API

Traefik exposes a number of information through an API handler, such as the configuration of all routers, services, middlewares, etc.

As with all features of Traefik, this handler can be enabled with the static configuration.

Security

Enabling the API in production is not recommended, because it will expose all configuration elements,including sensitive data.

In production, it should be at least secured by authentication and authorizations.

A good sane default (non exhaustive) set of recommendationswould be to apply the following protection mechanisms:

• At the transport level:NOT publicly exposing the API's port,keeping it restricted to internal networks(as in the principle of least privilege, applied to networks).

Configuration

If you enable the API, a new special service named [email protected] is created and then can be reference in a router.

To enable the API handler:

[api]

api: {}

--api=true

And then you will able to reference it like this.

  - "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
  - "[email protected]"
  - "traefik.http.routers.api.middlewares=auth"
  - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

"labels": {
  "traefik.http.routers.api.rule": "PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
  "traefik.http.routers.api.service": "[email protected]"
  "traefik.http.routers.api.middlewares": "auth"
  "traefik.http.middlewares.auth.basicauth.users": "test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
}

# Declaring the user list
labels:
  - "traefik.http.routers.api.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
    - "[email protected]"
    - "traefik.http.routers.api.middlewares=auth"
    - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

[http.routers.my-api]
    rule="PathPrefix(`/api`) || PathPrefix(`/dashboard`)"
    service="[email protected]"
    middlewares=["auth"]
[http.middlewares.auth.basicAuth]
    users = [
        "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
        "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
      ]

http:
  routers:
    api:
      rule: PathPrefix(`/api`) || PathPrefix(`/dashboard`)
      service: [email protected]
      middlewares:
        - auth
  middlewares:
    auth:
      basicAuth:
        users:
        - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/" 
        - "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"

insecure

Enable the API in insecure mode, which means that the API will be available directly on the entryPoint named traefik.

Note

If the entryPoint named traefik is not configured, it will be automatically created on port 8080.

[api]
  insecure = true

api:
  insecure: true

--api.insecure=true

dashboard

Optional, Default=true

Enable the dashboard. More about the dashboard features here.

[api]
  dashboard = true

api:
  dashboard: true

--api.dashboard=true

debug

Optional, Default=false

Enable additional endpoints for debugging and profiling, served under /debug/.

[api]
  debug = true

api:
  debug: true

--api.debug=true

Endpoints

All the following endpoints must be accessed with a GET HTTP request.