Merge branch 'v2.0' into master
This commit is contained in:
Fernandez Ludovic
commit
d66dd01438
46 changed files with 911 additions and 484 deletions
|
|
@ -14,7 +14,7 @@ In production, it should be at least secured by authentication and authorization
|
|||
A good sane default (non exhaustive) set of recommendations
|
||||
would be to apply the following protection mechanisms:
|
||||
|
||||
* At the transport level:
|
||||
* At the transport level:
|
||||
NOT publicly exposing the API's port,
|
||||
keeping it restricted to internal networks
|
||||
(as in the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), applied to networks).
|
||||
|
|
@ -23,13 +23,16 @@ would be to apply the following protection mechanisms:
|
|||
|
||||
If you enable the API, a new special `service` named `api@internal` is created and can then be referenced in a router.
|
||||
|
||||
To enable the API handler:
|
||||
To enable the API handler, use the following option on the
|
||||
[static configuration](../getting-started/configuration-overview.md#the-static-configuration):
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Static Configuration
|
||||
[api]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Static Configuration
|
||||
api: {}
|
||||
```
|
||||
|
||||
|
|
@ -37,11 +40,13 @@ api: {}
|
|||
--api=true
|
||||
```
|
||||
|
||||
And then you will be able to reference it like this:
|
||||
And then define a routing configuration on Traefik itself with the
|
||||
[dynamic configuration](../getting-started/configuration-overview.md#the-dynamic-configuration):
|
||||
|
||||
```yaml tab="Docker"
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
|
|
@ -57,40 +62,42 @@ labels:
|
|||
|
||||
```json tab="Marathon"
|
||||
"labels": {
|
||||
"traefik.http.routers.api.rule": "PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
"traefik.http.routers.api.service": "api@internal"
|
||||
"traefik.http.routers.api.middlewares": "auth"
|
||||
"traefik.http.routers.api.rule": "Host(`traefik.domain.com`)",
|
||||
"traefik.http.routers.api.service": "api@internal",
|
||||
"traefik.http.routers.api.middlewares": "auth",
|
||||
"traefik.http.middlewares.auth.basicauth.users": "test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
}
|
||||
```
|
||||
|
||||
```yaml tab="Rancher"
|
||||
# Declaring the user list
|
||||
# Dynamic Configuration
|
||||
labels:
|
||||
- "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
- "traefik.http.routers.api.rule=Host(`traefik.domain.com`)
|
||||
- "traefik.http.routers.api.service=api@internal"
|
||||
- "traefik.http.routers.api.middlewares=auth"
|
||||
- "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
```toml tab="File (TOML)"
|
||||
# Dynamic Configuration
|
||||
[http.routers.my-api]
|
||||
rule="PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
|
||||
rule="Host(`traefik.domain.com`)
|
||||
service="api@internal"
|
||||
middlewares=["auth"]
|
||||
|
||||
[http.middlewares.auth.basicAuth]
|
||||
users = [
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
|
||||
"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
|
||||
]
|
||||
```
|
||||
|
||||
```yaml tab="File (YAML)"
|
||||
# Dynamic Configuration
|
||||
http:
|
||||
routers:
|
||||
api:
|
||||
rule: PathPrefix(`/api`) || PathPrefix(`/dashboard`)
|
||||
rule: Host(`traefik.domain.com`)
|
||||
service: api@internal
|
||||
middlewares:
|
||||
- auth
|
||||
|
|
@ -98,10 +105,32 @@ http:
|
|||
auth:
|
||||
basicAuth:
|
||||
users:
|
||||
- "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
- "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
|
||||
- "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
|
||||
```
|
||||
|
||||
??? warning "The router's [rule](../../routing/routers#rule) must catch requests for the URI path `/api`"
|
||||
Using an "Host" rule is recommended, by catching all the incoming traffic on this host domain to the API.
|
||||
However, you can also use "path prefix" rule or any combination or rules.
|
||||
|
||||
```bash tab="Host Rule"
|
||||
# Matches http://traefik.domain.com, http://traefik.domain.com/api
|
||||
# or http://traefik.domain.com/hello
|
||||
rule = "Host(`traefik.domain.com`)"
|
||||
```
|
||||
|
||||
```bash tab="Path Prefix Rule"
|
||||
# Matches http://api.traefik.domain.com/api or http://domain.com/api
|
||||
# but does not match http://api.traefik.domain.com/hello
|
||||
rule = "PathPrefix(`/api`)"
|
||||
```
|
||||
|
||||
```bash tab="Combination of Rules"
|
||||
# Matches http://traefik.domain.com/api or http://traefik.domain.com/dashboard
|
||||
# but does not match http://traefik.domain.com/hello
|
||||
rule = "Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
|
||||
```
|
||||
|
||||
### `insecure`
|
||||
|
||||
Enable the API in `insecure` mode, which means that the API will be available directly on the entryPoint named `traefik`.
|
||||
|
|
@ -143,6 +172,9 @@ api:
|
|||
--api.dashboard=true
|
||||
```
|
||||
|
||||
!!! warning "With Dashboard enabled, the router [rule](../../routing/routers#rule) must catch requests for both `/api` and `/dashboard`"
|
||||
Please check the [Dashboard documentation](./dashboard.md#dashboard-router-rule) to learn more about this and to get examples.
|
||||
|
||||
### `debug`
|
||||
|
||||
_Optional, Default=false_
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue