4 KiB
EntryPoints
Opening Connections for Incomming Requests {: .subtitle }
Entrypoints are the network entry points into Traefik. They define the port which will receive the requests (whether HTTP or TCP).
Configuration Examples
??? example "Port 80 only"
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
```
We define an `entrypoint` called `web` that will listen on port `80`.
??? example "Port 80 & 443"
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
[entrypoints.web-secure]
address = ":443"
[entrypoints.web-secure.tls]
[[entrypoints.web-secure.tls.certificates]]
certFile = "tests/traefik.crt"
keyFile = "tests/traefik.key"
```
- Two entrypoints are defined: one called `web`, and the other called `web-secure`.
- `web` listens on port `80`, and `web-secure` on port `443`.
Configuration
General
Entrypoints are part of the static configuration. You can define them using a toml file, CLI arguments, or a key-value store. See the complete reference for the list of available options.
??? example "Using the CLI"
Here is an example of using the CLI to define `entrypoints`:
```shell
--entryPoints='Name:http Address::80'
--entryPoints='Name:https Address::443 TLS'
```
!!! note
The whitespace character (` `) is the option separator, and the comma (`,`) is the value separator for lists.
The option names are case-insensitive.
!!! warning "Using Docker Compose Files"
The syntax for passing arguments inside a docker compose file is a little different. Here are two examples.
```yaml
traefik:
image: traefik
command:
- --defaultentrypoints=powpow
- "--entryPoints=Name:powpow Address::42 Compress:true"
```
or
```yaml
traefik:
image: traefik
command: --defaultentrypoints=powpow --entryPoints='Name:powpow Address::42 Compress:true'
```
ProxyProtocol
Traefik supports ProxyProtocol.
??? example "Enabling Proxy Protocol with Trusted IPs"
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
[entrypoints.web.proxyProtocol]
trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
```
IPs in `trustedIPs` only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.
??? example "Insecure Mode -- Testing Environnement Only"
In a test environments, you can configure Traefik to trust every incomming connection. Doing so, every remote client address will be replaced (`trustedIPs` won't have any effect)
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
[entrypoints.web.proxyProtocol]
insecure = true
```
!!! warning "Queuing Traefik behind Another Load Balancer"
When queuing Traefik behind another load-balancer, make sure to configure Proxy Protocol on both sides.
Not doing so could introduce a security risk in your system (enabling request forgery).
Forwarded Header
You can configure Traefik to trust the forwarded headers information (X-Forwarded-*
)
??? example "Trusting Forwarded Headers from specific IPs"
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
[entrypoints.web.forwardedHeaders]
trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
```
??? example "Insecure Mode -- Always Trusting Forwarded Headers"
```toml
[entrypoints]
[entrypoints.web]
address = ":80"
[entrypoints.web.forwardedHeaders]
insecure = true
```