Replace internal dead links
This commit is contained in:
Romain
GitHub
parent
0ea8cbdfbf
commit
835899f4bc
41 changed files with 310 additions and 2043 deletions
|
|
@ -94,19 +94,20 @@ labels:
|
|||
|
||||
## Configuration Options
|
||||
|
||||
| Field | Description | Default | Required |
|
||||
|:------|:----------------------------------------------------------|:---------------------|:---------|
|
||||
| <a id="opt-serverName" href="#opt-serverName" title="#opt-serverName">`serverName`</a> | Configures the server name that will be used as the SNI. | "" | No |
|
||||
| <a id="opt-certificates" href="#opt-certificates" title="#opt-certificates">`certificates`</a> | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | [] | No |
|
||||
| <a id="opt-insecureSkipVerify" href="#opt-insecureSkipVerify" title="#opt-insecureSkipVerify">`insecureSkipVerify`</a> | Controls whether the server's certificate chain and host name is verified. | false | No |
|
||||
| <a id="opt-rootcas" href="#opt-rootcas" title="#opt-rootcas">`rootcas`</a> | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | [] | No |
|
||||
| <a id="opt-maxIdleConnsPerHost" href="#opt-maxIdleConnsPerHost" title="#opt-maxIdleConnsPerHost">`maxIdleConnsPerHost`</a> | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
|
||||
| <a id="opt-disableHTTP2" href="#opt-disableHTTP2" title="#opt-disableHTTP2">`disableHTTP2`</a> | Disables HTTP/2 for connections with servers. | false | No |
|
||||
| <a id="opt-peerCertURI" href="#opt-peerCertURI" title="#opt-peerCertURI">`peerCertURI`</a> | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
|
||||
| <a id="opt-forwardingTimeouts-dialTimeout" href="#opt-forwardingTimeouts-dialTimeout" title="#opt-forwardingTimeouts-dialTimeout">`forwardingTimeouts.dialTimeout`</a> | Amount of time to wait until a connection to a server can be established.<br />0 = no timeout | 30s | No |
|
||||
| <a id="opt-forwardingTimeouts-responseHeaderTimeout" href="#opt-forwardingTimeouts-responseHeaderTimeout" title="#opt-forwardingTimeouts-responseHeaderTimeout">`forwardingTimeouts.responseHeaderTimeout`</a> | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).<br />0 = no timeout | 0s | No |
|
||||
| <a id="opt-forwardingTimeouts-idleConnTimeout" href="#opt-forwardingTimeouts-idleConnTimeout" title="#opt-forwardingTimeouts-idleConnTimeout">`forwardingTimeouts.idleConnTimeout`</a> | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.<br />0 = no timeout | 90s | No |
|
||||
| <a id="opt-forwardingTimeouts-readIdleTimeout" href="#opt-forwardingTimeouts-readIdleTimeout" title="#opt-forwardingTimeouts-readIdleTimeout">`forwardingTimeouts.readIdleTimeout`</a> | Defines the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection. | 0s | No |
|
||||
| <a id="opt-forwardingTimeouts-pingTimeout" href="#opt-forwardingTimeouts-pingTimeout" title="#opt-forwardingTimeouts-pingTimeout">`forwardingTimeouts.pingTimeout`</a> | Defines the timeout after which the HTTP/2 connection will be closed if a response to ping is not received. | 15s | No |
|
||||
| <a id="opt-spiffe-ids" href="#opt-spiffe-ids" title="#opt-spiffe-ids">`spiffe.ids`</a> | Defines the allowed SPIFFE IDs.<br />This takes precedence over the SPIFFE TrustDomain. | [] | No |
|
||||
| <a id="opt-spiffe-trustDomain" href="#opt-spiffe-trustDomain" title="#opt-spiffe-trustDomain">`spiffe.trustDomain`</a> | Defines the SPIFFE trust domain. | "" | No |
|
||||
| Field | Description | Default | Required |
|
||||
|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------|:--------|:---------|
|
||||
| <a id="opt-serverName" href="#opt-serverName" title="#opt-serverName">`serverName`</a> | Configures the server name that will be used as the SNI. | "" | No |
|
||||
| <a id="opt-certificates" href="#opt-certificates" title="#opt-certificates">`certificates`</a> | Defines the list of certificates (as file paths, or data bytes) that will be set as client certificates for mTLS. | [] | No |
|
||||
| <a id="opt-insecureSkipVerify" href="#opt-insecureSkipVerify" title="#opt-insecureSkipVerify">`insecureSkipVerify`</a> | Controls whether the server's certificate chain and host name is verified. | false | No |
|
||||
| <a id="opt-rootcas" href="#opt-rootcas" title="#opt-rootcas">`rootcas`</a> | Set of root certificate authorities to use when verifying server certificates. (for mTLS connections). | [] | No |
|
||||
| <a id="opt-maxIdleConnsPerHost" href="#opt-maxIdleConnsPerHost" title="#opt-maxIdleConnsPerHost">`maxIdleConnsPerHost`</a> | Maximum idle (keep-alive) connections to keep per-host. | 200 | No |
|
||||
| <a id="opt-disableHTTP2" href="#opt-disableHTTP2" title="#opt-disableHTTP2">`disableHTTP2`</a> | Disables HTTP/2 for connections with servers. | false | No |
|
||||
| <a id="opt-peerCertURI" href="#opt-peerCertURI" title="#opt-peerCertURI">`peerCertURI`</a> | Defines the URI used to match against SAN URIs during the server's certificate verification. | "" | No |
|
||||
| <a id="opt-forwardingTimeouts-dialTimeout" href="#opt-forwardingTimeouts-dialTimeout" title="#opt-forwardingTimeouts-dialTimeout">`forwardingTimeouts.dialTimeout`</a> | Amount of time to wait until a connection to a server can be established.<br />0 = no timeout | 30s | No |
|
||||
| <a id="opt-forwardingTimeouts-responseHeaderTimeout" href="#opt-forwardingTimeouts-responseHeaderTimeout" title="#opt-forwardingTimeouts-responseHeaderTimeout">`forwardingTimeouts.responseHeaderTimeout`</a> | Amount of time to wait for a server's response headers after fully writing the request (including its body, if any).<br />0 = no timeout | 0s | No |
|
||||
| <a id="opt-forwardingTimeouts-idleConnTimeout" href="#opt-forwardingTimeouts-idleConnTimeout" title="#opt-forwardingTimeouts-idleConnTimeout">`forwardingTimeouts.idleConnTimeout`</a> | Maximum amount of time an idle (keep-alive) connection will remain idle before closing itself.<br />0 = no timeout | 90s | No |
|
||||
| <a id="opt-forwardingTimeouts-readIdleTimeout" href="#opt-forwardingTimeouts-readIdleTimeout" title="#opt-forwardingTimeouts-readIdleTimeout">`forwardingTimeouts.readIdleTimeout`</a> | Defines the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection. | 0s | No |
|
||||
| <a id="opt-forwardingTimeouts-pingTimeout" href="#opt-forwardingTimeouts-pingTimeout" title="#opt-forwardingTimeouts-pingTimeout">`forwardingTimeouts.pingTimeout`</a> | Defines the timeout after which the HTTP/2 connection will be closed if a response to ping is not received. | 15s | No |
|
||||
| <a id="opt-spiffe" href="#opt-spiffe" title="#opt-spiffe">`spiffe`</a> | Defines the SPIFFE configuration. An empty `spiffe` section enables SPIFFE (that allows any SPIFFE ID). | | No |
|
||||
| <a id="opt-spiffe-ids" href="#opt-spiffe-ids" title="#opt-spiffe-ids">`spiffe.ids`</a> | Defines the allowed SPIFFE IDs.<br />This takes precedence over the SPIFFE TrustDomain. | [] | No |
|
||||
| <a id="opt-spiffe-trustDomain" href="#opt-spiffe-trustDomain" title="#opt-spiffe-trustDomain">`spiffe.trustDomain`</a> | Defines the SPIFFE trust domain. | "" | No |
|
||||
|
|
|
|||
|
|
@ -23,6 +23,11 @@ http:
|
|||
- "ratelimit"
|
||||
tls:
|
||||
certResolver: "letsencrypt"
|
||||
options: "modern"
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "www.example.com"
|
||||
observability:
|
||||
metrics: true
|
||||
accessLogs: true
|
||||
|
|
@ -41,6 +46,11 @@ http:
|
|||
|
||||
[http.routers.my-router.tls]
|
||||
certResolver = "letsencrypt"
|
||||
options = "modern"
|
||||
|
||||
[[http.routers.my-router.tls.domains]]
|
||||
main = "example.com"
|
||||
sans = ["www.example.com"]
|
||||
|
||||
[http.routers.my-router.observability]
|
||||
metrics = true
|
||||
|
|
@ -56,6 +66,9 @@ labels:
|
|||
- "traefik.http.routers.my-router.middlewares=auth,ratelimit"
|
||||
- "traefik.http.routers.my-router.service=my-service"
|
||||
- "traefik.http.routers.my-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.my-router.tls.options=modern"
|
||||
- "traefik.http.routers.my-router.tls.domains[0].main=example.com"
|
||||
- "traefik.http.routers.my-router.tls.domains[0].sans=www.example.com"
|
||||
- "traefik.http.routers.my-router.observability.metrics=true"
|
||||
- "traefik.http.routers.my-router.observability.accessLogs=true"
|
||||
- "traefik.http.routers.my-router.observability.tracing=true"
|
||||
|
|
@ -70,6 +83,9 @@ labels:
|
|||
"traefik.http.routers.my-router.middlewares=auth,ratelimit",
|
||||
"traefik.http.routers.my-router.service=my-service",
|
||||
"traefik.http.routers.my-router.tls.certresolver=letsencrypt",
|
||||
"traefik.http.routers.my-router.tls.options=modern",
|
||||
"traefik.http.routers.my-router.tls.domains[0].main=example.com",
|
||||
"traefik.http.routers.my-router.tls.domains[0].sans=www.example.com",
|
||||
"traefik.http.routers.my-router.observability.metrics=true",
|
||||
"traefik.http.routers.my-router.observability.accessLogs=true",
|
||||
"traefik.http.routers.my-router.observability.tracing=true"
|
||||
|
|
@ -79,18 +95,22 @@ labels:
|
|||
|
||||
## Configuration Options
|
||||
|
||||
| Field | Description | Default | Required |
|
||||
|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|----------|
|
||||
| <a id="opt-entryPoints" href="#opt-entryPoints" title="#opt-entryPoints">`entryPoints`</a> | The list of entry points to which the router is attached. If not specified, HTTP routers are attached to all entry points. | All entry points | No |
|
||||
| <a id="opt-rule" href="#opt-rule" title="#opt-rule">`rule`</a> | Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria. If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service. See [Rules & Priority](./rules-and-priority.md) for details. | | Yes |
|
||||
| <a id="opt-priority" href="#opt-priority" title="#opt-priority">`priority`</a> | To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority. A value of `0` for the priority is ignored. See [Rules & Priority](./rules-and-priority.md) for details. | Rule length | No |
|
||||
| <a id="opt-middlewares" href="#opt-middlewares" title="#opt-middlewares">`middlewares`</a> | The list of middlewares that are applied to the router. Middlewares are applied in the order they are declared. See [Middlewares overview](../middlewares/overview.md) for available middlewares. | | No |
|
||||
| <a id="opt-tls" href="#opt-tls" title="#opt-tls">`tls`</a> | TLS configuration for the router. When specified, the router will only handle HTTPS requests. See [TLS overview](../tls/overview.md) for detailed TLS configuration. | | No |
|
||||
| <a id="opt-observability" href="#opt-observability" title="#opt-observability">`observability`</a> | Observability configuration for the router. Allows fine-grained control over access logs, metrics, and tracing per router. See [Observability](./observability.md) for details. | Inherited from entry points | No |
|
||||
| <a id="opt-service" href="#opt-service" title="#opt-service">`service`</a> | The name of the service that will handle the matched requests. Services can be load balancer services, weighted round robin, mirroring, or failover services. See [Service](../load-balancing/service.md) for details.| | Yes |
|
||||
|
||||
| Field | Description | Default | Required |
|
||||
|----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|----------|
|
||||
| <a id="opt-entryPoints" href="#opt-entryPoints" title="#opt-entryPoints">`entryPoints`</a> | The list of entry points to which the router is attached. If not specified, HTTP routers are attached to all entry points. | All entry points | No |
|
||||
| <a id="opt-rule" href="#opt-rule" title="#opt-rule">`rule`</a> | Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria. If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service. See [Rules & Priority](./rules-and-priority.md) for details. | | Yes |
|
||||
| <a id="opt-priority" href="#opt-priority" title="#opt-priority">`priority`</a> | To avoid path overlap, routes are sorted, by default, in descending order using rules length. The priority is directly equal to the length of the rule, and so the longest length has the highest priority. A value of `0` for the priority is ignored. See [Rules & Priority](./rules-and-priority.md) for details. | Rule length | No |
|
||||
| <a id="opt-middlewares" href="#opt-middlewares" title="#opt-middlewares">`middlewares`</a> | The list of middlewares that are applied to the router. Middlewares are applied in the order they are declared. See [Middlewares overview](../middlewares/overview.md) for available middlewares. | | No |
|
||||
| <a id="opt-tls" href="#opt-tls" title="#opt-tls">`tls`</a> | TLS configuration for the router. When specified, the router will only handle HTTPS requests. | | No |
|
||||
| <a id="opt-tls-certResolver" href="#opt-tls-certResolver" title="#opt-tls-certResolver">`tls.certResolver`</a> | The name of the certificate resolver to use for automatic certificate generation. See [Certificate Resolver](../tls/overview.md#certificate-resolver) for details. | | No |
|
||||
| <a id="opt-tls-options" href="#opt-tls-options" title="#opt-tls-options">`tls.options`</a> | The name of the TLS options to use for configuring TLS parameters (cipher suites, min/max TLS version, client authentication, etc.). See [TLS Options](../tls/tls-options.md) for detailed configuration. | `default` | No |
|
||||
| <a id="opt-tls-domains" href="#opt-tls-domains" title="#opt-tls-domains">`tls.domains`</a> | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. When using ACME certificate resolvers, domains are automatically extracted from router rules, making this option optional. | | No |
|
||||
| <a id="opt-observability" href="#opt-observability" title="#opt-observability">`observability`</a> | Observability configuration for the router. Allows fine-grained control over access logs, metrics, and tracing per router. See [Observability](./observability.md) for details. | Inherited from entry points | No |
|
||||
| <a id="opt-service" href="#opt-service" title="#opt-service">`service`</a> | The name of the service that will handle the matched requests. Services can be load balancer services, weighted round robin, mirroring, or failover services. See [Service](../load-balancing/service.md) for details. | | Yes |
|
||||
|
||||
## Router Naming
|
||||
|
||||
- The character `@` is not authorized in the router name
|
||||
- In provider-specific configurations (Docker, Kubernetes), router names are often auto-generated based on service names and rules
|
||||
|
||||
{!traefik-for-business-applications.md!}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,103 @@
|
|||
---
|
||||
title: "Traefik TLS Documentation"
|
||||
description: "Learn how to configure the transport layer security (TLS) connection in Traefik Proxy. Read the technical documentation."
|
||||
title: "Traefik HTTP TLS Documentation"
|
||||
description: "Learn how to configure the transport layer security (TLS) connection for HTTP services in Traefik Proxy. Read the technical documentation."
|
||||
---
|
||||
|
||||
Traefik's TLS configuration defines how TLS negotiation is handled for incoming connections.
|
||||
## General
|
||||
|
||||
The next section of this documentation explains how to configure TLS connections through a definition in the dynamic configuration and how to configure TLS options, and certificates stores.
|
||||
When an HTTP router is configured to handle HTTPS traffic, include a `tls` field in its definition.
|
||||
This field tells Traefik that the router should process only TLS requests and ignore non-TLS traffic.
|
||||
|
||||
By default, an HTTP router with a TLS field will terminate the TLS connections,
|
||||
meaning that it will send decrypted data to the services.
|
||||
The TLS configuration provides several options for fine-tuning the TLS behavior,
|
||||
including automatic certificate generation, custom TLS options, and explicit domain specification.
|
||||
|
||||
## Configuration Example
|
||||
|
||||
```yaml tab="Structured (YAML)"
|
||||
http:
|
||||
routers:
|
||||
my-https-router:
|
||||
rule: "Host(`example.com`) && Path(`/api`)"
|
||||
service: "my-http-service"
|
||||
tls:
|
||||
certResolver: "letsencrypt"
|
||||
options: "modern-tls"
|
||||
domains:
|
||||
- main: "example.com"
|
||||
sans:
|
||||
- "www.example.com"
|
||||
- "api.example.com"
|
||||
```
|
||||
|
||||
```toml tab="Structured (TOML)"
|
||||
[http.routers.my-https-router]
|
||||
rule = "Host(`example.com`) && Path(`/api`)"
|
||||
service = "my-http-service"
|
||||
|
||||
[http.routers.my-https-router.tls]
|
||||
certResolver = "letsencrypt"
|
||||
options = "modern-tls"
|
||||
|
||||
[[http.routers.my-https-router.tls.domains]]
|
||||
main = "example.com"
|
||||
sans = ["www.example.com", "api.example.com"]
|
||||
```
|
||||
|
||||
```yaml tab="Labels"
|
||||
labels:
|
||||
- "traefik.http.routers.my-https-router.rule=Host(`example.com`) && Path(`/api`)"
|
||||
- "traefik.http.routers.my-https-router.service=my-http-service"
|
||||
- "traefik.http.routers.my-https-router.tls=true"
|
||||
- "traefik.http.routers.my-https-router.tls.certresolver=letsencrypt"
|
||||
- "traefik.http.routers.my-https-router.tls.options=modern-tls"
|
||||
- "traefik.http.routers.my-https-router.tls.domains[0].main=example.com"
|
||||
- "traefik.http.routers.my-https-router.tls.domains[0].sans=www.example.com,api.example.com"
|
||||
```
|
||||
|
||||
```json tab="Tags"
|
||||
{
|
||||
"Tags": [
|
||||
"traefik.http.routers.my-https-router.rule=Host(`example.com`) && Path(`/api`)",
|
||||
"traefik.http.routers.my-https-router.service=my-http-service",
|
||||
"traefik.http.routers.my-https-router.tls=true",
|
||||
"traefik.http.routers.my-https-router.tls.certresolver=letsencrypt",
|
||||
"traefik.http.routers.my-https-router.tls.options=modern-tls",
|
||||
"traefik.http.routers.my-https-router.tls.domains[0].main=example.com",
|
||||
"traefik.http.routers.my-https-router.tls.domains[0].sans=www.example.com,api.example.com"
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Configuration Options
|
||||
|
||||
| Field | Description | Default | Required |
|
||||
|:-----------------------------------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------|:---------|
|
||||
| <a id="opt-options" href="#opt-options" title="#opt-options">`options`</a> | The name of the TLS options to use for configuring TLS parameters (cipher suites, min/max TLS version, client authentication, etc.). See [TLS Options](./tls-options.md) for detailed configuration. | `default` | No |
|
||||
| <a id="opt-certResolver" href="#opt-certResolver" title="#opt-certResolver">`certResolver`</a> | The name of the certificate resolver to use for automatic certificate generation via ACME providers (such as Let's Encrypt). See the [Certificate Resolver](./#certificate-resolver) section for more details. | "" | No |
|
||||
| <a id="opt-domains" href="#opt-domains" title="#opt-domains">`domains`</a> | List of domains and Subject Alternative Names (SANs) for explicit certificate domain specification. See the [Custom Domains](./#custom-domains) section for more details. | [] | No |
|
||||
|
||||
## Certificate Resolver
|
||||
|
||||
The `tls.certResolver` option allows you to specify a certificate resolver for automatic certificate generation via ACME providers (such as Let's Encrypt).
|
||||
|
||||
When a certificate resolver is configured for a router,
|
||||
Traefik will automatically obtain and manage TLS certificates for the domains specified in the router's rule (in the `Host` matcher) or in the `tls.domains` configuration (with `tls.domains` taking precedence).
|
||||
|
||||
!!! important "Prerequisites"
|
||||
|
||||
- Certificate resolvers must be defined in the [static configuration](../../../install-configuration/tls/certificate-resolvers/acme.md)
|
||||
- The router must have `tls` enabled
|
||||
- An ACME challenge type must be configured for the certificate resolver
|
||||
|
||||
## Custom Domains
|
||||
|
||||
When using ACME certificate resolvers, domains are automatically extracted from router rules,
|
||||
but the `tls.domains` option allows you to explicitly specify the domains and Subject Alternative Names (SANs) for which certificates should be generated.
|
||||
|
||||
This provides fine-grained control over certificate generation and takes precedence over domains automatically extracted from router rules.
|
||||
|
||||
Every domain must have A/AAAA records pointing to Traefik.
|
||||
|
||||
{!traefik-for-business-applications.md!}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue