API

    As with all features of Traefik, this handler can be enabled with the static configuration.

    Enabling the API in production is not recommended, because it will expose all configuration elements,including sensitive data.

    In production, it should be at least secured by authentication and authorizations.

    A good sane default (non exhaustive) set of recommendationswould be to apply the following protection mechanisms:

    • At the transport level:NOT publicly exposing the API's port,keeping it restricted to internal networks(as in the , applied to networks).

    If you enable the API, a new special named [email protected] is created and can then be referenced in a router.

    To enable the API handler, use the following option on the:

    1. # Static Configuration
    2. api: {}

    1. --api=true

    And then define a routing configuration on Traefik itself with thedynamic configuration:

    1. # Dynamic Configuration
    2. labels:
    3.   - "traefik.http.routers.api.rule=Host(`traefik.domain.com`)"
    4.   - ""
    5.   - "traefik.http.routers.api.middlewares=auth"
    6.   - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

    1. # Dynamic Configuration
    2. deploy:
    3.   labels:
    4.     - "traefik.http.routers.api.rule=Host(`traefik.domain.com`)"
    5.     - "[email protected]"
    6.     - "traefik.http.routers.api.middlewares=auth"
    7.     - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
    8.     # Dummy service for Swarm port detection. The port can be any valid integer value.
    9.     - "traefik.http.services.dummy-svc.loadbalancer.server.port=9999"

    1. apiVersion: traefik.containo.us/v1alpha1
    2. kind: IngressRoute
    3. metadata:
    4.   name: traefik-dashboard
    5. spec:
    6.   routes:
    7.   - match: Host(`traefik.domain.com`)
    8.     services:
    9.     - name: 
    10.       kind: TraefikService
    11. ---
    12. apiVersion: traefik.containo.us/v1alpha1
    13. kind: Middleware
    14. metadata:
    15.   name: auth
    16. spec:
    17.   basicAuth:
    18.     secret: secretName # Kubernetes secret named "secretName"
    1. # Dynamic Configuration
    2. - "traefik.http.routers.api.rule=Host(`traefik.domain.com`)"
    3. - "[email protected]"
    4. - "traefik.http.routers.api.middlewares=auth"

    1. # Dynamic Configuration
    2. labels:
    3.   - "traefik.http.routers.api.rule=Host(`traefik.domain.com`)"
    4.   - "traefik.http"
    5.   - "traefik.http.routers.api.middlewares=auth"
    6.   - "traefik.http.middlewares.auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"

    1. # Dynamic Configuration
    2. [http.routers.my-api]
    3.   rule = "Host(`traefik.domain.com`)"
    4.   service = "[email protected]"
    5.   middlewares = ["auth"]
    7. [http.middlewares.auth.basicAuth]
    8.   users = [
    9.     "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
    10.     "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",

    1. # Dynamic Configuration
    2. http:
    3.   routers:
    4.     api:
    5.       rule: Host(`traefik.domain.com`)
    6.       service: 
    7.       middlewares:
    8.         - auth
    9.   middlewares:
    10.     auth:
    11.       basicAuth:
    12.         users:
    13.           - "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
    14.           - "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"

    The router's rule must catch requests for the URI path /api

    Using an "Host" rule is recommended, by catching all the incoming traffic on this host domain to the API.However, you can also use "path prefix" rule or any combination or rules.

    1. # Matches http://traefik.domain.com, http://traefik.domain.com/api
    2. # or http://traefik.domain.com/hello
    3. rule = "Host(`traefik.domain.com`)"

    1. # Matches http://api.traefik.domain.com/api or http://domain.com/api
    2. # but does not match http://api.traefik.domain.com/hello
    3. rule = "PathPrefix(`/api`)"

    1. # Matches http://traefik.domain.com/api or http://traefik.domain.com/dashboard
    2. # but does not match http://traefik.domain.com/hello
    3. rule = "Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"

    Enable the API in insecure mode, which means that the API will be available directly on the entryPoint named .

    Info

    If the entryPoint named traefik is not configured, it will be automatically created on port 8080.

    1. api:
    2.   insecure: true

    1. --api.insecure=true

    Optional, Default=true

    Enable the dashboard. More about the dashboard features .

    1. [api]
    2.   dashboard = true

    1. api:
    2.   dashboard: true

    1. --api.dashboard=true

    With Dashboard enabled, the router rule must catch requests for both /api and /dashboard

    Please check the to learn more about this and to get examples.

    Optional, Default=false

    Enable additional endpoints for debugging and profiling, served under /debug/.

    1. [api]

    1. --api.debug=true