# Azure Service Fabric Provider

Traefik can be configured to use Azure Service Fabric as a provider.

See [this repository for an example deployment package and further documentation.](https://aka.ms/traefikonsf)

## Azure Service Fabric

```toml
################################################################
# Azure Service Fabric Provider
################################################################

# Enable Azure Service Fabric Provider
[serviceFabric]

# Azure Service Fabric Management Endpoint
#
# Required
#
clusterManagementUrl = "https://localhost:19080"

# Azure Service Fabric Management Endpoint API Version
#
# Required
# Default: "3.0"
#
apiVersion = "3.0"

# Azure Service Fabric Polling Interval (in seconds)
#
# Required
# Default: 10
#
refreshSeconds = 10

# Enable TLS connection.
#
# Optional
#
# [serviceFabric.tls]
#   ca = "/etc/ssl/ca.crt"
#   cert = "/etc/ssl/servicefabric.crt"
#   key = "/etc/ssl/servicefabric.key"
#   insecureSkipVerify = true
```

## Labels

The provider uses labels to configure how services are exposed through Traefik.
These can be set using Extensions and the Property Manager API

#### Extensions

Set labels with extensions through the services `ServiceManifest.xml` file.
Here is an example of an extension setting Traefik labels:

```xml
<StatelessServiceType ServiceTypeName="WebServiceType">
  <Extensions>
      <Extension Name="Traefik">
        <Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
          <Label Key="traefik.frontend.rule.example2">PathPrefixStrip: /a/path/to/strip</Label>
          <Label Key="traefik.enable">true</Label>
          <Label Key="traefik.frontend.passHostHeader">true</Label>
        </Labels>
      </Extension>
  </Extensions>
</StatelessServiceType>
```

#### Property Manager

Set Labels with the property manager API to overwrite and add labels, while your service is running.
Here is an example of adding a frontend rule using the property manager API.

```shell
curl -X PUT \
  'http://localhost:19080/Names/GettingStartedApplication2/WebService/$/GetProperty?api-version=6.0&IncludeValues=true' \
  -d '{
  "PropertyName": "traefik.frontend.rule.default",
  "Value": {
    "Kind": "String",
    "Data": "PathPrefixStrip: /a/path/to/strip"
  },
  "CustomTypeId": "LabelType"
}'
```

!!! note
    This functionality will be released in a future version of the [sfctl](https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-application-lifecycle-sfctl) tool.

## Available Labels

Labels, set through extensions or the property manager, can be used on services to override default behavior.

| Label                                                           | Description                                                                                                                                                                                                               |
|-----------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.enable=false`                                          | Disable this container in Traefik                                                                                                                                                                                         |
| `traefik.backend.circuitbreaker.expression=EXPR`                | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                              |
| `traefik.servicefabric.groupname`                               | Group all services with the same name into a single backend in Traefik                                                                                                                                                     |
| `traefik.servicefabric.groupweight`                             | Set the weighting of the current services nodes in the backend group                                                                                                                                                      |
| `traefik.servicefabric.enablelabeloverrides`                    | Toggle whether labels can be overridden using the Service Fabric Property Manager API                                                                                                                                     |
| `traefik.backend.healthcheck.path=/health`                      | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                     |
| `traefik.backend.healthcheck.port=8080`                         | Allow to use a different port for the health check.                                                                                                                                                                       |
| `traefik.backend.healthcheck.interval=5s`                       | Define the health check interval.                                                                                                                                                                                         |
| `traefik.backend.healthcheck.timeout=3s`                        | Define the health check request timeout.                                                                                                                                                                                  |
| `traefik.backend.healthcheck.hostname=foobar.com`               | Define the health check hostname.                                                                                                                                                                                         |
| `traefik.backend.healthcheck.headers=EXPR`                      | Define the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                  |
| `traefik.backend.loadbalancer.method=drr`                       | Override the default `wrr` load balancer algorithm                                                                                                                                                                        |
| `traefik.backend.loadbalancer.stickiness=true`                  | Enable backend sticky sessions                                                                                                                                                                                            |
| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`       | Manually set the cookie name for sticky sessions                                                                                                                                                                          |
| `traefik.backend.maxconn.amount=10`                             | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
| `traefik.backend.maxconn.extractorfunc=client.ip`               | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                     |
| `traefik.backend.weight=10`                                     | Assign this weight to the container                                                                                                                                                                                       |
| `traefik.frontend.auth.basic=EXPR`                              | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                          |
| `traefik.frontend.entryPoints=http,https`                       | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                |
| `traefik.frontend.passHostHeader=true`                          | Forward client `Host` header to the backend.                                                                                                                                                                              |
| `traefik.frontend.passTLSCert=true`                             | Forward TLS Client certificates to the backend.                                                                                                                                                                           |
| `traefik.frontend.priority=10`                                  | Override default frontend priority                                                                                                                                                                                        |
| `traefik.frontend.redirect.entryPoint=https`                    | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                     |
| `traefik.frontend.redirect.regex=^http://localhost/(.*)`        | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                   |
| `traefik.frontend.redirect.replacement=http://mydomain/$1`      | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                         |
| `traefik.frontend.redirect.permanent=true`                      | Return 301 instead of 302.                                                                                                                                                                                                |
| `traefik.frontend.rule=EXPR`                                    | Override the default frontend rule. Defaults to SF address.                                                                                                                                                               |
| `traefik.frontend.whiteList.sourceRange=RANGE`                  | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
| `traefik.frontend.whiteList.ipStrategy=true`                    | Uses the default IPStrategy.<br>Can be used when there is an existing `clientIPStrategy` but you want the remote address for whitelisting.                                                                                |
| `traefik.frontend.whiteList.ipStrategy.depth=5`                 | See [whitelist](/configuration/entrypoints/#white-listing)                                                                                                                                                                |
| `traefik.frontend.whiteList.ipStrategy.excludedIPs=127.0.0.1`   | See [whitelist](/configuration/entrypoints/#white-listing)                                                                                                                                                                |

### Custom Headers

| Label                                                 | Description                                                                                                                                                                         |
|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |

### Security Headers

| Label                                                    | Description                                                                                                                                                                                         |
|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
| `traefik.frontend.headers.publicKey=VALUE`               | Adds HPKP header.                                                                                                                                                                                   |
| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
