EntryPoints

Opening Connections for Incoming Requests

entryPoints

EntryPoints are the network entry points into Traefik. They define the port which will receive the requests (whether HTTP or TCP).

Configuration Examples

Port 80 only 
## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"
## Static configuration
entryPoints:
  web:
   address: ":80"
## Static configuration
--entryPoints.web.address=:80

We define an entrypoint called web that will listen on port 80.

Port 80 & 443 
## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"

  [entryPoints.websecure]
    address = ":443"
## Static configuration
entryPoints:
  web:
    address: ":80"

  websecure:
    address: ":443"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.websecure.address=:443
  • Two entrypoints are defined: one called web, and the other called websecure.
  • web listens on port 80, and websecure on port 443.

Configuration

General

EntryPoints are part of the static configuration. You can define them using a toml file, CLI arguments, or a key-value store.

See the complete reference for the list of available options 
## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.lifeCycle]
        requestAcceptGraceTimeout = 42
        graceTimeOut = 42
      [entryPoints.name.transport.respondingTimeouts]
        readTimeout = 42
        writeTimeout = 42
        idleTimeout = 42
    [entryPoints.name.proxyProtocol]
      insecure = true
      trustedIPs = ["127.0.0.1", "192.168.0.1"]
    [entryPoints.name.forwardedHeaders]
      insecure = true
      trustedIPs = ["127.0.0.1", "192.168.0.1"]
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      lifeCycle:
        requestAcceptGraceTimeout: 42
        graceTimeOut: 42
      respondingTimeouts:
        readTimeout: 42
        writeTimeout: 42
        idleTimeout: 42
    proxyProtocol:
      insecure: true
      trustedIPs:
        - "127.0.0.1"
        - "192.168.0.1"
    forwardedHeaders:
      insecure: true
      trustedIPs:
        - "127.0.0.1"
        - "192.168.0.1"
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
--entryPoints.name.transport.lifeCycle.graceTimeOut=42
--entryPoints.name.transport.respondingTimeouts.readTimeout=42
--entryPoints.name.transport.respondingTimeouts.writeTimeout=42
--entryPoints.name.transport.respondingTimeouts.idleTimeout=42
--entryPoints.name.proxyProtocol.insecure=true
--entryPoints.name.proxyProtocol.trustedIPs=127.0.0.1,192.168.0.1
--entryPoints.name.forwardedHeaders.insecure=true
--entryPoints.name.forwardedHeaders.trustedIPs=127.0.0.1,192.168.0.1

Forwarded Header

You can configure Traefik to trust the forwarded headers information (X-Forwarded-*).

forwardedHeaders.trustedIPs

Trusting Forwarded Headers from specific IPs.

## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"

    [entryPoints.web.forwardedHeaders]
      trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
## Static configuration
entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
      trustedIPs:
        - "127.0.0.1/32"
        - "192.168.1.7"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7
forwardedHeaders.insecure

Insecure Mode (Always Trusting Forwarded Headers).

## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"

    [entryPoints.web.forwardedHeaders]
      insecure = true
## Static configuration
entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
      insecure: true
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.insecure

Transport

respondingTimeouts

respondingTimeouts are timeouts for incoming requests to the Traefik instance.

transport.respondingTimeouts.readTimeout

Optional, Default=0s

readTimeout is the maximum duration for reading the entire request, including the body.

If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.respondingTimeouts]
        readTimeout = 42
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      respondingTimeouts:
        readTimeout: 42
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.respondingTimeouts.readTimeout=42
transport.respondingTimeouts.writeTimeout

Optional, Default=0s

writeTimeout is the maximum duration before timing out writes of the response.

It covers the time from the end of the request header read to the end of the response write. If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.respondingTimeouts]
        writeTimeout = 42
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      respondingTimeouts:
        writeTimeout: 42
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.respondingTimeouts.writeTimeout=42
transport.respondingTimeouts.idleTimeout

Optional, Default=180s

idleTimeout is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.

If zero, no timeout exists.
Can be provided in a format supported by time.ParseDuration or as raw values (digits). If no units are provided, the value is parsed assuming seconds.

## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.respondingTimeouts]
        idleTimeout = 42
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      respondingTimeouts:
        idleTimeout: 42
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.respondingTimeouts.idleTimeout=42

lifeCycle

Controls the behavior of Traefik during the shutdown phase.

lifeCycle.requestAcceptGraceTimeout

Optional, Default=0s

Duration to keep accepting requests prior to initiating the graceful termination period (as defined by the graceTimeOut option). This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.

Can be provided in a format supported by time.ParseDuration or as raw values (digits).

If no units are provided, the value is parsed assuming seconds. The zero duration disables the request accepting grace period, i.e., Traefik will immediately proceed to the grace period.

## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.lifeCycle]
        requestAcceptGraceTimeout = 42
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      lifeCycle:
        requestAcceptGraceTimeout: 42
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.lifeCycle.requestAcceptGraceTimeout=42
lifeCycle.graceTimeOut

Optional, Default=10s

Duration to give active requests a chance to finish before Traefik stops.

Can be provided in a format supported by time.ParseDuration or as raw values (digits).

If no units are provided, the value is parsed assuming seconds.

In this time frame no new requests are accepted.

## Static configuration
[entryPoints]
  [entryPoints.name]
    address = ":8888"
    [entryPoints.name.transport]
      [entryPoints.name.transport.lifeCycle]
        graceTimeOut = 42
## Static configuration
entryPoints:
  name:
    address: ":8888"
    transport:
      lifeCycle:
        graceTimeOut: 42
## Static configuration
--entryPoints.name.address=:8888
--entryPoints.name.transport.lifeCycle.graceTimeOut=42

ProxyProtocol

Traefik supports ProxyProtocol version 1 and 2.

If Proxy Protocol header parsing is enabled for the entry point, this entry point can accept connections with or without Proxy Protocol headers.

If the Proxy Protocol header is passed, then the version is determined automatically.

proxyProtocol.trustedIPs

Enabling Proxy Protocol with Trusted IPs.

## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"

    [entryPoints.web.proxyProtocol]
      trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
## Static configuration
entryPoints:
  web:
    address: ":80"
    proxyProtocol:
      trustedIPs:
        - "127.0.0.1/32"
        - "192.168.1.7"
--entryPoints.web.address=:80
--entryPoints.web.proxyProtocol.trustedIPs=127.0.0.1/32,192.168.1.7

IPs in trustedIPs only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.

proxyProtocol.insecure

Insecure Mode (Testing Environment Only).

In a test environments, you can configure Traefik to trust every incoming connection. Doing so, every remote client address will be replaced (trustedIPs won't have any effect)

## Static configuration
[entryPoints]
  [entryPoints.web]
    address = ":80"

    [entryPoints.web.proxyProtocol]
      insecure = true
## Static configuration
entryPoints:
  web:
    address: ":80"
    proxyProtocol:
      insecure: true
--entryPoints.web.address=:80
--entryPoints.web.proxyProtocol.insecure

Queuing Traefik behind Another Load Balancer

When queuing Traefik behind another load-balancer, make sure to configure Proxy Protocol on both sides. Not doing so could introduce a security risk in your system (enabling request forgery).