Merge branch 'v2.0' into master
This commit is contained in:
Fernandez Ludovic
commit
d66dd01438
46 changed files with 911 additions and 484 deletions
|
|
@ -16,8 +16,8 @@ The _dynamic configuration_ contains everything that defines how the requests ar
|
|||
This configuration can change and is seamlessly hot-reloaded, without any request interruption or connection loss.
|
||||
|
||||
!!! warning "Incompatible Configuration"
|
||||
Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now.
|
||||
If you're testing out v2, please ensure you are using a v2 configuration.
|
||||
Please be aware that the old configurations for Traefik v1.x are NOT compatible with the v2.x config as of now.
|
||||
If you are running v2, please ensure you are using a v2 configuration.
|
||||
|
||||
## The Dynamic Configuration
|
||||
|
||||
|
|
|
|||
|
|
@ -382,7 +382,7 @@ ACME certificates can be stored in a JSON file that needs to have a `600` file m
|
|||
In Docker you can mount either the JSON file, or the folder containing it:
|
||||
|
||||
```bash
|
||||
docker run -v "/my/host/acme.json:acme.json" traefik
|
||||
docker run -v "/my/host/acme.json:/acme.json" traefik
|
||||
```
|
||||
|
||||
```bash
|
||||
|
|
|
|||
|
|
@ -509,7 +509,8 @@ metadata:
|
|||
spec:
|
||||
forwardAuth:
|
||||
address: https://authserver.com/auth
|
||||
insecureSkipVerify: true
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
||||
```yaml tab="Consul Catalog"
|
||||
|
|
@ -531,7 +532,8 @@ labels:
|
|||
[http.middlewares]
|
||||
[http.middlewares.test-auth.forwardAuth]
|
||||
address = "https://authserver.com/auth"
|
||||
insecureSkipVerify: true
|
||||
[http.middlewares.test-auth.forwardAuth.tls]
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
|
|
@ -540,5 +542,6 @@ http:
|
|||
test-auth:
|
||||
forwardAuth:
|
||||
address: "https://authserver.com/auth"
|
||||
insecureSkipVerify: true
|
||||
tls:
|
||||
insecureSkipVerify: true
|
||||
```
|
||||
|
|
|
|||
|
|
@ -176,8 +176,8 @@ labels:
|
|||
```toml tab="File (TOML)"
|
||||
[http.middlewares]
|
||||
[http.middlewares.testHeader.headers]
|
||||
FrameDeny = true
|
||||
SSLRedirect = true
|
||||
frameDeny = true
|
||||
sslRedirect = true
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
|
|
@ -185,8 +185,8 @@ http:
|
|||
middlewares:
|
||||
testHeader:
|
||||
headers:
|
||||
FrameDeny: true
|
||||
SSLRedirect: true
|
||||
frameDeny: true
|
||||
sslRedirect: true
|
||||
```
|
||||
|
||||
### CORS Headers
|
||||
|
|
|
|||
|
|
@ -245,7 +245,10 @@ PassTLSClientCert can add two headers to the request:
|
|||
- `X-Forwarded-Tls-Client-Cert-Info` that contains all the selected certificate information in an escaped string.
|
||||
|
||||
!!! info
|
||||
The headers are filled with escaped string so it can be safely placed inside a URL query.
|
||||
|
||||
* The headers are filled with escaped string so it can be safely placed inside a URL query.
|
||||
* These options only work accordingly to the [MutualTLS configuration](../https/tls.md#client-authentication-mtls).
|
||||
That is to say, only the certificates that match the `clientAuth.clientAuthType` policy are passed.
|
||||
|
||||
In the following example, you can see a complete certificate. We will use each part of it to explain the middleware options.
|
||||
|
||||
|
|
|
|||
|
|
@ -3,13 +3,13 @@
|
|||
How to Migrate from Traefik v1 to Traefik v2.
|
||||
{: .subtitle }
|
||||
|
||||
The version 2 of Traefik introduces a number of breaking changes,
|
||||
The version 2 of Traefik introduces a number of breaking changes,
|
||||
which require one to update their configuration when they migrate from v1 to v2.
|
||||
The goal of this page is to recapitulate all of these changes, and in particular to give examples,
|
||||
The goal of this page is to recapitulate all of these changes, and in particular to give examples,
|
||||
feature by feature, of how the configuration looked like in v1, and how it now looks like in v2.
|
||||
|
||||
!!! info "Migration Helper"
|
||||
|
||||
|
||||
We created a tool to help during the migration: [traefik-migration-tool](https://github.com/containous/traefik-migration-tool)
|
||||
|
||||
This tool allows to:
|
||||
|
|
@ -32,7 +32,7 @@ Then any router can refer to an instance of the wanted middleware.
|
|||
!!! example "One frontend with basic auth and one backend, become one router, one service, and one basic auth middleware."
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.frontend.rule=Host:test.localhost;PathPrefix:/test"
|
||||
|
|
@ -92,9 +92,9 @@ Then any router can refer to an instance of the wanted middleware.
|
|||
[backends.backend1.loadBalancer]
|
||||
method = "wrr"
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.http.routers.router0.rule=Host(`bar.com`) && PathPrefix(`/test`)"
|
||||
|
|
@ -103,7 +103,7 @@ Then any router can refer to an instance of the wanted middleware.
|
|||
```
|
||||
|
||||
```yaml tab="K8s IngressRoute"
|
||||
# The definitions below require the definitions for the Middleware and IngressRoute kinds.
|
||||
# The definitions below require the definitions for the Middleware and IngressRoute kinds.
|
||||
# https://docs.traefik.io/v2.0/providers/kubernetes-crd/#traefik-ingressroute-definition
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
|
|
@ -155,7 +155,7 @@ Then any router can refer to an instance of the wanted middleware.
|
|||
[http.middlewares]
|
||||
[http.middlewares.auth.basicAuth]
|
||||
users = [
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
|
||||
]
|
||||
```
|
||||
|
|
@ -184,7 +184,7 @@ Then any router can refer to an instance of the wanted middleware.
|
|||
- "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
## TLS configuration is now dynamic, per router.
|
||||
## TLS Configuration Is Now Dynamic, per Router.
|
||||
|
||||
TLS parameters used to be specified in the static configuration, as an entryPoint field.
|
||||
With Traefik v2, a new dynamic TLS section at the root contains all the desired TLS configurations.
|
||||
|
|
@ -214,13 +214,13 @@ Then, a [router's TLS field](../routing/routers/index.md#tls) can refer to one o
|
|||
certFile = "path/to/my.cert"
|
||||
keyFile = "path/to/my.key"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--entryPoints='Name:web-secure Address::443 TLS:path/to/my.cert,path/to/my.key TLS.MinVersion:VersionTLS12 TLS.CipherSuites:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# dynamic configuration
|
||||
[http.routers]
|
||||
|
|
@ -250,7 +250,7 @@ Then, a [router's TLS field](../routing/routers/index.md#tls) can refer to one o
|
|||
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
http:
|
||||
routers:
|
||||
|
|
@ -275,9 +275,9 @@ Then, a [router's TLS field](../routing/routers/index.md#tls) can refer to one o
|
|||
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="K8s IngressRoute"
|
||||
# The definitions below require the definitions for the TLSOption and IngressRoute kinds.
|
||||
# The definitions below require the definitions for the TLSOption and IngressRoute kinds.
|
||||
# https://docs.traefik.io/v2.0/providers/kubernetes-crd/#traefik-ingressroute-definition
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: TLSOption
|
||||
|
|
@ -310,11 +310,11 @@ Then, a [router's TLS field](../routing/routers/index.md#tls) can refer to one o
|
|||
- name: whoami
|
||||
port: 80
|
||||
tls:
|
||||
options:
|
||||
options:
|
||||
name: mytlsoption
|
||||
namespace: default
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
# myTLSOptions must be defined by another provider, in this instance in the File Provider.
|
||||
|
|
@ -322,7 +322,7 @@ Then, a [router's TLS field](../routing/routers/index.md#tls) can refer to one o
|
|||
- "traefik.http.routers.router0.tls.options=myTLSOptions@file"
|
||||
```
|
||||
|
||||
## HTTP to HTTPS Redirection is now configured on Routers
|
||||
## HTTP to HTTPS Redirection Is Now Configured on Routers
|
||||
|
||||
Previously on Traefik v1, the redirection was applied on an entry point or on a frontend.
|
||||
With Traefik v2 it is applied on a [Router](../routing/routers/index.md).
|
||||
|
|
@ -350,14 +350,14 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
certFile = "examples/traefik.crt"
|
||||
keyFile = "examples/traefik.key"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--entrypoints=Name:web Address::80 Redirect.EntryPoint:web-secure
|
||||
--entryPoints='Name:web-secure Address::443 TLS:path/to/my.cert,path/to/my.key'
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- traefik.http.routers.web.rule=Host(`foo.com`)
|
||||
|
|
@ -454,9 +454,9 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
|
||||
[[tls.certificates]]
|
||||
certFile = "/path/to/domain.cert"
|
||||
keyFile = "/path/to/domain.key"
|
||||
keyFile = "/path/to/domain.key"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## static configuration
|
||||
# traefik.yml
|
||||
|
|
@ -506,7 +506,139 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
certificates:
|
||||
- certFile: /app/certs/server/server.pem
|
||||
keyFile: /app/certs/server/server.pem
|
||||
```
|
||||
```
|
||||
|
||||
## Strip and Rewrite Path Prefixes
|
||||
|
||||
With the new core notions of v2 (introduced earlier in the section
|
||||
["Frontends and Backends Are Dead... Long Live Routers, Middlewares, and Services"](#frontends-and-backends-are-dead-long-live-routers-middlewares-and-services)),
|
||||
transforming the URL path prefix of incoming requests is configured with [middlewares](../../middlewares/overview/),
|
||||
after the routing step with [router rule `PathPrefix`](https://docs.traefik.io/v2.0/routing/routers/#rule).
|
||||
|
||||
Use Case: Incoming requests to `http://company.org/admin` are forwarded to the webapplication "admin",
|
||||
with the path `/admin` stripped, e.g. to `http://<IP>:<port>/`. In this case, you must:
|
||||
|
||||
* First, configure a router named `admin` with a rule matching at least the path prefix with the `PathPrefix` keyword,
|
||||
* Then, define a middlware of type [`stripprefix`](../../middlewares/stripprefix/), which remove the prefix `/admin`, associated to the router `admin`.
|
||||
|
||||
!!! example "Strip Path Prefix When Forwarding to Backend"
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.frontend.rule=Host:company.org;PathPrefixStrip:/admin"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes Ingress"
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: traefik
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip
|
||||
spec:
|
||||
rules:
|
||||
- host: company.org
|
||||
http:
|
||||
paths:
|
||||
- path: /admin
|
||||
backend:
|
||||
serviceName: admin-svc
|
||||
servicePort: admin
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[frontends.admin]
|
||||
[frontends.admin.routes.admin_1]
|
||||
rule = "Host:company.org;PathPrefixStrip:/admin"
|
||||
```
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
```yaml tab="Docker"
|
||||
labels:
|
||||
- "traefik.http.routers.admin.rule=Host(`company.org`) && PathPrefix(`/admin`)"
|
||||
- "traefik.http.middlewares.admin-stripprefix.stripprefix.prefixes=/admin"
|
||||
- "traefik.http.routers.web.middlewares=admin-stripprefix@docker"
|
||||
```
|
||||
|
||||
```yaml tab="Kubernetes IngressRoute"
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: http-redirect-ingressRoute
|
||||
namespace: admin-web
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`company.org`) && PathPrefix(`/admin`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: admin-svc
|
||||
port: admin
|
||||
middlewares:
|
||||
- name: admin-stripprefix
|
||||
---
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-stripprefix
|
||||
spec:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- /admin
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## Dynamic configuration
|
||||
# dynamic-conf.toml
|
||||
|
||||
[http.routers.router1]
|
||||
rule = "Host(`company.org`) && PathPrefix(`/admin`)"
|
||||
service = "admin-svc"
|
||||
entrypoints = ["web"]
|
||||
middlewares = ["admin-stripprefix"]
|
||||
|
||||
[http.middlewares]
|
||||
[http.middlewares.admin-stripprefix.stripPrefix]
|
||||
prefixes = ["/admin"]
|
||||
|
||||
# ...
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## Dynamic Configuration
|
||||
# dynamic-conf.yml
|
||||
|
||||
# As YAML Configuration File
|
||||
http:
|
||||
routers:
|
||||
admin:
|
||||
service: admin-svc
|
||||
middlewares:
|
||||
- "admin-stripprefix"
|
||||
rule: "Host(`company.org`) && PathPrefix(`/admin`)"
|
||||
|
||||
middlewares:
|
||||
admin-stripprefix:
|
||||
stripPrefix:
|
||||
prefixes:
|
||||
- "/admin"
|
||||
|
||||
# ...
|
||||
```
|
||||
|
||||
??? question "What About Other Path Transformations?"
|
||||
|
||||
Instead of removing the path prefix with the [`stripprefix` middleware](../../middlewares/stripprefix/), you can also:
|
||||
|
||||
* Add a path prefix with the [`addprefix` middleware](../../middlewares/addprefix/)
|
||||
* Replace the complete path of the request with the [`replacepath` middleware](../../middlewares/replacepath/)
|
||||
* ReplaceRewrite path using Regexp with the [`replacepathregex` middleware](../../middlewares/replacepathregex/)
|
||||
* And a lot more on the [`middlewares` page](../../middlewares/overview/)
|
||||
|
||||
## ACME (LetsEncrypt)
|
||||
|
||||
|
|
@ -536,7 +668,7 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
[acme.httpChallenge]
|
||||
entryPoint = "web"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--defaultentrypoints=web-secure,web
|
||||
--entryPoints=Name:web Address::80 Redirect.EntryPoint:web-secure
|
||||
|
|
@ -547,9 +679,9 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
--acme.onHostRule=true
|
||||
--acme.httpchallenge.entrypoint=http
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[entryPoints]
|
||||
|
|
@ -566,7 +698,7 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
# used during the challenge
|
||||
entryPoint = "web"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
entryPoints:
|
||||
web:
|
||||
|
|
@ -583,8 +715,8 @@ To apply a redirection, one of the redirect middlewares, [RedirectRegex](../midd
|
|||
httpChallenge:
|
||||
# used during the challenge
|
||||
entryPoint: web
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--entryPoints.web.address=":80"
|
||||
--entryPoints.websecure.address=":443"
|
||||
|
|
@ -601,7 +733,7 @@ There is no more log configuration at the root level.
|
|||
!!! example "Simple log configuration"
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
logLevel = "DEBUG"
|
||||
|
|
@ -610,15 +742,15 @@ There is no more log configuration at the root level.
|
|||
filePath = "/path/to/traefik.log"
|
||||
format = "json"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--logLevel="DEBUG"
|
||||
--traefikLog.filePath="/path/to/traefik.log"
|
||||
--traefikLog.format="json"
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[log]
|
||||
|
|
@ -626,15 +758,15 @@ There is no more log configuration at the root level.
|
|||
filePath = "/path/to/log-file.log"
|
||||
format = "json"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# static configuration
|
||||
log:
|
||||
level: DEBUG
|
||||
filePath: /path/to/log-file.log
|
||||
format: json
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--log.level="DEBUG"
|
||||
--log.filePath="/path/to/traefik.log"
|
||||
|
|
@ -644,11 +776,11 @@ There is no more log configuration at the root level.
|
|||
## Tracing
|
||||
|
||||
Traefik v2 retains OpenTracing support. The `backend` root option from the v1 is gone, you just have to set your [tracing configuration](../observability/tracing/overview.md).
|
||||
|
||||
|
||||
!!! example "Simple Jaeger tracing configuration"
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[tracing]
|
||||
|
|
@ -660,18 +792,18 @@ Traefik v2 retains OpenTracing support. The `backend` root option from the v1 is
|
|||
samplingType = "const"
|
||||
localAgentHostPort = "12.0.0.1:6831"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--tracing.backend="jaeger"
|
||||
--tracing.servicename="tracing"
|
||||
--tracing.jaeger.localagenthostport="12.0.0.1:6831"
|
||||
--tracing.jaeger.samplingparam="1.0"
|
||||
--tracing.jaeger.samplingserverurl="http://12.0.0.1:5778/sampling"
|
||||
--tracing.jaeger.samplingtype="const"
|
||||
--tracing.jaeger.samplingtype="const"
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[tracing]
|
||||
|
|
@ -682,7 +814,7 @@ Traefik v2 retains OpenTracing support. The `backend` root option from the v1 is
|
|||
samplingType = "const"
|
||||
localAgentHostPort = "12.0.0.1:6831"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# static configuration
|
||||
tracing:
|
||||
|
|
@ -692,8 +824,8 @@ Traefik v2 retains OpenTracing support. The `backend` root option from the v1 is
|
|||
samplingServerURL: 'http://12.0.0.1:5778/sampling'
|
||||
samplingType: const
|
||||
localAgentHostPort: '12.0.0.1:6831'
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--tracing.servicename="tracing"
|
||||
--tracing.jaeger.localagenthostport="12.0.0.1:6831"
|
||||
|
|
@ -705,33 +837,33 @@ Traefik v2 retains OpenTracing support. The `backend` root option from the v1 is
|
|||
## Metrics
|
||||
|
||||
The v2 retains metrics tools and allows metrics to be configured for the entrypoints and/or services.
|
||||
For a basic configuration, the [metrics configuration](../observability/metrics/overview.md) remains the same.
|
||||
For a basic configuration, the [metrics configuration](../observability/metrics/overview.md) remains the same.
|
||||
|
||||
!!! example "Simple Prometheus metrics configuration"
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[metrics.prometheus]
|
||||
buckets = [0.1,0.3,1.2,5.0]
|
||||
entryPoint = "traefik"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--metrics.prometheus.buckets=[0.1,0.3,1.2,5.0]
|
||||
--metrics.prometheus.entrypoint="traefik"
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[metrics.prometheus]
|
||||
buckets = [0.1,0.3,1.2,5.0]
|
||||
entryPoint = "metrics"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# static configuration
|
||||
metrics:
|
||||
|
|
@ -742,22 +874,22 @@ For a basic configuration, the [metrics configuration](../observability/metrics/
|
|||
- 1.2
|
||||
- 5
|
||||
entryPoint: metrics
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--metrics.prometheus.buckets=[0.1,0.3,1.2,5.0]
|
||||
--metrics.prometheus.entrypoint="metrics"
|
||||
```
|
||||
|
||||
## No more root level key/values
|
||||
## No More Root Level Key/Values
|
||||
|
||||
To avoid any source of confusion, there are no more configuration at the root level.
|
||||
Each root item has been moved to a related section or removed.
|
||||
|
||||
!!! example "From root to dedicated section"
|
||||
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
checkNewVersion = false
|
||||
|
|
@ -772,7 +904,7 @@ Each root item has been moved to a related section or removed.
|
|||
defaultEntryPoints = ["web", "web-secure"]
|
||||
keepTrailingSlash = false
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--checknewversion=false
|
||||
--sendanonymoususage=true
|
||||
|
|
@ -786,9 +918,9 @@ Each root item has been moved to a related section or removed.
|
|||
--defaultentrypoints="web","web-secure"
|
||||
--keeptrailingslash=true
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# static configuration
|
||||
[global]
|
||||
|
|
@ -804,9 +936,9 @@ Each root item has been moved to a related section or removed.
|
|||
maxIdleConnsPerHost = 42
|
||||
|
||||
[providers]
|
||||
providersThrottleDuration = 42
|
||||
providersThrottleDuration = 42
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# static configuration
|
||||
global:
|
||||
|
|
@ -824,8 +956,8 @@ Each root item has been moved to a related section or removed.
|
|||
|
||||
providers:
|
||||
providersThrottleDuration: 42
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
```bash tab="CLI"
|
||||
--global.checknewversion=true
|
||||
--global.sendanonymoususage=true
|
||||
|
|
@ -835,7 +967,7 @@ Each root item has been moved to a related section or removed.
|
|||
--serverstransport.maxidleconnsperhost=42
|
||||
--providers.providersthrottleduration=42
|
||||
```
|
||||
|
||||
|
||||
## Dashboard
|
||||
|
||||
You need to activate the API to access the [dashboard](../operations/dashboard.md).
|
||||
|
|
@ -847,11 +979,11 @@ As the dashboard access is now secured by default you can either:
|
|||
!!! info "Dashboard with k8s and dedicated router"
|
||||
|
||||
As `api@internal` is not a Kubernetes service, you have to use the file provider or the `insecure` API option.
|
||||
|
||||
|
||||
!!! example "Activate and access the dashboard"
|
||||
|
||||
!!! info "v1"
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
## static configuration
|
||||
# traefik.toml
|
||||
|
|
@ -868,14 +1000,14 @@ As the dashboard access is now secured by default you can either:
|
|||
[api]
|
||||
entryPoint = "web-secure"
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--entryPoints='Name:web-secure Address::443 TLS Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/'
|
||||
--api
|
||||
```
|
||||
|
||||
|
||||
!!! info "v2"
|
||||
|
||||
|
||||
```yaml tab="Docker"
|
||||
# dynamic configuration
|
||||
labels:
|
||||
|
|
@ -916,7 +1048,7 @@ As the dashboard access is now secured by default you can either:
|
|||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
]
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
## static configuration
|
||||
# traefik.yaml
|
||||
|
|
@ -952,8 +1084,8 @@ As the dashboard access is now secured by default you can either:
|
|||
basicAuth:
|
||||
users:
|
||||
- 'test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/'
|
||||
```
|
||||
|
||||
```
|
||||
|
||||
## Providers
|
||||
|
||||
Supported [providers](../providers/overview.md), for now:
|
||||
|
|
@ -976,7 +1108,7 @@ Supported [providers](../providers/overview.md), for now:
|
|||
* [x] Rest
|
||||
* [ ] Zookeeper
|
||||
|
||||
## Some Tips You Should Known
|
||||
## Some Tips You Should Know
|
||||
|
||||
* Different sources of static configuration (file, CLI flags, ...) cannot be [mixed](../getting-started/configuration-overview.md#the-static-configuration).
|
||||
* Now, configuration elements can be referenced between different providers by using the provider namespace notation: `@<provider>`.
|
||||
|
|
|
|||
|
|
@ -180,7 +180,7 @@ accessLog:
|
|||
|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| `StartUTC` | The time at which request processing started. |
|
||||
| `StartLocal` | The local time at which request processing started. |
|
||||
| `Duration` | The total time taken by processing the response, including the origin server's time but not the log writing time. |
|
||||
| `Duration` | The total time taken (in nanoseconds) by processing the response, including the origin server's time but not the log writing time. |
|
||||
| `FrontendName` | The name of the Traefik frontend. |
|
||||
| `BackendName` | The name of the Traefik backend. |
|
||||
| `BackendURL` | The URL of the Traefik backend. |
|
||||
|
|
|
|||
4
docs/content/operations/.markdownlint.json
Normal file
4
docs/content/operations/.markdownlint.json
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"extends": "../../.markdownlint.json",
|
||||
"MD046": false
|
||||
}
|
||||
|
|
@ -14,7 +14,7 @@ In production, it should be at least secured by authentication and authorization
|
|||
A good sane default (non exhaustive) set of recommendations
|
||||
would be to apply the following protection mechanisms:
|
||||
|
||||
* At the transport level:
|
||||
* At the transport level:
|
||||
NOT publicly exposing the API's port,
|
||||
keeping it restricted to internal networks
|
||||
(as in the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), applied to networks).
|
||||
|
|
@ -23,13 +23,16 @@ would be to apply the following protection mechanisms:
|
|||
|
||||
If you enable the API, a new special `service` named `api@internal` is created and can then be referenced in a router.
|
||||
|
||||
To enable the API handler:
|
||||
To enable the API handler, use the following option on the
|
||||
[static configuration](../getting-started/configuration-overview.md#the-static-configuration):
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Static Configuration
|
||||
[api]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Static Configuration
|
||||
api: {}
|
||||
```
|
||||
|
||||
|
|
@ -37,11 +40,13 @@ api: {}
|
|||
--api=true
|
||||
```
|
||||
|
||||
And then you will be able to reference it like this:
|
||||
And then define a routing configuration on Traefik itself with the
|
||||
[dynamic configuration](../getting-started/configuration-overview.md#the-dynamic-configuration):
|
||||
|
||||
```yaml tab="Docker"
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
|
|
@ -57,40 +62,42 @@ labels:
|
|||
|
||||
```json tab="Marathon"
|
||||
"labels": {
|
||||
"traefik.http.routers.api.rule": "PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
"traefik.http.routers.api.service": "api@internal"
|
||||
"traefik.http.routers.api.middlewares": "auth"
|
||||
"traefik.http.routers.api.rule": "Host(`traefik.domain.com`)",
|
||||
"traefik.http.routers.api.service": "api@internal",
|
||||
"traefik.http.routers.api.middlewares": "auth",
|
||||
"traefik.http.middlewares.auth.basicauth.users": "test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
}
|
||||
```
|
||||
|
||||
```yaml tab="Rancher"
|
||||
# Declaring the user list
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Dynamic Configuration
|
||||
[http.routers.my-api]
|
||||
rule="PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
rule="Host(`traefik.domain.com`)
|
||||
service="api@internal"
|
||||
middlewares=["auth"]
|
||||
|
||||
[http.middlewares.auth.basicAuth]
|
||||
users = [
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
|
||||
]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Dynamic Configuration
|
||||
http:
|
||||
routers:
|
||||
api:
|
||||
rule: PathPrefix(`/api`) || PathPrefix(`/dashboard`)
|
||||
rule: Host(`traefik.domain.com`)
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- auth
|
||||
|
|
@ -98,10 +105,32 @@ http:
|
|||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
- "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
- "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
??? warning "The router's [rule](../../routing/routers#rule) must catch requests for the URI path `/api`"
|
||||
Using an "Host" rule is recommended, by catching all the incoming traffic on this host domain to the API.
|
||||
However, you can also use "path prefix" rule or any combination or rules.
|
||||
|
||||
```bash tab="Host Rule"
|
||||
# Matches http://traefik.domain.com, http://traefik.domain.com/api
|
||||
# or http://traefik.domain.com/hello
|
||||
rule = "Host(`traefik.domain.com`)"
|
||||
```
|
||||
|
||||
```bash tab="Path Prefix Rule"
|
||||
# Matches http://api.traefik.domain.com/api or http://domain.com/api
|
||||
# but does not match http://api.traefik.domain.com/hello
|
||||
rule = "PathPrefix(`/api`)"
|
||||
```
|
||||
|
||||
```bash tab="Combination of Rules"
|
||||
# Matches http://traefik.domain.com/api or http://traefik.domain.com/dashboard
|
||||
# but does not match http://traefik.domain.com/hello
|
||||
rule = "Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
|
||||
```
|
||||
|
||||
### `insecure`
|
||||
|
||||
Enable the API in `insecure` mode, which means that the API will be available directly on the entryPoint named `traefik`.
|
||||
|
|
@ -143,6 +172,9 @@ api:
|
|||
--api.dashboard=true
|
||||
```
|
||||
|
||||
!!! warning "With Dashboard enabled, the router [rule](../../routing/routers#rule) must catch requests for both `/api` and `/dashboard`"
|
||||
Please check the [Dashboard documentation](./dashboard.md#dashboard-router-rule) to learn more about this and to get examples.
|
||||
|
||||
### `debug`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
|
|
|||
|
|
@ -28,7 +28,8 @@ There are 2 ways to configure and access the dashboard:
|
|||
|
||||
This is the **recommended** method.
|
||||
|
||||
Start by enabling the dashboard by using the following option from [Traefik's API](./api.md):
|
||||
Start by enabling the dashboard by using the following option from [Traefik's API](./api.md)
|
||||
on the [static configuration](../getting-started/configuration-overview.md#the-static-configuration):
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[api]
|
||||
|
|
@ -59,17 +60,103 @@ api:
|
|||
--api.dashboard=true
|
||||
```
|
||||
|
||||
Then specify a router associated to the service `api@internal` to allow:
|
||||
Then define a routing configuration on Traefik itself,
|
||||
with a router attached to the service `api@internal` in the
|
||||
[dynamic configuration](../getting-started/configuration-overview.md#the-dynamic-configuration),
|
||||
to allow defining:
|
||||
|
||||
- Defining one or more security features through [middlewares](../middlewares/overview.md)
|
||||
- One or more security features through [middlewares](../middlewares/overview.md)
|
||||
like authentication ([basicAuth](../middlewares/basicauth.md) , [digestAuth](../middlewares/digestauth.md),
|
||||
[forwardAuth](../middlewares/forwardauth.md)) or [whitelisting](../middlewares/ipwhitelist.md).
|
||||
|
||||
- Defining your own [HTTP routing rule](../../routing/routers/#rule) for accessing the dashboard,
|
||||
- A [router rule](#dashboard-router-rule) for accessing the dashboard,
|
||||
through Traefik itself (sometimes referred as "Traefik-ception").
|
||||
|
||||
Please visit the ["Configuration" section of the API documentation](./api.md#configuration)
|
||||
to learn about configuring a router with the service `api@internal` and enabling the security features.
|
||||
??? example "Dashboard Dynamic Configuration Examples"
|
||||
|
||||
```yaml tab="Docker"
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
```json tab="Marathon"
|
||||
"labels": {
|
||||
"traefik.http.routers.api.rule": "Host(`traefik.domain.com`)",
|
||||
"traefik.http.routers.api.service": "api@internal",
|
||||
"traefik.http.routers.api.middlewares": "auth",
|
||||
"traefik.http.middlewares.auth.basicauth.users": "test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
}
|
||||
```
|
||||
|
||||
```yaml tab="Rancher"
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Dynamic Configuration
|
||||
[http.routers.my-api]
|
||||
rule="Host(`traefik.domain.com`)
|
||||
service="api@internal"
|
||||
middlewares=["auth"]
|
||||
|
||||
[http.middlewares.auth.basicAuth]
|
||||
users = [
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
|
||||
]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Dynamic Configuration
|
||||
http:
|
||||
routers:
|
||||
api:
|
||||
rule: Host(`traefik.domain.com`)
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- auth
|
||||
middlewares:
|
||||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
- "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
### Dashboard Router Rule
|
||||
|
||||
As underlined in the [documentation for the `api.dashboard` option](./api.md#dashboard),
|
||||
the [router rule](../routing/routers/index.md#rule) defined for Traefik must match
|
||||
the path prefixes `/api` and `/dashboard`.
|
||||
|
||||
We recommend to use a "Host Based rule" as ```Host(`traefik.domain.com`)``` to match everything on the host domain,
|
||||
or to make sure that the defined rule captures both prefixes:
|
||||
|
||||
```bash tab="Host Rule"
|
||||
# Matches http://traefik.domain.com/api or http://traefik.domain.com/dashboard
|
||||
rule = "Host(`traefik.domain.com`)"
|
||||
```
|
||||
|
||||
```bash tab="Path Prefix Rule"
|
||||
# Matches http://traefik.domain.com/api , http://domain.com/api or http://traefik.domain.com/dashboard
|
||||
# but does not match http://traefik.domain.com/hello
|
||||
rule = "PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
```
|
||||
|
||||
```bash tab="Combination of Rules"
|
||||
# Matches http://traefik.domain.com/api or http://traefik.domain.com/dashboard
|
||||
# but does not match http://traefik.domain.com/hello
|
||||
rule = "Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
|
||||
```
|
||||
|
||||
## Insecure Mode
|
||||
|
||||
|
|
|
|||
|
|
@ -128,7 +128,7 @@ Traefik requires access to the docker socket to get its dynamic configuration.
|
|||
??? info "Resources about Docker's Security"
|
||||
|
||||
- [KubeCon EU 2018 Keynote, Running with Scissors, from Liz Rice](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
|
||||
- [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html)
|
||||
- [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container/)
|
||||
- [A thread on Stack Overflow about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
|
||||
- [To DinD or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
|
||||
|
||||
|
|
|
|||
|
|
@ -580,7 +580,7 @@ Specifies the header name that will be used to store the trace ID.
|
|||
Settings for Instana. (Default: ```false```)
|
||||
|
||||
`--tracing.instana.localagenthost`:
|
||||
Set instana-agent's host that the reporter will used. (Default: ```localhost```)
|
||||
Set instana-agent's host that the reporter will used.
|
||||
|
||||
`--tracing.instana.localagentport`:
|
||||
Set instana-agent's port that the reporter will used. (Default: ```42699```)
|
||||
|
|
|
|||
|
|
@ -580,7 +580,7 @@ Specifies the header name that will be used to store the trace ID.
|
|||
Settings for Instana. (Default: ```false```)
|
||||
|
||||
`TRAEFIK_TRACING_INSTANA_LOCALAGENTHOST`:
|
||||
Set instana-agent's host that the reporter will used. (Default: ```localhost```)
|
||||
Set instana-agent's host that the reporter will used.
|
||||
|
||||
`TRAEFIK_TRACING_INSTANA_LOCALAGENTPORT`:
|
||||
Set instana-agent's port that the reporter will used. (Default: ```42699```)
|
||||
|
|
|
|||
|
|
@ -12,16 +12,16 @@ Attach labels to your containers and let Traefik do the rest!
|
|||
??? example "Configuring Docker & Deploying / Exposing Services"
|
||||
|
||||
Enabling the docker provider
|
||||
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
[providers.docker]
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
docker: {}
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.docker=true
|
||||
```
|
||||
|
|
@ -37,6 +37,27 @@ Attach labels to your containers and let Traefik do the rest!
|
|||
- traefik.http.routers.my-container.rule=Host(`mydomain.com`)
|
||||
```
|
||||
|
||||
??? example "Specify a Custom Port for the Container"
|
||||
|
||||
Forward requests for `http://mydomain.com` to `http://<private IP of container>:12345`:
|
||||
|
||||
```yaml
|
||||
version: "3"
|
||||
services:
|
||||
my-container:
|
||||
# ...
|
||||
labels:
|
||||
- traefik.http.routers.my-container.rule=Host(`mydomain.com`)
|
||||
# Tell Traefik to use the port 12345 to connect to `my-container`
|
||||
- traefik.http.services.my-service.loadbalancer.server.port=12345
|
||||
```
|
||||
|
||||
!!! important "Traefik Connecting to the Wrong Port: `HTTP/502 Gateway Error`"
|
||||
By default, Traefik uses the first exposed port of a container.
|
||||
|
||||
Setting the label `traefik.http.services.xxx.loadbalancer.server.port`
|
||||
overrides that behavior.
|
||||
|
||||
??? example "Configuring Docker Swarm & Deploying / Exposing Services"
|
||||
|
||||
Enabling the docker provider (Swarm Mode)
|
||||
|
|
@ -49,7 +70,7 @@ Attach labels to your containers and let Traefik do the rest!
|
|||
endpoint = "tcp://127.0.0.1:2377"
|
||||
swarmMode = true
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
providers:
|
||||
docker:
|
||||
|
|
@ -59,7 +80,7 @@ Attach labels to your containers and let Traefik do the rest!
|
|||
endpoint: "tcp://127.0.0.1:2375"
|
||||
swarmMode: true
|
||||
```
|
||||
|
||||
|
||||
```bash tab="CLI"
|
||||
--providers.docker.endpoint="tcp://127.0.0.1:2375"
|
||||
--providers.docker.swarmMode=true
|
||||
|
|
@ -85,7 +106,7 @@ Attach labels to your containers and let Traefik do the rest!
|
|||
## Routing Configuration
|
||||
|
||||
!!! info "Labels"
|
||||
|
||||
|
||||
- Labels are case insensitive.
|
||||
- The complete list of labels can be found in [the reference page](../../reference/dynamic-configuration/docker.md).
|
||||
|
||||
|
|
@ -129,82 +150,84 @@ add labels starting with `traefik.http.routers.<name-of-your-choice>.` and follo
|
|||
|
||||
For example, to change the rule, you could add the label ```traefik.http.routers.my-container.rule=Host(`mydomain.com`)```.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the router name `<router_name>`."
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.rule`"
|
||||
|
||||
See [rule](../routers/index.md#rule) for more information.
|
||||
|
||||
|
||||
See [rule](../routers/index.md#rule) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.rule=Host(`mydomain.com`)"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.entrypoints`"
|
||||
|
||||
See [entry points](../routers/index.md#entrypoints) for more information.
|
||||
|
||||
|
||||
See [entry points](../routers/index.md#entrypoints) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.entrypoints=web,websecure"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.middlewares`"
|
||||
|
||||
See [middlewares](../routers/index.md#middlewares) and [middlewares overview](../../middlewares/overview.md) for more information.
|
||||
|
||||
|
||||
See [middlewares](../routers/index.md#middlewares) and [middlewares overview](../../middlewares/overview.md) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.middlewares=auth,prefix,cb"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.service`"
|
||||
|
||||
See [rule](../routers/index.md#service) for more information.
|
||||
|
||||
|
||||
See [rule](../routers/index.md#service) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.service=myservice"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.tls`"
|
||||
|
||||
|
||||
See [tls](../routers/index.md#tls) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.tls=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.tls.certresolver`"
|
||||
|
||||
|
||||
See [certResolver](../routers/index.md#certresolver) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.tls.certresolver=myresolver"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.tls.domains[n].main`"
|
||||
|
||||
|
||||
See [domains](../routers/index.md#domains) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.tls.domains[0].main=foobar.com"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.tls.domains[n].sans`"
|
||||
|
||||
|
||||
See [domains](../routers/index.md#domains) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.tls.domains[0].sans=test.foobar.com,dev.foobar.com"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.tls.options`"
|
||||
|
||||
|
||||
See [options](../routers/index.md#options) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.tls.options=foobar"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.priority`"
|
||||
|
||||
See [options](../routers/index.md#priority) for more information.
|
||||
|
||||
|
||||
See [priority](../routers/index.md#priority) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.priority=42"
|
||||
```
|
||||
|
|
@ -217,125 +240,127 @@ add labels starting with `traefik.http.services.<name-of-your-choice>.`, followe
|
|||
For example, to change the `passHostHeader` behavior,
|
||||
you'd add the label `traefik.http.services.<name-of-your-choice>.loadbalancer.passhostheader=false`.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the service name `<service_name>`."
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.server.port`"
|
||||
|
||||
|
||||
Registers a port.
|
||||
Useful when the container exposes multiples ports.
|
||||
|
||||
|
||||
Mandatory for Docker Swarm.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.server.port=8080"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.server.scheme`"
|
||||
|
||||
|
||||
Overrides the default scheme.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.server.scheme=http"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.passhostheader`"
|
||||
|
||||
|
||||
See [pass Host header](../services/index.md#pass-host-header) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.passhostheader=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.headers.<header_name>`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.headers.X-Foo=foobar"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.hostname`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.hostname=foobar.com"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.interval`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.interval=10"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.path`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.path=/foo"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.port`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.port=42"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.scheme`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.scheme=http"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.healthcheck.timeout`"
|
||||
|
||||
|
||||
See [health check](../services/index.md#health-check) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.healthcheck.timeout=10"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.sticky`"
|
||||
|
||||
|
||||
See [sticky sessions](../services/index.md#sticky-sessions) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.sticky=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.httponly`"
|
||||
|
||||
|
||||
See [sticky sessions](../services/index.md#sticky-sessions) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.sticky.cookie.httponly=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.name`"
|
||||
|
||||
|
||||
See [sticky sessions](../services/index.md#sticky-sessions) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.sticky.cookie.name=foobar"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.sticky.cookie.secure`"
|
||||
|
||||
|
||||
See [sticky sessions](../services/index.md#sticky-sessions) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.sticky.cookie.secure=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.responseforwarding.flushinterval`"
|
||||
|
||||
|
||||
See [response forwarding](../services/index.md#response-forwarding) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.http.services.myservice.loadbalancer.responseforwarding.flushinterval=10"
|
||||
```
|
||||
|
|
@ -350,6 +375,8 @@ you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme=https`.
|
|||
|
||||
More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
|
||||
|
||||
!!! warning "The character `@` is not authorized in the middleware name."
|
||||
|
||||
??? example "Declaring and Referencing a Middleware"
|
||||
|
||||
```yaml
|
||||
|
|
@ -391,73 +418,73 @@ You can declare TCP Routers and/or Services using labels.
|
|||
#### TCP Routers
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.entrypoints`"
|
||||
|
||||
|
||||
See [entry points](../routers/index.md#entrypoints_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.entrypoints=ep1,ep2"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.rule`"
|
||||
|
||||
|
||||
See [rule](../routers/index.md#rule_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.rule=HostSNI(`myhost.com`)"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.service`"
|
||||
|
||||
|
||||
See [service](../routers/index.md#services) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.service=myservice"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls`"
|
||||
|
||||
|
||||
See [TLS](../routers/index.md#tls_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls=true"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls.certresolver`"
|
||||
|
||||
|
||||
See [certResolver](../routers/index.md#certresolver_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls.certresolver=myresolver"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls.domains[n].main`"
|
||||
|
||||
|
||||
See [domains](../routers/index.md#domains_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls.domains[0].main=foobar.com"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls.domains[n].sans`"
|
||||
|
||||
|
||||
See [domains](../routers/index.md#domains_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls.domains[0].sans=test.foobar.com,dev.foobar.com"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls.options`"
|
||||
|
||||
|
||||
See [options](../routers/index.md#options_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls.options=mysoptions"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.routers.<router_name>.tls.passthrough`"
|
||||
|
||||
|
||||
See [TLS](../routers/index.md#tls_1) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.routers.mytcprouter.tls.passthrough=true"
|
||||
```
|
||||
|
|
@ -465,17 +492,17 @@ You can declare TCP Routers and/or Services using labels.
|
|||
#### TCP Services
|
||||
|
||||
??? info "`traefik.tcp.services.<service_name>.loadbalancer.server.port`"
|
||||
|
||||
|
||||
Registers a port of the application.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.services.mytcpservice.loadbalancer.server.port=423"
|
||||
```
|
||||
|
||||
??? info "`traefik.tcp.services.<service_name>.loadbalancer.terminationdelay`"
|
||||
|
||||
|
||||
See [termination delay](../services/index.md#termination-delay) for more information.
|
||||
|
||||
|
||||
```yaml
|
||||
- "traefik.tcp.services.mytcpservice.loadbalancer.terminationdelay=100"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -52,6 +52,8 @@ add labels starting with `traefik.http.routers.{router-name-of-your-choice}.` an
|
|||
|
||||
For example, to change the routing rule, you could add the label ```"traefik.http.routers.routername.rule": "Host(`mydomain.com`)"```.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the router name `<router_name>`."
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.rule`"
|
||||
|
||||
See [rule](../routers/index.md#rule) for more information.
|
||||
|
|
@ -126,7 +128,7 @@ For example, to change the routing rule, you could add the label ```"traefik.htt
|
|||
|
||||
??? info "`traefik.http.routers.<router_name>.priority`"
|
||||
|
||||
See [options](../routers/index.md#priority) for more information.
|
||||
See [priority](../routers/index.md#priority) for more information.
|
||||
|
||||
```json
|
||||
"traefik.http.routers.myrouter.priority": "42"
|
||||
|
|
@ -139,6 +141,8 @@ add labels starting with `traefik.http.services.{service-name-of-your-choice}.`,
|
|||
|
||||
For example, to change the passHostHeader behavior, you'd add the label `"traefik.http.services.servicename.loadbalancer.passhostheader": "false"`.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the service name `<service_name>`."
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.server.port`"
|
||||
|
||||
Registers a port.
|
||||
|
|
@ -268,6 +272,8 @@ For example, to declare a middleware [`redirectscheme`](../../middlewares/redire
|
|||
|
||||
More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
|
||||
|
||||
!!! warning "The character `@` is not authorized in the middleware name."
|
||||
|
||||
??? example "Declaring and Referencing a Middleware"
|
||||
|
||||
```json
|
||||
|
|
|
|||
|
|
@ -57,6 +57,8 @@ To update the configuration of the Router automatically attached to the containe
|
|||
|
||||
For example, to change the rule, you could add the label ```traefik.http.routers.my-container.rule=Host(`mydomain.com`)```.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the router name `<router_name>`."
|
||||
|
||||
??? info "`traefik.http.routers.<router_name>.rule`"
|
||||
|
||||
See [rule](../routers/index.md#rule) for more information.
|
||||
|
|
@ -131,7 +133,7 @@ For example, to change the rule, you could add the label ```traefik.http.routers
|
|||
|
||||
??? info "`traefik.http.routers.<router_name>.priority`"
|
||||
|
||||
See [options](../routers/index.md#priority) for more information.
|
||||
See [priority](../routers/index.md#priority) for more information.
|
||||
|
||||
```yaml
|
||||
- "traefik.http.routers.myrouter.priority=42"
|
||||
|
|
@ -145,6 +147,8 @@ add labels starting with `traefik.http.services.{name-of-your-choice}.`, followe
|
|||
For example, to change the `passHostHeader` behavior,
|
||||
you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the service name `<service_name>`."
|
||||
|
||||
??? info "`traefik.http.services.<service_name>.loadbalancer.server.port`"
|
||||
|
||||
Registers a port.
|
||||
|
|
@ -274,6 +278,8 @@ For example, to declare a middleware [`redirectscheme`](../../middlewares/redire
|
|||
|
||||
More information about available middlewares in the dedicated [middlewares section](../../middlewares/overview.md).
|
||||
|
||||
!!! warning "The character `@` is not authorized in the middleware name."
|
||||
|
||||
??? example "Declaring and Referencing a Middleware"
|
||||
|
||||
```yaml
|
||||
|
|
|
|||
|
|
@ -7,9 +7,8 @@ There are, however, exceptions when using label-based configurations:
|
|||
and a label defines a service (e.g. implicitly through a loadbalancer server port value),
|
||||
but the router does not specify any service,
|
||||
then that service is automatically assigned to the router.
|
||||
1. If a label defines a router (e.g. through a router Rule)
|
||||
but no service is defined, then a service is automatically created
|
||||
and assigned to the router.
|
||||
1. If a label defines a router (e.g. through a router Rule) but no service is defined,
|
||||
then a service is automatically created and assigned to the router.
|
||||
|
||||
!!! info ""
|
||||
As one would expect, in either of these cases, if in addition a service is specified for the router,
|
||||
|
|
|
|||
|
|
@ -84,6 +84,8 @@ In the process, routers may use pieces of [middleware](../../middlewares/overvie
|
|||
|
||||
## Configuring HTTP Routers
|
||||
|
||||
!!! warning "The character `@` is not authorized in the router name"
|
||||
|
||||
### EntryPoints
|
||||
|
||||
If not specified, HTTP routers will accept requests from all defined entry points.
|
||||
|
|
@ -203,9 +205,14 @@ If you want to limit the router scope to a set of entry points, set the `entryPo
|
|||
|
||||
### Rule
|
||||
|
||||
Rules are a set of matchers that determine if a particular request matches specific criteria.
|
||||
Rules are a set of matchers configured with values, that determine if a particular request matches specific criteria.
|
||||
If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.
|
||||
|
||||
??? tip "Backticks or Quotes?"
|
||||
To set the value of a rule, use [backticks](https://en.wiktionary.org/wiki/backtick) ``` ` ``` or escaped double-quotes `\"`.
|
||||
|
||||
Single quotes `'` are not accepted as values are [Golang's String Literals](https://golang.org/ref/spec#String_literals).
|
||||
|
||||
!!! example "Host is traefik.io"
|
||||
|
||||
```toml
|
||||
|
|
@ -337,6 +344,8 @@ A value of `0` for the priority is ignored: `priority = 0` means that the defaul
|
|||
You can attach a list of [middlewares](../../middlewares/overview.md) to each HTTP router.
|
||||
The middlewares will take effect only if the rule matches, and before forwarding the request to the service.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the middleware name."
|
||||
|
||||
!!! tip "Middlewares order"
|
||||
|
||||
Middlewares are applied in the same order as their declaration in **router**.
|
||||
|
|
@ -376,6 +385,8 @@ but there are exceptions for label-based providers.
|
|||
See the specific [docker](../providers/docker.md#service-definition), [rancher](../providers/rancher.md#service-definition),
|
||||
or [marathon](../providers/marathon.md#service-definition) documentation.
|
||||
|
||||
!!! warning "The character `@` is not authorized in the middleware name."
|
||||
|
||||
!!! important "HTTP routers can only target HTTP services (not TCP services)."
|
||||
|
||||
### TLS
|
||||
|
|
@ -624,6 +635,8 @@ The [supported `provider` table](../../https/acme.md#providers) indicates if the
|
|||
|
||||
## Configuring TCP Routers
|
||||
|
||||
!!! warning "The character `@` is not authorized in the router name"
|
||||
|
||||
### General
|
||||
|
||||
If both HTTP routers and TCP routers listen to the same entry points, the TCP routers will apply *before* the HTTP routers.
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{
|
||||
"extends": "../../../.markdownlint.json",
|
||||
"MD024": false
|
||||
"MD024": false,
|
||||
"MD046": false
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,9 +5,9 @@ Configuring How to Reach the Services
|
|||
|
||||
|
||||
|
||||
The `Services` are responsible for configuring how to reach the actual services that will eventually handle the incoming requests.
|
||||
The `Services` are responsible for configuring how to reach the actual services that will eventually handle the incoming requests.
|
||||
|
||||
## Configuration Example
|
||||
## Configuration Examples
|
||||
|
||||
??? example "Declaring an HTTP Service with Two Servers -- Using the [File Provider](../../providers/file.md)"
|
||||
|
||||
|
|
@ -17,11 +17,11 @@ The `Services` are responsible for configuring how to reach the actual services
|
|||
[http.services.my-service.loadBalancer]
|
||||
|
||||
[[http.services.my-service.loadBalancer.servers]]
|
||||
url = "http://private-ip-server-1/"
|
||||
url = "http://<private-ip-server-1>:<private-port-server-1>/"
|
||||
[[http.services.my-service.loadBalancer.servers]]
|
||||
url = "http://private-ip-server-2/"
|
||||
url = "http://<private-ip-server-2>:<private-port-server-2>/"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -29,8 +29,8 @@ The `Services` are responsible for configuring how to reach the actual services
|
|||
my-service:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "http://private-ip-server-1/"
|
||||
- url: "http://private-ip-server-2/"
|
||||
- url: "http://<private-ip-server-1>:<private-port-server-1>/"
|
||||
- url: "http://<private-ip-server-2>:<private-port-server-2>/"
|
||||
```
|
||||
|
||||
??? example "Declaring a TCP Service with Two Servers -- Using the [File Provider](../../providers/file.md)"
|
||||
|
|
@ -40,26 +40,28 @@ The `Services` are responsible for configuring how to reach the actual services
|
|||
[tcp.services]
|
||||
[tcp.services.my-service.loadBalancer]
|
||||
[[tcp.services.my-service.loadBalancer.servers]]
|
||||
address = "xx.xx.xx.xx:xx"
|
||||
address = "<private-ip-server-1>:<private-port-server-1>"
|
||||
[[tcp.services.my-service.loadBalancer.servers]]
|
||||
address = "xx.xx.xx.xx:xx"
|
||||
address = "<private-ip-server-2>:<private-port-server-2>"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
tcp:
|
||||
services:
|
||||
my-service:
|
||||
loadBalancer:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- address: "xx.xx.xx.xx:xx"
|
||||
- address: "xx.xx.xx.xx:xx"
|
||||
- address: "<private-ip-server-1>:<private-port-server-1>"
|
||||
- address: "<private-ip-server-2>:<private-port-server-2>"
|
||||
```
|
||||
|
||||
## Configuring HTTP Services
|
||||
|
||||
### Servers Load Balancer
|
||||
|
||||
The load balancers are able to load balance the requests between multiple instances of your programs.
|
||||
The load balancers are able to load balance the requests between multiple instances of your programs.
|
||||
|
||||
Each service has a load-balancer, even if there is only one server to forward traffic to.
|
||||
|
||||
??? example "Declaring a Service with Two Servers (with Load Balancing) -- Using the [File Provider](../../providers/file.md)"
|
||||
|
||||
|
|
@ -87,10 +89,10 @@ The load balancers are able to load balance the requests between multiple instan
|
|||
#### Servers
|
||||
|
||||
Servers declare a single instance of your program.
|
||||
The `url` option point to a specific instance.
|
||||
The `url` option point to a specific instance.
|
||||
|
||||
!!! info ""
|
||||
Paths in the servers' `url` have no effect.
|
||||
Paths in the servers' `url` have no effect.
|
||||
If you want the requests to be sent to a specific path on your servers,
|
||||
configure your [`routers`](../routers/index.md) to use a corresponding [middleware](../../middlewares/overview.md) (e.g. the [AddPrefix](../../middlewares/addprefix.md) or [ReplacePath](../../middlewares/replacepath.md)) middlewares.
|
||||
|
||||
|
|
@ -103,7 +105,7 @@ The `url` option point to a specific instance.
|
|||
[[http.services.my-service.loadBalancer.servers]]
|
||||
url = "http://private-ip-server-1/"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -142,21 +144,21 @@ For now, only round robin load balancing is supported:
|
|||
```
|
||||
|
||||
#### Sticky sessions
|
||||
|
||||
|
||||
When sticky sessions are enabled, a cookie is set on the initial request to track which server handles the first response.
|
||||
On subsequent requests, the client is forwarded to the same server.
|
||||
|
||||
!!! info "Stickiness & Unhealthy Servers"
|
||||
|
||||
|
||||
If the server specified in the cookie becomes unhealthy, the request will be forwarded to a new server (and the cookie will keep track of the new server).
|
||||
|
||||
!!! info "Cookie Name"
|
||||
|
||||
!!! info "Cookie Name"
|
||||
|
||||
The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
|
||||
|
||||
!!! info "Secure & HTTPOnly flags"
|
||||
|
||||
By default, the affinity cookie is created without those flags. One however can change that through configuration.
|
||||
By default, the affinity cookie is created without those flags. One however can change that through configuration.
|
||||
|
||||
??? example "Adding Stickiness -- Using the [File Provider](../../providers/file.md)"
|
||||
|
||||
|
|
@ -166,7 +168,7 @@ On subsequent requests, the client is forwarded to the same server.
|
|||
[http.services.my-service]
|
||||
[http.services.my-service.loadBalancer.sticky.cookie]
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -223,8 +225,8 @@ Below are the available options for the health check mechanism:
|
|||
The interval must be greater than the timeout. If configuration doesn't reflect this, the interval will be set to timeout + 1 second.
|
||||
|
||||
!!! info "Recovering Servers"
|
||||
|
||||
Traefik keeps monitoring the health of unhealthy servers.
|
||||
|
||||
Traefik keeps monitoring the health of unhealthy servers.
|
||||
If a server has recovered (returning `2xx` -> `3xx` responses again), it will be added back to the load balacer rotation pool.
|
||||
|
||||
??? example "Custom Interval & Timeout -- Using the [File Provider](../../providers/file.md)"
|
||||
|
|
@ -261,7 +263,7 @@ Below are the available options for the health check mechanism:
|
|||
path = "/health"
|
||||
port = 8080
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -283,7 +285,7 @@ Below are the available options for the health check mechanism:
|
|||
path = "/health"
|
||||
scheme = "http"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -308,7 +310,7 @@ Below are the available options for the health check mechanism:
|
|||
My-Custom-Header = "foo"
|
||||
My-Header = "bar"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -337,7 +339,7 @@ By default, `passHostHeader` is true.
|
|||
[http.services.Service01.loadBalancer]
|
||||
passHostHeader = false
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -346,7 +348,7 @@ By default, `passHostHeader` is true.
|
|||
loadBalancer:
|
||||
passHostHeader: false
|
||||
```
|
||||
|
||||
|
||||
#### Response Forwarding
|
||||
|
||||
This section is about configuring how Traefik forwards the response from the backend server to the client.
|
||||
|
|
@ -358,7 +360,7 @@ Below are the available options for the Response Forwarding mechanism:
|
|||
A negative value means to flush immediately after each write to the client.
|
||||
The FlushInterval is ignored when ReverseProxy recognizes a response as a streaming response;
|
||||
for such responses, writes are flushed to the client immediately.
|
||||
|
||||
|
||||
??? example "Using a custom FlushInterval -- Using the [File Provider](../../providers/file.md)"
|
||||
|
||||
```toml tab="TOML"
|
||||
|
|
@ -368,7 +370,7 @@ Below are the available options for the Response Forwarding mechanism:
|
|||
[http.services.Service-1.loadBalancer.responseForwarding]
|
||||
flushInterval = "1s"
|
||||
```
|
||||
|
||||
|
||||
```yaml tab="YAML"
|
||||
## Dynamic configuration
|
||||
http:
|
||||
|
|
@ -378,7 +380,7 @@ Below are the available options for the Response Forwarding mechanism:
|
|||
responseForwarding:
|
||||
flushInterval: 1s
|
||||
```
|
||||
|
||||
|
||||
### Weighted Round Robin (service)
|
||||
|
||||
The WRR is able to load balance the requests between multiple services based on weights.
|
||||
|
|
@ -539,7 +541,7 @@ The `address` option (IP:Port) point to a specific instance.
|
|||
my-service:
|
||||
loadBalancer:
|
||||
servers:
|
||||
address: "xx.xx.xx.xx:xx"
|
||||
- address: "xx.xx.xx.xx:xx"
|
||||
```
|
||||
|
||||
#### Termination Delay
|
||||
|
|
|
|||
|
|
@ -101,4 +101,4 @@ curl [-k] https://your.domain.com/tls
|
|||
curl [-k] http://your.domain.com:8000/notls
|
||||
```
|
||||
|
||||
Note that you'll have to use `-k` as long as you're using the staging server of Let's Encrypt, since it is not in the root DNS servers.
|
||||
Note that you'll have to use `-k` as long as you're using the staging server of Let's Encrypt, since it is not an authorized certificate authority on systems where it hasn't been manually added.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue