Makes ALPN protocols configurable

docs/content/https/tls.md

@@ -399,6 +399,47 @@ spec:
   preferServerCipherSuites: true
 ```
 
+### ALPN Protocols
+
+_Optional, Default="h2, http/1.1, acme-tls/1"_
+
+This option allows to specify the list of supported application level protocols for the TLS handshake,
+in order of preference.
+If the client supports ALPN, the selected protocol will be one from this list, 
+and the connection will fail if there is no mutually supported protocol.
+
+```yaml tab="File (YAML)"
+# Dynamic configuration
+
+tls:
+  options:
+    default:
+      alpnProtocols:
+        - http/1.1
+        - h2
+```
+
+```toml tab="File (TOML)"
+# Dynamic configuration
+
+[tls.options]
+  [tls.options.default]
+    alpnProtocols = ["http/1.1", "h2"]
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSOption
+metadata:
+  name: default
+  namespace: default
+
+spec:
+  alpnProtocols:
+    - http/1.1
+    - h2
+```
+
 ### Client Authentication (mTLS)
 
 Traefik supports mutual authentication, through the `clientAuth` section.

docs/content/reference/dynamic-configuration/file.toml

@@ -421,6 +421,7 @@
       curvePreferences = ["foobar", "foobar"]
       sniStrict = true
       preferServerCipherSuites = true
+      alpnProtocols = ["foobar", "foobar"]
       [tls.options.Options0.clientAuth]
         caFiles = ["foobar", "foobar"]
         clientAuthType = "foobar"
@@ -431,6 +432,7 @@
       curvePreferences = ["foobar", "foobar"]
       sniStrict = true
       preferServerCipherSuites = true
+      alpnProtocols = ["foobar", "foobar"]
       [tls.options.Options1.clientAuth]
         caFiles = ["foobar", "foobar"]
         clientAuthType = "foobar"

docs/content/reference/dynamic-configuration/file.yaml

@@ -470,6 +470,9 @@ tls:
         clientAuthType: foobar
       sniStrict: true
       preferServerCipherSuites: true
+      alpnProtocols:
+        - foobar
+        - foobar
     Options1:
       minVersion: foobar
       maxVersion: foobar
@@ -486,6 +489,9 @@ tls:
         clientAuthType: foobar
       sniStrict: true
       preferServerCipherSuites: true
+      alpnProtocols:
+        - foobar
+        - foobar
   stores:
     Store0:
       defaultCertificate:

docs/content/reference/dynamic-configuration/kubernetes-crd-resource.yml

@@ -194,6 +194,9 @@ spec:
     clientAuthType: RequireAndVerifyClientCert
   sniStrict: true
   preferServerCipherSuites: true
+  alpnProtocols:
+    - foobar
+    - foobar
 
 ---
 apiVersion: traefik.containo.us/v1alpha1

docs/content/reference/dynamic-configuration/kv-ref.md

@@ -274,6 +274,8 @@
 | `traefik/tls/certificates/1/keyFile` | `foobar` |
 | `traefik/tls/certificates/1/stores/0` | `foobar` |
 | `traefik/tls/certificates/1/stores/1` | `foobar` |
+| `traefik/tls/options/Options0/alpnProtocols/0` | `foobar` |
+| `traefik/tls/options/Options0/alpnProtocols/1` | `foobar` |
 | `traefik/tls/options/Options0/cipherSuites/0` | `foobar` |
 | `traefik/tls/options/Options0/cipherSuites/1` | `foobar` |
 | `traefik/tls/options/Options0/clientAuth/caFiles/0` | `foobar` |
@@ -285,6 +287,8 @@
 | `traefik/tls/options/Options0/minVersion` | `foobar` |
 | `traefik/tls/options/Options0/preferServerCipherSuites` | `true` |
 | `traefik/tls/options/Options0/sniStrict` | `true` |
+| `traefik/tls/options/Options1/alpnProtocols/0` | `foobar` |
+| `traefik/tls/options/Options1/alpnProtocols/1` | `foobar` |
 | `traefik/tls/options/Options1/cipherSuites/0` | `foobar` |
 | `traefik/tls/options/Options1/cipherSuites/1` | `foobar` |
 | `traefik/tls/options/Options1/clientAuth/caFiles/0` | `foobar` |

docs/content/reference/dynamic-configuration/traefik.containo.us_tlsoptions.yaml

@@ -36,6 +36,10 @@ spec:
           spec:
             description: TLSOptionSpec configures TLS for an entry point.
             properties:
+              alpnProtocols:
+                items:
+                  type: string
+                type: array
               cipherSuites:
                 items:
                   type: string

docs/content/routing/providers/kubernetes-crd.md

@@ -1506,6 +1506,8 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
           - secret-ca2
         clientAuthType: VerifyClientCertIfGiven     # [7]
       sniStrict: true                               # [8]
+      alpnProtocols:                                # [9]
+        - foobar
     ```
 
 | Ref | Attribute                   | Purpose                                                                                                                                                                                                                    |
@@ -1518,6 +1520,7 @@ or referencing TLS options in the [`IngressRoute`](#kind-ingressroute) / [`Ingre
 | [6] | `clientAuth.secretNames`    | list of names of the referenced Kubernetes [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/) (in TLSOption namespace). The secret must contain a certificate under either a `tls.ca` or a `ca.crt` key. |
 | [7] | `clientAuth.clientAuthType` | defines the client authentication type to apply. The available values are: `NoClientCert`, `RequestClientCert`, `VerifyClientCertIfGiven` and `RequireAndVerifyClientCert`                                                 |
 | [8] | `sniStrict`                 | if `true`, Traefik won't allow connections from clients connections that do not specify a server_name extension                                                                                                            |
+| [9] | `alpnProtocols`             | List of supported [application level protocols](../../https/tls.md#alpn-protocols) for the TLS handshake, in order of preference.                                                                                          |
 
 !!! info "CA Secret"