Traefik

When to Load

Load this skill when the task involves configuring Traefik as a reverse proxy or ingress controller — setting up routers, middlewares, TLS certificates, service discovery via Docker labels or Kubernetes CRDs, or debugging traffic routing.

Core Concepts

Architecture

Traefik uses dynamic routing: entrypoints (ports) → routers (URL rules + middleware chains) → services (backend load balancing). Configuration comes from providers (Docker, Kubernetes, file, Consul, etc.) and can change without a restart.

Key Objects

• Entrypoints: Network listeners — web (HTTP :80), websecure (HTTPS :443), traefik (dashboard :8080). Can define additional for specific services (metrics, TCP, UDP)
• Routers: Match rules (Host(\example.com`) && PathPrefix(`/api`)), protocol (HTTP, HTTPS, TCP, UDP), set tls:` for HTTPS, attach middleware chain, reference backend service
• Middlewares: Processing pipeline — redirectScheme (HTTP → HTTPS), rateLimit, basicAuth/digestAuth/forwardAuth, addPrefix/stripPrefix, headers (CORS, security headers), retry, circuitBreaker, compress, replacePath, ipWhiteList, errorPage
• Services: Load balancer config — servers with URLs/ports, health checks (interval, timeout, path), sticky sessions, circuit breakers, mirroring (traffic shadow for testing)