traefik" -``` - -## Results - -### whoami: -```shell -wrk -t20 -c1000 -d60s -H "Host: test.traefik" --latency http://IP-whoami:80/bench -Running 1m test @ http://IP-whoami:80/bench - 20 threads and 1000 connections - Thread Stats Avg Stdev Max +/- Stdev - Latency 70.28ms 134.72ms 1.91s 89.94% - Req/Sec 2.92k 742.42 8.78k 68.80% - Latency Distribution - 50% 10.63ms - 75% 75.64ms - 90% 205.65ms - 99% 668.28ms - 3476705 requests in 1.00m, 384.61MB read - Socket errors: connect 0, read 0, write 0, timeout 103 -Requests/sec: 57894.35 -Transfer/sec: 6.40MB -``` - -### nginx: -```shell -wrk -t20 -c1000 -d60s -H "Host: test.traefik" --latency http://IP-nginx:8001/bench -Running 1m test @ http://IP-nginx:8001/bench - 20 threads and 1000 connections - Thread Stats Avg Stdev Max +/- Stdev - Latency 101.25ms 180.09ms 1.99s 89.34% - Req/Sec 1.69k 567.69 9.39k 72.62% - Latency Distribution - 50% 15.46ms - 75% 129.11ms - 90% 302.44ms - 99% 846.59ms - 2018427 requests in 1.00m, 298.36MB read - Socket errors: connect 0, read 0, write 0, timeout 90 -Requests/sec: 33591.67 -Transfer/sec: 4.97MB -``` - -### Traefik: - -```shell -wrk -t20 -c1000 -d60s -H "Host: test.traefik" --latency http://IP-traefik:8000/bench -Running 1m test @ http://IP-traefik:8000/bench - 20 threads and 1000 connections - Thread Stats Avg Stdev Max +/- Stdev - Latency 91.72ms 150.43ms 2.00s 90.50% - Req/Sec 1.43k 266.37 2.97k 69.77% - Latency Distribution - 50% 19.74ms - 75% 121.98ms - 90% 237.39ms - 99% 687.49ms - 1705073 requests in 1.00m, 188.63MB read - Socket errors: connect 0, read 0, write 0, timeout 7 -Requests/sec: 28392.44 -Transfer/sec: 3.14MB -``` - -## Conclusion - -Traefik is obviously slower than Nginx, but not so much: Traefik can serve 28392 requests/sec and Nginx 33591 requests/sec which gives a ratio of 85%. -Not bad for young project :) ! - -Some areas of possible improvements: - -- Use [GO_REUSEPORT](https://github.com/kavu/go_reuseport) listener -- Run a separate server instance per CPU core with `GOMAXPROCS=1` (it appears during benchmarks that there is a lot more context switches with Traefik than with nginx) - diff --git a/old/docs/configuration/api.md b/old/docs/configuration/api.md deleted file mode 100644 index 2d746afcb..000000000 --- a/old/docs/configuration/api.md +++ /dev/null @@ -1,347 +0,0 @@ -# API Definition - -## Configuration - -```toml -# API definition -# Warning: Enabling API will expose Traefik's configuration. -# It is not recommended in production, -# unless secured by authentication and authorizations -[api] - # Name of the related entry point - # - # Optional - # Default: "traefik" - # - entryPoint = "traefik" - - # Enable Dashboard - # - # Optional - # Default: true - # - dashboard = true - - # Enable debug mode. - # This will install HTTP handlers to expose Go expvars under /debug/vars and - # pprof profiling data under /debug/pprof/. - # Additionally, the log level will be set to DEBUG. - # - # Optional - # Default: false - # - debug = true -``` - -For more customization, see [entry points](/configuration/entrypoints/) documentation and the examples below. - -## Web UI - -![Web UI Providers](/img/web.frontend.png) - -![Web UI Health](/img/traefik-health.png) - -## Security - -Enabling the API will expose all configuration elements, -including sensitive data. - -It is not recommended in production, -unless secured by authentication and authorizations. - -A good sane default (but not exhaustive) set of recommendations -would be to apply the following protection mechanism: - -* _At application level:_ enabling HTTP [Basic Authentication](#authentication) -* _At transport level:_ NOT exposing publicly the API's port, -keeping it restricted over internal networks -(restricted networks as in https://en.wikipedia.org/wiki/Principle_of_least_privilege). - -## API - -| Path | Method | Description | -|-----------------------------------------------------------------|------------------|-------------------------------------------| -| `/` | `GET` | Provides a simple HTML frontend of Traefik | -| `/cluster/leader` | `GET` | JSON leader true/false response | -| `/health` | `GET` | JSON health metrics | -| `/api` | `GET` | Configuration for all providers | -| `/api/providers` | `GET` | Providers | -| `/api/providers/{provider}` | `GET`, `PUT` | Get or update provider (1) | -| `/api/providers/{provider}/backends` | `GET` | List backends | -| `/api/providers/{provider}/backends/{backend}` | `GET` | Get backend | -| `/api/providers/{provider}/backends/{backend}/servers` | `GET` | List servers in backend | -| `/api/providers/{provider}/backends/{backend}/servers/{server}` | `GET` | Get a server in a backend | -| `/api/providers/{provider}/frontends` | `GET` | List frontends | -| `/api/providers/{provider}/frontends/{frontend}` | `GET` | Get a frontend | -| `/api/providers/{provider}/frontends/{frontend}/routes` | `GET` | List routes in a frontend | -| `/api/providers/{provider}/frontends/{frontend}/routes/{route}` | `GET` | Get a route in a frontend | - -<1> See [Rest](/configuration/backends/rest/#api) for more information. - -!!! warning - For compatibility reason, when you activate the rest provider, you can use `web` or `rest` as `provider` value. - But be careful, in the configuration for all providers the key is still `web`. - -### Address / Port - -You can define a custom address/port like this: - -```toml -defaultEntryPoints = ["http"] - -[entryPoints] - [entryPoints.http] - address = ":80" - - [entryPoints.foo] - address = ":8082" - - [entryPoints.bar] - address = ":8083" - -[ping] -entryPoint = "foo" - -[api] -entryPoint = "bar" -``` - -In the above example, you would access a regular path, dashboard, and health-check as follows: - -* Regular path: `http://hostname:80/path` -* Dashboard: `http://hostname:8083/` -* Ping URL: `http://hostname:8082/ping` - -In the above example, it is _very_ important to create a named dedicated entry point, and do **not** include it in `defaultEntryPoints`. -Otherwise, you are likely to expose _all_ services via that entry point. - -### Custom Path - -You can define a custom path like this: - -```toml -defaultEntryPoints = ["http"] - -[entryPoints] - [entryPoints.http] - address = ":80" - - [entryPoints.foo] - address = ":8080" - - [entryPoints.bar] - address = ":8081" - -# Activate API and Dashboard -[api] -entryPoint = "bar" -dashboard = true - -[file] - [backends] - [backends.backend1] - [backends.backend1.servers.server1] - url = "http://127.0.0.1:8081" - - [frontends] - [frontends.frontend1] - entryPoints = ["foo"] - backend = "backend1" - [frontends.frontend1.routes.test_1] - rule = "PathPrefixStrip:/yourprefix;PathPrefix:/yourprefix" -``` - -### Authentication - -You can define the authentication like this: - -```toml -defaultEntryPoints = ["http"] - -[entryPoints] - [entryPoints.http] - address = ":80" - - [entryPoints.foo] - address=":8080" - [entryPoints.foo.auth] - [entryPoints.foo.auth.basic] - users = [ - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", - "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0", - ] - -[api] -entrypoint="foo" -``` - -For more information, see [entry points](/configuration/entrypoints/) . - -### Provider call example - -```shell -curl -s "http://localhost:8080/api" | jq . -``` -```json -{ - "file": { - "frontends": { - "frontend2": { - "routes": { - "test_2": { - "rule": "Path:/test" - } - }, - "backend": "backend1" - }, - "frontend1": { - "routes": { - "test_1": { - "rule": "Host:test.localhost" - } - }, - "backend": "backend2" - } - }, - "backends": { - "backend2": { - "loadBalancer": { - "method": "drr" - }, - "servers": { - "server2": { - "weight": 2, - "URL": "http://172.17.0.5:80" - }, - "server1": { - "weight": 1, - "url": "http://172.17.0.4:80" - } - } - }, - "backend1": { - "loadBalancer": { - "method": "wrr" - }, - "circuitBreaker": { - "expression": "NetworkErrorRatio() > 0.5" - }, - "servers": { - "server2": { - "weight": 1, - "url": "http://172.17.0.3:80" - }, - "server1": { - "weight": 10, - "url": "http://172.17.0.2:80" - } - } - } - } - } -} -``` - -### Cluster Leadership - -```shell -curl -s "http://localhost:8080/cluster/leader" | jq . -``` -```shell -< HTTP/1.1 200 OK -< Content-Type: application/json; charset=UTF-8 -< Date: xxx -< Content-Length: 15 -``` -If the given node is not a cluster leader, an HTTP status of `429-Too-Many-Requests` will be returned. -```json -{ - // current leadership status of the queried node - "leader": true -} -``` - -### Health - -```shell -curl -s "http://localhost:8080/health" | jq . -``` -```json -{ - // Traefik PID - "pid": 2458, - // Traefik server uptime (formated time) - "uptime": "39m6.885931127s", - // Traefik server uptime in seconds - "uptime_sec": 2346.885931127, - // current server date - "time": "2015-10-07 18:32:24.362238909 +0200 CEST", - // current server date in seconds - "unixtime": 1444235544, - // count HTTP response status code in realtime - "status_code_count": { - "502": 1 - }, - // count HTTP response status code since Traefik started - "total_status_code_count": { - "200": 7, - "404": 21, - "502": 13 - }, - // count HTTP response - "count": 1, - // count HTTP response - "total_count": 41, - // sum of all response time (formated time) - "total_response_time": "35.456865605s", - // sum of all response time in seconds - "total_response_time_sec": 35.456865605, - // average response time (formated time) - "average_response_time": "864.8016ms", - // average response time in seconds - "average_response_time_sec": 0.8648016000000001, - - // request statistics [requires --api.statistics to be set] - // ten most recent requests with 4xx and 5xx status codes - "recent_errors": [ - { - // status code - "status_code": 500, - // description of status code - "status": "Internal Server Error", - // request HTTP method - "method": "GET", - // request hostname - "host": "localhost", - // request path - "path": "/path", - // RFC 3339 formatted date/time - "time": "2016-10-21T16:59:15.418495872-07:00" - } - ] -} -``` - -## Metrics - -You can enable Traefik to export internal metrics to different monitoring systems. - -```toml -[api] - # ... - - # Enable more detailed statistics. - [api.statistics] - - # Number of recent errors logged. - # - # Default: 10 - # - recentErrors = 10 - - # ... -``` - -| Path | Method | Description | -|------------|---------------|-------------------------| -| `/metrics` | `GET` | Export internal metrics | diff --git a/old/docs/configuration/backends/boltdb.md b/old/docs/configuration/backends/boltdb.md deleted file mode 100644 index 8c4ee6f20..000000000 --- a/old/docs/configuration/backends/boltdb.md +++ /dev/null @@ -1,59 +0,0 @@ -# BoltDB Provider - -Traefik can be configured to use BoltDB as a provider. - -```toml -################################################################ -# BoltDB Provider -################################################################ - -# Enable BoltDB Provider. -[boltdb] - -# BoltDB file. -# -# Required -# Default: "127.0.0.1:4001" -# -endpoint = "/my.db" - -# Enable watch BoltDB changes. -# -# Optional -# Default: true -# -watch = true - -# Prefix used for KV store. -# -# Optional -# Default: "/traefik" -# -prefix = "/traefik" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -filename = "boltdb.tmpl" - -# Use BoltDB user/pass authentication. -# -# Optional -# -# username = foo -# password = bar - -# Enable BoltDB TLS connection. -# -# Optional -# -# [boltdb.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/boltdb.crt" -# key = "/etc/ssl/boltdb.key" -# insecureSkipVerify = true -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). diff --git a/old/docs/configuration/backends/consul.md b/old/docs/configuration/backends/consul.md deleted file mode 100644 index 84ddaa188..000000000 --- a/old/docs/configuration/backends/consul.md +++ /dev/null @@ -1,61 +0,0 @@ -# Consul Key-Value Provider - -Traefik can be configured to use Consul as a provider. - -```toml -################################################################ -# Consul KV Provider -################################################################ - -# Enable Consul KV Provider. -[consul] - -# Consul server endpoint. -# -# Required -# Default: "127.0.0.1:8500" -# -endpoint = "127.0.0.1:8500" - -# Enable watch Consul changes. -# -# Optional -# Default: true -# -watch = true - -# Prefix used for KV store. -# -# Optional -# Default: traefik -# -prefix = "traefik" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "consul.tmpl" - -# Use Consul user/pass authentication. -# -# Optional -# -# username = foo -# password = bar - -# Enable Consul TLS connection. -# -# Optional -# -# [consul.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/consul.crt" -# key = "/etc/ssl/consul.key" -# insecureSkipVerify = true -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure. diff --git a/old/docs/configuration/backends/consulcatalog.md b/old/docs/configuration/backends/consulcatalog.md deleted file mode 100644 index 00588ac7c..000000000 --- a/old/docs/configuration/backends/consulcatalog.md +++ /dev/null @@ -1,242 +0,0 @@ -# Consul Catalog Provider - -Traefik can be configured to use service discovery catalog of Consul as a provider. - -```toml -################################################################ -# Consul Catalog Provider -################################################################ - -# Enable Consul Catalog Provider. -[consulCatalog] - -# Consul server endpoint. -# -# Required -# Default: "127.0.0.1:8500" -# -endpoint = "127.0.0.1:8500" - -# Expose Consul catalog services by default in Traefik. -# -# Optional -# Default: true -# -exposedByDefault = false - -# Allow Consul server to serve the catalog reads regardless of whether it is the leader. -# -# Optional -# Default: false -# -stale = false - -# Default base domain used for the frontend rules. -# -# Optional -# -domain = "consul.localhost" - -# Prefix for Consul catalog tags. -# -# Optional -# Default: "traefik" -# -prefix = "traefik" - -# Default frontEnd Rule for Consul services. -# -# The format is a Go Template with: -# - ".ServiceName", ".Domain" and ".Attributes" available -# - "getTag(name, tags, defaultValue)", "hasTag(name, tags)" and "getAttribute(name, tags, defaultValue)" functions are available -# - "getAttribute(...)" function uses prefixed tag names based on "prefix" value -# -# Optional -# Default: "Host:{{.ServiceName}}.{{.Domain}}" -# -#frontEndRule = "Host:{{.ServiceName}}.{{.Domain}}" - -# Enable Consul catalog TLS connection. -# -# Optional -# -# [consulCatalog.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/consul.crt" -# key = "/etc/ssl/consul.key" -# insecureSkipVerify = true - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "consulcatalog.tmpl" - -# Override template version -# For advanced users :) -# -# Optional -# - "1": previous template version (must be used only with older custom templates, see "filename") -# - "2": current template version (must be used to force template version when "filename" is used) -# -# templateVersion = 2 -``` - -This provider will create routes matching on hostname based on the service name used in Consul. - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -## Tags - -Additional settings can be defined using Consul Catalog tags. - -!!! note - The default prefix is `traefik`. - -| Label | Description | -|--------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `.enable=false` | Disables this container in Traefik. | -| `.protocol=https` | Overrides the default `http` protocol. | -| `.weight=10` | Assigns this weight to the container. | -| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. | -| `.backend.circuitbreaker.expression=EXPR` | Creates a [circuit breaker](/basics/#backends) to be used against the backend. ex: `NetworkErrorRatio() > 0.` | -| `.backend.responseForwarding.flushInterval=10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `.backend.healthcheck.path=/health` | Enables health check for the backend, hitting the container at `path`. | -| `.backend.healthcheck.interval=5s` | Defines the health check interval. | -| `.backend.healthcheck.timeout=3s` | Defines the health check request timeout | -| `.backend.healthcheck.port=8080` | Sets a different port for the health check. | -| `traefik.backend.healthcheck.scheme=http` | Overrides the server URL scheme. | -| `.backend.healthcheck.hostname=foobar.com` | Defines the health check hostname. | -| `.backend.healthcheck.headers=EXPR` | Defines the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `.backend.loadbalancer.method=drr` | Overrides the default `wrr` load balancer algorithm. | -| `.backend.loadbalancer.stickiness=true` | Enables backend sticky sessions. | -| `.backend.loadbalancer.stickiness.cookieName=NAME` | Sets the cookie name manually for sticky sessions. | -| `.backend.maxconn.amount=10` | Sets a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `.backend.maxconn.extractorfunc=client.ip` | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `.frontend.auth.basic=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED). | -| `.frontend.auth.basic.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `.frontend.auth.basic.users=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`. | -| `.frontend.auth.basic.usersfile=/path/.htpasswd` | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `.frontend.auth.digest.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `.frontend.auth.digest.users=EXPR` | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`. | -| `.frontend.auth.digest.usersfile=/path/.htdigest` | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `.frontend.auth.forward.address=https://example.com` | Sets the URL of the authentication server. | -| `.frontend.auth.forward.authResponseHeaders=EXPR` | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header` | -| `.frontend.auth.forward.tls.ca=/path/ca.pem` | Sets the Certificate Authority (CA) for the TLS connection with the authentication server. | -| `.frontend.auth.forward.tls.caOptional=true` | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA). | -| `.frontend.auth.forward.tls.cert=/path/server.pem` | Sets the Certificate for the TLS connection with the authentication server. | -| `.frontend.auth.forward.tls.insecureSkipVerify=true` | If set to true invalid SSL certificates are accepted. | -| `.frontend.auth.forward.tls.key=/path/server.key` | Sets the Certificate for the TLS connection with the authentication server. | -| `.frontend.auth.forward.trustForwardHeader=true` | Trusts X-Forwarded-* headers. | -| `.frontend.auth.headerField=X-WebAuth-User` | Sets the header used to pass the authenticated user to the application. | -| `.frontend.entryPoints=http,https` | Assigns this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `.frontend.errors..backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `.frontend.errors..query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `.frontend.errors..status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `.frontend.passHostHeader=true` | Forwards client `Host` header to the backend. | -| `.frontend.passTLSClientCert.infos.issuer.commonName=true` | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.country=true` | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.locality=true` | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.organization=true` | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.province=true` | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.notAfter=true` | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.notBefore=true` | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.sans=true` | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.commonName=true` | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.country=true` | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.locality=true` | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.organization=true` | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.province=true` | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.infos.subject.serialNumber=true` | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `.frontend.passTLSClientCert.pem=true` | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header. | -| `.frontend.passTLSCert=true` | Forwards TLS Client certificates to the backend. | -| `.frontend.priority=10` | Overrides default frontend priority. | -| `.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `.frontend.rateLimit.rateSet..period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `.frontend.rateLimit.rateSet..average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `.frontend.rateLimit.rateSet..burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS). | -| `.frontend.redirect.regex=^http://localhost/(.*)` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `.frontend.redirect.replacement=http://mydomain/$1` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `.frontend.redirect.permanent=true` | Returns 301 instead of 302. | -| `.frontend.rule=EXPR` | Overrides the default frontend rule. Default: `Host:{{.ServiceName}}.{{.Domain}}`. | -| `.frontend.whiteList.sourceRange=RANGE` | Sets a list of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -### Multiple frontends for a single service - -If you need to support multiple frontends for a service, for example when having multiple `rules` that can't be combined, specify them as follows: - -``` -.frontends.A.rule=Host:A:PathPrefix:/A -.frontends.B.rule=Host:B:PathPrefix:/ -``` - -`A` and `B` here are just arbitrary names, they can be anything. You can use any setting that applies to `.frontend` from the table above. - -### Custom Headers - -!!! note - The default prefix is `traefik`. - -| Label | Description | -|--------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | - -### Security Headers - -!!! note - The default prefix is `traefik`. - -| Label | Description | -|-----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `.frontend.headers.hostsProxyHeaders=EXPR` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `.frontend.headers.SSLForceHost=true` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | - - -### Examples - -If you want that Traefik uses Consul tags correctly you need to defined them like that: - -```js -traefik.enable=true -traefik.tags=api -traefik.tags=external -``` - -If the prefix defined in Traefik configuration is `bla`, tags need to be defined like that: - -```js -bla.enable=true -bla.tags=api -bla.tags=external -``` diff --git a/old/docs/configuration/backends/docker.md b/old/docs/configuration/backends/docker.md deleted file mode 100644 index 586f612e7..000000000 --- a/old/docs/configuration/backends/docker.md +++ /dev/null @@ -1,19 +0,0 @@ -| `traefik.domain` | Sets the default base domain for the frontend rules. For more information, check the [Container Labels section's of the user guide "Let's Encrypt & Docker"](/user-guide/docker-and-lets-encrypt/#container-labels) | -| `traefik.port=80` | Registers this port. Useful when the container exposes multiples ports. | -| `traefik.protocol=https` | Overrides the default `http` protocol | -| `traefik.weight=10` | Assigns this weight to the container - -[2] `traefik.frontend.auth.basic.users=EXPR`: -To create `user:password` pair, it's possible to use this command: -`echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g`. -The result will be `user:$$apr1$$9Cv/OMGj$$ZomWQzuQbL.3TRCS81A1g/`, note additional symbol `$` makes escaping. - -[3] `traefik.backend.loadbalancer.swarm`: -If you enable this option, Traefik will use the virtual IP provided by docker swarm instead of the containers IPs. -Which means that Traefik will not perform any kind of load balancing and will delegate this task to swarm. -It also means that Traefik will manipulate only one backend, not one backend per container. - -!!! warning - When running inside a container, Traefik will need network access through: - - `docker network connect ` \ No newline at end of file diff --git a/old/docs/configuration/backends/dynamodb.md b/old/docs/configuration/backends/dynamodb.md deleted file mode 100644 index 37b15f624..000000000 --- a/old/docs/configuration/backends/dynamodb.md +++ /dev/null @@ -1,70 +0,0 @@ -# DynamoDB Provider - -Traefik can be configured to use Amazon DynamoDB as a provider. - -## Configuration - -```toml -################################################################ -# DynamoDB Provider -################################################################ - -# Enable DynamoDB Provider. -[dynamodb] - -# Region to use when connecting to AWS. -# -# Required -# -region = "us-west-1" - -# DyanmoDB Table Name. -# -# Optional -# Default: "traefik" -# -tableName = "traefik" - -# Enable watch DynamoDB changes. -# -# Optional -# Default: true -# -watch = true - -# Polling interval (in seconds). -# -# Optional -# Default: 15 -# -refreshSeconds = 15 - -# Access Key ID to use when connecting to AWS. -# -# Optional -# -accessKeyID = "abc" - -# Secret Access Key to use when connecting to AWS. -# -# Optional -# -secretAccessKey = "123" - -# Endpoint of local dynamodb instance for testing? -# -# Optional -# -endpoint = "http://localhost:8080" -``` - -## Table Items - -Items in the `dynamodb` table must have three attributes: - -- `id` (string): The id is the primary key. -- `name`(string): The name is used as the name of the frontend or backend. -- `frontend` or `backend` (map): This attribute's structure matches exactly the structure of a Frontend or Backend type in Traefik. - See `types/types.go` for details. - The presence or absence of this attribute determines its type. - So an item should never have both a `frontend` and a `backend` attribute. diff --git a/old/docs/configuration/backends/ecs.md b/old/docs/configuration/backends/ecs.md deleted file mode 100644 index 04c6a9c0c..000000000 --- a/old/docs/configuration/backends/ecs.md +++ /dev/null @@ -1,350 +0,0 @@ -# ECS Provider - -Traefik can be configured to use Amazon ECS as a provider. - -## Configuration - -```toml -################################################################ -# ECS Provider -################################################################ - -# Enable ECS Provider. -[ecs] - -# ECS Clusters Name. -# -# Optional -# Default: ["default"] -# -clusters = ["default"] - -# Enable watch ECS changes. -# -# Optional -# Default: true -# -watch = true - -# Default base domain used for the frontend rules. -# Can be overridden by setting the "traefik.domain" label. -# -# Optional -# Default: "" -# -domain = "ecs.localhost" - -# Enable auto discover ECS clusters. -# -# Optional -# Default: false -# -autoDiscoverClusters = false - -# Polling interval (in seconds). -# -# Optional -# Default: 15 -# -refreshSeconds = 15 - -# Expose ECS services by default in Traefik. -# -# Optional -# Default: true -# -exposedByDefault = false - -# Region to use when connecting to AWS. -# -# Optional -# -region = "us-east-1" - -# Access Key ID to use when connecting to AWS. -# -# Optional -# -accessKeyID = "abc" - -# Secret Access Key to use when connecting to AWS. -# -# Optional -# -secretAccessKey = "123" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "ecs.tmpl" - -# Override template version -# For advanced users :) -# -# Optional -# - "1": previous template version (must be used only with older custom templates, see "filename") -# - "2": current template version (must be used to force template version when "filename" is used) -# -# templateVersion = 2 -``` - -If `accessKeyID`/`secretAccessKey` is not given credentials will be resolved in the following order: - -- From environment variables; `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`. -- Shared credentials, determined by `AWS_PROFILE` and `AWS_SHARED_CREDENTIALS_FILE`, defaults to `default` and `~/.aws/credentials`. -- EC2 instance role or ECS task role - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -## Policy - -Traefik needs the following policy to read ECS information: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "TraefikECSReadAccess", - "Effect": "Allow", - "Action": [ - "ecs:ListClusters", - "ecs:DescribeClusters", - "ecs:ListTasks", - "ecs:DescribeTasks", - "ecs:DescribeContainerInstances", - "ecs:DescribeTaskDefinition", - "ec2:DescribeInstances" - ], - "Resource": [ - "*" - ] - } - ] -} -``` - -## Labels: overriding default behavior - -Labels can be used on task containers to override default behavior: - -| Label | Description | -|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.domain` | Sets the default base domain for frontend rules. | -| `traefik.enable=false` | Disables this container in Traefik. | -| `traefik.port=80` | Overrides the default `port` value. Overrides `NetworkBindings` from Docker Container | -| `traefik.protocol=https` | Overrides the default `http` protocol | -| `traefik.weight=10` | Assigns this weight to the container | -| `traefik.backend=foo` | Overrides the service name by `foo` in the generated name of the backend. | -| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.circuitbreaker.expression=EXPR` | Creates a [circuit breaker](/basics/#backends) to be used against the backend | -| `traefik.backend.responseForwarding.flushInterval=10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `traefik.backend.healthcheck.path=/health` | Enables health check for the backend, hitting the container at `path`. | -| `traefik.backend.healthcheck.interval=5s` | Defines the health check interval. (Default: 30s) | -| `traefik.backend.healthcheck.timeout=3s` | Defines the health check request timeout. (Default: 5s) | -| `traefik.backend.healthcheck.scheme=http` | Overrides the server URL scheme. | -| `traefik.backend.healthcheck.port=8080` | Sets a different port for the health check. | -| `traefik.backend.healthcheck.hostname=foobar.com` | Defines the health check hostname. | -| `traefik.backend.healthcheck.headers=EXPR` | Defines the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `traefik.backend.loadbalancer.method=drr` | Overrides the default `wrr` load balancer algorithm | -| `traefik.backend.loadbalancer.stickiness=true` | Enables backend sticky sessions | -| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Sets the cookie manually name for sticky sessions | -| `traefik.backend.maxconn.amount=10` | Sets a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `traefik.backend.maxconn.extractorfunc=client.ip` | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.frontend.auth.basic=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED). | -| `traefik.frontend.auth.basic.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.basic.users=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`. | -| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd` | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.digest.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.digest.users=EXPR` | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`. | -| `traefik.frontend.auth.digest.usersFile=/path/.htdigest` | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.forward.address=https://example.com` | Sets the URL of the authentication server. | -| `traefik.frontend.auth.forward.authResponseHeaders=EXPR` | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header` | -| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem` | Sets the Certificate Authority (CA) for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.caOptional=true` | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA). | -| `traefik.frontend.auth.forward.tls.cert=/path/server.pem` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true` | If set to true invalid SSL certificates are accepted. | -| `traefik.frontend.auth.forward.tls.key=/path/server.key` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.trustForwardHeader=true` | Trusts X-Forwarded-* headers. | -| `traefik.frontend.auth.headerField=X-WebAuth-User` | Sets the header used to pass the authenticated user to the application. | -| `traefik.frontend.auth.removeHeader=true` | If set to true, removes the Authorization header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true` | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.country=true` | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true` | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true` | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.province=true` | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notAfter=true` | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notBefore=true` | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.sans=true` | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true` | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.country=true` | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.locality=true` | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.organization=true` | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.province=true` | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true` | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.pem=true` | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header. | -| `traefik.frontend.entryPoints=http,https` | Assigns this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `traefik.frontend.errors..backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.passHostHeader=true` | Forwards client `Host` header to the backend. | -| `traefik.frontend.passTLSCert=true` | Forwards TLS Client certificates to the backend. | -| `traefik.frontend.priority=10` | Overrides default frontend priority | -| `traefik.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS) | -| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `traefik.frontend.redirect.permanent=true` | Returns 301 instead of 302. | -| `traefik.frontend.rule=EXPR` | Overrides the default frontend rule. Default: `Host:{instance_name}.{domain}`. | -| `traefik.frontend.whiteList.sourceRange=RANGE` | Sets a list of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `traefik.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -### Custom Headers - -| Label | Description | -|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | - -### Security Headers - -| Label | Description | -|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `traefik.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `traefik.frontend.headers.SSLForceHost=true` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | - -### Containers with Multiple Ports (segment labels) - -Segment labels are used to define routes to an application exposing multiple ports. -A segment is a group of labels that apply to a port exposed by an application. -You can define as many segments as ports exposed in an application. - -Segment labels override the default behavior. - -| Label | Description | -|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------| -| `traefik..backend=BACKEND` | Same as `traefik.backend` | -| `traefik..domain=DOMAIN` | Same as `traefik.domain` | -| `traefik..port=PORT` | Same as `traefik.port` | -| `traefik..protocol=http` | Same as `traefik.protocol` | -| `traefik..weight=10` | Same as `traefik.weight` | -| `traefik..frontend.auth.basic=EXPR` | Same as `traefik.frontend.auth.basic` | -| `traefik..frontend.auth.basic.removeHeader=true` | Same as `traefik.frontend.auth.basic.removeHeader` | -| `traefik..frontend.auth.basic.users=EXPR` | Same as `traefik.frontend.auth.basic.users` | -| `traefik..frontend.auth.basic.usersFile=/path/.htpasswd` | Same as `traefik.frontend.auth.basic.usersFile` | -| `traefik..frontend.auth.digest.removeHeader=true` | Same as `traefik.frontend.auth.digest.removeHeader` | -| `traefik..frontend.auth.digest.users=EXPR` | Same as `traefik.frontend.auth.digest.users` | -| `traefik..frontend.auth.digest.usersFile=/path/.htdigest` | Same as `traefik.frontend.auth.digest.usersFile` | -| `traefik..frontend.auth.forward.address=https://example.com` | Same as `traefik.frontend.auth.forward.address` | -| `traefik..frontend.auth.forward.authResponseHeaders=EXPR` | Same as `traefik.frontend.auth.forward.authResponseHeaders` | -| `traefik..frontend.auth.forward.tls.ca=/path/ca.pem` | Same as `traefik.frontend.auth.forward.tls.ca` | -| `traefik..frontend.auth.forward.tls.caOptional=true` | Same as `traefik.frontend.auth.forward.tls.caOptional` | -| `traefik..frontend.auth.forward.tls.cert=/path/server.pem` | Same as `traefik.frontend.auth.forward.tls.cert` | -| `traefik..frontend.auth.forward.tls.insecureSkipVerify=true` | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify` | -| `traefik..frontend.auth.forward.tls.key=/path/server.key` | Same as `traefik.frontend.auth.forward.tls.key` | -| `traefik..frontend.auth.forward.trustForwardHeader=true` | Same as `traefik.frontend.auth.forward.trustForwardHeader` | -| `traefik..frontend.auth.headerField=X-WebAuth-User` | Same as `traefik.frontend.auth.headerField` | -| `traefik..frontend.auth.removeHeader=true` | Same as `traefik.frontend.auth.removeHeader` | -| `traefik..frontend.entryPoints=https` | Same as `traefik.frontend.entryPoints` | -| `traefik..frontend.errors..backend=NAME` | Same as `traefik.frontend.errors..backend` | -| `traefik..frontend.errors..query=PATH` | Same as `traefik.frontend.errors..query` | -| `traefik..frontend.errors..status=RANGE` | Same as `traefik.frontend.errors..status` | -| `traefik..frontend.passHostHeader=true` | Same as `traefik.frontend.passHostHeader` | -| `traefik..frontend.passTLSClientCert.infos.issuer.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName` | -| `traefik..frontend.passTLSClientCert.infos.issuer.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country` | -| `traefik..frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.issuer.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality` | -| `traefik..frontend.passTLSClientCert.infos.issuer.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization` | -| `traefik..frontend.passTLSClientCert.infos.issuer.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province` | -| `traefik..frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber` | -| `traefik..frontend.passTLSClientCert.infos.notAfter=true` | Same as `traefik.frontend.passTLSClientCert.infos.notAfter` | -| `traefik..frontend.passTLSClientCert.infos.notBefore=true` | Same as `traefik.frontend.passTLSClientCert.infos.notBefore` | -| `traefik..frontend.passTLSClientCert.infos.sans=true` | Same as `traefik.frontend.passTLSClientCert.infos.sans` | -| `traefik..frontend.passTLSClientCert.infos.subject.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName` | -| `traefik..frontend.passTLSClientCert.infos.subject.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.country` | -| `traefik..frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.subject.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality` | -| `traefik..frontend.passTLSClientCert.infos.subject.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization` | -| `traefik..frontend.passTLSClientCert.infos.subject.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.province` | -| `traefik..frontend.passTLSClientCert.infos.subject.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber` | -| `traefik..frontend.passTLSClientCert.pem=true` | Same as `traefik.frontend.passTLSClientCert.infos.pem` | -| `traefik..frontend.passTLSCert=true` | Same as `traefik.frontend.passTLSCert` | -| `traefik..frontend.priority=10` | Same as `traefik.frontend.priority` | -| `traefik..frontend.rateLimit.extractorFunc=EXP` | Same as `traefik.frontend.rateLimit.extractorFunc` | -| `traefik..frontend.rateLimit.rateSet..period=6` | Same as `traefik.frontend.rateLimit.rateSet..period` | -| `traefik..frontend.rateLimit.rateSet..average=6` | Same as `traefik.frontend.rateLimit.rateSet..average` | -| `traefik..frontend.rateLimit.rateSet..burst=6` | Same as `traefik.frontend.rateLimit.rateSet..burst` | -| `traefik..frontend.redirect.entryPoint=https` | Same as `traefik.frontend.redirect.entryPoint` | -| `traefik..frontend.redirect.regex=^http://localhost/(.*)` | Same as `traefik.frontend.redirect.regex` | -| `traefik..frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement` | -| `traefik..frontend.redirect.permanent=true` | Same as `traefik.frontend.redirect.permanent` | -| `traefik..frontend.rule=EXP` | Same as `traefik.frontend.rule` | -| `traefik..frontend.whiteList.sourceRange=RANGE` | Same as `traefik.frontend.whiteList.sourceRange` | -| `traefik..frontend.whiteList.useXForwardedFor=true` | Same as `traefik.frontend.whiteList.useXForwardedFor` | -| `traefik..frontend.whiteList.ipStrategy=true` | Same as `traefik.frontend.whiteList.ipStrategy` | -| `traefik..frontend.whiteList.ipStrategy.depth=5` | Same as `traefik.frontend.whiteList.ipStrategy.depth` | -| `traefik..frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | Same as `traefik.frontend.whiteList.ipStrategy.excludedIPs` | - -#### Custom Headers - -| Label | Description | -|----------------------------------------------------------------------|----------------------------------------------------------| -| `traefik..frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders` | -| `traefik..frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` | - -#### Security Headers - -| Label | Description | -|-------------------------------------------------------------------------|--------------------------------------------------------------| -| `traefik..frontend.headers.allowedHosts=EXPR` | Same as `traefik.frontend.headers.allowedHosts` | -| `traefik..frontend.headers.browserXSSFilter=true` | Same as `traefik.frontend.headers.browserXSSFilter` | -| `traefik..frontend.headers.contentSecurityPolicy=VALUE` | Same as `traefik.frontend.headers.contentSecurityPolicy` | -| `traefik..frontend.headers.contentTypeNosniff=true` | Same as `traefik.frontend.headers.contentTypeNosniff` | -| `traefik..frontend.headers.customBrowserXSSValue=VALUE` | Same as `traefik.frontend.headers.customBrowserXSSValue` | -| `traefik..frontend.headers.customFrameOptionsValue=VALUE` | Same as `traefik.frontend.headers.customFrameOptionsValue` | -| `traefik..frontend.headers.forceSTSHeader=false` | Same as `traefik.frontend.headers.forceSTSHeader` | -| `traefik..frontend.headers.frameDeny=false` | Same as `traefik.frontend.headers.frameDeny` | -| `traefik..frontend.headers.hostsProxyHeaders=EXPR` | Same as `traefik.frontend.headers.hostsProxyHeaders` | -| `traefik..frontend.headers.isDevelopment=false` | Same as `traefik.frontend.headers.isDevelopment` | -| `traefik..frontend.headers.publicKey=VALUE` | Same as `traefik.frontend.headers.publicKey` | -| `traefik..frontend.headers.referrerPolicy=VALUE` | Same as `traefik.frontend.headers.referrerPolicy` | -| `traefik..frontend.headers.SSLRedirect=true` | Same as `traefik.frontend.headers.SSLRedirect` | -| `traefik..frontend.headers.SSLTemporaryRedirect=true` | Same as `traefik.frontend.headers.SSLTemporaryRedirect` | -| `traefik..frontend.headers.SSLHost=HOST` | Same as `traefik.frontend.headers.SSLHost` | -| `traefik..frontend.headers.SSLForceHost=true` | Same as `traefik.frontend.headers.SSLForceHost` | -| `traefik..frontend.headers.SSLProxyHeaders=EXPR` | Same as `traefik.frontend.headers.SSLProxyHeaders=EXPR` | -| `traefik..frontend.headers.STSSeconds=315360000` | Same as `traefik.frontend.headers.STSSeconds=315360000` | -| `traefik..frontend.headers.STSIncludeSubdomains=true` | Same as `traefik.frontend.headers.STSIncludeSubdomains=true` | -| `traefik..frontend.headers.STSPreload=true` | Same as `traefik.frontend.headers.STSPreload=true` | diff --git a/old/docs/configuration/backends/etcd.md b/old/docs/configuration/backends/etcd.md deleted file mode 100644 index 3ab85f19d..000000000 --- a/old/docs/configuration/backends/etcd.md +++ /dev/null @@ -1,61 +0,0 @@ -# Etcd Provider - -Traefik can be configured to use Etcd as a provider. - -```toml -################################################################ -# Etcd Provider -################################################################ - -# Enable Etcd Provider. -[etcd] - -# Etcd server endpoint. -# -# Required -# Default: "127.0.0.1:2379" -# -endpoint = "127.0.0.1:2379" - -# Enable watch Etcd changes. -# -# Optional -# Default: true -# -watch = true - -# Prefix used for KV store. -# -# Optional -# Default: "/traefik" -# -prefix = "/traefik" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "etcd.tmpl" - -# Use etcd user/pass authentication. -# -# Optional -# -# username = foo -# password = bar - -# Enable etcd TLS connection. -# -# Optional -# -# [etcd.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/etcd.crt" -# key = "/etc/ssl/etcd.key" -# insecureSkipVerify = true -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure. diff --git a/old/docs/configuration/backends/eureka.md b/old/docs/configuration/backends/eureka.md deleted file mode 100644 index 0341cabc4..000000000 --- a/old/docs/configuration/backends/eureka.md +++ /dev/null @@ -1,32 +0,0 @@ -# Eureka Provider - -Traefik can be configured to use Eureka as a provider. - -```toml -################################################################ -# Eureka Provider -################################################################ - -# Enable Eureka Provider. -[eureka] - -# Eureka server endpoint. -# -# Required -# -endpoint = "http://my.eureka.server/eureka" - -# Override default configuration time between refresh. -# -# Optional -# Default: 30s -# -refreshSeconds = "1m" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "eureka.tmpl" -``` diff --git a/old/docs/configuration/backends/file.md b/old/docs/configuration/backends/file.md deleted file mode 100644 index 2c0e5704c..000000000 --- a/old/docs/configuration/backends/file.md +++ /dev/null @@ -1,357 +0,0 @@ -# File Provider - -Traefik can be configured with a file. - -## Reference - -```toml -[file] - -# Backends -[backends] - - [backends.backend1] - - [backends.backend1.servers] - [backends.backend1.servers.server0] - url = "http://10.10.10.1:80" - weight = 1 - [backends.backend1.servers.server1] - url = "http://10.10.10.2:80" - weight = 2 - # ... - - [backends.backend1.circuitBreaker] - expression = "NetworkErrorRatio() > 0.5" - - [backends.backend1.responseForwarding] - flushInterval = "10ms" - - [backends.backend1.loadBalancer] - method = "drr" - [backends.backend1.loadBalancer.stickiness] - cookieName = "foobar" - - [backends.backend1.maxConn] - amount = 10 - extractorfunc = "request.host" - - [backends.backend1.healthCheck] - path = "/health" - port = 88 - interval = "30s" - timeout = "5s" - scheme = "http" - hostname = "myhost.com" - [backends.backend1.healthcheck.headers] - My-Custom-Header = "foo" - My-Header = "bar" - - [backends.backend2] - # ... - -# Frontends -[frontends] - - [frontends.frontend1] - entryPoints = ["http", "https"] - backend = "backend1" - passHostHeader = true - priority = 42 - - [frontends.frontend1.passTLSClientCert] - pem = true - [frontends.frontend1.passTLSClientCert.infos] - notBefore = true - notAfter = true - [frontends.frontend1.passTLSClientCert.infos.subject] - country = true - domainComponent = true - province = true - locality = true - organization = true - commonName = true - serialNumber = true - [frontends.frontend1.passTLSClientCert.infos.issuer] - country = true - domainComponent = true - province = true - locality = true - organization = true - commonName = true - serialNumber = true - [frontends.frontend1.auth] - headerField = "X-WebAuth-User" - [frontends.frontend1.auth.basic] - removeHeader = true - users = [ - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", - "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0", - ] - usersFile = "/path/to/.htpasswd" - [frontends.frontend1.auth.digest] - removeHeader = true - users = [ - "test:traefik:a2688e031edb4be6a3797f3882655c05", - "test2:traefik:518845800f9e2bfb1f1f740ec24f074e", - ] - usersFile = "/path/to/.htdigest" - [frontends.frontend1.auth.forward] - address = "https://authserver.com/auth" - trustForwardHeader = true - authResponseHeaders = ["X-Auth-User"] - [frontends.frontend1.auth.forward.tls] - ca = "path/to/local.crt" - caOptional = true - cert = "path/to/foo.cert" - key = "path/to/foo.key" - insecureSkipVerify = true - - [frontends.frontend1.whiteList] - sourceRange = ["10.42.0.0/16", "152.89.1.33/32", "afed:be44::/16"] - [frontends.frontend1.whiteList.IPStrategy] - depth = 6 - excludedIPs = ["152.89.1.33/32", "afed:be44::/16"] - - [frontends.frontend1.routes] - [frontends.frontend1.routes.route0] - rule = "Host:test.localhost" - [frontends.frontend1.routes.Route1] - rule = "Method:GET" - # ... - - [frontends.frontend1.headers] - allowedHosts = ["foobar", "foobar"] - hostsProxyHeaders = ["foobar", "foobar"] - SSLRedirect = true - SSLTemporaryRedirect = true - SSLHost = "foobar" - STSSeconds = 42 - STSIncludeSubdomains = true - STSPreload = true - forceSTSHeader = true - frameDeny = true - customFrameOptionsValue = "foobar" - contentTypeNosniff = true - browserXSSFilter = true - contentSecurityPolicy = "foobar" - publicKey = "foobar" - referrerPolicy = "foobar" - isDevelopment = true - [frontends.frontend1.headers.customRequestHeaders] - X-Foo-Bar-01 = "foobar" - X-Foo-Bar-02 = "foobar" - # ... - [frontends.frontend1.headers.customResponseHeaders] - X-Foo-Bar-03 = "foobar" - X-Foo-Bar-04 = "foobar" - # ... - [frontends.frontend1.headers.SSLProxyHeaders] - X-Foo-Bar-05 = "foobar" - X-Foo-Bar-06 = "foobar" - # ... - - [frontends.frontend1.errors] - [frontends.frontend1.errors.errorPage0] - status = ["500-599"] - backend = "error" - query = "/{status}.html" - [frontends.frontend1.errors.errorPage1] - status = ["404", "403"] - backend = "error" - query = "/{status}.html" - # ... - - [frontends.frontend1.ratelimit] - extractorfunc = "client.ip" - [frontends.frontend1.ratelimit.rateset.rateset1] - period = "10s" - average = 100 - burst = 200 - [frontends.frontend1.ratelimit.rateset.rateset2] - period = "3s" - average = 5 - burst = 10 - # ... - - [frontends.frontend1.redirect] - entryPoint = "https" - regex = "^http://localhost/(.*)" - replacement = "http://mydomain/$1" - permanent = true - - [frontends.frontend2] - # ... - -# HTTPS certificates -[[tls]] - entryPoints = ["https"] - [tls.certificate] - certFile = "path/to/my.cert" - keyFile = "path/to/my.key" - -[[tls]] - # ... -``` - -## Configuration Mode - -You have two choices: - -- [Rules in Traefik configuration file](/configuration/backends/file/#rules-in-traefik-configuration-file) -- [Rules in dedicated files](/configuration/backends/file/#rules-in-dedicated-files) - -To enable the file backend, you must either pass the `--file` option to the Traefik binary or put the `[file]` section (with or without inner settings) in the configuration file. - -The configuration file allows managing both backends/frontends and HTTPS certificates (which are not [Let's Encrypt](https://letsencrypt.org) certificates generated through Traefik). - -TOML templating can be used if rules are not defined in the Traefik configuration file. - -### Rules in Traefik Configuration File - -Add your configuration at the end of the global configuration file `traefik.toml`: - -```toml -defaultEntryPoints = ["http", "https"] - -[entryPoints] - [entryPoints.http] - # ... - [entryPoints.https] - # ... - -[file] - -# rules -[backends] - [backends.backend1] - # ... - [backends.backend2] - # ... - -[frontends] - [frontends.frontend1] - # ... - [frontends.frontend2] - # ... - [frontends.frontend3] - # ... - -# HTTPS certificate -[[tls]] - # ... - -[[tls]] - # ... -``` - -!!! note - If `tls.entryPoints` is not defined, the certificate is attached to all the `defaultEntryPoints` with a TLS configuration. - -!!! note - Adding certificates directly to the entryPoint is still maintained but certificates declared in this way cannot be managed dynamically. - It's recommended to use the file provider to declare certificates. - -!!! warning - TOML templating cannot be used if rules are defined in the Traefik configuration file. - -### Rules in Dedicated Files - -Traefik allows defining rules in one or more separate files. - -#### One Separate File - -You have to specify the file path in the `file.filename` option. - -```toml -# traefik.toml -defaultEntryPoints = ["http", "https"] - -[entryPoints] - [entryPoints.http] - # ... - [entryPoints.https] - # ... - -[file] - filename = "rules.toml" - watch = true -``` - -The option `file.watch` allows Traefik to watch file changes automatically. - -#### Multiple Separated Files - -You could have multiple `.toml` files in a directory (and recursively in its sub-directories): - -```toml -[file] - directory = "/path/to/config/" - watch = true -``` - -The option `file.watch` allows Traefik to watch file changes automatically. - -#### Separate Files Content - -If you are defining rules in one or more separate files, you can use two formats. - -##### Simple Format - -Backends, Frontends and TLS certificates are defined one at time, as described in the file `rules.toml`: - -```toml -# rules.toml -[backends] - [backends.backend1] - # ... - [backends.backend2] - # ... - -[frontends] - [frontends.frontend1] - # ... - [frontends.frontend2] - # ... - [frontends.frontend3] - # ... - -# HTTPS certificate -[[tls]] - # ... - -[[tls]] - # ... -``` - -##### TOML Templating - -!!! warning - TOML templating can only be used **if rules are defined in one or more separate files**. - Templating will not work in the Traefik configuration file. - -Traefik allows using TOML templating. - -Thus, it's possible to define easily lot of Backends, Frontends and TLS certificates as described in the file `template-rules.toml` : - -```toml -# template-rules.toml -[backends] -{{ range $i, $e := until 100 }} - [backends.backend{{ $e }}] - #... -{{ end }} - -[frontends] -{{ range $i, $e := until 100 }} - [frontends.frontend{{ $e }}] - #... -{{ end }} - - -# HTTPS certificate -{{ range $i, $e := until 100 }} -[[tls]] - #... -{{ end }} -``` diff --git a/old/docs/configuration/backends/kubernetes.md b/old/docs/configuration/backends/kubernetes.md deleted file mode 100644 index 810144233..000000000 --- a/old/docs/configuration/backends/kubernetes.md +++ /dev/null @@ -1,389 +0,0 @@ -# Kubernetes Ingress Provider - -Traefik can be configured to use Kubernetes Ingress as a provider. - -See also [Kubernetes user guide](/user-guide/kubernetes). - -## Configuration - -```toml -################################################################ -# Kubernetes Ingress Provider -################################################################ - -# Enable Kubernetes Ingress Provider. -[kubernetes] - -# Kubernetes server endpoint. -# -# Optional for in-cluster configuration, required otherwise. -# Default: empty -# -# endpoint = "http://localhost:8080" - -# Bearer token used for the Kubernetes client configuration. -# -# Optional -# Default: empty -# -# token = "my token" - -# Path to the certificate authority file. -# Used for the Kubernetes client configuration. -# -# Optional -# Default: empty -# -# certAuthFilePath = "/my/ca.crt" - -# Array of namespaces to watch. -# -# Optional -# Default: all namespaces (empty array). -# -# namespaces = ["default", "production"] - -# Ingress label selector to filter Ingress objects that should be processed. -# -# Optional -# Default: empty (process all Ingresses) -# -# labelselector = "A and not B" - -# Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed. -# If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed. -# Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed. -# -# Optional -# Default: empty -# -# ingressClass = "traefik-internal" - -# Disable PassHost Headers. -# -# Optional -# Default: false -# -# disablePassHostHeaders = true - -# Enable PassTLSCert Headers. -# -# Optional -# Default: false -# -# enablePassTLSCert = true - -# Override default configuration template. -# -# Optional -# Default: -# -# filename = "kubernetes.tmpl" - -# Enable IngressEndpoint configuration. -# This will allow Traefik to update the status section of ingress objects, if desired. -# -# Optional -# -# [kubernetes.ingressEndpoint] -# -# At least one must be configured. -# `publishedservice` will override the `hostname` and `ip` settings if configured. -# -# hostname = "localhost" -# ip = "127.0.0.1" -# publishedService = "namespace/servicename" -``` - -### `endpoint` - -The Kubernetes server endpoint as URL. - -When deployed into Kubernetes, Traefik will read the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` to construct the endpoint. - -The access token will be looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`. -Both are provided mounted automatically when deployed inside Kubernetes. - -The endpoint may be specified to override the environment variable values inside a cluster. - -When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client. -In this case, the endpoint is required. -Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig. - -### `labelselector` - -By default, Traefik processes all Ingress objects in the configured namespaces. -A label selector can be defined to filter on specific Ingress objects only. - -See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details. - -### `ingressEndpoint` - -You can configure a static hostname or IP address that Traefik will add to the status section of Ingress objects that it manages. -If you prefer, you can provide a service, which traefik will copy the status spec from. -This will give more flexibility in cloud/dynamic environments. - -### TLS communication between Traefik and backend pods - -Traefik automatically requests endpoint information based on the service provided in the ingress spec. -Although traefik will connect directly to the endpoints (pods), it still checks the service port to see if TLS communication is required. - -There are 3 ways to configure Traefik to use https to communicate with backend pods: - -1. If the service port defined in the ingress spec is 443 (note that you can still use `targetPort` to use a different port on your pod). -2. If the service port defined in the ingress spec has a name that starts with `https` (such as `https-api`, `https-web` or just `https`). -3. If the ingress spec includes the annotation `ingress.kubernetes.io/protocol: https`. - -If either of those configuration options exist, then the backend communication protocol is assumed to be TLS, and will connect via TLS automatically. - -!!! note - Please note that by enabling TLS communication between traefik and your pods, you will have to have trusted certificates that have the proper trust chain and IP subject name. - If this is not an option, you may need to skip TLS certificate verification. - See the [insecureSkipVerify](/configuration/commons/#main-section) setting for more details. - -## Annotations - -### General annotations - -The following general annotations are applicable on the Ingress object: - -| Annotation | Description | -|---------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.ingress.kubernetes.io/app-root: "/index.html"` | Redirects all requests for `/` to the defined path. (1) | -| `traefik.ingress.kubernetes.io/error-pages: ` | See [custom error pages](/configuration/commons/#custom-error-pages) section. (2) | -| `traefik.ingress.kubernetes.io/frontend-entry-points: http,https` | Override the default frontend endpoints. | -| `traefik.ingress.kubernetes.io/pass-client-tls-cert: ` | Forward the client certificate following the configuration in YAML. (3) | -| `traefik.ingress.kubernetes.io/pass-tls-cert: "true"` | Override the default frontend PassTLSCert value. Default: `false`.(DEPRECATED) | -| `traefik.ingress.kubernetes.io/preserve-host: "true"` | Forward client `Host` header to the backend. | -| `traefik.ingress.kubernetes.io/priority: "3"` | Override the default frontend rule priority. | -| `traefik.ingress.kubernetes.io/rate-limit: ` | See [rate limiting](/configuration/commons/#rate-limiting) section. (4) | -| `traefik.ingress.kubernetes.io/redirect-entry-point: https` | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS). | -| `traefik.ingress.kubernetes.io/redirect-permanent: "true"` | Return 301 instead of 302. | -| `traefik.ingress.kubernetes.io/redirect-regex: ^http://localhost/(.*)` | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-replacement`. | -| `traefik.ingress.kubernetes.io/redirect-replacement: http://mydomain/$1` | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-regex`. | -| `traefik.ingress.kubernetes.io/request-modifier: AddPrefix: /users` | Adds a [request modifier](/basics/#modifiers) to the backend request. | -| `traefik.ingress.kubernetes.io/rewrite-target: /users` | Replaces each matched Ingress path with the specified one, and adds the old path to the `X-Replaced-Path` header. | -| `traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip` | Overrides the default frontend rule type. Only path-related matchers can be specified [(`Path`, `PathPrefix`, `PathStrip`, `PathPrefixStrip`)](/basics/#path-matcher-usage-guidelines).(5) | -| `traefik.ingress.kubernetes.io/request-modifier: AddPrefix: /users` | Add a [request modifier](/basics/#modifiers) to the backend request. | -| `traefik.ingress.kubernetes.io/service-weights: ` | Set ingress backend weights specified as percentage or decimal numbers in YAML. (6) | -| `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access (7). | -| `traefik.ingress.kubernetes.io/whiteList-ipstrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.ingress.kubernetes.io/whiteList-ipstrategy-depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.ingress.kubernetes.io/whiteList-ipstrategy-excludedIPs=127.0.0. 1` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `ingress.kubernetes.io/protocol: ` | Set the protocol Traefik will use to communicate with pods. Acceptable protocols: http,https,h2c | - -<1> `traefik.ingress.kubernetes.io/app-root`: -Non-root paths will not be affected by this annotation and handled normally. -This annotation may not be combined with other redirect annotations. -Trying to do so will result in the other redirects being ignored. -This annotation can be used in combination with `traefik.ingress.kubernetes.io/redirect-permanent` to configure whether the `app-root` redirect is a 301 or a 302. - -<2> `traefik.ingress.kubernetes.io/error-pages` example: - -```yaml -foo: - status: - - "404" - backend: bar - query: /bar -fii: - status: - - "503" - - "500" - backend: bar - query: /bir -``` - -<3> `traefik.ingress.kubernetes.io/pass-client-tls-cert` example: - -```yaml -# add escaped pem in the `X-Forwarded-Tls-Client-Cert` header -pem: true -# add escaped certificate following infos in the `X-Forwarded-Tls-Client-Cert-Infos` header -infos: - notafter: true - notbefore: true - sans: true - subject: - country: true - province: true - locality: true - organization: true - commonname: true - serialnumber: true -``` - -If `pem` is set, it will add a `X-Forwarded-Tls-Client-Cert` header that contains the escaped pem as value. -If at least one flag of the `infos` part is set, it will add a `X-Forwarded-Tls-Client-Cert-Infos` header that contains an escaped string composed of the client certificate data selected by the infos flags. -This infos part is composed like the following example (not escaped): -```Subject="C=FR,ST=SomeState,L=Lyon,O=Cheese,CN=*.cheese.org",NB=1531900816,NA=1563436816,SAN=*.cheese.org,*.cheese.net,cheese.in,test@cheese.org,test@cheese.net,10.0.1.0,10.0.1.2``` - -<4> `traefik.ingress.kubernetes.io/rate-limit` example: - -```yaml -extractorfunc: client.ip -rateset: - bar: - period: 3s - average: 6 - burst: 9 - foo: - period: 6s - average: 12 - burst: 18 -``` - -<5> `traefik.ingress.kubernetes.io/rule-type` -Note: `ReplacePath` is deprecated in this annotation, use the `traefik.ingress.kubernetes.io/request-modifier` annotation instead. Default: `PathPrefix`. - -<6> `traefik.ingress.kubernetes.io/service-weights`: -Service weights enable to split traffic across multiple backing services in a fine-grained manner. - -Example: - -```yaml -service_backend1: 12.50% -service_backend2: 12.50% -service_backend3: 75 # Same as 75%, the percentage sign is optional -``` - -A single service backend definition may be omitted; in this case, Traefik auto-completes that service backend to 100% automatically. -Conveniently, users need not bother to compute the percentage remainder for a main service backend. -For instance, in the example above `service_backend3` does not need to be specified to be assigned 75%. - -!!! note - For each service weight given, the Ingress specification must include a backend item with the corresponding `serviceName` and (if given) matching path. - -Currently, 3 decimal places for the weight are supported. -An attempt to exceed the precision should be avoided as it may lead to percentage computation flaws and, in consequence, Ingress parsing errors. - -For each path definition, this annotation will fail if: - -- the sum of backend weights exceeds 100% or -- the sum of backend weights is less than 100% without one or more omitted backends - -See also the [user guide section traffic splitting](/user-guide/kubernetes/#traffic-splitting). - -<7> `traefik.ingress.kubernetes.io/whitelist-source-range`: -All source IPs are permitted if the list is empty or a single range is ill-formatted. -Please note, you may have to set `service.spec.externalTrafficPolicy` to the value `Local` to preserve the source IP of the request for filtering. -Please see [this link](https://kubernetes.io/docs/tutorials/services/source-ip/) for more information. - - -!!! note - Please note that `traefik.ingress.kubernetes.io/redirect-regex` and `traefik.ingress.kubernetes.io/redirect-replacement` do not have to be set if `traefik.ingress.kubernetes.io/redirect-entry-point` is defined for the redirection (they will not be used in this case). - -The following annotations are applicable on the Service object associated with a particular Ingress object: - -| Annotation | Description | -|--------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.ingress.kubernetes.io/buffering: ` | (1) See the [buffering](/configuration/commons/#buffering) section. | -| `traefik.ingress.kubernetes.io/affinity: "true"` | Enable backend sticky sessions. | -| `traefik.ingress.kubernetes.io/circuit-breaker-expression: ` | Set the circuit breaker expression for the backend. | -| `traefik.ingress.kubernetes.io/responseforwarding-flushinterval: "10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `traefik.ingress.kubernetes.io/load-balancer-method: drr` | Override the default `wrr` load balancer algorithm. | -| `traefik.ingress.kubernetes.io/max-conn-amount: "10"` | Sets the maximum number of simultaneous connections to the backend.
Must be used in conjunction with the label below to take effect. | -| `traefik.ingress.kubernetes.io/max-conn-extractor-func: client.ip` | Set the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.ingress.kubernetes.io/session-cookie-name: ` | Manually set the cookie name for sticky sessions. | - -<1> `traefik.ingress.kubernetes.io/buffering` example: - -```yaml -maxrequestbodybytes: 10485760 -memrequestbodybytes: 2097153 -maxresponsebodybytes: 10485761 -memresponsebodybytes: 2097152 -retryexpression: IsNetworkError() && Attempts() <= 2 -``` - -!!! note - `traefik.ingress.kubernetes.io/` and `ingress.kubernetes.io/` are supported prefixes. - -### Custom Headers Annotations - -| Annotation | Description | -| ------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `ingress.kubernetes.io/custom-request-headers: EXPR` | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: HEADER:value||HEADER2:value2 | -| `ingress.kubernetes.io/custom-response-headers: EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client. Format: HEADER:value||HEADER2:value2 | - -### Security Headers Annotations - -The following security annotations are applicable on the Ingress object: - -| Annotation | Description | -| ----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `ingress.kubernetes.io/allowed-hosts: EXPR` | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2` | -| `ingress.kubernetes.io/browser-xss-filter: "true"` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `ingress.kubernetes.io/content-security-policy: VALUE` | Adds CSP Header with the custom value. | -| `ingress.kubernetes.io/content-type-nosniff: "true"` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `ingress.kubernetes.io/custom-browser-xss-value: VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `ingress.kubernetes.io/force-hsts: "false"` | Adds the STS header to non-SSL requests. | -| `ingress.kubernetes.io/frame-deny: "true"` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `ingress.kubernetes.io/hsts-max-age: "315360000"` | Sets the max-age of the HSTS header. | -| `ingress.kubernetes.io/hsts-include-subdomains: "true"` | Adds the IncludeSubdomains section of the STS header. | -| `ingress.kubernetes.io/hsts-preload: "true"` | Adds the preload flag to the HSTS header. | -| `ingress.kubernetes.io/is-development: "false"` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `ingress.kubernetes.io/proxy-headers: EXPR` | Provides a list of headers that the proxied hostname may be stored. Format: `HEADER1,HEADER2` | -| `ingress.kubernetes.io/public-key: VALUE` | Adds HPKP header. | -| `ingress.kubernetes.io/referrer-policy: VALUE` | Adds referrer policy header. | -| `ingress.kubernetes.io/ssl-redirect: "true"` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `ingress.kubernetes.io/ssl-temporary-redirect: "true"` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `ingress.kubernetes.io/ssl-host: HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `ingress.kubernetes.io/ssl-force-host: "true"` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `ingress.kubernetes.io/ssl-proxy-headers: EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: HEADER:value||HEADER2:value2 | - -### Authentication - -Additional authentication annotations can be added to the Ingress object. -The source of the authentication is a Secret object that contains the credentials. - -| Annotation | basic | digest | forward | Description | -|----------------------------------------------------------------------|-------|--------|---------|-------------------------------------------------------------------------------------------------------------| -| `ingress.kubernetes.io/auth-type: basic` | x | x | x | Contains the authentication type: `basic`, `digest`, `forward`. | -| `ingress.kubernetes.io/auth-secret: mysecret` | x | x | | Name of Secret containing the username and password with access to the paths defined in the Ingress object. | -| `ingress.kubernetes.io/auth-remove-header: true` | x | x | | If set to `true` removes the `Authorization` header. | -| `ingress.kubernetes.io/auth-header-field: X-WebAuth-User` | x | x | | Pass Authenticated user to application via headers. | -| `ingress.kubernetes.io/auth-url: https://example.com` | | | x | [The URL of the authentication server](/configuration/entrypoints/#forward-authentication). | -| `ingress.kubernetes.io/auth-trust-headers: false` | | | x | Trust `X-Forwarded-*` headers. | -| `ingress.kubernetes.io/auth-response-headers: X-Auth-User, X-Secret` | | | x | Copy headers from the authentication server to the request. | -| `ingress.kubernetes.io/auth-tls-secret: secret` | | | x | Name of Secret containing the certificate and key for the forward auth. | -| `ingress.kubernetes.io/auth-tls-insecure` | | | x | If set to `true` invalid SSL certificates are accepted. | - -The secret must be created in the same namespace as the Ingress object. - -The following limitations hold for basic/digest auth: - -- The realm is not configurable; the only supported (and default) value is `traefik`. -- The Secret must contain a single file only. - -### TLS certificates management - -TLS certificates can be managed in Secrets objects. -More information are available in the [User Guide](/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress). - -!!! note - Only TLS certificates provided by users can be stored in Kubernetes Secrets. - [Let's Encrypt](https://letsencrypt.org) certificates cannot be managed in Kubernets Secrets yet. - -### Global Default Backend Ingresses - -Ingresses can be created that look like the following: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: cheese -spec: - backend: - serviceName: stilton - servicePort: 80 -``` - -This ingress follows the [Global Default Backend](https://kubernetes.io/docs/concepts/services-networking/ingress/#the-ingress-resource) property of ingresses. -This will allow users to create a "default backend" that will match all unmatched requests. - -!!! note - Due to Traefik's use of priorities, you may have to set this ingress priority lower than other ingresses in your environment, to avoid this global ingress from satisfying requests that _could_ match other ingresses. - To do this, use the `traefik.ingress.kubernetes.io/priority` annotation (as seen in [General Annotations](/configuration/backends/kubernetes/#general-annotations)) on your ingresses accordingly. diff --git a/old/docs/configuration/backends/marathon.md b/old/docs/configuration/backends/marathon.md deleted file mode 100644 index 18eba6c7a..000000000 --- a/old/docs/configuration/backends/marathon.md +++ /dev/null @@ -1,415 +0,0 @@ -# Marathon Provider - -Traefik can be configured to use Marathon as a provider. - -See also [Marathon user guide](/user-guide/marathon). - - -## Configuration - -```toml -################################################################ -# Mesos/Marathon Provider -################################################################ - -# Enable Marathon Provider. -[marathon] - -# Marathon server endpoint. -# You can also specify multiple endpoint for Marathon: -# endpoint = "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080" -# -# Required -# Default: "http://127.0.0.1:8080" -# -endpoint = "http://127.0.0.1:8080" - -# Enable watch Marathon changes. -# -# Optional -# Default: true -# -watch = true - -# Default base domain used for the frontend rules. -# Can be overridden by setting the "traefik.domain" label on an application. -# -# Required -# -domain = "marathon.localhost" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "marathon.tmpl" - -# Override template version -# For advanced users :) -# -# Optional -# - "1": previous template version (must be used only with older custom templates, see "filename") -# - "2": current template version (must be used to force template version when "filename" is used) -# -# templateVersion = 2 - -# Expose Marathon apps by default in Traefik. -# -# Optional -# Default: true -# -# exposedByDefault = false - -# Convert Marathon groups to subdomains. -# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain} -# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain} -# -# Optional -# Default: false -# -# groupsAsSubDomains = true - -# Enable compatibility with marathon-lb labels. -# -# Optional -# Default: false -# -# marathonLBCompatibility = true - -# Enable filtering using Marathon constraints.. -# If enabled, Traefik will read Marathon constraints, as defined in https://mesosphere.github.io/marathon/docs/constraints.html -# Each individual constraint will be treated as a verbatim compounded tag. -# i.e. "rack_id:CLUSTER:rack-1", with all constraint groups concatenated together using ":" -# -# Optional -# Default: false -# -# filterMarathonConstraints = true - -# Enable Marathon basic authentication. -# -# Optional -# -# [marathon.basic] -# httpBasicAuthUser = "foo" -# httpBasicPassword = "bar" - -# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config -# -# Optional -# -# [marathon.TLS] -# CA = "/etc/ssl/ca.crt" -# Cert = "/etc/ssl/marathon.cert" -# Key = "/etc/ssl/marathon.key" -# insecureSkipVerify = true - -# DCOSToken for DCOS environment. -# This will override the Authorization header. -# -# Optional -# -# dcosToken = "xxxxxx" - -# Override DialerTimeout. -# Amount of time to allow the Marathon provider to wait to open a TCP connection -# to a Marathon master. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). -# If no units are provided, the value is parsed assuming seconds. -# -# Optional -# Default: "5s" -# -# dialerTimeout = "5s" - -# Override ResponseHeaderTimeout. -# Amount of time to allow the Marathon provider to wait until the first response -# header from the Marathon master is received. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). -# If no units are provided, the value is parsed assuming seconds. -# -# Optional -# Default: "60s" -# -# responseHeaderTimeout = "60s" - -# Override TLSHandshakeTimeout. -# Amount of time to allow the Marathon provider to wait until the TLS -# handshake completes. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). -# If no units are provided, the value is parsed assuming seconds. -# -# Optional -# Default: "5s" -# -# TLSHandshakeTimeout = "5s" - -# Set the TCP Keep Alive interval for the Marathon HTTP Client. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw -# values (digits). -# If no units are provided, the value is parsed assuming seconds. -# -# Optional -# Default: "10s" -# -# keepAlive = "10s" - -# By default, a task's IP address (as returned by the Marathon API) is used as -# backend server if an IP-per-task configuration can be found; otherwise, the -# name of the host running the task is used. -# The latter behavior can be enforced by enabling this switch. -# -# Optional -# Default: false -# -# forceTaskHostname = true - -# Applications may define readiness checks which are probed by Marathon during -# deployments periodically and the results exposed via the API. -# Enabling the following parameter causes Traefik to filter out tasks -# whose readiness checks have not succeeded. -# Note that the checks are only valid at deployment times. -# See the Marathon guide for details. -# -# Optional -# Default: false -# -# respectReadinessChecks = true -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -## Labels: overriding default behavior - -Marathon labels may be used to dynamically change the routing and forwarding behavior. - -They may be specified on one of two levels: Application or service. - -### Application Level - -The following labels can be defined on Marathon applications. They adjust the behavior for the entire application. - -| Label | Description | -|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.domain` | Sets the default base domain used for the frontend rules. | -| `traefik.enable=false` | Disables this container in Traefik. | -| `traefik.port=80` | Registers this port. Useful when the container exposes multiples ports. | -| `traefik.portIndex=1` | Registers port by index in the application's ports array. Useful when the application exposes multiple ports. | -| `traefik.protocol=https` | Overrides the default `http` protocol. | -| `traefik.weight=10` | Assigns this weight to the container. | -| `traefik.backend=foo` | Overrides the application name by `foo` in the generated name of the backend. | -| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.circuitbreaker.expression=EXPR` | Creates a [circuit breaker](/basics/#backends) to be used against the backend | -| `traefik.backend.responseForwarding.flushInterval=10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `traefik.backend.healthcheck.path=/health` | Enables health check for the backend, hitting the container at `path`. | -| `traefik.backend.healthcheck.interval=5s` | Defines the health check interval. (Default: 30s) | -| `traefik.backend.healthcheck.timeout=3s` | Defines the health check request timeout. (Default: 5s) | -| `traefik.backend.healthcheck.port=8080` | Sets a different port for the health check. | -| `traefik.backend.healthcheck.scheme=http` | Overrides the server URL scheme. | -| `traefik.backend.healthcheck.hostname=foobar.com` | Defines the health check hostname. | -| `traefik.backend.healthcheck.headers=EXPR` | Defines the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `traefik.backend.loadbalancer.method=drr` | Overrides the default `wrr` load balancer algorithm | -| `traefik.backend.loadbalancer.stickiness=true` | Enables backend sticky sessions | -| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Sets the cookie name manually for sticky sessions | -| `traefik.backend.maxconn.amount=10` | Sets a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `traefik.backend.maxconn.extractorfunc=client.ip` | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.frontend.auth.basic=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED). | -| `traefik.frontend.auth.basic.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.basic.users=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`. | -| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd` | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.digest.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.digest.users=EXPR` | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`. | -| `traefik.frontend.auth.digest.usersFile=/path/.htdigest` | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.forward.address=https://example.com` | Sets the URL of the authentication server. | -| `traefik.frontend.auth.forward.authResponseHeaders=EXPR` | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header` | -| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem` | Sets the Certificate Authority (CA) for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.caOptional=true` | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA). | -| `traefik.frontend.auth.forward.tls.cert=/path/server.pem` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true` | If set to true invalid SSL certificates are accepted. | -| `traefik.frontend.auth.forward.tls.key=/path/server.key` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.trustForwardHeader=true` | Trusts X-Forwarded-* headers. | -| `traefik.frontend.auth.headerField=X-WebAuth-User` | Sets the header used to pass the authenticated user to the application. | -| `traefik.frontend.auth.removeHeader=true` | If set to true, removes the Authorization header. | -| `traefik.frontend.entryPoints=http,https` | Assigns this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `traefik.frontend.errors..backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.passHostHeader=true` | Forwards client `Host` header to the backend. | -| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true` | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.country=true` | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true` | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true` | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.province=true` | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notAfter=true` | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notBefore=true` | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.sans=true` | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true` | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.country=true` | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.locality=true` | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.province=true` | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.pem=true` | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header. | -| `traefik.frontend.passTLSCert=true` | Forwards TLS Client certificates to the backend. | -| `traefik.frontend.priority=10` | Overrides default frontend priority | -| `traefik.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS) | -| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `traefik.frontend.redirect.permanent=true` | Returns 301 instead of 302. | -| `traefik.frontend.rule=EXPR` | Overrides the default frontend rule. Default: `Host:{sub_domain}.{domain}`. | -| `traefik.frontend.whiteList.sourceRange=RANGE` | Sets a list of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `traefik.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -#### Custom Headers - -| Label | Description | -|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | -| - -#### Security Headers - -| Label | Description | -|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `traefik.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `traefik.frontend.headers.SSLForceHost=true` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | - -### Applications with Multiple Ports (segment labels) - -Segment labels are used to define routes to an application exposing multiple ports. -A segment is a group of labels that apply to a port exposed by an application. -You can define as many segments as ports exposed in an application. - -Segment labels override the default behavior. - -| Label | Description | -|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------| -| `traefik..backend=BACKEND` | Same as `traefik.backend` | -| `traefik..domain=DOMAIN` | Same as `traefik.domain` | -| `traefik..portIndex=1` | Same as `traefik.portIndex` | -| `traefik..port=PORT` | Same as `traefik.port` | -| `traefik..protocol=http` | Same as `traefik.protocol` | -| `traefik..weight=10` | Same as `traefik.weight` | -| `traefik..frontend.auth.basic=EXPR` | Same as `traefik.frontend.auth.basic` | -| `traefik..frontend.auth.basic.removeHeader=true` | Same as `traefik.frontend.auth.basic.removeHeader` | -| `traefik..frontend.auth.basic.users=EXPR` | Same as `traefik.frontend.auth.basic.users` | -| `traefik..frontend.auth.basic.usersFile=/path/.htpasswd` | Same as `traefik.frontend.auth.basic.usersFile` | -| `traefik..frontend.auth.digest.removeHeader=true` | Same as `traefik.frontend.auth.digest.removeHeader` | -| `traefik..frontend.auth.digest.users=EXPR` | Same as `traefik.frontend.auth.digest.users` | -| `traefik..frontend.auth.digest.usersFile=/path/.htdigest` | Same as `traefik.frontend.auth.digest.usersFile` | -| `traefik..frontend.auth.forward.address=https://example.com` | Same as `traefik.frontend.auth.forward.address` | -| `traefik..frontend.auth.forward.authResponseHeaders=EXPR` | Same as `traefik.frontend.auth.forward.authResponseHeaders` | -| `traefik..frontend.auth.forward.tls.ca=/path/ca.pem` | Same as `traefik.frontend.auth.forward.tls.ca` | -| `traefik..frontend.auth.forward.tls.caOptional=true` | Same as `traefik.frontend.auth.forward.tls.caOptional` | -| `traefik..frontend.auth.forward.tls.cert=/path/server.pem` | Same as `traefik.frontend.auth.forward.tls.cert` | -| `traefik..frontend.auth.forward.tls.insecureSkipVerify=true` | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify` | -| `traefik..frontend.auth.forward.tls.key=/path/server.key` | Same as `traefik.frontend.auth.forward.tls.key` | -| `traefik..frontend.auth.forward.trustForwardHeader=true` | Same as `traefik.frontend.auth.forward.trustForwardHeader` | -| `traefik..frontend.auth.headerField=X-WebAuth-User` | Same as `traefik.frontend.auth.headerField` | -| `traefik..frontend.auth.removeHeader=true` | Same as `traefik.frontend.auth.removeHeader` | -| `traefik..frontend.entryPoints=https` | Same as `traefik.frontend.entryPoints` | -| `traefik..frontend.errors..backend=NAME` | Same as `traefik.frontend.errors..backend` | -| `traefik..frontend.errors..query=PATH` | Same as `traefik.frontend.errors..query` | -| `traefik..frontend.errors..status=RANGE` | Same as `traefik.frontend.errors..status` | -| `traefik..frontend.passHostHeader=true` | Same as `traefik.frontend.passHostHeader` | -| `traefik..frontend.passTLSClientCert.infos.issuer.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName` | -| `traefik..frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.issuer.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country` | -| `traefik..frontend.passTLSClientCert.infos.issuer.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality` | -| `traefik..frontend.passTLSClientCert.infos.issuer.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization` | -| `traefik..frontend.passTLSClientCert.infos.issuer.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province` | -| `traefik..frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber` | -| `traefik..frontend.passTLSClientCert.infos.notAfter=true` | Same as `traefik.frontend.passTLSClientCert.infos.notAfter` | -| `traefik..frontend.passTLSClientCert.infos.notBefore=true` | Same as `traefik.frontend.passTLSClientCert.infos.notBefore` | -| `traefik..frontend.passTLSClientCert.infos.sans=true` | Same as `traefik.frontend.passTLSClientCert.infos.sans` | -| `traefik..frontend.passTLSClientCert.infos.subject.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName` | -| `traefik..frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.subject.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.country` | -| `traefik..frontend.passTLSClientCert.infos.subject.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality` | -| `traefik..frontend.passTLSClientCert.infos.subject.organization=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.organization` | -| `traefik..frontend.passTLSClientCert.infos.subject.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.province` | -| `traefik..frontend.passTLSClientCert.infos.subject.serialNumber=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber` | -| `traefik..frontend.passTLSClientCert.pem=true` | Same as `traefik.frontend.passTLSClientCert.infos.pem` | -| `traefik..frontend.passTLSCert=true` | Same as `traefik.frontend.passTLSCert` | -| `traefik..frontend.priority=10` | Same as `traefik.frontend.priority` | -| `traefik..frontend.rateLimit.extractorFunc=EXP` | Same as `traefik.frontend.rateLimit.extractorFunc` | -| `traefik..frontend.rateLimit.rateSet..period=6` | Same as `traefik.frontend.rateLimit.rateSet..period` | -| `traefik..frontend.rateLimit.rateSet..average=6` | Same as `traefik.frontend.rateLimit.rateSet..average` | -| `traefik..frontend.rateLimit.rateSet..burst=6` | Same as `traefik.frontend.rateLimit.rateSet..burst` | -| `traefik..frontend.redirect.entryPoint=https` | Same as `traefik.frontend.redirect.entryPoint` | -| `traefik..frontend.redirect.regex=^http://localhost/(.*)` | Same as `traefik.frontend.redirect.regex` | -| `traefik..frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement` | -| `traefik..frontend.redirect.permanent=true` | Same as `traefik.frontend.redirect.permanent` | -| `traefik..frontend.rule=EXP` | Same as `traefik.frontend.rule` | -| `traefik..frontend.whiteList.sourceRange=RANGE` | Same as `traefik.frontend.whiteList.sourceRange` | -| `traefik..frontend.whiteList.ipStrategy=true` | Same as `traefik.frontend.whiteList.ipStrategy` | -| `traefik..frontend.whiteList.ipStrategy.depth=5` | Same as `traefik.frontend.whiteList.ipStrategy.depth` | -| `traefik..frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | Same as `traefik.frontend.whiteList.ipStrategy.excludedIPs` | - -#### Custom Headers - -| Label | Description | -|----------------------------------------------------------------------|----------------------------------------------------------| -| `traefik..frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders` | -| `traefik..frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` | - -#### Security Headers - -| Label | Description | -|-------------------------------------------------------------------------|--------------------------------------------------------------| -| `traefik..frontend.headers.allowedHosts=EXPR` | Same as `traefik.frontend.headers.allowedHosts` | -| `traefik..frontend.headers.browserXSSFilter=true` | Same as `traefik.frontend.headers.browserXSSFilter` | -| `traefik..frontend.headers.contentSecurityPolicy=VALUE` | Same as `traefik.frontend.headers.contentSecurityPolicy` | -| `traefik..frontend.headers.contentTypeNosniff=true` | Same as `traefik.frontend.headers.contentTypeNosniff` | -| `traefik..frontend.headers.customBrowserXSSValue=VALUE` | Same as `traefik.frontend.headers.customBrowserXSSValue` | -| `traefik..frontend.headers.customFrameOptionsValue=VALUE` | Same as `traefik.frontend.headers.customFrameOptionsValue` | -| `traefik..frontend.headers.forceSTSHeader=false` | Same as `traefik.frontend.headers.forceSTSHeader` | -| `traefik..frontend.headers.frameDeny=false` | Same as `traefik.frontend.headers.frameDeny` | -| `traefik..frontend.headers.hostsProxyHeaders=EXPR` | Same as `traefik.frontend.headers.hostsProxyHeaders` | -| `traefik..frontend.headers.isDevelopment=false` | Same as `traefik.frontend.headers.isDevelopment` | -| `traefik..frontend.headers.publicKey=VALUE` | Same as `traefik.frontend.headers.publicKey` | -| `traefik..frontend.headers.referrerPolicy=VALUE` | Same as `traefik.frontend.headers.referrerPolicy` | -| `traefik..frontend.headers.SSLRedirect=true` | Same as `traefik.frontend.headers.SSLRedirect` | -| `traefik..frontend.headers.SSLTemporaryRedirect=true` | Same as `traefik.frontend.headers.SSLTemporaryRedirect` | -| `traefik..frontend.headers.SSLHost=HOST` | Same as `traefik.frontend.headers.SSLHost` | -| `traefik..frontend.headers.SSLForceHost=true` | Same as `traefik.frontend.headers.SSLForceHost` | -| `traefik..frontend.headers.SSLProxyHeaders=EXPR` | Same as `traefik.frontend.headers.SSLProxyHeaders=EXPR` | -| `traefik..frontend.headers.STSSeconds=315360000` | Same as `traefik.frontend.headers.STSSeconds=315360000` | -| `traefik..frontend.headers.STSIncludeSubdomains=true` | Same as `traefik.frontend.headers.STSIncludeSubdomains=true` | -| `traefik..frontend.headers.STSPreload=true` | Same as `traefik.frontend.headers.STSPreload=true` | diff --git a/old/docs/configuration/backends/mesos.md b/old/docs/configuration/backends/mesos.md deleted file mode 100644 index 8eda978c1..000000000 --- a/old/docs/configuration/backends/mesos.md +++ /dev/null @@ -1,323 +0,0 @@ -# Mesos Generic Provider - -Traefik can be configured to use Mesos as a provider. - -```toml -################################################################ -# Mesos Provider -################################################################ - -# Enable Mesos Provider. -[mesos] - -# Mesos server endpoint. -# You can also specify multiple endpoint for Mesos: -# endpoint = "192.168.35.40:5050,192.168.35.41:5050,192.168.35.42:5050" -# endpoint = "zk://192.168.35.20:2181,192.168.35.21:2181,192.168.35.22:2181/mesos" -# -# Required -# Default: "http://127.0.0.1:5050" -# -endpoint = "http://127.0.0.1:8080" - -# Enable watch Mesos changes. -# -# Optional -# Default: true -# -watch = true - -# Default base domain used for the frontend rules. -# Can be overridden by setting the "traefik.domain" label on an application. -# -# Required -# -domain = "mesos.localhost" - -# Expose Mesos apps by default in Traefik. -# -# Optional -# Default: true -# -# exposedByDefault = false - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "mesos.tmpl" - -# Override template version -# For advanced users :) -# -# Optional -# - "1": previous template version (must be used only with older custom templates, see "filename") -# - "2": current template version (must be used to force template version when "filename" is used) -# -# templateVersion = 2 - -# TLS client configuration. https://golang.org/pkg/crypto/tls/#Config -# -# Optional -# -# [mesos.TLS] -# insecureSkipVerify = true - -# Zookeeper timeout (in seconds). -# -# Optional -# Default: 30 -# -# zkDetectionTimeout = 30 - -# Polling interval (in seconds). -# -# Optional -# Default: 30 -# -# refreshSeconds = 30 - -# IP sources (e.g. host, docker, mesos, netinfo). -# -# Optional -# -# ipSources = "host" - -# HTTP Timeout (in seconds). -# -# Optional -# Default: 30 -# -# stateTimeoutSecond = "30" - -# Convert groups to subdomains. -# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain} -# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain} -# -# Optional -# Default: false -# -# groupsAsSubDomains = true - -``` - -## Labels: overriding default behavior - -The following labels can be defined on Mesos tasks. They adjust the behavior for the entire application. - -| Label | Description | -|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.domain` | Sets the default domain for the frontend rules. | -| `traefik.enable=false` | Disables this container in Traefik. | -| `traefik.port=80` | Registers this port. Useful when the application exposes multiple ports. | -| `traefik.portName=web` | Registers port by name in the application's ports array. Useful when the application exposes multiple ports. | -| `traefik.portIndex=1` | Registers port by index in the application's ports array. Useful when the application exposes multiple ports. | -| `traefik.protocol=https` | Overrides the default `http` protocol | -| `traefik.weight=10` | Assigns this weight to the container | -| `traefik.backend=foo` | Overrides the task name by `foo` in the generated name of the backend. | -| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.circuitbreaker.expression=EXPR` | Creates a [circuit breaker](/basics/#backends) to be used against the backend | -| `traefik.backend.responseForwarding.flushInterval=10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `traefik.backend.healthcheck.path=/health` | Enables health check for the backend, hitting the container at `path`. | -| `traefik.backend.healthcheck.interval=5s` | Defines the health check interval. (Default: 30s) | -| `traefik.backend.healthcheck.timeout=3s` | Defines the health check request timeout. (Default: 5s) | -| `traefik.backend.healthcheck.scheme=http` | Overrides the server URL scheme. | -| `traefik.backend.healthcheck.port=8080` | Sets a different port for the health check. | -| `traefik.backend.healthcheck.hostname=foobar.com` | Defines the health check hostname. | -| `traefik.backend.healthcheck.headers=EXPR` | Defines the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `traefik.backend.loadbalancer.method=drr` | Overrides the default `wrr` load balancer algorithm | -| `traefik.backend.loadbalancer.stickiness=true` | Enables backend sticky sessions | -| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Sets the cookie manually name for sticky sessions | -| `traefik.backend.maxconn.amount=10` | Sets a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `traefik.backend.maxconn.extractorfunc=client.ip` | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.frontend.auth.basic=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED). | -| `traefik.frontend.auth.basic.users=EXPR` | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`. | -| `traefik.frontend.auth.basic.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd` | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.digest.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.digest.users=EXPR` | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`. | -| `traefik.frontend.auth.digest.usersFile=/path/.htdigest` | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.forward.address=https://example.com` | Sets the URL of the authentication server. | -| `traefik.frontend.auth.forward.authResponseHeaders=EXPR` | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header` | -| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem` | Sets the Certificate Authority (CA) for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.caOptional=true` | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA). | -| `traefik.frontend.auth.forward.tls.cert=/path/server.pem` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true` | If set to true invalid SSL certificates are accepted. | -| `traefik.frontend.auth.forward.tls.key=/path/server.key` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.trustForwardHeader=true` | Trusts X-Forwarded-* headers. | -| `traefik.frontend.auth.headerField=X-WebAuth-User` | Sets the header used to pass the authenticated user to the application. | -| `traefik.frontend.auth.removeHeader=true` | If set to true, removes the Authorization header. | -| `traefik.frontend.entryPoints=http,https` | Assigns this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `traefik.frontend.errors..backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.passHostHeader=true` | Forwards client `Host` header to the backend. | -| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true` | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.country=true` | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true` | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true` | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.province=true` | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notAfter=true` | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notBefore=true` | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.sans=true` | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true` | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.country=true` | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.locality=true` | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.province=true` | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.pem=true` | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header. | -| `traefik.frontend.passTLSCert=true` | Forwards TLS Client certificates to the backend. | -| `traefik.frontend.priority=10` | Overrides default frontend priority | -| `traefik.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS) | -| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `traefik.frontend.redirect.permanent=true` | Returns 301 instead of 302. | -| `traefik.frontend.rule=EXPR` | Overrides the default frontend rule. Default: `Host:{discovery_name}.{domain}`. | -| `traefik.frontend.whiteList.sourceRange=RANGE` | Sets a list of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `traefik.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -### Custom Headers - -| Label | Description | -|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | - -### Security Headers - -| Label | Description | -|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `traefik.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `traefik.frontend.headers.SSLForceHost=true` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | - -### Applications with Multiple Ports (segment labels) - -Segment labels are used to define routes to an application exposing multiple ports. -A segment is a group of labels that apply to a port exposed by an application. -You can define as many segments as ports exposed in an application. - -Additionally, if a segment name matches a named port, that port will be used unless `portIndex`, `portName`, or `port` labels are specified for that segment. - -Segment labels override the default behavior. - -| Label | Description | -|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------| -| `traefik..backend=BACKEND` | Same as `traefik.backend` | -| `traefik..domain=DOMAIN` | Same as `traefik.domain` | -| `traefik..portIndex=1` | Same as `traefik.portIndex` | -| `traefik..portName=web` | Same as `traefik.portName` | -| `traefik..port=PORT` | Same as `traefik.port` | -| `traefik..protocol=http` | Same as `traefik.protocol` | -| `traefik..weight=10` | Same as `traefik.weight` | -| `traefik..frontend.auth.basic=EXPR` | Same as `traefik.frontend.auth.basic` | -| `traefik..frontend.auth.basic.removeHeader=true` | Same as `traefik.frontend.auth.basic.removeHeader` | -| `traefik..frontend.auth.basic.users=EXPR` | Same as `traefik.frontend.auth.basic.users` | -| `traefik..frontend.auth.basic.usersFile=/path/.htpasswd` | Same as `traefik.frontend.auth.basic.usersFile` | -| `traefik..frontend.auth.digest.removeHeader=true` | Same as `traefik.frontend.auth.digest.removeHeader` | -| `traefik..frontend.auth.digest.users=EXPR` | Same as `traefik.frontend.auth.digest.users` | -| `traefik..frontend.auth.digest.usersFile=/path/.htdigest` | Same as `traefik.frontend.auth.digest.usersFile` | -| `traefik..frontend.auth.forward.address=https://example.com` | Same as `traefik.frontend.auth.forward.address` | -| `traefik..frontend.auth.forward.authResponseHeaders=EXPR` | Same as `traefik.frontend.auth.forward.authResponseHeaders` | -| `traefik..frontend.auth.forward.tls.ca=/path/ca.pem` | Same as `traefik.frontend.auth.forward.tls.ca` | -| `traefik..frontend.auth.forward.tls.caOptional=true` | Same as `traefik.frontend.auth.forward.tls.caOptional` | -| `traefik..frontend.auth.forward.tls.cert=/path/server.pem` | Same as `traefik.frontend.auth.forward.tls.cert` | -| `traefik..frontend.auth.forward.tls.insecureSkipVerify=true` | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify` | -| `traefik..frontend.auth.forward.tls.key=/path/server.key` | Same as `traefik.frontend.auth.forward.tls.key` | -| `traefik..frontend.auth.forward.trustForwardHeader=true` | Same as `traefik.frontend.auth.forward.trustForwardHeader` | -| `traefik..frontend.auth.headerField=X-WebAuth-User` | Same as `traefik.frontend.auth.headerField` | -| `traefik..frontend.auth.removeHeader=true` | Same as `traefik.frontend.auth.removeHeader` | -| `traefik..frontend.entryPoints=https` | Same as `traefik.frontend.entryPoints` | -| `traefik..frontend.errors..backend=NAME` | Same as `traefik.frontend.errors..backend` | -| `traefik..frontend.errors..query=PATH` | Same as `traefik.frontend.errors..query` | -| `traefik..frontend.errors..status=RANGE` | Same as `traefik.frontend.errors..status` | -| `traefik..frontend.passHostHeader=true` | Same as `traefik.frontend.passHostHeader` | -| `traefik..frontend.passTLSClientCert.infos.notAfter=true` | Same as `traefik.frontend.passTLSClientCert.infos.notAfter` | -| `traefik..frontend.passTLSClientCert.infos.notBefore=true` | Same as `traefik.frontend.passTLSClientCert.infos.notBefore` | -| `traefik..frontend.passTLSClientCert.infos.sans=true` | Same as `traefik.frontend.passTLSClientCert.infos.sans` | -| `traefik..frontend.passTLSClientCert.infos.subject.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName` | -| `traefik..frontend.passTLSClientCert.infos.subject.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.country` | -| `traefik..frontend.passTLSClientCert.infos.subject.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality` | -| `traefik..frontend.passTLSClientCert.infos.subject.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization` | -| `traefik..frontend.passTLSClientCert.infos.subject.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.province` | -| `traefik..frontend.passTLSClientCert.infos.subject.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber` | -| `traefik..frontend.passTLSClientCert.pem=true` | Same as `traefik.frontend.passTLSClientCert.infos.pem` | -| `traefik..frontend.passTLSCert=true` | Same as `traefik.frontend.passTLSCert` | -| `traefik..frontend.priority=10` | Same as `traefik.frontend.priority` | -| `traefik..frontend.rateLimit.extractorFunc=EXP` | Same as `traefik.frontend.rateLimit.extractorFunc` | -| `traefik..frontend.rateLimit.rateSet..period=6` | Same as `traefik.frontend.rateLimit.rateSet..period` | -| `traefik..frontend.rateLimit.rateSet..average=6` | Same as `traefik.frontend.rateLimit.rateSet..average` | -| `traefik..frontend.rateLimit.rateSet..burst=6` | Same as `traefik.frontend.rateLimit.rateSet..burst` | -| `traefik..frontend.redirect.entryPoint=https` | Same as `traefik.frontend.redirect.entryPoint` | -| `traefik..frontend.redirect.regex=^http://localhost/(.*)` | Same as `traefik.frontend.redirect.regex` | -| `traefik..frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement` | -| `traefik..frontend.redirect.permanent=true` | Same as `traefik.frontend.redirect.permanent` | -| `traefik..frontend.rule=EXP` | Same as `traefik.frontend.rule` | -| `traefik..frontend.whiteList.sourceRange=RANGE` | Same as `traefik.frontend.whiteList.sourceRange` | -| `traefik..frontend.whiteList.ipStrategy=true` | Same as `traefik.frontend.whiteList.ipStrategy` | -| `traefik..frontend.whiteList.ipStrategy.depth=5` | Same as `traefik.frontend.whiteList.ipStrategy.depth` | -| `traefik..frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | Same as `traefik.frontend.whiteList.ipStrategy.excludedIPs` | - -#### Custom Headers - -| Label | Description | -|----------------------------------------------------------------------|----------------------------------------------------------| -| `traefik..frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders` | -| `traefik..frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` | - -#### Security Headers - -| Label | Description | -|-------------------------------------------------------------------------|--------------------------------------------------------------| -| `traefik..frontend.headers.allowedHosts=EXPR` | Same as `traefik.frontend.headers.allowedHosts` | -| `traefik..frontend.headers.browserXSSFilter=true` | Same as `traefik.frontend.headers.browserXSSFilter` | -| `traefik..frontend.headers.contentSecurityPolicy=VALUE` | Same as `traefik.frontend.headers.contentSecurityPolicy` | -| `traefik..frontend.headers.contentTypeNosniff=true` | Same as `traefik.frontend.headers.contentTypeNosniff` | -| `traefik..frontend.headers.customBrowserXSSValue=VALUE` | Same as `traefik.frontend.headers.customBrowserXSSValue` | -| `traefik..frontend.headers.customFrameOptionsValue=VALUE` | Same as `traefik.frontend.headers.customFrameOptionsValue` | -| `traefik..frontend.headers.forceSTSHeader=false` | Same as `traefik.frontend.headers.forceSTSHeader` | -| `traefik..frontend.headers.frameDeny=false` | Same as `traefik.frontend.headers.frameDeny` | -| `traefik..frontend.headers.hostsProxyHeaders=EXPR` | Same as `traefik.frontend.headers.hostsProxyHeaders` | -| `traefik..frontend.headers.isDevelopment=false` | Same as `traefik.frontend.headers.isDevelopment` | -| `traefik..frontend.headers.publicKey=VALUE` | Same as `traefik.frontend.headers.publicKey` | -| `traefik..frontend.headers.referrerPolicy=VALUE` | Same as `traefik.frontend.headers.referrerPolicy` | -| `traefik..frontend.headers.SSLRedirect=true` | Same as `traefik.frontend.headers.SSLRedirect` | -| `traefik..frontend.headers.SSLTemporaryRedirect=true` | Same as `traefik.frontend.headers.SSLTemporaryRedirect` | -| `traefik..frontend.headers.SSLHost=HOST` | Same as `traefik.frontend.headers.SSLHost` | -| `traefik..frontend.headers.SSLForceHost=true` | Same as `traefik.frontend.headers.SSLForceHost` | -| `traefik..frontend.headers.SSLProxyHeaders=EXPR` | Same as `traefik.frontend.headers.SSLProxyHeaders=EXPR` | -| `traefik..frontend.headers.STSSeconds=315360000` | Same as `traefik.frontend.headers.STSSeconds=315360000` | -| `traefik..frontend.headers.STSIncludeSubdomains=true` | Same as `traefik.frontend.headers.STSIncludeSubdomains=true` | -| `traefik..frontend.headers.STSPreload=true` | Same as `traefik.frontend.headers.STSPreload=true` | diff --git a/old/docs/configuration/backends/rancher.md b/old/docs/configuration/backends/rancher.md deleted file mode 100644 index 22cd797f0..000000000 --- a/old/docs/configuration/backends/rancher.md +++ /dev/null @@ -1,355 +0,0 @@ -# Rancher Provider - -Traefik can be configured to use Rancher as a provider. - -## Global Configuration - -```toml -################################################################ -# Rancher Provider -################################################################ - -# Enable Rancher Provider. -[rancher] - -# Default base domain used for the frontend rules. -# Can be overridden by setting the "traefik.domain" label on an service. -# -# Required -# -domain = "rancher.localhost" - -# Enable watch Rancher changes. -# -# Optional -# Default: true -# -watch = true - -# Polling interval (in seconds). -# -# Optional -# Default: 15 -# -refreshSeconds = 15 - -# Expose Rancher services by default in Traefik. -# -# Optional -# Default: true -# -exposedByDefault = false - -# Filter services with unhealthy states and inactive states. -# -# Optional -# Default: false -# -enableServiceHealthFilter = true - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "rancher.tmpl" - -# Override template version -# For advanced users :) -# -# Optional -# - "1": previous template version (must be used only with older custom templates, see "filename") -# - "2": current template version (must be used to force template version when "filename" is used) -# -# templateVersion = 2 -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -## Rancher Metadata Service - -```toml -# Enable Rancher metadata service provider instead of the API -# provider. -# -# Optional -# Default: false -# -[rancher.metadata] - -# Poll the Rancher metadata service for changes every `rancher.refreshSeconds`. -# NOTE: this is less accurate than the default long polling technique which -# will provide near instantaneous updates to Traefik -# -# Optional -# Default: false -# -intervalPoll = true - -# Prefix used for accessing the Rancher metadata service. -# -# Optional -# Default: "/latest" -# -prefix = "/2016-07-29" -``` - -## Rancher API - -```toml -# Enable Rancher API provider. -# -# Optional -# Default: true -# -[rancher.api] - -# Endpoint to use when connecting to the Rancher API. -# -# Required -endpoint = "http://rancherserver.example.com/v1" - -# AccessKey to use when connecting to the Rancher API. -# -# Required -accessKey = "XXXXXXXXXXXXXXXXXXXX" - -# SecretKey to use when connecting to the Rancher API. -# -# Required -secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -``` - -!!! note - If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters. - - To enable Traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`. - This can be found within the API Key advanced options. - - Add these labels to traefik docker deployment to autogenerated these values: - ``` - io.rancher.container.agent.role: environment - io.rancher.container.create_agent: true - ``` - -## Labels: overriding default behavior - -### On Containers - -Labels can be used on task containers to override default behavior: - -| Label | Description | -|---------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.domain` | Sets the default base domain for the frontend rules. | -| `traefik.enable=false` | Disables this container in Traefik. | -| `traefik.port=80` | Registers this port. Useful when the container exposes multiple ports. | -| `traefik.protocol=https` | Overrides the default `http` protocol. | -| `traefik.weight=10` | Assigns this weight to the container. | -| `traefik.backend=foo` | Overrides the service name by `foo` in the generated name of the backend. | -| `traefik.backend.buffering.maxRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.maxResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memRequestBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.memResponseBodyBytes=0` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.buffering.retryExpression=EXPR` | See [buffering](/configuration/commons/#buffering) section. | -| `traefik.backend.circuitbreaker.expression=EXPR` | Creates a [circuit breaker](/basics/#backends) to be used against the backend | -| `traefik.backend.responseForwarding.flushInterval=10ms` | Defines the interval between two flushes when forwarding response from backend to client. | -| `traefik.backend.healthcheck.path=/health` | Enables health check for the backend, hitting the container at `path`. | -| `traefik.backend.healthcheck.interval=5s` | Defines the health check interval. | -| `traefik.backend.healthcheck.timeout=3s ` | Defines the health check request timeout. | -| `traefik.backend.healthcheck.port=8080` | Sets a different port for the health check. | -| `traefik.backend.healthcheck.scheme=http` | Overrides the server URL scheme. | -| `traefik.backend.healthcheck.hostname=foobar.com` | Defines the health check hostname. | -| `traefik.backend.healthcheck.headers=EXPR` | Defines the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `traefik.backend.loadbalancer.method=drr` | Overrides the default `wrr` load balancer algorithm | -| `traefik.backend.loadbalancer.stickiness=true` | Enables backend sticky sessions | -| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Sets the cookie name manually for sticky sessions | -| `traefik.backend.maxconn.amount=10` | Sets a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `traefik.backend.maxconn.extractorfunc=client.ip` | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.frontend.auth.basic=EXPR` | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED). | -| `traefik.frontend.auth.basic.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.basic.users=EXPR` | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` . | -| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd` | Sets the basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.digest.removeHeader=true` | If set to `true`, removes the `Authorization` header. | -| `traefik.frontend.auth.digest.users=EXPR` | Sets the digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`. | -| `traefik.frontend.auth.digest.usersFile=/path/.htdigest` | Sets the digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence. | -| `traefik.frontend.auth.forward.address=https://example.com` | Sets the URL of the authentication server. | -| `traefik.frontend.auth.forward.authResponseHeaders=EXPR` | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header` | -| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem` | Sets the Certificate Authority (CA) for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.caOptional=true` | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA). | -| `traefik.frontend.auth.forward.tls.cert=/path/server.pem` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true` | If set to true invalid SSL certificates are accepted. | -| `traefik.frontend.auth.forward.tls.key=/path/server.key` | Sets the Certificate for the TLS connection with the authentication server. | -| `traefik.frontend.auth.forward.trustForwardHeader=true` | Trusts X-Forwarded-* headers. | -| `traefik.frontend.auth.headerField=X-WebAuth-User` | Sets the header used to pass the authenticated user to the application. | -| `traefik.frontend.entryPoints=http,https` | Assigns this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `traefik.frontend.errors..backend=NAME` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..query=PATH` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.errors..status=RANGE` | See [custom error pages](/configuration/commons/#custom-error-pages) section. | -| `traefik.frontend.passHostHeader=true` | Forwards client `Host` header to the backend. | -| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true` | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.country=true` | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true` | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true` | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.province=true` | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notAfter=true` | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.notBefore=true` | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.sans=true` | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true` | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.country=true` | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.locality=true` | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.province=true` | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header. | -| `traefik.frontend.passTLSClientCert.pem=true` | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header. | -| `traefik.frontend.passTLSCert=true` | Forwards TLS Client certificates to the backend. | -| `traefik.frontend.priority=10` | Overrides default frontend priority | -| `traefik.frontend.rateLimit.extractorFunc=EXP` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..period=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..average=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.rateLimit.rateSet..burst=6` | See [rate limiting](/configuration/commons/#rate-limiting) section. | -| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS) | -| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirects to another URL to this frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `traefik.frontend.redirect.permanent=true` | Returns 301 instead of 302. | -| `traefik.frontend.rule=EXPR` | Overrides the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`. | -| `traefik.frontend.whiteList.sourceRange=RANGE` | Sets a list of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access.
If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `traefik.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -#### Custom Headers - -| Label | Description | -|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | - -#### Security Headers - -| Label | Description | -|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | -| `traefik.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `traefik.frontend.headers.SSLForceHost=true` | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false. | -| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | - -### On containers with Multiple Ports (segment labels) - -Segment labels are used to define routes to a container exposing multiple ports. -A segment is a group of labels that apply to a port exposed by a container. -You can define as many segments as ports exposed in a container. - -Segment labels override the default behavior. - -| Label | Description | -|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------| -| `traefik..backend=BACKEND` | Same as `traefik.backend` | -| `traefik..domain=DOMAIN` | Same as `traefik.domain` | -| `traefik..port=PORT` | Same as `traefik.port` | -| `traefik..protocol=http` | Same as `traefik.protocol` | -| `traefik..weight=10` | Same as `traefik.weight` | -| `traefik..frontend.auth.basic=EXPR` | Same as `traefik.frontend.auth.basic` | -| `traefik..frontend.auth.basic.removeHeader=true` | Same as `traefik.frontend.auth.basic.removeHeader` | -| `traefik..frontend.auth.basic.users=EXPR` | Same as `traefik.frontend.auth.basic.users` | -| `traefik..frontend.auth.basic.usersFile=/path/.htpasswd` | Same as `traefik.frontend.auth.basic.usersFile` | -| `traefik..frontend.auth.digest.removeHeader=true` | Same as `traefik.frontend.auth.digest.removeHeader` | -| `traefik..frontend.auth.digest.users=EXPR` | Same as `traefik.frontend.auth.digest.users` | -| `traefik..frontend.auth.digest.usersFile=/path/.htdigest` | Same as `traefik.frontend.auth.digest.usersFile` | -| `traefik..frontend.auth.forward.address=https://example.com` | Same as `traefik.frontend.auth.forward.address` | -| `traefik..frontend.auth.forward.authResponseHeaders=EXPR` | Same as `traefik.frontend.auth.forward.authResponseHeaders` | -| `traefik..frontend.auth.forward.tls.ca=/path/ca.pem` | Same as `traefik.frontend.auth.forward.tls.ca` | -| `traefik..frontend.auth.forward.tls.caOptional=true` | Same as `traefik.frontend.auth.forward.tls.caOptional` | -| `traefik..frontend.auth.forward.tls.cert=/path/server.pem` | Same as `traefik.frontend.auth.forward.tls.cert` | -| `traefik..frontend.auth.forward.tls.insecureSkipVerify=true` | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify` | -| `traefik..frontend.auth.forward.tls.key=/path/server.key` | Same as `traefik.frontend.auth.forward.tls.key` | -| `traefik..frontend.auth.forward.trustForwardHeader=true` | Same as `traefik.frontend.auth.forward.trustForwardHeader` | -| `traefik..frontend.auth.headerField=X-WebAuth-User` | Same as `traefik.frontend.auth.headerField` | -| `traefik..frontend.entryPoints=https` | Same as `traefik.frontend.entryPoints` | -| `traefik..frontend.errors..backend=NAME` | Same as `traefik.frontend.errors..backend` | -| `traefik..frontend.errors..query=PATH` | Same as `traefik.frontend.errors..query` | -| `traefik..frontend.errors..status=RANGE` | Same as `traefik.frontend.errors..status` | -| `traefik..frontend.passHostHeader=true` | Same as `traefik.frontend.passHostHeader` | -| `traefik..frontend.passTLSClientCert.infos.issuer.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName` | -| `traefik..frontend.passTLSClientCert.infos.issuer.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country` | -| `traefik..frontend.passTLSClientCert.infos.issuer.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.issuer.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality` | -| `traefik..frontend.passTLSClientCert.infos.issuer.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization` | -| `traefik..frontend.passTLSClientCert.infos.issuer.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province` | -| `traefik..frontend.passTLSClientCert.infos.issuer.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber` | -| `traefik..frontend.passTLSClientCert.infos.notAfter=true` | Same as `traefik.frontend.passTLSClientCert.infos.notAfter` | -| `traefik..frontend.passTLSClientCert.infos.notBefore=true` | Same as `traefik.frontend.passTLSClientCert.infos.notBefore` | -| `traefik..frontend.passTLSClientCert.infos.sans=true` | Same as `traefik.frontend.passTLSClientCert.infos.sans` | -| `traefik..frontend.passTLSClientCert.infos.subject.commonName=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName` | -| `traefik..frontend.passTLSClientCert.infos.subject.country=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.country` | -| `traefik..frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` | -| `traefik..frontend.passTLSClientCert.infos.subject.locality=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality` | -| `traefik..frontend.passTLSClientCert.infos.subject.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization` | -| `traefik..frontend.passTLSClientCert.infos.subject.province=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.province` | -| `traefik..frontend.passTLSClientCert.infos.subject.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber` | -| `traefik..frontend.passTLSClientCert.pem=true` | Same as `traefik.frontend.passTLSClientCert.infos.pem` | -| `traefik..frontend.passTLSCert=true` | Same as `traefik.frontend.passTLSCert` | -| `traefik..frontend.priority=10` | Same as `traefik.frontend.priority` | -| `traefik..frontend.rateLimit.extractorFunc=EXP` | Same as `traefik.frontend.rateLimit.extractorFunc` | -| `traefik..frontend.rateLimit.rateSet..period=6` | Same as `traefik.frontend.rateLimit.rateSet..period` | -| `traefik..frontend.rateLimit.rateSet..average=6` | Same as `traefik.frontend.rateLimit.rateSet..average` | -| `traefik..frontend.rateLimit.rateSet..burst=6` | Same as `traefik.frontend.rateLimit.rateSet..burst` | -| `traefik..frontend.redirect.entryPoint=https` | Same as `traefik.frontend.redirect.entryPoint` | -| `traefik..frontend.redirect.regex=^http://localhost/(.*)` | Same as `traefik.frontend.redirect.regex` | -| `traefik..frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement` | -| `traefik..frontend.redirect.permanent=true` | Same as `traefik.frontend.redirect.permanent` | -| `traefik..frontend.rule=EXP` | Same as `traefik.frontend.rule` | -| `traefik..frontend.whiteList.sourceRange=RANGE` | Same as `traefik.frontend.whiteList.sourceRange` | -| `traefik..frontend.whiteList.ipStrategy=true` | Same as `traefik.frontend.whiteList.ipStrategy` | -| `traefik..frontend.whiteList.ipStrategy.depth=5` | Same as `traefik.frontend.whiteList.ipStrategy.depth` | -| `traefik..frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | Same as `traefik.frontend.whiteList.ipStrategy.excludedIPs` | - -#### Custom Headers - -| Label | Description | -|----------------------------------------------------------------------|------------------------------------------------------------| -| `traefik..frontend.headers.customRequestHeaders=EXPR ` | overrides `traefik.frontend.headers.customRequestHeaders` | -| `traefik..frontend.headers.customResponseHeaders=EXPR` | overrides `traefik.frontend.headers.customResponseHeaders` | - -#### Security Headers - -| Label | Description | -|-------------------------------------------------------------------------|--------------------------------------------------------------| -| `traefik..frontend.headers.allowedHosts=EXPR` | overrides `traefik.frontend.headers.allowedHosts` | -| `traefik..frontend.headers.browserXSSFilter=true` | overrides `traefik.frontend.headers.browserXSSFilter` | -| `traefik..frontend.headers.contentSecurityPolicy=VALUE` | overrides `traefik.frontend.headers.contentSecurityPolicy` | -| `traefik..frontend.headers.contentTypeNosniff=true` | overrides `traefik.frontend.headers.contentTypeNosniff` | -| `traefik..frontend.headers.customBrowserXSSValue=VALUE` | overrides `traefik.frontend.headers.customBrowserXSSValue` | -| `traefik..frontend.headers.customFrameOptionsValue=VALUE` | overrides `traefik.frontend.headers.customFrameOptionsValue` | -| `traefik..frontend.headers.forceSTSHeader=false` | overrides `traefik.frontend.headers.forceSTSHeader` | -| `traefik..frontend.headers.frameDeny=false` | overrides `traefik.frontend.headers.frameDeny` | -| `traefik..frontend.headers.hostsProxyHeaders=EXPR` | overrides `traefik.frontend.headers.hostsProxyHeaders` | -| `traefik..frontend.headers.isDevelopment=false` | overrides `traefik.frontend.headers.isDevelopment` | -| `traefik..frontend.headers.publicKey=VALUE` | overrides `traefik.frontend.headers.publicKey` | -| `traefik..frontend.headers.referrerPolicy=VALUE` | overrides `traefik.frontend.headers.referrerPolicy` | -| `traefik..frontend.headers.SSLRedirect=true` | overrides `traefik.frontend.headers.SSLRedirect` | -| `traefik..frontend.headers.SSLTemporaryRedirect=true` | overrides `traefik.frontend.headers.SSLTemporaryRedirect` | -| `traefik..frontend.headers.SSLHost=HOST` | overrides `traefik.frontend.headers.SSLHost` | -| `traefik..frontend.headers.SSLForceHost=true` | overrides `traefik.frontend.headers.SSLForceHost` | -| `traefik..frontend.headers.SSLProxyHeaders=EXPR` | overrides `traefik.frontend.headers.SSLProxyHeaders` | -| `traefik..frontend.headers.STSSeconds=315360000` | overrides `traefik.frontend.headers.STSSeconds` | -| `traefik..frontend.headers.STSIncludeSubdomains=true` | overrides `traefik.frontend.headers.STSIncludeSubdomains` | -| `traefik..frontend.headers.STSPreload=true` | overrides `traefik.frontend.headers.STSPreload` | diff --git a/old/docs/configuration/backends/rest.md b/old/docs/configuration/backends/rest.md deleted file mode 100644 index 4051e7cbf..000000000 --- a/old/docs/configuration/backends/rest.md +++ /dev/null @@ -1,92 +0,0 @@ -# Rest Provider - -Traefik can be configured: - -- using a RESTful api. - -## Configuration - -```toml -# Enable REST Provider. -[rest] - # Name of the related entry point - # - # Optional - # Default: "traefik" - # - entryPoint = "traefik" -``` - -## API - -| Path | Method | Description | -|------------------------------|--------|-----------------| -| `/api/providers/web` | `PUT` | update provider | -| `/api/providers/rest` | `PUT` | update provider | - -!!! warning - For compatibility reason, when you activate the rest provider, you can use `web` or `rest` as `provider` value. - - -```shell -curl -XPUT -d @file "http://localhost:8080/api/providers/rest" -``` - -with `@file`: -```json -{ - "frontends": { - "frontend2": { - "routes": { - "test_2": { - "rule": "Path:/test" - } - }, - "backend": "backend1" - }, - "frontend1": { - "routes": { - "test_1": { - "rule": "Host:test.localhost" - } - }, - "backend": "backend2" - } - }, - "backends": { - "backend2": { - "loadBalancer": { - "method": "drr" - }, - "servers": { - "server2": { - "weight": 2, - "URL": "http://172.17.0.5:80" - }, - "server1": { - "weight": 1, - "url": "http://172.17.0.4:80" - } - } - }, - "backend1": { - "loadBalancer": { - "method": "wrr" - }, - "circuitBreaker": { - "expression": "NetworkErrorRatio() > 0.5" - }, - "servers": { - "server2": { - "weight": 1, - "url": "http://172.17.0.3:80" - }, - "server1": { - "weight": 10, - "url": "http://172.17.0.2:80" - } - } - } - } -} -``` diff --git a/old/docs/configuration/backends/servicefabric.md b/old/docs/configuration/backends/servicefabric.md deleted file mode 100644 index 635a2ef66..000000000 --- a/old/docs/configuration/backends/servicefabric.md +++ /dev/null @@ -1,160 +0,0 @@ -# Azure Service Fabric Provider - -Traefik can be configured to use Azure Service Fabric as a provider. - -See [this repository for an example deployment package and further documentation.](https://aka.ms/traefikonsf) - -## Azure Service Fabric - -```toml -################################################################ -# Azure Service Fabric Provider -################################################################ - -# Enable Azure Service Fabric Provider -[serviceFabric] - -# Azure Service Fabric Management Endpoint -# -# Required -# -clusterManagementUrl = "https://localhost:19080" - -# Azure Service Fabric Management Endpoint API Version -# -# Required -# Default: "3.0" -# -apiVersion = "3.0" - -# Azure Service Fabric Polling Interval (in seconds) -# -# Required -# Default: 10 -# -refreshSeconds = 10 - -# Enable TLS connection. -# -# Optional -# -# [serviceFabric.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/servicefabric.crt" -# key = "/etc/ssl/servicefabric.key" -# insecureSkipVerify = true -``` - -## Labels - -The provider uses labels to configure how services are exposed through Traefik. -These can be set using Extensions and the Property Manager API - -#### Extensions - -Set labels with extensions through the services `ServiceManifest.xml` file. -Here is an example of an extension setting Traefik labels: - -```xml - - - - - - - - - - - -``` - -#### Property Manager - -Set Labels with the property manager API to overwrite and add labels, while your service is running. -Here is an example of adding a frontend rule using the property manager API. - -```shell -curl -X PUT \ - 'http://localhost:19080/Names/GettingStartedApplication2/WebService/$/GetProperty?api-version=6.0&IncludeValues=true' \ - -d '{ - "PropertyName": "traefik.frontend.rule.default", - "Value": { - "Kind": "String", - "Data": "PathPrefixStrip: /a/path/to/strip" - }, - "CustomTypeId": "LabelType" -}' -``` - -!!! note - This functionality will be released in a future version of the [sfctl](https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-application-lifecycle-sfctl) tool. - -## Available Labels - -Labels, set through extensions or the property manager, can be used on services to override default behavior. - -| Label | Description | -|-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.enable=false` | Disable this container in Traefik | -| `traefik.backend.circuitbreaker.expression=EXPR` | Create a [circuit breaker](/basics/#backends) to be used against the backend | -| `traefik.servicefabric.groupname` | Group all services with the same name into a single backend in Traefik | -| `traefik.servicefabric.groupweight` | Set the weighting of the current services nodes in the backend group | -| `traefik.servicefabric.enablelabeloverrides` | Toggle whether labels can be overridden using the Service Fabric Property Manager API | -| `traefik.backend.healthcheck.path=/health` | Enable health check for the backend, hitting the container at `path`. | -| `traefik.backend.healthcheck.port=8080` | Allow to use a different port for the health check. | -| `traefik.backend.healthcheck.interval=5s` | Define the health check interval. | -| `traefik.backend.healthcheck.timeout=3s` | Define the health check request timeout. | -| `traefik.backend.healthcheck.hostname=foobar.com` | Define the health check hostname. | -| `traefik.backend.healthcheck.headers=EXPR` | Define the health check request headers
Format: HEADER:value||HEADER2:value2 | -| `traefik.backend.loadbalancer.method=drr` | Override the default `wrr` load balancer algorithm | -| `traefik.backend.loadbalancer.stickiness=true` | Enable backend sticky sessions | -| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions | -| `traefik.backend.maxconn.amount=10` | Set a maximum number of connections to the backend.
Must be used in conjunction with the below label to take effect. | -| `traefik.backend.maxconn.extractorfunc=client.ip` | Set the function to be used against the request to determine what to limit maximum connections to the backend by.
Must be used in conjunction with the above label to take effect. | -| `traefik.backend.weight=10` | Assign this weight to the container | -| `traefik.frontend.auth.basic=EXPR` | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash` | -| `traefik.frontend.entryPoints=http,https` | Assign this frontend to entry points `http` and `https`.
Overrides `defaultEntryPoints` | -| `traefik.frontend.passHostHeader=true` | Forward client `Host` header to the backend. | -| `traefik.frontend.passTLSCert=true` | Forward TLS Client certificates to the backend. | -| `traefik.frontend.priority=10` | Override default frontend priority | -| `traefik.frontend.redirect.entryPoint=https` | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS) | -| `traefik.frontend.redirect.regex=^http://localhost/(.*)` | Redirect to another URL for that frontend.
Must be set with `traefik.frontend.redirect.replacement`. | -| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.
Must be set with `traefik.frontend.redirect.regex`. | -| `traefik.frontend.redirect.permanent=true` | Return 301 instead of 302. | -| `traefik.frontend.rule=EXPR` | Override the default frontend rule. Defaults to SF address. | -| `traefik.frontend.whiteList.sourceRange=RANGE` | List of IP-Ranges which are allowed to access.
An unset or empty list allows all Source-IPs to access.
If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. | -| `traefik.frontend.whiteList.ipStrategy=true` | Uses the default IPStrategy.
Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting. | -| `traefik.frontend.whiteList.ipStrategy.depth=5` | See [whitelist](/configuration/entrypoints/#white-listing) | -| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1` | See [whitelist](/configuration/entrypoints/#white-listing) | - -### Custom Headers - -| Label | Description | -|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.
Format: HEADER:value||HEADER2:value2 | - -### Security Headers - -| Label | Description | -|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `traefik.frontend.headers.allowedHosts=EXPR` | Provides a list of allowed hosts that requests will be processed.
Format: `Host1,Host2` | -| `traefik.frontend.headers.hostsProxyHeaders=EXPR ` | Provides a list of headers that the proxied hostname may be stored.
Format: `HEADER1,HEADER2` | -| `traefik.frontend.headers.SSLRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent. | -| `traefik.frontend.headers.SSLTemporaryRedirect=true` | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301. | -| `traefik.frontend.headers.SSLHost=HOST` | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request. | -| `traefik.frontend.headers.SSLProxyHeaders=EXPR` | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).
Format: HEADER:value||HEADER2:value2 | -| `traefik.frontend.headers.STSSeconds=315360000` | Sets the max-age of the STS header. | -| `traefik.frontend.headers.STSIncludeSubdomains=true` | Adds the `IncludeSubdomains` section of the STS header. | -| `traefik.frontend.headers.STSPreload=true` | Adds the preload flag to the STS header. | -| `traefik.frontend.headers.forceSTSHeader=false` | Adds the STS header to non-SSL requests. | -| `traefik.frontend.headers.frameDeny=false` | Adds the `X-Frame-Options` header with the value of `DENY`. | -| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value. | -| `traefik.frontend.headers.contentTypeNosniff=true` | Adds the `X-Content-Type-Options` header with the value `nosniff`. | -| `traefik.frontend.headers.browserXSSFilter=true` | Adds the X-XSS-Protection header with the value `1; mode=block`. | -| `traefik.frontend.headers.customBrowserXSSValue=VALUE` | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option. | -| `traefik.frontend.headers.contentSecurityPolicy=VALUE` | Adds CSP Header with the custom value. | -| `traefik.frontend.headers.publicKey=VALUE` | Adds HPKP header. | -| `traefik.frontend.headers.referrerPolicy=VALUE` | Adds referrer policy header. | -| `traefik.frontend.headers.isDevelopment=false` | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.
When deploying to production, be sure to set this to false. | diff --git a/old/docs/configuration/backends/zookeeper.md b/old/docs/configuration/backends/zookeeper.md deleted file mode 100644 index 34aa4e2f4..000000000 --- a/old/docs/configuration/backends/zookeeper.md +++ /dev/null @@ -1,61 +0,0 @@ -# Zookeeper Provider - -Traefik can be configured to use Zookeeper as a provider. - -```toml -################################################################ -# Zookeeper Provider -################################################################ - -# Enable Zookeeper Provider. -[zookeeper] - -# Zookeeper server endpoint. -# -# Required -# Default: "127.0.0.1:2181" -# -endpoint = "127.0.0.1:2181" - -# Enable watch Zookeeper changes. -# -# Optional -# Default: true -# -watch = true - -# Prefix used for KV store. -# -# Optional -# Default: "traefik" -# -prefix = "traefik" - -# Override default configuration template. -# For advanced users :) -# -# Optional -# -# filename = "zookeeper.tmpl" - -# Use Zookeeper user/pass authentication. -# -# Optional -# -# username = foo -# password = bar - -# Enable Zookeeper TLS connection. -# -# Optional -# -# [zookeeper.tls] -# ca = "/etc/ssl/ca.crt" -# cert = "/etc/ssl/zookeeper.crt" -# key = "/etc/ssl/zookeeper.key" -# insecureSkipVerify = true -``` - -To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific). - -Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure. diff --git a/old/docs/configuration/commons.md b/old/docs/configuration/commons.md deleted file mode 100644 index 1826dfd76..000000000 --- a/old/docs/configuration/commons.md +++ /dev/null @@ -1,306 +0,0 @@ -# Global Configuration - -## Main Section - -```toml -# Enable debug mode. -# This will install HTTP handlers to expose Go expvars under /debug/vars and -# pprof profiling data under /debug/pprof/. -# The log level will be set to DEBUG unless `logLevel` is specified. -# -# Optional -# Default: false -# -# debug = true - -# Periodically check if a new version has been released. -# -# Optional -# Default: true -# -# checkNewVersion = false - -# Tells traefik whether it should keep the trailing slashes in the paths (e.g. /paths/) or redirect to the no trailing slash paths instead (/paths). -# -# Optional -# Default: false -# -# keepTrailingSlash = false - -# Providers throttle duration. -# -# Optional -# Default: "2s" -# -# providersThrottleDuration = "2s" - -# Controls the maximum idle (keep-alive) connections to keep per-host. -# -# Optional -# Default: 200 -# -# maxIdleConnsPerHost = 200 - -# If set to true invalid SSL certificates are accepted for backends. -# This disables detection of man-in-the-middle attacks so should only be used on secure backend networks. -# -# Optional -# Default: false -# -# insecureSkipVerify = true - -# Register Certificates in the rootCA. -# -# Optional -# Default: [] -# -# rootCAs = [ "/mycert.cert" ] - -# Entrypoints to be used by frontends that do not specify any entrypoint. -# Each frontend can specify its own entrypoints. -# -# Optional -# Default: ["http"] -# -# defaultEntryPoints = ["http", "https"] -``` - -- `providersThrottleDuration`: Providers throttle duration: minimum duration in seconds between 2 events from providers before applying a new configuration. -It avoids unnecessary reloads if multiples events are sent in a short amount of time. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -- `maxIdleConnsPerHost`: Controls the maximum idle (keep-alive) connections to keep per-host. -If zero, `DefaultMaxIdleConnsPerHost` from the Go standard library net/http module is used. -If you encounter 'too many open files' errors, you can either increase this value or change the `ulimit`. - -- `insecureSkipVerify` : If set to true invalid SSL certificates are accepted for backends. -**Note:** This disables detection of man-in-the-middle attacks so should only be used on secure backend networks. - -- `rootCAs`: Register Certificates in the RootCA. This certificates will be use for backends calls. -**Note** You can use file path or cert content directly - -- `defaultEntryPoints`: Entrypoints to be used by frontends that do not specify any entrypoint. -Each frontend can specify its own entrypoints. - -- `keepTrailingSlash`: Tells Traefik whether it should keep the trailing slashes that might be present in the paths of incoming requests (true), or if it should redirect to the slashless version of the URL (default behavior: false) - -!!! note - Beware that the value of `keepTrailingSlash` can have a significant impact on the way your frontend rules are interpreted. - The table below tries to sum up several behaviors depending on requests/configurations. - The current default behavior is deprecated and kept for compatibility reasons. - As a consequence, we encourage you to set `keepTrailingSlash` to true. - - | Incoming request | keepTrailingSlash | Path:{value} | Behavior - |----------------------|-------------------|--------------|----------------------------| - | http://foo.com/path/ | false | Path:/path/ | Proceeds with the request | - | http://foo.com/path/ | false | Path:/path | 301 to http://foo.com/path | - | http://foo.com/path | false | Path:/path/ | Proceeds with the request | - | http://foo.com/path | false | Path:/path | Proceeds with the request | - | http://foo.com/path/ | true | Path:/path/ | Proceeds with the request | - | http://foo.com/path/ | true | Path:/path | 404 | - | http://foo.com/path | true | Path:/path/ | 404 | - | http://foo.com/path | true | Path:/path | Proceeds with the request | - - -## Life Cycle - -Controls the behavior of Traefik during the shutdown phase. - -```toml -[lifeCycle] - -# Duration to keep accepting requests prior to initiating the graceful -# termination period (as defined by the `graceTimeOut` option). This -# option is meant to give downstream load-balancers sufficient time to -# take Traefik out of rotation. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -# If no units are provided, the value is parsed assuming seconds. -# The zero duration disables the request accepting grace period, i.e., -# Traefik will immediately proceed to the grace period. -# -# Optional -# Default: 0 -# -# requestAcceptGraceTimeout = "10s" - -# Duration to give active requests a chance to finish before Traefik stops. -# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -# If no units are provided, the value is parsed assuming seconds. -# Note: in this time frame no new requests are accepted. -# -# Optional -# Default: "10s" -# -# graceTimeOut = "10s" -``` - -## Timeouts - -### Responding Timeouts - -`respondingTimeouts` are timeouts for incoming requests to the Traefik instance. - -```toml -[respondingTimeouts] - -# readTimeout is the maximum duration for reading the entire request, including the body. -# -# Optional -# Default: "0s" -# -# readTimeout = "5s" - -# writeTimeout is the maximum duration before timing out writes of the response. -# -# Optional -# Default: "0s" -# -# writeTimeout = "5s" - -# idleTimeout is the maximum duration an idle (keep-alive) connection will remain idle before closing itself. -# -# Optional -# Default: "180s" -# -# idleTimeout = "360s" -``` - -- `readTimeout` is the maximum duration for reading the entire request, including the body. -If zero, no timeout exists. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -- `writeTimeout` is the maximum duration before timing out writes of the response. -It covers the time from the end of the request header read to the end of the response write. -If zero, no timeout exists. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -- `idleTimeout` is the maximum duration an idle (keep-alive) connection will remain idle before closing itself. -If zero, no timeout exists. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -### Forwarding Timeouts - -`forwardingTimeouts` are timeouts for requests forwarded to the backend servers. - -```toml -[forwardingTimeouts] - -# dialTimeout is the amount of time to wait until a connection to a backend server can be established. -# -# Optional -# Default: "30s" -# -# dialTimeout = "30s" - -# responseHeaderTimeout is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any). -# -# Optional -# Default: "0s" -# -# responseHeaderTimeout = "0s" -``` - -- `dialTimeout` is the amount of time to wait until a connection to a backend server can be established. -If zero, no timeout exists. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -- `responseHeaderTimeout` is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any). -If zero, no timeout exists. -Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits). -If no units are provided, the value is parsed assuming seconds. - -## Host Resolver - -`hostResolver` are used for request host matching process. - -```toml -[hostResolver] - -# cnameFlattening is a trigger to flatten request host, assuming it is a CNAME record -# -# Optional -# Default : false -# -cnameFlattening = true - -# resolvConf is dns resolving configuration file, the default is /etc/resolv.conf -# -# Optional -# Default : "/etc/resolv.conf" -# -# resolvConf = "/etc/resolv.conf" - -# resolvDepth is the maximum CNAME recursive lookup -# -# Optional -# Default : 5 -# -# resolvDepth = 5 -``` - -- To allow serving secure https request and generate the SSL using ACME while `cnameFlattening` is active. -The `acme` configuration for `HTTP-01` challenge and `onDemand` is mandatory. -Refer to [ACME configuration](/configuration/acme) for more information. - -## Override Default Configuration Template - -!!! warning - For advanced users only. - -Supported by all providers except: File Provider, Rest Provider and DynamoDB Provider. - -```toml -[provider_name] - -# Override default provider configuration template. For advanced users :) -# -# Optional -# Default: "" -# -filename = "custom_config_template.tpml" - -# Enable debug logging of generated configuration template. -# -# Optional -# Default: false -# -debugLogGeneratedTemplate = true -``` - -Example: - -```toml -[marathon] -filename = "my_custom_config_template.tpml" -``` - -The template files can be written using functions provided by: - -- [go template](https://golang.org/pkg/text/template/) -- [sprig library](https://masterminds.github.io/sprig/) - -Example: - -```tmpl -[backends] - [backends.backend1] - url = "http://firstserver" - [backends.backend2] - url = "http://secondserver" - -{{$frontends := dict "frontend1" "backend1" "frontend2" "backend2"}} -[frontends] -{{range $frontend, $backend := $frontends}} - [frontends.{{$frontend}}] - backend = "{{$backend}}" -{{end}} -``` - -### Using ping for an external Load-balancer rotation health check - -If you are running Traefik behind an external Load-balancer, and want to configure rotation health check on the Load-balancer to take a Traefik instance out of rotation gracefully, you can configure [lifecycle.requestAcceptGraceTimeout](/configuration/commons.md#life-cycle) and the ping endpoint will return `503` response on traefik server termination, so that the Load-balancer can take the terminating traefik instance out of rotation, before it stops responding. diff --git a/old/docs/img/architecture.png b/old/docs/img/architecture.png deleted file mode 100644 index 85cde6491..000000000 Binary files a/old/docs/img/architecture.png and /dev/null differ diff --git a/old/docs/img/architecture.svg b/old/docs/img/architecture.svg deleted file mode 100644 index db214d233..000000000 --- a/old/docs/img/architecture.svg +++ /dev/null @@ -1,2407 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - API - - BACKOFFICE 1 - - DATA - - WEB - - ADMIN - - BACKOFFICE 2 - - BACKOFFICE 3 - - - - - API.DOMAIN.COM - DOMAIN.COM/WEB - BACKOFFICE.DOMAIN.COM - - - - - - - ORCHESTRATOR - - PRIVATE NETWORK - INTERNET - - API - LISTEN - (DOCKER, SWARM, MESOS...) - - - - - diff --git a/old/docs/img/grpc.svg b/old/docs/img/grpc.svg deleted file mode 100644 index 3f1d53c76..000000000 --- a/old/docs/img/grpc.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - - diff --git a/old/docs/img/internal.png b/old/docs/img/internal.png deleted file mode 100644 index 0abe8799f..000000000 Binary files a/old/docs/img/internal.png and /dev/null differ diff --git a/old/docs/img/letsencrypt-logo-horizontal.svg b/old/docs/img/letsencrypt-logo-horizontal.svg deleted file mode 100644 index 5498a1e7b..000000000 --- a/old/docs/img/letsencrypt-logo-horizontal.svg +++ /dev/null @@ -1,172 +0,0 @@ - - - - - - image/svg+xml - - - - - - - - Layer 1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/old/docs/img/overview.svg b/old/docs/img/overview.svg deleted file mode 100644 index 6d6bc027c..000000000 --- a/old/docs/img/overview.svg +++ /dev/null @@ -1,5394 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - image/svg+xml - - - - - - - - Port: 80Redirect: SSL - - Port: 443Redirect: no - - - - - FRONTENDS - ENTRYPOINTS - HTTP - SSL - Host:api.domain.com - - Host:backoffice.domain.com - - Host:domain.comPath:/web - - BACKENDS - - BACK 1 - - BACK 2 - BACK 3 - - WEB - - API - - - - - - - - - - - - - - - API - WEB - BACKOFFICE 1 - BACKOFFICE 2 - - - - - - BACKOFFICE 3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/old/docs/img/traefik-health.png b/old/docs/img/traefik-health.png deleted file mode 100644 index cf3160975..000000000 Binary files a/old/docs/img/traefik-health.png and /dev/null differ diff --git a/old/docs/img/traefik.icon.png b/old/docs/img/traefik.icon.png deleted file mode 100644 index 9708dd0ba..000000000 Binary files a/old/docs/img/traefik.icon.png and /dev/null differ diff --git a/old/docs/img/traefik.logo.png b/old/docs/img/traefik.logo.png deleted file mode 100644 index 4778d0f5b..000000000 Binary files a/old/docs/img/traefik.logo.png and /dev/null differ diff --git a/old/docs/img/web.frontend.png b/old/docs/img/web.frontend.png deleted file mode 100644 index 62a90e5e9..000000000 Binary files a/old/docs/img/web.frontend.png and /dev/null differ diff --git a/old/docs/img/zenika.logo.png b/old/docs/img/zenika.logo.png deleted file mode 100644 index a4ef24487..000000000 Binary files a/old/docs/img/zenika.logo.png and /dev/null differ diff --git a/old/docs/index.md b/old/docs/index.md deleted file mode 100644 index d3edd240a..000000000 --- a/old/docs/index.md +++ /dev/null @@ -1,79 +0,0 @@ -

-Traefik -

- -[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik) -[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](/) -[![Go Report Card](https://goreportcard.com/badge/github.com/containous/traefik)](https://goreportcard.com/report/github.com/containous/traefik) -[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md) -[![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io) -[![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik) - - -Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy. -Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically. -Pointing Traefik at your orchestrator should be the _only_ configuration step you need. - -## Overview - -Imagine that you have deployed a bunch of microservices with the help of an orchestrator (like Swarm or Kubernetes) or a service registry (like etcd or consul). -Now you want users to access these microservices, and you need a reverse proxy. - -Traditional reverse-proxies require that you configure _each_ route that will connect paths and subdomains to _each_ microservice. -In an environment where you add, remove, kill, upgrade, or scale your services _many_ times a day, the task of keeping the routes up to date becomes tedious. - -**This is when Traefik can help you!** - -Traefik listens to your service registry/orchestrator API and instantly generates the routes so your microservices are connected to the outside world -- without further intervention from your part. - -**Run Traefik and let it do the work for you!** -_(But if you'd rather configure some of your routes manually, Traefik supports that too!)_ - -![Architecture](img/architecture.png) - -## Features - -- Continuously updates its configuration (No restarts!) -- Supports multiple load balancing algorithms -- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org) (wildcard certificates support) -- Circuit breakers, retry -- High Availability with cluster mode (beta) -- See the magic through its clean web UI -- Websocket, HTTP/2, GRPC ready -- Provides metrics (Rest, Prometheus, Datadog, Statsd, InfluxDB) -- Keeps access logs (JSON, CLF) -- Fast -- Exposes a Rest API -- Packaged as a single binary file (made with ❤️ with go) and available as a [tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) docker image - - -## Supported Providers - -- [Docker](/configuration/backends/docker/) / [Swarm mode](/configuration/backends/docker/#docker-swarm-mode) -- [Kubernetes](/configuration/backends/kubernetes/) -- [Mesos](/configuration/backends/mesos/) / [Marathon](/configuration/backends/marathon/) -- [Rancher](/configuration/backends/rancher/) (API, Metadata) -- [Azure Service Fabric](/configuration/backends/servicefabric/) -- [Consul Catalog](/configuration/backends/consulcatalog/) -- [Consul](/configuration/backends/consul/) / [Etcd](/configuration/backends/etcd/) / [Zookeeper](/configuration/backends/zookeeper/) / [BoltDB](/configuration/backends/boltdb/) -- [Eureka](/configuration/backends/eureka/) -- [Amazon ECS](/configuration/backends/ecs/) -- [Amazon DynamoDB](/configuration/backends/dynamodb/) -- [File](/configuration/backends/file/) -- [Rest](/configuration/backends/rest/) - -## Security - -### Security Advisories - -We strongly advise you to join our mailing list to be aware of the latest announcements from our security team. You can subscribe sending a mail to security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security). - -### CVE - -Reported vulnerabilities can be found on -[cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik). - -### Report a Vulnerability - -We want to keep Traefik safe for everyone. -If you've discovered a security vulnerability in Traefik, we appreciate your help in disclosing it to us in a responsible manner, using [this form](https://security.traefik.io). diff --git a/old/docs/metrics.md b/old/docs/metrics.md deleted file mode 100644 index 13747307b..000000000 --- a/old/docs/metrics.md +++ /dev/null @@ -1,148 +0,0 @@ -# Metrics - -## Old Content - -# Metrics Definition - -## Prometheus - -```toml -# Metrics definition -[metrics] - #... - - # To enable Traefik to export internal metrics to Prometheus - [metrics.prometheus] - - # Name of the related entry point - # - # Optional - # Default: "traefik" - # - entryPoint = "traefik" - - # Buckets for latency metrics - # - # Optional - # Default: [0.1, 0.3, 1.2, 5.0] - # - buckets = [0.1,0.3,1.2,5.0] - - # ... -``` - -## DataDog - -```toml -# Metrics definition -[metrics] - #... - - # DataDog metrics exporter type - [metrics.datadog] - - # DataDog's address. - # - # Required - # Default: "localhost:8125" - # - address = "localhost:8125" - - # DataDog push interval - # - # Optional - # Default: "10s" - # - pushInterval = "10s" - - # ... -``` - -## StatsD - -```toml -# Metrics definition -[metrics] - #... - - # StatsD metrics exporter type - [metrics.statsd] - - # StatD's address. - # - # Required - # Default: "localhost:8125" - # - address = "localhost:8125" - - # StatD push interval - # - # Optional - # Default: "10s" - # - pushInterval = "10s" - - # ... -``` - -## InfluxDB - -```toml -[metrics] - # ... - - # InfluxDB metrics exporter type - [metrics.influxdb] - - # InfluxDB's address. - # - # Required - # Default: "localhost:8089" - # - address = "localhost:8089" - - # InfluxDB's address protocol (udp or http) - # - # Required - # Default: "udp" - # - protocol = "udp" - - # InfluxDB's username - # - # Optional - # Default: "" (no username) - # - username = "" - - # InfluxDB's password - # - # Optional - # Default: "" (no password) - # - password = "" - - # InfluxDB push interval - # - # Optional - # Default: "10s" - # - pushinterval = "10s" - - # InfluxDB database used when protocol is http - # - # Optional - # Default: "" - # - database = "" - - # InfluxDB retention policy used when protocol is http - # - # Optional - # Default: "" - # - retentionpolicy = "" - - # ... -``` - diff --git a/old/docs/theme/js/extra.js b/old/docs/theme/js/extra.js deleted file mode 100644 index eb0cc12ff..000000000 --- a/old/docs/theme/js/extra.js +++ /dev/null @@ -1,4 +0,0 @@ -/* Highlight */ -(function(hljs) { - hljs.initHighlightingOnLoad(); -})(hljs); \ No newline at end of file diff --git a/old/docs/theme/js/hljs/LICENSE b/old/docs/theme/js/hljs/LICENSE deleted file mode 100644 index 422deb735..000000000 --- a/old/docs/theme/js/hljs/LICENSE +++ /dev/null @@ -1,24 +0,0 @@ -Copyright (c) 2006, Ivan Sagalaev -All rights reserved. -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - * Neither the name of highlight.js nor the names of its contributors - may be used to endorse or promote products derived from this software - without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY -EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY -DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; -LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND -ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS -SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/old/docs/theme/js/hljs/highlight.pack.js b/old/docs/theme/js/hljs/highlight.pack.js deleted file mode 100644 index 00288b0e3..000000000 --- a/old/docs/theme/js/hljs/highlight.pack.js +++ /dev/null @@ -1,2 +0,0 @@ -/*! highlight.js v9.12.0 | BSD3 License | git.io/hljslicense */ -!function(e){var n="object"==typeof window&&window||"object"==typeof self&&self;"undefined"!=typeof exports?e(exports):n&&(n.hljs=e({}),"function"==typeof define&&define.amd&&define([],function(){return n.hljs}))}(function(e){function n(e){return e.replace(/&/g,"&").replace(//g,">")}function t(e){return e.nodeName.toLowerCase()}function r(e,n){var t=e&&e.exec(n);return t&&0===t.index}function a(e){return k.test(e)}function i(e){var n,t,r,i,o=e.className+" ";if(o+=e.parentNode?e.parentNode.className:"",t=B.exec(o))return w(t[1])?t[1]:"no-highlight";for(o=o.split(/\s+/),n=0,r=o.length;r>n;n++)if(i=o[n],a(i)||w(i))return i}function o(e){var n,t={},r=Array.prototype.slice.call(arguments,1);for(n in e)t[n]=e[n];return r.forEach(function(e){for(n in e)t[n]=e[n]}),t}function u(e){var n=[];return function r(e,a){for(var i=e.firstChild;i;i=i.nextSibling)3===i.nodeType?a+=i.nodeValue.length:1===i.nodeType&&(n.push({event:"start",offset:a,node:i}),a=r(i,a),t(i).match(/br|hr|img|input/)||n.push({event:"stop",offset:a,node:i}));return a}(e,0),n}function c(e,r,a){function i(){return e.length&&r.length?e[0].offset!==r[0].offset?e[0].offset"}function u(e){s+=""}function c(e){("start"===e.event?o:u)(e.node)}for(var l=0,s="",f=[];e.length||r.length;){var g=i();if(s+=n(a.substring(l,g[0].offset)),l=g[0].offset,g===e){f.reverse().forEach(u);do c(g.splice(0,1)[0]),g=i();while(g===e&&g.length&&g[0].offset===l);f.reverse().forEach(o)}else"start"===g[0].event?f.push(g[0].node):f.pop(),c(g.splice(0,1)[0])}return s+n(a.substr(l))}function l(e){return e.v&&!e.cached_variants&&(e.cached_variants=e.v.map(function(n){return o(e,{v:null},n)})),e.cached_variants||e.eW&&[o(e)]||[e]}function s(e){function n(e){return e&&e.source||e}function t(t,r){return new RegExp(n(t),"m"+(e.cI?"i":"")+(r?"g":""))}function r(a,i){if(!a.compiled){if(a.compiled=!0,a.k=a.k||a.bK,a.k){var o={},u=function(n,t){e.cI&&(t=t.toLowerCase()),t.split(" ").forEach(function(e){var t=e.split("|");o[t[0]]=[n,t[1]?Number(t[1]):1]})};"string"==typeof a.k?u("keyword",a.k):x(a.k).forEach(function(e){u(e,a.k[e])}),a.k=o}a.lR=t(a.l||/\w+/,!0),i&&(a.bK&&(a.b="\\b("+a.bK.split(" ").join("|")+")\\b"),a.b||(a.b=/\B|\b/),a.bR=t(a.b),a.e||a.eW||(a.e=/\B|\b/),a.e&&(a.eR=t(a.e)),a.tE=n(a.e)||"",a.eW&&i.tE&&(a.tE+=(a.e?"|":"")+i.tE)),a.i&&(a.iR=t(a.i)),null==a.r&&(a.r=1),a.c||(a.c=[]),a.c=Array.prototype.concat.apply([],a.c.map(function(e){return l("self"===e?a:e)})),a.c.forEach(function(e){r(e,a)}),a.starts&&r(a.starts,i);var c=a.c.map(function(e){return e.bK?"\\.?("+e.b+")\\.?":e.b}).concat([a.tE,a.i]).map(n).filter(Boolean);a.t=c.length?t(c.join("|"),!0):{exec:function(){return null}}}}r(e)}function f(e,t,a,i){function o(e,n){var t,a;for(t=0,a=n.c.length;a>t;t++)if(r(n.c[t].bR,e))return n.c[t]}function u(e,n){if(r(e.eR,n)){for(;e.endsParent&&e.parent;)e=e.parent;return e}return e.eW?u(e.parent,n):void 0}function c(e,n){return!a&&r(n.iR,e)}function l(e,n){var t=N.cI?n[0].toLowerCase():n[0];return e.k.hasOwnProperty(t)&&e.k[t]}function p(e,n,t,r){var a=r?"":I.classPrefix,i='',i+n+o}function h(){var e,t,r,a;if(!E.k)return n(k);for(a="",t=0,E.lR.lastIndex=0,r=E.lR.exec(k);r;)a+=n(k.substring(t,r.index)),e=l(E,r),e?(B+=e[1],a+=p(e[0],n(r[0]))):a+=n(r[0]),t=E.lR.lastIndex,r=E.lR.exec(k);return a+n(k.substr(t))}function d(){var e="string"==typeof E.sL;if(e&&!y[E.sL])return n(k);var t=e?f(E.sL,k,!0,x[E.sL]):g(k,E.sL.length?E.sL:void 0);return E.r>0&&(B+=t.r),e&&(x[E.sL]=t.top),p(t.language,t.value,!1,!0)}function b(){L+=null!=E.sL?d():h(),k=""}function v(e){L+=e.cN?p(e.cN,"",!0):"",E=Object.create(e,{parent:{value:E}})}function m(e,n){if(k+=e,null==n)return b(),0;var t=o(n,E);if(t)return t.skip?k+=n:(t.eB&&(k+=n),b(),t.rB||t.eB||(k=n)),v(t,n),t.rB?0:n.length;var r=u(E,n);if(r){var a=E;a.skip?k+=n:(a.rE||a.eE||(k+=n),b(),a.eE&&(k=n));do E.cN&&(L+=C),E.skip||(B+=E.r),E=E.parent;while(E!==r.parent);return r.starts&&v(r.starts,""),a.rE?0:n.length}if(c(n,E))throw new Error('Illegal lexeme "'+n+'" for mode "'+(E.cN||"")+'"');return k+=n,n.length||1}var N=w(e);if(!N)throw new Error('Unknown language: "'+e+'"');s(N);var R,E=i||N,x={},L="";for(R=E;R!==N;R=R.parent)R.cN&&(L=p(R.cN,"",!0)+L);var k="",B=0;try{for(var M,j,O=0;;){if(E.t.lastIndex=O,M=E.t.exec(t),!M)break;j=m(t.substring(O,M.index),M[0]),O=M.index+j}for(m(t.substr(O)),R=E;R.parent;R=R.parent)R.cN&&(L+=C);return{r:B,value:L,language:e,top:E}}catch(T){if(T.message&&-1!==T.message.indexOf("Illegal"))return{r:0,value:n(t)};throw T}}function g(e,t){t=t||I.languages||x(y);var r={r:0,value:n(e)},a=r;return t.filter(w).forEach(function(n){var t=f(n,e,!1);t.language=n,t.r>a.r&&(a=t),t.r>r.r&&(a=r,r=t)}),a.language&&(r.second_best=a),r}function p(e){return I.tabReplace||I.useBR?e.replace(M,function(e,n){return I.useBR&&"\n"===e?"
":I.tabReplace?n.replace(/\t/g,I.tabReplace):""}):e}function h(e,n,t){var r=n?L[n]:t,a=[e.trim()];return e.match(/\bhljs\b/)||a.push("hljs"),-1===e.indexOf(r)&&a.push(r),a.join(" ").trim()}function d(e){var n,t,r,o,l,s=i(e);a(s)||(I.useBR?(n=document.createElementNS("http://www.w3.org/1999/xhtml","div"),n.innerHTML=e.innerHTML.replace(/\n/g,"").replace(//g,"\n")):n=e,l=n.textContent,r=s?f(s,l,!0):g(l),t=u(n),t.length&&(o=document.createElementNS("http://www.w3.org/1999/xhtml","div"),o.innerHTML=r.value,r.value=c(t,u(o),l)),r.value=p(r.value),e.innerHTML=r.value,e.className=h(e.className,s,r.language),e.result={language:r.language,re:r.r},r.second_best&&(e.second_best={language:r.second_best.language,re:r.second_best.r}))}function b(e){I=o(I,e)}function v(){if(!v.called){v.called=!0;var e=document.querySelectorAll("pre code");E.forEach.call(e,d)}}function m(){addEventListener("DOMContentLoaded",v,!1),addEventListener("load",v,!1)}function N(n,t){var r=y[n]=t(e);r.aliases&&r.aliases.forEach(function(e){L[e]=n})}function R(){return x(y)}function w(e){return e=(e||"").toLowerCase(),y[e]||y[L[e]]}var E=[],x=Object.keys,y={},L={},k=/^(no-?highlight|plain|text)$/i,B=/\blang(?:uage)?-([\w-]+)\b/i,M=/((^(<[^>]+>|\t|)+|(?:\n)))/gm,C="",I={classPrefix:"hljs-",tabReplace:null,useBR:!1,languages:void 0};return e.highlight=f,e.highlightAuto=g,e.fixMarkup=p,e.highlightBlock=d,e.configure=b,e.initHighlighting=v,e.initHighlightingOnLoad=m,e.registerLanguage=N,e.listLanguages=R,e.getLanguage=w,e.inherit=o,e.IR="[a-zA-Z]\\w*",e.UIR="[a-zA-Z_]\\w*",e.NR="\\b\\d+(\\.\\d+)?",e.CNR="(-?)(\\b0[xX][a-fA-F0-9]+|(\\b\\d+(\\.\\d*)?|\\.\\d+)([eE][-+]?\\d+)?)",e.BNR="\\b(0b[01]+)",e.RSR="!|!=|!==|%|%=|&|&&|&=|\\*|\\*=|\\+|\\+=|,|-|-=|/=|/|:|;|<<|<<=|<=|<|===|==|=|>>>=|>>=|>=|>>>|>>|>|\\?|\\[|\\{|\\(|\\^|\\^=|\\||\\|=|\\|\\||~",e.BE={b:"\\\\[\\s\\S]",r:0},e.ASM={cN:"string",b:"'",e:"'",i:"\\n",c:[e.BE]},e.QSM={cN:"string",b:'"',e:'"',i:"\\n",c:[e.BE]},e.PWM={b:/\b(a|an|the|are|I'm|isn't|don't|doesn't|won't|but|just|should|pretty|simply|enough|gonna|going|wtf|so|such|will|you|your|they|like|more)\b/},e.C=function(n,t,r){var a=e.inherit({cN:"comment",b:n,e:t,c:[]},r||{});return a.c.push(e.PWM),a.c.push({cN:"doctag",b:"(?:TODO|FIXME|NOTE|BUG|XXX):",r:0}),a},e.CLCM=e.C("//","$"),e.CBCM=e.C("/\\*","\\*/"),e.HCM=e.C("#","$"),e.NM={cN:"number",b:e.NR,r:0},e.CNM={cN:"number",b:e.CNR,r:0},e.BNM={cN:"number",b:e.BNR,r:0},e.CSSNM={cN:"number",b:e.NR+"(%|em|ex|ch|rem|vw|vh|vmin|vmax|cm|mm|in|pt|pc|px|deg|grad|rad|turn|s|ms|Hz|kHz|dpi|dpcm|dppx)?",r:0},e.RM={cN:"regexp",b:/\//,e:/\/[gimuy]*/,i:/\n/,c:[e.BE,{b:/\[/,e:/\]/,r:0,c:[e.BE]}]},e.TM={cN:"title",b:e.IR,r:0},e.UTM={cN:"title",b:e.UIR,r:0},e.METHOD_GUARD={b:"\\.\\s*"+e.UIR,r:0},e});hljs.registerLanguage("sql",function(e){var t=e.C("--","$");return{cI:!0,i:/[<>{}*#]/,c:[{bK:"begin end start commit rollback savepoint lock alter create drop rename call delete do handler insert load replace select truncate update set show pragma grant merge describe use explain help declare prepare execute deallocate release unlock purge reset change stop analyze cache flush optimize repair kill install uninstall checksum restore check backup revoke comment",e:/;/,eW:!0,l:/[\w\.]+/,k:{keyword:"abort abs absolute acc acce accep accept access accessed accessible account acos action activate add addtime admin administer advanced advise aes_decrypt aes_encrypt after agent aggregate ali alia alias allocate allow alter always analyze ancillary and any anydata anydataset anyschema anytype apply archive archived archivelog are as asc ascii asin assembly assertion associate asynchronous at atan atn2 attr attri attrib attribu attribut attribute attributes audit authenticated authentication authid authors auto autoallocate autodblink autoextend automatic availability avg backup badfile basicfile before begin beginning benchmark between bfile bfile_base big bigfile bin binary_double binary_float binlog bit_and bit_count bit_length bit_or bit_xor bitmap blob_base block blocksize body both bound buffer_cache buffer_pool build bulk by byte byteordermark bytes cache caching call calling cancel capacity cascade cascaded case cast catalog category ceil ceiling chain change changed char_base char_length character_length characters characterset charindex charset charsetform charsetid check checksum checksum_agg child choose chr chunk class cleanup clear client clob clob_base clone close cluster_id cluster_probability cluster_set clustering coalesce coercibility col collate collation collect colu colum column column_value columns columns_updated comment commit compact compatibility compiled complete composite_limit compound compress compute concat concat_ws concurrent confirm conn connec connect connect_by_iscycle connect_by_isleaf connect_by_root connect_time connection consider consistent constant constraint constraints constructor container content contents context contributors controlfile conv convert convert_tz corr corr_k corr_s corresponding corruption cos cost count count_big counted covar_pop covar_samp cpu_per_call cpu_per_session crc32 create creation critical cross cube cume_dist curdate current current_date current_time current_timestamp current_user cursor curtime customdatum cycle data database databases datafile datafiles datalength date_add date_cache date_format date_sub dateadd datediff datefromparts datename datepart datetime2fromparts day day_to_second dayname dayofmonth dayofweek dayofyear days db_role_change dbtimezone ddl deallocate declare decode decompose decrement decrypt deduplicate def defa defau defaul default defaults deferred defi defin define degrees delayed delegate delete delete_all delimited demand dense_rank depth dequeue des_decrypt des_encrypt des_key_file desc descr descri describ describe descriptor deterministic diagnostics difference dimension direct_load directory disable disable_all disallow disassociate discardfile disconnect diskgroup distinct distinctrow distribute distributed div do document domain dotnet double downgrade drop dumpfile duplicate duration each edition editionable editions element ellipsis else elsif elt empty enable enable_all enclosed encode encoding encrypt end end-exec endian enforced engine engines enqueue enterprise entityescaping eomonth error errors escaped evalname evaluate event eventdata events except exception exceptions exchange exclude excluding execu execut execute exempt exists exit exp expire explain export export_set extended extent external external_1 external_2 externally extract failed failed_login_attempts failover failure far fast feature_set feature_value fetch field fields file file_name_convert filesystem_like_logging final finish first first_value fixed flash_cache flashback floor flush following follows for forall force form forma format found found_rows freelist freelists freepools fresh from from_base64 from_days ftp full function general generated get get_format get_lock getdate getutcdate global global_name globally go goto grant grants greatest group group_concat group_id grouping grouping_id groups gtid_subtract guarantee guard handler hash hashkeys having hea head headi headin heading heap help hex hierarchy high high_priority hosts hour http id ident_current ident_incr ident_seed identified identity idle_time if ifnull ignore iif ilike ilm immediate import in include including increment index indexes indexing indextype indicator indices inet6_aton inet6_ntoa inet_aton inet_ntoa infile initial initialized initially initrans inmemory inner innodb input insert install instance instantiable instr interface interleaved intersect into invalidate invisible is is_free_lock is_ipv4 is_ipv4_compat is_not is_not_null is_used_lock isdate isnull isolation iterate java join json json_exists keep keep_duplicates key keys kill language large last last_day last_insert_id last_value lax lcase lead leading least leaves left len lenght length less level levels library like like2 like4 likec limit lines link list listagg little ln load load_file lob lobs local localtime localtimestamp locate locator lock locked log log10 log2 logfile logfiles logging logical logical_reads_per_call logoff logon logs long loop low low_priority lower lpad lrtrim ltrim main make_set makedate maketime managed management manual map mapping mask master master_pos_wait match matched materialized max maxextents maximize maxinstances maxlen maxlogfiles maxloghistory maxlogmembers maxsize maxtrans md5 measures median medium member memcompress memory merge microsecond mid migration min minextents minimum mining minus minute minvalue missing mod mode model modification modify module monitoring month months mount move movement multiset mutex name name_const names nan national native natural nav nchar nclob nested never new newline next nextval no no_write_to_binlog noarchivelog noaudit nobadfile nocheck nocompress nocopy nocycle nodelay nodiscardfile noentityescaping noguarantee nokeep nologfile nomapping nomaxvalue nominimize nominvalue nomonitoring none noneditionable nonschema noorder nopr nopro noprom nopromp noprompt norely noresetlogs noreverse normal norowdependencies noschemacheck noswitch not nothing notice notrim novalidate now nowait nth_value nullif nulls num numb numbe nvarchar nvarchar2 object ocicoll ocidate ocidatetime ociduration ociinterval ociloblocator ocinumber ociref ocirefcursor ocirowid ocistring ocitype oct octet_length of off offline offset oid oidindex old on online only opaque open operations operator optimal optimize option optionally or oracle oracle_date oradata ord ordaudio orddicom orddoc order ordimage ordinality ordvideo organization orlany orlvary out outer outfile outline output over overflow overriding package pad parallel parallel_enable parameters parent parse partial partition partitions pascal passing password password_grace_time password_lock_time password_reuse_max password_reuse_time password_verify_function patch path patindex pctincrease pctthreshold pctused pctversion percent percent_rank percentile_cont percentile_disc performance period period_add period_diff permanent physical pi pipe pipelined pivot pluggable plugin policy position post_transaction pow power pragma prebuilt precedes preceding precision prediction prediction_cost prediction_details prediction_probability prediction_set prepare present preserve prior priority private private_sga privileges procedural procedure procedure_analyze processlist profiles project prompt protection public publishingservername purge quarter query quick quiesce quota quotename radians raise rand range rank raw read reads readsize rebuild record records recover recovery recursive recycle redo reduced ref reference referenced references referencing refresh regexp_like register regr_avgx regr_avgy regr_count regr_intercept regr_r2 regr_slope regr_sxx regr_sxy reject rekey relational relative relaylog release release_lock relies_on relocate rely rem remainder rename repair repeat replace replicate replication required reset resetlogs resize resource respect restore restricted result result_cache resumable resume retention return returning returns reuse reverse revoke right rlike role roles rollback rolling rollup round row row_count rowdependencies rowid rownum rows rtrim rules safe salt sample save savepoint sb1 sb2 sb4 scan schema schemacheck scn scope scroll sdo_georaster sdo_topo_geometry search sec_to_time second section securefile security seed segment select self sequence sequential serializable server servererror session session_user sessions_per_user set sets settings sha sha1 sha2 share shared shared_pool short show shrink shutdown si_averagecolor si_colorhistogram si_featurelist si_positionalcolor si_stillimage si_texture siblings sid sign sin size size_t sizes skip slave sleep smalldatetimefromparts smallfile snapshot some soname sort soundex source space sparse spfile split sql sql_big_result sql_buffer_result sql_cache sql_calc_found_rows sql_small_result sql_variant_property sqlcode sqldata sqlerror sqlname sqlstate sqrt square standalone standby start starting startup statement static statistics stats_binomial_test stats_crosstab stats_ks_test stats_mode stats_mw_test stats_one_way_anova stats_t_test_ stats_t_test_indep stats_t_test_one stats_t_test_paired stats_wsr_test status std stddev stddev_pop stddev_samp stdev stop storage store stored str str_to_date straight_join strcmp strict string struct stuff style subdate subpartition subpartitions substitutable substr substring subtime subtring_index subtype success sum suspend switch switchoffset switchover sync synchronous synonym sys sys_xmlagg sysasm sysaux sysdate sysdatetimeoffset sysdba sysoper system system_user sysutcdatetime table tables tablespace tan tdo template temporary terminated tertiary_weights test than then thread through tier ties time time_format time_zone timediff timefromparts timeout timestamp timestampadd timestampdiff timezone_abbr timezone_minute timezone_region to to_base64 to_date to_days to_seconds todatetimeoffset trace tracking transaction transactional translate translation treat trigger trigger_nestlevel triggers trim truncate try_cast try_convert try_parse type ub1 ub2 ub4 ucase unarchived unbounded uncompress under undo unhex unicode uniform uninstall union unique unix_timestamp unknown unlimited unlock unpivot unrecoverable unsafe unsigned until untrusted unusable unused update updated upgrade upped upper upsert url urowid usable usage use use_stored_outlines user user_data user_resources users using utc_date utc_timestamp uuid uuid_short validate validate_password_strength validation valist value values var var_samp varcharc vari varia variab variabl variable variables variance varp varraw varrawc varray verify version versions view virtual visible void wait wallet warning warnings week weekday weekofyear wellformed when whene whenev wheneve whenever where while whitespace with within without work wrapped xdb xml xmlagg xmlattributes xmlcast xmlcolattval xmlelement xmlexists xmlforest xmlindex xmlnamespaces xmlpi xmlquery xmlroot xmlschema xmlserialize xmltable xmltype xor year year_to_month years yearweek",literal:"true false null",built_in:"array bigint binary bit blob boolean char character date dec decimal float int int8 integer interval number numeric real record serial serial8 smallint text varchar varying void"},c:[{cN:"string",b:"'",e:"'",c:[e.BE,{b:"''"}]},{cN:"string",b:'"',e:'"',c:[e.BE,{b:'""'}]},{cN:"string",b:"`",e:"`",c:[e.BE]},e.CNM,e.CBCM,t]},e.CBCM,t]}});hljs.registerLanguage("python",function(e){var r={keyword:"and elif is global as in if from raise for except finally print import pass return exec else break not with class assert yield try while continue del or def lambda async await nonlocal|10 None True False",built_in:"Ellipsis NotImplemented"},b={cN:"meta",b:/^(>>>|\.\.\.) /},c={cN:"subst",b:/\{/,e:/\}/,k:r,i:/#/},a={cN:"string",c:[e.BE],v:[{b:/(u|b)?r?'''/,e:/'''/,c:[b],r:10},{b:/(u|b)?r?"""/,e:/"""/,c:[b],r:10},{b:/(fr|rf|f)'''/,e:/'''/,c:[b,c]},{b:/(fr|rf|f)"""/,e:/"""/,c:[b,c]},{b:/(u|r|ur)'/,e:/'/,r:10},{b:/(u|r|ur)"/,e:/"/,r:10},{b:/(b|br)'/,e:/'/},{b:/(b|br)"/,e:/"/},{b:/(fr|rf|f)'/,e:/'/,c:[c]},{b:/(fr|rf|f)"/,e:/"/,c:[c]},e.ASM,e.QSM]},s={cN:"number",r:0,v:[{b:e.BNR+"[lLjJ]?"},{b:"\\b(0o[0-7]+)[lLjJ]?"},{b:e.CNR+"[lLjJ]?"}]},i={cN:"params",b:/\(/,e:/\)/,c:["self",b,s,a]};return c.c=[a,s,b],{aliases:["py","gyp"],k:r,i:/(<\/|->|\?)|=>/,c:[b,s,a,e.HCM,{v:[{cN:"function",bK:"def"},{cN:"class",bK:"class"}],e:/:/,i:/[${=;\n,]/,c:[e.UTM,i,{b:/->/,eW:!0,k:"None"}]},{cN:"meta",b:/^[\t ]*@/,e:/$/},{b:/\b(print|exec)\(/}]}});hljs.registerLanguage("nginx",function(e){var r={cN:"variable",v:[{b:/\$\d+/},{b:/\$\{/,e:/}/},{b:"[\\$\\@]"+e.UIR}]},b={eW:!0,l:"[a-z/_]+",k:{literal:"on off yes no true false none blocked debug info notice warn error crit select break last permanent redirect kqueue rtsig epoll poll /dev/poll"},r:0,i:"=>",c:[e.HCM,{cN:"string",c:[e.BE,r],v:[{b:/"/,e:/"/},{b:/'/,e:/'/}]},{b:"([a-z]+):/",e:"\\s",eW:!0,eE:!0,c:[r]},{cN:"regexp",c:[e.BE,r],v:[{b:"\\s\\^",e:"\\s|{|;",rE:!0},{b:"~\\*?\\s+",e:"\\s|{|;",rE:!0},{b:"\\*(\\.[a-z\\-]+)+"},{b:"([a-z\\-]+\\.)+\\*"}]},{cN:"number",b:"\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}(:\\d{1,5})?\\b"},{cN:"number",b:"\\b\\d+[kKmMgGdshdwy]*\\b",r:0},r]};return{aliases:["nginxconf"],c:[e.HCM,{b:e.UIR+"\\s+{",rB:!0,e:"{",c:[{cN:"section",b:e.UIR}],r:0},{b:e.UIR+"\\s",e:";|{",rB:!0,c:[{cN:"attribute",b:e.UIR,starts:b}],r:0}],i:"[^\\s\\}]"}});hljs.registerLanguage("ini",function(e){var b={cN:"string",c:[e.BE],v:[{b:"'''",e:"'''",r:10},{b:'"""',e:'"""',r:10},{b:'"',e:'"'},{b:"'",e:"'"}]};return{aliases:["toml"],cI:!0,i:/\S/,c:[e.C(";","$"),e.HCM,{cN:"section",b:/^\s*\[+/,e:/\]+/},{b:/^[a-z0-9\[\]_-]+\s*=\s*/,e:"$",rB:!0,c:[{cN:"attr",b:/[a-z0-9\[\]_-]+/},{b:/=/,eW:!0,r:0,c:[{cN:"literal",b:/\bon|off|true|false|yes|no\b/},{cN:"variable",v:[{b:/\$[\w\d"][\w\d_]*/},{b:/\$\{(.*?)}/}]},b,{cN:"number",b:/([\+\-]+)?[\d]+_[\d_]+/},e.NM]}]}]}});hljs.registerLanguage("http",function(e){var t="HTTP/[0-9\\.]+";return{aliases:["https"],i:"\\S",c:[{b:"^"+t,e:"$",c:[{cN:"number",b:"\\b\\d{3}\\b"}]},{b:"^[A-Z]+ (.*?) "+t+"$",rB:!0,e:"$",c:[{cN:"string",b:" ",e:" ",eB:!0,eE:!0},{b:t},{cN:"keyword",b:"[A-Z]+"}]},{cN:"attribute",b:"^\\w",e:": ",eE:!0,i:"\\n|\\s|=",starts:{e:"$",r:0}},{b:"\\n\\n",starts:{sL:[],eW:!0}}]}});hljs.registerLanguage("javascript",function(e){var r="[A-Za-z$_][0-9A-Za-z$_]*",t={keyword:"in of if for while finally var new function do return void else break catch instanceof with throw case default try this switch continue typeof delete let yield const export super debugger as async await static import from as",literal:"true false null undefined NaN Infinity",built_in:"eval isFinite isNaN parseFloat parseInt decodeURI decodeURIComponent encodeURI encodeURIComponent escape unescape Object Function Boolean Error EvalError InternalError RangeError ReferenceError StopIteration SyntaxError TypeError URIError Number Math Date String RegExp Array Float32Array Float64Array Int16Array Int32Array Int8Array Uint16Array Uint32Array Uint8Array Uint8ClampedArray ArrayBuffer DataView JSON Intl arguments require module console window document Symbol Set Map WeakSet WeakMap Proxy Reflect Promise"},a={cN:"number",v:[{b:"\\b(0[bB][01]+)"},{b:"\\b(0[oO][0-7]+)"},{b:e.CNR}],r:0},n={cN:"subst",b:"\\$\\{",e:"\\}",k:t,c:[]},c={cN:"string",b:"`",e:"`",c:[e.BE,n]};n.c=[e.ASM,e.QSM,c,a,e.RM];var s=n.c.concat([e.CBCM,e.CLCM]);return{aliases:["js","jsx"],k:t,c:[{cN:"meta",r:10,b:/^\s*['"]use (strict|asm)['"]/},{cN:"meta",b:/^#!/,e:/$/},e.ASM,e.QSM,c,e.CLCM,e.CBCM,a,{b:/[{,]\s*/,r:0,c:[{b:r+"\\s*:",rB:!0,r:0,c:[{cN:"attr",b:r,r:0}]}]},{b:"("+e.RSR+"|\\b(case|return|throw)\\b)\\s*",k:"return throw case",c:[e.CLCM,e.CBCM,e.RM,{cN:"function",b:"(\\(.*?\\)|"+r+")\\s*=>",rB:!0,e:"\\s*=>",c:[{cN:"params",v:[{b:r},{b:/\(\s*\)/},{b:/\(/,e:/\)/,eB:!0,eE:!0,k:t,c:s}]}]},{b://,sL:"xml",c:[{b:/<\w+\s*\/>/,skip:!0},{b:/<\w+/,e:/(\/\w+|\w+\/)>/,skip:!0,c:[{b:/<\w+\s*\/>/,skip:!0},"self"]}]}],r:0},{cN:"function",bK:"function",e:/\{/,eE:!0,c:[e.inherit(e.TM,{b:r}),{cN:"params",b:/\(/,e:/\)/,eB:!0,eE:!0,c:s}],i:/\[|%/},{b:/\$[(.]/},e.METHOD_GUARD,{cN:"class",bK:"class",e:/[{;=]/,eE:!0,i:/[:"\[\]]/,c:[{bK:"extends"},e.UTM]},{bK:"constructor",e:/\{/,eE:!0}],i:/#(?!!)/}});hljs.registerLanguage("java",function(e){var a="[À-ʸa-zA-Z_$][À-ʸa-zA-Z_$0-9]*",t=a+"(<"+a+"(\\s*,\\s*"+a+")*>)?",r="false synchronized int abstract float private char boolean static null if const for true while long strictfp finally protected import native final void enum else break transient catch instanceof byte super volatile case assert short package default double public try this switch continue throws protected public private module requires exports do",s="\\b(0[bB]([01]+[01_]+[01]+|[01]+)|0[xX]([a-fA-F0-9]+[a-fA-F0-9_]+[a-fA-F0-9]+|[a-fA-F0-9]+)|(([\\d]+[\\d_]+[\\d]+|[\\d]+)(\\.([\\d]+[\\d_]+[\\d]+|[\\d]+))?|\\.([\\d]+[\\d_]+[\\d]+|[\\d]+))([eE][-+]?\\d+)?)[lLfF]?",c={cN:"number",b:s,r:0};return{aliases:["jsp"],k:r,i:/<\/|#/,c:[e.C("/\\*\\*","\\*/",{r:0,c:[{b:/\w+@/,r:0},{cN:"doctag",b:"@[A-Za-z]+"}]}),e.CLCM,e.CBCM,e.ASM,e.QSM,{cN:"class",bK:"class interface",e:/[{;=]/,eE:!0,k:"class interface",i:/[:"\[\]]/,c:[{bK:"extends implements"},e.UTM]},{bK:"new throw return else",r:0},{cN:"function",b:"("+t+"\\s+)+"+e.UIR+"\\s*\\(",rB:!0,e:/[{;=]/,eE:!0,k:r,c:[{b:e.UIR+"\\s*\\(",rB:!0,r:0,c:[e.UTM]},{cN:"params",b:/\(/,e:/\)/,k:r,r:0,c:[e.ASM,e.QSM,e.CNM,e.CBCM]},e.CLCM,e.CBCM]},c,{cN:"meta",b:"@[A-Za-z]+"}]}});hljs.registerLanguage("apache",function(e){var r={cN:"number",b:"[\\$%]\\d+"};return{aliases:["apacheconf"],cI:!0,c:[e.HCM,{cN:"section",b:""},{cN:"attribute",b:/\w+/,r:0,k:{nomarkup:"order deny allow setenv rewriterule rewriteengine rewritecond documentroot sethandler errordocument loadmodule options header listen serverroot servername"},starts:{e:/$/,r:0,k:{literal:"on off all"},c:[{cN:"meta",b:"\\s\\[",e:"\\]$"},{cN:"variable",b:"[\\$%]\\{",e:"\\}",c:["self",r]},r,e.QSM]}}],i:/\S/}});hljs.registerLanguage("xml",function(s){var e="[A-Za-z0-9\\._:-]+",t={eW:!0,i:/`]+/}]}]}]};return{aliases:["html","xhtml","rss","atom","xjb","xsd","xsl","plist"],cI:!0,c:[{cN:"meta",b:"",r:10,c:[{b:"\\[",e:"\\]"}]},s.C("",{r:10}),{b:"<\\!\\[CDATA\\[",e:"\\]\\]>",r:10},{b:/<\?(php)?/,e:/\?>/,sL:"php",c:[{b:"/\\*",e:"\\*/",skip:!0}]},{cN:"tag",b:"|$)",e:">",k:{name:"style"},c:[t],starts:{e:"",rE:!0,sL:["css","xml"]}},{cN:"tag",b:"|$)",e:">",k:{name:"script"},c:[t],starts:{e:"",rE:!0,sL:["actionscript","javascript","handlebars","xml"]}},{cN:"meta",v:[{b:/<\?xml/,e:/\?>/,r:10},{b:/<\?\w+/,e:/\?>/}]},{cN:"tag",b:"",c:[{cN:"name",b:/[^\/><\s]+/,r:0},t]}]}});hljs.registerLanguage("markdown",function(e){return{aliases:["md","mkdown","mkd"],c:[{cN:"section",v:[{b:"^#{1,6}",e:"$"},{b:"^.+?\\n[=-]{2,}$"}]},{b:"<",e:">",sL:"xml",r:0},{cN:"bullet",b:"^([*+-]|(\\d+\\.))\\s+"},{cN:"strong",b:"[*_]{2}.+?[*_]{2}"},{cN:"emphasis",v:[{b:"\\*.+?\\*"},{b:"_.+?_",r:0}]},{cN:"quote",b:"^>\\s+",e:"$"},{cN:"code",v:[{b:"^```w*s*$",e:"^```s*$"},{b:"`.+?`"},{b:"^( {4}| )",e:"$",r:0}]},{b:"^[-\\*]{3,}",e:"$"},{b:"\\[.+?\\][\\(\\[].*?[\\)\\]]",rB:!0,c:[{cN:"string",b:"\\[",e:"\\]",eB:!0,rE:!0,r:0},{cN:"link",b:"\\]\\(",e:"\\)",eB:!0,eE:!0},{cN:"symbol",b:"\\]\\[",e:"\\]",eB:!0,eE:!0}],r:10},{b:/^\[[^\n]+\]:/,rB:!0,c:[{cN:"symbol",b:/\[/,e:/\]/,eB:!0,eE:!0},{cN:"link",b:/:\s*/,e:/$/,eB:!0}]}]}});hljs.registerLanguage("diff",function(e){return{aliases:["patch"],c:[{cN:"meta",r:10,v:[{b:/^@@ +\-\d+,\d+ +\+\d+,\d+ +@@$/},{b:/^\*\*\* +\d+,\d+ +\*\*\*\*$/},{b:/^\-\-\- +\d+,\d+ +\-\-\-\-$/}]},{cN:"comment",v:[{b:/Index: /,e:/$/},{b:/={3,}/,e:/$/},{b:/^\-{3}/,e:/$/},{b:/^\*{3} /,e:/$/},{b:/^\+{3}/,e:/$/},{b:/\*{5}/,e:/\*{5}$/}]},{cN:"addition",b:"^\\+",e:"$"},{cN:"deletion",b:"^\\-",e:"$"},{cN:"addition",b:"^\\!",e:"$"}]}});hljs.registerLanguage("json",function(e){var i={literal:"true false null"},n=[e.QSM,e.CNM],r={e:",",eW:!0,eE:!0,c:n,k:i},t={b:"{",e:"}",c:[{cN:"attr",b:/"/,e:/"/,c:[e.BE],i:"\\n"},e.inherit(r,{b:/:/})],i:"\\S"},c={b:"\\[",e:"\\]",c:[e.inherit(r)],i:"\\S"};return n.splice(n.length,0,t,c),{c:n,k:i,i:"\\S"}});hljs.registerLanguage("go",function(e){var t={keyword:"break default func interface select case map struct chan else goto package switch const fallthrough if range type continue for import return var go defer bool byte complex64 complex128 float32 float64 int8 int16 int32 int64 string uint8 uint16 uint32 uint64 int uint uintptr rune",literal:"true false iota nil",built_in:"append cap close complex copy imag len make new panic print println real recover delete"};return{aliases:["golang"],k:t,i:"%$#]",starts:{e:"$",sL:"bash"}}]}});hljs.registerLanguage("makefile",function(e){var i={cN:"variable",v:[{b:"\\$\\("+e.UIR+"\\)",c:[e.BE]},{b:/\$[@% - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to - deal in the Software without restriction, including without limitation the - rights to use, copy, modify, merge, publish, distribute, sublicense, and/or - sell copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS - IN THE SOFTWARE. ---> - -{% import "partials/language.html" as lang with context %} - - -
- - - {% if page.previous_page or page.next_page %} - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - {% endif %} - - -
-
- - -
- {% if config.copyright %} -
- {{ config.copyright }} -
- {% endif %} - powered by - MkDocs - and - - Material for MkDocs -
- - - {% block social %} - {% include "partials/social.html" %} - {% endblock %} -
-
-
diff --git a/old/docs/theme/styles/atom-one-light.css b/old/docs/theme/styles/atom-one-light.css deleted file mode 100644 index d5bd1d2a9..000000000 --- a/old/docs/theme/styles/atom-one-light.css +++ /dev/null @@ -1,96 +0,0 @@ -/* - -Atom One Light by Daniel Gamage -Original One Light Syntax theme from https://github.com/atom/one-light-syntax - -base: #fafafa -mono-1: #383a42 -mono-2: #686b77 -mono-3: #a0a1a7 -hue-1: #0184bb -hue-2: #4078f2 -hue-3: #a626a4 -hue-4: #50a14f -hue-5: #e45649 -hue-5-2: #c91243 -hue-6: #986801 -hue-6-2: #c18401 - -*/ - -.hljs { - display: block; - overflow-x: auto; - padding: 0.5em; - color: #383a42; - background: #fafafa; -} - -.hljs-comment, -.hljs-quote { - color: #a0a1a7; - font-style: italic; -} - -.hljs-doctag, -.hljs-keyword, -.hljs-formula { - color: #a626a4; -} - -.hljs-section, -.hljs-name, -.hljs-selector-tag, -.hljs-deletion, -.hljs-subst { - color: #e45649; -} - -.hljs-literal { - color: #0184bb; -} - -.hljs-string, -.hljs-regexp, -.hljs-addition, -.hljs-attribute, -.hljs-meta-string { - color: #50a14f; -} - -.hljs-built_in, -.hljs-class .hljs-title { - color: #c18401; -} - -.hljs-attr, -.hljs-variable, -.hljs-template-variable, -.hljs-type, -.hljs-selector-class, -.hljs-selector-attr, -.hljs-selector-pseudo, -.hljs-number { - color: #986801; -} - -.hljs-symbol, -.hljs-bullet, -.hljs-link, -.hljs-meta, -.hljs-selector-id, -.hljs-title { - color: #4078f2; -} - -.hljs-emphasis { - font-style: italic; -} - -.hljs-strong { - font-weight: bold; -} - -.hljs-link { - text-decoration: underline; -} diff --git a/old/docs/theme/styles/extra.css b/old/docs/theme/styles/extra.css deleted file mode 100644 index 9694531e2..000000000 --- a/old/docs/theme/styles/extra.css +++ /dev/null @@ -1,20 +0,0 @@ -.md-logo img { - background-color: white; - border-radius: 50%; - width: 30px; - height: 30px; -} - -/* Fix for Chrome */ -.md-typeset__table td code { - word-break: unset; -} - -.md-typeset__table tr :nth-child(1) { - word-wrap: break-word; - max-width: 30em; -} - -p { - text-align: justify; -} diff --git a/old/docs/user-guide/cluster-docker-consul.md b/old/docs/user-guide/cluster-docker-consul.md deleted file mode 100644 index bdd6d73d1..000000000 --- a/old/docs/user-guide/cluster-docker-consul.md +++ /dev/null @@ -1,294 +0,0 @@ -# Clustering / High Availability on Docker Swarm with Consul - -This guide explains how to use Traefik in high availability mode in a Docker Swarm and with Let's Encrypt. - -Why do we need Traefik in cluster mode? Running multiple instances should work out of the box? - -If you want to use Let's Encrypt with Traefik, sharing configuration or TLS certificates between many Traefik instances, you need Traefik cluster/HA. - -Ok, could we mount a shared volume used by all my instances? Yes, you can, but it will not work. -When you use Let's Encrypt, you need to store certificates, but not only. -When Traefik generates a new certificate, it configures a challenge and once Let's Encrypt will verify the ownership of the domain, it will ping back the challenge. -If the challenge is not known by other Traefik instances, the validation will fail. - -For more information about the challenge: [Automatic Certificate Management Environment (ACME)](https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#http-challenge) - -## Prerequisites - -You will need a working Docker Swarm cluster. - -## Traefik configuration - -In this guide, we will not use a TOML configuration file, but only command line flag. -With that, we can use the base image without mounting configuration file or building custom image. - -What Traefik should do: - -- Listen to 80 and 443 -- Redirect HTTP traffic to HTTPS -- Generate SSL certificate when a domain is added -- Listen to Docker Swarm event - -### EntryPoints configuration - -TL;DR: - -```shell -$ traefik \ - --entrypoints='Name:http Address::80 Redirect.EntryPoint:https' \ - --entrypoints='Name:https Address::443 TLS' \ - --defaultentrypoints=http,https -``` - -To listen to different ports, we need to create an entry point for each. - -The CLI syntax is `--entrypoints='Name:a_name Address:an_ip_or_empty:a_port options'`. -If you want to redirect traffic from one entry point to another, it's the option `Redirect.EntryPoint:entrypoint_name`. - -By default, we don't want to configure all our services to listen on http and https, we add a default entry point configuration: `--defaultentrypoints=http,https`. - -### Let's Encrypt configuration - -TL;DR: - -```shell -$ traefik \ - --acme \ - --acme.storage=/etc/traefik/acme/acme.json \ - --acme.entryPoint=https \ - --acme.httpChallenge.entryPoint=http \ - --acme.email=contact@mydomain.ca -``` - -Let's Encrypt needs 4 parameters: an TLS entry point to listen to, a non-TLS entry point to allow HTTP challenges, a storage for certificates, and an email for the registration. - -To enable Let's Encrypt support, you need to add `--acme` flag. - -Now, Traefik needs to know where to store the certificates, we can choose between a key in a Key-Value store, or a file path: `--acme.storage=my/key` or `--acme.storage=/path/to/acme.json`. - -The `acme.httpChallenge.entryPoint` flag enables the `HTTP-01` challenge and specifies the entryPoint to use during the challenges. - -For your email and the entry point, it's `--acme.entryPoint` and `--acme.email` flags. - -### Docker configuration - -TL;DR: - -```shell -$ traefik \ - --docker \ - --docker.swarmMode \ - --docker.domain=mydomain.ca \ - --docker.watch -``` - -To enable docker and swarm-mode support, you need to add `--docker` and `--docker.swarmMode` flags. -To watch docker events, add `--docker.watch`. - -### Full docker-compose file - -```yaml -version: "3" -services: - traefik: - image: traefik:1.5 - command: - - "--api" - - "--entrypoints=Name:http Address::80 Redirect.EntryPoint:https" - - "--entrypoints=Name:https Address::443 TLS" - - "--defaultentrypoints=http,https" - - "--acme" - - "--acme.storage=/etc/traefik/acme/acme.json" - - "--acme.entryPoint=https" - - "--acme.httpChallenge.entryPoint=http" - - "--acme.onHostRule=true" - - "--acme.onDemand=false" - - "--acme.email=contact@mydomain.ca" - - "--docker" - - "--docker.swarmMode" - - "--docker.domain=mydomain.ca" - - "--docker.watch" - volumes: - - /var/run/docker.sock:/var/run/docker.sock - networks: - - webgateway - - traefik - ports: - - target: 80 - published: 80 - mode: host - - target: 443 - published: 443 - mode: host - - target: 8080 - published: 8080 - mode: host - deploy: - mode: global - placement: - constraints: - - node.role == manager - update_config: - parallelism: 1 - delay: 10s - restart_policy: - condition: on-failure -networks: - webgateway: - driver: overlay - external: true - traefik: - driver: overlay -``` - -## Migrate configuration to Consul - -We created a special Traefik command to help configuring your Key Value store from a Traefik TOML configuration file and/or CLI flags. - -## Deploy a Traefik cluster - -The best way we found is to have an initializer service. -This service will push the config to Consul via the `storeconfig` sub-command. - -This service will retry until finishing without error because Consul may not be ready when the service tries to push the configuration. - -The initializer in a docker-compose file will be: - -```yaml - traefik_init: - image: traefik:1.5 - command: - - "storeconfig" - - "--api" - [...] - - "--consul" - - "--consul.endpoint=consul:8500" - - "--consul.prefix=traefik" - networks: - - traefik - deploy: - restart_policy: - condition: on-failure - depends_on: - - consul -``` - -And now, the Traefik part will only have the Consul configuration. - -```yaml - traefik: - image: traefik:1.5 - depends_on: - - traefik_init - - consul - command: - - "--consul" - - "--consul.endpoint=consul:8500" - - "--consul.prefix=traefik" - [...] -``` - -!!! note - For Traefik <1.5.0 add `acme.storage=traefik/acme/account` because Traefik is not reading it from Consul. - -If you have some update to do, update the initializer service and re-deploy it. -The new configuration will be stored in Consul, and you need to restart the Traefik node: `docker service update --force traefik_traefik`. - -## Full docker-compose file - -```yaml -version: "3.4" -services: - traefik_init: - image: traefik:1.5 - command: - - "storeconfig" - - "--api" - - "--entrypoints=Name:http Address::80 Redirect.EntryPoint:https" - - "--entrypoints=Name:https Address::443 TLS" - - "--defaultentrypoints=http,https" - - "--acme" - - "--acme.storage=traefik/acme/account" - - "--acme.entryPoint=https" - - "--acme.httpChallenge.entryPoint=http" - - "--acme.onHostRule=true" - - "--acme.onDemand=false" - - "--acme.email=foobar@example.com" - - "--docker" - - "--docker.swarmMode" - - "--docker.domain=example.com" - - "--docker.watch" - - "--consul" - - "--consul.endpoint=consul:8500" - - "--consul.prefix=traefik" - networks: - - traefik - deploy: - restart_policy: - condition: on-failure - depends_on: - - consul - traefik: - image: traefik:1.5 - depends_on: - - traefik_init - - consul - command: - - "--consul" - - "--consul.endpoint=consul:8500" - - "--consul.prefix=traefik" - volumes: - - /var/run/docker.sock:/var/run/docker.sock - networks: - - webgateway - - traefik - ports: - - target: 80 - published: 80 - mode: host - - target: 443 - published: 443 - mode: host - - target: 8080 - published: 8080 - mode: host - deploy: - mode: global - placement: - constraints: - - node.role == manager - update_config: - parallelism: 1 - delay: 10s - restart_policy: - condition: on-failure - consul: - image: consul - command: agent -server -bootstrap-expect=1 - volumes: - - consul-data:/consul/data - environment: - - CONSUL_LOCAL_CONFIG={"datacenter":"us_east2","server":true} - - CONSUL_BIND_INTERFACE=eth0 - - CONSUL_CLIENT_INTERFACE=eth0 - deploy: - replicas: 1 - placement: - constraints: - - node.role == manager - restart_policy: - condition: on-failure - networks: - - traefik - -networks: - webgateway: - driver: overlay - external: true - traefik: - driver: overlay - -volumes: - consul-data: - driver: [not local] -``` diff --git a/old/docs/user-guide/cluster.md b/old/docs/user-guide/cluster.md deleted file mode 100644 index b08d2b937..000000000 --- a/old/docs/user-guide/cluster.md +++ /dev/null @@ -1,33 +0,0 @@ -# Clustering / High Availability (beta) - -This guide explains how to use Traefik in high availability mode. - -In order to deploy and configure multiple Traefik instances, without copying the same configuration file on each instance, we will use a distributed Key-Value store. - -## Prerequisites - -You will need a working KV store cluster. -_(Currently, we recommend [Consul](https://consul.io) .)_ - -## File configuration to KV store migration - -We created a special Traefik command to help configuring your Key Value store from a Traefik TOML configuration file. - -Please refer to [this section](/user-guide/kv-config/#store-configuration-in-key-value-store) to get more details. - -## Deploy a Traefik cluster - -Once your Traefik configuration is uploaded on your KV store, you can start each Traefik instance. - -A Traefik cluster is based on a manager/worker model. - -When starting, Traefik will elect a manager. -If this instance fails, another manager will be automatically elected. - -## Traefik cluster and Let's Encrypt - -**In cluster mode, ACME certificates have to be stored in [a KV Store entry](/configuration/acme/#as-a-key-value-store-entry).** - -Thanks to the Traefik cluster mode algorithm (based on [the Raft Consensus Algorithm](https://raft.github.io/)), only one instance will contact Let's encrypt to solve the challenges. - -The others instances will get ACME certificate from the KV Store entry. diff --git a/old/docs/user-guide/docker-and-lets-encrypt.md b/old/docs/user-guide/docker-and-lets-encrypt.md deleted file mode 100644 index daf94d907..000000000 --- a/old/docs/user-guide/docker-and-lets-encrypt.md +++ /dev/null @@ -1,262 +0,0 @@ -# Let's Encrypt & Docker - -In this use case, we want to use Traefik as a _layer-7_ load balancer with SSL termination for a set of micro-services used to run a web application. - -We also want to automatically _discover any services_ on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly. - -In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname. - -## Setting Up - -In order for this to work, you'll need a server with a public IP address, with Docker and docker-compose installed on it. - -In this example, we're using the fictitious domain _my-awesome-app.org_. - -In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address. - -## Networking - -Docker containers can only communicate with each other over TCP when they share at least one network. -This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers _unless you'd want to_. - -In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in. - -On the Docker host, run the following command: - -```shell -docker network create web -``` - -Now, let's create a directory on the server where we will configure the rest of Traefik: - -```shell -mkdir -p /opt/traefik -``` - -Within this directory, we're going to create 3 empty files: - -```shell -touch /opt/traefik/docker-compose.yml -touch /opt/traefik/acme.json && chmod 600 /opt/traefik/acme.json -touch /opt/traefik/traefik.toml -``` - -The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik. - -The contents of the file is as follows: - -```yaml -version: '2' - -services: - traefik: - image: traefik:1.5.4 - restart: always - ports: - - 80:80 - - 443:443 - networks: - - web - volumes: - - /var/run/docker.sock:/var/run/docker.sock - - /opt/traefik/traefik.toml:/traefik.toml - - /opt/traefik/acme.json:/acme.json - container_name: traefik - -networks: - web: - external: true -``` - -As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container. -Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure its own internal configuration when containers are created (or shut down). -Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted). -We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on. -Finally, we're giving this container a static name called `traefik`. - -Let's take a look at a simple `traefik.toml` configuration as well before we'll create the Traefik container: - -```toml -debug = false - -logLevel = "ERROR" -defaultEntryPoints = ["https","http"] - -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.http.redirect] - entryPoint = "https" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[retry] - -[docker] -endpoint = "unix:///var/run/docker.sock" -domain = "my-awesome-app.org" -watch = true -exposedByDefault = false - -[acme] -email = "your-email-here@my-awesome-app.org" -storage = "acme.json" -entryPoint = "https" -onHostRule = true -[acme.httpChallenge] -entryPoint = "http" -``` - -This is the minimum configuration required to do the following: - -- Log `ERROR`-level messages (or more severe) to the console, but silence `DEBUG`-level messages -- Check for new versions of Traefik periodically -- Create two entry points, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`. -- Enable the Docker provider and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Traefik by default, we'll get into this in a bit!** -- Enable automatic request and configuration of SSL certificates using Let's Encrypt. - These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises. - -Alright, let's boot the container. From the `/opt/traefik` directory, run `docker-compose up -d` which will create and start the Traefik container. - -## Exposing Web Services to the Outside World - -Now that we've fully configured and started Traefik, it's time to get our applications running! - -Let's take a simple example of a micro-service project consisting of various services, where some will be exposed to the outside world and some will not. - -The `docker-compose.yml` of our project looks like this: - -```yaml -version: "2.1" - -services: - app: - image: my-docker-registry.com/my-awesome-app/app:latest - depends_on: - db: - condition: service_healthy - redis: - condition: service_healthy - restart: always - networks: - - web - - default - expose: - - "9000" - labels: - - "traefik.docker.network=web" - - "traefik.enable=true" - - "traefik.basic.frontend.rule=Host:app.my-awesome-app.org" - - "traefik.basic.port=9000" - - "traefik.basic.protocol=http" - - "traefik.admin.frontend.rule=Host:admin-app.my-awesome-app.org" - - "traefik.admin.protocol=https" - - "traefik.admin.port=9443" - - db: - image: my-docker-registry.com/back-end/5.7 - restart: always - - redis: - image: my-docker-registry.com/back-end/redis:4-alpine - restart: always - - events: - image: my-docker-registry.com/my-awesome-app/events:latest - depends_on: - db: - condition: service_healthy - redis: - condition: service_healthy - restart: always - networks: - - web - - default - expose: - - "3000" - labels: - - "traefik.backend=my-awesome-app-events" - - "traefik.docker.network=web" - - "traefik.frontend.rule=Host:events.my-awesome-app.org" - - "traefik.enable=true" - - "traefik.port=3000" - -networks: - web: - external: true -``` - -Here, we can see a set of services with two applications that we're actually exposing to the outside world. -Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks. -Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document. - -Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers. - -### Labels - -As mentioned earlier, we don't want containers exposed automatically by Traefik. - -The reason behind this is simple: we want to have control over this process ourselves. -Thanks to Docker labels, we can tell Traefik how to create its internal routing configuration. - -Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000: - -```yaml -- "traefik.docker.network=web" -- "traefik.enable=true" -- "traefik.basic.frontend.rule=Host:app.my-awesome-app.org" -- "traefik.basic.port=9000" -- "traefik.basic.protocol=http" -- "traefik.admin.frontend.rule=Host:admin-app.my-awesome-app.org" -- "traefik.admin.protocol=https" -- "traefik.admin.port=9443" -``` - -We use both `container labels` and `service labels`. - -#### Container labels - -First, we specify the `backend` name which corresponds to the actual service we're routing **to**. - -We also tell Traefik to use the `web` network to route HTTP traffic to this container. -With the `traefik.enable` label, we tell Traefik to include this container in its internal configuration. - -With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`. -Essentially, this is the actual rule used for Layer-7 load balancing. - -Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on. - -### Service labels - -`Service labels` allow managing many routes for the same container. - -When both `container labels` and `service labels` are defined, `container labels` are just used as default values for missing `service labels` but no frontend/backend are going to be defined only with these labels. -Obviously, labels `traefik.frontend.rule` and `traefik.port` described above, will only be used to complete information set in `service labels` during the container frontends/backends creation. - -In the example, two service names are defined : `basic` and `admin`. -They allow creating two frontends and two backends. - -- `basic` has only one `service label` : `traefik.basic.protocol`. -Traefik will use values set in `traefik.frontend.rule` and `traefik.port` to create the `basic` frontend and backend. -The frontend listens to incoming HTTP requests which contain the `Host` `app.my-awesome-app.org` and redirect them in `HTTP` to the port `9000` of the backend. -- `admin` has all the `services labels` needed to create the `admin` frontend and backend (`traefik.admin.frontend.rule`, `traefik.admin.protocol`, `traefik.admin.port`). -Traefik will create a frontend to listen to incoming HTTP requests which contain the `Host` `admin-app.my-awesome-app.org` and redirect them in `HTTPS` to the port `9443` of the backend. - -#### Gotchas and tips - -- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label. - If a container exposes multiple ports, Traefik may forward traffic to the wrong port. - Even if a container only exposes one port, you should always write configuration defensively and explicitly. -- Should you choose to enable the `exposedByDefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see. - Usually, this is a bad idea. -- With the `traefik.frontend.auth.basic` label, it's possible for Traefik to provide a HTTP basic-auth challenge for the endpoints you provide the label for. -- Traefik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics -- Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol. - Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS) - -### Final thoughts - -Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, powerful and self-configuring solution for your projects. - -With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well. diff --git a/old/docs/user-guide/examples.md b/old/docs/user-guide/examples.md deleted file mode 100644 index 8ea95406e..000000000 --- a/old/docs/user-guide/examples.md +++ /dev/null @@ -1,415 +0,0 @@ -# Examples - -You will find here some configuration examples of Traefik. - -## HTTP only - -```toml -defaultEntryPoints = ["http"] - -[entryPoints] - [entryPoints.http] - address = ":80" -``` - -## HTTP + HTTPS (with SNI) - -```toml -defaultEntryPoints = ["http", "https"] - -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - [[entryPoints.https.tls.certificates]] - certFile = "integration/fixtures/https/snitest.com.cert" - keyFile = "integration/fixtures/https/snitest.com.key" - [[entryPoints.https.tls.certificates]] - certFile = "integration/fixtures/https/snitest.org.cert" - keyFile = "integration/fixtures/https/snitest.org.key" -``` -Note that we can either give path to certificate file or directly the file content itself ([like in this TOML example](/user-guide/kv-config/#upload-the-configuration-in-the-key-value-store)). - -## HTTP redirect on HTTPS - -```toml -defaultEntryPoints = ["http", "https"] - -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.http.redirect] - entryPoint = "https" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - [[entryPoints.https.tls.certificates]] - certFile = "examples/traefik.crt" - keyFile = "examples/traefik.key" -``` - -!!! note - Please note that `regex` and `replacement` do not have to be set in the `redirect` structure if an entrypoint is defined for the redirection (they will not be used in this case) - -## Let's Encrypt support - -### Basic example with HTTP challenge - -```toml -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "acme.json" -caServer = "https://acme-staging-v02.api.letsencrypt.org/directory" -entryPoint = "https" - [acme.httpChallenge] - entryPoint = "http" - -[[acme.domains]] - main = "local1.com" - sans = ["test1.local1.com", "test2.local1.com"] -[[acme.domains]] - main = "local2.com" - sans = ["test1.local2.com", "test2x.local2.com"] -[[acme.domains]] - main = "local3.com" -[[acme.domains]] - main = "local4.com" -``` - -This configuration allows generating Let's Encrypt certificates (thanks to `HTTP-01` challenge) for the four domains `local[1-4].com` with described SANs. - -Traefik generates these certificates when it starts and it needs to be restarted if new domains are added. - -### onHostRule option (with HTTP challenge) - -```toml -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "acme.json" -onHostRule = true -caServer = "https://acme-staging-v02.api.letsencrypt.org/directory" -entryPoint = "https" - [acme.httpChallenge] - entryPoint = "http" - -[[acme.domains]] - main = "local1.com" - sans = ["test1.local1.com", "test2.local1.com"] -[[acme.domains]] - main = "local2.com" - sans = ["test1.local2.com", "test2x.local2.com"] -[[acme.domains]] - main = "local3.com" -[[acme.domains]] - main = "local4.com" -``` - -This configuration allows generating Let's Encrypt certificates (thanks to `HTTP-01` challenge) for the four domains `local[1-4].com`. - -Traefik generates these certificates when it starts. - -If a backend is added with a `onHost` rule, Traefik will automatically generate the Let's Encrypt certificate for the new domain (for frontends wired on the `acme.entryPoint`). - -### OnDemand option (with HTTP challenge) - -```toml -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "acme.json" -onDemand = true -caServer = "https://acme-staging-v02.api.letsencrypt.org/directory" -entryPoint = "https" - [acme.httpChallenge] - entryPoint = "http" -``` - -This configuration allows generating a Let's Encrypt certificate (thanks to `HTTP-01` challenge) during the first HTTPS request on a new domain. - -!!! note - This option simplifies the configuration but : - - * TLS handshakes will be slow when requesting a hostname certificate for the first time, which can lead to DDoS attacks. - * Let's Encrypt have rate limiting: https://letsencrypt.org/docs/rate-limits - - That's why, it's better to use the `onHostRule` option if possible. - -### DNS challenge - -```toml -[entryPoints] - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "acme.json" -caServer = "https://acme-staging-v02.api.letsencrypt.org/directory" -entryPoint = "https" - [acme.dnsChallenge] - provider = "digitalocean" # DNS Provider name (cloudflare, OVH, gandi...) - delayBeforeCheck = 0 - -[[acme.domains]] - main = "local1.com" - sans = ["test1.local1.com", "test2.local1.com"] -[[acme.domains]] - main = "local2.com" - sans = ["test1.local2.com", "test2x.local2.com"] -[[acme.domains]] - main = "local3.com" -[[acme.domains]] - main = "local4.com" -``` - -DNS challenge needs environment variables to be executed. -These variables have to be set on the machine/container that host Traefik. - -These variables are described [in this section](/configuration/acme/#provider). - -### DNS challenge with wildcard domains - -```toml -[entryPoints] - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "acme.json" -caServer = "https://acme-staging-v02.api.letsencrypt.org/directory" -entryPoint = "https" - [acme.dnsChallenge] - provider = "digitalocean" # DNS Provider name (cloudflare, OVH, gandi...) - delayBeforeCheck = 0 - -[[acme.domains]] - main = "*.local1.com" -[[acme.domains]] - main = "local2.com" - sans = ["test1.local2.com", "test2x.local2.com"] -[[acme.domains]] - main = "*.local3.com" -[[acme.domains]] - main = "*.local4.com" -``` - -DNS challenge needs environment variables to be executed. -These variables have to be set on the machine/container that host Traefik. - -These variables are described [in this section](/configuration/acme/#provider). - -More information about wildcard certificates are available [in this section](/configuration/acme/#wildcard-domains). - -### onHostRule option and provided certificates (with HTTP challenge) - -```toml -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - [[entryPoints.https.tls.certificates]] - certFile = "examples/traefik.crt" - keyFile = "examples/traefik.key" - -[acme] -email = "test@traefik.io" -storage = "acme.json" -onHostRule = true -caServer = "http://172.18.0.1:4000/directory" -entryPoint = "https" - [acme.httpChallenge] - entryPoint = "http" -``` - -Traefik will only try to generate a Let's encrypt certificate (thanks to `HTTP-01` challenge) if the domain cannot be checked by the provided certificates. - -### Cluster mode - -#### Prerequisites - -Before you use Let's Encrypt in a Traefik cluster, take a look to [the key-value store explanations](/user-guide/kv-config) and more precisely at [this section](/user-guide/kv-config/#store-configuration-in-key-value-store), which will describe how to migrate from a acme local storage *(acme.json file)* to a key-value store configuration. - -#### Configuration - -```toml -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - [entryPoints.https.tls] - -[acme] -email = "test@traefik.io" -storage = "traefik/acme/account" -caServer = "http://172.18.0.1:4000/directory" -entryPoint = "https" - -[acme.httpChallenge] - entryPoint = "http" - -[[acme.domains]] - main = "local1.com" - sans = ["test1.local1.com", "test2.local1.com"] -[[acme.domains]] - main = "local2.com" - sans = ["test1.local2.com", "test2x.local2.com"] -[[acme.domains]] - main = "local3.com" -[[acme.domains]] - main = "local4.com" - -[consul] - endpoint = "127.0.0.1:8500" - watch = true - prefix = "traefik" -``` - -This configuration allows to use the key `traefik/acme/account` to get/set Let's Encrypt certificates content. -The `consul` provider contains the configuration. - -!!! note - It's possible to use others key-value store providers as described [here](/user-guide/kv-config/#key-value-store-configuration). - -## Override entrypoints in frontends - -```toml -[frontends] - - [frontends.frontend1] - backend = "backend2" - [frontends.frontend1.routes.test_1] - rule = "Host:test.localhost" - - [frontends.frontend2] - backend = "backend1" - passHostHeader = true - entrypoints = ["https"] # overrides defaultEntryPoints - [frontends.frontend2.routes.test_1] - rule = "Host:{subdomain:[a-z]+}.localhost" - - [frontends.frontend3] - entrypoints = ["http", "https"] # overrides defaultEntryPoints - backend = "backend2" - rule = "Path:/test" -``` - -## Override the Traefik HTTP server idleTimeout and/or throttle configurations from re-loading too quickly - -```toml -providersThrottleDuration = "5s" - -[respondingTimeouts] -idleTimeout = "360s" -``` - -## Using labels in docker-compose.yml - -Pay attention to the **labels** section: - -``` -home: -image: abiosoft/caddy:0.10.14 -networks: - - ntw_front -volumes: - - ./www/home/srv/:/srv/ -deploy: - mode: replicated - replicas: 2 - #placement: - # constraints: [node.role==manager] - restart_policy: - condition: on-failure - max_attempts: 5 - resources: - limits: - cpus: '0.20' - memory: 9M - reservations: - cpus: '0.05' - memory: 9M - labels: - - "traefik.frontend.rule=PathPrefixStrip:/" - - "traefik.backend=home" - - "traefik.port=2015" - - "traefik.weight=10" - - "traefik.enable=true" - - "traefik.passHostHeader=true" - - "traefik.docker.network=ntw_front" - - "traefik.frontend.entryPoints=http" - - "traefik.backend.loadbalancer.swarm=true" - - "traefik.backend.loadbalancer.method=drr" -``` - -Something more tricky using `regex`. - -In this case a slash is added to `siteexample.io/portainer` and redirect to `siteexample.io/portainer/`. For more details: https://github.com/containous/traefik/issues/563 - -The double sign `$$` are variables managed by the docker compose file ([documentation](https://docs.docker.com/compose/compose-file/#variable-substitution)). - -``` -portainer: -image: portainer/portainer:1.16.5 -networks: - - ntw_front -volumes: - - /var/run/docker.sock:/var/run/docker.sock -deploy: - mode: replicated - replicas: 1 - placement: - constraints: [node.role==manager] - restart_policy: - condition: on-failure - max_attempts: 5 - resources: - limits: - cpus: '0.33' - memory: 20M - reservations: - cpus: '0.05' - memory: 10M - labels: - - "traefik.frontend.rule=PathPrefixStrip:/portainer" - - "traefik.backend=portainer" - - "traefik.port=9000" - - "traefik.weight=10" - - "traefik.enable=true" - - "traefik.passHostHeader=true" - - "traefik.docker.network=ntw_front" - - "traefik.frontend.entryPoints=http" - - "traefik.backend.loadbalancer.swarm=true" - - "traefik.backend.loadbalancer.method=drr" - # https://github.com/containous/traefik/issues/563#issuecomment-421360934 - - "traefik.frontend.redirect.regex=^(.*)/portainer$$" - - "traefik.frontend.redirect.replacement=$$1/portainer/" - - "traefik.frontend.rule=PathPrefix:/portainer;ReplacePathRegex: ^/portainer/(.*) /$$1" -``` diff --git a/old/docs/user-guide/grpc.md b/old/docs/user-guide/grpc.md deleted file mode 100644 index d1ad358c9..000000000 --- a/old/docs/user-guide/grpc.md +++ /dev/null @@ -1,183 +0,0 @@ -# gRPC examples - -## With HTTP (h2c) - -This section explains how to use Traefik as reverse proxy for gRPC application. - -### Traefik configuration - -At last, we configure our Traefik instance to use both self-signed certificates. - -```toml -defaultEntryPoints = ["https"] - -[entryPoints] - [entryPoints.http] - address = ":80" - [entryPoints.http] - -[api] - -[file] - -[backends] - [backends.backend1] - [backends.backend1.servers.server1] - # Access on backend with h2c - url = "h2c://backend.local:8080" - - -[frontends] - [frontends.frontend1] - backend = "backend1" - [frontends.frontend1.routes.test_1] - rule = "Host:frontend.local" -``` - -!!! warning - For provider with label, you will have to specify the `traefik.protocol=h2c` - -### Conclusion - -We don't need specific configuration to use gRPC in Traefik, we just need to use `h2c` protocol, or use HTTPS communications to have HTTP2 with the backend. - -## With HTTPS - -This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates. - -![gRPC architecture](/img/grpc.svg) - -### gRPC Server certificate - -In order to secure the gRPC server, we generate a self-signed certificate for backend url: - -```bash -openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./backend.key -out ./backend.cert -``` - -That will prompt for information, the important answer is: - -``` -Common Name (e.g. server FQDN or YOUR name) []: backend.local -``` - -### gRPC Client certificate - -Generate your self-signed certificate for frontend url: - -```bash -openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert -``` - -with - -``` -Common Name (e.g. server FQDN or YOUR name) []: frontend.local -``` - -### Traefik configuration - -At last, we configure our Traefik instance to use both self-signed certificates. - -```toml -defaultEntryPoints = ["https"] - -# For secure connection on backend.local -rootCAs = [ "./backend.cert" ] - -[entryPoints] - [entryPoints.https] - address = ":4443" - [entryPoints.https.tls] - # For secure connection on frontend.local - [[entryPoints.https.tls.certificates]] - certFile = "./frontend.cert" - keyFile = "./frontend.key" - - -[api] - -[file] - -[backends] - [backends.backend1] - [backends.backend1.servers.server1] - # Access on backend with HTTPS - url = "https://backend.local:8080" - - -[frontends] - [frontends.frontend1] - backend = "backend1" - [frontends.frontend1.routes.test_1] - rule = "Host:frontend.local" -``` - -!!! warning - With some backends, the server URLs use the IP, so you may need to configure `insecureSkipVerify` instead of the `rootCAS` to activate HTTPS without hostname verification. - -### A gRPC example in go (modify for https) - -We use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld) - -!!! warning - In order to use this gRPC example, we need to modify it to use HTTPS - -So we modify the "gRPC server example" to use our own self-signed certificate: - -```go -// ... - -// Read cert and key file -BackendCert, _ := ioutil.ReadFile("./backend.cert") -BackendKey, _ := ioutil.ReadFile("./backend.key") - -// Generate Certificate struct -cert, err := tls.X509KeyPair(BackendCert, BackendKey) -if err != nil { - log.Fatalf("failed to parse certificate: %v", err) -} - -// Create credentials -creds := credentials.NewServerTLSFromCert(&cert) - -// Use Credentials in gRPC server options -serverOption := grpc.Creds(creds) -var s *grpc.Server = grpc.NewServer(serverOption) -defer s.Stop() - -pb.RegisterGreeterServer(s, &server{}) -err := s.Serve(lis) - -// ... -``` - -Next we will modify gRPC Client to use our Traefik self-signed certificate: - -```go -// ... - -// Read cert file -FrontendCert, _ := ioutil.ReadFile("./frontend.cert") - -// Create CertPool -roots := x509.NewCertPool() -roots.AppendCertsFromPEM(FrontendCert) - -// Create credentials -credsClient := credentials.NewClientTLSFromCert(roots, "") - -// Dial with specific Transport (with credentials) -conn, err := grpc.Dial("frontend.local:4443", grpc.WithTransportCredentials(credsClient)) -if err != nil { - log.Fatalf("did not connect: %v", err) -} - -defer conn.Close() -client := pb.NewGreeterClient(conn) - -name := "World" -r, err := client.SayHello(context.Background(), &pb.HelloRequest{Name: name}) - -// ... -``` diff --git a/old/docs/user-guide/kubernetes.md b/old/docs/user-guide/kubernetes.md deleted file mode 100644 index de116e7d1..000000000 --- a/old/docs/user-guide/kubernetes.md +++ /dev/null @@ -1,1020 +0,0 @@ -# Kubernetes Ingress Controller - -This guide explains how to use Traefik as an Ingress controller for a Kubernetes cluster. - -If you are not familiar with Ingresses in Kubernetes you might want to read the [Kubernetes user guide](https://kubernetes.io/docs/concepts/services-networking/ingress/) - -The config files used in this guide can be found in the [examples directory](https://github.com/containous/traefik/tree/master/examples/k8s) - -## Prerequisites - -1. A working Kubernetes cluster. If you want to follow along with this guide, you should setup [minikube](https://kubernetes.io/docs/getting-started-guides/minikube/) on your machine, as it is the quickest way to get a local Kubernetes cluster setup for experimentation and development. - -!!! note - The guide is likely not fully adequate for a production-ready setup. - -2. The `kubectl` binary should be [installed on your workstation](https://kubernetes.io/docs/getting-started-guides/minikube/#download-kubectl). - -### Role Based Access Control configuration (Kubernetes 1.6+ only) - -Kubernetes introduces [Role Based Access Control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) in 1.6+ to allow fine-grained control of Kubernetes resources and API. - -If your cluster is configured with RBAC, you will need to authorize Traefik to use the Kubernetes API. There are two ways to set up the proper permission: Via namespace-specific RoleBindings or a single, global ClusterRoleBinding. - -RoleBindings per namespace enable to restrict granted permissions to the very namespaces only that Traefik is watching over, thereby following the least-privileges principle. This is the preferred approach if Traefik is not supposed to watch all namespaces, and the set of namespaces does not change dynamically. Otherwise, a single ClusterRoleBinding must be employed. - -!!! note - RoleBindings per namespace are available in Traefik 1.5 and later. Please use ClusterRoleBindings for older versions. - -For the sake of simplicity, this guide will use a ClusterRoleBinding: - -```yaml ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1beta1 -metadata: - name: traefik-ingress-controller -rules: - - apiGroups: - - "" - resources: - - services - - endpoints - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - extensions - resources: - - ingresses - verbs: - - get - - list - - watch ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1beta1 -metadata: - name: traefik-ingress-controller -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: traefik-ingress-controller -subjects: -- kind: ServiceAccount - name: traefik-ingress-controller - namespace: kube-system -``` - -[examples/k8s/traefik-rbac.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/traefik-rbac.yaml) - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-rbac.yaml -``` - -For namespaced restrictions, one RoleBinding is required per watched namespace along with a corresponding configuration of Traefik's `kubernetes.namespaces` parameter. - -## Deploy Traefik using a Deployment or DaemonSet - -It is possible to use Traefik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object, - whereas both options have their own pros and cons: - -- The scalability can be much better when using a Deployment, because you will have a Single-Pod-per-Node model when using a DaemonSet, whereas you may need less replicas based on your environment when using a Deployment. -- DaemonSets automatically scale to new nodes, when the nodes join the cluster, whereas Deployment pods are only scheduled on new nodes if required. -- DaemonSets ensure that only one replica of pods run on any single node. Deployments require affinity settings if you want to ensure that two pods don't end up on the same node. -- DaemonSets can be run with the `NET_BIND_SERVICE` capability, which will allow it to bind to port 80/443/etc on each host. This will allow bypassing the kube-proxy, and reduce traffic hops. Note that this is against the Kubernetes Best Practices [Guidelines](https://kubernetes.io/docs/concepts/configuration/overview/#services), and raises the potential for scheduling/scaling issues. Despite potential issues, this remains the choice for most ingress controllers. -- If you are unsure which to choose, start with the Daemonset. - -The Deployment objects looks like this: - -```yaml ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: traefik-ingress-controller - namespace: kube-system ---- -kind: Deployment -apiVersion: extensions/v1beta1 -metadata: - name: traefik-ingress-controller - namespace: kube-system - labels: - k8s-app: traefik-ingress-lb -spec: - replicas: 1 - selector: - matchLabels: - k8s-app: traefik-ingress-lb - template: - metadata: - labels: - k8s-app: traefik-ingress-lb - name: traefik-ingress-lb - spec: - serviceAccountName: traefik-ingress-controller - terminationGracePeriodSeconds: 60 - containers: - - image: traefik - name: traefik-ingress-lb - ports: - - name: http - containerPort: 80 - - name: admin - containerPort: 8080 - args: - - --api - - --kubernetes - - --logLevel=INFO ---- -kind: Service -apiVersion: v1 -metadata: - name: traefik-ingress-service - namespace: kube-system -spec: - selector: - k8s-app: traefik-ingress-lb - ports: - - protocol: TCP - port: 80 - name: web - - protocol: TCP - port: 8080 - name: admin - type: NodePort -``` - -[examples/k8s/traefik-deployment.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/traefik-deployment.yaml) - -!!! note - The Service will expose two NodePorts which allow access to the ingress and the web interface. - -The DaemonSet objects looks not much different: - -```yaml ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: traefik-ingress-controller - namespace: kube-system ---- -kind: DaemonSet -apiVersion: extensions/v1beta1 -metadata: - name: traefik-ingress-controller - namespace: kube-system - labels: - k8s-app: traefik-ingress-lb -spec: - template: - metadata: - labels: - k8s-app: traefik-ingress-lb - name: traefik-ingress-lb - spec: - serviceAccountName: traefik-ingress-controller - terminationGracePeriodSeconds: 60 - containers: - - image: traefik - name: traefik-ingress-lb - ports: - - name: http - containerPort: 80 - hostPort: 80 - - name: admin - containerPort: 8080 - securityContext: - capabilities: - drop: - - ALL - add: - - NET_BIND_SERVICE - args: - - --api - - --kubernetes - - --logLevel=INFO ---- -kind: Service -apiVersion: v1 -metadata: - name: traefik-ingress-service - namespace: kube-system -spec: - selector: - k8s-app: traefik-ingress-lb - ports: - - protocol: TCP - port: 80 - name: web - - protocol: TCP - port: 8080 - name: admin -``` - -[examples/k8s/traefik-ds.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/traefik-ds.yaml) - -!!! note - This will create a Daemonset that uses privileged ports 80/8080 on the host. This may not work on all providers, but illustrates the static (non-NodePort) hostPort binding. The `traefik-ingress-service` can still be used inside the cluster to access the DaemonSet pods. - -To deploy Traefik to your cluster start by submitting one of the YAML files to the cluster with `kubectl`: - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-deployment.yaml -``` - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml -``` - -There are some significant differences between using Deployments and DaemonSets: - -- The Deployment has easier up and down scaling possibilities. - It can implement full pod lifecycle and supports rolling updates from Kubernetes 1.2. - At least one Pod is needed to run the Deployment. -- The DaemonSet automatically scales to all nodes that meets a specific selector and guarantees to fill nodes one at a time. - Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well. - -### Check the Pods - -Now lets check if our command was successful. - -Start by listing the pods in the `kube-system` namespace: - -```shell -kubectl --namespace=kube-system get pods -``` - -```shell -NAME READY STATUS RESTARTS AGE -kube-addon-manager-minikubevm 1/1 Running 0 4h -kubernetes-dashboard-s8krj 1/1 Running 0 4h -traefik-ingress-controller-678226159-eqseo 1/1 Running 0 7m -``` - -You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched a Pod, and it is now running. -_It might take a few moments for Kubernetes to pull the Traefik image and start the container._ - -!!! note - You could also check the deployment with the Kubernetes dashboard, run - `minikube dashboard` to open it in your browser, then choose the `kube-system` - namespace from the menu at the top right of the screen. - -You should now be able to access Traefik on port 80 of your Minikube instance when using the DaemonSet: - -```shell -curl $(minikube ip) -``` - -```shell -404 page not found -``` - -If you decided to use the deployment, then you need to target the correct NodePort, which can be seen when you execute `kubectl get services --namespace=kube-system`. - -```shell -curl $(minikube ip): -``` - -```shell -404 page not found -``` - -!!! note - We expect to see a 404 response here as we haven't yet given Traefik any configuration. - -All further examples below assume a DaemonSet installation. Deployment users will need to append the NodePort when constructing requests. - -## Deploy Traefik using Helm Chart - -!!! note - The Helm Chart is maintained by the community, not the Traefik project maintainers. - -Instead of installing Traefik via Kubernetes object directly, you can also use the Traefik Helm chart. - -Install the Traefik chart by: - -```shell -helm install stable/traefik -``` -Install the Traefik chart using a values.yaml file. - -```shell -helm install --values values.yaml stable/traefik -``` - -```yaml -dashboard: - enabled: true - domain: traefik-ui.minikube -kubernetes: - namespaces: - - default - - kube-system -``` -For more information, check out [the documentation](https://github.com/kubernetes/charts/tree/master/stable/traefik). - -## Submitting an Ingress to the Cluster - -Lets start by creating a Service and an Ingress that will expose the [Traefik Web UI](https://github.com/containous/traefik#web-ui). - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: traefik-web-ui - namespace: kube-system -spec: - selector: - k8s-app: traefik-ingress-lb - ports: - - name: web - port: 80 - targetPort: 8080 ---- -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: traefik-web-ui - namespace: kube-system -spec: - rules: - - host: traefik-ui.minikube - http: - paths: - - path: / - backend: - serviceName: traefik-web-ui - servicePort: web -``` - -[examples/k8s/ui.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/ui.yaml) - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/ui.yaml -``` - -Now lets setup an entry in our `/etc/hosts` file to route `traefik-ui.minikube` to our cluster. - -In production you would want to set up real DNS entries. -You can get the IP address of your minikube instance by running `minikube ip`: - -```shell -echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts -``` - -We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) in the browser and view the Traefik web UI. - -### Add a TLS Certificate to the Ingress - -!!! note - For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. - For more details see [here](/configuration/entrypoints/). - -You can add a TLS entrypoint by adding the following `args` to the container spec: - -```yaml - --defaultentrypoints=http,https - --entrypoints=Name:https Address::443 TLS - --entrypoints=Name:http Address::80 -``` - -To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource. - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: traefik-web-ui - namespace: kube-system - annotations: - kubernetes.io/ingress.class: traefik -spec: - rules: - - host: traefik-ui.minikube - http: - paths: - - backend: - serviceName: traefik-web-ui - servicePort: 80 - tls: - - secretName: traefik-ui-tls-cert -``` - -In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress. -The following two commands will generate a new certificate and create a secret containing the key and cert files. - -```shell -openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=traefik-ui.minikube" -kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=tls.key --cert=tls.crt -``` - -If there are any errors while loading the TLS section of an ingress, the whole ingress will be skipped. - -!!! note - The secret must have two entries named `tls.key`and `tls.crt`. - See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details. - -!!! note - The TLS certificates will be added to all entrypoints defined by the ingress annotation `traefik.frontend.entryPoints`. - If no such annotation is provided, the TLS certificates will be added to all TLS-enabled `defaultEntryPoints`. - -!!! note - The field `hosts` in the TLS configuration is ignored. Instead, the domains provided by the certificate are used for this purpose. - It is recommended to not use wildcard certificates as they will match globally. - -## Basic Authentication - -It's possible to protect access to Traefik through basic authentication. (See the [Kubernetes Ingress](/configuration/backends/kubernetes) configuration page for syntactical details and restrictions.) - -### Creating the Secret - -A. Use `htpasswd` to create a file containing the username and the MD5-encoded password: - -```shell -htpasswd -c ./auth myusername -``` - -You will be prompted for a password which you will have to enter twice. -`htpasswd` will create a file with the following: - -```shell -cat auth -``` - -```shell -myusername:$apr1$78Jyn/1K$ERHKVRPPlzAX8eBtLuvRZ0 -``` - -B. Now use `kubectl` to create a secret in the `monitoring` namespace using the file created by `htpasswd`. - -```shell -kubectl create secret generic mysecret --from-file auth --namespace=monitoring -``` - -!!! note - Secret must be in same namespace as the Ingress object. - -C. Attach the following annotations to the Ingress object: - -- `traefik.ingress.kubernetes.io/auth-type: "basic"` -- `traefik.ingress.kubernetes.io/auth-secret: "mysecret"` - -They specify basic authentication and reference the Secret `mysecret` containing the credentials. - -Following is a full Ingress example based on Prometheus: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: prometheus-dashboard - namespace: monitoring - annotations: - kubernetes.io/ingress.class: traefik - traefik.ingress.kubernetes.io/auth-type: "basic" - traefik.ingress.kubernetes.io/auth-secret: "mysecret" -spec: - rules: - - host: dashboard.prometheus.example.com - http: - paths: - - backend: - serviceName: prometheus - servicePort: 9090 -``` - -You can apply the example as following: - -```shell -kubectl create -f prometheus-ingress.yaml -n monitoring -``` - -## Name-based Routing - -In this example we are going to setup websites for three of the United Kingdoms best loved cheeses: Cheddar, Stilton, and Wensleydale. - -First lets start by launching the pods for the cheese websites. - -```yaml ---- -kind: Deployment -apiVersion: extensions/v1beta1 -metadata: - name: stilton - labels: - app: cheese - cheese: stilton -spec: - replicas: 2 - selector: - matchLabels: - app: cheese - task: stilton - template: - metadata: - labels: - app: cheese - task: stilton - version: v0.0.1 - spec: - containers: - - name: cheese - image: errm/cheese:stilton - ports: - - containerPort: 80 ---- -kind: Deployment -apiVersion: extensions/v1beta1 -metadata: - name: cheddar - labels: - app: cheese - cheese: cheddar -spec: - replicas: 2 - selector: - matchLabels: - app: cheese - task: cheddar - template: - metadata: - labels: - app: cheese - task: cheddar - version: v0.0.1 - spec: - containers: - - name: cheese - image: errm/cheese:cheddar - ports: - - containerPort: 80 ---- -kind: Deployment -apiVersion: extensions/v1beta1 -metadata: - name: wensleydale - labels: - app: cheese - cheese: wensleydale -spec: - replicas: 2 - selector: - matchLabels: - app: cheese - task: wensleydale - template: - metadata: - labels: - app: cheese - task: wensleydale - version: v0.0.1 - spec: - containers: - - name: cheese - image: errm/cheese:wensleydale - ports: - - containerPort: 80 -``` - -[examples/k8s/cheese-deployments.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-deployments.yaml) - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-deployments.yaml -``` - -Next we need to setup a Service for each of the cheese pods. - -```yaml ---- -apiVersion: v1 -kind: Service -metadata: - name: stilton -spec: - ports: - - name: http - targetPort: 80 - port: 80 - selector: - app: cheese - task: stilton ---- -apiVersion: v1 -kind: Service -metadata: - name: cheddar -spec: - ports: - - name: http - targetPort: 80 - port: 80 - selector: - app: cheese - task: cheddar ---- -apiVersion: v1 -kind: Service -metadata: - name: wensleydale - annotations: - traefik.backend.circuitbreaker: "NetworkErrorRatio() > 0.5" -spec: - ports: - - name: http - targetPort: 80 - port: 80 - selector: - app: cheese - task: wensleydale -``` - -!!! note - We also set a [circuit breaker expression](/basics/#backends) for one of the backends by setting the `traefik.backend.circuitbreaker` annotation on the service. - -[examples/k8s/cheese-services.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-services.yaml) - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-services.yaml -``` - -Now we can submit an ingress for the cheese websites. - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: cheese - annotations: - kubernetes.io/ingress.class: traefik -spec: - rules: - - host: stilton.minikube - http: - paths: - - path: / - backend: - serviceName: stilton - servicePort: http - - host: cheddar.minikube - http: - paths: - - path: / - backend: - serviceName: cheddar - servicePort: http - - host: wensleydale.minikube - http: - paths: - - path: / - backend: - serviceName: wensleydale - servicePort: http -``` - -[examples/k8s/cheese-ingress.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-ingress.yaml) - -!!! note - We list each hostname, and add a backend service. - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml -``` - -Now visit the [Traefik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host. -Along with a backend listing for each service with a server set up for each pod. - -If you edit your `/etc/hosts` again you should be able to access the cheese websites in your browser. - -```shell -echo "$(minikube ip) stilton.minikube cheddar.minikube wensleydale.minikube" | sudo tee -a /etc/hosts -``` - -- [Stilton](http://stilton.minikube/) -- [Cheddar](http://cheddar.minikube/) -- [Wensleydale](http://wensleydale.minikube/) - -## Path-based Routing - -Now lets suppose that our fictional client has decided that while they are super happy about our cheesy web design, when they asked for 3 websites they had not really bargained on having to buy 3 domain names. - -No problem, we say, why don't we reconfigure the sites to host all 3 under one domain. - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: cheeses - annotations: - kubernetes.io/ingress.class: traefik - traefik.frontend.rule.type: PathPrefixStrip -spec: - rules: - - host: cheeses.minikube - http: - paths: - - path: /stilton - backend: - serviceName: stilton - servicePort: http - - path: /cheddar - backend: - serviceName: cheddar - servicePort: http - - path: /wensleydale - backend: - serviceName: wensleydale - servicePort: http -``` - -[examples/k8s/cheeses-ingress.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheeses-ingress.yaml) - -!!! note - We are configuring Traefik to strip the prefix from the url path with the `traefik.frontend.rule.type` annotation so that we can use the containers from the previous example without modification. - -```shell -kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheeses-ingress.yaml -``` - -```shell -echo "$(minikube ip) cheeses.minikube" | sudo tee -a /etc/hosts -``` - -You should now be able to visit the websites in your browser. - -- [cheeses.minikube/stilton](http://cheeses.minikube/stilton/) -- [cheeses.minikube/cheddar](http://cheeses.minikube/cheddar/) -- [cheeses.minikube/wensleydale](http://cheeses.minikube/wensleydale/) - -## Multiple Ingress Definitions for the Same Host (or Host+Path) - -Traefik will merge multiple Ingress definitions for the same host/path pair into one definition. - -Let's say the number of cheese services is growing. -It is now time to move the cheese services to a dedicated cheese namespace to simplify the managements of cheese and non-cheese services. - -Simply deploy a new Ingress Object with the same host an path into the cheese namespace: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: cheese - namespace: cheese - annotations: - kubernetes.io/ingress.class: traefik - traefik.frontend.rule.type: PathPrefixStrip -spec: - rules: - - host: cheese.minikube - http: - paths: - - path: /cheddar - backend: - serviceName: cheddar - servicePort: http -``` - -Traefik will now look for cheddar service endpoints (ports on healthy pods) in both the cheese and the default namespace. -Deploying cheddar into the cheese namespace and afterwards shutting down cheddar in the default namespace is enough to migrate the traffic. - -!!! note - The kubernetes documentation does not specify this merging behavior. - -!!! note - Merging ingress definitions can cause problems if the annotations differ or if the services handle requests differently. - Be careful and extra cautious when running multiple overlapping ingress definitions. - -## Specifying Routing Priorities - -Sometimes you need to specify priority for ingress routes, especially when handling wildcard routes. -This can be done by adding the `traefik.frontend.priority` annotation, i.e.: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: wildcard-cheeses - annotations: - traefik.frontend.priority: "1" -spec: - rules: - - host: *.minikube - http: - paths: - - path: / - backend: - serviceName: stilton - servicePort: http - -kind: Ingress -metadata: - name: specific-cheeses - annotations: - traefik.frontend.priority: "2" -spec: - rules: - - host: specific.minikube - http: - paths: - - path: / - backend: - serviceName: stilton - servicePort: http -``` - -Note that priority values must be quoted to avoid numeric interpretation (which are illegal for annotations). - -## Forwarding to ExternalNames - -When specifying an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors), -Traefik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443. -This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port. - -## Disable passing the Host Header - -By default Traefik will pass the incoming Host header to the upstream resource. - -However, there are times when you may not want this to be the case. For example, if your service is of the ExternalName type. - -### Disable globally - -Add the following to your TOML configuration file: - -```toml -disablePassHostHeaders = true -``` - -### Disable per Ingress - -To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` annotation on your ingress to `"false"`. - -Here is an example definition: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - name: example - annotations: - kubernetes.io/ingress.class: traefik - traefik.frontend.passHostHeader: "false" -spec: - rules: - - host: example.com - http: - paths: - - path: /static - backend: - serviceName: static - servicePort: https -``` - -And an example service definition: - -```yaml -apiVersion: v1 -kind: Service -metadata: - name: static -spec: - ports: - - name: https - port: 443 - type: ExternalName - externalName: static.otherdomain.com -``` - -If you were to visit `example.com/static` the request would then be passed on to `static.otherdomain.com/static`, and `static.otherdomain.com` would receive the request with the Host header being `static.otherdomain.com`. - -!!! note - The per-ingress annotation overrides whatever the global value is set to. - So you could set `disablePassHostHeaders` to `true` in your TOML configuration file and then enable passing the host header per ingress if you wanted. - -## Partitioning the Ingress object space - -By default, Traefik processes every Ingress objects it observes. At times, however, it may be desirable to ignore certain objects. The following sub-sections describe common use cases and how they can be handled with Traefik. - -### Between Traefik and other Ingress controller implementations - -Sometimes Traefik runs along other Ingress controller implementations. One such example is when both Traefik and a cloud provider Ingress controller are active. - -The `kubernetes.io/ingress.class` annotation can be attached to any Ingress object in order to control whether Traefik should handle it. - -If the annotation is missing, contains an empty value, or the value `traefik`, then the Traefik controller will take responsibility and process the associated Ingress object. - -It is also possible to set the `ingressClass` option in Traefik to a particular value. Traefik will only process matching Ingress objects. -For instance, setting the option to `traefik-internal` causes Traefik to process Ingress objects with the same `kubernetes.io/ingress.class` annotation value, ignoring all other objects (including those with a `traefik` value, empty value, and missing annotation). - -!!! note - Letting multiple ingress controllers handle the same ingress objects can lead to unintended behavior. - It is recommended to prefix all ingressClass values with `traefik` to avoid unintended collisions with other ingress implementations. - -### Between multiple Traefik Deployments - -Sometimes multiple Traefik Deployments are supposed to run concurrently. -For instance, it is conceivable to have one Deployment deal with internal and another one with external traffic. - -For such cases, it is advisable to classify Ingress objects through a label and configure the `labelSelector` option per each Traefik Deployment accordingly. -To stick with the internal/external example above, all Ingress objects meant for internal traffic could receive a `traffic-type: internal` label while objects designated for external traffic receive a `traffic-type: external` label. -The label selectors on the Traefik Deployments would then be `traffic-type=internal` and `traffic-type=external`, respectively. - -## Traffic Splitting - -It is possible to split Ingress traffic in a fine-grained manner between multiple deployments using _service weights_. - -One canonical use case is canary releases where a deployment representing a newer release is to receive an initially small but ever-increasing fraction of the requests over time. -The way this can be done in Traefik is to specify a percentage of requests that should go into each deployment. - -For instance, say that an application `my-app` runs in version 1. -A newer version 2 is about to be released, but confidence in the robustness and reliability of new version running in production can only be gained gradually. -Thus, a new deployment `my-app-canary` is created and scaled to a replica count that suffices for a 1% traffic share. -Along with it, a Service object is created as usual. - -The Ingress specification would look like this: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - annotations: - traefik.ingress.kubernetes.io/service-weights: | - my-app: 99% - my-app-canary: 1% - name: my-app -spec: - rules: - - http: - paths: - - backend: - serviceName: my-app - servicePort: 80 - path: / - - backend: - serviceName: my-app-canary - servicePort: 80 - path: / -``` - -Take note of the `traefik.ingress.kubernetes.io/service-weights` annotation: It specifies the distribution of requests among the referenced backend services, `my-app` and `my-app-canary`. -With this definition, Traefik will route 99% of the requests to the pods backed by the `my-app` deployment, and 1% to those backed by `my-app-canary`. -Over time, the ratio may slowly shift towards the canary deployment until it is deemed to replace the previous main application, in steps such as 5%/95%, 10%/90%, 50%/50%, and finally 100%/0%. - -A few conditions must hold for service weights to be applied correctly: - -- The associated service backends must share the same path and host. -- The total percentage shared across all service backends must yield 100% (see the section on [omitting the final service](#omitting-the-final-service), however). -- The percentage values are interpreted as floating point numbers to a supported precision as defined in the [annotation documentation](/configuration/backends/kubernetes#general-annotations). - -### Omitting the Final Service - -When specifying service weights, it is possible to omit exactly one service for convenience reasons. - -For instance, the following definition shows how to split requests in a scenario where a canary release is accompanied by a baseline deployment for easier metrics comparison or automated canary analysis: - -```yaml -apiVersion: extensions/v1beta1 -kind: Ingress -metadata: - annotations: - traefik.ingress.kubernetes.io/service-weights: | - my-app-canary: 10% - my-app-baseline: 10% - name: app -spec: - rules: - - http: - paths: - - backend: - serviceName: my-app-canary - servicePort: 80 - path: / - - backend: - serviceName: my-app-baseline - servicePort: 80 - path: / - - backend: - serviceName: my-app-main - servicePort: 80 - path: / -``` - -This configuration assigns 80% of traffic to `my-app-main` automatically, thus freeing the user from having to complete percentage values manually. -This becomes handy when increasing shares for canary releases continuously. - -## Production advice - -### Resource limitations - -The examples shown deliberately do not specify any [resource limitations](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) as there is no one size fits all. - -In a production environment, however, it is important to set proper bounds, especially with regards to CPU: - -- too strict and Traefik will be throttled while serving requests (as Kubernetes imposes hard quotas) -- too loose and Traefik may waste resources not available for other containers - -When in doubt, you should measure your resource needs, and adjust requests and limits accordingly. diff --git a/old/docs/user-guide/kv-config.md b/old/docs/user-guide/kv-config.md deleted file mode 100644 index a7ecde26d..000000000 --- a/old/docs/user-guide/kv-config.md +++ /dev/null @@ -1,444 +0,0 @@ -# Key-value store configuration - -Both [static global configuration](/user-guide/kv-config/#static-configuration-in-key-value-store) and [dynamic](/user-guide/kv-config/#dynamic-configuration-in-key-value-store) configuration can be stored in a Key-value store. - -This section explains how to launch Traefik using a configuration loaded from a Key-value store. - -Traefik supports several Key-value stores: - -- [Consul](https://consul.io) -- [etcd](https://coreos.com/etcd/) -- [ZooKeeper](https://zookeeper.apache.org/) -- [boltdb](https://github.com/boltdb/bolt) - -## Static configuration in Key-value store - -We will see the steps to set it up with an easy example. - -!!! note - We could do the same with any other Key-value Store. - -### docker-compose file for Consul - -The Traefik global configuration will be retrieved from a [Consul](https://consul.io) store. - -First we have to launch Consul in a container. - -The [docker-compose file](https://docs.docker.com/compose/compose-file/) allows us to launch Consul and four instances of the trivial app [containous/whoami](https://github.com/containous/whoami) : - -```yaml -consul: - image: progrium/consul - command: -server -bootstrap -log-level debug -ui-dir /ui - ports: - - "8400:8400" - - "8500:8500" - - "8600:53/udp" - expose: - - "8300" - - "8301" - - "8301/udp" - - "8302" - - "8302/udp" - -whoami1: - image: containous/whoami - -whoami2: - image: containous/whoami - -whoami3: - image: containous/whoami - -whoami4: - image: containous/whoami -``` - -### Upload the configuration in the Key-value store - -We should now fill the store with the Traefik global configuration. -To do that, we can send the Key-value pairs via [curl commands](https://www.consul.io/intro/getting-started/kv.html) or via the [Web UI](https://www.consul.io/intro/getting-started/ui.html). - -Fortunately, Traefik allows automation of this process using the `storeconfig` subcommand. -Please refer to the [store Traefik configuration](/user-guide/kv-config/#store-configuration-in-key-value-store) section to get documentation on it. - -Here is the toml configuration we would like to store in the Key-value Store : - -```toml -logLevel = "DEBUG" - -defaultEntryPoints = ["http", "https"] - -[entryPoints] - [entryPoints.api] - address = ":8081" - [entryPoints.http] - address = ":80" - [entryPoints.https] - address = ":443" - - [entryPoints.https.tls] - [[entryPoints.https.tls.certificates]] - certFile = "integration/fixtures/https/snitest.com.cert" - keyFile = "integration/fixtures/https/snitest.com.key" - [[entryPoints.https.tls.certificates]] - certFile = """-----BEGIN CERTIFICATE----- - - -----END CERTIFICATE-----""" - keyFile = """-----BEGIN PRIVATE KEY----- - - -----END PRIVATE KEY-----""" - [entryPoints.other-https] - address = ":4443" - [entryPoints.other-https.tls] - -[consul] - endpoint = "127.0.0.1:8500" - watch = true - prefix = "traefik" - -[api] - entrypoint = "api" -``` - -And there, the same global configuration in the Key-value Store (using `prefix = "traefik"`): - -| Key | Value | -|-----------------------------------------------------------|---------------------------------------------------------------| -| `/traefik/loglevel` | `DEBUG` | -| `/traefik/defaultentrypoints/0` | `http` | -| `/traefik/defaultentrypoints/1` | `https` | -| `/traefik/entrypoints/api/address` | `:8081` | -| `/traefik/entrypoints/http/address` | `:80` | -| `/traefik/entrypoints/https/address` | `:443` | -| `/traefik/entrypoints/https/tls/certificates/0/certfile` | `integration/fixtures/https/snitest.com.cert` | -| `/traefik/entrypoints/https/tls/certificates/0/keyfile` | `integration/fixtures/https/snitest.com.key` | -| `/traefik/entrypoints/https/tls/certificates/1/certfile` | `--BEGIN CERTIFICATE----END CERTIFICATE--` | -| `/traefik/entrypoints/https/tls/certificates/1/keyfile` | `--BEGIN CERTIFICATE----END CERTIFICATE--` | -| `/traefik/entrypoints/other-https/address` | `:4443` | -| `/traefik/consul/endpoint` | `127.0.0.1:8500` | -| `/traefik/consul/watch` | `true` | -| `/traefik/consul/prefix` | `traefik` | -| `/traefik/api/entrypoint` | `api` | - -In case you are setting key values manually: - -- Remember to specify the indexes (`0`,`1`, `2`, ... ) under prefixes `/traefik/defaultentrypoints/` and `/traefik/entrypoints/https/tls/certificates/` in order to match the global configuration structure. -- Be careful to give the correct IP address and port on the key `/traefik/consul/endpoint`. - -Note that we can either give path to certificate file or directly the file content itself. - -### Launch Traefik - -We will now launch Traefik in a container. - -We use CLI flags to setup the connection between Traefik and Consul. -All the rest of the global configuration is stored in Consul. - -Here is the [docker-compose file](https://docs.docker.com/compose/compose-file/) : - -```yaml -traefik: - image: traefik - command: --consul --consul.endpoint=127.0.0.1:8500 - ports: - - "80:80" - - "8080:8080" -``` - -!!! warning - Be careful to give the correct IP address and port in the flag `--consul.endpoint`. - -### Consul ACL Token support - -To specify a Consul ACL token for Traefik, we have to set a System Environment variable named `CONSUL_HTTP_TOKEN` prior to starting Traefik. -This variable must be initialized with the ACL token value. - -If Traefik is launched into a Docker container, the variable `CONSUL_HTTP_TOKEN` can be initialized with the `-e` Docker option : `-e "CONSUL_HTTP_TOKEN=[consul-acl-token-value]"` - -If a Consul ACL is used to restrict Traefik read/write access, one of the following configurations is needed. - -- HCL format : - -``` - key "traefik" { - policy = "write" - }, - - session "" { - policy = "write" - } -``` - -- JSON format : - -```json -{ - "key": { - "traefik": { - "policy": "write" - } - }, - "session": { - "": { - "policy": "write" - } - } -} -``` - -### TLS support - -To connect to a Consul endpoint using SSL, simply specify `https://` in the `consul.endpoint` property - -- `--consul.endpoint=https://[consul-host]:[consul-ssl-port]` - -### TLS support with client certificates - -So far, only [Consul](https://consul.io) and [etcd](https://coreos.com/etcd/) support TLS connections with client certificates. - -To set it up, we should enable [consul security](https://www.consul.io/docs/internals/security.html) (or [etcd security](https://coreos.com/etcd/docs/latest/security.html)). - -Then, we have to provide CA, Cert and Key to Traefik using `consul` flags : - -- `--consul.tls` -- `--consul.tls.ca=path/to/the/file` -- `--consul.tls.cert=path/to/the/file` -- `--consul.tls.key=path/to/the/file` - -Or etcd flags : - -- `--etcd.tls` -- `--etcd.tls.ca=path/to/the/file` -- `--etcd.tls.cert=path/to/the/file` -- `--etcd.tls.key=path/to/the/file` - -!! note - We can either give directly directly the file content itself (instead of the path to certificate) in a TOML file configuration. - -Remember the command `traefik --help` to display the updated list of flags. - -## Dynamic configuration in Key-value store - -Following our example, we will provide backends/frontends rules and HTTPS certificates to Traefik. - -!!! note - This section is independent of the way Traefik got its static configuration. - It means that the static configuration can either come from the same Key-value store or from any other sources. - -### Key-value storage structure - -Here is the toml configuration we would like to store in the store : - -```toml -[file] - -# rules -[backends] - [backends.backend1] - [backends.backend1.circuitbreaker] - expression = "NetworkErrorRatio() > 0.5" - [backends.backend1.servers.server1] - url = "http://172.17.0.2:80" - weight = 10 - [backends.backend1.servers.server2] - url = "http://172.17.0.3:80" - weight = 1 - [backends.backend2] - [backends.backend1.maxconn] - amount = 10 - extractorfunc = "request.host" - [backends.backend2.LoadBalancer] - method = "drr" - [backends.backend2.servers.server1] - url = "http://172.17.0.4:80" - weight = 1 - [backends.backend2.servers.server2] - url = "http://172.17.0.5:80" - weight = 2 - -[frontends] - [frontends.frontend1] - backend = "backend2" - [frontends.frontend1.routes.test_1] - rule = "Host:test.localhost" - [frontends.frontend2] - backend = "backend1" - passHostHeader = true - priority = 10 - [frontends.frontend2.auth.basic] - users = [ - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", - "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0", - ] - entrypoints = ["https"] # overrides defaultEntryPoints - [frontends.frontend2.routes.test_1] - rule = "Host:{subdomain:[a-z]+}.localhost" - [frontends.frontend3] - entrypoints = ["http", "https"] # overrides defaultEntryPoints - backend = "backend2" - rule = "Path:/test" - -[[tls]] - [tls.certificate] - certFile = "path/to/your.cert" - keyFile = "path/to/your.key" - -[[tls]] - entryPoints = ["https","other-https"] - [tls.certificate] - certFile = """-----BEGIN CERTIFICATE----- - - -----END CERTIFICATE-----""" - keyFile = """-----BEGIN CERTIFICATE----- - - -----END CERTIFICATE-----""" -``` - -And there, the same dynamic configuration in a KV Store (using `prefix = "traefik"`): - -- backend 1 - -| Key | Value | -|--------------------------------------------------------|-----------------------------| -| `/traefik/backends/backend1/circuitbreaker/expression` | `NetworkErrorRatio() > 0.5` | -| `/traefik/backends/backend1/servers/server1/url` | `http://172.17.0.2:80` | -| `/traefik/backends/backend1/servers/server1/weight` | `10` | -| `/traefik/backends/backend1/servers/server2/url` | `http://172.17.0.3:80` | -| `/traefik/backends/backend1/servers/server2/weight` | `1` | -| `/traefik/backends/backend1/servers/server2/tags` | `api,helloworld` | - -- backend 2 - -| Key | Value | -|-----------------------------------------------------|------------------------| -| `/traefik/backends/backend2/maxconn/amount` | `10` | -| `/traefik/backends/backend2/maxconn/extractorfunc` | `request.host` | -| `/traefik/backends/backend2/loadbalancer/method` | `drr` | -| `/traefik/backends/backend2/servers/server1/url` | `http://172.17.0.4:80` | -| `/traefik/backends/backend2/servers/server1/weight` | `1` | -| `/traefik/backends/backend2/servers/server2/url` | `http://172.17.0.5:80` | -| `/traefik/backends/backend2/servers/server2/weight` | `2` | -| `/traefik/backends/backend2/servers/server2/tags` | `web` | - -- frontend 1 - -| Key | Value | -|---------------------------------------------------|-----------------------| -| `/traefik/frontends/frontend1/backend` | `backend2` | -| `/traefik/frontends/frontend1/routes/test_1/rule` | `Host:test.localhost` | - -- frontend 2 - -| Key | Value | -|----------------------------------------------------|-----------------------------------------------| -| `/traefik/frontends/frontend2/backend` | `backend1` | -| `/traefik/frontends/frontend2/passhostheader` | `true` | -| `/traefik/frontends/frontend2/priority` | `10` | -| `/traefik/frontends/frontend2/auth/basic/users/0` | `test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/` | -| `/traefik/frontends/frontend2/auth/basic/users/1` | `test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0` | -| `/traefik/frontends/frontend2/entrypoints` | `http,https` | -| `/traefik/frontends/frontend2/routes/test_2/rule` | `PathPrefix:/test` | - -- certificate 1 - -| Key | Value | -|---------------------------------------|--------------------| -| `/traefik/tls/1/certificate/certfile` | `path/to/your.cert`| -| `/traefik/tls/1/certificate/keyfile` | `path/to/your.key` | - -!!! note - As `/traefik/tls/1/entrypoints` is not defined, the certificate will be attached to all `defaulEntryPoints` with a TLS configuration (in the example, the entryPoint `https`) - -- certificate 2 - -| Key | Value | -|---------------------------------------|-----------------------| -| `/traefik/tls/2/entrypoints` | `https,other-https` | -| `/traefik/tls/2/certificate/certfile` | `` | -| `/traefik/tls/2/certificate/keyfile` | `` | - -### Atomic configuration changes - -Traefik can watch the backends/frontends configuration changes and generate its configuration automatically. - -!!! note - Only backends/frontends rules are dynamic, the rest of the Traefik configuration stay static. - -The [Etcd](https://github.com/coreos/etcd/issues/860) and [Consul](https://github.com/hashicorp/consul/issues/886) backends do not support updating multiple keys atomically. -As a result, it may be possible for Traefik to read an intermediate configuration state despite judicious use of the `--providersThrottleDuration` flag. -To solve this problem, Traefik supports a special key called `/traefik/alias`. -If set, Traefik use the value as an alternative key prefix. - -Given the key structure below, Traefik will use the `http://172.17.0.2:80` as its only backend (frontend keys have been omitted for brevity). - -| Key | Value | -|-------------------------------------------------------------------------|-----------------------------| -| `/traefik/alias` | `/traefik_configurations/1` | -| `/traefik_configurations/1/backends/backend1/servers/server1/url` | `http://172.17.0.2:80` | -| `/traefik_configurations/1/backends/backend1/servers/server1/weight` | `10` | - -When an atomic configuration change is required, you may write a new configuration at an alternative prefix. - -Here, although the `/traefik_configurations/2/...` keys have been set, the old configuration is still active because the `/traefik/alias` key still points to `/traefik_configurations/1`: - -| Key | Value | -|-------------------------------------------------------------------------|-----------------------------| -| `/traefik/alias` | `/traefik_configurations/1` | -| `/traefik_configurations/1/backends/backend1/servers/server1/url` | `http://172.17.0.2:80` | -| `/traefik_configurations/1/backends/backend1/servers/server1/weight` | `10` | -| `/traefik_configurations/2/backends/backend1/servers/server1/url` | `http://172.17.0.2:80` | -| `/traefik_configurations/2/backends/backend1/servers/server1/weight` | `5` | -| `/traefik_configurations/2/backends/backend1/servers/server2/url` | `http://172.17.0.3:80` | -| `/traefik_configurations/2/backends/backend1/servers/server2/weight` | `5` | - -Once the `/traefik/alias` key is updated, the new `/traefik_configurations/2` configuration becomes active atomically. - -Here, we have a 50% balance between the `http://172.17.0.3:80` and the `http://172.17.0.4:80` hosts while no traffic is sent to the `172.17.0.2:80` host: - -| Key | Value | -|-------------------------------------------------------------------------|-----------------------------| -| `/traefik/alias` | `/traefik_configurations/2` | -| `/traefik_configurations/1/backends/backend1/servers/server1/url` | `http://172.17.0.2:80` | -| `/traefik_configurations/1/backends/backend1/servers/server1/weight` | `10` | -| `/traefik_configurations/2/backends/backend1/servers/server1/url` | `http://172.17.0.3:80` | -| `/traefik_configurations/2/backends/backend1/servers/server1/weight` | `5` | -| `/traefik_configurations/2/backends/backend1/servers/server2/url` | `http://172.17.0.4:80` | -| `/traefik_configurations/2/backends/backend1/servers/server2/weight` | `5` | - -!!! note - Traefik *will not watch for key changes in the `/traefik_configurations` prefix*. It will only watch for changes in the `/traefik/alias`. - Further, if the `/traefik/alias` key is set, all other configuration with `/traefik/backends` or `/traefik/frontends` prefix are ignored. - -## Store configuration in Key-value store - -!!! note - Don't forget to [setup the connection between Traefik and Key-value store](/user-guide/kv-config/#launch-traefik). - -The static Traefik configuration in a key-value store can be automatically created and updated, using the [`storeconfig` subcommand](/basics/#commands). - -```bash -traefik storeconfig [flags] ... -``` -This command is here only to automate the [process which upload the configuration into the Key-value store](/user-guide/kv-config/#upload-the-configuration-in-the-key-value-store). -Traefik will not start but the [static configuration](/basics/#static-traefik-configuration) will be uploaded into the Key-value store. - -If you configured ACME (Let's Encrypt), your registration account and your certificates will also be uploaded. - -If you configured a file provider `[file]`, all your dynamic configuration (backends, frontends...) will be uploaded to the Key-value store. - -To upload your ACME certificates to the KV store, get your Traefik TOML file and add the new `storage` option in the `acme` section: - -```toml -[acme] -email = "test@traefik.io" -storage = "traefik/acme/account" # the key where to store your certificates in the KV store -storageFile = "acme.json" # your old certificates store -``` - -Call `traefik storeconfig` to upload your config in the KV store. -Then remove the line `storageFile = "acme.json"` from your TOML config file. - -That's it! - -![GIF Magica](https://i.giphy.com/ujUdrdpX7Ok5W.gif) diff --git a/old/docs/user-guide/marathon.md b/old/docs/user-guide/marathon.md deleted file mode 100644 index ec62e1497..000000000 --- a/old/docs/user-guide/marathon.md +++ /dev/null @@ -1,144 +0,0 @@ -# Marathon - -This guide explains how to integrate Marathon and operate the cluster in a reliable way from Traefik's standpoint. - -## Host detection - -Marathon offers multiple ways to run (Docker-containerized) applications, the most popular ones being - -- BRIDGE-networked containers with dynamic high ports exposed -- HOST-networked containers with host machine ports -- containers with dedicated IP addresses ([IP-per-task](https://mesosphere.github.io/marathon/docs/ip-per-task.html)). - -Traefik tries to detect the configured mode and route traffic to the right IP addresses. It is possible to force using task hosts with the `forceTaskHostname` option. - -Given the complexity of the subject, it is possible that the heuristic fails. -Apart from filing an issue and waiting for the feature request / bug report to get addressed, one workaround for such situations is to customize the Marathon template file to the individual needs. - -!!! note - This does _not_ require rebuilding Traefik but only to point the `filename` configuration parameter to a customized version of the `marathon.tmpl` file on Traefik startup. - -## Port detection - -Traefik also attempts to determine the right port (which is a [non-trivial matter in Marathon](https://mesosphere.github.io/marathon/docs/ports.html)). -Following is the order by which Traefik tries to identify the port (the first one that yields a positive result will be used): - -1. A arbitrary port specified through the `traefik.port` label. -1. The task port (possibly indexed through the `traefik.portIndex` label, otherwise the first one). -1. The port from the application's `portDefinitions` field (possibly indexed through the `traefik.portIndex` label, otherwise the first one). -1. The port from the application's `ipAddressPerTask` field (possibly indexed through the `traefik.portIndex` label, otherwise the first one). - -## Applications with multiple ports - -Some Marathon applications may expose multiple ports. Traefik supports creating one so-called _segment_ per port using [segment labels](/configuration/backends/marathon#applications-with-multiple-ports-segment-labels). - -For instance, assume that a Marathon application exposes a web API on port 80 and an admin interface on port 8080. It would then be possible to make each service available by specifying the following Marathon labels: - -``` -traefik.web.port=80 -``` - -``` -traefik.admin.port=8080 -``` - -(Note that the service names `web` and `admin` can be chosen arbitrarily.) - -Technically, Traefik will create one pair of frontend and backend configurations for each service. - -## Achieving high availability - -### Scenarios - -There are three scenarios where the availability of a Marathon application could be impaired along with the risk of losing or failing requests: - -- During the startup phase when Traefik already routes requests to the backend even though it has not completed its bootstrapping process yet. -- During the shutdown phase when Traefik still routes requests to the backend while the backend is already terminating. -- During a failure of the application when Traefik has not yet identified the backend as being erroneous. - -The first two scenarios are common with every rolling upgrade of an application (i.e. a new version release or configuration update). - -The following sub-sections describe how to resolve or mitigate each scenario. - -#### Startup - -It is possible to define [readiness checks](https://mesosphere.github.io/marathon/docs/readiness-checks.html) (available since Marathon version 1.1) per application and have Marathon take these into account during the startup phase. - -The idea is that each application provides an HTTP endpoint that Marathon queries periodically during an ongoing deployment in order to mark the associated readiness check result as successful if and only if the endpoint returns a response within the configured HTTP code range. -As long as the check keeps failing, Marathon will not proceed with the deployment (within the configured upgrade strategy bounds). - -Beginning with version 1.4, Traefik respects readiness check results if the Traefik option is set and checks are configured on the applications accordingly. - -!!! note - Due to the way readiness check results are currently exposed by the Marathon API, ready tasks may be taken into rotation with a small delay. - It is on the order of one readiness check timeout interval (as configured on the application specification) and guarantees that non-ready tasks do not receive traffic prematurely. - -If readiness checks are not possible, a current mitigation strategy is to enable [retries](/configuration/commons#retry-configuration) and make sure that a sufficient number of healthy application tasks exist so that one retry will likely hit one of those. -Apart from its probabilistic nature, the workaround comes at the price of increased latency. - -#### Shutdown - -It is possible to install a [termination handler](https://mesosphere.github.io/marathon/docs/health-checks.html) (available since Marathon version 1.3) with each application whose responsibility it is to delay the shutdown process long enough until the backend has been taken out of load-balancing rotation with reasonable confidence (i.e., Traefik has received an update from the Marathon event bus, recomputes the available Marathon backends, and applies the new configuration). -Specifically, each termination handler should install a signal handler listening for a SIGTERM signal and implement the following steps on signal reception: - -1. Disable Keep-Alive HTTP connections. -1. Keep accepting HTTP requests for a certain period of time. -1. Stop accepting new connections. -1. Finish serving any in-flight requests. -1. Shut down. - -Traefik already ignores Marathon tasks whose state does not match `TASK_RUNNING`; since terminating tasks transition into the `TASK_KILLING` and eventually `TASK_KILLED` state, there is nothing further that needs to be done on Traefik's end. - -How long HTTP requests should continue to be accepted in step 2 depends on how long Traefik needs to receive and process the Marathon configuration update. -Under regular operational conditions, it should be on the order of seconds, with 10 seconds possibly being a good default value. - -Again, configuring Traefik to do retries (as discussed in the previous section) can serve as a decent workaround strategy. -Paired with termination handlers, they would cover for those cases where either the termination sequence or Traefik cannot complete their part of the orchestration process in time. - -#### Failure - -A failing application always happens unexpectedly, and hence, it is very difficult or even impossible to rule out the adversal effects categorically. - -Failure reasons vary broadly and could stretch from unacceptable slowness, a task crash, or a network split. - -There are two mitigaton efforts: - -1. Configure [Marathon health checks](https://mesosphere.github.io/marathon/docs/health-checks.html) on each application. -1. Configure Traefik health checks (possibly via the `traefik.backend.healthcheck.*` labels) and make sure they probe with proper frequency. - -The Marathon health check makes sure that applications once deemed dysfunctional are being rescheduled to different slaves. -However, they might take a while to get triggered and the follow-up processes to complete. - -For that reason, the Treafik health check provides an additional check that responds more rapidly and does not require a configuration reload to happen. -Additionally, it protects from cases that the Marathon health check may not be able to cover, such as a network split. - -### (Non-)Alternatives - -There are a few alternatives of varying quality that are frequently asked for. - -The remaining section is going to explore them along with a benefit/cost trade-off. - -#### Reusing Marathon health checks - -It may seem obvious to reuse the Marathon health checks as a signal to Traefik whether an application should be taken into load-balancing rotation or not. - -Apart from the increased latency a failing health check may have, a major problem with this is is that Marathon does not persist the health check results. -Consequently, if a master re-election occurs in the Marathon clusters, all health check results will revert to the _unknown_ state, effectively causing all applications inside the cluster to become unavailable and leading to a complete cluster failure. -Re-elections do not only happen during regular maintenance work (often requiring rolling upgrades of the Marathon nodes) but also when the Marathon leader fails spontaneously. -As such, there is no way to handle this situation deterministically. - -Finally, Marathon health checks are not mandatory (the default is to use the task state as reported by Mesos), so requiring them for Traefik would raise the entry barrier for Marathon users. - -Traefik used to use the health check results as a strict requirement but moved away from it as [users reported the dramatic consequences](https://github.com/containous/traefik/issues/653). - -#### Draining - -Another common approach is to let a proxy drain backends that are supposed to shut down. -That is, once a backend is supposed to shut down, Traefik would stop forwarding requests. - -On the plus side, this would not require any modifications to the application in question. -However, implementing this fully within Traefik seems like a non-trivial undertaking. - -Additionally, the approach is less flexible compared to a custom termination handler since only the latter allows for the implementation of custom termination sequences that go beyond simple request draining (e.g., persisting a snapshot state to disk prior to terminating). - -The feature is currently not implemented; a request for draining in general is at [issue 41](https://github.com/containous/traefik/issues/41). diff --git a/old/docs/user-guide/swarm-mode.md b/old/docs/user-guide/swarm-mode.md deleted file mode 100644 index df7ee745e..000000000 --- a/old/docs/user-guide/swarm-mode.md +++ /dev/null @@ -1,332 +0,0 @@ -# Docker Swarm (mode) cluster - -This section explains how to create a multi-host docker cluster with swarm mode using [docker-machine](https://docs.docker.com/machine) and how to deploy Traefik on it. - -The cluster consists of: - -- 3 servers -- 1 manager -- 2 workers -- 1 [overlay](https://docs.docker.com/network/overlay/) network (multi-host networking) - - -## Prerequisites - -1. You will need to install [docker-machine](https://docs.docker.com/machine/) -2. You will need the latest [VirtualBox](https://www.virtualbox.org/wiki/Downloads) - - -## Cluster provisioning - -First, let's create all the required nodes. -It's a shorter version of the [swarm tutorial](https://docs.docker.com/engine/swarm/swarm-tutorial/). - -```shell -docker-machine create -d virtualbox manager -docker-machine create -d virtualbox worker1 -docker-machine create -d virtualbox worker2 -``` - -Then, let's setup the cluster, in order: - -1. initialize the cluster -1. get the token for other host to join -1. on both workers, join the cluster with the token - -```shell -docker-machine ssh manager "docker swarm init \ - --listen-addr $(docker-machine ip manager) \ - --advertise-addr $(docker-machine ip manager)" - -export worker_token=$(docker-machine ssh manager "docker swarm \ -join-token worker -q") - -docker-machine ssh worker1 "docker swarm join \ - --token=${worker_token} \ - --listen-addr $(docker-machine ip worker1) \ - --advertise-addr $(docker-machine ip worker1) \ - $(docker-machine ip manager)" - -docker-machine ssh worker2 "docker swarm join \ - --token=${worker_token} \ - --listen-addr $(docker-machine ip worker2) \ - --advertise-addr $(docker-machine ip worker2) \ - $(docker-machine ip manager)" -``` - -Let's validate the cluster is up and running. - -```shell -docker-machine ssh manager docker node ls -``` -``` -ID HOSTNAME STATUS AVAILABILITY MANAGER STATUS -013v16l1sbuwjqcn7ucbu4jwt worker1 Ready Active -8buzkquycd17jqjber0mo2gn8 worker2 Ready Active -fnpj8ozfc85zvahx2r540xfcf * manager Ready Active Leader -``` - -Finally, let's create a network for Traefik to use. - -```shell -docker-machine ssh manager "docker network create --driver=overlay traefik-net" -``` - - -## Deploy Traefik - -Let's deploy Traefik as a docker service in our cluster. -The only requirement for Traefik to work with swarm mode is that it needs to run on a manager node - we are going to use a [constraint](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints---constraint) for that. - -```shell -docker-machine ssh manager "docker service create \ - --name traefik \ - --constraint=node.role==manager \ - --publish 80:80 --publish 8080:8080 \ - --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \ - --network traefik-net \ - traefik \ - --docker \ - --docker.swarmMode \ - --docker.domain=traefik \ - --docker.watch \ - --api" -``` - -Let's explain this command: - -| Option | Description | -|-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------| -| `--publish 80:80 --publish 8080:8080` | we publish port `80` and `8080` on the cluster. | -| `--constraint=node.role==manager` | we ask docker to schedule Traefik on a manager node. | -| `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock` | we bind mount the docker socket where Traefik is scheduled to be able to speak to the daemon. | -| `--network traefik-net` | we attach the Traefik service (and thus the underlying container) to the `traefik-net` network. | -| `--docker` | enable docker provider, and `--docker.swarmMode` to enable the swarm mode on Traefik. | -| `--api` | activate the webUI on port 8080 | - - -## Deploy your apps - -We can now deploy our app on the cluster, here [whoami](https://github.com/containous/whoami), a simple web server in Go. -We start 2 services, on the `traefik-net` network. - -```shell -docker-machine ssh manager "docker service create \ - --name whoami0 \ - --label traefik.port=80 \ - --network traefik-net \ - containous/whoami" - -docker-machine ssh manager "docker service create \ - --name whoami1 \ - --label traefik.port=80 \ - --network traefik-net \ - containous/whoami" -``` - -!!! note - We set `whoami1` to use sticky sessions (`--label traefik.backend.loadbalancer.stickiness=true`). - We'll demonstrate that later. - -!!! note - If using `docker stack deploy`, there is [a specific way that the labels must be defined in the docker-compose file](https://github.com/containous/traefik/issues/994#issuecomment-269095109). - -Check that everything is scheduled and started: - -```shell -docker-machine ssh manager "docker service ls" -``` -``` -ID NAME MODE REPLICAS IMAGE PORTS -moq3dq4xqv6t traefik replicated 1/1 traefik:latest *:80->80/tcp,*:8080->8080/tcp -ysil6oto1wim whoami0 replicated 1/1 containous/whoami:latest -z9re2mnl34k4 whoami1 replicated 1/1 containous/whoami:latest -``` - - -## Access to your apps through Traefik - -```shell -curl -H Host:whoami0.traefik http://$(docker-machine ip manager) -``` -```yaml -Hostname: 5b0b3d148359 -IP: 127.0.0.1 -IP: 10.0.0.8 -IP: 10.0.0.4 -IP: 172.18.0.5 -GET / HTTP/1.1 -Host: whoami0.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.2 -X-Forwarded-Host: whoami0.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` -```shell -curl -H Host:whoami1.traefik http://$(docker-machine ip manager) -``` -```yaml -Hostname: 3633163970f6 -IP: 127.0.0.1 -IP: 10.0.0.14 -IP: 10.0.0.6 -IP: 172.18.0.5 -GET / HTTP/1.1 -Host: whoami1.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.2 -X-Forwarded-Host: whoami1.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` - -!!! note - As Traefik is published, you can access it from any machine and not only the manager. - -```shell -curl -H Host:whoami0.traefik http://$(docker-machine ip worker1) -``` -```yaml -Hostname: 5b0b3d148359 -IP: 127.0.0.1 -IP: 10.0.0.8 -IP: 10.0.0.4 -IP: 172.18.0.5 -GET / HTTP/1.1 -Host: whoami0.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.3 -X-Forwarded-Host: whoami0.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` -```shell -curl -H Host:whoami1.traefik http://$(docker-machine ip worker2) -``` -```yaml -Hostname: 3633163970f6 -IP: 127.0.0.1 -IP: 10.0.0.14 -IP: 10.0.0.6 -IP: 172.18.0.5 -GET / HTTP/1.1 -Host: whoami1.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.4 -X-Forwarded-Host: whoami1.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` - -## Scale both services - -```shell -docker-machine ssh manager "docker service scale whoami0=5" -docker-machine ssh manager "docker service scale whoami1=5" -``` - -Check that we now have 5 replicas of each `whoami` service: - -```shell -docker-machine ssh manager "docker service ls" -``` -``` -ID NAME MODE REPLICAS IMAGE PORTS -moq3dq4xqv6t traefik replicated 1/1 traefik:latest *:80->80/tcp,*:8080->8080/tcp -ysil6oto1wim whoami0 replicated 5/5 containous/whoami:latest -z9re2mnl34k4 whoami1 replicated 5/5 containous/whoami:latest -``` - -## Access to your `whoami0` through Traefik multiple times. - -Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks: - -```shell -curl -H Host:whoami0.traefik http://$(docker-machine ip manager) -``` -```yaml -Hostname: f3138d15b567 -IP: 127.0.0.1 -IP: 10.0.0.5 -IP: 10.0.0.4 -IP: 172.18.0.3 -GET / HTTP/1.1 -Host: whoami0.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.2 -X-Forwarded-Host: whoami0.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` - -Do the same against `whoami1`: - -```shell -curl -c cookies.txt -H Host:whoami1.traefik http://$(docker-machine ip manager) -``` -```yaml -Hostname: 348e2f7bf432 -IP: 127.0.0.1 -IP: 10.0.0.15 -IP: 10.0.0.6 -IP: 172.18.0.6 -GET / HTTP/1.1 -Host: whoami1.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 10.255.0.2 -X-Forwarded-Host: whoami1.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` - -Because the sticky sessions require cookies to work, we used the `-c cookies.txt` option to store the cookie into a file. -The cookie contains the IP of the container to which the session sticks: - -```shell -cat ./cookies.txt -``` -``` -# Netscape HTTP Cookie File -# https://curl.haxx.se/docs/http-cookies.html -# This file was generated by libcurl! Edit at your own risk. - -whoami1.traefik FALSE / FALSE 0 _TRAEFIK_BACKEND http://10.0.0.15:80 -``` - -If you load the cookies file (`-b cookies.txt`) for the next request, you will see that stickiness is maintained: - -```shell -curl -b cookies.txt -H Host:whoami1.traefik http://$(docker-machine ip manager) -``` -```yaml -Hostname: 348e2f7bf432 -IP: 127.0.0.1 -IP: 10.0.0.15 -IP: 10.0.0.6 -IP: 172.18.0.6 -GET / HTTP/1.1 -Host: whoami1.traefik -User-Agent: curl/7.55.1 -Accept: */* -Accept-Encoding: gzip -Cookie: _TRAEFIK_BACKEND=http://10.0.0.15:80 -X-Forwarded-For: 10.255.0.2 -X-Forwarded-Host: whoami1.traefik -X-Forwarded-Proto: http -X-Forwarded-Server: 77fc29c69fe4 -``` - -![GIF Magica](https://i.giphy.com/ujUdrdpX7Ok5W.gif) diff --git a/old/docs/user-guide/swarm.md b/old/docs/user-guide/swarm.md deleted file mode 100644 index 014ab1cd3..000000000 --- a/old/docs/user-guide/swarm.md +++ /dev/null @@ -1,181 +0,0 @@ -# Swarm cluster - -This section explains how to create a multi-host [swarm](https://docs.docker.com/swarm) cluster using [docker-machine](https://docs.docker.com/machine/) and how to deploy Traefik on it. - -The cluster consists of: - -- 2 servers -- 1 swarm master -- 2 swarm nodes -- 1 [overlay](https://docs.docker.com/network/overlay/) network (multi-host networking) - -## Prerequisites - -1. You need to install [docker-machine](https://docs.docker.com/machine/) -2. You need the latest [VirtualBox](https://www.virtualbox.org/wiki/Downloads) - -## Cluster provisioning - -We first follow [this guide](https://docs.docker.com/engine/userguide/networking/get-started-overlay/) to create the cluster. - -### Create machine `mh-keystore` - -This machine is the service registry of our cluster. - -```shell -docker-machine create -d virtualbox mh-keystore -``` - -Then we install the service registry [Consul](https://consul.io) on this machine: - -```shell -eval "$(docker-machine env mh-keystore)" -docker run -d \ - -p "8500:8500" \ - -h "consul" \ - progrium/consul -server -bootstrap -``` - -### Create machine `mhs-demo0` - -This machine is a swarm master and a swarm agent on it. - -```shell -docker-machine create -d virtualbox \ - --swarm --swarm-master \ - --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \ - --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \ - --engine-opt="cluster-advertise=eth1:2376" \ - mhs-demo0 -``` - -### Create machine `mhs-demo1` - -This machine have a swarm agent on it. - -```shell -docker-machine create -d virtualbox \ - --swarm \ - --swarm-discovery="consul://$(docker-machine ip mh-keystore):8500" \ - --engine-opt="cluster-store=consul://$(docker-machine ip mh-keystore):8500" \ - --engine-opt="cluster-advertise=eth1:2376" \ - mhs-demo1 -``` - -### Create the overlay Network - -Create the overlay network on the swarm master: - -```shell -eval $(docker-machine env --swarm mhs-demo0) -docker network create --driver overlay --subnet=10.0.9.0/24 my-net -``` - -## Deploy Traefik - -Deploy Traefik: - -```shell -docker $(docker-machine config mhs-demo0) run \ - -d \ - -p 80:80 -p 8080:8080 \ - --net=my-net \ - -v /var/lib/boot2docker/:/ssl \ - traefik \ - -l DEBUG \ - -c /dev/null \ - --docker \ - --docker.domain=traefik \ - --docker.endpoint=tcp://$(docker-machine ip mhs-demo0):2376 \ - --docker.tls \ - --docker.tls.ca=/ssl/ca.pem \ - --docker.tls.cert=/ssl/server.pem \ - --docker.tls.key=/ssl/server-key.pem \ - --docker.tls.insecureSkipVerify \ - --docker.watch \ - --api -``` - -Let's explain this command: - -| Option | Description | -|-------------------------------------------|---------------------------------------------------------------| -| `-p 80:80 -p 8080:8080` | we bind ports 80 and 8080 | -| `--net=my-net` | run the container on the network my-net | -| `-v /var/lib/boot2docker/:/ssl` | mount the ssl keys generated by docker-machine | -| `-c /dev/null` | empty config file | -| `--docker` | enable docker provider | -| `--docker.endpoint=tcp://172.18.0.1:2376` | connect to the swarm master using the docker_gwbridge network | -| `--docker.tls` | enable TLS using the docker-machine keys | -| `--api` | activate the webUI on port 8080 | - - -## Deploy your apps - -We can now deploy our app on the cluster, here [whoami](https://github.com/containous/whoami), a simple web server in GO, on the network `my-net`: - -```shell -eval $(docker-machine env --swarm mhs-demo0) -docker run -d --name=whoami0 --net=my-net --env="constraint:node==mhs-demo0" containous/whoami -docker run -d --name=whoami1 --net=my-net --env="constraint:node==mhs-demo1" containous/whoami -``` - -Check that everything is started: - -```shell -docker ps -``` -``` -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -ba2c21488299 containous/whoami "/whoamI" 8 seconds ago Up 9 seconds 80/tcp mhs-demo1/whoami1 -8147a7746e7a containous/whoami "/whoamI" 19 seconds ago Up 20 seconds 80/tcp mhs-demo0/whoami0 -8fbc39271b4c traefik "/traefik -l DEBUG -c" 36 seconds ago Up 37 seconds 192.168.99.101:80->80/tcp, 192.168.99.101:8080->8080/tcp mhs-demo0/serene_bhabha -``` - -## Access to your apps through Traefik - -```shell -curl -H Host:whoami0.traefik http://$(docker-machine ip mhs-demo0) -``` -```yaml -Hostname: 8147a7746e7a -IP: 127.0.0.1 -IP: ::1 -IP: 10.0.9.3 -IP: fe80::42:aff:fe00:903 -IP: 172.18.0.3 -IP: fe80::42:acff:fe12:3 -GET / HTTP/1.1 -Host: 10.0.9.3:80 -User-Agent: curl/7.35.0 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 192.168.99.1 -X-Forwarded-Host: 10.0.9.3:80 -X-Forwarded-Proto: http -X-Forwarded-Server: 8fbc39271b4c -``` - -```shell -curl -H Host:whoami1.traefik http://$(docker-machine ip mhs-demo0) -``` -```yaml -Hostname: ba2c21488299 -IP: 127.0.0.1 -IP: ::1 -IP: 10.0.9.4 -IP: fe80::42:aff:fe00:904 -IP: 172.18.0.2 -IP: fe80::42:acff:fe12:2 -GET / HTTP/1.1 -Host: 10.0.9.4:80 -User-Agent: curl/7.35.0 -Accept: */* -Accept-Encoding: gzip -X-Forwarded-For: 192.168.99.1 -X-Forwarded-Host: 10.0.9.4:80 -X-Forwarded-Proto: http -X-Forwarded-Server: 8fbc39271b4c -``` - -![GIF Magica](https://i.giphy.com/ujUdrdpX7Ok5W.gif)