ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Developer tools · #traefikproxy
When deploying internal services via Traefik Proxy v2.x, preventing accidental public exposure of backend routers is a primary security requirement. While EntryPoints define the listening ports, routers determine which traffic reaches the service based on matching rules. There is a design trade-off between implementing network-level restrictions and identity
Problem Overview When the RequestSizeLimit middleware is configured, Traefik should reject requests whose body size exceeds the specified limit with an HTTP 413 response. However, the middleware’s documentation does not mention handling of Transfer‑Encoding: chunked streams. Observed Behavior In both Traefik v2.x and v3.x, a POST request that uses chunked tr
Retry vs CircuitBreaker for Non‑Idempotent POSTs When a backend intermittently returns 5xx errors for POST requests, the Traefik proxy offers two documented approaches: the Retry middleware and the CircuitBreaker middleware. The goal is to mitigate transient failures while preventing accidental duplicate writes to the backend. The Retry middleware reissues t
ACME Certificate Persistence Traefik utilizes a JSON file, acme.json , to persist TLS certificates and account keys generated via the ACME protocol. To maintain security, Traefik enforces strict filesystem permissions on this file. Storage Constraint On Linux environments, the acme.json file must have permissions set to 600 . If the file is too accessible, T
Traefik's retry middleware re-sends requests to an upstream after connection failures or matching HTTP status codes, governed by the attempts option. The middleware applies retries to every HTTP method, including POST and PATCH, and does not expose a built-in filter to restrict retries to idempotent methods such as GET, HEAD, OPTIONS, PUT, or DELETE. If an u
BasicAuth Middleware Configuration Traefik's BasicAuth middleware provides a mechanism for securing routes using static credentials, typically defined via an htpasswd-formatted string or file. This implementation validates requests based on a direct match of the username and password. While this satisfies basic authentication needs, the middleware lacks a na
Rate Limiting with Token Bucket Traefik Proxy utilizes a token-bucket model for HTTP rate limiting, allowing for a defined average request rate and a burst capacity. This middleware is typically applied to routers to prevent service exhaustion by limiting the number of requests processed per client. Client Identification and State Management The sourceCriter