EntryPoints

    EntryPoints are the network entry points into Traefik. They define the port which will receive the packets, and whether to listen for TCP or UDP.

    Port 80 only

    File (YAML)

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.web]
    4.     address = ":80"

    CLI

    1. ## Static configuration
    2. --entryPoints.web.address=:80

    We define an entrypoint called web that will listen on port 80.

    Port 80 & 443

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   web:
    4.     address: ":80"
    6.   websecure:
    7.     address: ":443"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.web]
    4.     address = ":80"
    6.   [entryPoints.websecure]
    7.     address = ":443"

    CLI

    1. ## Static configuration
    2. --entryPoints.web.address=:80
    3. --entryPoints.websecure.address=:443
    • Two entrypoints are defined: one called web, and the other called websecure.
    • web listens on port 80, and websecure on port 443.

    UDP on port 1704

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   streaming:
    4.     address: ":1704/udp"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.streaming]
    4.     address = ":1704/udp"

    CLI

    1. ## Static configuration
    2. --entryPoints.streaming.address=:1704/udp

    EntryPoints are part of the . They can be defined by using a file (YAML or TOML) or CLI arguments.

    See the complete reference for the list of available options

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888" # same as ":8888/tcp"
    5.     http2:
    6.       maxConcurrentStreams: 42
    7.     http3:
    8.       advertisedPort: 8888
    9.     transport:
    10.       lifeCycle:
    11.         requestAcceptGraceTimeout: 42
    12.         graceTimeOut: 42
    13.       respondingTimeouts:
    14.         readTimeout: 42
    15.         writeTimeout: 42
    16.         idleTimeout: 42
    17.     proxyProtocol:
    18.       insecure: true
    19.       trustedIPs:
    20.         - "127.0.0.1"
    21.         - "192.168.0.1"
    22.     forwardedHeaders:
    23.       insecure: true
    24.       trustedIPs:
    25.         - "127.0.0.1"
    26.         - "192.168.0.1"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888" # same as ":8888/tcp"
    5.     [entryPoints.name.http2]
    6.       maxConcurrentStreams = 42
    7.     [entryPoints.name.http3]
    8.       advertisedPort = 8888
    9.     [entryPoints.name.transport]
    10.       [entryPoints.name.transport.lifeCycle]
    11.         requestAcceptGraceTimeout = 42
    12.         graceTimeOut = 42
    13.       [entryPoints.name.transport.respondingTimeouts]
    14.         readTimeout = 42
    15.         writeTimeout = 42
    16.         idleTimeout = 42
    17.     [entryPoints.name.proxyProtocol]
    18.       insecure = true
    19.       trustedIPs = ["127.0.0.1", "192.168.0.1"]
    20.     [entryPoints.name.forwardedHeaders]
    21.       insecure = true
    22.       trustedIPs = ["127.0.0.1", "192.168.0.1"]

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888 # same as :8888/tcp
    3. --entryPoints.name.http2.maxConcurrentStreams=42
    4. --entryPoints.name.http3.advertisedport=8888
    5. --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
    6. --entryPoints.name.transport.lifeCycle.graceTimeOut=42
    7. --entryPoints.name.transport.respondingTimeouts.readTimeout=42
    8. --entryPoints.name.transport.respondingTimeouts.writeTimeout=42
    9. --entryPoints.name.transport.respondingTimeouts.idleTimeout=42
    10. --entryPoints.name.proxyProtocol.insecure=true
    11. --entryPoints.name.proxyProtocol.trustedIPs=127.0.0.1,192.168.0.1
    12. --entryPoints.name.forwardedHeaders.insecure=true
    13. --entryPoints.name.forwardedHeaders.trustedIPs=127.0.0.1,192.168.0.1

    Address

    The address defines the port, and optionally the hostname, on which to listen for incoming connections and packets. It also defines the protocol to use (TCP or UDP). If no protocol is specified, the default is TCP. The format is:

    1. [host]:port[/tcp|/udp]

    If both TCP and UDP are wanted for the same port, two entryPoints definitions are needed, such as in the example below.

    Both TCP and UDP on Port 3179

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   tcpep:
    4.    address: ":3179"
    5.   udpep:
    6.    address: ":3179/udp"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.tcpep]
    4.     address = ":3179"
    5.   [entryPoints.udpep]
    6.     address = ":3179/udp"

    CLI

    1. ## Static configuration
    2. --entryPoints.tcpep.address=:3179
    3. --entryPoints.udpep.address=:3179/udp

    Listen on Specific IP Addresses Only

    File (yaml)

    1. entryPoints:
    2.   specificIPv4:
    3.     address: "192.168.2.7:8888"
    4.   specificIPv6:
    5.     address: "[2001:db8::1]:8888"

    File (TOML)

    1. [entryPoints.specificIPv4]
    2.   address = "192.168.2.7:8888"
    3. [entryPoints.specificIPv6]
    4.   address = "[2001:db8::1]:8888"

    CLI

    1. --entrypoints.specificIPv4.address=192.168.2.7:8888
    2. --entrypoints.specificIPv6.address=[2001:db8::1]:8888

    Full details for how to specify address can be found in (and net.Dial) of the doc for go.

    HTTP/2

    maxConcurrentStreams

    Optional, Default=250

    maxConcurrentStreams specifies the number of concurrent streams per connection that each client is allowed to initiate. The maxConcurrentStreams value must be greater than zero.

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     http2:
    4.       maxConcurrentStreams: 250

    File (TOML)

    1. [entryPoints.foo]
    2.   [entryPoints.foo.http2]
    3.     maxConcurrentStreams = 250

    CLI

    1. --entryPoints.name.http2.maxConcurrentStreams=250

    http3

    http3 enables HTTP/3 protocol on the entryPoint. HTTP/3 requires a TCP entryPoint, as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this entryPoint is the same as the one used for TLS traffic.

    HTTP/3 uses UDP+TLS

    As HTTP/3 uses UDP, you can’t have a TCP entryPoint with HTTP/3 on the same port as a UDP entryPoint. Since HTTP/3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP/3.

    Enabling Experimental HTTP/3

    As the HTTP/3 spec is still in draft, HTTP/3 support in Traefik is an experimental feature and needs to be activated in the experimental section of the static configuration.

    File (YAML)

    1. experimental:
    2.   http3: true
    4. entryPoints:
    5.   name:
    6.     http3: {}

    File (TOML)

    1. [experimental]
    2.   http3 = true

    CLI

    1. --experimental.http3=true 
    2. --entrypoints.name.http3

    advertisedPort

    http3.advertisedPort defines which UDP port to advertise as the HTTP/3 authority. It defaults to the entryPoint’s address port. It can be used to override the authority in the alt-svc header, for example if the public facing port is different from where Traefik is listening.

    http3.advertisedPort

    File (YAML)

    1. experimental:
    2.   http3: true
    4. entryPoints:
    5.   name:
    7.       advertisedPort: 443

    File (TOML)

    1. [experimental]
    2.   http3 = true
    4. [entryPoints.name.http3]
    5.   advertisedPort = 443

    CLI

    Forwarded Headers

    You can configure Traefik to trust the forwarded headers information (X-Forwarded-*).

    forwardedHeaders.trustedIPs

    Trusting Forwarded Headers from specific IPs.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   web:
    4.     address: ":80"
    5.     forwardedHeaders:
    6.       trustedIPs:
    7.         - "127.0.0.1/32"
    8.         - "192.168.1.7"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.web]
    4.     address = ":80"
    6.     [entryPoints.web.forwardedHeaders]
    7.       trustedIPs = ["127.0.0.1/32", "192.168.1.7"]

    CLI

    1. ## Static configuration
    2. --entryPoints.web.address=:80
    3. --entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7

    forwardedHeaders.insecure

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   web:
    4.     address: ":80"
    5.     forwardedHeaders:
    6.       insecure: true

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.web]
    4.     address = ":80"
    6.     [entryPoints.web.forwardedHeaders]
    7.       insecure = true

    CLI

    1. ## Static configuration
    2. --entryPoints.web.address=:80
    3. --entryPoints.web.forwardedHeaders.insecure

    Transport

    respondingTimeouts

    respondingTimeouts are timeouts for incoming requests to the Traefik instance. Setting them has no effect for UDP entryPoints.

    transport.respondingTimeouts.readTimeout

    Optional, Default=0s

    readTimeout is the maximum duration for reading the entire request, including the body.

    If zero, no timeout exists.
    Can be provided in a format supported by or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888"
    5.     transport:
    6.       respondingTimeouts:
    7.         readTimeout: 42

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888"
    5.     [entryPoints.name.transport]
    6.       [entryPoints.name.transport.respondingTimeouts]
    7.         readTimeout = 42

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888
    3. --entryPoints.name.transport.respondingTimeouts.readTimeout=42

    transport.respondingTimeouts.writeTimeout

    Optional, Default=0s

    writeTimeout is the maximum duration before timing out writes of the response.

    It covers the time from the end of the request header read to the end of the response write. If zero, no timeout exists.
    Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888"
    5.     transport:
    6.       respondingTimeouts:
    7.         writeTimeout: 42

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888"
    5.     [entryPoints.name.transport]
    6.       [entryPoints.name.transport.respondingTimeouts]
    7.         writeTimeout = 42

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888
    3. --entryPoints.name.transport.respondingTimeouts.writeTimeout=42

    transport.respondingTimeouts.idleTimeout

    Optional, Default=180s

    idleTimeout is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.

    If zero, no timeout exists.
    Can be provided in a format supported by or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888"
    5.     transport:
    6.       respondingTimeouts:
    7.         idleTimeout: 42

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888"
    5.     [entryPoints.name.transport]
    6.       [entryPoints.name.transport.respondingTimeouts]
    7.         idleTimeout = 42

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888
    3. --entryPoints.name.transport.respondingTimeouts.idleTimeout=42

    lifeCycle

    Controls the behavior of Traefik during the shutdown phase.

    lifeCycle.requestAcceptGraceTimeout

    Optional, Default=0s

    Duration to keep accepting requests prior to initiating the graceful termination period (as defined by the graceTimeOut option). This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.

    Can be provided in a format supported by or as raw values (digits).

    If no units are provided, the value is parsed assuming seconds. The zero duration disables the request accepting grace period, i.e., Traefik will immediately proceed to the grace period.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888"
    5.     transport:
    6.       lifeCycle:
    7.         requestAcceptGraceTimeout: 42

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888"
    5.     [entryPoints.name.transport]
    6.       [entryPoints.name.transport.lifeCycle]
    7.         requestAcceptGraceTimeout = 42

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888
    3. --entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42

    lifeCycle.graceTimeOut

    Optional, Default=10s

    Duration to give active requests a chance to finish before Traefik stops.

    Can be provided in a format supported by time.ParseDuration or as raw values (digits).

    If no units are provided, the value is parsed assuming seconds.

    In this time frame no new requests are accepted.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   name:
    4.     address: ":8888"
    5.     transport:
    6.       lifeCycle:
    7.         graceTimeOut: 42

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.name]
    4.     address = ":8888"
    5.     [entryPoints.name.transport]
    6.       [entryPoints.name.transport.lifeCycle]
    7.         graceTimeOut = 42

    CLI

    1. ## Static configuration
    2. --entryPoints.name.address=:8888
    3. --entryPoints.name.transport.lifeCycle.graceTimeOut=42

    Traefik supports ProxyProtocol version 1 and 2.

    If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.

    If the Proxy Protocol header is passed, then the version is determined automatically.

    proxyProtocol.trustedIPs

    Enabling Proxy Protocol with Trusted IPs.

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   web:
    4.     address: ":80"
    5.     proxyProtocol:
    6.       trustedIPs:
    7.         - "127.0.0.1/32"
    8.         - "192.168.1.7"

    File (TOML)

    1. ## Static configuration
    2. [entryPoints]
    3.   [entryPoints.web]
    4.     address = ":80"
    6.     [entryPoints.web.proxyProtocol]
    7.       trustedIPs = ["127.0.0.1/32", "192.168.1.7"]

    CLI

    1. --entryPoints.web.address=:80
    2. --entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.7

    IPs in trustedIPs only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.

    proxyProtocol.insecure

    Insecure Mode (Testing Environment Only).

    In a test environments, you can configure Traefik to trust every incoming connection. Doing so, every remote client address will be replaced (trustedIPs won’t have any effect)

    File (YAML)

    1. ## Static configuration
    2. entryPoints:
    3.   web:
    4.     address: ":80"
    5.     proxyProtocol:
    6.       insecure: true
    1. ## Static configuration
    2. [entryPoints]
    4.     address = ":80"
    6.       insecure = true

    CLI

    Queuing Traefik behind Another Load Balancer

    When queuing Traefik behind another load-balancer, make sure to configure Proxy Protocol on both sides. Not doing so could introduce a security risk in your system (enabling request forgery).

    This whole section is dedicated to options, keyed by entry point, that will apply only to HTTP routing.

    Redirection

    HTTPS redirection (80 to 443)

    File (YAML)

    1. entryPoints:
    2.   web:
    3.     address: :80
    4.     http:
    5.       redirections:
    6.         entryPoint:
    7.           to: websecure
    8.           scheme: https
    10.   websecure:
    11.     address: :443

    File (TOML)

    1. [entryPoints.web]
    2.   address = ":80"
    4.   [entryPoints.web.http]
    5.     [entryPoints.web.http.redirections]
    6.       [entryPoints.web.http.redirections.entryPoint]
    7.         to = "websecure"
    8.         scheme = "https"
    10. [entryPoints.websecure]
    11.   address = ":443"

    CLI

    1. --entrypoints.web.address=:80
    2. --entrypoints.web.http.redirections.entryPoint.to=websecure
    3. --entrypoints.web.http.redirections.entryPoint.scheme=https
    4. --entrypoints.websecure.address=:443

    entryPoint

    This section is a convenience to enable (permanent) redirecting of all incoming requests on an entry point (e.g. port 80) to another entry point (e.g. port 443) or an explicit port (:443).

    entryPoint.to

    Required

    The target element, it can be:

    • an entry point name (ex: websecure)
    • a port (:443)

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     # ...
    4.     http:
    5.       redirections:
    6.         entryPoint:
    7.           to: websecure

    File (TOML)

    1. [entryPoints.foo]
    2.   # ...
    3.   [entryPoints.foo.http.redirections]
    4.     [entryPoints.foo.http.redirections.entryPoint]
    5.       to = "websecure"

    CLI

    1. --entrypoints.foo.http.redirections.entryPoint.to=websecure

    entryPoint.scheme

    Optional, Default=”https”

    The redirection target scheme.

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     # ...
    4.     http:
    5.       redirections:
    6.         entryPoint:
    7.           # ...
    8.           scheme: https

    File (TOML)

    1. [entryPoints.foo]
    2.   # ...
    3.   [entryPoints.foo.http.redirections]
    4.     [entryPoints.foo.http.redirections.entryPoint]
    5.       # ...
    6.       scheme = "https"

    CLI

    1. --entrypoints.foo.http.redirections.entryPoint.scheme=https

    entryPoint.permanent

    Optional, Default=true

    To apply a permanent redirection.

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     # ...
    4.     http:
    5.       redirections:
    6.         entryPoint:
    7.           # ...
    8.           permanent: true

    File (TOML)

    1. [entryPoints.foo]
    2.   # ...
    3.   [entryPoints.foo.http.redirections]
    4.     [entryPoints.foo.http.redirections.entryPoint]
    5.       # ...
    6.       permanent = true

    CLI

    1. --entrypoints.foo.http.redirections.entrypoint.permanent=true

    entryPoint.priority

    Optional, Default=MaxInt32-1 (2147483646)

    Priority of the generated router.

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     # ...
    4.     http:
    5.       redirections:
    6.         entryPoint:
    7.           # ...
    8.           priority: 10

    File (TOML)

    1. [entryPoints.foo]
    2.   # ...
    3.   [entryPoints.foo.http.redirections]
    4.     [entryPoints.foo.http.redirections.entryPoint]
    5.       # ...
    6.       priority = 10

    CLI

    1. --entrypoints.foo.http.redirections.entrypoint.priority=10

    Middlewares

    The list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.

    File (YAML)

    1. entryPoints:
    2.   websecure:
    3.     address: ':443'
    4.     http:
    5.       middlewares:
    6.         - [email protected]
    7.         - [email protected]

    File (TOML)

    1. [entryPoints.websecure]
    2.   address = ":443"
    4.   [entryPoints.websecure.http]
    5.     middlewares = ["[email protected]", "[email protected]"]

    CLI

    1. --entrypoints.websecure.address=:443
    2. [email protected],[email protected]

    This section is about the default TLS configuration applied to all routers associated with the named entry point.

    If a TLS section (i.e. any of its fields) is user-defined, then the default configuration does not apply at all.

    The TLS section is the same as the TLS section on HTTP routers.

    File (YAML)

    1. entryPoints:
    2.   websecure:
    3.     address: ':443'
    4.     http:
    5.       tls:
    6.         options: foobar
    7.         certResolver: leresolver
    8.         domains:
    9.           - main: example.com
    10.             sans:
    11.               - foo.example.com
    12.               - bar.example.com
    13.           - main: test.com
    14.             sans:
    15.               - foo.test.com
    16.               - bar.test.com

    File (TOML)

    1. [entryPoints.websecure]
    2.   address = ":443"
    4.     [entryPoints.websecure.http.tls]
    5.       options = "foobar"
    6.       certResolver = "leresolver"
    7.       [[entryPoints.websecure.http.tls.domains]]
    8.         main = "example.com"
    9.         sans = ["foo.example.com", "bar.example.com"]
    10.       [[entryPoints.websecure.http.tls.domains]]
    11.         main = "test.com"
    12.         sans = ["foo.test.com", "bar.test.com"]

    CLI

    1. --entrypoints.websecure.address=:443
    2. --entrypoints.websecure.http.tls.options=foobar
    3. --entrypoints.websecure.http.tls.certResolver=leresolver
    4. --entrypoints.websecure.http.tls.domains[0].main=example.com
    5. --entrypoints.websecure.http.tls.domains[0].sans=foo.example.com,bar.example.com
    6. --entrypoints.websecure.http.tls.domains[1].main=test.com
    7. --entrypoints.websecure.http.tls.domains[1].sans=foo.test.com,bar.test.com

    Let’s Encrypt

    File (YAML)

    1. entryPoints:
    2.   websecure:
    3.     address: ':443'
    4.     http:
    5.       tls:
    6.         certResolver: leresolver

    File (TOML)

    1. [entryPoints.websecure]
    2.   address = ":443"
    4.     [entryPoints.websecure.http.tls]
    5.       certResolver = "leresolver"

    CLI

    1. --entrypoints.websecure.address=:443
    2. --entrypoints.websecure.http.tls.certResolver=leresolver

    This whole section is dedicated to options, keyed by entry point, that will apply only to UDP routing.

    Timeout

    Optional, Default=3s

    Timeout defines how long to wait on an idle session before releasing the related resources. The Timeout value must be greater than zero.

    File (YAML)

    1. entryPoints:
    2.   foo:
    3.     address: ':8000/udp'
    4.     udp:
    5.       timeout: 10s

    File (TOML)

    1. [entryPoints.foo]
    2.   address = ":8000/udp"
    4.     [entryPoints.foo.udp]

    CLI

    Using Traefik for Business Applications?

    If you are using Traefik in your organization, consider . You can use it as your:

    Traefik Enterprise simplifies the discovery, security, and deployment of APIs and microservices across any environment. See it in action in this short video walkthrough.