EntryPoints

Opening Connections for Incoming Requests

entryPoints

EntryPoints are the network entry points into Traefik. They define the port which will receive the packets, and whether to listen for TCP or UDP.

Configuration Examples

Port 80 only

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.    address: ":80"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"

CLI

  1. ## Static configuration
  2. --entryPoints.web.address=:80

We define an entrypoint called web that will listen on port 80.

Port 80 & 443

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  6.   websecure:
  7.     address: ":443"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.   [entryPoints.websecure]
  7.     address = ":443"

CLI

  1. ## Static configuration
  2. --entryPoints.web.address=:80
  3. --entryPoints.websecure.address=:443
  • Two entrypoints are defined: one called web, and the other called websecure.
  • web listens on port 80, and websecure on port 443.

UDP on port 1704

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   streaming:
  4.     address: ":1704/udp"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.streaming]
  4.     address = ":1704/udp"

CLI

  1. ## Static configuration
  2. --entryPoints.streaming.address=:1704/udp

Configuration

General

EntryPoints are part of the static configuration. They can be defined by using a file (YAML or TOML) or CLI arguments.

See the complete reference for the list of available options

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888" # same as ":8888/tcp"
  5.     http2:
  6.       maxConcurrentStreams: 42
  7.     http3:
  8.       advertisedPort: 8888
  9.     transport:
  10.       lifeCycle:
  11.         requestAcceptGraceTimeout: 42
  12.         graceTimeOut: 42
  13.       respondingTimeouts:
  14.         readTimeout: 42
  15.         writeTimeout: 42
  16.         idleTimeout: 42
  17.     proxyProtocol:
  18.       insecure: true
  19.       trustedIPs:
  20.         - "127.0.0.1"
  21.         - "192.168.0.1"
  22.     forwardedHeaders:
  23.       insecure: true
  24.       trustedIPs:
  25.         - "127.0.0.1"
  26.         - "192.168.0.1"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888" # same as ":8888/tcp"
  5.     [entryPoints.name.http2]
  6.       maxConcurrentStreams = 42
  7.     [entryPoints.name.http3]
  8.       advertisedPort = 8888
  9.     [entryPoints.name.transport]
  10.       [entryPoints.name.transport.lifeCycle]
  11.         requestAcceptGraceTimeout = 42
  12.         graceTimeOut = 42
  13.       [entryPoints.name.transport.respondingTimeouts]
  14.         readTimeout = 42
  15.         writeTimeout = 42
  16.         idleTimeout = 42
  17.     [entryPoints.name.proxyProtocol]
  18.       insecure = true
  19.       trustedIPs = ["127.0.0.1", "192.168.0.1"]
  20.     [entryPoints.name.forwardedHeaders]
  21.       insecure = true
  22.       trustedIPs = ["127.0.0.1", "192.168.0.1"]

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888 # same as :8888/tcp
  3. --entryPoints.name.http2.maxConcurrentStreams=42
  4. --entryPoints.name.http3.advertisedport=8888
  5. --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
  6. --entryPoints.name.transport.lifeCycle.graceTimeOut=42
  7. --entryPoints.name.transport.respondingTimeouts.readTimeout=42
  8. --entryPoints.name.transport.respondingTimeouts.writeTimeout=42
  9. --entryPoints.name.transport.respondingTimeouts.idleTimeout=42
  10. --entryPoints.name.proxyProtocol.insecure=true
  11. --entryPoints.name.proxyProtocol.trustedIPs=127.0.0.1,192.168.0.1
  12. --entryPoints.name.forwardedHeaders.insecure=true
  13. --entryPoints.name.forwardedHeaders.trustedIPs=127.0.0.1,192.168.0.1

Address

The address defines the port, and optionally the hostname, on which to listen for incoming connections and packets. It also defines the protocol to use (TCP or UDP). If no protocol is specified, the default is TCP. The format is:

  1. [host]:port[/tcp|/udp]

If both TCP and UDP are wanted for the same port, two entryPoints definitions are needed, such as in the example below.

Both TCP and UDP on Port 3179

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   tcpep:
  4.    address: ":3179"
  5.   udpep:
  6.    address: ":3179/udp"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.tcpep]
  4.     address = ":3179"
  5.   [entryPoints.udpep]
  6.     address = ":3179/udp"

CLI

  1. ## Static configuration
  2. --entryPoints.tcpep.address=:3179
  3. --entryPoints.udpep.address=:3179/udp

Listen on Specific IP Addresses Only

File (yaml)

  1. entryPoints:
  2.   specificIPv4:
  3.     address: "192.168.2.7:8888"
  4.   specificIPv6:
  5.     address: "[2001:db8::1]:8888"

File (TOML)

  1. [entryPoints.specificIPv4]
  2.   address = "192.168.2.7:8888"
  3. [entryPoints.specificIPv6]
  4.   address = "[2001:db8::1]:8888"

CLI

  1. --entryPoints.specificIPv4.address=192.168.2.7:8888
  2. --entryPoints.specificIPv6.address=[2001:db8::1]:8888

Full details for how to specify address can be found in net.Listen (and net.Dial) of the doc for go.

AllowACMEByPass

Optional, Default=false

allowACMEByPass determines whether a user defined router can handle ACME TLS or HTTP challenges instead of the Traefik dedicated one. This option can be used when a Traefik instance has one or more certificate resolvers configured, but is also used to route challenges connections/requests to services that could also initiate their own ACME challenges.

No Certificate Resolvers configured

It is not necessary to use the `allowACMEByPass’ option certificate option if no certificate resolver is defined. In fact, Traefik will automatically allow ACME TLS or HTTP requests to be handled by custom routers in this case, since there can be no concurrency with its own challenge handlers.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     allowACMEByPass: true

File (TOML)

  1. [entryPoints.foo]
  2.   [entryPoints.foo.allowACMEByPass]
  3.     allowACMEByPass = true

CLI

  1. --entryPoints.name.allowACMEByPass=true

ReusePort

Optional, Default=false

The ReusePort option enables EntryPoints from the same or different processes listening on the same TCP/UDP port by utilizing the SO_REUSEPORT socket option. It also allows the kernel to act like a load balancer to distribute incoming connections between entry points.

For example, you can use it with the transport.lifeCycle to do canary deployments against Traefik itself. Like upgrading Traefik version or reloading the static configuration without any service downtime.

Supported platforms

The ReusePort option currently works only on Linux, FreeBSD, OpenBSD and Darwin. It will be ignored on other platforms.

There is a known bug in the Linux kernel that may cause unintended TCP connection failures when using the ReusePort option. For more details, see https://lwn.net/Articles/853637/.

Listen on the same port

File (yaml)

  1. entryPoints:
  2.   web:
  3.     address: ":80"
  4.     reusePort: true

File (TOML)

  1. [entryPoints.web]
  2.   address = ":80"
  3.   reusePort = true

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.web.reusePort=true

Now it is possible to run multiple Traefik processes with the same EntryPoint configuration.

Listen on the same port but bind to a different host

File (yaml)

  1. entryPoints:
  2.   web:
  3.     address: ":80"
  4.     reusePort: true
  5.   privateWeb:
  6.     address: "192.168.1.2:80"
  7.     reusePort: true

File (TOML)

  1. [entryPoints.web]
  2.   address = ":80"
  3.   reusePort = true
  4. [entryPoints.privateWeb]
  5.   address = "192.168.1.2:80"
  6.   reusePort = true

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.web.reusePort=true
  3. --entryPoints.privateWeb.address=192.168.1.2:80
  4. --entryPoints.privateWeb.reusePort=true

Requests to 192.168.1.2:80 will only be handled by routers that have privateWeb as the entry point.

AsDefault

Optional, Default=false

The AsDefault option marks the EntryPoint to be in the list of default EntryPoints. EntryPoints in this list are used (by default) on HTTP and TCP routers that do not define their own EntryPoints option.

List of default EntryPoints

If there is no EntryPoint with the AsDefault option set to true, then the list of default EntryPoints includes all HTTP/TCP EntryPoints.

If at least one EntryPoint has the AsDefault option set to true, then the list of default EntryPoints includes only EntryPoints that have the AsDefault option set to true.

Some built-in EntryPoints are always excluded from the list, namely: traefik.

Only TCP and HTTP

The AsDefault option has no effect on UDP EntryPoints. When a UDP router does not define the EntryPoints option, it is attached to all available UDP EntryPoints.

Defining only one EntryPoint as default

File (yaml)

  1. entryPoints:
  2.   web:
  3.     address: ":80"
  4.   websecure:
  5.     address: ":443"
  6.     asDefault: true

File (TOML)

  1. [entryPoints.web]
  2.   address = ":80"
  3. [entryPoints.websecure]
  4.   address = ":443"
  5.   asDefault = true

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.websecure.address=:443
  3. --entryPoints.websecure.asDefault=true

HTTP/2

maxConcurrentStreams

Optional, Default=250

maxConcurrentStreams specifies the number of concurrent streams per connection that each client is allowed to initiate. The maxConcurrentStreams value must be greater than zero.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     http2:
  4.       maxConcurrentStreams: 250

File (TOML)

  1. [entryPoints.foo]
  2.   [entryPoints.foo.http2]
  3.     maxConcurrentStreams = 250

CLI

  1. --entryPoints.name.http2.maxConcurrentStreams=250

HTTP/3

http3

http3 enables HTTP/3 protocol on the entryPoint. HTTP/3 requires a TCP entryPoint, as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this entryPoint is the same as the one used for TLS traffic.

File (YAML)

  1. entryPoints:
  2.   name:
  3.     http3: {}

File (TOML)

  1. [entryPoints.name.http3]

CLI

  1. --entryPoints.name.http3

HTTP/3 uses UDP+TLS

As HTTP/3 actually uses UDP, when traefik is configured with a TCP entryPoint on port N with HTTP/3 enabled, the underlying HTTP/3 server that is started automatically listens on UDP port N too. As a consequence, it means port N cannot be used by another UDP entryPoint. Since HTTP/3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP/3.

advertisedPort

http3.advertisedPort defines which UDP port to advertise as the HTTP/3 authority. It defaults to the entryPoint’s address port. It can be used to override the authority in the alt-svc header, for example if the public facing port is different from where Traefik is listening.

http3.advertisedPort

File (YAML)

  1. entryPoints:
  2.   name:
  3.     http3:
  4.       advertisedPort: 443

File (TOML)

  1. [entryPoints.name.http3]
  2.   advertisedPort = 443

CLI

  1. --entryPoints.name.http3.advertisedport=443

Forwarded Headers

You can configure Traefik to trust the forwarded headers information (X-Forwarded-*).

forwardedHeaders.trustedIPs

Trusting Forwarded Headers from specific IPs.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  5.     forwardedHeaders:
  6.       trustedIPs:
  7.         - "127.0.0.1/32"
  8.         - "192.168.1.7"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.     [entryPoints.web.forwardedHeaders]
  7.       trustedIPs = ["127.0.0.1/32", "192.168.1.7"]

CLI

  1. ## Static configuration
  2. --entryPoints.web.address=:80
  3. --entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7

forwardedHeaders.insecure

Insecure Mode (Always Trusting Forwarded Headers).

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  5.     forwardedHeaders:
  6.       insecure: true

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.     [entryPoints.web.forwardedHeaders]
  7.       insecure = true

CLI

  1. ## Static configuration
  2. --entryPoints.web.address=:80
  3. --entryPoints.web.forwardedHeaders.insecure

forwardedHeaders.connection

As per RFC7230, Traefik respects the Connection options from the client request. By doing so, it removes any header field(s) listed in the request Connection header and the Connection header field itself when empty. The removal happens as soon as the request is handled by Traefik, thus the removed headers are not available when the request passes through the middleware chain. The connection option lists the Connection headers allowed to passthrough the middleware chain before their removal.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  5.     forwardedHeaders:
  6.       connection:
  7.         - foobar

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.     [entryPoints.web.forwardedHeaders]
  7.       connection = ["foobar"]

CLI

  1. ## Static configuration
  2. --entryPoints.web.address=:80
  3. --entryPoints.web.forwardedHeaders.connection=foobar

Transport

respondingTimeouts

respondingTimeouts are timeouts for incoming requests to the Traefik instance. Setting them has no effect for UDP entryPoints.

transport.respondingTimeouts.readTimeout

Optional, Default=60s

readTimeout is the maximum duration for reading the entire request, including the body.

If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds. We strongly suggest to adapt this value accordingly to the your needs.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       respondingTimeouts:
  7.         readTimeout: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       [entryPoints.name.transport.respondingTimeouts]
  7.         readTimeout = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.respondingTimeouts.readTimeout=42

transport.respondingTimeouts.writeTimeout

Optional, Default=0s

writeTimeout is the maximum duration before timing out writes of the response.

It covers the time from the end of the request header read to the end of the response write. If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       respondingTimeouts:
  7.         writeTimeout: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       [entryPoints.name.transport.respondingTimeouts]
  7.         writeTimeout = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.respondingTimeouts.writeTimeout=42

transport.respondingTimeouts.idleTimeout

Optional, Default=180s

idleTimeout is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.

If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       respondingTimeouts:
  7.         idleTimeout: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       [entryPoints.name.transport.respondingTimeouts]
  7.         idleTimeout = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.respondingTimeouts.idleTimeout=42

lifeCycle

Controls the behavior of Traefik during the shutdown phase.

lifeCycle.requestAcceptGraceTimeout

Optional, Default=0s

Duration to keep accepting requests prior to initiating the graceful termination period (as defined by the graceTimeOut option). This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.

Can be provided in a format supported by time.ParseDuration or as raw values (digits).

If no units are provided, the value is parsed assuming seconds. The zero duration disables the request accepting grace period, i.e., Traefik will immediately proceed to the grace period.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       lifeCycle:
  7.         requestAcceptGraceTimeout: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       [entryPoints.name.transport.lifeCycle]
  7.         requestAcceptGraceTimeout = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42

lifeCycle.graceTimeOut

Optional, Default=10s

Duration to give active requests a chance to finish before Traefik stops.

Can be provided in a format supported by time.ParseDuration or as raw values (digits).

If no units are provided, the value is parsed assuming seconds.

In this time frame no new requests are accepted.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       lifeCycle:
  7.         graceTimeOut: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       [entryPoints.name.transport.lifeCycle]
  7.         graceTimeOut = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.lifeCycle.graceTimeOut=42

keepAliveMaxRequests

Optional, Default=0

The maximum number of requests Traefik can handle before sending a Connection: Close header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       keepAliveMaxRequests: 42

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       keepAliveMaxRequests = 42

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.keepAliveMaxRequests=42

keepAliveMaxTime

Optional, Default=0s

The maximum duration Traefik can handle requests before sending a Connection: Close header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   name:
  4.     address: ":8888"
  5.     transport:
  6.       keepAliveMaxTime: 42s

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.name]
  4.     address = ":8888"
  5.     [entryPoints.name.transport]
  6.       keepAliveMaxTime = "42s"

CLI

  1. ## Static configuration
  2. --entryPoints.name.address=:8888
  3. --entryPoints.name.transport.keepAliveMaxTime=42s

ProxyProtocol

Traefik supports PROXY protocol version 1 and 2.

If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.

If the PROXY protocol header is passed, then the version is determined automatically.

proxyProtocol.trustedIPs

Enabling PROXY protocol with Trusted IPs.

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  5.     proxyProtocol:
  6.       trustedIPs:
  7.         - "127.0.0.1/32"
  8.         - "192.168.1.7"

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.     [entryPoints.web.proxyProtocol]
  7.       trustedIPs = ["127.0.0.1/32", "192.168.1.7"]

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.7

IPs in trustedIPs only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.

proxyProtocol.insecure

Insecure Mode (Testing Environment Only).

In a test environments, you can configure Traefik to trust every incoming connection. Doing so, every remote client address will be replaced (trustedIPs won’t have any effect)

File (YAML)

  1. ## Static configuration
  2. entryPoints:
  3.   web:
  4.     address: ":80"
  5.     proxyProtocol:
  6.       insecure: true

File (TOML)

  1. ## Static configuration
  2. [entryPoints]
  3.   [entryPoints.web]
  4.     address = ":80"
  6.     [entryPoints.web.proxyProtocol]
  7.       insecure = true

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.web.proxyProtocol.insecure

Queuing Traefik behind Another Load Balancer

When queuing Traefik behind another load-balancer, make sure to configure PROXY protocol on both sides. Not doing so could introduce a security risk in your system (enabling request forgery).

HTTP Options

This whole section is dedicated to options, keyed by entry point, that will apply only to HTTP routing.

Redirection

HTTPS redirection (80 to 443)

File (YAML)

  1. entryPoints:
  2.   web:
  3.     address: :80
  4.     http:
  5.       redirections:
  6.         entryPoint:
  7.           to: websecure
  8.           scheme: https
  10.   websecure:
  11.     address: :443

File (TOML)

  1. [entryPoints.web]
  2.   address = ":80"
  4.   [entryPoints.web.http]
  5.     [entryPoints.web.http.redirections]
  6.       [entryPoints.web.http.redirections.entryPoint]
  7.         to = "websecure"
  8.         scheme = "https"
  10. [entryPoints.websecure]
  11.   address = ":443"

CLI

  1. --entryPoints.web.address=:80
  2. --entryPoints.web.http.redirections.entryPoint.to=websecure
  3. --entryPoints.web.http.redirections.entryPoint.scheme=https
  4. --entryPoints.websecure.address=:443

entryPoint

This section is a convenience to enable (permanent) redirecting of all incoming requests on an entry point (e.g. port 80) to another entry point (e.g. port 443) or an explicit port (:443).

entryPoint.to

Required

The target element, it can be:

  • an entry point name (ex: websecure)
  • a port (:443)

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     # ...
  4.     http:
  5.       redirections:
  6.         entryPoint:
  7.           to: websecure

File (TOML)

  1. [entryPoints.foo]
  2.   # ...
  3.   [entryPoints.foo.http.redirections]
  4.     [entryPoints.foo.http.redirections.entryPoint]
  5.       to = "websecure"

CLI

  1. --entryPoints.foo.http.redirections.entryPoint.to=websecure

entryPoint.scheme

Optional, Default=”https”

The redirection target scheme.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     # ...
  4.     http:
  5.       redirections:
  6.         entryPoint:
  7.           # ...
  8.           scheme: https

File (TOML)

  1. [entryPoints.foo]
  2.   # ...
  3.   [entryPoints.foo.http.redirections]
  4.     [entryPoints.foo.http.redirections.entryPoint]
  5.       # ...
  6.       scheme = "https"

CLI

  1. --entryPoints.foo.http.redirections.entryPoint.scheme=https

entryPoint.permanent

Optional, Default=true

To apply a permanent redirection.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     # ...
  4.     http:
  5.       redirections:
  6.         entryPoint:
  7.           # ...
  8.           permanent: true

File (TOML)

  1. [entryPoints.foo]
  2.   # ...
  3.   [entryPoints.foo.http.redirections]
  4.     [entryPoints.foo.http.redirections.entryPoint]
  5.       # ...
  6.       permanent = true

CLI

  1. --entryPoints.foo.http.redirections.entrypoint.permanent=true

entryPoint.priority

Optional, Default=MaxInt-1

Priority of the generated router.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     # ...
  4.     http:
  5.       redirections:
  6.         entryPoint:
  7.           # ...
  8.           priority: 10

File (TOML)

  1. [entryPoints.foo]
  2.   # ...
  3.   [entryPoints.foo.http.redirections]
  4.     [entryPoints.foo.http.redirections.entryPoint]
  5.       # ...
  6.       priority = 10

CLI

  1. --entryPoints.foo.http.redirections.entrypoint.priority=10

EncodeQuerySemicolons

Optional, Default=false

The encodeQuerySemicolons option allows to enable query semicolons encoding. One could use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik. When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.

File (YAML)

  1. entryPoints:
  2.   websecure:
  3.     address: ':443'
  4.     http:
  5.       encodeQuerySemicolons: true

File (TOML)

  1. [entryPoints.websecure]
  2.   address = ":443"
  4.   [entryPoints.websecure.http]
  5.     encodeQuerySemicolons = true

CLI

  1. --entryPoints.websecure.address=:443
  2. --entryPoints.websecure.http.encodequerysemicolons=true

Examples

EncodeQuerySemicolonsRequest QueryResulting Request Query
falsefoo=bar;baz=barfoo=bar&baz=bar
truefoo=bar;baz=barfoo=bar%3Bbaz=bar
falsefoo=bar&baz=bar;foofoo=bar&baz=bar&foo
truefoo=bar&baz=bar;foofoo=bar&baz=bar%3Bfoo

Middlewares

The list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.

File (YAML)

  1. entryPoints:
  2.   websecure:
  3.     address: ':443'
  4.     http:
  5.       middlewares:
  6.         - auth@file
  7.         - strip@file

File (TOML)

  1. [entryPoints.websecure]
  2.   address = ":443"
  4.   [entryPoints.websecure.http]
  5.     middlewares = ["auth@file", "strip@file"]

CLI

  1. --entryPoints.websecure.address=:443
  2. --entryPoints.websecure.http.middlewares=auth@file,strip@file

TLS

This section is about the default TLS configuration applied to all routers associated with the named entry point.

If a TLS section (i.e. any of its fields) is user-defined, then the default configuration does not apply at all.

The TLS section is the same as the TLS section on HTTP routers.

File (YAML)

  1. entryPoints:
  2.   websecure:
  3.     address: ':443'
  4.     http:
  5.       tls:
  6.         options: foobar
  7.         certResolver: leresolver
  8.         domains:
  9.           - main: example.com
  10.             sans:
  11.               - foo.example.com
  12.               - bar.example.com
  13.           - main: test.com
  14.             sans:
  15.               - foo.test.com
  16.               - bar.test.com

File (TOML)

  1. [entryPoints.websecure]
  2.   address = ":443"
  4.     [entryPoints.websecure.http.tls]
  5.       options = "foobar"
  6.       certResolver = "leresolver"
  7.       [[entryPoints.websecure.http.tls.domains]]
  8.         main = "example.com"
  9.         sans = ["foo.example.com", "bar.example.com"]
  10.       [[entryPoints.websecure.http.tls.domains]]
  11.         main = "test.com"
  12.         sans = ["foo.test.com", "bar.test.com"]

CLI

  1. --entryPoints.websecure.address=:443
  2. --entryPoints.websecure.http.tls.options=foobar
  3. --entryPoints.websecure.http.tls.certResolver=leresolver
  4. --entryPoints.websecure.http.tls.domains[0].main=example.com
  5. --entryPoints.websecure.http.tls.domains[0].sans=foo.example.com,bar.example.com
  6. --entryPoints.websecure.http.tls.domains[1].main=test.com
  7. --entryPoints.websecure.http.tls.domains[1].sans=foo.test.com,bar.test.com

Let’s Encrypt

File (YAML)

  1. entryPoints:
  2.   websecure:
  3.     address: ':443'
  4.     http:
  5.       tls:
  6.         certResolver: leresolver

File (TOML)

  1. [entryPoints.websecure]
  2.   address = ":443"
  4.     [entryPoints.websecure.http.tls]
  5.       certResolver = "leresolver"

CLI

  1. --entryPoints.websecure.address=:443
  2. --entryPoints.websecure.http.tls.certResolver=leresolver

UDP Options

This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing.

Timeout

Optional, Default=3s

Timeout defines how long to wait on an idle session before releasing the related resources. The Timeout value must be greater than zero.

File (YAML)

  1. entryPoints:
  2.   foo:
  3.     address: ':8000/udp'
  4.     udp:
  5.       timeout: 10s

File (TOML)

  1. [entryPoints.foo]
  2.   address = ":8000/udp"
  4.     [entryPoints.foo.udp]
  5.       timeout = "10s"

CLI

  1. --entryPoints.foo.address=:8000/udp
  2. --entryPoints.foo.udp.timeout=10s

Using Traefik OSS in Production?

If you are using Traefik at work, consider adding enterprise-grade API gateway capabilities or commercial support for Traefik OSS.

Adding API Gateway capabilities to Traefik OSS is fast and seamless. There’s no rip and replace and all configurations remain intact. See it in action via this short video.

Systemd Socket Activation

Traefik supports systemd socket activation.

When a socket activation file descriptor name matches an EntryPoint name, the corresponding file descriptor will be used as the TCP listener for the matching EntryPoint.

  1. systemd-socket-activate -l 80 -l 443 --fdname web:websecure  ./traefik --entrypoints.web --entrypoints.websecure

EntryPoint Address

When a socket activation file descriptor name matches an EntryPoint name its address configuration is ignored.

TCP Only

Socket activation is not yet supported with UDP entryPoints.

Docker Support

Socket activation is not supported by Docker but works with Podman containers.