EntryPoints Configuration

Configuration Example

Static Configuration

## Static configuration
entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: :443
    tls: {}
    middlewares:
      - auth@kubernetescrd
      - strip@kubernetescrd

Helm Chart Values

## Values file
ports:
  web:
    port: :80
  websecure:
    port: :443
    tls:
      enabled: true
    middlewares:
      - auth@kubernetescrd
      - strip@kubernetescrd
additionalArguments:
  - --entryPoints.web.http.redirections.to=websecure
  - --entryPoints.web.http.redirections.scheme=https
  - --entryPoints.web.http.redirections.permanent=true

Ports 80, 443, 9000 and 9100

In the Helm Charts, the entryPoints web (port 80), websecure (port 443), traefik (port 9000) and metrics (port 9100) are created by default. The entryPoints web, websecure are exposed by default using a Service.

The default behaviors can be overridden in the Helm Chart. More information in the Helm Chart reference page.

Configuration Options

Field	Description	Default	Required
address	Define the port, and optionally the hostname, on which to listen for incoming connections and packets. It also defines the protocol to use (TCP or UDP). If no protocol is specified, the default is TCP. The format is:[host]:port[/tcp|/udp]. More information here.	-	Yes
allowACMEByPass	Determines whether a user defined router can handle ACME TLS or HTTP challenges instead of the Traefik dedicated one. This option can be used when a Traefik instance has one or more certificate resolvers configured, but is also used to route challenges connections/requests to services that could also initiate their own ACME challenges.	false	No
asDefault	Mark the entryPoint to be in the list of default entryPoints. entryPointsin this list are used (by default) on HTTP and TCP routers that do not define their own entryPointsoption. More information here.	false	No
forwardedHeaders.trustedIPs	Set the IP from where Traefik Hub trusts the forwarded headers information (X-Forwarded-*).	-	No
forwardedHeaders.insecure	Set the insecure mode to always trust the forwarded headers information (X-Forwarded-*). We recommend to use this option only for tests purposes, not in production.	false	No
http.redirections. entryPoint.to	The target element to enable (permanent) redirecting of all incoming requests on an entry point to another one. The target element, it can be an entry point name (ex: websecure), or a port (:443).	-	Yes
http.redirections. entryPoint.scheme	The target scheme to enable (permanent) redirecting of all incoming requests on an entry point to another one changing the scheme. The target element, it can be an entry point name (ex: websecure), or a port (:443).	"https"	No
http.redirections. entryPoint.permanent	Enable permanent redirecting of all incoming requests on an entry point to another one changing the scheme. The target element, it can be an entry point name (ex: websecure), or a port (:443).	false	No
http.redirections. entryPoint.priority	Default priority applied to the routers attached to the entryPoint.	MaxInt32-1 (2147483646)	No
http.encodeQuerySemicolons	Enable query semicolons encoding Use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik Hub. When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend. More information here.	false	No
http.middlewares	Set the list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point. More information here	-	No
http.tls	Enable TLS on every router attached to the entryPoint. If no certificate are set, a default self-signed certificate is generates by Traefik Hub. We recommend to not use self signed certificates in production.	-	No
http.tls.options	Apply TLS options on every router attached to the entryPoint. The TLS options can be overidden per router. More information in the dedicated section	-	No
http.tls.certResolver	Apply a certificate resolver on every router attached to the entryPoint. The TLS options can be overidden per router. More information in the dedicated section	-	No
http2.maxConcurrentStreams	Set the number of concurrent streams per connection that each client is allowed to initiate. The value must be greater than zero.	250	No
http3	Enable HTTP/3 protocol on the entryPoint. HTTP/3 requires a TCP entryPoint. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this entryPoint is the same as the one used for TLS traffic. More information here.	-	No
http3.advertisedPort	Set the UDP port to advertise as the HTTP/3 authority. It defaults to the entryPoint's address port. It can be used to override the authority in the alt-svc header, for example if the public facing port is different from where Traefik Hub is listening.	-	No
proxyProtocol.trustedIPs	Enable PROXY protocol with Trusted IPs. Traefik Hub supports PROXY protocol version 1 and 2. If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers. If the PROXY protocol header is passed, then the version is determined automatically. More information here.	-	No
proxyProtocol.insecure	Enable PROXY protocol trusting every incoming connection. Every remote client address will be replaced (trustedIPs) won't have any effect). Traefik Hub supports PROXY protocol version 1 and 2. If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers. If the PROXY protocol header is passed, then the version is determined automatically. We recommend to use this option only for tests purposes, not in production. More information here.	-	No
reusePort	Enable entryPoints from the same or different processes listening on the same TCP/UDP port by utilizing the SO_REUSEPORT socket option. It also allows the kernel to act like a load balancer to distribute incoming connections between entry points.. More information here.	false	No
transport. respondingTimeouts. readTimeout	Set the timeouts for incoming requests to the Traefik Hub instance. This is the maximum duration for reading the entire request, including the body. Setting them has no effect for UDP entryPoints. If zero, no timeout exists. Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.	60s (seconds)	No
transport. respondingTimeouts. writeTimeout	Maximum duration before timing out writes of the response. It covers the time from the end of the request header read to the end of the response write. If zero, no timeout exists. Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.	0s (seconds)	No
transport. respondingTimeouts. idleTimeout	Maximum duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout exists Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds	180s (seconds)	No
transport. lifeCycle. graceTimeOut	Set the duration to give active requests a chance to finish before Traefik Hub stops. Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds In this time frame no new requests are accepted.	10s (seconds)	No
transport. lifeCycle. requestAcceptGraceTimeout	Set the duration to keep accepting requests prior to initiating the graceful termination period (as defined by the transportlifeCycle.graceTimeOut option). This option is meant to give downstream load-balancers sufficient time to take Traefik Hub out of rotation. Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds	0s (seconds)	No
transport. keepAliveMaxRequests	Set the maximum number of requests Traefik Hub can handle before sending a Connection: Close header to the client (for HTTP2, Traefik Hub sends a GOAWAY). Zero means no limit.	0	No
transport. keepAliveMaxTime	Set the maximum duration Traefik Hub can handle requests before sending a Connection: Close header to the client (for HTTP2, Traefik Hub sends a GOAWAY). Zero means no limit.	0s (seconds)	No
udp.timeout	Define how long to wait on an idle session before releasing the related resources. The Timeout value must be greater than zero.	3s (seconds)	No

address

In the Helm Charts, the entryPoints web (port 80), websecure (port 443), traefik (port 9000) and metrics (port 9100) are created by default. The entryPoints web, websecure are exposed by default using a Service.

The default behaviors can be overridden in the Helm Chart. More information in the Helm Chart reference page.

asDefault

If there is no entryPoint with the asDefault option set to true, then the list of default entryPoints includes all HTTP/TCP entryPoints.

If at least one entryPoint has the asDefault option set to true, then the list of default entryPoints includes only entryPoints that have the asDefault option set to true.

Some built-in entryPoints are always excluded from the list, namely: traefik.

The asDefault option has no effect on UDP entryPoints. When a UDP router does not define the entryPoints option, it is attached to all available UDP entryPoints.

http.middlewares

• You can attach a list of middlewares to each EntryPoint.
• The middlewares will take effect only if the rule matches, and before forwarding the request to the service.
• Middlewares are applied in the same order as their declaration.
• Middlewares are applied by default to every router exposed through the EntryPoint (the Middlewares declared on the IngressRoute or the Ingress are applied after the ones declared on the Entrypoint)
• The option allows attaching a list of middleware using the format middlewarename@providername as described in the example below:

Static Configuration

## Static configuration
entryPoints:
  web:
    address: :80
    middlewares:
      - auth@kubernetescrd
      - strip@file

Helm Chart Values

## Values file
ports:
  web:
    port: :80
    middlewares:
      - auth@kubernetescrd
      - strip@file

Ports 80, 443, 9000 and 9100

In the Helm Charts, the entryPoints web (port 80), websecure (port 443), traefik (port 9000) and metrics (port 9100) are created by default. The entryPoints web, websecure are exposed by default using a Service.

The default behaviors can be overriddenin the Helm Chart. More information in the Helm Chart reference page.

# Attach the middleware auth defined using the File provier and the middleware default-prefix defined using a Kubernetes CRD
traefik.ingress.kubernetes.io/router.middlewares: auth@file,default-prefix@kubernetescrd

http.encodeQuerySemicolons

Behavior examples:

EncodeQuerySemicolons	Request Query	Resulting Request Query
false	foo=bar;baz=bar	foo=bar&baz=bar
true	foo=bar;baz=bar	foo=bar%3Bbaz=bar
false	foo=bar&baz=bar;foo	foo=bar&baz=bar&foo
true	foo=bar&baz=bar;foo	foo=bar&baz=bar%3Bfoo

HTTP3 = UDP+TLS

As HTTP/3 actually uses UDP, when traefik hub is configured with a TCP entryPoint on port N with HTTP/3 enabled, the underlying HTTP/3 server that is started automatically listens on UDP port N too. As a consequence, it means port N cannot be used by another UDP entryPoint. Since HTTP/3 requires the use of TLS, only routers with TLS enabled will be usable with HTTP/3.

ProxyProtocol and Load-Balancers

IPs in trustedIPs only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.

When queuing Traefik Hub behind another load-balancer, make sure to configure PROXY protocol on both sides. Not doing so could introduce a security risk in your system (enabling request forgery).

reusePort

Examples

Many processes on the same EntryPoint

Static Configuration

## Static configuration
entryPoints:
  web:
    address: ":80"
    reusePort: true

Helm Chart Values

## Values file
additionalArguments:
  - --entryPoints.web.reusePort=true

Many processes on the same EntryPoint on another host

Static Configuration

## Static configuration
entryPoints:
  web:
    address: ":80"
    reusePort: true
  privateWeb:
    address: "192.168.1.2:80"
    reusePort: true

Helm Chart Values

## Values file
additionalArguments:
  - --entryPoints.web.reusePort=true
  - --entryPoints.privateWeb.address=192.168.1.2:80
  - --entryPoints.privateWeb.reusePort=true

Supported platforms

The reusePort option currently works only on Linux, FreeBSD, OpenBSD and Darwin. It will be ignored on other platforms.

There is a known bug in the Linux kernel that may cause unintended TCP connection failures when using the reusePort option. For more details, see https://lwn.net/Articles/853637/.

Canary deployment

Use the reusePort option with the other option transport.lifeCycle.gracetimeout to do canary deployments against Traefik Hub itself. Like upgrading Traefik Hub version or reloading the static configuration without any service downtime.