Increase timeout for Docker image sync job to 30 minutes

Co-authored-by: Kevin Pollet <pollet.kevin@gmail.com>

.dockerignore

@@ -1,3 +1,5 @@
 dist/
-!dist/traefik
+!dist/**/traefik
 site/
+vendor/
+.idea/

.gitattributes

@@ -1 +1 @@
-# vendor/github.com/xenolf/lego/providers/dns/cloudxns/cloudxns.go eol=crlf
+# vendor/github.com/go-acme/lego/providers/dns/cloudxns/cloudxns.go eol=crlf

.github/CODEOWNERS

@@ -1,24 +0,0 @@
-provider/kubernetes/**  @containous/kubernetes
-provider/rancher/**     @containous/rancher
-provider/marathon/**    @containous/marathon
-provider/docker/**      @containous/docker
-
-docs/user-guide/kubernetes.md       @containous/kubernetes
-docs/user-guide/marathon.md         @containous/marathon
-docs/user-guide/swarm.md            @containous/docker
-docs/user-guide/swarm-mode.md       @containous/docker
-
-docs/configuration/backends/docker.md       @containous/docker
-docs/configuration/backends/kubernetes.md   @containous/kubernetes
-docs/configuration/backends/marathon.md     @containous/marathon
-docs/configuration/backends/rancher.md      @containous/rancher
-
-examples/k8s/                   @containous/kubernetes
-examples/compose-k8s.yaml       @containous/kubernetes
-examples/k8s.namespace.yaml     @containous/kubernetes
-examples/compose-rancher.yml    @containous/rancher
-examples/compose-marathon.yml   @containous/marathon
-
-vendor/github.com/gambol99/go-marathon  @containous/marathon
-vendor/github.com/rancher               @containous/rancher
-vendor/k8s.io/                          @containous/kubernetes

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: traefik

.github/ISSUE_TEMPLATE.md

@@ -1,29 +1,33 @@
+<!-- PLEASE FOLLOW THE ISSUE TEMPLATE TO HELP TRIAGE AND SUPPORT! -->
+
+### Do you want to request a *feature* or report a *bug*?
+
 <!--
 DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
 
 The issue tracker is for reporting bugs and feature requests only.
 For end-user related support questions, please refer to one of the following:
 
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
+- the Traefik community forum: https://community.traefik.io/
 
 -->
 
-
-### Do you want to request a *feature* or report a *bug*?
+Bug
 
 <!--
-If you intend to ask a support question: DO NOT FILE AN ISSUE.
+
+The configurations between 1.X and 2.X are NOT compatible.
+Please have a look here https://doc.traefik.io/traefik/getting-started/configuration-overview/.
+
 -->
 
 ### What did you do?
 
 <!--
 
-HOW TO WRITE A GOOD ISSUE?
+HOW TO WRITE A GOOD BUG REPORT?
 
 - Respect the issue template as much as possible.
-- If possible, use the command `traefik bug`. See https://www.youtube.com/watch?v=Lyz62L8m93I.
 - The title should be short and descriptive.
 - Explain the conditions which led you to report this issue: the context.
 - The context should lead to something, an idea or a problem that you’re facing.
@@ -43,13 +47,12 @@ HOW TO WRITE A GOOD ISSUE?
 ### Output of `traefik version`: (_What version of Traefik are you using?_)
 
 <!--
+`latest` is not considered as a valid version.
+
 For the Traefik Docker image:
     docker run [IMAGE] version
     ex: docker run traefik version
 
-For the alpine Traefik Docker image:
-    docker run [IMAGE] traefik version
-    ex: docker run traefik traefik version
 -->
 
 ```
@@ -61,12 +64,13 @@ For the alpine Traefik Docker image:
 ```toml
 # (paste your configuration here)
 ```
+
 <!--
 Add more configuration information here.
 -->
 
 
-### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output in DEBUG level (`--log.level=DEBUG` switch)
 
 ```
 (paste your output here)

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -1,78 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-
----
-
-<!--
-DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
-
-The issue tracker is for reporting bugs and feature requests only.
-For end-user related support questions, please refer to one of the following:
-
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
-
--->
-
-
-### Do you want to request a *feature* or report a *bug*?
-
-Bug
-
-### What did you do?
-
-<!--
-
-HOW TO WRITE A GOOD BUG REPORT?
-
-- Respect the issue template as much as possible.
-- If possible, use the command `traefik bug`. See https://www.youtube.com/watch?v=Lyz62L8m93I.
-- The title should be short and descriptive.
-- Explain the conditions which led you to report this issue: the context.
-- The context should lead to something, an idea or a problem that you’re facing.
-- Remain clear and concise.
-- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
-
--->
-
-### What did you expect to see?
-
-
-
-### What did you see instead?
-
-
-
-### Output of `traefik version`: (_What version of Traefik are you using?_)
-
-<!--
-For the Traefik Docker image:
-    docker run [IMAGE] version
-    ex: docker run traefik version
-
-For the alpine Traefik Docker image:
-    docker run [IMAGE] traefik version
-    ex: docker run traefik traefik version
--->
-
-```
-(paste your output here)
-```
-
-### What is your environment & configuration (arguments, toml, provider, platform, ...)?
-
-```toml
-# (paste your configuration here)
-```
-
-<!--
-Add more configuration information here.
--->
-
-
-### If applicable, please paste the log output in DEBUG level (`--logLevel=DEBUG` switch)
-
-```
-(paste your output here)
-```

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -1,37 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-
----
-
-<!--
-DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
-
-The issue tracker is for reporting bugs and feature requests only.
-For end-user related support questions, please refer to one of the following:
-
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
-
--->
-
-
-### Do you want to request a *feature* or report a *bug*?
-
-Feature
-
-### What did you expect to see?
-
-<!--
-
-HOW TO WRITE A GOOD ISSUE?
-
-- Respect the issue template as much as possible.
-- If possible, use the command `traefik bug`. See https://www.youtube.com/watch?v=Lyz62L8m93I.
-- The title should be short and descriptive.
-- Explain the conditions which led you to report this issue: the context.
-- The context should lead to something, an idea or a problem that you’re facing.
-- Remain clear and concise.
-- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
-
--->

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,82 @@
+name: Bug Report (Traefik)
+description: Create a report to help us improve.
+body:
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Welcome!
+      description: |
+        The issue tracker is for reporting bugs and feature requests only.
+        For end-user related support questions, please use the [Traefik community forum](https://community.traefik.io/).
+
+        All new/updated issues are triaged regularly by the maintainers.
+        All issues closed by a bot are subsequently double-checked by the maintainers.
+
+        DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
+
+      options:
+        - label: Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
+          required: true
+        - label: Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.
+          required: true
+
+  - type: textarea
+    attributes:
+      label: What did you do?
+      description: |
+        How to write a good bug report?
+
+        - Respect the issue template as much as possible.
+        - The title should be short and descriptive.
+        - Explain the conditions which led you to report this issue: the context.
+        - The context should lead to something, an idea or a problem that you’re facing.
+        - Remain clear and concise.
+        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
+      placeholder: What did you do?
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: What did you see instead?
+      placeholder: What did you see instead?
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: What version of Traefik are you using?
+      description: |
+        `latest` is not considered as a valid version.
+
+        Output of `traefik version`.
+
+        For the Traefik Docker image (`docker run [IMAGE] version`), example:
+        ```console
+        $ docker run traefik version
+        ```
+      placeholder: Paste your output here.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: What is your environment & configuration?
+      description: arguments, toml, provider, platform, ...
+      placeholder: Add information here.
+      value: |
+        ```yaml
+        # (paste your configuration here)
+        ```
+
+        Add more configuration information here.
+    validations:
+      required: true
+
+  - type: textarea
+    attributes:
+      label: If applicable, please paste the log output in DEBUG level
+      description: "`--log.level=DEBUG` switch."
+      placeholder: Paste your output here.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Traefik Community Support
+    url: https://community.traefik.io/
+    about: If you have a question, or are looking for advice, please post on our Discuss forum! The community loves to chime in to help. Happy Coding!
+  - name: Traefik Helm Chart Issues
+    url: https://github.com/traefik/traefik-helm-chart
+    about: Are you submitting an issue or feature enhancement for the Traefik helm chart? Please post in the traefik-helm-chart GitHub Issues.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,33 @@
+name: Feature Request (Traefik)
+description: Suggest an idea for this project.
+body:
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Welcome!
+      description: |
+        The issue tracker is for reporting bugs and feature requests only. For end-user related support questions, please refer to one of the following:
+        - the Traefik community forum: https://community.traefik.io/
+
+        DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
+      options:
+        - label: Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
+          required: true
+        - label: Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.
+          required: true
+
+  - type: textarea
+    attributes:
+      label: What did you expect to see?
+      description: |
+        How to write a good issue?
+
+        - Respect the issue template as much as possible.
+        - The title should be short and descriptive.
+        - Explain the conditions which led you to report this issue: the context.
+        - The context should lead to something, an idea or a problem that you’re facing.
+        - Remain clear and concise.
+        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
+      placeholder: What did you expect to see?
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,18 +1,20 @@
 <!--
 PLEASE READ THIS MESSAGE.
 
-HOW TO WRITE A GOOD PULL REQUEST?
+Documentation:
+- for Traefik v2: use branch v2.11 (fixes only)
+- for Traefik v3.6: use branch v3.6
+- for Traefik v3.7: use branch v3.7
 
-- Make it small.
-- Do only one thing.
-- Avoid re-formatting.
-- Make sure the code builds.
-- Make sure all tests pass.
-- Add tests.
-- Write useful descriptions and titles.
-- Address review comments in terms of additional commits.
-- Do not amend/squash existing ones unless the PR is trivial.
-- Read the contributing guide: https://github.com/containous/traefik/blob/master/CONTRIBUTING.md.
+Bug:
+- for Traefik v2: use branch v2.11 (security fixes only)
+- for Traefik v3.6: use branch v3.6
+- for Traefik v3.7: use branch v3.7
+
+Enhancements:
+- use branch master
+
+HOW TO WRITE A GOOD PULL REQUEST? https://doc.traefik.io/traefik/contributing/submitting-pull-requests/
 
 -->
 

.github/workflows/build.yaml

@@ -0,0 +1,81 @@
+name: Build Binaries
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths-ignore:
+      - 'docs/**'
+      - '**.md'
+      - 'script/gcg/**'
+
+env:
+  CGO_ENABLED: 0
+
+jobs:
+
+  build-webui:
+    uses: ./.github/workflows/template-webui.yaml
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    strategy:
+      matrix:
+        os: [ darwin, freebsd, linux, openbsd, windows ]
+        arch: [ amd64, arm64 ]
+        include:
+          - os: freebsd
+            arch: 386
+          - os: linux
+            arch: 386
+          - os: linux
+            arch: arm
+            goarm: 6
+          - os: linux
+            arch: arm
+            goarm: 7
+          - os: linux
+            arch: ppc64le
+          - os: linux
+            arch: riscv64
+          - os: linux
+            arch: s390x
+          - os: openbsd
+            arch: 386
+          - os: windows
+            arch: 386
+    needs:
+      - build-webui
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        env:
+          ImageOS: ${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.goarm }}
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Artifact webui
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: webui.tar.gz
+
+      - name: Untar webui
+        run: |
+          tar xvf webui.tar.gz
+          rm webui.tar.gz
+
+      - name: Build
+        env:
+          GOOS: ${{ matrix.os }}
+          GOARCH: ${{ matrix.arch }}
+          GOARM: ${{ matrix.goarm }}
+        run: make binary

.github/workflows/check_doc.yaml

@@ -0,0 +1,63 @@
+name: Check Documentation
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - '.github/workflows/check_doc.yaml'
+      - 'docs/**'
+
+jobs:
+
+  docs:
+    name: lint, build and verify
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Install markdownlint
+        run: |
+          npm install --global markdownlint@0.29.0 markdownlint-cli@0.35.0
+
+      - name: Lint
+        run: ./docs/scripts/lint.sh docs
+
+      - name: Setup python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: "./docs/requirements.txt"
+
+      - name: Build documentation
+        working-directory: ./docs
+        run: |
+          pip install -r requirements.txt
+          mkdocs build --strict
+
+      - name: Setup ruby
+        uses: ruby/setup-ruby@90be1154f987f4dc0fe0dd0feedac9e473aa4ba8 # v1.286.0
+        with:
+          ruby-version: '3.4'
+
+      - name: Install html-proofer
+        run: |
+          gem install nokogiri --version 1.18.6 --no-document -- --use-system-libraries
+          gem install html-proofer --version 5.0.10 --no-document -- --use-system-libraries
+        env:
+          NOKOGIRI_USE_SYSTEM_LIBRARIES: "true"
+
+      # Comes from https://github.com/gjtorikian/html-proofer?tab=readme-ov-file#caching-with-continuous-integration
+      - name: Cache HTMLProofer
+        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+        with:
+          path: tmp/.htmlproofer
+          key: ${{ runner.os }}-htmlproofer
+
+      - name: Verify
+        run: ./docs/scripts/verify.sh docs/site

.github/workflows/codeql.yml

@@ -0,0 +1,72 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - master
+      - v*
+  schedule:
+    - cron: '11 22 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript', 'go' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+    - name: setup go
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      if: ${{ matrix.language == 'go' }}
+      with:
+        go-version-file: '.go-version'
+        check-latest: true
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@38e701f46e33fb233075bf4238cb1e5d68e429e4 # v3.31.11
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@38e701f46e33fb233075bf4238cb1e5d68e429e4 # v3.31.11
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #     echo "Run, Build Application using script"
+    #     ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@38e701f46e33fb233075bf4238cb1e5d68e429e4 # v3.31.11
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/documentation.yaml

@@ -0,0 +1,54 @@
+name: Build and Publish Documentation
+
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - master
+      - v*
+
+env:
+  STRUCTOR_VERSION: v1.13.2
+  MIXTUS_VERSION: v0.4.1
+
+jobs:
+
+  docs:
+    name: Doc Process
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.repository == 'traefik/traefik'
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Login to DockerHub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Install Structor ${{ env.STRUCTOR_VERSION }}
+        run: curl -sSfL https://raw.githubusercontent.com/traefik/structor/master/godownloader.sh | sh -s -- -b $HOME/bin ${STRUCTOR_VERSION}
+
+      - name: Install Seo-doc
+        run: curl -sSfL https://raw.githubusercontent.com/traefik/seo-doc/master/godownloader.sh | sh -s -- -b "${HOME}/bin"
+
+      - name: Install Mixtus ${{ env.MIXTUS_VERSION }}
+        run: curl -sSfL https://raw.githubusercontent.com/traefik/mixtus/master/godownloader.sh | sh -s -- -b $HOME/bin ${MIXTUS_VERSION}
+
+      - name: Build documentation
+        run: |
+          STRUCTOR_LATEST_TAG=$(curl -s https://api.github.com/repos/traefik/traefik/releases/latest | jq -r '.tag_name')
+          $HOME/bin/structor -o traefik -r traefik --dockerfile-url="https://raw.githubusercontent.com/traefik/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/traefik/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/traefik/structor/master/requirements-override.txt" --force-edit-url --exp-branch=master --debug
+
+      - name: Apply seo
+        run: $HOME/bin/seo -path=./site -product=traefik
+
+      - name: Publish documentation
+        run: $HOME/bin/mixtus --dst-doc-path="./traefik" --dst-owner=traefik --dst-repo-name=doc --git-user-email="30906710+traefiker@users.noreply.github.com" --git-user-name=traefiker --src-doc-path="./site" --src-owner=traefik --src-repo-name=traefik
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN_REPO }}

.github/workflows/experimental.yaml

@@ -0,0 +1,70 @@
+name: Build experimental image on branch
+
+on:
+  push:
+    branches:
+      - master
+      - v*
+
+env:
+  CGO_ENABLED: 0
+
+jobs:
+
+  build-webui:
+    if: github.repository == 'traefik/traefik'
+    uses: ./.github/workflows/template-webui.yaml
+
+  experimental:
+    if: github.repository == 'traefik/traefik'
+    name: Build experimental image on branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        env:
+          ImageOS: ${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.goarm }}
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Build
+        run: make generate binary
+
+      - name: Branch name
+        run: echo ${GITHUB_REF##*/}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Artifact webui
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: webui.tar.gz
+
+      - name: Untar webui
+        run: |
+          tar xvf webui.tar.gz
+          rm webui.tar.gz
+
+      - name: Build docker experimental image
+        env:
+          DOCKER_BUILDX_ARGS: "--push"
+        run: |
+          make multi-arch-image-experimental-${GITHUB_REF##*/}

.github/workflows/release.yaml

@@ -0,0 +1,136 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+env:
+  CGO_ENABLED: 0
+  VERSION: ${{ github.ref_name }}
+  TRAEFIKER_EMAIL: "traefiker@traefik.io"
+  CODENAME: langres
+
+jobs:
+
+  build-webui:
+    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
+    uses: ./.github/workflows/template-webui.yaml
+
+  build:
+    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    strategy:
+      matrix:
+        os: [ linux-amd64, linux-386, linux-arm, linux-arm64, linux-ppc64le, linux-s390x, linux-riscv64, darwin-amd64, darwin-arm64, windows-amd64, windows-arm64, windows-386, freebsd-amd64, freebsd-386, openbsd-amd64, openbsd-386, openbsd-riscv64 ]
+    needs:
+      - build-webui
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        env:
+          # Ensure cache consistency on Linux, see https://github.com/actions/setup-go/pull/383
+          ImageOS: ${{ matrix.os }}
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Artifact webui
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: webui.tar.gz
+
+      - name: Untar webui
+        run: |
+          tar xvf webui.tar.gz
+          rm webui.tar.gz
+
+      - name: Go generate
+        run: go generate
+
+
+      - name: Generate goreleaser file
+        run: |
+          GORELEASER_CONFIG_FILE_PATH=$(go run ./internal/release "${{ matrix.os }}")
+          echo "GORELEASER_CONFIG_FILE_PATH=$GORELEASER_CONFIG_FILE_PATH" >> $GITHUB_ENV
+
+      - name: Build with goreleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        with:
+          distribution: goreleaser
+          # 'latest', 'nightly', or a semver
+          version: '~> v2'
+          args: release --clean --timeout="90m" --config "${{ env.GORELEASER_CONFIG_FILE_PATH }}"
+
+      - name: Artifact binaries
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: ${{ matrix.os }}-binaries
+          path: |
+            dist/**/*_checksums.txt
+            dist/**/*.tar.gz
+            dist/**/*.zip
+          retention-days: 1
+
+  release:
+    if: github.ref_type == 'tag' && github.repository == 'traefik/traefik'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    needs:
+      - build
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Artifact webui
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: webui.tar.gz
+
+      - name: Untar webui
+        run: |
+          tar xvf webui.tar.gz
+          rm webui.tar.gz
+
+      - name: Retrieve the secret and decode it to a file
+        env:
+          TRAEFIKER_RSA: ${{ secrets.TRAEFIKER_RSA }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "${TRAEFIKER_RSA}" | base64 --decode > ~/.ssh/traefiker_rsa
+
+      - name: Download All Artifacts
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          path: dist/
+          pattern: "*-binaries"
+          merge-multiple: true
+
+      - name: Publish Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cat dist/**/*_checksums.txt >> "dist/traefik_${VERSION}_checksums.txt"
+          rm dist/**/*_checksums.txt
+          tar cfz "dist/traefik-${VERSION}.src.tar.gz" \
+            --exclude-vcs \
+            --exclude .idea \
+            --exclude .github \
+            --exclude dist .
+
+          chown -R "$(id -u)":"$(id -g)" dist/
+          gh release create ${VERSION} ./dist/**/traefik*.{zip,tar.gz} ./dist/traefik*.{tar.gz,txt} --repo traefik/traefik --title ${VERSION} --notes ${VERSION} --latest=false
+
+          ./script/deploy.sh

.github/workflows/sync-docker-images.yaml

@@ -0,0 +1,27 @@
+name: Sync Docker Images
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *" # Run every day
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      packages: write
+      contents: read
+    if: github.repository == 'traefik/traefik'
+
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
+      
+      - name: Sync
+        run: |
+          EXCLUDED_TAGS="1.7.9-alpine v1.0.0-beta.392 v1.0.0-beta.404 v1.0.0-beta.704 v1.0.0-rc1 v1.7.9-alpine"
+          EXCLUDED_REGEX=$(echo $EXCLUDED_TAGS | sed 's/ /|/g')
+          diff <(crane ls traefik) <(crane ls ghcr.io/traefik/traefik) | grep '^<' | awk '{print $2}' | while read -r tag; do [[ "$tag" =~ ^($EXCLUDED_REGEX)$ ]] || (echo "Processing image: traefik:$tag"; crane cp "traefik:$tag" "ghcr.io/traefik/traefik:$tag"); done
+          crane cp traefik:latest ghcr.io/traefik/traefik:latest

.github/workflows/template-webui.yaml

@@ -0,0 +1,51 @@
+name: Build Web UI
+on:
+  workflow_call: {}
+env:
+  SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 48  # 2 days
+jobs:
+
+  build-webui:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Enable corepack
+        run: corepack enable
+
+      - name: Setup node
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version-file: webui/.nvmrc
+          cache: yarn
+          cache-dependency-path: webui/yarn.lock
+
+      - name: Setup safe-chain
+        working-directory: ./webui
+        run: |
+          npm i -g @aikidosec/safe-chain
+          safe-chain setup-ci
+
+      - name: Build webui
+        working-directory: ./webui
+        run: |
+          yarn install
+          yarn tsc
+          yarn lint
+          yarn build
+
+      - name: Package webui
+        run: |
+          tar czvf webui.tar.gz ./webui/static/
+
+      - name: Artifact webui
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: webui.tar.gz
+          path: webui.tar.gz
+          retention-days: 1

.github/workflows/test-gateway-api-conformance.yaml

@@ -0,0 +1,42 @@
+name: Test K8s Gateway API conformance
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - '.github/workflows/test-gateway-api-conformance.yaml'
+      - 'pkg/provider/kubernetes/gateway/**'
+      - 'integration/fixtures/gateway-api-conformance/**'
+      - 'integration/gateway_api_conformance_test.go'
+      - 'integration/integration_test.go'
+
+env:
+  CGO_ENABLED: 0
+
+jobs:
+
+  test-gateway-api-conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
+      - name: Gateway API conformance test and report
+        run: |
+          make test-gateway-api-conformance
+          git diff --exit-code

.github/workflows/test-integration.yaml

@@ -0,0 +1,104 @@
+name: Test Integration
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths-ignore:
+      - 'docs/**'
+      - '**.md'
+      - 'script/gcg/**'
+
+env:
+  CGO_ENABLED: 0
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
+      - name: Build binary
+        run: make binary-linux-amd64
+
+      - name: Save go cache build
+        uses: actions/cache/save@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+        with:
+          path: |
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.mod', '**/go.sum') }}
+
+      - name: Artifact traefik binary
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: traefik
+          path: ./dist/linux/amd64/traefik
+          retention-days: 1
+
+  test-integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    needs:
+      - build
+    strategy:
+      fail-fast: true
+      matrix:
+        parallel: [12]
+        index: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Download traefik binary
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: traefik
+          path: ./dist/linux/amd64/
+
+      - name: Make binary executable
+        run: chmod +x ./dist/linux/amd64/traefik
+
+      - name: Restore go cache build
+        uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+        with:
+          path: |
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.mod', '**/go.sum') }}
+
+      - name: Generate go test Slice
+        id: test_split
+        uses: hashicorp-forge/go-test-split-action@ddb2685fb140c29505663b405af7eb2cd953dd13 # v2.0.1
+        with:
+          packages: ./integration
+          total: ${{ matrix.parallel }}
+          index: ${{ matrix.index }}
+
+      - name: Run Integration tests
+        run: |
+          TESTS=$(echo "${{ steps.test_split.outputs.run}}" | sed 's/\$/\$\$/g')
+          TESTFLAGS="-run \"${TESTS}\"" make test-integration

.github/workflows/test-knative-conformance.yaml

@@ -0,0 +1,52 @@
+name: Test Knative conformance
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - '.github/workflows/test-knative-conformance.yaml'
+      - 'pkg/provider/kubernetes/knative/**'
+      - 'integration/fixtures/knative/**'
+      - 'integration/knative_conformance_test.go'
+      - 'integration/integration_test.go'
+
+env:
+  CGO_ENABLED: 0
+
+jobs:
+
+  test-knative-conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Set up KO
+        uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
+        env:
+          KO_DOCKER_REPO: ko.local
+
+      - name: Upload Test Images
+        run: |
+          # Download the test image templates.
+          go mod vendor
+          ./integration/fixtures/knative/upload-test-images.sh
+
+      - name: Avoid generating webui
+        run: |
+          touch webui/static/index.html
+
+      - name: Knative conformance test
+        run: |
+          make test-knative-conformance

.github/workflows/test-unit.yaml

@@ -0,0 +1,93 @@
+name: Test Unit
+
+on:
+  pull_request:
+    branches:
+      - '*'
+    paths-ignore:
+      - 'docs/**'
+      - '**.md'
+      - 'script/gcg/**'
+
+jobs:
+  generate-packages:
+    name: List Go Packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Generate matrix
+        id: set-matrix
+        run: |
+          matrix_output=$(go run ./internal/testsci/genmatrix.go)
+          echo "$matrix_output"
+          echo "$matrix_output" >> $GITHUB_OUTPUT
+
+  test-unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: generate-packages
+    strategy:
+      matrix:
+        package: ${{ fromJson(needs.generate-packages.outputs.matrix) }}
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Tests
+        run: |
+          go test -v -parallel 8 ${{ matrix.package.group }}
+
+  test-ui-unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Enable corepack
+        run: corepack enable
+
+      - name: Set up Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version-file: webui/.nvmrc
+          cache: 'yarn'
+          cache-dependency-path: webui/yarn.lock
+
+      - name: Setup safe-chain
+        run: |
+          npm i -g @aikidosec/safe-chain
+          safe-chain setup-ci
+
+      - name: UI unit tests
+        working-directory: ./webui
+        env:
+          VITE_APP_BASE_API_URL: "/api"
+        run: |
+          yarn install
+          yarn test:unit:ci

.github/workflows/validate.yaml

@@ -0,0 +1,81 @@
+name: Validate
+
+on:
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  GOLANGCI_LINT_VERSION: v2.10.1
+  MISSPELL_VERSION: v0.7.0
+
+jobs:
+
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        with:
+          version: "${{ env.GOLANGCI_LINT_VERSION }}"
+
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: Install misspell ${{ env.MISSPELL_VERSION }}
+        run: curl -sfL https://raw.githubusercontent.com/golangci/misspell/HEAD/install-misspell.sh | sh -s -- -b $(go env GOPATH)/bin ${MISSPELL_VERSION}
+
+      - name: Validate
+        run: make validate-files
+
+  validate-generate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        with:
+          go-version-file: '.go-version'
+          check-latest: true
+
+      - name: go generate
+        run: |
+          make generate
+          git diff --exit-code
+
+      - name: make generate-crd
+        run: |
+          make generate-crd
+          git diff --exit-code

.gitignore

@@ -1,15 +1,22 @@
-/dist
-/autogen/genstatic/gen.go
 .idea/
 .intellij/
 *.iml
+.vscode/
+.DS_Store
+/dist
+/webui/.tmp/
+/site/
+/docs/site/
+/autogen/
 /traefik
 /traefik.toml
-/static/
-/webui/.tmp/
-.vscode/
-/site/
+/traefik.yml
 *.log
 *.exe
-.DS_Store
-/examples/acme/acme.json
+cover.out
+vendor/
+plugins-storage/
+plugins-local/
+traefik_changelog.md
+integration/tailscale.secret
+integration/gateway-api-conformance-reports/**/experimental-dev-default-report.yaml

.go-version

@@ -0,0 +1 @@
+1.25

.golangci.yml

@@ -0,0 +1,359 @@
+version: "2"
+
+formatters:
+  enable:
+    - gci
+    - gofumpt
+  exclusions:
+    generated: lax
+    paths:
+      - pkg/provider/kubernetes/crd/generated/
+
+linters:
+  default: all
+  disable:
+    - bodyclose # too many false-positive
+    - containedctx # too many false-positive
+    - contextcheck # too many false-positive
+    - cyclop # duplicate of gocyclo
+    - dupl # Too strict
+    - err113 # Too strict
+    - exhaustive # Not relevant
+    - exhaustruct # Not relevant
+    - forcetypeassert # Too strict
+    - gochecknoglobals
+    - gochecknoinits
+    - gocognit # Too strict
+    - gocyclo # FIXME must be fixed
+    - gosec # Too strict
+    - gosmopolitan  # not relevant
+    - ireturn # Not relevant
+    - lll # Not relevant
+    - maintidx # kind of duplicate of gocyclo
+    - makezero # Not relevant
+    - mnd # Too strict
+    - nestif # Too many false-positive.
+    - nilnil # Not relevant
+    - nlreturn # Not relevant
+    - noctx # Too strict
+    - noinlineerr # Too strict
+    - nonamedreturns # Too strict
+    - paralleltest # Not relevant
+    - prealloc # Too many false-positive.
+    - rowserrcheck # not relevant (SQL)
+    - sqlclosecheck # not relevant (SQL)
+    - tagliatelle # Too strict
+    - testpackage # Too strict
+    - tparallel # Not relevant
+    - varnamelen # Not relevant
+    - wrapcheck # Too strict
+    - wsl # Too strict
+    - wsl_v5 # Too strict
+
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: github.com/instana/testify
+              desc: not allowed
+            - pkg: github.com/pkg/errors
+              desc: Should be replaced by standard lib errors package
+    errcheck:
+      exclude-functions:
+        - fmt.Fprintln
+    forbidigo:
+      forbid:
+        - pattern: ^print(ln)?$
+        - pattern: ^spew\.Print(f|ln)?$
+        - pattern: ^spew\.Dump$
+    funlen:
+      lines: -1
+      statements: 120
+    goconst:
+      min-len: 3
+      min-occurrences: 4
+    gocyclo:
+      min-complexity: 14
+    godox:
+      keywords:
+        - FIXME
+    gomoddirectives:
+      toolchain-pattern: go1\.\d+\.\d+$
+      tool-forbidden: true
+      go-version-pattern: ^1\.\d+(\.0)?$
+      replace-local: true
+      replace-allow-list:
+        - github.com/abbot/go-http-auth
+        - github.com/gorilla/mux
+        - github.com/mailgun/minheap
+        - github.com/mailgun/multibuf
+        - github.com/jaguilar/vt100
+        - github.com/cucumber/godog
+        - github.com/vulcand/oxy/v2
+    govet:
+      enable-all: true
+      disable:
+        - shadow
+        - fieldalignment
+    importas:
+      no-unaliased: true
+      alias:
+        - pkg: github.com/docker/compose/v2/pkg/api
+          alias: composeapi
+
+        # Standard Kubernetes rewrites:
+        - pkg: k8s.io/api/core/v1
+          alias: corev1
+        - pkg: k8s.io/api/networking/v1
+          alias: netv1
+        - pkg: k8s.io/api/networking/v1beta1
+          alias: netv1beta1
+        - pkg: k8s.io/api/admission/v1
+          alias: admv1
+        - pkg: k8s.io/api/admission/v1beta1
+          alias: admv1beta1
+        - pkg: k8s.io/api/extensions/v1beta1
+          alias: extv1beta1
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: metav1
+        - pkg: k8s.io/apimachinery/pkg/types
+          alias: ktypes
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: kerror
+        - pkg: k8s.io/client-go/kubernetes
+          alias: kclientset
+        - pkg: k8s.io/client-go/informers
+          alias: kinformers
+        - pkg: k8s.io/client-go/testing
+          alias: ktesting
+        - pkg: k8s.io/apimachinery/pkg/runtime/schema
+          alias: kschema
+        - pkg: k8s.io/client-go/kubernetes/scheme
+          alias: kscheme
+        - pkg: k8s.io/apimachinery/pkg/version
+          alias: kversion
+        - pkg: k8s.io/client-go/kubernetes/fake
+          alias: kubefake
+        - pkg: k8s.io/client-go/discovery/fake
+          alias: discoveryfake
+
+        # Kubernetes Gateway rewrites:
+        - pkg: sigs.k8s.io/gateway-api/pkg/client/clientset/gateway/versioned
+          alias: gateclientset
+        - pkg: sigs.k8s.io/gateway-api/pkg/client/informers/gateway/externalversions
+          alias: gateinformers
+        - pkg: sigs.k8s.io/gateway-api/apis/v1alpha2
+          alias: gatev1alpha2
+
+        # Traefik Kubernetes rewrites:
+        - pkg: github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/traefikio/v1alpha1
+          alias: traefikv1alpha1
+        - pkg: github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned
+          alias: traefikclientset
+        - pkg: github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/informers/externalversions
+          alias: traefikinformers
+        - pkg: github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/scheme
+          alias: traefikscheme
+        - pkg: github.com/traefik/traefik/v3/pkg/provider/kubernetes/crd/generated/clientset/versioned/fake
+          alias: traefikcrdfake
+    misspell:
+      locale: US
+    revive:
+      rules:
+        - name: struct-tag
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: exported
+          disabled: true
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: package-comments
+          disabled: true
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unused-parameter
+          disabled: true
+        - name: unreachable-code
+        - name: redefines-builtin-id
+    tagalign:
+      align: false
+      sort: true
+      order:
+        - description
+        - json
+        - toml
+        - yaml
+        - yml
+        - label
+        - label-slice-as-struct
+        - file
+        - kv
+        - export
+    testifylint:
+      disable:
+        - suite-dont-use-pkg
+        - require-error
+        - go-require
+    perfsprint:
+      err-error: true
+      errorf: true
+      sprintf1: true
+      strconcat: false
+    staticcheck:
+      checks:
+        - all
+        - '-SA1019'
+        - '-ST1000'
+        - '-ST1003'
+        - '-ST1016'
+        - '-ST1020'
+        - '-ST1021'
+        - '-ST1022'
+        - '-QF1001'
+        - '-QF1008' # TODO must be fixed
+
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - std-error-handling
+    rules:
+      - path: (.+)_test.go
+        linters:
+          - canonicalheader
+          - fatcontext
+          - funlen
+          - goconst
+          - godot
+      - path: (.+)_test.go
+        text: ' always receives '
+        linters:
+          - unparam
+      - path: pkg/server/service/bufferpool.go
+        text: 'SA6002: argument should be pointer-like to avoid allocations'
+      - path: pkg/server/middleware/middlewares.go
+        text: Function 'buildConstructor' has too many statements
+        linters:
+          - funlen
+      - path: pkg/provider/kubernetes/ingress-nginx/kubernetes.go
+        text: Function 'loadConfiguration' has too many statements
+        linters:
+          - funlen
+      - path: pkg/tracing/haystack/logger.go
+        linters:
+          - goprintffuncname
+      - path: pkg/tracing/tracing.go
+        text: printf-like formatting function 'SetErrorWithEvent' should be named 'SetErrorWithEventf'
+        linters:
+          - goprintffuncname
+      - path: pkg/tls/tlsmanager_test.go
+        text: 'SA1019: config.ClientCAs.Subjects has been deprecated since Go 1.18'
+      - path: pkg/types/tls_test.go
+        text: 'SA1019: tlsConfig.RootCAs.Subjects has been deprecated since Go 1.18'
+      - path: pkg/provider/kubernetes/(crd|gateway)/client.go
+        linters:
+          - interfacebloat
+      - path: pkg/observability/metrics/metrics.go
+        linters:
+          - interfacebloat
+      - path: integration/healthcheck_test.go
+        text: Duplicate words \(wsp2,\) found
+        linters:
+          - dupword
+      - path: pkg/types/domain_test.go
+        text: Duplicate words \(sub\) found
+        linters:
+          - dupword
+      - path: pkg/provider/kubernetes/gateway/client_mock_test.go
+        text: 'unusedwrite: unused write to field'
+        linters:
+          - govet
+      - path: pkg/provider/acme/local_store.go
+        linters:
+          - musttag
+      - path: pkg/tls/certificate.go
+        text: the methods of "Certificates" use pointer receiver and non-pointer receiver.
+        linters:
+          - recvcheck
+      - path: pkg/config/static/static_config.go
+        source: 'errors.New\("Consul Catalog provider'
+        text: 'ST1005: error strings should not be capitalized'
+      - path: pkg/config/static/static_config.go
+        source: 'errors.New\("Consul provider'
+        text: 'ST1005: error strings should not be capitalized'
+      - path: pkg/config/static/static_config.go
+        source: 'errors.New\("Nomad provider'
+        text: 'ST1005: error strings should not be capitalized'
+      - path: (.+)\.go
+        text: 'omitzero: Omitempty has no effect on nested struct field'
+        linters:
+          - modernize
+      - path: (.+)\.go
+        text: 'struct-tag: unknown option "inline" in json tag'
+        linters:
+          - revive
+      - path: (.+)\.go
+        text: 'struct-tag: unknown option "omitzero" in toml tag'
+        linters:
+          - revive
+      - path: (pkg/types/.+|pkg/api/.+|pkg/observability/types/.+)\.go
+        text: 'var-naming: avoid meaningless package names'
+        linters:
+          - revive
+      - path: ((cmd|pkg)/version/.*|pkg/config/runtime/.*|pkg/log/.*|pkg/(middlewares/)?metrics/.*|pkg/muxer/http/.+|pkg/provider/http/.+|pkg/tls/.+|pkg/proxy/httputil/.+|pkg/observability/metrics/.+)\.go
+        text: 'var-naming: avoid package names that conflict with Go standard library package names'
+        linters:
+          - revive
+      - path: (.+)\.go$
+        text: 'SA1019: http.CloseNotifier has been deprecated' # FIXME must be fixed
+      - path: (.+)\.go$
+        text: 'SA1019: dynamic.(TCPIPWhiteList|IPWhiteList) is deprecated: please use IPAllowList instead.'
+      - path: (.+)\.go$
+        text: 'SA1019: middlewareTCP.Spec.IPWhiteList is deprecated: please use IPAllowList instead.'
+      - path: (.+)\.go$
+        text: 'SA1019: cfg.(SSLRedirect|SSLTemporaryRedirect|SSLHost|SSLForceHost|FeaturePolicy) is deprecated'
+      - path: (.+)\.go$
+        text: 'SA1019: c.Providers.(ConsulCatalog|Consul|Nomad).Namespace is deprecated'
+      - path: pkg/middlewares/auth/basic_auth_test.go
+        text: 'SA1008: keys in http.Header are canonicalized, "x-user" is not canonical; fix the constant or use http.CanonicalHeaderKey'
+      - path: pkg/middlewares/auth/digest_auth_test.go
+        text: 'SA1008: keys in http.Header are canonicalized, "x-user" is not canonical; fix the constant or use http.CanonicalHeaderKey'
+      - path: pkg/provider/kubernetes/crd/kubernetes.go
+        text: "Function 'loadConfigurationFromCRD' has too many statements"
+        linters:
+          - funlen
+      - path: pkg/plugins/middlewarewasm.go
+        text: 'the methods of "wasmMiddlewareBuilder" use pointer receiver and non-pointer receiver.'
+        linters:
+          - recvcheck
+      - path: pkg/proxy/httputil/bufferpool.go
+        text: 'SA6002: argument should be pointer-like to avoid allocations'
+      - path: integration/integration_test.go
+        text: 'var (gatewayAPIConformanceRunTest|traefikVersion) is unused'
+      - path: pkg/server/router/router.go
+        text: 'appendAssign: append result not assigned to the same slice'
+        linters:
+          - gocritic
+      - path: pkg/server/conncontext.go
+        linters:
+          - fatcontext
+    paths:
+      - pkg/provider/kubernetes/crd/generated/
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0

.gometalinter.json

@@ -1,42 +0,0 @@
-{
-  "Vendor": true,
-  "Sort": [
-    "path",
-    "line",
-    "column",
-    "severity",
-    "linter"
-  ],
-  "Test": true,
-  "Cyclo": 15,
-  "Enable": [
-    "gotypex",
-    "nakedret",
-    "vet",
-    "goimports",
-    "golint",
-    "ineffassign",
-    "gotype",
-    "misspell",
-    "structcheck",
-    "gosimple",
-    "unconvert",
-    "varcheck",
-    "errcheck",
-    "unused",
-    "deadcode",
-    "staticcheck"
-  ],
-  "Disable": [
-    "gas",
-    "maligned",
-    "interfacer",
-    "goconst",
-    "gocyclo",
-    "vetshadow"
-  ],
-  "Exclude": [
-    "autogen/.*"
-  ],
-  "Deadline": "5m"
-}

.goreleaser.yml.tmpl

@@ -0,0 +1,71 @@
+project_name: traefik
+version: 2
+
+[[if .GOARCH]]
+dist: "./dist/[[ .GOOS ]]-[[ .GOARCH ]]"
+[[else]]
+dist: "./dist/[[ .GOOS ]]"
+[[end]]
+
+builds:
+  - binary: traefik
+
+    main: ./cmd/traefik/
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -s -w -X github.com/traefik/traefik/v3/pkg/version.Version={{.Version}} -X github.com/traefik/traefik/v3/pkg/version.Codename={{.Env.CODENAME}} -X github.com/traefik/traefik/v3/pkg/version.BuildDate={{.Date}}
+    flags:
+      - -trimpath
+    goos:
+      - "[[ .GOOS ]]"
+    goarch:
+      [[if .GOARCH]]
+      - "[[ .GOARCH ]]"
+      [[else]]
+      - amd64
+      - '386'
+      - arm
+      - arm64
+      - ppc64le
+      - s390x
+      - riscv64
+      [[end]]
+    goarm:
+      - '7'
+      - '6'
+    ignore:
+      - goos: darwin
+        goarch: '386'
+      - goos: openbsd
+        goarch: arm
+      - goos: openbsd
+        goarch: arm64
+      - goos: freebsd
+        goarch: arm
+      - goos: freebsd
+        goarch: arm64
+      - goos: windows
+        goarch: arm
+
+changelog:
+  disable: true
+
+archives:
+  - id: traefik
+    name_template: '{{ .ProjectName }}_v{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}'
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE.md
+      - CHANGELOG.md
+
+checksum:
+  name_template: "{{ .ProjectName }}_v{{ .Version }}_checksums.txt"
+
+release:
+  disable: true

.pre-commit-config.yaml

@@ -1,10 +0,0 @@
--   repo: git://github.com/pre-commit/pre-commit-hooks
-    sha: 44e1753f98b0da305332abe26856c3e621c5c439
-    hooks:
-    -   id: detect-private-key
--   repo: git://github.com/containous/pre-commit-hooks
-    sha: 35e641b5107671e94102b0ce909648559e568d61
-    hooks:
-    -   id: goFmt
-    -   id: goLint
-    -   id: goErrcheck

.semaphoreci/cleanup.sh

@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-sudo rm -rf static

.semaphoreci/job1.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-if [ -n "$SHOULD_TEST" ]; then ci_retry make pull-images; fi
-
-if [ -n "$SHOULD_TEST" ]; then ci_retry make test-integration; fi

.semaphoreci/job2.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-ci_retry make validate
-
-if [ -n "$SHOULD_TEST" ]; then ci_retry make test-unit; fi
-
-if [ -n "$SHOULD_TEST" ]; then make -j${N_MAKE_JOBS} crossbinary-default-parallel; fi

.semaphoreci/setup.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-export DOCKER_VERSION=17.03.1
-
-source .semaphoreci/vars
-
-if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
-
-if [ -n "$TEMP_STORAGE" ]; then SHOULD_TEST=$(echo "$TEMP_STORAGE" | grep -Ev '(.md|.yaml|.yml)' || :); fi
-
-if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq update; fi
-
-if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*; fi
-
-if [ -n "$SHOULD_TEST" ]; then  docker version; fi

.semaphoreci/vars

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-export REPO='containous/traefik'
-
-if VERSION=$(git describe --exact-match --abbrev=0 --tags);
-then
-  export VERSION
-else
-  export VERSION=''
-fi
-
-export CODENAME=maroilles
-
-export N_MAKE_JOBS=2
-
-
-function ci_retry {
-
-    local NRETRY=3
-    local NSLEEP=5
-    local n=0
-
-    until [ $n -ge $NRETRY ]
-    do
-        "$@" && break
-        n=$[$n+1]
-        echo "$@ failed, attempt ${n}/${NRETRY}"
-        sleep $NSLEEP
-    done
-
-    [ $n -lt $NRETRY ]
-
-}
-
-export -f ci_retry
-

.travis.yml

@@ -1,64 +0,0 @@
-sudo: required
-dist: trusty
-
-git:
-  depth: false
-
-services:
-  - docker
-
-env:
-  global:
-    - REPO: $TRAVIS_REPO_SLUG
-    - VERSION: $TRAVIS_TAG
-    - CODENAME: maroilles
-    - N_MAKE_JOBS: 2
-
-script:
-- echo "Skipping tests... (Tests are executed on SemaphoreCI)"
-- if [ "$TRAVIS_PULL_REQUEST" != "false" ]; then make docs-verify; fi
-
-before_deploy:
-  - >
-    if ! [ "$BEFORE_DEPLOY_RUN" ]; then
-      export BEFORE_DEPLOY_RUN=1;
-      sudo -E apt-get -yq update;
-      sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*;
-      docker version;
-      make image;
-      if [ "$TRAVIS_TAG" ]; then
-        make -j${N_MAKE_JOBS} crossbinary-parallel;
-        tar cfz dist/traefik-${VERSION}.src.tar.gz --exclude-vcs --exclude dist .;
-      fi;
-      curl -sI https://github.com/containous/structor/releases/latest | grep -Fi Location  | tr -d '\r' | sed "s/tag/download/g" | awk -F " " '{ print $2 "/structor_linux-amd64"}' | wget --output-document=$GOPATH/bin/structor -i -;
-      chmod +x $GOPATH/bin/structor;
-      structor -o containous -r traefik --dockerfile-url="https://raw.githubusercontent.com/containous/traefik/master/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/containous/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/containous/structor/master/requirements-override.txt" --exp-branch=master --debug;
-    fi
-deploy:
-  - provider: releases
-    api_key: ${GITHUB_TOKEN}
-    file: dist/traefik*
-    skip_cleanup: true
-    file_glob: true
-    on:
-      repo: containous/traefik
-      tags: true
-  - provider: script
-    script: sh script/deploy.sh
-    skip_cleanup: true
-    on:
-      repo: containous/traefik
-      tags: true
-  - provider: script
-    script: sh script/deploy-docker.sh
-    skip_cleanup: true
-    on:
-      repo: containous/traefik
-  - provider: pages
-    edge: false
-    github_token: ${GITHUB_TOKEN}
-    local_dir: site
-    skip_cleanup: true
-    on:
-      repo: containous/traefik
-      all_branches: true

AGENTS.md

@@ -0,0 +1,113 @@
+# Traefik — Contributor Guide for AI Agents
+
+Traefik is a modern HTTP reverse proxy and load balancer that discovers services from orchestrators (Kubernetes, Docker, Nomad, ...) and wires up routing dynamically. This file is the canonical guide for AI coding agents (Claude Code, Codex, Gemini, Cursor, ...) working in this repository; `CLAUDE.md` is a thin pointer to this file. For everything not covered here, defer to [`CONTRIBUTING.md`](./CONTRIBUTING.md) and [`docs/content/contributing/`](./docs/content/contributing/).
+
+> **Training-data notice.** Traefik evolved significantly between v2 and v3 (label formats, provider names, CRD shapes, middleware names). If anything you think you know about Traefik contradicts this file or the current code, trust this file and the code — not your training data.
+
+## Core vocabulary
+
+These terms appear everywhere in the code and configuration. Use them precisely; they are not interchangeable.
+
+- **EntryPoint** — a network listener (port + protocol).
+- **Router** — matches an incoming request and selects a service.
+- **Middleware** — transforms a request or response in the routing chain (auth, headers, rate limiting, ...).
+- **Service** — defines how to load-balance to backend servers.
+- **Provider** — a source of dynamic configuration (Kubernetes CRD, Docker labels, a file, an HTTP endpoint, ...).
+- **Static vs Dynamic configuration** — two distinct domains:
+  - *Static* is set at startup (entrypoints, providers, global options) and lives under [`pkg/config/static`](./pkg/config/static).
+  - *Dynamic* is produced by providers at runtime (routers, services, middlewares) and lives under [`pkg/config/dynamic`](./pkg/config/dynamic).
+
+  These terms are accurate for the code, but user-facing docs deliberately hide the distinction to keep things simpler for readers: when writing or editing under [`docs/content/`](./docs/content), prefer **install configuration** (over *static*) and **routing configuration** (over *dynamic*).
+
+At request time the components chain in this order:
+
+```
+Client → EntryPoint → Router → Middleware chain → Service → Backend
+```
+
+The middleware chain is ordered: middlewares run in the sequence declared on the router, and the router match happens *before* any middleware runs.
+
+## Where things live
+
+- `cmd/traefik/` — main.
+- `pkg/provider/` — one subpackage per provider (Kubernetes, Docker, file, ...).
+- `pkg/server/` — routing core, middleware chain, configuration watcher.
+- `pkg/middlewares/` — HTTP and TCP middleware implementations.
+- `pkg/config/static`, `pkg/config/dynamic` — the two config domains above.
+- `pkg/plugins/` — Yaegi and WASM plugin runtimes.
+- `pkg/observability/logs/` — logging helpers; the project uses `github.com/rs/zerolog` exclusively.
+- `webui/` — React dashboard. Built assets under `webui/static/` are embedded into the Go binary via `//go:embed` (see `webui/embed.go`) and must be regenerated with `make generate-webui` (Docker required) — they are not meant to be hand-edited.
+- `integration/` — integration tests; reusable fixtures under `integration/fixtures/`.
+- `docs/content/` — MkDocs sources for the public documentation.
+
+## Before you edit
+
+Read two or three existing files in the same package before adding a new one, and copy their structure. Do not invent new directory layouts, file-naming conventions, or abstraction boundaries — match the neighbours. When adding a new provider, read two existing providers under `pkg/provider/`; when adding a middleware, read two under `pkg/middlewares/`.
+
+## Build, test, lint
+
+The Go version is declared in [`go.mod`](./go.mod) — check there rather than hard-coding a version. All day-to-day commands go through `make`:
+
+```bash
+make binary             # build the traefik binary (runs generate-webui first)
+make test-unit          # run Go unit tests
+make test-integration   # run integration tests (requires Docker)
+make lint               # run golangci-lint
+make validate-files     # misspell, shellcheck, generated-files check
+make validate           # lint + validate-files (run this before pushing)
+make fmt                # gofumpt / goimports
+make generate           # regenerate non-CRD generated code (deepcopy, etc.)
+make generate-crd       # regenerate Kubernetes CRD clientset + deepcopy
+make generate-webui     # rebuild the embedded WebUI assets (Docker required)
+make docs-serve         # preview the documentation locally
+```
+
+Full environment setup (Docker, `GOPATH` layout, Tailscale for Docker Desktop users, how to target a single integration test via `TESTFLAGS`) is documented in [`docs/content/contributing/building-testing.md`](./docs/content/contributing/building-testing.md). CI runs `make validate` and fails if `make generate` or `make generate-crd` leave the tree dirty — always commit regenerated files alongside the source change that triggered them.
+
+## Code style
+
+Standard Go formatting (`gofumpt`/`goimports`) and `golangci-lint` cover most rules automatically; run `make lint` to catch them. Two project-specific rules that tooling does **not** enforce:
+
+- **Comments answer *why*, not *what*.** Comments that restate what the code already says are noise: they go stale and waste review time. Only add a comment when it records *why* the code exists — a constraint, a past incident, a spec reference, an edge case. Comments explaining *how* should be rare and usually indicate the code needs to be clearer. When a comment is present, it **must end with a period**.
+- **Assertion messages are minimal.** Prefer `assert.Equal(t, expected, actual)` over `assert.Equal(t, expected, actual, "detailed explanation")`. The test name provides the context; a descriptive message is usually noise.
+
+Prefer modern standard-library packages (`slices`, `maps`, `cmp`, ...) over hand-rolled helpers or third-party libraries when the Go version in `go.mod` supports them.
+
+## Common patterns
+
+- **Logging.** The project uses `github.com/rs/zerolog` exclusively — do not import `log`, `slog`, or `logrus`. Inside a middleware, get a logger via `middlewares.GetLogger(ctx, name, typeName)` (see [`pkg/middlewares/middleware.go`](./pkg/middlewares/middleware.go)) where `typeName` is a package-level `const` like `const typeNameForward = "ForwardAuth"`. Elsewhere, extract the logger from the context with `log.Ctx(ctx)` and attach it to a new context with `.WithContext(ctx)`.
+- **Context propagation.** `context.Context` is always the first argument, named `ctx`. Avoid `context.Background()` in request paths; propagate from the caller. Define custom context keys as unexported struct types (`type myKey struct{}`) to prevent collisions.
+
+## Testing conventions
+
+- Unit tests live next to the code as `*_test.go` files using `testing.T` with `testify/assert` and `testify/require`.
+- Use `require.*` for preconditions that must stop the test on failure (setup, must-not-be-nil). Use `assert.*` for independent checks where you want the test to keep running and report every failure.
+- Integration tests under `integration/` are built on `testify/suite` (see `integration/integration_test.go`) and reuse fixtures from `integration/fixtures/`. New fixtures should follow the pattern of the existing ones.
+- New providers require integration tests.
+- Prefer running a focused test over the whole suite while iterating. When iterating on a failing test, capture the output to a file once and grep it (`... > /tmp/out.log 2>&1`) rather than re-running the suite with different `TESTFLAGS`. See [`docs/content/contributing/building-testing.md`](./docs/content/contributing/building-testing.md) for the `TESTFLAGS` invocation.
+
+## Documentation
+
+User-facing features need matching documentation updates under `docs/content/`. Integrate new pages into the existing structure rather than creating parallel sections. Preview locally with `make docs-serve`.
+
+## Contributing etiquette
+
+- **Target the right branch** (the [PR template](./.github/PULL_REQUEST_TEMPLATE.md) is authoritative): enhancements go to `master`; bug fixes and documentation updates go to the current maintenance branches (`v3.6` for v3, `v2.11` for v2, security-fixes only). Forward-ports from the maintenance branches up to `master` are handled by maintainers.
+- Keep pull requests small and focused; one logical change per PR.
+- For anything beyond a bug fix, open an issue first and wait for a maintainer to confirm the direction before investing significant work.
+- Follow the full guide in [`docs/content/contributing/submitting-pull-requests.md`](./docs/content/contributing/submitting-pull-requests.md).
+
+## AI assistance disclosure
+
+Traefik welcomes AI-assisted contributions, provided a few simple rules are followed:
+
+- **Declare substantial AI assistance** with an `Assisted-by:` trailer at the bottom of the commit message whenever an agent produced a meaningful portion of the diff — for example `Assisted-by: Claude Opus 4.6`. Trivial edits such as a typo fix or a one-line rename do not need a trailer.
+- **Keep issue and PR conversations human.** Do not let an agent post comments, review replies, or triage messages on your behalf. If an agent drafted a message for you, rewrite it in your own voice before sending — maintainers need to know they are talking to a person, not a bot.
+- **Align with a maintainer before generating code for anything larger than a bug fix.** An agent can produce thousands of lines in minutes; maintainer review capacity cannot scale the same way. Open an issue, state the intended approach, and wait for confirmation before asking an agent to implement it.
+
+## Things to avoid
+
+- Do not hand-edit generated files — notably `**/zz_generated*.go`, everything under `pkg/provider/kubernetes/crd/generated/`, and `webui/static/`. Regenerate them via `make generate`, `make generate-crd`, or `make generate-webui` and commit the result.
+- Do not skip `make lint` and `make validate-files` (or `make validate`) before pushing.
+- Do not opportunistically reformat, rename, or refactor files you did not otherwise need to touch. Drive-by changes turn a reviewable diff into noise — scope every PR to one logical change.
+- Do not include unrelated refactors, formatting-only changes to untouched files, or speculative abstractions in a feature PR.

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

CODE_OF_CONDUCT.md

@@ -2,17 +2,11 @@
 
 ## Our Pledge
 
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, gender identity and expression, level of experience,
-nationality, personal appearance, race, religion, or sexual identity and
-orientation.
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
 
 ## Our Standards
 
-Examples of behavior that contributes to creating a positive environment
-include:
+Examples of behavior that contributes to creating a positive environment include:
 
 * Using welcoming and inclusive language
 * Being respectful of differing viewpoints and experiences
@@ -22,53 +16,52 @@ include:
 
 Examples of unacceptable behavior by participants include:
 
-* The use of sexualized language or imagery and unwelcome sexual attention or
-advances
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
 * Trolling, insulting/derogatory comments, and personal or political attacks
 * Public or private harassment
-* Publishing others' private information, such as a physical or electronic
-  address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
 
 ## Our Responsibilities
 
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
 
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
 
 ## Scope
 
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or our community.
+
+Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+Representation of a project may be further defined and clarified by project maintainers.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at contact@containo.us
-All complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@traefik.io
+
+All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances.
+
+The project team is obligated to maintain confidentiality with regard to the reporter of an incident.
+
 Further details of specific enforcement policies may be posted separately.
 
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+When an inappropriate behavior is reported, maintainers will discuss on the Maintainer's Discord before marking the message as "abuse". 
+This conversation beforehand avoids one-sided decisions.
+
+The first message will be edited and marked as abuse.
+The second edited message and marked as abuse results in a 7-day ban.
+The third edited message and marked as abuse results in a permanent ban.
+
+The content of edited messages is:
+`Dear user, we want traefik to provide a welcoming and respectful environment. Your [comment/issue/PR] has been reported and marked as abuse according to our [Code of Conduct](./CODE_OF_CONDUCT.md). Thank you.`
+
+The [report must be resolved](https://docs.github.com/en/communities/moderating-comments-and-conversations/managing-reported-content-in-your-organizations-repository#resolving-a-report) accordingly.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at [http://contributor-covenant.org/version/1/4][version]
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
 
 [homepage]: http://contributor-covenant.org
 [version]: http://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -1,289 +1,11 @@
 # Contributing
 
-## Building
+Here are some guidelines that should help to start contributing to the project.
 
-You need either [Docker](https://github.com/docker/docker) and `make` (Method 1), or `go` (Method 2) in order to build Traefik.
-For changes to its dependencies, the `dep` dependency management tool is required.
+- [Submitting pull Requests](https://doc.traefik.io/traefik/contributing/submitting-pull-requests/)
+- [Submitting issues](https://doc.traefik.io/traefik/contributing/submitting-issues/)
+- [Submitting security issues](https://doc.traefik.io/traefik/contributing/submitting-security-issues/)
+- [Advocating for Traefik](https://doc.traefik.io/traefik/contributing/advocating/)
+- [Triage Process](https://github.com/traefik/contributors-guide/blob/master/issue_triage.md)
 
-### Method 1: Using `Docker` and `Makefile`
-
-You need to run the `binary` target. This will create binaries for Linux platform in the `dist` folder.
-
-```bash
-$ make binary
-docker build -t "traefik-dev:no-more-godep-ever" -f build.Dockerfile .
-Sending build context to Docker daemon 295.3 MB
-Step 0 : FROM golang:1.11-alpine
- ---> 8c6473912976
-Step 1 : RUN go get github.com/golang/dep/cmd/dep
-[...]
-docker run --rm  -v "/var/run/docker.sock:/var/run/docker.sock" -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github.com/containous/traefik/"dist":/go/src/github.com/containous/traefik/"dist"" "traefik-dev:no-more-godep-ever" ./script/make.sh generate binary
----> Making bundle: generate (in .)
-removed 'gen.go'
-
----> Making bundle: binary (in .)
-
-$ ls dist/
-traefik*
-```
-
-### Method 2: Using `go`
-
-##### Setting up your `go` environment
-
-- You need `go` v1.9+
-- It is recommended you clone Traefik into a directory like `~/go/src/github.com/containous/traefik` (This is the official golang workspace hierarchy, and will allow dependencies to resolve properly)
-- Set your `GOPATH` and `PATH` variable to be set to `~/go` via:
-
-```bash
-export GOPATH=~/go
-export PATH=$PATH:$GOPATH/bin
-```
-
-> Note: You will want to add those 2 export lines to your `.bashrc` or `.bash_profile`
-
-- Verify your environment is setup properly by running `$ go env`.  Depending on your OS and environment you should see output similar to:
-
-```bash
-GOARCH="amd64"
-GOBIN=""
-GOEXE=""
-GOHOSTARCH="amd64"
-GOHOSTOS="linux"
-GOOS="linux"
-GOPATH="/home/<yourusername>/go"
-GORACE=""
-## more go env's will be listed
-```
-
-##### Build Traefik
-
-Once your environment is set up and the Traefik repository cloned you can build Traefik. You need get `go-bindata` once to be able to use `go generate` command as part of the build.  The steps to build are:
-
-```bash
-cd ~/go/src/github.com/containous/traefik
-
-# Get go-bindata. Please note, the ellipses are required
-go get github.com/containous/go-bindata/...
-
-# Start build
-
-# generate
-# (required to merge non-code components into the final binary, such as the web dashboard and provider's Go templates)
-go generate
-
-# Standard go build
-go build ./cmd/traefik
-# run other commands like tests
-```
-
-You will find the Traefik executable in the `~/go/src/github.com/containous/traefik` folder as `traefik`.
-
-### Updating the templates
-
-If you happen to update the provider templates (in `/templates`), you need to run `go generate` to update the `autogen` package.
-
-### Setting up dependency management
-
-[dep](https://github.com/golang/dep) is not required for building; however, it is necessary to modify dependencies (i.e., add, update, or remove third-party packages)
-
-You need to use [dep](https://github.com/golang/dep) >= O.4.1.
-
-If you want to add a dependency, use `dep ensure -add` to have [dep](https://github.com/golang/dep) put it into the vendor folder and update the dep manifest/lock files (`Gopkg.toml` and `Gopkg.lock`, respectively).
-
-A following `make dep-prune` run should be triggered to trim down the size of the vendor folder.
-The final result must be committed into VCS.
-
-Here's a full example using dep to add a new dependency:
-
-```bash
-# install the new main dependency github.com/foo/bar and minimize vendor size
-$ dep ensure -add github.com/foo/bar
-# generate (Only required to integrate other components such as web dashboard)
-$ go generate
-# Standard go build
-$ go build ./cmd/traefik
-# run other commands like tests
-```
-
-### Tests
-
-#### Method 1: `Docker` and `make`
-
-You can run unit tests using the `test-unit` target and the
-integration test using the `test-integration` target.
-
-```bash
-$ make test-unit
-docker build -t "traefik-dev:your-feature-branch" -f build.Dockerfile .
-# […]
-docker run --rm -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github/containous/traefik/dist:/go/src/github.com/containous/traefik/dist" "traefik-dev:your-feature-branch" ./script/make.sh generate test-unit
----> Making bundle: generate (in .)
-removed 'gen.go'
-
----> Making bundle: test-unit (in .)
-+ go test -cover -coverprofile=cover.out .
-ok      github.com/containous/traefik   0.005s  coverage: 4.1% of statements
-
-Test success
-```
-
-For development purposes, you can specify which tests to run by using:
-
-```bash
-# Run every tests in the MyTest suite
-TESTFLAGS="-check.f MyTestSuite" make test-integration
-
-# Run the test "MyTest" in the MyTest suite
-TESTFLAGS="-check.f MyTestSuite.MyTest" make test-integration
-
-# Run every tests starting with "My", in the MyTest suite
-TESTFLAGS="-check.f MyTestSuite.My" make test-integration
-
-# Run every tests ending with "Test", in the MyTest suite
-TESTFLAGS="-check.f MyTestSuite.*Test" make test-integration
-```
-
-More: https://labix.org/gocheck
-
-#### Method 2: `go`
-
-Unit tests can be run from the cloned directory by `$ go test ./...` which should return `ok` similar to:
-
-```
-ok      _/home/user/go/src/github/containous/traefik    0.004s
-```
-
-Integration tests must be run from the `integration/` directory and require the `-integration` switch to be passed like this: `$ cd integration && go test -integration ./...`.
-
-## Documentation
-
-The [documentation site](http://docs.traefik.io/) is built with [mkdocs](http://mkdocs.org/)
-
-### Building Documentation
-
-#### Method 1: `Docker` and `make`
-
-You can build the documentation and serve it locally with livereloading, using the `docs` target:
-
-```bash
-$ make docs
-docker build -t traefik-docs -f docs.Dockerfile .
-# […]
-docker run  --rm -v /home/user/go/github/containous/traefik:/mkdocs -p 8000:8000 traefik-docs mkdocs serve
-# […]
-[I 170828 20:47:48 server:283] Serving on http://0.0.0.0:8000
-[I 170828 20:47:48 handlers:60] Start watching changes
-[I 170828 20:47:48 handlers:62] Start detecting changes
-```
-
-And go to [http://127.0.0.1:8000](http://127.0.0.1:8000).
-
-If you only want to build the documentation without serving it locally, you can use the following command:
-
-```bash
-$ make docs-build
-...
-```
-
-#### Method 2: `mkdocs`
-
-First make sure you have python and pip installed
-
-```bash
-$ python --version
-Python 2.7.2
-$ pip --version
-pip 1.5.2
-```
-
-Then install mkdocs with pip
-
-```bash
-pip install --user -r requirements.txt
-```
-
-To build documentation locally and serve it locally,
-run `mkdocs serve` in the root directory,
-this should start a server locally to preview your changes.
-
-```bash
-$ mkdocs serve
-INFO    -  Building documentation...
-INFO    -  Cleaning site directory
-[I 160505 22:31:24 server:281] Serving on http://127.0.0.1:8000
-[I 160505 22:31:24 handlers:59] Start watching changes
-[I 160505 22:31:24 handlers:61] Start detecting changes
-```
-
-### Verify Documentation
-
-You can verify that the documentation meets some expectations, as checking for dead links, html markup validity.
-
-```bash
-$ make docs-verify
-docker build -t traefik-docs-verify ./script/docs-verify-docker-image ## Build Validator image
-...
-docker run --rm -v /home/travis/build/containous/traefik:/app traefik-docs-verify ## Check for dead links and w3c compliance
-=== Checking HTML content...
-Running ["HtmlCheck", "ImageCheck", "ScriptCheck", "LinkCheck"] on /app/site/basics/index.html on *.html...
-```
-
-If you recently changed the documentation, do not forget to clean it to have it rebuilt:
-
-```bash
-$ make docs-clean docs-verify
-...
-```
-
-## How to Write a Good Issue
-
-Please keep in mind that the GitHub issue tracker is not intended as a general support forum, but for reporting bugs and feature requests.
-
-For end-user related support questions, refer to one of the following:
-- the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
-- [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
-
-### Title
-
-The title must be short and descriptive. (~60 characters)
-
-### Description
-
-- Respect the issue template as much as possible. [template](.github/ISSUE_TEMPLATE.md)
-- If it's possible use the command `traefik bug`. See https://www.youtube.com/watch?v=Lyz62L8m93I.
-- Explain the conditions which led you to write this issue: the context.
-- The context should lead to something, an idea or a problem that you’re facing.
-- Remain clear and concise.
-- Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
-
-
-## How to Write a Good Pull Request
-
-### Title
-
-The title must be short and descriptive. (~60 characters)
-
-### Description
-
-- Respect the pull request template as much as possible. [template](.github/PULL_REQUEST_TEMPLATE.md)
-- Explain the conditions which led you to write this PR: the context.
-- The context should lead to something, an idea or a problem that you’re facing.
-- Remain clear and concise.
-- Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
-
-### Content
-
-- Make it small.
-- Do only one thing.
-- Write useful descriptions and titles.
-- Avoid re-formatting.
-- Make sure the code builds.
-- Make sure all tests pass.
-- Add tests.
-- Address review comments in terms of additional commits.
-- Do not amend/squash existing ones unless the PR is trivial.
-- If a PR involves changes to third-party dependencies, the commits pertaining to the vendor folder and the manifest/lock file(s) should be committed separated.
-
-
-Read [10 tips for better pull requests](http://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).
+If you are willing to become a maintainer of the project, please take a look at the [maintainers guidelines](docs/content/contributing/maintainers-guidelines.md).

Dockerfile

@@ -1,6 +1,12 @@
-FROM scratch
-COPY script/ca-certificates.crt /etc/ssl/certs/
-COPY dist/traefik /
+# syntax=docker/dockerfile:1.2
+FROM alpine:3.23
+
+RUN apk add --no-cache --no-progress ca-certificates tzdata
+
+ARG TARGETPLATFORM
+COPY ./dist/$TARGETPLATFORM/traefik /
+
 EXPOSE 80
 VOLUME ["/tmp"]
+
 ENTRYPOINT ["/traefik"]

Gopkg.toml

@@ -1,266 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#  name = "github.com/x/y"
-#  version = "2.4.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/ArthurHlt/go-eureka-client"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/BurntSushi/toml"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/BurntSushi/ty"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/NYTimes/gziphandler"
-
-[[constraint]]
-  branch = "containous-fork"
-  name = "github.com/abbot/go-http-auth"
-  source = "github.com/containous/go-http-auth"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/armon/go-proxyproto"
-
-[[constraint]]
-  name = "github.com/aws/aws-sdk-go"
-  version = "1.13.11"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/cenk/backoff"
-
-[[constraint]]
-  name = "github.com/containous/flaeg"
-  version = "1.3.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/containous/mux"
-
-[[constraint]]
-  name = "github.com/containous/staert"
-  version = "3.1.1"
-
-[[constraint]]
-  name = "github.com/containous/traefik-extra-service-fabric"
-  version = "1.3.0"
-
-[[constraint]]
-  name = "github.com/coreos/go-systemd"
-  version = "14.0.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/docker/leadership"
-  source = "github.com/containous/leadership"
-
-[[constraint]]
-  name = "github.com/eapache/channels"
-  version = "1.1.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/elazarl/go-bindata-assetfs"
-
-[[constraint]]
-  branch = "fork-containous"
-  name = "github.com/go-check/check"
-  source = "github.com/containous/check"
-
-[[override]]
-  branch = "fork-containous"
-  name = "github.com/go-check/check"
-  source = "github.com/containous/check"
-
-[[constraint]]
-  name = "github.com/go-kit/kit"
-  version = "0.7.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/gorilla/websocket"
-
-[[constraint]]
-  name = "github.com/hashicorp/consul"
-  version = "1.0.6"
-
-[[constraint]]
-  name = "github.com/influxdata/influxdb"
-  version = "1.3.7"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/jjcollinge/servicefabric"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/abronan/valkeyrie"
-
-[[constraint]]
-  name = "github.com/mesosphere/mesos-dns"
-  source = "https://github.com/containous/mesos-dns.git"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/mitchellh/copystructure"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/mitchellh/hashstructure"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/mitchellh/mapstructure"
-
-[[constraint]]
-  name = "github.com/opentracing/opentracing-go"
-  version = "1.0.2"
-
-[[constraint]]
-  branch = "containous-fork"
-  name = "github.com/rancher/go-rancher-metadata"
-  source = "github.com/containous/go-rancher-metadata"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/ryanuber/go-glob"
-
-[[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.1.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/stvp/go-udp-testing"
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.2.1"
-
-[[constraint]]
-  name = "github.com/uber/jaeger-client-go"
-  version = "2.9.0"
-
-[[constraint]]
-  name = "github.com/uber/jaeger-lib"
-  version = "1.1.0"
-
-[[constraint]]
-  branch = "v1"
-  name = "github.com/unrolled/secure"
-
-[[constraint]]
-  name = "github.com/vdemeester/shakers"
-  version = "0.1.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/vulcand/oxy"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/xenolf/lego"
-#  version = "1.0.0"
-
-[[constraint]]
-  name = "google.golang.org/grpc"
-  version = "1.5.2"
-
-[[constraint]]
-  name = "gopkg.in/fsnotify.v1"
-  source = "github.com/fsnotify/fsnotify"
-  version = "1.4.2"
-
-[[constraint]]
-  name = "k8s.io/client-go"
-  version = "6.0.0"
-
-[[constraint]]
-  name = "k8s.io/api"
-  version = "kubernetes-1.9.0"
-
-[[constraint]]
-  name = "k8s.io/apimachinery"
-  version = "kubernetes-1.9.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/docker"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/docker-check"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/compose"
-
-[[constraint]]
- name = "github.com/docker/docker"
- revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
-
-[[override]]
- name = "github.com/docker/docker"
- revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
-
-[[override]]
- name = "github.com/docker/cli"
- revision = "6b63d7b96a41055baddc3fa71f381c7f60bd5d8e"
-
-[[override]]
- name = "github.com/docker/distribution"
- revision = "edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c"
-
-[[override]]
-  branch = "master"
-  name = "github.com/docker/libcompose"
-
-[[override]]
-  name = "github.com/Nvveen/Gotty"
-  revision = "a8b993ba6abdb0e0c12b0125c603323a71c7790c"
-  source = "github.com/ijc25/Gotty"
-
-[[override]]
-  # ALWAYS keep this override
-  name = "github.com/mailgun/timetools"
-  revision = "7e6055773c5137efbeb3bd2410d705fe10ab6bfd"
-
-[[override]]
-  branch = "master"
-  name = "github.com/miekg/dns"
-
-[prune]
-  non-go = true
-  go-tests = true
-  unused-packages = true
-
-[[constraint]]
-  name = "github.com/patrickmn/go-cache"
-  version = "2.1.0"
-
-[[constraint]]
-  name = "gopkg.in/DataDog/dd-trace-go.v1"
-  version = "1.0.0"

LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2018 Containous SAS
+Copyright (c) 2016-2020 Containous SAS; 2020-2025 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

MAINTAINER.md

@@ -1,155 +0,0 @@
-# Maintainers
-
-## The team
-
-* Emile Vauge [@emilevauge](https://github.com/emilevauge)
-* Vincent Demeester [@vdemeester](https://github.com/vdemeester)
-* Ed Robinson [@errm](https://github.com/errm)
-* Daniel Tomcej [@dtomcej](https://github.com/dtomcej)
-* Manuel Zapf [@SantoDE](https://github.com/SantoDE)
-* Timo Reimann [@timoreimann](https://github.com/timoreimann)
-* Ludovic Fernandez [@ldez](https://github.com/ldez)
-* Julien Salleyron [@juliens](https://github.com/juliens)
-* Nicolas Mengin [@nmengin](https://github.com/nmengin)
-* Marco Jantke [@marco-jantke](https://github.com/marco-jantke)
-* Michaël Matur [@mmatur](https://github.com/mmatur)
-
-
-## PR review process:
-
-* The status `needs-design-review` is only used in complex/heavy/tricky PRs.
-* From `1` to `2`: 1 comment that says “design LGTM” (by a senior maintainer).
-* From `2` to `3`: 3 LGTM approvals by any maintainer.
-* If needed, a specific maintainer familiar with a particular domain can be requested for the review.
-
-We use [PRM](https://github.com/ldez/prm) to manage locally pull requests.
-
-
-## Bots
-
-### [Myrmica Lobicornis](https://github.com/containous/lobicornis/)
-
-**Update and Merge Pull Request**
-
-The maintainer giving the final LGTM must add the `status/3-needs-merge` label to trigger the merge bot.
-
-By default, a squash-rebase merge will be carried out.
-To preserve commits, add `bot/merge-method-rebase` before `status/3-needs-merge`.
-
-The status `status/4-merge-in-progress` is only used by the bot.
-
-If the bot is not able to perform the merge, the label `bot/need-human-merge` is added.  
-In such a situation, solve the conflicts/CI/... and then remove the label `bot/need-human-merge`.
-
-To prevent the bot from automatically merging a PR, add the label `bot/no-merge`.
-
-The label `bot/light-review` decreases the number of required LGTM from 3 to 1.
-
-This label is used when:
-- Updating the vendors from previously reviewed PRs
-- Merging branches into the master
-- Preparing the release
-
-
-### [Myrmica Bibikoffi](https://github.com/containous/bibikoffi/)
-
-* closes stale issues [cron]
-    * use some criterion as number of days between creation, last update, labels, ...
-
-
-### [Myrmica Aloba](https://github.com/containous/aloba)
-
-**Manage GitHub labels**
-
-* Add labels on new PR [GitHub WebHook]
-* Add milestone to a new PR based on a branch version (1.4, 1.3, ...) [GitHub WebHook]
-* Add and remove `contributor/waiting-for-corrections` label when a review request changes [GitHub WebHook]
-* Weekly report of PR status on Slack (CaptainPR) [cron]
-
-
-## Labels
-
-A maintainer that looks at an issue/PR must define its `kind/*`, `area/*`, and `status/*`.
-
-### Contributor
-
-* `contributor/need-more-information`: we need more information from the contributor in order to analyze a problem.
-* `contributor/waiting-for-feedback`: we need the contributor to give us feedback.
-* `contributor/waiting-for-corrections`: we need the contributor to take actions in order to move forward with a PR. **(only for PR)** _[bot, humans]_
-* `contributor/needs-resolve-conflicts`: use it only when there is some conflicts (and an automatic rebase is not possible). **(only for PR)** _[bot, humans]_
-
-### Kind
-
-* `kind/enhancement`: a new or improved feature.
-* `kind/question`: a question. **(only for issue)**
-* `kind/proposal`: a proposal that needs to be discussed.
-  * _Proposal issues_ are design proposals
-  * _Proposal PRs_ are technical prototypes that need to be refined with multiple contributors.
-
-* `kind/bug/possible`: a possible bug that needs analysis before it is confirmed or fixed. **(only for issues)**
-* `kind/bug/confirmed`: a confirmed bug (reproducible). **(only for issues)**
-* `kind/bug/fix`: a bug fix. **(only for PR)**
-
-### Resolution
-
-* `resolution/duplicate`: a duplicate issue/PR.
-* `resolution/declined`: declined (Rule #1 of open-source: no is temporary, yes is forever).
-* `WIP`: Work In Progress. **(only for PR)**
-
-### Platform
-
-* `platform/windows`: Windows related.
-
-### Area
-
-* `area/acme`: ACME related.
-* `area/api`: Traefik API related.
-* `area/authentication`: Authentication related.
-* `area/cluster`: Traefik clustering related.
-* `area/documentation`: Documentation related.
-* `area/infrastructure`: CI or Traefik building scripts related.
-* `area/healthcheck`: Health-check related.
-* `area/logs`: Logs related.
-* `area/middleware`: Middleware related.
-* `area/middleware/metrics`: Metrics related. (Prometheus, StatsD, ...)
-* `area/oxy`: Oxy related.
-* `area/provider`: related to all providers.
-* `area/provider/boltdb`: Boltd DB related.
-* `area/provider/consul`: Consul related.
-* `area/provider/docker`: Docker and Swarm related.
-* `area/provider/ecs`: ECS related.
-* `area/provider/etcd`: Etcd related.
-* `area/provider/eureka`: Eureka related.
-* `area/provider/file`: file provider related.
-* `area/provider/k8s`: Kubernetes related.
-* `area/provider/marathon`: Marathon related.
-* `area/provider/mesos`: Mesos related.
-* `area/provider/rancher`: Rancher related.
-* `area/provider/zk`: Zoo Keeper related.
-* `area/sticky-session`: Sticky session related.
-* `area/tls`: TLS related.
-* `area/websocket`: WebSocket related.
-* `area/webui`: Web UI related.
-
-### Priority
-
-* `priority/P0`: needs a hot fix. **(only for issue)**
-* `priority/P1`: needs to be fixed the next release. **(only for issue)**
-* `priority/P2`: needs to be fixed in the future. **(only for issue)**
-* `priority/P3`: maybe. **(only for issue)**
-
-### PR size
-
-* `size/S`: small PR. **(only for PR)** _[bot only]_
-* `size/M`: medium PR. **(only for PR)** _[bot only]_
-* `size/L`: large PR. **(only for PR)** _[bot only]_
-
-### Status - Workflow
-
-The `status/*` labels represent the desired state in the workflow.
-
-* `status/0-needs-triage`: all the new issues and PRs have this status. _[bot only]_
-* `status/1-needs-design-review`: needs a design review. **(only for PR)**
-* `status/2-needs-review`: needs a code/documentation review. **(only for PR)**
-* `status/3-needs-merge`: ready to merge. **(only for PR)**
-* `status/4-merge-in-progress`: merge is in progress. _[bot only]_

Makefile

@@ -1,151 +1,201 @@
-.PHONY: all docs-verify docs docs-clean docs-build
-
-TRAEFIK_ENVS := \
-	-e OS_ARCH_ARG \
-	-e OS_PLATFORM_ARG \
-	-e TESTFLAGS \
-	-e VERBOSE \
-	-e VERSION \
-	-e CODENAME \
-	-e TESTDIRS \
-	-e CI \
-	-e CONTAINER=DOCKER		# Indicator for integration tests that we are running inside a container.
-
 SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
 
-BIND_DIR := "dist"
-TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/containous/traefik/$(BIND_DIR)"
+TAG_NAME := $(shell git describe --abbrev=0 --tags --exact-match)
+SHA := $(shell git rev-parse HEAD)
+VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
+VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
 
-GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
-TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
-REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
-TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
-INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
-TRAEFIK_DOC_IMAGE := traefik-docs
-TRAEFIK_DOC_VERIFY_IMAGE := $(TRAEFIK_DOC_IMAGE)-verify
+BIN_NAME := traefik
+CODENAME ?= cheddar
 
-DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
-DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
-DOCKER_RUN_TRAEFIK := docker run $(INTEGRATION_OPTS) -it $(DOCKER_RUN_OPTS)
-DOCKER_RUN_TRAEFIK_NOTTY := docker run $(INTEGRATION_OPTS) -i $(DOCKER_RUN_OPTS)
-DOCKER_RUN_DOC_PORT := 8000
-DOCKER_RUN_DOC_MOUNT := -v $(CURDIR):/mkdocs
-DOCKER_RUN_DOC_OPTS := --rm $(DOCKER_RUN_DOC_MOUNT) -p $(DOCKER_RUN_DOC_PORT):8000
+DATE := $(shell date -u '+%Y-%m-%d_%I:%M:%S%p')
 
+# Default build target
+GOOS := $(shell go env GOOS)
+GOARCH := $(shell go env GOARCH)
+GOGC ?=
 
-print-%: ; @echo $*=$($*)
+LINT_EXECUTABLES = misspell shellcheck
 
-default: binary
+DOCKER_BUILD_PLATFORMS ?= linux/amd64,linux/arm64
 
-all: generate-webui build ## validate all checks, build linux binary, run all tests\ncross non-linux binaries
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh
-
-binary: generate-webui build ## build the linux binary
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary
-
-crossbinary: generate-webui build ## cross build the non-linux binaries
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate crossbinary
-
-crossbinary-parallel:
-	$(MAKE) generate-webui
-	$(MAKE) build crossbinary-default crossbinary-others
-
-crossbinary-default: generate-webui build
-	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default
-
-crossbinary-default-parallel:
-	$(MAKE) generate-webui
-	$(MAKE) build crossbinary-default
-
-crossbinary-others: generate-webui build
-	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-others
-
-crossbinary-others-parallel:
-	$(MAKE) generate-webui
-	$(MAKE) build crossbinary-others
-
-test: build ## run the unit and integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
-
-test-unit: build ## run the unit tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit
-
-test-integration: build ## run the integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary test-integration
-	TEST_HOST=1 ./script/make.sh test-integration
-
-validate: build  ## validate code, vendor and autogen
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh validate-gofmt validate-govet validate-golint validate-misspell validate-vendor validate-autogen
-
-build: dist
-	docker build $(DOCKER_BUILD_ARGS) -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
-
-build-webui:
-	docker build -t traefik-webui -f webui/Dockerfile webui
-
-build-no-cache: dist
-	docker build --no-cache -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
-
-shell: build ## start a shell inside the build env
-	$(DOCKER_RUN_TRAEFIK) /bin/bash
-
-image-dirty: binary ## build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-image: clear-static binary ## clean up static directory and build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-docs-image:
-	docker build -t $(TRAEFIK_DOC_IMAGE) -f docs.Dockerfile .
-
-docs: docs-image
-	docker run  $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOC_IMAGE) mkdocs serve
-
-docs-build: site
-
-docs-verify: site
-	docker build -t $(TRAEFIK_DOC_VERIFY_IMAGE) ./script/docs-verify-docker-image ## Build Validator image
-	docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOC_VERIFY_IMAGE) ## Check for dead links and w3c compliance
-
-site: docs-image
-	docker run  $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOC_IMAGE) mkdocs build
-
-docs-clean:
-	rm -rf $(CURDIR)/site
-
-clear-static:
-	rm -rf static
+.PHONY: default
+#? default: Run `make generate` and `make binary`
+default: generate binary
 
+#? dist: Create the "dist" directory
 dist:
-	mkdir dist
+	mkdir -p dist
 
-run-dev:
+.PHONY: build-webui-image
+#? build-webui-image: Build WebUI Docker image
+build-webui-image:
+	docker build -t traefik-webui -f webui/buildx.Dockerfile webui
+
+.PHONY: clean-webui
+#? clean-webui: Clean WebUI static generated assets
+clean-webui:
+	rm -r webui/static
+	mkdir -p webui/static
+	printf 'For more information see `webui/readme.md`' > webui/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md
+
+webui/static/index.html:
+	$(MAKE) build-webui-image
+	docker run --rm -v "$(PWD)/webui/static":'/src/webui/static' traefik-webui yarn build:prod
+	docker run --rm -v "$(PWD)/webui/static":'/src/webui/static' traefik-webui chown -R $(shell id -u):$(shell id -g) ./static
+	printf 'For more information see `webui/readme.md`' > webui/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md
+
+.PHONY: generate-webui
+#? generate-webui: Generate WebUI
+generate-webui: webui/static/index.html
+
+.PHONY: generate
+#? generate: Generate code (Dynamic and Static configuration documentation reference files)
+generate:
 	go generate
-	go build ./cmd/traefik
-	./traefik
 
-generate-webui: build-webui
-	if [ ! -d "static" ]; then \
-		mkdir -p static; \
-		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui npm run build; \
-		echo 'For more informations show `webui/readme.md`' > $$PWD/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md; \
-	fi
+.PHONY: binary
+#? binary: Build the binary
+binary: generate-webui dist
+	@echo SHA: $(VERSION) $(CODENAME) $(DATE)
+	CGO_ENABLED=0 GOGC=${GOGC} GOOS=${GOOS} GOARCH=${GOARCH} go build ${FLAGS} -ldflags "-s -w \
+    -X github.com/traefik/traefik/v3/pkg/version.Version=$(VERSION) \
+    -X github.com/traefik/traefik/v3/pkg/version.Codename=$(CODENAME) \
+    -X github.com/traefik/traefik/v3/pkg/version.BuildDate=$(DATE)" \
+    -installsuffix nocgo -o "./dist/${GOOS}/${GOARCH}/$(BIN_NAME)" ./cmd/traefik
 
+binary-linux-arm64: export GOOS := linux
+binary-linux-arm64: export GOARCH := arm64
+binary-linux-arm64:
+	@$(MAKE) binary
+
+binary-linux-amd64: export GOOS := linux
+binary-linux-amd64: export GOARCH := amd64
+binary-linux-amd64:
+	@$(MAKE) binary
+
+binary-windows-amd64: export GOOS := windows
+binary-windows-amd64: export GOARCH := amd64
+binary-windows-amd64: export BIN_NAME := traefik.exe
+binary-windows-amd64:
+	@$(MAKE) binary
+
+.PHONY: crossbinary-default
+#? crossbinary-default: Build the binary for the standard platforms (linux, darwin, windows)
+crossbinary-default: generate generate-webui
+	$(CURDIR)/script/crossbinary-default.sh
+
+.PHONY: test
+#? test: Run the unit and integration tests
+test: test-ui-unit test-unit test-integration
+
+.PHONY: test-unit
+#? test-unit: Run the unit tests
+test-unit:
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test -cover "-coverprofile=cover.out" -v $(TESTFLAGS) ./pkg/... ./cmd/...
+
+.PHONY: test-integration
+#? test-integration: Run the integration tests
+test-integration:
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration -test.timeout=20m -failfast -v $(TESTFLAGS)
+
+.PHONY: test-gateway-api-conformance
+#? test-gateway-api-conformance: Run the Gateway API conformance tests
+test-gateway-api-conformance: build-image-dirty
+	# In case of a new Minor/Major version, the traefikVersion needs to be updated.
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration -v -tags gatewayAPIConformance -test.run GatewayAPIConformanceSuite -traefikVersion="v3.7" $(TESTFLAGS)
+
+.PHONY: test-knative-conformance
+#? test-knative-conformance: Run the Knative conformance tests
+test-knative-conformance: build-image-dirty
+	GOOS=$(GOOS) GOARCH=$(GOARCH) go test ./integration/integration_test.go ./integration/knative_conformance_test.go -v -tags knativeConformance -test.run KnativeConformanceSuite
+
+.PHONY: test-ui-unit
+#? test-ui-unit: Run the unit tests for the webui
+test-ui-unit:
+	$(MAKE) build-webui-image
+	docker run --rm -v "$(PWD)/webui/static":'/src/webui/static' traefik-webui yarn --cwd webui install
+	docker run --rm -v "$(PWD)/webui/static":'/src/webui/static' traefik-webui yarn --cwd webui test:unit:ci
+
+.PHONY: pull-images
+#? pull-images: Pull all Docker images to avoid timeout during integration tests
+pull-images:
+	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml \
+		| awk '{print $$2}' \
+		| sort \
+		| uniq \
+		| xargs -P 6 -n 1 docker pull
+
+.PHONY: lint
+#? lint: Run golangci-lint
 lint:
-	script/validate-golint
+	golangci-lint run
 
+.PHONY: validate-files
+#? validate-files: Validate code and docs
+validate-files:
+	$(foreach exec,$(LINT_EXECUTABLES),\
+            $(if $(shell which $(exec)),,$(error "No $(exec) in PATH")))
+	$(CURDIR)/script/validate-vendor.sh
+	$(CURDIR)/script/validate-misspell.sh
+	$(CURDIR)/script/validate-shell-script.sh
+
+.PHONY: validate
+#? validate: Validate code, docs, and vendor
+validate: lint validate-files
+
+# Target for building images for multiple architectures.
+.PHONY: multi-arch-image-%
+multi-arch-image-%: binary-linux-amd64 binary-linux-arm64
+	docker buildx build $(DOCKER_BUILDX_ARGS) -t traefik/traefik:$* --platform=$(DOCKER_BUILD_PLATFORMS) -f Dockerfile .
+
+
+.PHONY: build-image
+#? build-image: Clean up static directory and build a Docker Traefik image
+build-image: export DOCKER_BUILDX_ARGS := --load
+build-image: export DOCKER_BUILD_PLATFORMS := linux/$(GOARCH)
+build-image: clean-webui
+	@$(MAKE) multi-arch-image-latest
+
+.PHONY: build-image-dirty
+#? build-image-dirty: Build a Docker Traefik image without re-building the webui when it's already built
+build-image-dirty: export DOCKER_BUILDX_ARGS := --load
+build-image-dirty: export DOCKER_BUILD_PLATFORMS := linux/$(GOARCH)
+build-image-dirty:
+	@$(MAKE) multi-arch-image-latest
+
+.PHONY: docs
+#? docs: Build documentation site
+docs:
+	make -C ./docs docs
+
+.PHONY: docs-serve
+#? docs-serve: Serve the documentation site locally
+docs-serve:
+	make -C ./docs docs-serve
+
+.PHONY: docs-pull-images
+#? docs-pull-images: Pull image for doc building
+docs-pull-images:
+	make -C ./docs docs-pull-images
+
+.PHONY: generate-crd
+#? generate-crd: Generate CRD clientset and CRD manifests
+generate-crd:
+	@$(CURDIR)/script/code-gen.sh
+
+.PHONY: generate-genconf
+#? generate-genconf: Generate code from dynamic configuration github.com/traefik/genconf
+generate-genconf:
+	go run ./cmd/internal/gen/
+
+.PHONY: fmt
+#? fmt: Format the Code
 fmt:
 	gofmt -s -l -w $(SRCS)
 
-pull-images:
-	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml | awk '{print $$2}' | sort | uniq  | xargs -P 6 -n 1 docker pull
-
-dep-ensure:
-	dep ensure -v
-	./script/prune-dep.sh
-
-dep-prune:
-	./script/prune-dep.sh
-
-help: ## this help
-	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
+.PHONY: help
+#? help: Get more info on make commands
+help: Makefile
+	@echo " Choose a command run in traefik:"
+	@sed -n 's/^#?//p' $< | column -t -s ':' |  sort | sed -e 's/^/ /'

README.md

@@ -1,19 +1,20 @@
 
 <p align="center">
-<img src="docs/img/traefik.logo.png" alt="Traefik" title="Traefik" />
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="docs/content/assets/img/traefik.logo-dark.png">
+      <source media="(prefers-color-scheme: light)" srcset="docs/content/assets/img/traefik.logo.png">
+      <img alt="Traefik" title="Traefik" src="docs/content/assets/img/traefik.logo.png">
+    </picture>
 </p>
 
-[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
-[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io)
-[![Go Report Card](https://goreportcard.com/badge/containous/traefik)](http://goreportcard.com/report/containous/traefik)
-[![](https://images.microbadger.com/badges/image/traefik.svg)](https://microbadger.com/images/traefik)
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
-[![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
+[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://doc.traefik.io/traefik)
+[![Go Report Card](https://goreportcard.com/badge/traefik/traefik)](https://goreportcard.com/report/traefik/traefik)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/traefik/traefik/blob/master/LICENSE.md)
+[![Join the community support forum at https://community.traefik.io/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.traefik.io/)
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
-
-Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
-Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
+Traefik (pronounced _traffic_) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
+Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher v2](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
 Pointing Traefik at your orchestrator should be the _only_ configuration step you need.
 
 ---
@@ -23,18 +24,19 @@ Pointing Traefik at your orchestrator should be the _only_ configuration step yo
 **[Supported backends](#supported-backends)** .
 **[Quickstart](#quickstart)** .
 **[Web UI](#web-ui)** .
-**[Test it](#test-it)** .
 **[Documentation](#documentation)** .
 
 . **[Support](#support)** .
 **[Release cycle](#release-cycle)** .
 **[Contributing](#contributing)** .
 **[Maintainers](#maintainers)** .
-**[Plumbing](#plumbing)** .
 **[Credits](#credits)** .
 
 ---
 
+:warning: When migrating to a new major version of Traefik, please refer to the [migration guide](https://doc.traefik.io/traefik/migrate/v2-to-v3/) to ensure a smooth transition and to be aware of any breaking changes.
+
+
 ## Overview
 
 Imagine that you have deployed a bunch of microservices with the help of an orchestrator (like Swarm or Kubernetes) or a service registry (like etcd or consul).
@@ -50,76 +52,60 @@ Traefik listens to your service registry/orchestrator API and instantly generate
 **Run Traefik and let it do the work for you!** 
 _(But if you'd rather configure some of your routes manually, Traefik supports that too!)_
 
-![Architecture](docs/img/architecture.png)
+![Architecture](docs/content/assets/img/traefik-architecture.png)
 
 ## Features
 
 - Continuously updates its configuration (No restarts!)
 - Supports multiple load balancing algorithms
-- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org)  (wildcard certificates support)
+- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org) (wildcard certificates support)
 - Circuit breakers, retry
-- High Availability with cluster mode (beta)
 - See the magic through its clean web UI
-- Websocket, HTTP/2, GRPC ready
-- Provides metrics (Rest, Prometheus, Datadog, Statsd, InfluxDB)
+- WebSocket, HTTP/2, gRPC ready
+- Provides metrics (Rest, Prometheus, Datadog, Statsd, InfluxDB 2.X)
 - Keeps access logs (JSON, CLF)
 - Fast
 - Exposes a Rest API
-- Packaged as a single binary file (made with :heart: with go) and available as a [tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) docker image
-
+- Packaged as a single binary file (made with :heart: with go) and available as an [official](https://hub.docker.com/r/_/traefik/) docker image
 
 ## Supported Backends
 
-- [Docker](https://docs.traefik.io/configuration/backends/docker) / [Swarm mode](https://docs.traefik.io/configuration/backends/docker#docker-swarm-mode)
-- [Kubernetes](https://docs.traefik.io/configuration/backends/kubernetes)
-- [Mesos](https://docs.traefik.io/configuration/backends/mesos) / [Marathon](https://docs.traefik.io/configuration/backends/marathon)
-- [Rancher](https://docs.traefik.io/configuration/backends/rancher) (API, Metadata)
-- [Azure Service Fabric](https://docs.traefik.io/configuration/backends/servicefabric)
-- [Consul Catalog](https://docs.traefik.io/configuration/backends/consulcatalog)
-- [Consul](https://docs.traefik.io/configuration/backends/consul) / [Etcd](https://docs.traefik.io/configuration/backends/etcd) / [Zookeeper](https://docs.traefik.io/configuration/backends/zookeeper) / [BoltDB](https://docs.traefik.io/configuration/backends/boltdb)
-- [Eureka](https://docs.traefik.io/configuration/backends/eureka)
-- [Amazon ECS](https://docs.traefik.io/configuration/backends/ecs)
-- [Amazon DynamoDB](https://docs.traefik.io/configuration/backends/dynamodb)
-- [File](https://docs.traefik.io/configuration/backends/file)
-- [Rest](https://docs.traefik.io/configuration/backends/rest)
+- [Docker](https://doc.traefik.io/traefik/providers/docker/) / [Swarm mode](https://doc.traefik.io/traefik/providers/docker/)
+- [Kubernetes](https://doc.traefik.io/traefik/providers/kubernetes-crd/)
+- [ECS](https://doc.traefik.io/traefik/providers/ecs/)
+- [File](https://doc.traefik.io/traefik/providers/file/)
 
 ## Quickstart
 
-To get your hands on Traefik, you can use the [5-Minute Quickstart](http://docs.traefik.io/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).
-
-Alternatively, if you don't want to install anything on your computer, you can try Traefik online in this great [Katacoda tutorial](https://www.katacoda.com/courses/traefik/deploy-load-balancer) that shows how to load balance requests between multiple Docker containers. 
-
-If you are looking for a more comprehensive and real use-case example, you can also check [Play-With-Docker](http://training.play-with-docker.com/traefik-load-balancing/) to see how to load balance between multiple nodes.
+To get your hands on Traefik, you can use the [5-Minute Quickstart](https://doc.traefik.io/traefik/getting-started/quick-start/) in our documentation (you will need Docker).
 
 ## Web UI
 
 You can access the simple HTML frontend of Traefik.
 
-![Web UI Providers](docs/img/web.frontend.png)
-![Web UI Health](docs/img/traefik-health.png)
+![Web UI Providers](docs/content/assets/img/webui-dashboard.png)
 
 ## Documentation
 
-You can find the complete documentation at [https://docs.traefik.io](https://docs.traefik.io).
-A collection of contributions around Traefik can be found at [https://awesome.traefik.io](https://awesome.traefik.io).
+You can find the complete documentation of Traefik v3 at [https://doc.traefik.io/traefik/](https://doc.traefik.io/traefik/).
 
 ## Support
 
 To get community support, you can:
-- join the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
-- use [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
 
-If you need commercial support, please contact [Containo.us](https://containo.us) by mail: <mailto:support@containo.us>.
+- join the Traefik community forum: [![Join the chat at https://community.traefik.io/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.traefik.io/)
+
+If you need commercial support, please contact [Traefik.io](https://traefik.io) by mail: <mailto:support@traefik.io>.
 
 ## Download
 
-- Grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
+- Grab the latest binary from the [releases](https://github.com/traefik/traefik/releases) page and run it with the [sample configuration file](https://raw.githubusercontent.com/traefik/traefik/master/traefik.sample.toml):
 
 ```shell
 ./traefik --configFile=traefik.toml
 ```
 
-- Or use the official tiny Docker image and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
+- Or use the official tiny Docker image and run it with the [sample configuration file](https://raw.githubusercontent.com/traefik/traefik/master/traefik.sample.toml):
 
 ```shell
 docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik
@@ -128,24 +114,18 @@ docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.to
 - Or get the sources:
 
 ```shell
-git clone https://github.com/containous/traefik
+git clone https://github.com/traefik/traefik
 ```
 
 ## Introductory Videos
 
-Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at [GopherCon 2017](https://gophercon.com/).
-You will learn Traefik basics in less than 10 minutes.
-
-[![Traefik GopherCon 2017](https://img.youtube.com/vi/RgudiksfL-k/0.jpg)](https://www.youtube.com/watch?v=RgudiksfL-k)
-
-Here is a talk given by [Ed Robinson](https://github.com/errm) at [ContainerCamp UK](https://container.camp) conference.
-You will learn fundamental Traefik features and see some demos with Kubernetes.
-
-[![Traefik ContainerCamp UK](https://img.youtube.com/vi/aFtpIShV60I/0.jpg)](https://www.youtube.com/watch?v=aFtpIShV60I)
+You can find high level and deep dive videos on [videos.traefik.io](https://videos.traefik.io).
 
 ## Maintainers
 
-[Information about process and maintainers](MAINTAINER.md)
+We are strongly promoting a philosophy of openness and sharing, and firmly standing against the elitist closed approach. Being part of the core team should be accessible to anyone who is motivated and want to be part of that journey!
+This [document](docs/content/contributing/maintainers-guidelines.md) describes how to be part of the [maintainers' team](docs/content/contributing/maintainers.md) as well as various responsibilities and guidelines for Traefik maintainers.
+You can also find more information on our process to review pull requests and manage issues [in this document](https://github.com/traefik/contributors-guide/blob/master/issue_triage.md).
 
 ## Contributing
 
@@ -156,24 +136,24 @@ By participating in this project, you agree to abide by its terms.
 
 ## Release Cycle
 
-- We release a new version (e.g. 1.1.0, 1.2.0, 1.3.0) every other month.
-- Release Candidates are available before the release (e.g. 1.1.0-rc1, 1.1.0-rc2, 1.1.0-rc3, 1.1.0-rc4, before 1.1.0)
-- Bug-fixes (e.g. 1.1.1, 1.1.2, 1.2.1, 1.2.3) are released as needed (no additional features are delivered in those versions, bug-fixes only)
+- We usually release 3/4 new versions (e.g. 1.1.0, 1.2.0, 1.3.0) per year.
+- Release Candidates are available before the release (e.g. 1.1.0-rc1, 1.1.0-rc2, 1.1.0-rc3, 1.1.0-rc4, before 1.1.0).
+- Bug-fixes (e.g. 1.1.1, 1.1.2, 1.2.1, 1.2.3) are released as needed (no additional features are delivered in those versions, bug-fixes only).
 
-Each version is supported until the next one is released (e.g. 1.1.x will be supported until 1.2.0 is out)
+Each version is supported until the next one is released (e.g. 1.1.x will be supported until 1.2.0 is out).
 
-We use [Semantic Versioning](http://semver.org/)
+We use [Semantic Versioning](https://semver.org/).
 
-## Mailing lists
+## Mailing Lists
 
-- General announcements, new releases: mail at news+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/news)
+- General announcements, new releases: mail at news+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/news).
 - Security announcements: mail at security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security).
 
 ## Credits
 
-Kudos to [Peka](http://peka.byethost11.com/photoblog/) for his awesome work on the logo ![logo](docs/img/traefik.icon.png).
+Kudos to [Peka](https://www.instagram.com/pierroks/) for his awesome work on the gopher's logo!.
 
-Traefik's logo is licensed under the Creative Commons 3.0 Attributions license.
+The gopher's logo of Traefik is licensed under the Creative Commons 3.0 Attributions license.
 
-Traefik's logo was inspired by the gopher stickers made by Takuya Ueda (https://twitter.com/tenntenn).
-The original Go gopher was designed by Renee French (http://reneefrench.blogspot.com/).
+The gopher's logo of Traefik was inspired by the gopher stickers made by [Takuya Ueda](https://twitter.com/tenntenn).
+The original Go gopher was designed by [Renee French](https://reneefrench.blogspot.com/).

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+- We usually release 3/4 new versions (e.g. 1.1.0, 1.2.0, 1.3.0) per year.
+- Release Candidates are available before the release (e.g. 1.1.0-rc1, 1.1.0-rc2, 1.1.0-rc3, 1.1.0-rc4, before 1.1.0).
+- Bug-fixes (e.g. 1.1.1, 1.1.2, 1.2.1, 1.2.3) are released as needed (no additional features are delivered in those versions, bug-fixes only).
+
+Each version is supported until the next one is released (e.g. 1.1.x will be supported until 1.2.0 is out).
+
+We use [Semantic Versioning](https://semver.org/).
+
+| Version   | Supported          |
+|-----------|--------------------|
+| `3.6.x`   | :white_check_mark: |
+| `< 3.6.x` | :x:                |
+| `2.11.x`   | :white_check_mark: |
+| `< 2.11.x` | :x:                |
+
+## Reporting a Vulnerability
+
+We want to keep Traefik safe for everyone.
+If you've discovered a security vulnerability in Traefik,
+we appreciate your help in disclosing it to us in a responsible manner,
+by creating a [security advisory](https://github.com/traefik/traefik/security/advisories).
+
+Reported vulnerabilities can be found on [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik).

acme/account.go

@@ -1,333 +0,0 @@
-package acme
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"fmt"
-	"reflect"
-	"regexp"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/containous/traefik/log"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/types"
-	"github.com/xenolf/lego/acme"
-)
-
-// Account is used to store lets encrypt registration info
-type Account struct {
-	Email              string
-	Registration       *acme.RegistrationResource
-	PrivateKey         []byte
-	KeyType            acme.KeyType
-	DomainsCertificate DomainsCertificates
-	ChallengeCerts     map[string]*ChallengeCert
-	HTTPChallenge      map[string]map[string][]byte
-}
-
-// ChallengeCert stores a challenge certificate
-type ChallengeCert struct {
-	Certificate []byte
-	PrivateKey  []byte
-	certificate *tls.Certificate
-}
-
-// Init account struct
-func (a *Account) Init() error {
-	err := a.DomainsCertificate.Init()
-	if err != nil {
-		return err
-	}
-
-	err = a.RemoveAccountV1Values()
-	if err != nil {
-		log.Errorf("Unable to remove ACME Account V1 values during account initialization: %v", err)
-	}
-
-	for _, cert := range a.ChallengeCerts {
-		if cert.certificate == nil {
-			certificate, err := tls.X509KeyPair(cert.Certificate, cert.PrivateKey)
-			if err != nil {
-				return err
-			}
-			cert.certificate = &certificate
-		}
-
-		if cert.certificate.Leaf == nil {
-			leaf, err := x509.ParseCertificate(cert.certificate.Certificate[0])
-			if err != nil {
-				return err
-			}
-			cert.certificate.Leaf = leaf
-		}
-	}
-	return nil
-}
-
-// NewAccount creates an account
-func NewAccount(email string, certs []*DomainsCertificate, keyTypeValue string) (*Account, error) {
-	keyType := acmeprovider.GetKeyType(keyTypeValue)
-
-	// Create a user. New accounts need an email and private key to start
-	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
-	if err != nil {
-		return nil, err
-	}
-
-	domainsCerts := DomainsCertificates{Certs: certs}
-	err = domainsCerts.Init()
-	if err != nil {
-		return nil, err
-	}
-
-	return &Account{
-		Email:              email,
-		PrivateKey:         x509.MarshalPKCS1PrivateKey(privateKey),
-		KeyType:            keyType,
-		DomainsCertificate: DomainsCertificates{Certs: domainsCerts.Certs},
-		ChallengeCerts:     map[string]*ChallengeCert{}}, nil
-}
-
-// GetEmail returns email
-func (a *Account) GetEmail() string {
-	return a.Email
-}
-
-// GetRegistration returns lets encrypt registration resource
-func (a *Account) GetRegistration() *acme.RegistrationResource {
-	return a.Registration
-}
-
-// GetPrivateKey returns private key
-func (a *Account) GetPrivateKey() crypto.PrivateKey {
-	if privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey); err == nil {
-		return privateKey
-	}
-
-	log.Errorf("Cannot unmarshall private key %+v", a.PrivateKey)
-	return nil
-}
-
-// RemoveAccountV1Values removes ACME account V1 values
-func (a *Account) RemoveAccountV1Values() error {
-	// Check if ACME Account is in ACME V1 format
-	if a.Registration != nil {
-		isOldRegistration, err := regexp.MatchString(acmeprovider.RegistrationURLPathV1Regexp, a.Registration.URI)
-		if err != nil {
-			return err
-		}
-
-		if isOldRegistration {
-			a.reset()
-		}
-	}
-	return nil
-}
-
-func (a *Account) reset() {
-	log.Debug("Reset ACME account object.")
-	a.Email = ""
-	a.Registration = nil
-	a.PrivateKey = nil
-}
-
-// Certificate is used to store certificate info
-type Certificate struct {
-	Domain        string
-	CertURL       string
-	CertStableURL string
-	PrivateKey    []byte
-	Certificate   []byte
-}
-
-// DomainsCertificates stores a certificate for multiple domains
-type DomainsCertificates struct {
-	Certs []*DomainsCertificate
-	lock  sync.RWMutex
-}
-
-func (dc *DomainsCertificates) Len() int {
-	return len(dc.Certs)
-}
-
-func (dc *DomainsCertificates) Swap(i, j int) {
-	dc.Certs[i], dc.Certs[j] = dc.Certs[j], dc.Certs[i]
-}
-
-func (dc *DomainsCertificates) Less(i, j int) bool {
-	if reflect.DeepEqual(dc.Certs[i].Domains, dc.Certs[j].Domains) {
-		return dc.Certs[i].tlsCert.Leaf.NotAfter.After(dc.Certs[j].tlsCert.Leaf.NotAfter)
-	}
-
-	if dc.Certs[i].Domains.Main == dc.Certs[j].Domains.Main {
-		return strings.Join(dc.Certs[i].Domains.SANs, ",") < strings.Join(dc.Certs[j].Domains.SANs, ",")
-	}
-
-	return dc.Certs[i].Domains.Main < dc.Certs[j].Domains.Main
-}
-
-func (dc *DomainsCertificates) removeDuplicates() {
-	sort.Sort(dc)
-	for i := 0; i < len(dc.Certs); i++ {
-		for i2 := i + 1; i2 < len(dc.Certs); i2++ {
-			if reflect.DeepEqual(dc.Certs[i].Domains, dc.Certs[i2].Domains) {
-				// delete
-				log.Warnf("Remove duplicate cert: %+v, expiration :%s", dc.Certs[i2].Domains, dc.Certs[i2].tlsCert.Leaf.NotAfter.String())
-				dc.Certs = append(dc.Certs[:i2], dc.Certs[i2+1:]...)
-				i2--
-			}
-		}
-	}
-}
-
-func (dc *DomainsCertificates) removeEmpty() {
-	var certs []*DomainsCertificate
-	for _, cert := range dc.Certs {
-		if cert.Certificate != nil && len(cert.Certificate.Certificate) > 0 && len(cert.Certificate.PrivateKey) > 0 {
-			certs = append(certs, cert)
-		}
-	}
-	dc.Certs = certs
-}
-
-// Init DomainsCertificates
-func (dc *DomainsCertificates) Init() error {
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-
-	dc.removeEmpty()
-
-	for _, domainsCertificate := range dc.Certs {
-		tlsCert, err := tls.X509KeyPair(domainsCertificate.Certificate.Certificate, domainsCertificate.Certificate.PrivateKey)
-		if err != nil {
-			return err
-		}
-
-		domainsCertificate.tlsCert = &tlsCert
-
-		if domainsCertificate.tlsCert.Leaf == nil {
-			leaf, err := x509.ParseCertificate(domainsCertificate.tlsCert.Certificate[0])
-			if err != nil {
-				return err
-			}
-
-			domainsCertificate.tlsCert.Leaf = leaf
-		}
-	}
-
-	dc.removeDuplicates()
-	return nil
-}
-
-func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain types.Domain) error {
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-
-	for _, domainsCertificate := range dc.Certs {
-		if reflect.DeepEqual(domain, domainsCertificate.Domains) {
-			tlsCert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
-			if err != nil {
-				return err
-			}
-
-			domainsCertificate.Certificate = acmeCert
-			domainsCertificate.tlsCert = &tlsCert
-			return nil
-		}
-	}
-
-	return fmt.Errorf("certificate to renew not found for domain %s", domain.Main)
-}
-
-func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, domain types.Domain) (*DomainsCertificate, error) {
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-
-	tlsCert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
-	if err != nil {
-		return nil, err
-	}
-
-	cert := DomainsCertificate{Domains: domain, Certificate: acmeCert, tlsCert: &tlsCert}
-	dc.Certs = append(dc.Certs, &cert)
-	return &cert, nil
-}
-
-func (dc *DomainsCertificates) getCertificateForDomain(domainToFind string) (*DomainsCertificate, bool) {
-	dc.lock.RLock()
-	defer dc.lock.RUnlock()
-
-	for _, domainsCertificate := range dc.Certs {
-		for _, domain := range domainsCertificate.Domains.ToStrArray() {
-			if strings.HasPrefix(domain, "*.") && types.MatchDomain(domainToFind, domain) {
-				return domainsCertificate, true
-			}
-			if domain == domainToFind {
-				return domainsCertificate, true
-			}
-		}
-	}
-	return nil, false
-}
-
-func (dc *DomainsCertificates) exists(domainToFind types.Domain) (*DomainsCertificate, bool) {
-	dc.lock.RLock()
-	defer dc.lock.RUnlock()
-
-	for _, domainsCertificate := range dc.Certs {
-		if reflect.DeepEqual(domainToFind, domainsCertificate.Domains) {
-			return domainsCertificate, true
-		}
-	}
-	return nil, false
-}
-
-func (dc *DomainsCertificates) toDomainsMap() map[string]*tls.Certificate {
-	domainsCertificatesMap := make(map[string]*tls.Certificate)
-
-	for _, domainCertificate := range dc.Certs {
-		certKey := domainCertificate.Domains.Main
-
-		if domainCertificate.Domains.SANs != nil {
-			sort.Strings(domainCertificate.Domains.SANs)
-
-			for _, dnsName := range domainCertificate.Domains.SANs {
-				if dnsName != domainCertificate.Domains.Main {
-					certKey += fmt.Sprintf(",%s", dnsName)
-				}
-			}
-		}
-		domainsCertificatesMap[certKey] = domainCertificate.tlsCert
-	}
-	return domainsCertificatesMap
-}
-
-// DomainsCertificate contains a certificate for multiple domains
-type DomainsCertificate struct {
-	Domains     types.Domain
-	Certificate *Certificate
-	tlsCert     *tls.Certificate
-}
-
-func (dc *DomainsCertificate) needRenew() bool {
-	for _, c := range dc.tlsCert.Certificate {
-		crt, err := x509.ParseCertificate(c)
-		if err != nil {
-			// If there's an error, we assume the cert is broken, and needs update
-			return true
-		}
-
-		// <= 30 days left, renew certificate
-		if crt.NotAfter.Before(time.Now().Add(24 * 30 * time.Hour)) {
-			return true
-		}
-	}
-
-	return false
-}

acme/acme.go

@@ -1,835 +0,0 @@
-package acme
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	fmtlog "log"
-	"net"
-	"net/http"
-	"net/url"
-	"reflect"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/BurntSushi/ty/fun"
-	"github.com/cenk/backoff"
-	"github.com/containous/flaeg"
-	"github.com/containous/mux"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
-	"github.com/eapache/channels"
-	"github.com/sirupsen/logrus"
-	"github.com/xenolf/lego/acme"
-	legolog "github.com/xenolf/lego/log"
-	"github.com/xenolf/lego/providers/dns"
-)
-
-var (
-	// OSCPMustStaple enables OSCP stapling as from https://github.com/xenolf/lego/issues/270
-	OSCPMustStaple = false
-)
-
-// ACME allows to connect to lets encrypt and retrieve certs
-// Deprecated Please use provider/acme/Provider
-type ACME struct {
-	Email                 string                      `description:"Email address used for registration"`
-	Domains               []types.Domain              `description:"SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='main.net,san1.net,san2.net'"`
-	Storage               string                      `description:"File or key used for certificates storage."`
-	StorageFile           string                      // Deprecated
-	OnDemand              bool                        `description:"(Deprecated) Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` // Deprecated
-	OnHostRule            bool                        `description:"Enable certificate generation on frontends Host rules."`
-	CAServer              string                      `description:"CA server to use."`
-	EntryPoint            string                      `description:"Entrypoint to proxy acme challenge to."`
-	KeyType               string                      `description:"KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. Default to 'RSA4096'"`
-	DNSChallenge          *acmeprovider.DNSChallenge  `description:"Activate DNS-01 Challenge"`
-	HTTPChallenge         *acmeprovider.HTTPChallenge `description:"Activate HTTP-01 Challenge"`
-	TLSChallenge          *acmeprovider.TLSChallenge  `description:"Activate TLS-ALPN-01 Challenge"`
-	DNSProvider           string                      `description:"(Deprecated) Activate DNS-01 Challenge"`                                                                    // Deprecated
-	DelayDontCheckDNS     flaeg.Duration              `description:"(Deprecated) Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."` // Deprecated
-	ACMELogging           bool                        `description:"Enable debug logging of ACME actions."`
-	OverrideCertificates  bool                        `description:"Enable to override certificates in key-value store when using storeconfig"`
-	client                *acme.Client
-	store                 cluster.Store
-	challengeHTTPProvider *challengeHTTPProvider
-	challengeTLSProvider  *challengeTLSProvider
-	checkOnDemandDomain   func(domain string) bool
-	jobs                  *channels.InfiniteChannel
-	TLSConfig             *tls.Config `description:"TLS config in case wildcard certs are used"`
-	dynamicCerts          *safe.Safe
-	resolvingDomains      map[string]struct{}
-	resolvingDomainsMutex sync.RWMutex
-}
-
-func (a *ACME) init() error {
-	acme.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
-
-	if a.ACMELogging {
-		legolog.Logger = fmtlog.New(log.WriterLevel(logrus.InfoLevel), "legolog: ", 0)
-	} else {
-		legolog.Logger = fmtlog.New(ioutil.Discard, "", 0)
-	}
-
-	a.jobs = channels.NewInfiniteChannel()
-
-	// Init the currently resolved domain map
-	a.resolvingDomains = make(map[string]struct{})
-
-	return nil
-}
-
-// AddRoutes add routes on internal router
-func (a *ACME) AddRoutes(router *mux.Router) {
-	router.Methods(http.MethodGet).
-		Path(acme.HTTP01ChallengePath("{token}")).
-		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-			if a.challengeHTTPProvider == nil {
-				rw.WriteHeader(http.StatusNotFound)
-				return
-			}
-
-			vars := mux.Vars(req)
-			if token, ok := vars["token"]; ok {
-				domain, _, err := net.SplitHostPort(req.Host)
-				if err != nil {
-					log.Debugf("Unable to split host and port: %v. Fallback to request host.", err)
-					domain = req.Host
-				}
-				tokenValue := a.challengeHTTPProvider.getTokenValue(token, domain)
-				if len(tokenValue) > 0 {
-					rw.WriteHeader(http.StatusOK)
-					rw.Write(tokenValue)
-					return
-				}
-			}
-			rw.WriteHeader(http.StatusNotFound)
-		}))
-}
-
-// CreateClusterConfig creates a tls.config using ACME configuration in cluster mode
-func (a *ACME) CreateClusterConfig(leadership *cluster.Leadership, tlsConfig *tls.Config, certs *safe.Safe, checkOnDemandDomain func(domain string) bool) error {
-	err := a.init()
-	if err != nil {
-		return err
-	}
-
-	if len(a.Storage) == 0 {
-		return errors.New("empty Store, please provide a key for certs storage")
-	}
-
-	a.checkOnDemandDomain = checkOnDemandDomain
-	a.dynamicCerts = certs
-
-	tlsConfig.GetCertificate = a.getCertificate
-	a.TLSConfig = tlsConfig
-
-	listener := func(object cluster.Object) error {
-		account := object.(*Account)
-		account.Init()
-		if !leadership.IsLeader() {
-			a.client, err = a.buildACMEClient(account)
-			if err != nil {
-				log.Errorf("Error building ACME client %+v: %s", object, err.Error())
-			}
-		}
-		return nil
-	}
-
-	datastore, err := cluster.NewDataStore(
-		leadership.Pool.Ctx(),
-		staert.KvSource{
-			Store:  leadership.Store,
-			Prefix: a.Storage,
-		},
-		&Account{},
-		listener)
-	if err != nil {
-		return err
-	}
-
-	a.store = datastore
-	a.challengeTLSProvider = &challengeTLSProvider{store: a.store}
-
-	ticker := time.NewTicker(24 * time.Hour)
-	leadership.Pool.AddGoCtx(func(ctx context.Context) {
-		log.Info("Starting ACME renew job...")
-		defer log.Info("Stopped ACME renew job...")
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				a.renewCertificates()
-			}
-		}
-	})
-
-	leadership.AddListener(a.leadershipListener)
-	return nil
-}
-
-func (a *ACME) leadershipListener(elected bool) error {
-	if elected {
-		_, err := a.store.Load()
-		if err != nil {
-			return err
-		}
-
-		transaction, object, err := a.store.Begin()
-		if err != nil {
-			return err
-		}
-
-		account := object.(*Account)
-		account.Init()
-		// Reset Account values if caServer changed, thus registration URI can be updated
-		if account != nil && account.Registration != nil && !isAccountMatchingCaServer(account.Registration.URI, a.CAServer) {
-			log.Info("Account URI does not match the current CAServer. The account will be reset")
-			account.reset()
-		}
-
-		var needRegister bool
-		if account == nil || len(account.Email) == 0 {
-			domainsCerts := DomainsCertificates{Certs: []*DomainsCertificate{}}
-			if account != nil {
-				domainsCerts = account.DomainsCertificate
-			}
-
-			account, err = NewAccount(a.Email, domainsCerts.Certs, a.KeyType)
-			if err != nil {
-				return err
-			}
-
-			needRegister = true
-		} else if len(account.KeyType) == 0 {
-			// Set the KeyType if not already defined in the account
-			account.KeyType = acmeprovider.GetKeyType(a.KeyType)
-		}
-
-		a.client, err = a.buildACMEClient(account)
-		if err != nil {
-			return err
-		}
-		if needRegister {
-			// New users will need to register; be sure to save it
-			log.Debug("Register...")
-
-			reg, err := a.client.Register(true)
-			if err != nil {
-				return err
-			}
-
-			account.Registration = reg
-		}
-
-		err = transaction.Commit(account)
-		if err != nil {
-			return err
-		}
-
-		a.retrieveCertificates()
-		a.renewCertificates()
-		a.runJobs()
-	}
-	return nil
-}
-
-func isAccountMatchingCaServer(accountURI string, serverURI string) bool {
-	aru, err := url.Parse(accountURI)
-	if err != nil {
-		log.Infof("Unable to parse account.Registration URL : %v", err)
-		return false
-	}
-	cau, err := url.Parse(serverURI)
-	if err != nil {
-		log.Infof("Unable to parse CAServer URL : %v", err)
-		return false
-	}
-	return cau.Hostname() == aru.Hostname()
-}
-
-func (a *ACME) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	domain := types.CanonicalDomain(clientHello.ServerName)
-	account := a.store.Get().(*Account)
-
-	if challengeCert, ok := a.challengeTLSProvider.getCertificate(domain); ok {
-		log.Debugf("ACME got challenge %s", domain)
-		return challengeCert, nil
-	}
-
-	if providedCertificate := a.getProvidedCertificate(domain); providedCertificate != nil {
-		return providedCertificate, nil
-	}
-
-	if domainCert, ok := account.DomainsCertificate.getCertificateForDomain(domain); ok {
-		log.Debugf("ACME got domain cert %s", domain)
-		return domainCert.tlsCert, nil
-	}
-
-	if a.OnDemand {
-		if a.checkOnDemandDomain != nil && !a.checkOnDemandDomain(domain) {
-			return nil, nil
-		}
-		return a.loadCertificateOnDemand(clientHello)
-	}
-
-	log.Debugf("No certificate found or generated for %s", domain)
-	return nil, nil
-}
-
-func (a *ACME) retrieveCertificates() {
-	a.jobs.In() <- func() {
-		log.Info("Retrieving ACME certificates...")
-
-		a.deleteUnnecessaryDomains()
-
-		for i := 0; i < len(a.Domains); i++ {
-			domain := a.Domains[i]
-
-			// check if cert isn't already loaded
-			account := a.store.Get().(*Account)
-			if _, exists := account.DomainsCertificate.exists(domain); !exists {
-				var domains []string
-				domains = append(domains, domain.Main)
-				domains = append(domains, domain.SANs...)
-				domains, err := a.getValidDomains(domains, true)
-				if err != nil {
-					log.Errorf("Error validating ACME certificate for domain %q: %s", domains, err)
-					continue
-				}
-
-				certificateResource, err := a.getDomainsCertificates(domains)
-				if err != nil {
-					log.Errorf("Error getting ACME certificate for domain %q: %s", domains, err)
-					continue
-				}
-
-				transaction, object, err := a.store.Begin()
-				if err != nil {
-					log.Errorf("Error creating ACME store transaction from domain %q: %s", domain, err)
-					continue
-				}
-
-				account = object.(*Account)
-				_, err = account.DomainsCertificate.addCertificateForDomains(certificateResource, domain)
-				if err != nil {
-					log.Errorf("Error adding ACME certificate for domain %q: %s", domains, err)
-					continue
-				}
-
-				if err = transaction.Commit(account); err != nil {
-					log.Errorf("Error Saving ACME account %+v: %s", account, err)
-					continue
-				}
-			}
-		}
-
-		log.Info("Retrieved ACME certificates")
-	}
-}
-
-func (a *ACME) renewCertificates() {
-	a.jobs.In() <- func() {
-		log.Info("Testing certificate renew...")
-		account := a.store.Get().(*Account)
-		for _, certificateResource := range account.DomainsCertificate.Certs {
-			if certificateResource.needRenew() {
-				log.Infof("Renewing certificate from LE : %+v", certificateResource.Domains)
-				renewedACMECert, err := a.renewACMECertificate(certificateResource)
-				if err != nil {
-					log.Errorf("Error renewing certificate from LE: %v", err)
-					continue
-				}
-				operation := func() error {
-					return a.storeRenewedCertificate(certificateResource, renewedACMECert)
-				}
-				notify := func(err error, time time.Duration) {
-					log.Warnf("Renewed certificate storage error: %v, retrying in %s", err, time)
-				}
-				ebo := backoff.NewExponentialBackOff()
-				ebo.MaxElapsedTime = 60 * time.Second
-				err = backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-				if err != nil {
-					log.Errorf("Datastore cannot sync: %v", err)
-					continue
-				}
-			}
-		}
-	}
-}
-
-func (a *ACME) renewACMECertificate(certificateResource *DomainsCertificate) (*Certificate, error) {
-	renewedCert, err := a.client.RenewCertificate(acme.CertificateResource{
-		Domain:        certificateResource.Certificate.Domain,
-		CertURL:       certificateResource.Certificate.CertURL,
-		CertStableURL: certificateResource.Certificate.CertStableURL,
-		PrivateKey:    certificateResource.Certificate.PrivateKey,
-		Certificate:   certificateResource.Certificate.Certificate,
-	}, true, OSCPMustStaple)
-	if err != nil {
-		return nil, err
-	}
-	log.Infof("Renewed certificate from  LE: %+v", certificateResource.Domains)
-	return &Certificate{
-		Domain:        renewedCert.Domain,
-		CertURL:       renewedCert.CertURL,
-		CertStableURL: renewedCert.CertStableURL,
-		PrivateKey:    renewedCert.PrivateKey,
-		Certificate:   renewedCert.Certificate,
-	}, nil
-}
-
-func (a *ACME) storeRenewedCertificate(certificateResource *DomainsCertificate, renewedACMECert *Certificate) error {
-	transaction, object, err := a.store.Begin()
-	if err != nil {
-		return fmt.Errorf("error during transaction initialization for renewing certificate: %v", err)
-	}
-
-	log.Infof("Renewing certificate in data store : %+v ", certificateResource.Domains)
-	account := object.(*Account)
-	err = account.DomainsCertificate.renewCertificates(renewedACMECert, certificateResource.Domains)
-	if err != nil {
-		return fmt.Errorf("error renewing certificate in datastore: %v ", err)
-	}
-
-	log.Infof("Commit certificate renewed in data store : %+v", certificateResource.Domains)
-	if err = transaction.Commit(account); err != nil {
-		return fmt.Errorf("error saving ACME account %+v: %v", account, err)
-	}
-
-	oldAccount := a.store.Get().(*Account)
-	for _, oldCertificateResource := range oldAccount.DomainsCertificate.Certs {
-		if oldCertificateResource.Domains.Main == certificateResource.Domains.Main && strings.Join(oldCertificateResource.Domains.SANs, ",") == strings.Join(certificateResource.Domains.SANs, ",") && certificateResource.Certificate != renewedACMECert {
-			return fmt.Errorf("renewed certificate not stored: %+v", certificateResource.Domains)
-		}
-	}
-
-	log.Infof("Certificate successfully renewed in data store: %+v", certificateResource.Domains)
-	return nil
-}
-
-func dnsOverrideDelay(delay flaeg.Duration) error {
-	var err error
-	if delay > 0 {
-		log.Debugf("Delaying %d rather than validating DNS propagation", delay)
-		acme.PreCheckDNS = func(_, _ string) (bool, error) {
-			time.Sleep(time.Duration(delay))
-			return true, nil
-		}
-	} else if delay < 0 {
-		err = fmt.Errorf("invalid negative DelayBeforeCheck: %d", delay)
-	}
-	return err
-}
-
-func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
-	log.Debug("Building ACME client...")
-	caServer := "https://acme-v02.api.letsencrypt.org/directory"
-	if len(a.CAServer) > 0 {
-		caServer = a.CAServer
-	}
-
-	client, err := acme.NewClient(caServer, account, account.KeyType)
-	if err != nil {
-		return nil, err
-	}
-
-	// DNS challenge
-	if a.DNSChallenge != nil && len(a.DNSChallenge.Provider) > 0 {
-		log.Debugf("Using DNS Challenge provider: %s", a.DNSChallenge.Provider)
-
-		err = dnsOverrideDelay(a.DNSChallenge.DelayBeforeCheck)
-		if err != nil {
-			return nil, err
-		}
-
-		acmeprovider.SetRecursiveNameServers(a.DNSChallenge.Resolvers)
-		acmeprovider.SetPropagationCheck(a.DNSChallenge.DisablePropagationCheck)
-
-		var provider acme.ChallengeProvider
-		provider, err = dns.NewDNSChallengeProviderByName(a.DNSChallenge.Provider)
-		if err != nil {
-			return nil, err
-		}
-
-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSALPN01})
-		err = client.SetChallengeProvider(acme.DNS01, provider)
-		return client, err
-	}
-
-	// HTTP challenge
-	if a.HTTPChallenge != nil && len(a.HTTPChallenge.EntryPoint) > 0 {
-		log.Debug("Using HTTP Challenge provider.")
-
-		client.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSALPN01})
-		a.challengeHTTPProvider = &challengeHTTPProvider{store: a.store}
-		err = client.SetChallengeProvider(acme.HTTP01, a.challengeHTTPProvider)
-		return client, err
-	}
-
-	// TLS Challenge
-	if a.TLSChallenge != nil {
-		log.Debug("Using TLS Challenge provider.")
-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
-		err = client.SetChallengeProvider(acme.TLSALPN01, a.challengeTLSProvider)
-		return client, err
-	}
-
-	return nil, errors.New("ACME challenge not specified, please select TLS or HTTP or DNS Challenge")
-}
-
-func (a *ACME) loadCertificateOnDemand(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	domain := types.CanonicalDomain(clientHello.ServerName)
-	account := a.store.Get().(*Account)
-	if certificateResource, ok := account.DomainsCertificate.getCertificateForDomain(domain); ok {
-		return certificateResource.tlsCert, nil
-	}
-	certificate, err := a.getDomainsCertificates([]string{domain})
-	if err != nil {
-		return nil, err
-	}
-	log.Debugf("Got certificate on demand for domain %s", domain)
-
-	transaction, object, err := a.store.Begin()
-	if err != nil {
-		return nil, err
-	}
-	account = object.(*Account)
-	cert, err := account.DomainsCertificate.addCertificateForDomains(certificate, types.Domain{Main: domain})
-	if err != nil {
-		return nil, err
-	}
-	if err = transaction.Commit(account); err != nil {
-		return nil, err
-	}
-	return cert.tlsCert, nil
-}
-
-// LoadCertificateForDomains loads certificates from ACME for given domains
-func (a *ACME) LoadCertificateForDomains(domains []string) {
-	a.jobs.In() <- func() {
-		log.Debugf("LoadCertificateForDomains %v...", domains)
-
-		domains, err := a.getValidDomains(domains, false)
-		if err != nil {
-			log.Errorf("Error getting valid domain: %v", err)
-			return
-		}
-
-		operation := func() error {
-			if a.client == nil {
-				return errors.New("ACME client still not built")
-			}
-			return nil
-		}
-		notify := func(err error, time time.Duration) {
-			log.Errorf("Error getting ACME client: %v, retrying in %s", err, time)
-		}
-		ebo := backoff.NewExponentialBackOff()
-		ebo.MaxElapsedTime = 30 * time.Second
-		err = backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-		if err != nil {
-			log.Errorf("Error getting ACME client: %v", err)
-			return
-		}
-		account := a.store.Get().(*Account)
-
-		// Check provided certificates
-		uncheckedDomains := a.getUncheckedDomains(domains, account)
-		if len(uncheckedDomains) == 0 {
-			return
-		}
-
-		a.addResolvingDomains(uncheckedDomains)
-		defer a.removeResolvingDomains(uncheckedDomains)
-
-		certificate, err := a.getDomainsCertificates(uncheckedDomains)
-		if err != nil {
-			log.Errorf("Error getting ACME certificates %+v : %v", uncheckedDomains, err)
-			return
-		}
-		log.Debugf("Got certificate for domains %+v", uncheckedDomains)
-		transaction, object, err := a.store.Begin()
-
-		if err != nil {
-			log.Errorf("Error creating transaction %+v : %v", uncheckedDomains, err)
-			return
-		}
-		var domain types.Domain
-		if len(uncheckedDomains) > 1 {
-			domain = types.Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
-		} else {
-			domain = types.Domain{Main: uncheckedDomains[0]}
-		}
-		account = object.(*Account)
-		_, err = account.DomainsCertificate.addCertificateForDomains(certificate, domain)
-		if err != nil {
-			log.Errorf("Error adding ACME certificates %+v : %v", uncheckedDomains, err)
-			return
-		}
-		if err = transaction.Commit(account); err != nil {
-			log.Errorf("Error Saving ACME account %+v: %v", account, err)
-			return
-		}
-	}
-}
-
-func (a *ACME) addResolvingDomains(resolvingDomains []string) {
-	a.resolvingDomainsMutex.Lock()
-	defer a.resolvingDomainsMutex.Unlock()
-
-	for _, domain := range resolvingDomains {
-		a.resolvingDomains[domain] = struct{}{}
-	}
-}
-
-func (a *ACME) removeResolvingDomains(resolvingDomains []string) {
-	a.resolvingDomainsMutex.Lock()
-	defer a.resolvingDomainsMutex.Unlock()
-
-	for _, domain := range resolvingDomains {
-		delete(a.resolvingDomains, domain)
-	}
-}
-
-// Get provided certificate which check a domains list (Main and SANs)
-// from static and dynamic provided certificates
-func (a *ACME) getProvidedCertificate(domains string) *tls.Certificate {
-	log.Debugf("Looking for provided certificate to validate %s...", domains)
-	cert := searchProvidedCertificateForDomains(domains, a.TLSConfig.NameToCertificate)
-	if cert == nil && a.dynamicCerts != nil && a.dynamicCerts.Get() != nil {
-		cert = searchProvidedCertificateForDomains(domains, a.dynamicCerts.Get().(map[string]*tls.Certificate))
-	}
-	if cert == nil {
-		log.Debugf("No provided certificate found for domains %s, get ACME certificate.", domains)
-	}
-	return cert
-}
-
-func searchProvidedCertificateForDomains(domain string, certs map[string]*tls.Certificate) *tls.Certificate {
-	// Use regex to test for provided certs that might have been added into TLSConfig
-	for certDomains := range certs {
-		domainChecked := false
-		for _, certDomain := range strings.Split(certDomains, ",") {
-			domainChecked = types.MatchDomain(domain, certDomain)
-			if domainChecked {
-				break
-			}
-		}
-		if domainChecked {
-			log.Debugf("Domain %q checked by provided certificate %q", domain, certDomains)
-			return certs[certDomains]
-		}
-	}
-	return nil
-}
-
-// Get provided certificate which check a domains list (Main and SANs)
-// from static and dynamic provided certificates
-func (a *ACME) getUncheckedDomains(domains []string, account *Account) []string {
-	a.resolvingDomainsMutex.RLock()
-	defer a.resolvingDomainsMutex.RUnlock()
-
-	log.Debugf("Looking for provided certificate to validate %s...", domains)
-	allCerts := make(map[string]*tls.Certificate)
-
-	// Get static certificates
-	for domains, certificate := range a.TLSConfig.NameToCertificate {
-		allCerts[domains] = certificate
-	}
-
-	// Get dynamic certificates
-	if a.dynamicCerts != nil && a.dynamicCerts.Get() != nil {
-		for domains, certificate := range a.dynamicCerts.Get().(map[string]*tls.Certificate) {
-			allCerts[domains] = certificate
-		}
-	}
-
-	// Get ACME certificates
-	if account != nil {
-		for domains, certificate := range account.DomainsCertificate.toDomainsMap() {
-			allCerts[domains] = certificate
-		}
-	}
-
-	// Get currently resolved domains
-	for domain := range a.resolvingDomains {
-		if _, ok := allCerts[domain]; !ok {
-			allCerts[domain] = &tls.Certificate{}
-		}
-	}
-
-	// Get Configuration Domains
-	for i := 0; i < len(a.Domains); i++ {
-		allCerts[a.Domains[i].Main] = &tls.Certificate{}
-		for _, san := range a.Domains[i].SANs {
-			allCerts[san] = &tls.Certificate{}
-		}
-	}
-
-	return searchUncheckedDomains(domains, allCerts)
-}
-
-func searchUncheckedDomains(domains []string, certs map[string]*tls.Certificate) []string {
-	var uncheckedDomains []string
-	for _, domainToCheck := range domains {
-		if !isDomainAlreadyChecked(domainToCheck, certs) {
-			uncheckedDomains = append(uncheckedDomains, domainToCheck)
-		}
-	}
-
-	if len(uncheckedDomains) == 0 {
-		log.Debugf("No ACME certificate to generate for domains %q.", domains)
-	} else {
-		log.Debugf("Domains %q need ACME certificates generation for domains %q.", domains, strings.Join(uncheckedDomains, ","))
-	}
-	return uncheckedDomains
-}
-
-func (a *ACME) getDomainsCertificates(domains []string) (*Certificate, error) {
-	var cleanDomains []string
-	for _, domain := range domains {
-		canonicalDomain := types.CanonicalDomain(domain)
-		cleanDomain := acme.UnFqdn(canonicalDomain)
-		if canonicalDomain != cleanDomain {
-			log.Warnf("FQDN detected, please remove the trailing dot: %s", canonicalDomain)
-		}
-		cleanDomains = append(cleanDomains, cleanDomain)
-	}
-
-	log.Debugf("Loading ACME certificates %s...", cleanDomains)
-	bundle := true
-
-	certificate, err := a.client.ObtainCertificate(cleanDomains, bundle, nil, OSCPMustStaple)
-	if err != nil {
-		return nil, fmt.Errorf("cannot obtain certificates: %+v", err)
-	}
-
-	log.Debugf("Loaded ACME certificates %s", cleanDomains)
-	return &Certificate{
-		Domain:        certificate.Domain,
-		CertURL:       certificate.CertURL,
-		CertStableURL: certificate.CertStableURL,
-		PrivateKey:    certificate.PrivateKey,
-		Certificate:   certificate.Certificate,
-	}, nil
-}
-
-func (a *ACME) runJobs() {
-	safe.Go(func() {
-		for job := range a.jobs.Out() {
-			function := job.(func())
-			function()
-		}
-	})
-}
-
-// getValidDomains checks if given domain is allowed to generate a ACME certificate and return it
-func (a *ACME) getValidDomains(domains []string, wildcardAllowed bool) ([]string, error) {
-	// Check if the domains array is empty or contains only one empty value
-	if len(domains) == 0 || (len(domains) == 1 && len(domains[0]) == 0) {
-		return nil, errors.New("unable to generate a certificate when no domain is given")
-	}
-
-	if strings.HasPrefix(domains[0], "*") {
-		if !wildcardAllowed {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q from a 'Host' rule", strings.Join(domains, ","))
-		}
-
-		if a.DNSChallenge == nil && len(a.DNSProvider) == 0 {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q : ACME needs a DNSChallenge", strings.Join(domains, ","))
-		}
-		if strings.HasPrefix(domains[0], "*.*") {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q : ACME does not allow '*.*' wildcard domain", strings.Join(domains, ","))
-		}
-	}
-	for _, san := range domains[1:] {
-		if strings.HasPrefix(san, "*") {
-			return nil, fmt.Errorf("unable to generate a certificate for domains %q: SANs can not be a wildcard domain", strings.Join(domains, ","))
-
-		}
-	}
-
-	domains = fun.Map(types.CanonicalDomain, domains).([]string)
-	return domains, nil
-}
-
-func isDomainAlreadyChecked(domainToCheck string, existentDomains map[string]*tls.Certificate) bool {
-	for certDomains := range existentDomains {
-		for _, certDomain := range strings.Split(certDomains, ",") {
-			if types.MatchDomain(domainToCheck, certDomain) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// deleteUnnecessaryDomains deletes from the configuration :
-// - Duplicated domains
-// - Domains which are checked by wildcard domain
-func (a *ACME) deleteUnnecessaryDomains() {
-	var newDomains []types.Domain
-
-	for idxDomainToCheck, domainToCheck := range a.Domains {
-		keepDomain := true
-
-		for idxDomain, domain := range a.Domains {
-			if idxDomainToCheck == idxDomain {
-				continue
-			}
-
-			if reflect.DeepEqual(domain, domainToCheck) {
-				if idxDomainToCheck > idxDomain {
-					log.Warnf("The domain %v is duplicated in the configuration but will be process by ACME only once.", domainToCheck)
-					keepDomain = false
-				}
-				break
-			}
-
-			var newDomainsToCheck []string
-
-			// Check if domains can be validated by the wildcard domain
-			domainsMap := make(map[string]*tls.Certificate)
-			domainsMap[domain.Main] = &tls.Certificate{}
-			if len(domain.SANs) > 0 {
-				domainsMap[strings.Join(domain.SANs, ",")] = &tls.Certificate{}
-			}
-
-			for _, domainProcessed := range domainToCheck.ToStrArray() {
-				if idxDomain < idxDomainToCheck && isDomainAlreadyChecked(domainProcessed, domainsMap) {
-					// The domain is duplicated in a CN
-					log.Warnf("Domain %q is duplicated in the configuration or validated by the domain %v. It will be processed once.", domainProcessed, domain)
-					continue
-				} else if domain.Main != domainProcessed && strings.HasPrefix(domain.Main, "*") && types.MatchDomain(domainProcessed, domain.Main) {
-					// Check if a wildcard can validate the domain
-					log.Warnf("Domain %q will not be processed by ACME provider because it is validated by the wildcard %q", domainProcessed, domain.Main)
-					continue
-				}
-				newDomainsToCheck = append(newDomainsToCheck, domainProcessed)
-			}
-
-			// Delete the domain if both Main and SANs can be validated by the wildcard domain
-			// otherwise keep the unchecked values
-			if newDomainsToCheck == nil {
-				keepDomain = false
-				break
-			}
-			domainToCheck.Set(newDomainsToCheck)
-		}
-
-		if keepDomain {
-			newDomains = append(newDomains, domainToCheck)
-		}
-	}
-
-	a.Domains = newDomains
-}

acme/acme_example.json

@@ -1,43 +0,0 @@
-{
-  "Email": "test@traefik.io",
-  "Registration": {
-    "body": {
-      "resource": "reg",
-      "id": 3,
-      "key": {
-        "kty": "RSA",
-        "n": "y5a71suIqvEtovDmDVQ3SSNagk5IVCFI_TvqWpEXSrdbcDE2C-PTEtEUJuLkYwygcpiWYbPmXgdS628vQCw5Uo4DeDyHiuysJOWBLaWow3p9goOdhnPbGBq0liIR9xXyRoctdipVk8UiO9scWsu4jMBM3sMr7_yBWPfYYiLEQmZGFO3iE7Oqr55h_kncHIj5lUQY1j_jkftqxlxUB5_0quyJ7l915j5QY--eY7h4GEhRvx0TlUpi-CnRtRblGeDDDilXZD6bQN2962WdKecsmRaYx-ttLz6jCPXz2VDJRWNcIS501ne2Zh3hzw_DS6IRd2GIia1Wg4sisi9epC9sumXPHi6xzR6-_i_nsFjdtTkUcV8HmorOYoc820KQVZaLScxa8e7-ixpOd6mr6AIbEf7dBAkb9f_iK3GwpqKD8yNcaj1EQgNSyJSjnKSulXI_GwkGnuXe00Qpb1a8ha5Z8yWg7XmZZnJyAZrmK60RfwRNQ1rO5ioerNUBJ2KYTYNzVjBdob9Ug6Cjh4bEKNNjqcbjQ50_Z97Vw40xzpDQ_fYllc6n92eSuv6olxFJTmK7EhHuanDzITngaqei3zL9RwQ7P-1jfEZ03qmGrQYYqXcsS46PQ8cE-frzY2mKp16pRNCG7-03gKVGV0JHyW1aYbevNUk7OumCAXhC2YOigBk",
-        "e": "AQAB"
-      },
-      "contact": [
-        "mailto:test@traefik.io"
-      ],
-      "agreement": "http://boulder:4000/terms/v1"
-    },
-    "uri": "http://127.0.0.1:4000/acme/reg/3",
-    "new_authzr_uri": "http://127.0.0.1:4000/acme/new-authz",
-    "terms_of_service": "http://boulder:4000/terms/v1"
-  },
-  "PrivateKey": "MIIJJwIBAAKCAgEAy5a71suIqvEtovDmDVQ3SSNagk5IVCFI/TvqWpEXSrdbcDE2C+PTEtEUJuLkYwygcpiWYbPmXgdS628vQCw5Uo4DeDyHiuysJOWBLaWow3p9goOdhnPbGBq0liIR9xXyRoctdipVk8UiO9scWsu4jMBM3sMr7/yBWPfYYiLEQmZGFO3iE7Oqr55h/kncHIj5lUQY1j/jkftqxlxUB5/0quyJ7l915j5QY++eY7h4GEhRvx0TlUpi+CnRtRblGeDDDilXZD6bQN2962WdKecsmRaYx+ttLz6jCPXz2VDJRWNcIS501ne2Zh3hzw/DS6IRd2GIia1Wg4sisi9epC9sumXPHi6xzR6+/i/nsFjdtTkUcV8HmorOYoc820KQVZaLScxa8e7+ixpOd6mr6AIbEf7dBAkb9f/iK3GwpqKD8yNcaj1EQgNSyJSjnKSulXI/GwkGnuXe00Qpb1a8ha5Z8yWg7XmZZnJyAZrmK60RfwRNQ1rO5ioerNUBJ2KYTYNzVjBdob9Ug6Cjh4bEKNNjqcbjQ50/Z97Vw40xzpDQ/fYllc6n92eSuv6olxFJTmK7EhHuanDzITngaqei3zL9RwQ7P+1jfEZ03qmGrQYYqXcsS46PQ8cE+frzY2mKp16pRNCG7+03gKVGV0JHyW1aYbevNUk7OumCAXhC2YOigBkCAwEAAQKCAgA8XW1EuwTC6tAFSDhuK1JZNUpY6K05hMUHkQRj5jFpzgQmt/C2hc7H/YZkIVJmrA/G6sdsINNlffZwKH9yH6q/d6w/snLeFl7UcdhjmIL5sxAT6sKCY0fLVd/FxERfZvp3Pw2Tw+mr7v+/j7BQm6cU1M/2HRiiB9SydIqMTpKyvXB6NC6ceOFbQTL9GxlQvKyEPbS/kiH/3vRB7I5d1GfPZmNfcp6ark9X0my8VK4HRSo36H8t/OhrfLrZXvh/O82aHVf0OTv/d8AgU/jNu+XVXoXegUfWglQFDChJf1KuaE+g5w1tqgFDNgkGRD475soXA6xgZi0Iw/B9tN3zALzT4IiAW1q72feeTgKOMA2zGtKXxQZZSOV+DuWFZNz/tT7XqGQThqxM09CHv2WGOe80vobtegXYTUt90hysrqIZmBW5XYdzQlJh1KWTtfCaTrWd47kbGvhkEPc8aA3Ji4/AqfkVXiqwaLu+MSlgzPpRj7U7UAIDqnpZjgttgLp74Ujnk3bTaUzdyyNqYDBG3IFGr/Sv+2GQDAUn/PYRJKWr0BteqOzX9zvW3zY8g9CYVXfK/AW3RMWLV8ly6vH/gWqa9gEuzRNRlzjUU6/HCVbUx3UT8RMWH2TQ0uuQZr5JX1iTwjeeT0dEIly1NnRQC92wcrE4UUTBEF3krGVpDBf0AQKCAQEA4jB8w+2fwzbF8X+gCODcY7sTeJRunzGy+jbdaLkcThuylga+6W3ZgWx0BD30ql9K2mouCVu86fCTnBeXXEC3QoTdgw/EzJ83+4JU3QSDdzs9Ta9vLHyvrpUkQfZ8UZpeLLmFsmsBMbBbnfw0S1TzXDsgrAc+G4tia8nO/Iqu75kEMGzmHQAvmN3iSqc1aTS4qumbB19g+v+csq9NEht4F9jt39KotG+OD3MxCxtMu7vxAkJRjFFcgcbb2Rtqe/kQEKA1vLEAJg27lV4k8XibCSerVUR6IzT8WZHrNiXmpRguTLl2k8uFUdCOOx6aLGyRVJ6+8SgIsMR540vnxwQzEQKCAQEA5mu2wtWT19mvXopC3easPsXIPzc5oaRkqfWZYT1KHcVQ7NIXsE3vCjcf/3igZ8l/FVQ4G4fpk/GoTqlpV5Aq/JHCpVOR2O69uB+W4kWgliejpHvF9gszzAYnC8lIXqDbWiinBhmm3ii8sDGAoBaSDw5NMUq3mI+nd8zZ+jx1bLBczDafmQ0YKr8k0YaROxIgoBgDOQDdSqG387lwzpza2DKI5Al3HfS42zjT0RmBahPiuT2aEoUZmIYuvFY0fEjfkpbdvLyexHfZCILRUGlG1nAwASFg86lp+mFSBJ3E3cvbP0CpbFGxon5u4Ao3/7htoOh6huh7MQ91h41fv1hsiQKCAQAe7WRR4e7jYVzlbX7zV9Oqq0y5QwpxJ/mB7viNNiphn7Xmf5uhDU0dPjgK0HHgzdDNVpFe5DVLg4KbaDpg+dRU+xfSsNhG5kpgUGzMH67eIbJ7Kc64tX/MDkZ74nkTK1lPIjrer3TlV2jfjDmWR1JTPR51hzP9ziwx8tEjhM7woeqJuIoqUvkvHL+xV3WdIgFSFUkGVAtNpp/FauTN4gWktRupbAN3UH2LLUP6ccwnK0aD+Y9u8T0F3av33qDLvL1umIlgeI89pMkOXmYMwmHoeY0axpcwszECCkqwB7SmxEyoXv+Qq9ZZ3ntkKAYKpvmkKWSQUtoFWYgVBS727mMRAoIBABLdwusU/bPwuPEutObiWjwRiaHTbb6UbUGVQGe70vO5EjUxxorC9s2JUe9i+w9EakleyfFHIZLheHxoVp26yio/7QYIX6q5cYM/4uTH+qwQts9i6wSISkdsQYovguNsnEk3huVy+Dy8bSaoBvYUowTkkOF2Uq4FJRskBLz+ckbh8dcuqcaoUdA+Mk+NixqhE1bIYIssTPItZ5hnGJtyMGD/UkIJnF0ximk4r+8w/W2oDypHpvPZPg1E/1KgZE/Az7166NDpSL6haX3O6ECDPi+Uo/mTuBJ7TpgXm9WQ7WuTo3H8Y2LhFYBOhdmGPKuNeDxyjIW7R0rvDxp4MtzB6rECggEAJIl7/qp1lxUQPQJRTsEYBkOtdRw0IGG1Rcj0emhHaBN05c9opCy+Osb7mVeU5ZiULe5kD02phL+36pEumprz7QzN46Y5pZc8AQ2W/QkeL4Wo9U9QzczvQQzc1EqrBkzvQTZtBhn4DRzz0IuTn1beVyHtBZeNpBFgMQFv9VYQuUNwFoTOkkQrBRnYbXH6KEnhF3c/1Hzi4KHVdHdfZ3LH7KFQJ34xio0q2tWQSQYeybmwOXdd9sxpz/Y4KBS9fqm7UrwnPK8yuOc05HLEaws+1iam5YyJprlQo3mGKe0wRztwn44HDeQr70LlFm0lzigVAv0hSiWO1Q5hJL7nDu8m/Q==",
-  "DomainsCertificate": {
-    "Certs": [
-      {
-        "Domains": {
-          "Main": "local1.com",
-          "SANs": [
-            "test1.local1.com",
-            "test2.local1.com"
-          ]
-        },
-        "Certificate": {
-          "Domain": "local1.com",
-          "CertURL": "http://127.0.0.1:4000/acme/cert/ffc4f3f14def9ee6ec6a0522b5c0baa3379d",
-          "CertStableURL": "",
-          "PrivateKey": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS1FJQkFBS0NBZ0VBdVNoTTR4enF6cE5YcFNaNnAvZnQrRmt5VmgyK1BSZXJUelV0OERRSng2UkVjQS9FCnN2RnNIVmNOSkZMS2twYTNlOEd3SUZBakJQNnJPK3hoR1JjWlJrdENON1gyOW5LZFhGbHZkYzJxd0hyTFF5WWkKTTB3ODhTck41VERiNi96TWU2dTB0dERiYWtDbDd6ZEJKUXJ6a1h5ZU1MeVkzTUs3aVkrMHpwL2JqMVhvbk5DdQpaQStkZ3hsMVNrV01DVUYvQk9HNWFyT1hwb0x4S0dQWGdzV3hOTVNLVmJKSHczL3ZqNTViZU92Um5lT3BNWlhvCmMwOWpZT3VBakNka1Z5czBSWHJLNWNCRDRMbVRXdnN4MFdTK2VMVHlGTTdQTHVZM3lEWkNNWEhjVmlqRHhnbFMKYjB1ZVRQcGFUWEQwYkxqZ0RNOUVEdE15ZEJzMUNPWlpPWG9ickN5Q2I1eWxTOFdVd1NzVXM1UldxZnlVbnAvcgpSNGx2c2RZOWRVZjRPdkNMVnJvWWk5NWFGc1Zxa0xLOExuL0Eyc3kxYWlDTnR4RmpKOXRXbWU0V0NhdzRoU0YvCkR4NWVNNWNYR2JSYXduVlZJQlZXeHhzNTBPMFJlUWRvbXBQZEFNS1RDWk9SRmxYaDdOWTdxQVdWRGtpdzhyam8Kekd3Ni9XdjlOR3hTNTliKzc0YVAxcjBxOTZ2RS9Rdi8zTCtjbjhiN0lBLytPYmFKdzhIT3RGbXc4RjBxQkN3MAprYWVVSloxb1JueGFYQUo4RHhHREpFOVdNUzh0QmJtVm16YkxoRkMzeDdVc0xGeTBrSzh1SFBFT3dQb2NKNUFUCkE1UHBvclNEMmFleHA0Z3VqYVp5c1JManpmY0dnaTdva0JFNlZVNWVqRE1iYS9lNERQNEJQUVg5VmtVQ0F3RUEKQVFLQ0FnQmZjMWdYcUp1ZmZMT3REcVlpbXh4UmIrSVVKT2NpWldaSndmZDVvY244NGtEcHFDZFZ2RUZvNnF4NgpzamQ5MURhb2xOUHdCSC9aSGxRMTR3aTNQNEluQzdzS0wwTXVEeTN5SXFUa0RPOWVwSzdPWWdVMWZyTFgvS0lCCjZlc2x2Ny9HYldFTzhhSjdKdktqM0U4NEFtcEg4UDgzenJIYTlJUnJTT3NEcmNNcEpEZHpSOXp1OW1IVDZMYmYKWC9UdC9KYTNkSW42YUxUZ0FSYkRKSjAvN0J3TFFOcXpqT0dUOWdzUWRhbGdMK2x5eEo4L1ViRndhRmVwNmgzdApvbzBHcHQ0ZWgwdTdueDhlNVd3Q2RnWmJsTnpnS3grMC9Gd3dLRHhQZVRFc2ZpOEJONmlkR2NjbVdzd3prTWdtCnJmbERaeGNSWTNRSlZIVHBCL0dTTWZXRFBPQ3dRdGltQk1WN3kxM2hPMTdPWXpSNDBMZnpUalJBbmtna2V2eWYKcFowb3dLR3o4QS9haHhRWWJmYVQ5VEhXV0wrYUpYeUhFanBKckp5aTg3UExVbzhsOFVydU56MDRWNXpLOFJPbgo2cG9EWmVtbm1EYWRlU09pK3hZRWlGT1NwSXNWbzlpcm9jUGFKN2YzYWpiNUU4RHpuN1o1MmhzL2R6akpLcFZJCm5mVDFkUU9SZEowSXRUNlRlQ2RTL0dpS25IS1RtNjR2T21IbmlJcm8rUGRhUmFjV0IrTUJ0VytRd0cyUStyRGkKc3g4NlpQbHRpTVpLMDZ5TVlyVHZUdGk2aFVGaUY5cWh4b3RGazdNQkNrZlIwYUVhaUREQUpKNm1jb1lpRUQ2QgpBVGJhVmpVaGNaUiswYkRST25PN0ozRk5rZmx3K2dMaVhvcXFRRW9pU2ZWb2h5SWY3UUtDQVFFQThjYTM5K0g4CjN3L2Qrcm0yUGNhM0RMQnBYaWU4Z3ZYcGpjazVYSkpvSGVmbnJjZWQrcFpXaTZEYncwYld0MEdtYkxmVjJNSlAKV2I1aTZzSXhmdkN3YlFqbHY0UnExMVA5ZEswT3poMnVpKzZ6cXVBMG5YTVcrN0lJS0cvdDhmS2NJZGRRNnRGcwpFclFVTFBDak56ODA2cHBiSlhPRmVvMW1BK293TGhHNlA3dDhCdlZHSk1NaTNxejNlSUNuVVE2eDNFY01ITXNuClhrM21DUzI1WUZaNk96cytFK254cGVraTAzZmQwblp3UE1jdElHZys1c3hleE9zREsrTHlvb2FqQnc5N0oyUzIKcUNNWXFtT0tLcmxEQ3Y1WmQ4dlZLN3hXVmpKRVhGTTNMZ2pieHBRcCtuVXNVVWxwS01LOVlGS0lRREl0RU9aMApWcWExTXJaOElzN1l5d0tDQVFFQXhBemZIa2pIVGlvTHdZbG5EcEk0MWlOTDh5Y0ZBallrTC94dWhPU2tlVkE4CjdRWDZPZUpDekR3Z0FUYXVqOWR6Y0wwby9yTndWV0xWcnQ3OXk3YnJvVDdFREZKWVNTY25GRXNMTlVWSXRncGkKckNSUXJTL1F2TkVGTmE5K0pRc1dmYkdBNHdIUTFaSjI4MFp1cWMvNlEyUi9kZVh3cUZBQVBHN2NIcEhHWlR6ZQoyRmFRUHFLRkV4WlEyZkpvRys0SVBRNHVQVERybXlGMmVUWXk2T3BaaDBHbWJRYlVTa1dFWDlQRmF1cHJIWVdGCk8wK25DaVVPNVRaMFZoaGR2dUNKMWdPclZHYzhBUlJtUVZ1aUNEWTZCaGlvVTU0ZmZsSXlDTXZ5a3MwcmRXZ3MKWVJ2TmN4TXNlRGJpTDRKSURkMHhiN1d4VUdmVjRVNHZPMks5Vms1N0x3S0NBUUVBMkd1eE1jcXd1RnRUc0tPYwpaaUFDcXZFZTRKRmhSVGtySHlnSW1MelZSaS9ZU3M1c3MycnZmWDA0T3N5bVZ0UUZUVHdoeUMzbktjWXFkVW52ClZGblBFMHJyblV2Qzk0elBUQ205SHZPaTBzK1JORndOdlFMUWgrME5NR1ZBOFZyaU44aXRQZ1RJWU5XaFdianQKNFA1TE45V0QwVHBmT1J4cFBRZmNxT0JsZjdjcmhtNzNvdUNwemZtMmE3OStCaWpKUFF5NzR1cFhDeXRmeHNlUApNSlU0Uk56NjdJaDFMclpKM2xGbDFvYitZT2xKazhDOHpZd1RLT0hWck9zeGxobyt4SXN2Q2t3MDFMelZ6Mi9hCnRmT3Y5NTlHSnQzbXE0ZWpJUFZPQy9iUlpmdTMvMEdSY2dpQTZ5SnpaM0VxWTVaOU1EbTU3VzdjcE5RRlRxZmEKNXEyUmtRS0NBUUErNGhZSzQ3TXg2aUNkTWxKaEJSdS82OUJucktOWm96NFdPalRFNFlXejk3MmpGU0Mrd2tsRQpzeUJjNDBvNGp4WFRHb2wwc04rZU03WndnY3dNTko3OXVHRXZ4cFhVMlA4YTdqc3BHaEVKZXVsTlo5U015R0orCnZkaWE4TEJZZDJiK2FCbjhOay9pd1Rqd0xTNC92NXI1Vk5uaFdpRElDK2tYZVVPWGRwQ1pWbDN3TEV2V0cxRHQKMzJHTmxzZzM5VENsVE5BZUJudjc1VTdYOEQrQ0gvRVpoa0E0aGxFL2hXN0JRZTczclRzd1creHhLc3BjWWFpVwpjdEg3NzVMYUw3Rm1lUVRTYk01OVZpcTZXZ2J0OVY3Rko5R09DSkQzZHF2ZjBITDlEVndjSzQ3WWt3OWlFc3RYCnY5cnEvREhhYUpGNzBGNlFlTTNNbDhSa212WTZJYkEzQW9JQkFRRGt6RmZLeG9HQ3dWUDlua3k4NmFQSjFvd2kKc2FDZEx6RjRWTENRZzkrUXJITzEyY0p5MFFQUnJ2cUQyMGp1cDFlOWJhWVZzbkdYc1FZTFg2NVR6UzJSSCtlSAp6S0NPTTdnMVE3djMxNWpjMDMvN1lQck4rb3RrV0VBOUkyaDZjUE1vY3c0aERTNk02OFlxQVlKTS9RclVhenZhCnhBTFJaZEVkQW1xWDA4VHhuY1hRUEVxYkk0ZnlSZ2pVM1BYR3RRaFFFbERpR2kwbThjQTJNTXdsR1RmbTdOSXgKaENjZ2ZkL296TEp2VUhiMkxLRi82cXEySmJVRHlOMkVoK0xSZUJjdnp6Y1grZE5MdGQxY0Uvcm1SM2hMbWxmNgo3KzRpTVMxK0t1eWV3VlJVUEE1c1F1aUYyVUVoeEs1MUpZK1FpOG9HbERKdGRrOXB3QlZNN1F0WW9KVEwKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K",
-          "Certificate": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZvakNDQklxZ0F3SUJBZ0lUQVAvRTgvRk43NTdtN0dvRklyWEF1cU0zblRBTkJna3Foa2lHOXcwQkFRc0YKQURBZk1SMHdHd1lEVlFRRERCUm9NbkJ3ZVNCb01tTnJaWElnWm1GclpTQkRRVEFlRncweE9EQXhNVFV3TnpJNQpNREJhRncweE9EQTBNVFV3TnpJNU1EQmFNRVF4RXpBUkJnTlZCQU1UQ214dlkyRnNNUzVqYjIweExUQXJCZ05WCkJBVVRKR1ptWXpSbU0yWXhOR1JsWmpsbFpUWmxZelpoTURVeU1tSTFZekJpWVdFek16YzVaRENDQWlJd0RRWUoKS29aSWh2Y05BUUVCQlFBRGdnSVBBRENDQWdvQ2dnSUJBTGtvVE9NYzZzNlRWNlVtZXFmMzdmaFpNbFlkdmowWApxMDgxTGZBMENjZWtSSEFQeExMeGJCMVhEU1JTeXBLV3QzdkJzQ0JRSXdUK3F6dnNZUmtYR1VaTFFqZTE5dlp5Cm5WeFpiM1hOcXNCNnkwTW1Jak5NUFBFcXplVXcyK3Y4ekh1cnRMYlEyMnBBcGU4M1FTVUs4NUY4bmpDOG1OekMKdTRtUHRNNmYyNDlWNkp6UXJtUVBuWU1aZFVwRmpBbEJmd1RodVdxemw2YUM4U2hqMTRMRnNUVEVpbFd5UjhOLwo3NCtlVzNqcjBaM2pxVEdWNkhOUFkyRHJnSXduWkZjck5FVjZ5dVhBUStDNWsxcjdNZEZrdm5pMDhoVE96eTdtCk44ZzJRakZ4M0ZZb3c4WUpVbTlMbmt6NldrMXc5R3k0NEF6UFJBN1RNblFiTlFqbVdUbDZHNndzZ20rY3BVdkYKbE1FckZMT1VWcW44bEo2ZjYwZUpiN0hXUFhWSCtEcndpMWE2R0l2ZVdoYkZhcEN5dkM1L3dOck10V29namJjUgpZeWZiVnBudUZnbXNPSVVoZnc4ZVhqT1hGeG0wV3NKMVZTQVZWc2NiT2REdEVYa0hhSnFUM1FEQ2t3bVRrUlpWCjRleldPNmdGbFE1SXNQSzQ2TXhzT3Yxci9UUnNVdWZXL3UrR2o5YTlLdmVyeFAwTC85eS9uSi9HK3lBUC9qbTIKaWNQQnpyUlpzUEJkS2dRc05KR25sQ1dkYUVaOFdsd0NmQThSZ3lSUFZqRXZMUVc1bFpzMnk0UlF0OGUxTEN4Ywp0SkN2TGh6eERzRDZIQ2VRRXdPVDZhSzBnOW1uc2FlSUxvMm1jckVTNDgzM0JvSXU2SkFST2xWT1hvd3pHMnYzCnVBeitBVDBGL1ZaRkFnTUJBQUdqZ2dHd01JSUJyREFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXcKRkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SFFZRFZSME9CQllFRk5LZQpBVUZYc2Z2N2lML0lYVVBXdzY2ZU5jQnhNQjhHQTFVZEl3UVlNQmFBRlB0NFR4TDVZQldETEo4WGZ6UVpzeTQyCjZrR0pNR1lHQ0NzR0FRVUZCd0VCQkZvd1dEQWlCZ2dyQmdFRkJRY3dBWVlXYUhSMGNEb3ZMekV5Tnk0d0xqQXUKTVRvME1EQXlMekF5QmdnckJnRUZCUWN3QW9ZbWFIUjBjRG92THpFeU55NHdMakF1TVRvME1EQXdMMkZqYldVdgphWE56ZFdWeUxXTmxjblF3T1FZRFZSMFJCREl3TUlJS2JHOWpZV3d4TG1OdmJZSVFkR1Z6ZERFdWJHOWpZV3d4CkxtTnZiWUlRZEdWemRESXViRzlqWVd3eExtTnZiVEFuQmdOVkhSOEVJREFlTUJ5Z0dxQVloaFpvZEhSd09pOHYKWlhoaGJYQnNaUzVqYjIwdlkzSnNNR0VHQTFVZElBUmFNRmd3Q0FZR1o0RU1BUUlCTUV3R0F5b0RCREJGTUNJRwpDQ3NHQVFVRkJ3SUJGaFpvZEhSd09pOHZaWGhoYlhCc1pTNWpiMjB2WTNCek1COEdDQ3NHQVFVRkJ3SUNNQk1NCkVVUnZJRmRvWVhRZ1ZHaHZkU0JYYVd4ME1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ3A0Q2FxZlR4THNQTzQKS2JueDJZdEc4bTN3MC9keTVVR1VRNjZHbGxPVTk0L2I0MmNhbTRuNUZrTWlpZ01IaUx4c2JZVXh0cDZKQ3R5cQpLKzFNcDFWWEtSTTVKbFBTNWRIaWhxdHk1U3BrTUhjampwQSs3U2YyVWtoNmpKRWYxTUVJY2JnWnpJRk5IT0hYClVUUUppVFhKcno3blJDZnlQWFZtbWErUGtIRlU4R0VEVzJGOVptU1kzVFBiQWhiWkV2UkZubjUrR1lxbkZuancKWWw3Y0I2MXYwRzVpOGQwbnVvbTB4a2hiNTU3Y3BiZHhLblhsaFU4N2RZSTR5SUdPdUFGUWpYcXFXN2NIZCtXUQpWSDB2dFA3cEgrRmt2YnY4WkkxMHMrNU5ZcCtzZjFQZGQxekJsRmdNSGF3dnFFYUg3SU9sejdkajlCdmtVc0dpClhxQWVqQnFPCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVpakNDQTNLZ0F3SUJBZ0lDRWswd0RRWUpLb1pJaHZjTkFRRUxCUUF3S3pFcE1DY0dBMVVFQXd3Z1kyRmoKYTJ4cGJtY2dZM0o1Y0hSdlozSmhjR2hsY2lCbVlXdGxJRkpQVDFRd0hoY05NVFV4TURJeE1qQXhNVFV5V2hjTgpNakF4TURFNU1qQXhNVFV5V2pBZk1SMHdHd1lEVlFRREV4Um9ZWEJ3ZVNCb1lXTnJaWElnWm1GclpTQkRRVENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTUlLUjNtYUJjVVNzbmNYWXpRVDEzRDUKTnIrWjNtTHhNTWgzVFVkdDZzQUNtcWJKMGJ0UmxnWGZNdE5MTTJPVTFJNmEzSnUrdElaU2RuMnYyMUpCd3Z4VQp6cFpRNHp5MmNpbUlpTVFEWkNRSEp3ekM5R1puOEhhVzA5MWl6OUgwR28zQTdXRFh3WU5tc2RMTlJpMDBvMTRVCmpvYVZxYVBzWXJaV3ZSS2FJUnFhVTBoSG1TMEFXd1FTdk4vOTNpTUlYdXlpd3l3bWt3S2JXbm54Q1EvZ3NjdEsKRlV0Y05yd0V4OVdnajZLbGh3RFR5STFRV1NCYnhWWU55VWdQRnpLeHJTbXdNTzB5TmZmN2hvK1FUOXg1K1kvNwpYRTU5UzRNYzRaWHhjWEtldy9nU2xOOVU1bXZUK0QyQmhEdGtDdXBkZnNaTkNRV3AyN0ErYi9EbXJGSTlOcXNDCkF3RUFBYU9DQWNJd2dnRytNQklHQTFVZEV3RUIvd1FJTUFZQkFmOENBUUF3UXdZRFZSMGVCRHd3T3FFNE1BYUMKQkM1dGFXd3dDb2NJQUFBQUFBQUFBQUF3SW9jZ0FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQQpBQUFBQUFBd0RnWURWUjBQQVFIL0JBUURBZ0dHTUg4R0NDc0dBUVVGQndFQkJITXdjVEF5QmdnckJnRUZCUWN3CkFZWW1hSFIwY0RvdkwybHpjbWN1ZEhKMWMzUnBaQzV2WTNOd0xtbGtaVzUwY25WemRDNWpiMjB3T3dZSUt3WUIKQlFVSE1BS0dMMmgwZEhBNkx5OWhjSEJ6TG1sa1pXNTBjblZ6ZEM1amIyMHZjbTl2ZEhNdlpITjBjbTl2ZEdOaAplRE11Y0Rkak1COEdBMVVkSXdRWU1CYUFGT21rUCs2ZXBlYnkxZGQ1WUR5VHBpNGtqcGVxTUZRR0ExVWRJQVJOCk1Fc3dDQVlHWjRFTUFRSUJNRDhHQ3lzR0FRUUJndDhUQVFFQk1EQXdMZ1lJS3dZQkJRVUhBZ0VXSW1oMGRIQTYKTHk5amNITXVjbTl2ZEMxNE1TNXNaWFJ6Wlc1amNubHdkQzV2Y21jd1BBWURWUjBmQkRVd016QXhvQytnTFlZcgphSFIwY0RvdkwyTnliQzVwWkdWdWRISjFjM1F1WTI5dEwwUlRWRkpQVDFSRFFWZ3pRMUpNTG1OeWJEQWRCZ05WCkhRNEVGZ1FVKzNoUEV2bGdGWU1zbnhkL05CbXpMamJxUVlrd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFBMFkKQWVMWE9rbHg0aGhDaWtVVWwrQmRuRmZuMWcwVzVBaVFMVk5JT0w2UG5xWHUwd2puaE55aHFkd25maFlNbm95NAppZFJoNGxCNnB6OEdmOXBubExkL0RuV1NWM2dTKy9JL21BbDFkQ2tLYnk2SDJWNzkwZTZJSG1JSzJLWW0zam0rClUrK0ZJZEdwQmRzUVRTZG1pWC9yQXl1eE1ETTBhZE1rTkJ3VGZRbVpRQ3o2bkdIdzFRY1NQWk12WnBzQzhTa3YKZWt6eHNqRjFvdE9yTVVQTlBRdnRUV3JWeDhHbFIycWZ4LzR4YlFhMXYyZnJOdkZCQ21PNTlnb3oram5XdmZUdApqMk5qd0RaN3ZsTUJzUG0xNmRiS1lDODQwdXZSb1pqeHFzZGMzQ2hDWmpxaW1GcWxORy94b1BBOCtkVGljWnpDClhFOWlqUEljdlc2eTFhYTNiR3c9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
-        }
-      }
-    ]
-  },
-  "ChallengeCerts": {}
-}

acme/acme_test.go

@@ -1,824 +0,0 @@
-package acme
-
-import (
-	"crypto/tls"
-	"encoding/base64"
-	"net/http"
-	"net/http/httptest"
-	"reflect"
-	"sort"
-	"sync"
-	"testing"
-	"time"
-
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/tls/generate"
-	"github.com/containous/traefik/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/xenolf/lego/acme"
-)
-
-func TestDomainsSet(t *testing.T) {
-	testCases := []struct {
-		input    string
-		expected types.Domains
-	}{
-		{
-			input:    "",
-			expected: types.Domains{},
-		},
-		{
-			input: "foo1.com",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-			},
-		},
-		{
-			input: "foo2.com,bar.net",
-			expected: types.Domains{
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-			},
-		},
-		{
-			input: "foo3.com,bar1.net,bar2.net,bar3.net",
-			expected: types.Domains{
-				types.Domain{
-					Main: "foo3.com",
-					SANs: []string{"bar1.net", "bar2.net", "bar3.net"},
-				},
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.input, func(t *testing.T) {
-			t.Parallel()
-
-			domains := types.Domains{}
-			domains.Set(test.input)
-			assert.Exactly(t, test.expected, domains)
-		})
-	}
-}
-
-func TestDomainsSetAppend(t *testing.T) {
-	testCases := []struct {
-		input    string
-		expected types.Domains
-	}{
-		{
-			input:    "",
-			expected: types.Domains{},
-		},
-		{
-			input: "foo1.com",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-			},
-		},
-		{
-			input: "foo2.com,bar.net",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-			},
-		},
-		{
-			input: "foo3.com,bar1.net,bar2.net,bar3.net",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-				types.Domain{
-					Main: "foo3.com",
-					SANs: []string{"bar1.net", "bar2.net", "bar3.net"},
-				},
-			},
-		},
-	}
-
-	// append to
-	domains := types.Domains{}
-	for _, test := range testCases {
-		t.Run(test.input, func(t *testing.T) {
-
-			domains.Set(test.input)
-			assert.Exactly(t, test.expected, domains)
-		})
-	}
-}
-
-func TestCertificatesRenew(t *testing.T) {
-	foo1Cert, foo1Key, _ := generate.KeyPair("foo1.com", time.Now())
-	foo2Cert, foo2Key, _ := generate.KeyPair("foo2.com", time.Now())
-
-	domainsCertificates := DomainsCertificates{
-		lock: sync.RWMutex{},
-		Certs: []*DomainsCertificate{
-			{
-				Domains: types.Domain{
-					Main: "foo1.com"},
-				Certificate: &Certificate{
-					Domain:        "foo1.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    foo1Key,
-					Certificate:   foo1Cert,
-				},
-			},
-			{
-				Domains: types.Domain{
-					Main: "foo2.com"},
-				Certificate: &Certificate{
-					Domain:        "foo2.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    foo2Key,
-					Certificate:   foo2Cert,
-				},
-			},
-		},
-	}
-
-	foo1Cert, foo1Key, _ = generate.KeyPair("foo1.com", time.Now())
-	newCertificate := &Certificate{
-		Domain:        "foo1.com",
-		CertURL:       "url",
-		CertStableURL: "url",
-		PrivateKey:    foo1Key,
-		Certificate:   foo1Cert,
-	}
-
-	err := domainsCertificates.renewCertificates(newCertificate, types.Domain{Main: "foo1.com"})
-	if err != nil {
-		t.Errorf("Error in renewCertificates :%v", err)
-	}
-
-	if len(domainsCertificates.Certs) != 2 {
-		t.Errorf("Expected domainsCertificates length %d %+v\nGot %+v", 2, domainsCertificates.Certs, len(domainsCertificates.Certs))
-	}
-
-	if !reflect.DeepEqual(domainsCertificates.Certs[0].Certificate, newCertificate) {
-		t.Errorf("Expected new certificate %+v \nGot %+v", newCertificate, domainsCertificates.Certs[0].Certificate)
-	}
-}
-
-func TestRemoveDuplicates(t *testing.T) {
-	now := time.Now()
-	fooCert, fooKey, _ := generate.KeyPair("foo.com", now)
-	foo24Cert, foo24Key, _ := generate.KeyPair("foo.com", now.Add(24*time.Hour))
-	foo48Cert, foo48Key, _ := generate.KeyPair("foo.com", now.Add(48*time.Hour))
-	barCert, barKey, _ := generate.KeyPair("bar.com", now)
-	domainsCertificates := DomainsCertificates{
-		lock: sync.RWMutex{},
-		Certs: []*DomainsCertificate{
-			{
-				Domains: types.Domain{
-					Main: "foo.com"},
-				Certificate: &Certificate{
-					Domain:        "foo.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    foo24Key,
-					Certificate:   foo24Cert,
-				},
-			},
-			{
-				Domains: types.Domain{
-					Main: "foo.com"},
-				Certificate: &Certificate{
-					Domain:        "foo.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    foo48Key,
-					Certificate:   foo48Cert,
-				},
-			},
-			{
-				Domains: types.Domain{
-					Main: "foo.com"},
-				Certificate: &Certificate{
-					Domain:        "foo.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    fooKey,
-					Certificate:   fooCert,
-				},
-			},
-			{
-				Domains: types.Domain{
-					Main: "bar.com"},
-				Certificate: &Certificate{
-					Domain:        "bar.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    barKey,
-					Certificate:   barCert,
-				},
-			},
-			{
-				Domains: types.Domain{
-					Main: "foo.com"},
-				Certificate: &Certificate{
-					Domain:        "foo.com",
-					CertURL:       "url",
-					CertStableURL: "url",
-					PrivateKey:    foo48Key,
-					Certificate:   foo48Cert,
-				},
-			},
-		},
-	}
-	domainsCertificates.Init()
-
-	if len(domainsCertificates.Certs) != 2 {
-		t.Errorf("Expected domainsCertificates length %d %+v\nGot %+v", 2, domainsCertificates.Certs, len(domainsCertificates.Certs))
-	}
-
-	for _, cert := range domainsCertificates.Certs {
-		switch cert.Domains.Main {
-		case "bar.com":
-			continue
-		case "foo.com":
-			if !cert.tlsCert.Leaf.NotAfter.Equal(now.Add(48 * time.Hour).Truncate(1 * time.Second)) {
-				t.Errorf("Bad expiration %s date for domain %+v, now %s", cert.tlsCert.Leaf.NotAfter.String(), cert, now.Add(48*time.Hour).Truncate(1*time.Second).String())
-			}
-		default:
-			t.Errorf("Unknown domain %+v", cert)
-		}
-	}
-}
-
-func TestNoPreCheckOverride(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
-	err := dnsOverrideDelay(0)
-	if err != nil {
-		t.Errorf("Error in dnsOverrideDelay :%v", err)
-	}
-	if acme.PreCheckDNS != nil {
-		t.Error("Unexpected change to acme.PreCheckDNS when leaving DNS verification as is.")
-	}
-}
-
-func TestSillyPreCheckOverride(t *testing.T) {
-	err := dnsOverrideDelay(-5)
-	if err == nil {
-		t.Error("Missing expected error in dnsOverrideDelay!")
-	}
-}
-
-func TestPreCheckOverride(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
-	err := dnsOverrideDelay(5)
-	if err != nil {
-		t.Errorf("Error in dnsOverrideDelay :%v", err)
-	}
-	if acme.PreCheckDNS == nil {
-		t.Error("No change to acme.PreCheckDNS when meant to be adding enforcing override function.")
-	}
-}
-
-func TestAcmeClientCreation(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
-	// Lengthy setup to avoid external web requests - oh for easier golang testing!
-	account := &Account{Email: "f@f"}
-	account.PrivateKey, _ = base64.StdEncoding.DecodeString(`
-MIIBPAIBAAJBAMp2Ni92FfEur+CAvFkgC12LT4l9D53ApbBpDaXaJkzzks+KsLw9zyAxvlrfAyTCQ
-7tDnEnIltAXyQ0uOFUUdcMCAwEAAQJAK1FbipATZcT9cGVa5x7KD7usytftLW14heQUPXYNV80r/3
-lmnpvjL06dffRpwkYeN8DATQF/QOcy3NNNGDw/4QIhAPAKmiZFxA/qmRXsuU8Zhlzf16WrNZ68K64
-asn/h3qZrAiEA1+wFR3WXCPIolOvd7AHjfgcTKQNkoMPywU4FYUNQ1AkCIQDv8yk0qPjckD6HVCPJ
-llJh9MC0svjevGtNlxJoE3lmEQIhAKXy1wfZ32/XtcrnENPvi6lzxI0T94X7s5pP3aCoPPoJAiEAl
-cijFkALeQp/qyeXdFld2v9gUN3eCgljgcl0QweRoIc=---`)
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`{
-  "GPHhmRVEDas": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
-  "keyChange": "https://foo/acme/key-change",
-  "meta": {
-    "termsOfService": "https://boulder:4431/terms/v7"
-  },
-  "newAccount": "https://foo/acme/new-acct",
-  "newNonce": "https://foo/acme/new-nonce",
-  "newOrder": "https://foo/acme/new-order",
-  "revokeCert": "https://foo/acme/revoke-cert"
-}`))
-	}))
-	defer ts.Close()
-	a := ACME{DNSChallenge: &acmeprovider.DNSChallenge{Provider: "manual", DelayBeforeCheck: 10}, CAServer: ts.URL}
-
-	client, err := a.buildACMEClient(account)
-	if err != nil {
-		t.Errorf("Error in buildACMEClient: %v", err)
-	}
-	if client == nil {
-		t.Error("No client from buildACMEClient!")
-	}
-	if acme.PreCheckDNS == nil {
-		t.Error("No change to acme.PreCheckDNS when meant to be adding enforcing override function.")
-	}
-}
-
-func TestAcme_getUncheckedCertificates(t *testing.T) {
-	mm := make(map[string]*tls.Certificate)
-	mm["*.containo.us"] = &tls.Certificate{}
-	mm["traefik.acme.io"] = &tls.Certificate{}
-
-	dm := make(map[string]struct{})
-	dm["*.traefik.wtf"] = struct{}{}
-
-	a := ACME{TLSConfig: &tls.Config{NameToCertificate: mm}, resolvingDomains: dm}
-
-	domains := []string{"traefik.containo.us", "trae.containo.us", "foo.traefik.wtf"}
-	uncheckedDomains := a.getUncheckedDomains(domains, nil)
-	assert.Empty(t, uncheckedDomains)
-	domains = []string{"traefik.acme.io", "trae.acme.io"}
-	uncheckedDomains = a.getUncheckedDomains(domains, nil)
-	assert.Len(t, uncheckedDomains, 1)
-	domainsCertificates := DomainsCertificates{Certs: []*DomainsCertificate{
-		{
-			tlsCert: &tls.Certificate{},
-			Domains: types.Domain{
-				Main: "*.acme.wtf",
-				SANs: []string{"trae.acme.io"},
-			},
-		},
-	}}
-	account := Account{DomainsCertificate: domainsCertificates}
-	uncheckedDomains = a.getUncheckedDomains(domains, &account)
-	assert.Empty(t, uncheckedDomains)
-	domains = []string{"traefik.containo.us", "trae.containo.us", "traefik.wtf"}
-	uncheckedDomains = a.getUncheckedDomains(domains, nil)
-	assert.Len(t, uncheckedDomains, 1)
-}
-
-func TestAcme_getProvidedCertificate(t *testing.T) {
-	mm := make(map[string]*tls.Certificate)
-	mm["*.containo.us"] = &tls.Certificate{}
-	mm["traefik.acme.io"] = &tls.Certificate{}
-
-	a := ACME{TLSConfig: &tls.Config{NameToCertificate: mm}}
-
-	domain := "traefik.containo.us"
-	certificate := a.getProvidedCertificate(domain)
-	assert.NotNil(t, certificate)
-	domain = "trae.acme.io"
-	certificate = a.getProvidedCertificate(domain)
-	assert.Nil(t, certificate)
-}
-
-func TestAcme_getValidDomain(t *testing.T) {
-	testCases := []struct {
-		desc            string
-		domains         []string
-		wildcardAllowed bool
-		dnsChallenge    *acmeprovider.DNSChallenge
-		expectedErr     string
-		expectedDomains []string
-	}{
-		{
-			desc:            "valid wildcard",
-			domains:         []string{"*.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "",
-			expectedDomains: []string{"*.traefik.wtf"},
-		},
-		{
-			desc:            "no wildcard",
-			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			expectedErr:     "",
-			wildcardAllowed: true,
-			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
-		},
-		{
-			desc:            "unauthorized wildcard",
-			domains:         []string{"*.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: false,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.traefik.wtf\" from a 'Host' rule",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "no domain",
-			domains:         []string{},
-			dnsChallenge:    nil,
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a certificate when no domain is given",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "no DNSChallenge",
-			domains:         []string{"*.traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    nil,
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.traefik.wtf,foo.traefik.wtf\" : ACME needs a DNSChallenge",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "unauthorized wildcard with SAN",
-			domains:         []string{"*.*.traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.*.traefik.wtf,foo.traefik.wtf\" : ACME does not allow '*.*' wildcard domain",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "wildcard with SANs",
-			domains:         []string{"*.traefik.wtf", "traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "",
-			expectedDomains: []string{"*.traefik.wtf", "traefik.wtf"},
-		},
-		{
-			desc:            "unexpected SANs",
-			domains:         []string{"*.traefik.wtf", "*.acme.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a certificate for domains \"*.traefik.wtf,*.acme.wtf\": SANs can not be a wildcard domain",
-			expectedDomains: nil,
-		},
-	}
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			a := ACME{}
-			if test.dnsChallenge != nil {
-				a.DNSChallenge = test.dnsChallenge
-			}
-			domains, err := a.getValidDomains(test.domains, test.wildcardAllowed)
-
-			if len(test.expectedErr) > 0 {
-				assert.EqualError(t, err, test.expectedErr, "Unexpected error.")
-			} else {
-				assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
-			}
-		})
-	}
-}
-
-func TestAcme_getCertificateForDomain(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		domain        string
-		dc            *DomainsCertificates
-		expected      *DomainsCertificate
-		expectedFound bool
-	}{
-		{
-			desc:   "non-wildcard exact match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected: &DomainsCertificate{
-				Domains: types.Domain{
-					Main: "foo.traefik.wtf",
-				},
-			},
-			expectedFound: true,
-		},
-		{
-			desc:   "non-wildcard no match",
-			domain: "bar.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected:      nil,
-			expectedFound: false,
-		},
-		{
-			desc:   "wildcard match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "*.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected: &DomainsCertificate{
-				Domains: types.Domain{
-					Main: "*.traefik.wtf",
-				},
-			},
-			expectedFound: true,
-		},
-		{
-			desc:   "wildcard no match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "*.bar.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected:      nil,
-			expectedFound: false,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			got, found := test.dc.getCertificateForDomain(test.domain)
-			assert.Equal(t, test.expectedFound, found)
-			assert.Equal(t, test.expected, got)
-		})
-	}
-}
-
-func TestRemoveEmptyCertificates(t *testing.T) {
-	now := time.Now()
-	fooCert, fooKey, _ := generate.KeyPair("foo.com", now)
-	acmeCert, acmeKey, _ := generate.KeyPair("acme.wtf", now.Add(24*time.Hour))
-	barCert, barKey, _ := generate.KeyPair("bar.com", now)
-	testCases := []struct {
-		desc       string
-		dc         *DomainsCertificates
-		expectedDc *DomainsCertificates
-	}{
-		{
-			desc: "No empty certificate",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: fooCert,
-							PrivateKey:  fooKey,
-						},
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: barCert,
-							PrivateKey:  barKey,
-						},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-			expectedDc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: fooCert,
-							PrivateKey:  fooKey,
-						},
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: barCert,
-							PrivateKey:  barKey,
-						},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-		},
-		{
-			desc: "First certificate is nil",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: barCert,
-							PrivateKey:  barKey,
-						},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-			expectedDc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: nil,
-							PrivateKey:  barKey,
-						},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-		},
-		{
-			desc: "Last certificate is empty",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: fooCert,
-							PrivateKey:  fooKey,
-						},
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-			expectedDc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: fooCert,
-							PrivateKey:  fooKey,
-						},
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-				},
-			},
-		},
-		{
-			desc: "First and last certificates are nil or empty",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-					{
-						Certificate: &Certificate{},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-			expectedDc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Certificate: &Certificate{
-							Certificate: acmeCert,
-							PrivateKey:  acmeKey,
-						},
-						Domains: types.Domain{
-							Main: "acme.wtf",
-						},
-					},
-				},
-			},
-		},
-		{
-			desc: "All certificates are nil or empty",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.com",
-						},
-					},
-					{
-						Domains: types.Domain{
-							Main: "foo24.com",
-						},
-					},
-					{
-						Certificate: &Certificate{},
-						Domains: types.Domain{
-							Main: "bar.com",
-						},
-					},
-				},
-			},
-			expectedDc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{},
-			},
-		},
-	}
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			a := &Account{DomainsCertificate: *test.dc}
-			a.Init()
-
-			assert.Equal(t, len(test.expectedDc.Certs), len(a.DomainsCertificate.Certs))
-			sort.Sort(&a.DomainsCertificate)
-			sort.Sort(test.expectedDc)
-			for key, value := range test.expectedDc.Certs {
-				assert.Equal(t, value.Domains.Main, a.DomainsCertificate.Certs[key].Domains.Main)
-			}
-		})
-	}
-}

acme/challenge_http_provider.go

@@ -1,104 +0,0 @@
-package acme
-
-import (
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/cenk/backoff"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
-)
-
-var _ acme.ChallengeProviderTimeout = (*challengeHTTPProvider)(nil)
-
-type challengeHTTPProvider struct {
-	store cluster.Store
-	lock  sync.RWMutex
-}
-
-func (c *challengeHTTPProvider) getTokenValue(token, domain string) []byte {
-	log.Debugf("Looking for an existing ACME challenge for token %v...", token)
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-
-	account := c.store.Get().(*Account)
-	if account.HTTPChallenge == nil {
-		return []byte{}
-	}
-
-	var result []byte
-	operation := func() error {
-		var ok bool
-		if result, ok = account.HTTPChallenge[token][domain]; !ok {
-			return fmt.Errorf("cannot find challenge for token %v", token)
-		}
-		return nil
-	}
-
-	notify := func(err error, time time.Duration) {
-		log.Errorf("Error getting challenge for token retrying in %s", time)
-	}
-
-	ebo := backoff.NewExponentialBackOff()
-	ebo.MaxElapsedTime = 60 * time.Second
-	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-	if err != nil {
-		log.Errorf("Error getting challenge for token: %v", err)
-		return []byte{}
-	}
-	return result
-}
-
-func (c *challengeHTTPProvider) Present(domain, token, keyAuth string) error {
-	log.Debugf("Challenge Present %s", domain)
-	c.lock.Lock()
-	defer c.lock.Unlock()
-
-	transaction, object, err := c.store.Begin()
-	if err != nil {
-		return err
-	}
-
-	account := object.(*Account)
-	if account.HTTPChallenge == nil {
-		account.HTTPChallenge = map[string]map[string][]byte{}
-	}
-
-	if _, ok := account.HTTPChallenge[token]; !ok {
-		account.HTTPChallenge[token] = map[string][]byte{}
-	}
-
-	account.HTTPChallenge[token][domain] = []byte(keyAuth)
-
-	return transaction.Commit(account)
-}
-
-func (c *challengeHTTPProvider) CleanUp(domain, token, keyAuth string) error {
-	log.Debugf("Challenge CleanUp %s", domain)
-	c.lock.Lock()
-	defer c.lock.Unlock()
-
-	transaction, object, err := c.store.Begin()
-	if err != nil {
-		return err
-	}
-
-	account := object.(*Account)
-	if _, ok := account.HTTPChallenge[token]; ok {
-		if _, domainOk := account.HTTPChallenge[token][domain]; domainOk {
-			delete(account.HTTPChallenge[token], domain)
-		}
-		if len(account.HTTPChallenge[token]) == 0 {
-			delete(account.HTTPChallenge, token)
-		}
-	}
-
-	return transaction.Commit(account)
-}
-
-func (c *challengeHTTPProvider) Timeout() (timeout, interval time.Duration) {
-	return 60 * time.Second, 5 * time.Second
-}

acme/challenge_tls_provider.go

@@ -1,127 +0,0 @@
-package acme
-
-import (
-	"crypto/tls"
-	"fmt"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/cenk/backoff"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
-)
-
-var _ acme.ChallengeProviderTimeout = (*challengeTLSProvider)(nil)
-
-type challengeTLSProvider struct {
-	store cluster.Store
-	lock  sync.RWMutex
-}
-
-func (c *challengeTLSProvider) getCertificate(domain string) (cert *tls.Certificate, exists bool) {
-	log.Debugf("Looking for an existing ACME challenge for %s...", domain)
-
-	if !strings.HasSuffix(domain, ".acme.invalid") {
-		return nil, false
-	}
-
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-
-	account := c.store.Get().(*Account)
-	if account.ChallengeCerts == nil {
-		return nil, false
-	}
-
-	account.Init()
-
-	var result *tls.Certificate
-	operation := func() error {
-		for _, cert := range account.ChallengeCerts {
-			for _, dns := range cert.certificate.Leaf.DNSNames {
-				if domain == dns {
-					result = cert.certificate
-					return nil
-				}
-			}
-		}
-		return fmt.Errorf("cannot find challenge cert for domain %s", domain)
-	}
-
-	notify := func(err error, time time.Duration) {
-		log.Errorf("Error getting cert: %v, retrying in %s", err, time)
-	}
-	ebo := backoff.NewExponentialBackOff()
-	ebo.MaxElapsedTime = 60 * time.Second
-
-	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-	if err != nil {
-		log.Errorf("Error getting cert: %v", err)
-		return nil, false
-
-	}
-	return result, true
-}
-
-func (c *challengeTLSProvider) Present(domain, token, keyAuth string) error {
-	log.Debugf("Challenge Present %s", domain)
-
-	cert, err := tlsALPN01ChallengeCert(domain, keyAuth)
-	if err != nil {
-		return err
-	}
-
-	c.lock.Lock()
-	defer c.lock.Unlock()
-
-	transaction, object, err := c.store.Begin()
-	if err != nil {
-		return err
-	}
-
-	account := object.(*Account)
-	if account.ChallengeCerts == nil {
-		account.ChallengeCerts = map[string]*ChallengeCert{}
-	}
-	account.ChallengeCerts[domain] = cert
-
-	return transaction.Commit(account)
-}
-
-func (c *challengeTLSProvider) CleanUp(domain, token, keyAuth string) error {
-	log.Debugf("Challenge CleanUp %s", domain)
-
-	c.lock.Lock()
-	defer c.lock.Unlock()
-
-	transaction, object, err := c.store.Begin()
-	if err != nil {
-		return err
-	}
-
-	account := object.(*Account)
-	delete(account.ChallengeCerts, domain)
-
-	return transaction.Commit(account)
-}
-
-func (c *challengeTLSProvider) Timeout() (timeout, interval time.Duration) {
-	return 60 * time.Second, 5 * time.Second
-}
-
-func tlsALPN01ChallengeCert(domain, keyAuth string) (*ChallengeCert, error) {
-	tempCertPEM, rsaPrivPEM, err := acme.TLSALPNChallengeBlocks(domain, keyAuth)
-	if err != nil {
-		return nil, err
-	}
-
-	certificate, err := tls.X509KeyPair(tempCertPEM, rsaPrivPEM)
-	if err != nil {
-		return nil, err
-	}
-
-	return &ChallengeCert{Certificate: tempCertPEM, PrivateKey: rsaPrivPEM, certificate: &certificate}, nil
-}

acme/localStore.go

@@ -1,177 +0,0 @@
-package acme
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/acme"
-)
-
-// LocalStore is a store using a file as storage
-type LocalStore struct {
-	file string
-}
-
-// NewLocalStore create a LocalStore
-func NewLocalStore(file string) *LocalStore {
-	return &LocalStore{
-		file: file,
-	}
-}
-
-// Get loads file into store and returns the Account
-func (s *LocalStore) Get() (*Account, error) {
-	account := &Account{}
-
-	hasData, err := acme.CheckFile(s.file)
-	if err != nil {
-		return nil, err
-	}
-
-	if hasData {
-		f, err := os.Open(s.file)
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-
-		file, err := ioutil.ReadAll(f)
-		if err != nil {
-			return nil, err
-		}
-
-		if err := json.Unmarshal(file, &account); err != nil {
-			return nil, err
-		}
-	}
-
-	return account, nil
-}
-
-// ConvertToNewFormat converts old acme.json format to the new one and store the result into the file (used for the backward compatibility)
-func ConvertToNewFormat(fileName string) {
-	localStore := acme.NewLocalStore(fileName)
-
-	storeAccount, err := localStore.GetAccount()
-	if err != nil {
-		log.Errorf("Failed to read new account, ACME data conversion is not available : %v", err)
-		return
-	}
-
-	storeCertificates, err := localStore.GetCertificates()
-	if err != nil {
-		log.Errorf("Failed to read new certificates, ACME data conversion is not available : %v", err)
-		return
-	}
-
-	if storeAccount == nil {
-		localStore := NewLocalStore(fileName)
-
-		account, err := localStore.Get()
-		if err != nil {
-			log.Errorf("Failed to read old account, ACME data conversion is not available : %v", err)
-			return
-		}
-
-		// Convert ACME data from old to new format
-		newAccount := &acme.Account{}
-		if account != nil && len(account.Email) > 0 {
-			err = backupACMEFile(fileName, account)
-			if err != nil {
-				log.Errorf("Unable to create a backup for the V1 formatted ACME file: %v", err)
-				return
-			}
-
-			err = account.RemoveAccountV1Values()
-			if err != nil {
-				log.Errorf("Unable to remove ACME Account V1 values during format conversion: %v", err)
-				return
-			}
-
-			newAccount = &acme.Account{
-				PrivateKey:   account.PrivateKey,
-				Registration: account.Registration,
-				Email:        account.Email,
-				KeyType:      account.KeyType,
-			}
-
-			var newCertificates []*acme.Certificate
-			for _, cert := range account.DomainsCertificate.Certs {
-				newCertificates = append(newCertificates, &acme.Certificate{
-					Certificate: cert.Certificate.Certificate,
-					Key:         cert.Certificate.PrivateKey,
-					Domain:      cert.Domains,
-				})
-			}
-
-			// If account is in the old format, storeCertificates is nil or empty and has to be initialized
-			storeCertificates = newCertificates
-		}
-
-		// Store the data in new format into the file even if account is nil
-		// to delete Account in ACME v1 format and keeping the certificates
-		newLocalStore := acme.NewLocalStore(fileName)
-		newLocalStore.SaveDataChan <- &acme.StoredData{Account: newAccount, Certificates: storeCertificates}
-	}
-}
-
-func backupACMEFile(originalFileName string, account interface{}) error {
-	// write account to file
-	data, err := json.MarshalIndent(account, "", "  ")
-	if err != nil {
-		return err
-	}
-	return ioutil.WriteFile(originalFileName+".bak", data, 0600)
-}
-
-// FromNewToOldFormat converts new acme account to the old one (used for the backward compatibility)
-func FromNewToOldFormat(fileName string) (*Account, error) {
-	localStore := acme.NewLocalStore(fileName)
-
-	storeAccount, err := localStore.GetAccount()
-	if err != nil {
-		return nil, err
-	}
-
-	storeCertificates, err := localStore.GetCertificates()
-	if err != nil {
-		return nil, err
-	}
-
-	// Convert ACME Account from new to old format
-	// (Needed by the KV stores)
-	var account *Account
-	if storeAccount != nil {
-		account = &Account{
-			Email:              storeAccount.Email,
-			PrivateKey:         storeAccount.PrivateKey,
-			Registration:       storeAccount.Registration,
-			DomainsCertificate: DomainsCertificates{},
-			KeyType:            storeAccount.KeyType,
-		}
-	}
-
-	// Convert ACME Certificates from new to old format
-	// (Needed by the KV stores)
-	if len(storeCertificates) > 0 {
-		// Account can be nil if data are migrated from new format
-		// with a ACME V1 Account
-		if account == nil {
-			account = &Account{}
-		}
-		for _, cert := range storeCertificates {
-			_, err := account.DomainsCertificate.addCertificateForDomains(&Certificate{
-				Domain:      cert.Domain.Main,
-				Certificate: cert.Certificate,
-				PrivateKey:  cert.Key,
-			}, cert.Domain)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	return account, nil
-}

acme/localStore_test.go

@@ -1,31 +0,0 @@
-package acme
-
-import (
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGet(t *testing.T) {
-	acmeFile := "./acme_example.json"
-
-	folder, prefix := filepath.Split(acmeFile)
-	tmpFile, err := ioutil.TempFile(folder, prefix)
-	defer os.Remove(tmpFile.Name())
-
-	assert.NoError(t, err)
-
-	fileContent, err := ioutil.ReadFile(acmeFile)
-	assert.NoError(t, err)
-
-	tmpFile.Write(fileContent)
-
-	localStore := NewLocalStore(tmpFile.Name())
-	account, err := localStore.Get()
-	assert.NoError(t, err)
-
-	assert.Len(t, account.DomainsCertificate.Certs, 1)
-}

anonymize/anonymize.go

@@ -1,136 +0,0 @@
-package anonymize
-
-import (
-	"encoding/json"
-	"fmt"
-	"reflect"
-	"regexp"
-
-	"github.com/mitchellh/copystructure"
-	"github.com/mvdan/xurls"
-)
-
-const (
-	maskShort = "xxxx"
-	maskLarge = maskShort + maskShort + maskShort + maskShort + maskShort + maskShort + maskShort + maskShort
-)
-
-// Do configuration.
-func Do(baseConfig interface{}, indent bool) (string, error) {
-	anomConfig, err := copystructure.Copy(baseConfig)
-	if err != nil {
-		return "", err
-	}
-
-	val := reflect.ValueOf(anomConfig)
-
-	err = doOnStruct(val)
-	if err != nil {
-		return "", err
-	}
-
-	configJSON, err := marshal(anomConfig, indent)
-	if err != nil {
-		return "", err
-	}
-
-	return doOnJSON(string(configJSON)), nil
-}
-
-func doOnJSON(input string) string {
-	mailExp := regexp.MustCompile(`\w[-._\w]*\w@\w[-._\w]*\w\.\w{2,3}"`)
-	return xurls.Relaxed.ReplaceAllString(mailExp.ReplaceAllString(input, maskLarge+"\""), maskLarge)
-}
-
-func doOnStruct(field reflect.Value) error {
-	switch field.Kind() {
-	case reflect.Ptr:
-		if !field.IsNil() {
-			if err := doOnStruct(field.Elem()); err != nil {
-				return err
-			}
-		}
-	case reflect.Struct:
-		for i := 0; i < field.NumField(); i++ {
-			fld := field.Field(i)
-			stField := field.Type().Field(i)
-			if !isExported(stField) {
-				continue
-			}
-			if stField.Tag.Get("export") == "true" {
-				if err := doOnStruct(fld); err != nil {
-					return err
-				}
-			} else {
-				if err := reset(fld, stField.Name); err != nil {
-					return err
-				}
-			}
-		}
-	case reflect.Map:
-		for _, key := range field.MapKeys() {
-			if err := doOnStruct(field.MapIndex(key)); err != nil {
-				return err
-			}
-		}
-	case reflect.Slice:
-		for j := 0; j < field.Len(); j++ {
-			if err := doOnStruct(field.Index(j)); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func reset(field reflect.Value, name string) error {
-	if !field.CanSet() {
-		return fmt.Errorf("cannot reset field %s", name)
-	}
-
-	switch field.Kind() {
-	case reflect.Ptr:
-		if !field.IsNil() {
-			field.Set(reflect.Zero(field.Type()))
-		}
-	case reflect.Struct:
-		if field.IsValid() {
-			field.Set(reflect.Zero(field.Type()))
-		}
-	case reflect.String:
-		if field.String() != "" {
-			field.Set(reflect.ValueOf(maskShort))
-		}
-	case reflect.Map:
-		if field.Len() > 0 {
-			field.Set(reflect.MakeMap(field.Type()))
-		}
-	case reflect.Slice:
-		if field.Len() > 0 {
-			field.Set(reflect.MakeSlice(field.Type(), 0, 0))
-		}
-	case reflect.Interface:
-		if !field.IsNil() {
-			return reset(field.Elem(), "")
-		}
-	default:
-		// Primitive type
-		field.Set(reflect.Zero(field.Type()))
-	}
-	return nil
-}
-
-// isExported return true is a struct field is exported, else false
-func isExported(f reflect.StructField) bool {
-	if f.PkgPath != "" && !f.Anonymous {
-		return false
-	}
-	return true
-}
-
-func marshal(anomConfig interface{}, indent bool) ([]byte, error) {
-	if indent {
-		return json.MarshalIndent(anomConfig, "", " ")
-	}
-	return json.Marshal(anomConfig)
-}

anonymize/anonymize_config_test.go

@@ -1,700 +0,0 @@
-package anonymize
-
-import (
-	"crypto/tls"
-	"os"
-	"testing"
-	"time"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/middlewares"
-	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/kv"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/safe"
-	traefiktls "github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/elazarl/go-bindata-assetfs"
-	"github.com/thoas/stats"
-)
-
-func TestDo_globalConfiguration(t *testing.T) {
-
-	config := &configuration.GlobalConfiguration{}
-
-	config.GraceTimeOut = flaeg.Duration(666 * time.Second)
-	config.Debug = true
-	config.CheckNewVersion = true
-	config.AccessLogsFile = "AccessLogsFile"
-	config.AccessLog = &types.AccessLog{
-		FilePath: "AccessLog FilePath",
-		Format:   "AccessLog Format",
-	}
-	config.TraefikLogsFile = "TraefikLogsFile"
-	config.LogLevel = "LogLevel"
-	config.EntryPoints = configuration.EntryPoints{
-		"foo": {
-			Address: "foo Address",
-			TLS: &traefiktls.TLS{
-				MinVersion:   "foo MinVersion",
-				CipherSuites: []string{"foo CipherSuites 1", "foo CipherSuites 2", "foo CipherSuites 3"},
-				Certificates: traefiktls.Certificates{
-					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
-					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
-				},
-				ClientCA: traefiktls.ClientCA{
-					Files:    traefiktls.FilesOrContents{"foo ClientCAFiles 1", "foo ClientCAFiles 2", "foo ClientCAFiles 3"},
-					Optional: false,
-				},
-			},
-			Redirect: &types.Redirect{
-				Replacement: "foo Replacement",
-				Regex:       "foo Regex",
-				EntryPoint:  "foo EntryPoint",
-			},
-			Auth: &types.Auth{
-				Basic: &types.Basic{
-					UsersFile: "foo Basic UsersFile",
-					Users:     types.Users{"foo Basic Users 1", "foo Basic Users 2", "foo Basic Users 3"},
-				},
-				Digest: &types.Digest{
-					UsersFile: "foo Digest UsersFile",
-					Users:     types.Users{"foo Digest Users 1", "foo Digest Users 2", "foo Digest Users 3"},
-				},
-				Forward: &types.Forward{
-					Address: "foo Address",
-					TLS: &types.ClientTLS{
-						CA:                 "foo CA",
-						Cert:               "foo Cert",
-						Key:                "foo Key",
-						InsecureSkipVerify: true,
-					},
-					TrustForwardHeader: true,
-				},
-			},
-			WhitelistSourceRange: []string{"foo WhitelistSourceRange 1", "foo WhitelistSourceRange 2", "foo WhitelistSourceRange 3"},
-			Compress:             true,
-			ProxyProtocol: &configuration.ProxyProtocol{
-				TrustedIPs: []string{"127.0.0.1/32", "192.168.0.1"},
-			},
-		},
-		"fii": {
-			Address: "fii Address",
-			TLS: &traefiktls.TLS{
-				MinVersion:   "fii MinVersion",
-				CipherSuites: []string{"fii CipherSuites 1", "fii CipherSuites 2", "fii CipherSuites 3"},
-				Certificates: traefiktls.Certificates{
-					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
-					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
-				},
-				ClientCA: traefiktls.ClientCA{
-					Files:    traefiktls.FilesOrContents{"fii ClientCAFiles 1", "fii ClientCAFiles 2", "fii ClientCAFiles 3"},
-					Optional: false,
-				},
-			},
-			Redirect: &types.Redirect{
-				Replacement: "fii Replacement",
-				Regex:       "fii Regex",
-				EntryPoint:  "fii EntryPoint",
-			},
-			Auth: &types.Auth{
-				Basic: &types.Basic{
-					UsersFile: "fii Basic UsersFile",
-					Users:     types.Users{"fii Basic Users 1", "fii Basic Users 2", "fii Basic Users 3"},
-				},
-				Digest: &types.Digest{
-					UsersFile: "fii Digest UsersFile",
-					Users:     types.Users{"fii Digest Users 1", "fii Digest Users 2", "fii Digest Users 3"},
-				},
-				Forward: &types.Forward{
-					Address: "fii Address",
-					TLS: &types.ClientTLS{
-						CA:                 "fii CA",
-						Cert:               "fii Cert",
-						Key:                "fii Key",
-						InsecureSkipVerify: true,
-					},
-					TrustForwardHeader: true,
-				},
-			},
-			WhitelistSourceRange: []string{"fii WhitelistSourceRange 1", "fii WhitelistSourceRange 2", "fii WhitelistSourceRange 3"},
-			Compress:             true,
-			ProxyProtocol: &configuration.ProxyProtocol{
-				TrustedIPs: []string{"127.0.0.1/32", "192.168.0.1"},
-			},
-		},
-	}
-	config.Cluster = &types.Cluster{
-		Node: "Cluster Node",
-		Store: &types.Store{
-			Prefix: "Cluster Store Prefix",
-			// ...
-		},
-	}
-	config.Constraints = types.Constraints{
-		{
-			Key:       "Constraints Key 1",
-			Regex:     "Constraints Regex 2",
-			MustMatch: true,
-		},
-		{
-			Key:       "Constraints Key 1",
-			Regex:     "Constraints Regex 2",
-			MustMatch: true,
-		},
-	}
-	config.ACME = &acme.ACME{
-		Email: "acme Email",
-		Domains: []types.Domain{
-			{
-				Main: "Domains Main",
-				SANs: []string{"Domains acme SANs 1", "Domains acme SANs 2", "Domains acme SANs 3"},
-			},
-		},
-		Storage:           "Storage",
-		StorageFile:       "StorageFile",
-		OnDemand:          true,
-		OnHostRule:        true,
-		CAServer:          "CAServer",
-		EntryPoint:        "EntryPoint",
-		DNSChallenge:      &acmeprovider.DNSChallenge{Provider: "DNSProvider"},
-		DelayDontCheckDNS: 666,
-		ACMELogging:       true,
-		TLSConfig: &tls.Config{
-			InsecureSkipVerify: true,
-			// ...
-		},
-	}
-	config.DefaultEntryPoints = configuration.DefaultEntryPoints{"DefaultEntryPoints 1", "DefaultEntryPoints 2", "DefaultEntryPoints 3"}
-	config.ProvidersThrottleDuration = flaeg.Duration(666 * time.Second)
-	config.MaxIdleConnsPerHost = 666
-	config.IdleTimeout = flaeg.Duration(666 * time.Second)
-	config.InsecureSkipVerify = true
-	config.RootCAs = traefiktls.FilesOrContents{"RootCAs 1", "RootCAs 2", "RootCAs 3"}
-	config.Retry = &configuration.Retry{
-		Attempts: 666,
-	}
-	config.HealthCheck = &configuration.HealthCheckConfig{
-		Interval: flaeg.Duration(666 * time.Second),
-	}
-	config.API = &api.Handler{
-		EntryPoint:            "traefik",
-		Dashboard:             true,
-		Debug:                 true,
-		CurrentConfigurations: &safe.Safe{},
-		Statistics: &types.Statistics{
-			RecentErrors: 666,
-		},
-		Stats: &stats.Stats{
-			Uptime:              time.Now(),
-			Pid:                 666,
-			ResponseCounts:      map[string]int{"foo": 1},
-			TotalResponseCounts: map[string]int{"bar": 1},
-			TotalResponseTime:   time.Now(),
-		},
-		StatsRecorder: &middlewares.StatsRecorder{},
-		DashboardAssets: &assetfs.AssetFS{
-			Asset: func(path string) ([]byte, error) {
-				return nil, nil
-			},
-			AssetDir: func(path string) ([]string, error) {
-				return nil, nil
-			},
-			AssetInfo: func(path string) (os.FileInfo, error) {
-				return nil, nil
-			},
-			Prefix: "fii",
-		},
-	}
-	config.RespondingTimeouts = &configuration.RespondingTimeouts{
-		ReadTimeout:  flaeg.Duration(666 * time.Second),
-		WriteTimeout: flaeg.Duration(666 * time.Second),
-		IdleTimeout:  flaeg.Duration(666 * time.Second),
-	}
-	config.ForwardingTimeouts = &configuration.ForwardingTimeouts{
-		DialTimeout:           flaeg.Duration(666 * time.Second),
-		ResponseHeaderTimeout: flaeg.Duration(666 * time.Second),
-	}
-	config.Docker = &docker.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "docker Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "docker Constraints Key 1",
-					Regex:     "docker Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "docker Constraints Key 1",
-					Regex:     "docker Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint: "docker Endpoint",
-		Domain:   "docker Domain",
-		TLS: &types.ClientTLS{
-			CA:                 "docker CA",
-			Cert:               "docker Cert",
-			Key:                "docker Key",
-			InsecureSkipVerify: true,
-		},
-		ExposedByDefault: true,
-		UseBindPortIP:    true,
-		SwarmMode:        true,
-	}
-	config.File = &file.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "file Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "file Constraints Key 1",
-					Regex:     "file Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "file Constraints Key 1",
-					Regex:     "file Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Directory: "file Directory",
-	}
-	config.Web = &configuration.WebCompatibility{
-		Address:  "web Address",
-		CertFile: "web CertFile",
-		KeyFile:  "web KeyFile",
-		ReadOnly: true,
-		Statistics: &types.Statistics{
-			RecentErrors: 666,
-		},
-		Metrics: &types.Metrics{
-			Prometheus: &types.Prometheus{
-				Buckets: types.Buckets{6.5, 6.6, 6.7},
-			},
-			Datadog: &types.Datadog{
-				Address:      "Datadog Address",
-				PushInterval: "Datadog PushInterval",
-			},
-			StatsD: &types.Statsd{
-				Address:      "StatsD Address",
-				PushInterval: "StatsD PushInterval",
-			},
-		},
-		Path: "web Path",
-		Auth: &types.Auth{
-			Basic: &types.Basic{
-				UsersFile: "web Basic UsersFile",
-				Users:     types.Users{"web Basic Users 1", "web Basic Users 2", "web Basic Users 3"},
-			},
-			Digest: &types.Digest{
-				UsersFile: "web Digest UsersFile",
-				Users:     types.Users{"web Digest Users 1", "web Digest Users 2", "web Digest Users 3"},
-			},
-			Forward: &types.Forward{
-				Address: "web Address",
-				TLS: &types.ClientTLS{
-					CA:                 "web CA",
-					Cert:               "web Cert",
-					Key:                "web Key",
-					InsecureSkipVerify: true,
-				},
-				TrustForwardHeader: true,
-			},
-		},
-		Debug: true,
-	}
-	config.Marathon = &marathon.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "marathon Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "marathon Constraints Key 1",
-					Regex:     "marathon Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "marathon Constraints Key 1",
-					Regex:     "marathon Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint:                "",
-		Domain:                  "",
-		ExposedByDefault:        true,
-		GroupsAsSubDomains:      true,
-		DCOSToken:               "",
-		MarathonLBCompatibility: true,
-		TLS: &types.ClientTLS{
-			CA:                 "marathon CA",
-			Cert:               "marathon Cert",
-			Key:                "marathon Key",
-			InsecureSkipVerify: true,
-		},
-		DialerTimeout:     flaeg.Duration(666 * time.Second),
-		KeepAlive:         flaeg.Duration(666 * time.Second),
-		ForceTaskHostname: true,
-		Basic: &marathon.Basic{
-			HTTPBasicAuthUser: "marathon HTTPBasicAuthUser",
-			HTTPBasicPassword: "marathon HTTPBasicPassword",
-		},
-		RespectReadinessChecks: true,
-	}
-	config.ConsulCatalog = &consulcatalog.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "ConsulCatalog Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "ConsulCatalog Constraints Key 1",
-					Regex:     "ConsulCatalog Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "ConsulCatalog Constraints Key 1",
-					Regex:     "ConsulCatalog Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint:         "ConsulCatalog Endpoint",
-		Domain:           "ConsulCatalog Domain",
-		ExposedByDefault: true,
-		Prefix:           "ConsulCatalog Prefix",
-		FrontEndRule:     "ConsulCatalog FrontEndRule",
-	}
-	config.Kubernetes = &kubernetes.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "k8s Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "k8s Constraints Key 1",
-					Regex:     "k8s Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "k8s Constraints Key 1",
-					Regex:     "k8s Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint:               "k8s Endpoint",
-		Token:                  "k8s Token",
-		CertAuthFilePath:       "k8s CertAuthFilePath",
-		DisablePassHostHeaders: true,
-		Namespaces:             kubernetes.Namespaces{"k8s Namespaces 1", "k8s Namespaces 2", "k8s Namespaces 3"},
-		LabelSelector:          "k8s LabelSelector",
-	}
-	config.Mesos = &mesos.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "mesos Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "mesos Constraints Key 1",
-					Regex:     "mesos Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "mesos Constraints Key 1",
-					Regex:     "mesos Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint:           "mesos Endpoint",
-		Domain:             "mesos Domain",
-		ExposedByDefault:   true,
-		GroupsAsSubDomains: true,
-		ZkDetectionTimeout: 666,
-		RefreshSeconds:     666,
-		IPSources:          "mesos IPSources",
-		StateTimeoutSecond: 666,
-		Masters:            []string{"mesos Masters 1", "mesos Masters 2", "mesos Masters 3"},
-	}
-	config.Eureka = &eureka.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "eureka Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "eureka Constraints Key 1",
-					Regex:     "eureka Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "eureka Constraints Key 1",
-					Regex:     "eureka Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Endpoint:       "eureka Endpoint",
-		Delay:          flaeg.Duration(30 * time.Second),
-		RefreshSeconds: flaeg.Duration(30 * time.Second),
-	}
-	config.ECS = &ecs.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "ecs Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "ecs Constraints Key 1",
-					Regex:     "ecs Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "ecs Constraints Key 1",
-					Regex:     "ecs Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		Domain:               "ecs Domain",
-		ExposedByDefault:     true,
-		RefreshSeconds:       666,
-		Clusters:             ecs.Clusters{"ecs Clusters 1", "ecs Clusters 2", "ecs Clusters 3"},
-		Cluster:              "ecs Cluster",
-		AutoDiscoverClusters: true,
-		Region:               "ecs Region",
-		AccessKeyID:          "ecs AccessKeyID",
-		SecretAccessKey:      "ecs SecretAccessKey",
-	}
-	config.Rancher = &rancher.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "rancher Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "rancher Constraints Key 1",
-					Regex:     "rancher Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "rancher Constraints Key 1",
-					Regex:     "rancher Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		APIConfiguration: rancher.APIConfiguration{
-			Endpoint:  "rancher Endpoint",
-			AccessKey: "rancher AccessKey",
-			SecretKey: "rancher SecretKey",
-		},
-		API: &rancher.APIConfiguration{
-			Endpoint:  "rancher Endpoint",
-			AccessKey: "rancher AccessKey",
-			SecretKey: "rancher SecretKey",
-		},
-		Metadata: &rancher.MetadataConfiguration{
-			IntervalPoll: true,
-			Prefix:       "rancher Metadata Prefix",
-		},
-		Domain:                    "rancher Domain",
-		RefreshSeconds:            666,
-		ExposedByDefault:          true,
-		EnableServiceHealthFilter: true,
-	}
-	config.DynamoDB = &dynamodb.Provider{
-		BaseProvider: provider.BaseProvider{
-			Watch:    true,
-			Filename: "dynamodb Filename",
-			Constraints: types.Constraints{
-				{
-					Key:       "dynamodb Constraints Key 1",
-					Regex:     "dynamodb Constraints Regex 2",
-					MustMatch: true,
-				},
-				{
-					Key:       "dynamodb Constraints Key 1",
-					Regex:     "dynamodb Constraints Regex 2",
-					MustMatch: true,
-				},
-			},
-			Trace:                     true,
-			DebugLogGeneratedTemplate: true,
-		},
-		AccessKeyID:     "dynamodb AccessKeyID",
-		RefreshSeconds:  666,
-		Region:          "dynamodb Region",
-		SecretAccessKey: "dynamodb SecretAccessKey",
-		TableName:       "dynamodb TableName",
-		Endpoint:        "dynamodb Endpoint",
-	}
-	config.Etcd = &etcd.Provider{
-		Provider: kv.Provider{
-			BaseProvider: provider.BaseProvider{
-				Watch:    true,
-				Filename: "etcd Filename",
-				Constraints: types.Constraints{
-					{
-						Key:       "etcd Constraints Key 1",
-						Regex:     "etcd Constraints Regex 2",
-						MustMatch: true,
-					},
-					{
-						Key:       "etcd Constraints Key 1",
-						Regex:     "etcd Constraints Regex 2",
-						MustMatch: true,
-					},
-				},
-				Trace:                     true,
-				DebugLogGeneratedTemplate: true,
-			},
-			Endpoint: "etcd Endpoint",
-			Prefix:   "etcd Prefix",
-			TLS: &types.ClientTLS{
-				CA:                 "etcd CA",
-				Cert:               "etcd Cert",
-				Key:                "etcd Key",
-				InsecureSkipVerify: true,
-			},
-			Username: "etcd Username",
-			Password: "etcd Password",
-		},
-	}
-	config.Zookeeper = &zk.Provider{
-		Provider: kv.Provider{
-			BaseProvider: provider.BaseProvider{
-				Watch:    true,
-				Filename: "zk Filename",
-				Constraints: types.Constraints{
-					{
-						Key:       "zk Constraints Key 1",
-						Regex:     "zk Constraints Regex 2",
-						MustMatch: true,
-					},
-					{
-						Key:       "zk Constraints Key 1",
-						Regex:     "zk Constraints Regex 2",
-						MustMatch: true,
-					},
-				},
-				Trace:                     true,
-				DebugLogGeneratedTemplate: true,
-			},
-			Endpoint: "zk Endpoint",
-			Prefix:   "zk Prefix",
-			TLS: &types.ClientTLS{
-				CA:                 "zk CA",
-				Cert:               "zk Cert",
-				Key:                "zk Key",
-				InsecureSkipVerify: true,
-			},
-			Username: "zk Username",
-			Password: "zk Password",
-		},
-	}
-	config.Boltdb = &boltdb.Provider{
-		Provider: kv.Provider{
-			BaseProvider: provider.BaseProvider{
-				Watch:    true,
-				Filename: "boltdb Filename",
-				Constraints: types.Constraints{
-					{
-						Key:       "boltdb Constraints Key 1",
-						Regex:     "boltdb Constraints Regex 2",
-						MustMatch: true,
-					},
-					{
-						Key:       "boltdb Constraints Key 1",
-						Regex:     "boltdb Constraints Regex 2",
-						MustMatch: true,
-					},
-				},
-				Trace:                     true,
-				DebugLogGeneratedTemplate: true,
-			},
-			Endpoint: "boltdb Endpoint",
-			Prefix:   "boltdb Prefix",
-			TLS: &types.ClientTLS{
-				CA:                 "boltdb CA",
-				Cert:               "boltdb Cert",
-				Key:                "boltdb Key",
-				InsecureSkipVerify: true,
-			},
-			Username: "boltdb Username",
-			Password: "boltdb Password",
-		},
-	}
-	config.Consul = &consul.Provider{
-		Provider: kv.Provider{
-			BaseProvider: provider.BaseProvider{
-				Watch:    true,
-				Filename: "consul Filename",
-				Constraints: types.Constraints{
-					{
-						Key:       "consul Constraints Key 1",
-						Regex:     "consul Constraints Regex 2",
-						MustMatch: true,
-					},
-					{
-						Key:       "consul Constraints Key 1",
-						Regex:     "consul Constraints Regex 2",
-						MustMatch: true,
-					},
-				},
-				Trace:                     true,
-				DebugLogGeneratedTemplate: true,
-			},
-			Endpoint: "consul Endpoint",
-			Prefix:   "consul Prefix",
-			TLS: &types.ClientTLS{
-				CA:                 "consul CA",
-				Cert:               "consul Cert",
-				Key:                "consul Key",
-				InsecureSkipVerify: true,
-			},
-			Username: "consul Username",
-			Password: "consul Password",
-		},
-	}
-
-	cleanJSON, err := Do(config, true)
-	if err != nil {
-		t.Fatal(err, cleanJSON)
-	}
-}

anonymize/anonymize_doOnJSON_test.go

@@ -1,237 +0,0 @@
-package anonymize
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_doOnJSON(t *testing.T) {
-	baseConfiguration := `
-{
- "GraceTimeOut": 10000000000,
- "Debug": false,
- "CheckNewVersion": true,
- "AccessLogsFile": "",
- "TraefikLogsFile": "",
- "LogLevel": "ERROR",
- "EntryPoints": {
-  "http": {
-   "Network": "",
-   "Address": ":80",
-   "TLS": null,
-   "Redirect": {
-    "EntryPoint": "https",
-    "Regex": "",
-    "Replacement": ""
-   },
-   "Auth": null,
-   "Compress": false
-  },
-  "https": {
-   "Address": ":443",
-   "TLS": {
-    "MinVersion": "",
-    "CipherSuites": null,
-    "Certificates": null,
-    "ClientCAFiles": null
-   },
-   "Redirect": null,
-   "Auth": null,
-   "Compress": false
-  }
- },
- "Cluster": null,
- "Constraints": [],
- "ACME": {
-  "Email": "foo@bar.com",
-  "Domains": [
-   {
-    "Main": "foo@bar.com",
-    "SANs": null
-   },
-   {
-    "Main": "foo@bar.com",
-    "SANs": null
-   }
-  ],
-  "Storage": "",
-  "StorageFile": "/acme/acme.json",
-  "OnDemand": true,
-  "OnHostRule": true,
-  "CAServer": "",
-  "EntryPoint": "https",
-  "DNSProvider": "",
-  "DelayDontCheckDNS": 0,
-  "ACMELogging": false,
-  "TLSConfig": null
- },
- "DefaultEntryPoints": [
-  "https",
-  "http"
- ],
- "ProvidersThrottleDuration": 2000000000,
- "MaxIdleConnsPerHost": 200,
- "IdleTimeout": 180000000000,
- "InsecureSkipVerify": false,
- "Retry": null,
- "HealthCheck": {
-  "Interval": 30000000000
- },
- "Docker": null,
- "File": null,
- "Web": null,
- "Marathon": null,
- "Consul": null,
- "ConsulCatalog": null,
- "Etcd": null,
- "Zookeeper": null,
- "Boltdb": null,
- "Kubernetes": null,
- "Mesos": null,
- "Eureka": null,
- "ECS": null,
- "Rancher": null,
- "DynamoDB": null,
- "ConfigFile": "/etc/traefik/traefik.toml"
-}
-`
-	expectedConfiguration := `
-{
- "GraceTimeOut": 10000000000,
- "Debug": false,
- "CheckNewVersion": true,
- "AccessLogsFile": "",
- "TraefikLogsFile": "",
- "LogLevel": "ERROR",
- "EntryPoints": {
-  "http": {
-   "Network": "",
-   "Address": ":80",
-   "TLS": null,
-   "Redirect": {
-    "EntryPoint": "https",
-    "Regex": "",
-    "Replacement": ""
-   },
-   "Auth": null,
-   "Compress": false
-  },
-  "https": {
-   "Address": ":443",
-   "TLS": {
-    "MinVersion": "",
-    "CipherSuites": null,
-    "Certificates": null,
-    "ClientCAFiles": null
-   },
-   "Redirect": null,
-   "Auth": null,
-   "Compress": false
-  }
- },
- "Cluster": null,
- "Constraints": [],
- "ACME": {
-  "Email": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-  "Domains": [
-   {
-    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-    "SANs": null
-   },
-   {
-    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-    "SANs": null
-   }
-  ],
-  "Storage": "",
-  "StorageFile": "/acme/acme.json",
-  "OnDemand": true,
-  "OnHostRule": true,
-  "CAServer": "",
-  "EntryPoint": "https",
-  "DNSProvider": "",
-  "DelayDontCheckDNS": 0,
-  "ACMELogging": false,
-  "TLSConfig": null
- },
- "DefaultEntryPoints": [
-  "https",
-  "http"
- ],
- "ProvidersThrottleDuration": 2000000000,
- "MaxIdleConnsPerHost": 200,
- "IdleTimeout": 180000000000,
- "InsecureSkipVerify": false,
- "Retry": null,
- "HealthCheck": {
-  "Interval": 30000000000
- },
- "Docker": null,
- "File": null,
- "Web": null,
- "Marathon": null,
- "Consul": null,
- "ConsulCatalog": null,
- "Etcd": null,
- "Zookeeper": null,
- "Boltdb": null,
- "Kubernetes": null,
- "Mesos": null,
- "Eureka": null,
- "ECS": null,
- "Rancher": null,
- "DynamoDB": null,
- "ConfigFile": "/etc/traefik/traefik.toml"
-}
-`
-	anomConfiguration := doOnJSON(baseConfiguration)
-
-	if anomConfiguration != expectedConfiguration {
-		t.Errorf("Got %s, want %s.", anomConfiguration, expectedConfiguration)
-	}
-}
-
-func Test_doOnJSON_simple(t *testing.T) {
-	testCases := []struct {
-		name           string
-		input          string
-		expectedOutput string
-	}{
-		{
-			name: "email",
-			input: `{
-				"email1": "goo@example.com",
-				"email2": "foo.bargoo@example.com",
-				"email3": "foo.bargoo@example.com.us"
-			}`,
-			expectedOutput: `{
-				"email1": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-				"email2": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-				"email3": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-			}`,
-		},
-		{
-			name: "url",
-			input: `{
-				"URL": "foo domain.com foo",
-				"URL": "foo sub.domain.com foo",
-				"URL": "foo sub.sub.domain.com foo",
-				"URL": "foo sub.sub.sub.domain.com.us foo"
-			}`,
-			expectedOutput: `{
-				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
-				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
-				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
-				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo"
-			}`,
-		},
-	}
-
-	for _, test := range testCases {
-		t.Run(test.name, func(t *testing.T) {
-			output := doOnJSON(test.input)
-			assert.Equal(t, test.expectedOutput, output)
-		})
-	}
-}

anonymize/anonymize_doOnStruct_test.go

@@ -1,176 +0,0 @@
-package anonymize
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type Courgette struct {
-	Ji string
-	Ho string
-}
-type Tomate struct {
-	Ji string
-	Ho string
-}
-
-type Carotte struct {
-	Name        string
-	Value       int
-	Courgette   Courgette
-	ECourgette  Courgette `export:"true"`
-	Pourgette   *Courgette
-	EPourgette  *Courgette `export:"true"`
-	Aubergine   map[string]string
-	EAubergine  map[string]string `export:"true"`
-	SAubergine  map[string]Tomate
-	ESAubergine map[string]Tomate `export:"true"`
-	PSAubergine map[string]*Tomate
-	EPAubergine map[string]*Tomate `export:"true"`
-}
-
-func Test_doOnStruct(t *testing.T) {
-	testCase := []struct {
-		name     string
-		base     *Carotte
-		expected *Carotte
-		hasError bool
-	}{
-		{
-			name: "primitive",
-			base: &Carotte{
-				Name:  "koko",
-				Value: 666,
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-			},
-		},
-		{
-			name: "struct",
-			base: &Carotte{
-				Name: "koko",
-				Courgette: Courgette{
-					Ji: "huu",
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-			},
-		},
-		{
-			name: "pointer",
-			base: &Carotte{
-				Name: "koko",
-				Pourgette: &Courgette{
-					Ji: "hoo",
-				},
-			},
-			expected: &Carotte{
-				Name:      "xxxx",
-				Pourgette: nil,
-			},
-		},
-		{
-			name: "export struct",
-			base: &Carotte{
-				Name: "koko",
-				ECourgette: Courgette{
-					Ji: "huu",
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-				ECourgette: Courgette{
-					Ji: "xxxx",
-				},
-			},
-		},
-		{
-			name: "export pointer struct",
-			base: &Carotte{
-				Name: "koko",
-				ECourgette: Courgette{
-					Ji: "huu",
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-				ECourgette: Courgette{
-					Ji: "xxxx",
-				},
-			},
-		},
-		{
-			name: "export map string/string",
-			base: &Carotte{
-				Name: "koko",
-				EAubergine: map[string]string{
-					"foo": "bar",
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-				EAubergine: map[string]string{
-					"foo": "bar",
-				},
-			},
-		},
-		{
-			name: "export map string/pointer",
-			base: &Carotte{
-				Name: "koko",
-				EPAubergine: map[string]*Tomate{
-					"foo": {
-						Ji: "fdskljf",
-					},
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-				EPAubergine: map[string]*Tomate{
-					"foo": {
-						Ji: "xxxx",
-					},
-				},
-			},
-		},
-		{
-			name: "export map string/struct (UNSAFE)",
-			base: &Carotte{
-				Name: "koko",
-				ESAubergine: map[string]Tomate{
-					"foo": {
-						Ji: "JiJiJi",
-					},
-				},
-			},
-			expected: &Carotte{
-				Name: "xxxx",
-				ESAubergine: map[string]Tomate{
-					"foo": {
-						Ji: "JiJiJi",
-					},
-				},
-			},
-			hasError: true,
-		},
-	}
-
-	for _, test := range testCase {
-		t.Run(test.name, func(t *testing.T) {
-			val := reflect.ValueOf(test.base).Elem()
-			err := doOnStruct(val)
-			if !test.hasError && err != nil {
-				t.Fatal(err)
-			}
-			if test.hasError && err == nil {
-				t.Fatal("Got no error but want an error.")
-			}
-
-			assert.EqualValues(t, test.expected, test.base)
-		})
-	}
-}

api/dashboard.go

@@ -1,39 +0,0 @@
-package api
-
-import (
-	"net/http"
-
-	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
-	"github.com/elazarl/go-bindata-assetfs"
-)
-
-// DashboardHandler expose dashboard routes
-type DashboardHandler struct {
-	Assets *assetfs.AssetFS
-}
-
-// AddRoutes add dashboard routes on a router
-func (g DashboardHandler) AddRoutes(router *mux.Router) {
-	if g.Assets == nil {
-		log.Error("No assets for dashboard")
-		return
-	}
-
-	// Expose dashboard
-	router.Methods(http.MethodGet).
-		Path("/").
-		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-			http.Redirect(response, request, request.Header.Get("X-Forwarded-Prefix")+"/dashboard/", 302)
-		})
-
-	router.Methods(http.MethodGet).
-		Path("/dashboard/status").
-		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-			http.Redirect(response, request, "/dashboard/", 302)
-		})
-
-	router.Methods(http.MethodGet).
-		PathPrefix("/dashboard/").
-		Handler(http.StripPrefix("/dashboard/", http.FileServer(g.Assets)))
-}

api/debug.go

@@ -1,48 +0,0 @@
-package api
-
-import (
-	"expvar"
-	"fmt"
-	"net/http"
-	"net/http/pprof"
-	"runtime"
-
-	"github.com/containous/mux"
-)
-
-func init() {
-	expvar.Publish("Goroutines", expvar.Func(goroutines))
-}
-
-func goroutines() interface{} {
-	return runtime.NumGoroutine()
-}
-
-// DebugHandler expose debug routes
-type DebugHandler struct{}
-
-// AddRoutes add debug routes on a router
-func (g DebugHandler) AddRoutes(router *mux.Router) {
-	router.Methods(http.MethodGet).Path("/debug/vars").
-		HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			w.Header().Set("Content-Type", "application/json; charset=utf-8")
-			fmt.Fprint(w, "{\n")
-			first := true
-			expvar.Do(func(kv expvar.KeyValue) {
-				if !first {
-					fmt.Fprint(w, ",\n")
-				}
-				first = false
-				fmt.Fprintf(w, "%q: %s", kv.Key, kv.Value)
-			})
-			fmt.Fprint(w, "\n}\n")
-		})
-
-	runtime.SetBlockProfileRate(1)
-	runtime.SetMutexProfileFraction(5)
-	router.Methods(http.MethodGet).PathPrefix("/debug/pprof/cmdline").HandlerFunc(pprof.Cmdline)
-	router.Methods(http.MethodGet).PathPrefix("/debug/pprof/profile").HandlerFunc(pprof.Profile)
-	router.Methods(http.MethodGet).PathPrefix("/debug/pprof/symbol").HandlerFunc(pprof.Symbol)
-	router.Methods(http.MethodGet).PathPrefix("/debug/pprof/trace").HandlerFunc(pprof.Trace)
-	router.Methods(http.MethodGet).PathPrefix("/debug/pprof/").HandlerFunc(pprof.Index)
-}

api/handler.go

@@ -1,252 +0,0 @@
-package api
-
-import (
-	"net/http"
-
-	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/middlewares"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
-	"github.com/elazarl/go-bindata-assetfs"
-	thoas_stats "github.com/thoas/stats"
-	"github.com/unrolled/render"
-)
-
-// Handler expose api routes
-type Handler struct {
-	EntryPoint            string `description:"EntryPoint" export:"true"`
-	Dashboard             bool   `description:"Activate dashboard" export:"true"`
-	Debug                 bool   `export:"true"`
-	CurrentConfigurations *safe.Safe
-	Statistics            *types.Statistics          `description:"Enable more detailed statistics" export:"true"`
-	Stats                 *thoas_stats.Stats         `json:"-"`
-	StatsRecorder         *middlewares.StatsRecorder `json:"-"`
-	DashboardAssets       *assetfs.AssetFS           `json:"-"`
-}
-
-var (
-	templatesRenderer = render.New(render.Options{
-		Directory: "nowhere",
-	})
-)
-
-// AddRoutes add api routes on a router
-func (p Handler) AddRoutes(router *mux.Router) {
-	if p.Debug {
-		DebugHandler{}.AddRoutes(router)
-	}
-
-	router.Methods(http.MethodGet).Path("/api").HandlerFunc(p.getConfigHandler)
-	router.Methods(http.MethodGet).Path("/api/providers").HandlerFunc(p.getConfigHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}").HandlerFunc(p.getProviderHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/backends").HandlerFunc(p.getBackendsHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/backends/{backend}").HandlerFunc(p.getBackendHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/backends/{backend}/servers").HandlerFunc(p.getServersHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/backends/{backend}/servers/{server}").HandlerFunc(p.getServerHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/frontends").HandlerFunc(p.getFrontendsHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/frontends/{frontend}").HandlerFunc(p.getFrontendHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/frontends/{frontend}/routes").HandlerFunc(p.getRoutesHandler)
-	router.Methods(http.MethodGet).Path("/api/providers/{provider}/frontends/{frontend}/routes/{route}").HandlerFunc(p.getRouteHandler)
-
-	// health route
-	router.Methods(http.MethodGet).Path("/health").HandlerFunc(p.getHealthHandler)
-
-	version.Handler{}.AddRoutes(router)
-
-	if p.Dashboard {
-		DashboardHandler{Assets: p.DashboardAssets}.AddRoutes(router)
-	}
-}
-
-func getProviderIDFromVars(vars map[string]string) string {
-	providerID := vars["provider"]
-	// TODO: Deprecated
-	if providerID == "rest" {
-		providerID = "web"
-	}
-	return providerID
-}
-
-func (p Handler) getConfigHandler(response http.ResponseWriter, request *http.Request) {
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	err := templatesRenderer.JSON(response, http.StatusOK, currentConfigurations)
-	if err != nil {
-		log.Error(err)
-	}
-}
-
-func (p Handler) getProviderHandler(response http.ResponseWriter, request *http.Request) {
-	providerID := getProviderIDFromVars(mux.Vars(request))
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		err := templatesRenderer.JSON(response, http.StatusOK, provider)
-		if err != nil {
-			log.Error(err)
-		}
-	} else {
-		http.NotFound(response, request)
-	}
-}
-
-func (p Handler) getBackendsHandler(response http.ResponseWriter, request *http.Request) {
-	providerID := getProviderIDFromVars(mux.Vars(request))
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		err := templatesRenderer.JSON(response, http.StatusOK, provider.Backends)
-		if err != nil {
-			log.Error(err)
-		}
-	} else {
-		http.NotFound(response, request)
-	}
-}
-
-func (p Handler) getBackendHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	backendID := vars["backend"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if backend, ok := provider.Backends[backendID]; ok {
-			err := templatesRenderer.JSON(response, http.StatusOK, backend)
-			if err != nil {
-				log.Error(err)
-			}
-			return
-		}
-	}
-	http.NotFound(response, request)
-}
-
-func (p Handler) getServersHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	backendID := vars["backend"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if backend, ok := provider.Backends[backendID]; ok {
-			err := templatesRenderer.JSON(response, http.StatusOK, backend.Servers)
-			if err != nil {
-				log.Error(err)
-			}
-			return
-		}
-	}
-	http.NotFound(response, request)
-}
-
-func (p Handler) getServerHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	backendID := vars["backend"]
-	serverID := vars["server"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if backend, ok := provider.Backends[backendID]; ok {
-			if server, ok := backend.Servers[serverID]; ok {
-				err := templatesRenderer.JSON(response, http.StatusOK, server)
-				if err != nil {
-					log.Error(err)
-				}
-				return
-			}
-		}
-	}
-	http.NotFound(response, request)
-}
-
-func (p Handler) getFrontendsHandler(response http.ResponseWriter, request *http.Request) {
-	providerID := getProviderIDFromVars(mux.Vars(request))
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		err := templatesRenderer.JSON(response, http.StatusOK, provider.Frontends)
-		if err != nil {
-			log.Error(err)
-		}
-	} else {
-		http.NotFound(response, request)
-	}
-}
-
-func (p Handler) getFrontendHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	frontendID := vars["frontend"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if frontend, ok := provider.Frontends[frontendID]; ok {
-			err := templatesRenderer.JSON(response, http.StatusOK, frontend)
-			if err != nil {
-				log.Error(err)
-			}
-			return
-		}
-	}
-	http.NotFound(response, request)
-}
-
-func (p Handler) getRoutesHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	frontendID := vars["frontend"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if frontend, ok := provider.Frontends[frontendID]; ok {
-			err := templatesRenderer.JSON(response, http.StatusOK, frontend.Routes)
-			if err != nil {
-				log.Error(err)
-			}
-			return
-		}
-	}
-	http.NotFound(response, request)
-}
-
-func (p Handler) getRouteHandler(response http.ResponseWriter, request *http.Request) {
-	vars := mux.Vars(request)
-	providerID := getProviderIDFromVars(vars)
-	frontendID := vars["frontend"]
-	routeID := vars["route"]
-
-	currentConfigurations := p.CurrentConfigurations.Get().(types.Configurations)
-	if provider, ok := currentConfigurations[providerID]; ok {
-		if frontend, ok := provider.Frontends[frontendID]; ok {
-			if route, ok := frontend.Routes[routeID]; ok {
-				err := templatesRenderer.JSON(response, http.StatusOK, route)
-				if err != nil {
-					log.Error(err)
-				}
-				return
-			}
-		}
-	}
-	http.NotFound(response, request)
-}
-
-// healthResponse combines data returned by thoas/stats with statistics (if
-// they are enabled).
-type healthResponse struct {
-	*thoas_stats.Data
-	*middlewares.Stats
-}
-
-func (p *Handler) getHealthHandler(response http.ResponseWriter, request *http.Request) {
-	health := &healthResponse{Data: p.Stats.Data()}
-	if p.StatsRecorder != nil {
-		health.Stats = p.StatsRecorder.Data()
-	}
-	err := templatesRenderer.JSON(response, http.StatusOK, health)
-	if err != nil {
-		log.Error(err)
-	}
-}

build.Dockerfile

@@ -1,27 +0,0 @@
-FROM golang:1.11-alpine
-
-RUN apk --update upgrade \
-&& apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \
-&& rm -rf /var/cache/apk/*
-
-RUN go get github.com/containous/go-bindata/... \
-&& go get golang.org/x/lint/golint \
-&& go get github.com/kisielk/errcheck \
-&& go get github.com/client9/misspell/cmd/misspell
-
-# Which docker version to test on
-ARG DOCKER_VERSION=17.03.2
-ARG DEP_VERSION=0.4.1
-
-# Download dep binary to bin folder in $GOPATH
-RUN mkdir -p /usr/local/bin \
-    && curl -fsSL -o /usr/local/bin/dep https://github.com/golang/dep/releases/download/v${DEP_VERSION}/dep-linux-amd64 \
-    && chmod +x /usr/local/bin/dep
-
-# Download docker
-RUN mkdir -p /usr/local/bin \
-    && curl -fL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}-ce.tgz \
-    | tar -xzC /usr/local/bin --transform 's#^.+/##x'
-
-WORKDIR /go/src/github.com/containous/traefik
-COPY . /go/src/github.com/containous/traefik

cluster/datastore.go

@@ -1,247 +0,0 @@
-package cluster
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/abronan/valkeyrie/store"
-	"github.com/cenk/backoff"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/job"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
-	"github.com/satori/go.uuid"
-)
-
-// Metadata stores Object plus metadata
-type Metadata struct {
-	object Object
-	Object []byte
-	Lock   string
-}
-
-// NewMetadata returns new Metadata
-func NewMetadata(object Object) *Metadata {
-	return &Metadata{object: object}
-}
-
-// Marshall marshalls object
-func (m *Metadata) Marshall() error {
-	var err error
-	m.Object, err = json.Marshal(m.object)
-	return err
-}
-
-func (m *Metadata) unmarshall() error {
-	if len(m.Object) == 0 {
-		return nil
-	}
-	return json.Unmarshal(m.Object, m.object)
-}
-
-// Listener is called when Object has been changed in KV store
-type Listener func(Object) error
-
-var _ Store = (*Datastore)(nil)
-
-// Datastore holds a struct synced in a KV store
-type Datastore struct {
-	kv        staert.KvSource
-	ctx       context.Context
-	localLock *sync.RWMutex
-	meta      *Metadata
-	lockKey   string
-	listener  Listener
-}
-
-// NewDataStore creates a Datastore
-func NewDataStore(ctx context.Context, kvSource staert.KvSource, object Object, listener Listener) (*Datastore, error) {
-	datastore := Datastore{
-		kv:        kvSource,
-		ctx:       ctx,
-		meta:      &Metadata{object: object},
-		lockKey:   kvSource.Prefix + "/lock",
-		localLock: &sync.RWMutex{},
-		listener:  listener,
-	}
-	err := datastore.watchChanges()
-	if err != nil {
-		return nil, err
-	}
-	return &datastore, nil
-}
-
-func (d *Datastore) watchChanges() error {
-	stopCh := make(chan struct{})
-	kvCh, err := d.kv.Watch(d.lockKey, stopCh, nil)
-	if err != nil {
-		return fmt.Errorf("error while watching key %s: %v", d.lockKey, err)
-	}
-	safe.Go(func() {
-		ctx, cancel := context.WithCancel(d.ctx)
-		operation := func() error {
-			for {
-				select {
-				case <-ctx.Done():
-					stopCh <- struct{}{}
-					return nil
-				case _, ok := <-kvCh:
-					if !ok {
-						cancel()
-						return err
-					}
-					err = d.reload()
-					if err != nil {
-						return err
-					}
-					if d.listener != nil {
-						err := d.listener(d.meta.object)
-						if err != nil {
-							log.Errorf("Error calling datastore listener: %s", err)
-						}
-					}
-				}
-			}
-		}
-		notify := func(err error, time time.Duration) {
-			log.Errorf("Error in watch datastore: %+v, retrying in %s", err, time)
-		}
-		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
-		if err != nil {
-			log.Errorf("Error in watch datastore: %v", err)
-		}
-	})
-	return nil
-}
-
-func (d *Datastore) reload() error {
-	log.Debug("Datastore reload")
-	_, err := d.Load()
-	return err
-}
-
-// Begin creates a transaction with the KV store.
-func (d *Datastore) Begin() (Transaction, Object, error) {
-	id := uuid.NewV4().String()
-	log.Debugf("Transaction %s begins", id)
-	remoteLock, err := d.kv.NewLock(d.lockKey, &store.LockOptions{TTL: 20 * time.Second, Value: []byte(id)})
-	if err != nil {
-		return nil, nil, err
-	}
-	stopCh := make(chan struct{})
-	ctx, cancel := context.WithCancel(d.ctx)
-	var errLock error
-	go func() {
-		_, errLock = remoteLock.Lock(stopCh)
-		cancel()
-	}()
-	select {
-	case <-ctx.Done():
-		if errLock != nil {
-			return nil, nil, errLock
-		}
-	case <-d.ctx.Done():
-		stopCh <- struct{}{}
-		return nil, nil, d.ctx.Err()
-	}
-
-	// we got the lock! Now make sure we are synced with KV store
-	operation := func() error {
-		meta := d.get()
-		if meta.Lock != id {
-			return fmt.Errorf("object lock value: expected %s, got %s", id, meta.Lock)
-		}
-		return nil
-	}
-	notify := func(err error, time time.Duration) {
-		log.Errorf("Datastore sync error: %v, retrying in %s", err, time)
-		err = d.reload()
-		if err != nil {
-			log.Errorf("Error reloading: %+v", err)
-		}
-	}
-	ebo := backoff.NewExponentialBackOff()
-	ebo.MaxElapsedTime = 60 * time.Second
-	err = backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
-	if err != nil {
-		return nil, nil, fmt.Errorf("datastore cannot sync: %v", err)
-	}
-
-	// we synced with KV store, we can now return Setter
-	return &datastoreTransaction{
-		Datastore:  d,
-		remoteLock: remoteLock,
-		id:         id,
-	}, d.meta.object, nil
-}
-
-func (d *Datastore) get() *Metadata {
-	d.localLock.RLock()
-	defer d.localLock.RUnlock()
-	return d.meta
-}
-
-// Load load atomically a struct from the KV store
-func (d *Datastore) Load() (Object, error) {
-	d.localLock.Lock()
-	defer d.localLock.Unlock()
-
-	// clear Object first, as mapstructure's decoder doesn't have ZeroFields set to true for merging purposes
-	d.meta.Object = d.meta.Object[:0]
-
-	err := d.kv.LoadConfig(d.meta)
-	if err != nil {
-		return nil, err
-	}
-	err = d.meta.unmarshall()
-	if err != nil {
-		return nil, err
-	}
-	return d.meta.object, nil
-}
-
-// Get atomically a struct from the KV store
-func (d *Datastore) Get() Object {
-	d.localLock.RLock()
-	defer d.localLock.RUnlock()
-	return d.meta.object
-}
-
-var _ Transaction = (*datastoreTransaction)(nil)
-
-type datastoreTransaction struct {
-	*Datastore
-	remoteLock store.Locker
-	dirty      bool
-	id         string
-}
-
-// Commit allows to set an object in the KV store
-func (s *datastoreTransaction) Commit(object Object) error {
-	s.localLock.Lock()
-	defer s.localLock.Unlock()
-	if s.dirty {
-		return fmt.Errorf("transaction already used, please begin a new one")
-	}
-	s.Datastore.meta.object = object
-	err := s.Datastore.meta.Marshall()
-	if err != nil {
-		return fmt.Errorf("marshall error: %s", err)
-	}
-	err = s.kv.StoreConfig(s.Datastore.meta)
-	if err != nil {
-		return fmt.Errorf("StoreConfig error: %s", err)
-	}
-
-	err = s.remoteLock.Unlock()
-	if err != nil {
-		return fmt.Errorf("unlock error: %s", err)
-	}
-
-	s.dirty = true
-	log.Debugf("Transaction committed %s", s.id)
-	return nil
-}

cluster/leadership.go

@@ -1,146 +0,0 @@
-package cluster
-
-import (
-	"context"
-	"net/http"
-	"time"
-
-	"github.com/cenk/backoff"
-	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/docker/leadership"
-	"github.com/unrolled/render"
-)
-
-const clusterLeaderKeySuffix = "/leader"
-
-var templatesRenderer = render.New(render.Options{
-	Directory: "nowhere",
-})
-
-// Leadership allows leadership election using a KV store
-type Leadership struct {
-	*safe.Pool
-	*types.Cluster
-	candidate *leadership.Candidate
-	leader    *safe.Safe
-	listeners []LeaderListener
-}
-
-// NewLeadership creates a leadership
-func NewLeadership(ctx context.Context, cluster *types.Cluster) *Leadership {
-	return &Leadership{
-		Pool:      safe.NewPool(ctx),
-		Cluster:   cluster,
-		candidate: leadership.NewCandidate(cluster.Store, cluster.Store.Prefix+clusterLeaderKeySuffix, cluster.Node, 20*time.Second),
-		listeners: []LeaderListener{},
-		leader:    safe.New(false),
-	}
-}
-
-// LeaderListener is called when leadership has changed
-type LeaderListener func(elected bool) error
-
-// Participate tries to be a leader
-func (l *Leadership) Participate(pool *safe.Pool) {
-	pool.GoCtx(func(ctx context.Context) {
-		log.Debugf("Node %s running for election", l.Cluster.Node)
-		defer log.Debugf("Node %s no more running for election", l.Cluster.Node)
-		backOff := backoff.NewExponentialBackOff()
-		operation := func() error {
-			return l.run(ctx, l.candidate)
-		}
-
-		notify := func(err error, time time.Duration) {
-			log.Errorf("Leadership election error %+v, retrying in %s", err, time)
-		}
-		err := backoff.RetryNotify(safe.OperationWithRecover(operation), backOff, notify)
-		if err != nil {
-			log.Errorf("Cannot elect leadership %+v", err)
-		}
-	})
-}
-
-// AddListener adds a leadership listener
-func (l *Leadership) AddListener(listener LeaderListener) {
-	l.listeners = append(l.listeners, listener)
-}
-
-// Resign resigns from being a leader
-func (l *Leadership) Resign() {
-	l.candidate.Resign()
-	log.Infof("Node %s resigned", l.Cluster.Node)
-}
-
-func (l *Leadership) run(ctx context.Context, candidate *leadership.Candidate) error {
-	electedCh, errCh := candidate.RunForElection()
-	for {
-		select {
-		case elected := <-electedCh:
-			l.onElection(elected)
-		case err := <-errCh:
-			return err
-		case <-ctx.Done():
-			l.candidate.Resign()
-			return nil
-		}
-	}
-}
-
-func (l *Leadership) onElection(elected bool) {
-	if elected {
-		log.Infof("Node %s elected leader ♚", l.Cluster.Node)
-		l.leader.Set(true)
-		l.Start()
-	} else {
-		log.Infof("Node %s elected worker ♝", l.Cluster.Node)
-		l.leader.Set(false)
-		l.Stop()
-	}
-	for _, listener := range l.listeners {
-		err := listener(elected)
-		if err != nil {
-			log.Errorf("Error calling Leadership listener: %s", err)
-		}
-	}
-}
-
-type leaderResponse struct {
-	Leader     bool   `json:"leader"`
-	LeaderNode string `json:"leader_node"`
-}
-
-func (l *Leadership) getLeaderHandler(response http.ResponseWriter, request *http.Request) {
-	leaderNode := ""
-	leaderKv, err := l.Cluster.Store.Get(l.Cluster.Store.Prefix+clusterLeaderKeySuffix, nil)
-	if err != nil {
-		log.Error(err)
-	} else {
-		leaderNode = string(leaderKv.Value)
-	}
-	leader := &leaderResponse{Leader: l.IsLeader(), LeaderNode: leaderNode}
-
-	status := http.StatusOK
-	if !leader.Leader {
-		// Set status to be `429`, as this will typically cause load balancers to stop sending requests to the instance without removing them from rotation.
-		status = http.StatusTooManyRequests
-	}
-
-	err = templatesRenderer.JSON(response, status, leader)
-	if err != nil {
-		log.Error(err)
-	}
-}
-
-// IsLeader returns true if current node is leader
-func (l *Leadership) IsLeader() bool {
-	return l.leader.Get().(bool)
-}
-
-// AddRoutes add dashboard routes on a router
-func (l *Leadership) AddRoutes(router *mux.Router) {
-	// Expose cluster leader
-	router.Methods(http.MethodGet).Path("/api/cluster/leader").HandlerFunc(l.getLeaderHandler)
-}

cluster/store.go

@@ -1,16 +0,0 @@
-package cluster
-
-// Object is the struct to store
-type Object interface{}
-
-// Store is a generic interface to represents a storage
-type Store interface {
-	Load() (Object, error)
-	Get() Object
-	Begin() (Transaction, Object, error)
-}
-
-// Transaction allows to set a struct in the KV store
-type Transaction interface {
-	Commit(object Object) error
-}

cmd/bug/bug.go

@@ -1,171 +0,0 @@
-package bug
-
-import (
-	"bytes"
-	"fmt"
-	"net/url"
-	"os/exec"
-	"runtime"
-	"text/template"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/version"
-)
-
-const (
-	bugTracker  = "https://github.com/containous/traefik/issues/new"
-	bugTemplate = `<!--
-DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
-
-The issue tracker is for reporting bugs and feature requests only.
-For end-user related support questions, refer to one of the following:
-
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
-
--->
-
-### Do you want to request a *feature* or report a *bug*?
-
-(If you intend to ask a support question: **DO NOT FILE AN ISSUE**.
-Use [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik)
-or [Slack](https://slack.traefik.io) instead.)
-
-
-
-### What did you do?
-
-<!--
-
-HOW TO WRITE A GOOD ISSUE?
-
-- Respect the issue template as more as possible.
-- If it's possible use the command ` + "`" + "traefik bug" + "`" + `. See https://www.youtube.com/watch?v=Lyz62L8m93I.
-- The title must be short and descriptive.
-- Explain the conditions which led you to write this issue: the context.
-- The context should lead to something, an idea or a problem that you’re facing.
-- Remain clear and concise.
-- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
-
--->
-
-
-### What did you expect to see?
-
-
-
-### What did you see instead?
-
-
-
-### Output of ` + "`" + `traefik version` + "`" + `: (_What version of Traefik are you using?_)
-
-` + "```" + `
-{{.Version}}
-` + "```" + `
-
-### What is your environment & configuration (arguments, toml, provider, platform, ...)?
-
-` + "```" + `json
-{{.Configuration}}
-` + "```" + `
-
-<!--
-Add more configuration information here.
--->
-
-### If applicable, please paste the log output at DEBUG level (` + "`" + `--logLevel=DEBUG` + "`" + ` switch)
-
-` + "```" + `
-(paste your output here)
-` + "```" + `
-
-`
-)
-
-// NewCmd builds a new Bug command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-
-	// version Command init
-	return &flaeg.Command{
-		Name:                  "bug",
-		Description:           `Report an issue on Traefik bugtracker`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run:                   runCmd(traefikConfiguration),
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
-	}
-}
-
-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-
-		body, err := createReport(traefikConfiguration)
-		if err != nil {
-			return err
-		}
-
-		sendReport(body)
-
-		return nil
-	}
-}
-
-func createReport(traefikConfiguration *cmd.TraefikConfiguration) (string, error) {
-	var versionPrint bytes.Buffer
-	if err := version.GetPrint(&versionPrint); err != nil {
-		return "", err
-	}
-
-	tmpl, err := template.New("bug").Parse(bugTemplate)
-	if err != nil {
-		return "", err
-	}
-
-	config, err := anonymize.Do(traefikConfiguration, true)
-	if err != nil {
-		return "", err
-	}
-
-	v := struct {
-		Version       string
-		Configuration string
-	}{
-		Version:       versionPrint.String(),
-		Configuration: config,
-	}
-
-	var bug bytes.Buffer
-	if err := tmpl.Execute(&bug, v); err != nil {
-		return "", err
-	}
-
-	return bug.String(), nil
-}
-
-func sendReport(body string) {
-	URL := bugTracker + "?body=" + url.QueryEscape(body)
-	if err := openBrowser(URL); err != nil {
-		fmt.Printf("Please file a new issue at %s using this template:\n\n", bugTracker)
-		fmt.Print(body)
-	}
-}
-
-func openBrowser(URL string) error {
-	var err error
-	switch runtime.GOOS {
-	case "linux":
-		err = exec.Command("xdg-open", URL).Start()
-	case "windows":
-		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", URL).Start()
-	case "darwin":
-		err = exec.Command("open", URL).Start()
-	default:
-		err = fmt.Errorf("unsupported platform")
-	}
-	return err
-}

cmd/bug/bug_test.go

@@ -1,67 +0,0 @@
-package bug
-
-import (
-	"testing"
-
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/stretchr/testify/assert"
-)
-
-func Test_createReport(t *testing.T) {
-	traefikConfiguration := &cmd.TraefikConfiguration{
-		ConfigFile: "FOO",
-		GlobalConfiguration: configuration.GlobalConfiguration{
-			EntryPoints: configuration.EntryPoints{
-				"goo": &configuration.EntryPoint{
-					Address: "hoo.bar",
-					Auth: &types.Auth{
-						Basic: &types.Basic{
-							UsersFile: "foo Basic UsersFile",
-							Users:     types.Users{"foo Basic Users 1", "foo Basic Users 2", "foo Basic Users 3"},
-						},
-						Digest: &types.Digest{
-							UsersFile: "foo Digest UsersFile",
-							Users:     types.Users{"foo Digest Users 1", "foo Digest Users 2", "foo Digest Users 3"},
-						},
-					},
-				},
-			},
-			File: &file.Provider{
-				Directory: "BAR",
-			},
-			RootCAs: tls.FilesOrContents{"fllf"},
-		},
-	}
-
-	report, err := createReport(traefikConfiguration)
-	assert.NoError(t, err, report)
-
-	// exported anonymous configuration
-	assert.NotContains(t, "web Basic Users ", report)
-	assert.NotContains(t, "foo Digest Users ", report)
-	assert.NotContains(t, "hoo.bar", report)
-}
-
-func Test_anonymize_traefikConfiguration(t *testing.T) {
-	traefikConfiguration := &cmd.TraefikConfiguration{
-		ConfigFile: "FOO",
-		GlobalConfiguration: configuration.GlobalConfiguration{
-			EntryPoints: configuration.EntryPoints{
-				"goo": &configuration.EntryPoint{
-					Address: "hoo.bar",
-				},
-			},
-			File: &file.Provider{
-				Directory: "BAR",
-			},
-		},
-	}
-	_, err := anonymize.Do(traefikConfiguration, true)
-	assert.NoError(t, err)
-	assert.Equal(t, "hoo.bar", traefikConfiguration.GlobalConfiguration.EntryPoints["goo"].Address)
-}

cmd/configuration.go

@@ -3,340 +3,36 @@ package cmd
 import (
 	"time"
 
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik-extra-service-fabric"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/middlewares/accesslog"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/datadog"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/ping"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/rest"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/types"
-	sf "github.com/jjcollinge/servicefabric"
+	ptypes "github.com/traefik/paerser/types"
+	"github.com/traefik/traefik/v3/pkg/config/static"
 )
 
-// TraefikConfiguration holds GlobalConfiguration and other stuff
-type TraefikConfiguration struct {
-	configuration.GlobalConfiguration `mapstructure:",squash" export:"true"`
-	ConfigFile                        string `short:"c" description:"Configuration file to use (TOML)." export:"true"`
+// TraefikCmdConfiguration wraps the static configuration and extra parameters.
+type TraefikCmdConfiguration struct {
+	static.Configuration `export:"true"`
+
+	// ConfigFile is the path to the configuration file.
+	ConfigFile string `description:"Configuration file to use. If specified all other flags are ignored." export:"true"`
 }
 
-// NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
-func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
-	// default Docker
-	var defaultDocker docker.Provider
-	defaultDocker.Watch = true
-	defaultDocker.ExposedByDefault = true
-	defaultDocker.Endpoint = "unix:///var/run/docker.sock"
-	defaultDocker.SwarmMode = false
-
-	// default File
-	var defaultFile file.Provider
-	defaultFile.Watch = true
-	defaultFile.Filename = "" // needs equivalent to  viper.ConfigFileUsed()
-
-	// default Rest
-	var defaultRest rest.Provider
-	defaultRest.EntryPoint = configuration.DefaultInternalEntryPointName
-
-	// TODO: Deprecated - Web provider, use REST provider instead
-	var defaultWeb configuration.WebCompatibility
-	defaultWeb.Address = ":8080"
-	defaultWeb.Statistics = &types.Statistics{
-		RecentErrors: 10,
-	}
-
-	// TODO: Deprecated - default Metrics
-	defaultWeb.Metrics = &types.Metrics{
-		Prometheus: &types.Prometheus{
-			Buckets:    types.Buckets{0.1, 0.3, 1.2, 5},
-			EntryPoint: configuration.DefaultInternalEntryPointName,
-		},
-		Datadog: &types.Datadog{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		StatsD: &types.Statsd{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		InfluxDB: &types.InfluxDB{
-			Address:      "localhost:8089",
-			Protocol:     "udp",
-			PushInterval: "10s",
-		},
-	}
-
-	// default Marathon
-	var defaultMarathon marathon.Provider
-	defaultMarathon.Watch = true
-	defaultMarathon.Endpoint = "http://127.0.0.1:8080"
-	defaultMarathon.ExposedByDefault = true
-	defaultMarathon.Constraints = types.Constraints{}
-	defaultMarathon.DialerTimeout = flaeg.Duration(5 * time.Second)
-	defaultMarathon.ResponseHeaderTimeout = flaeg.Duration(60 * time.Second)
-	defaultMarathon.TLSHandshakeTimeout = flaeg.Duration(5 * time.Second)
-	defaultMarathon.KeepAlive = flaeg.Duration(10 * time.Second)
-
-	// default Consul
-	var defaultConsul consul.Provider
-	defaultConsul.Watch = true
-	defaultConsul.Endpoint = "127.0.0.1:8500"
-	defaultConsul.Prefix = "traefik"
-	defaultConsul.Constraints = types.Constraints{}
-
-	// default CatalogProvider
-	var defaultConsulCatalog consulcatalog.Provider
-	defaultConsulCatalog.Endpoint = "127.0.0.1:8500"
-	defaultConsulCatalog.ExposedByDefault = true
-	defaultConsulCatalog.Constraints = types.Constraints{}
-	defaultConsulCatalog.Prefix = "traefik"
-	defaultConsulCatalog.FrontEndRule = "Host:{{.ServiceName}}.{{.Domain}}"
-	defaultConsulCatalog.Stale = false
-
-	// default Etcd
-	var defaultEtcd etcd.Provider
-	defaultEtcd.Watch = true
-	defaultEtcd.Endpoint = "127.0.0.1:2379"
-	defaultEtcd.Prefix = "/traefik"
-	defaultEtcd.Constraints = types.Constraints{}
-
-	// default Zookeeper
-	var defaultZookeeper zk.Provider
-	defaultZookeeper.Watch = true
-	defaultZookeeper.Endpoint = "127.0.0.1:2181"
-	defaultZookeeper.Prefix = "traefik"
-	defaultZookeeper.Constraints = types.Constraints{}
-
-	// default Boltdb
-	var defaultBoltDb boltdb.Provider
-	defaultBoltDb.Watch = true
-	defaultBoltDb.Endpoint = "127.0.0.1:4001"
-	defaultBoltDb.Prefix = "/traefik"
-	defaultBoltDb.Constraints = types.Constraints{}
-
-	// default Kubernetes
-	var defaultKubernetes kubernetes.Provider
-	defaultKubernetes.Watch = true
-	defaultKubernetes.Constraints = types.Constraints{}
-
-	// default Mesos
-	var defaultMesos mesos.Provider
-	defaultMesos.Watch = true
-	defaultMesos.Endpoint = "http://127.0.0.1:5050"
-	defaultMesos.ExposedByDefault = true
-	defaultMesos.Constraints = types.Constraints{}
-	defaultMesos.RefreshSeconds = 30
-	defaultMesos.ZkDetectionTimeout = 30
-	defaultMesos.StateTimeoutSecond = 30
-
-	// default ECS
-	var defaultECS ecs.Provider
-	defaultECS.Watch = true
-	defaultECS.ExposedByDefault = true
-	defaultECS.AutoDiscoverClusters = false
-	defaultECS.Clusters = ecs.Clusters{"default"}
-	defaultECS.RefreshSeconds = 15
-	defaultECS.Constraints = types.Constraints{}
-
-	// default Rancher
-	var defaultRancher rancher.Provider
-	defaultRancher.Watch = true
-	defaultRancher.ExposedByDefault = true
-	defaultRancher.RefreshSeconds = 15
-
-	// default DynamoDB
-	var defaultDynamoDB dynamodb.Provider
-	defaultDynamoDB.Constraints = types.Constraints{}
-	defaultDynamoDB.RefreshSeconds = 15
-	defaultDynamoDB.TableName = "traefik"
-	defaultDynamoDB.Watch = true
-
-	// default Eureka
-	var defaultEureka eureka.Provider
-	defaultEureka.RefreshSeconds = flaeg.Duration(30 * time.Second)
-
-	// default ServiceFabric
-	var defaultServiceFabric servicefabric.Provider
-	defaultServiceFabric.APIVersion = sf.DefaultAPIVersion
-	defaultServiceFabric.RefreshSeconds = 10
-
-	// default Ping
-	var defaultPing = ping.Handler{
-		EntryPoint: "traefik",
-	}
-
-	// default TraefikLog
-	defaultTraefikLog := types.TraefikLog{
-		Format:   "common",
-		FilePath: "",
-	}
-
-	// default AccessLog
-	defaultAccessLog := types.AccessLog{
-		Format:   accesslog.CommonFormat,
-		FilePath: "",
-		Filters:  &types.AccessLogFilters{},
-		Fields: &types.AccessLogFields{
-			DefaultMode: types.AccessLogKeep,
-			Headers: &types.FieldHeaders{
-				DefaultMode: types.AccessLogKeep,
+// NewTraefikConfiguration creates a TraefikCmdConfiguration with default values.
+func NewTraefikConfiguration() *TraefikCmdConfiguration {
+	return &TraefikCmdConfiguration{
+		Configuration: static.Configuration{
+			Global: &static.Global{
+				CheckNewVersion: true,
 			},
-		},
-	}
-
-	// default HealthCheckConfig
-	healthCheck := configuration.HealthCheckConfig{
-		Interval: flaeg.Duration(configuration.DefaultHealthCheckInterval),
-	}
-
-	// default RespondingTimeouts
-	respondingTimeouts := configuration.RespondingTimeouts{
-		IdleTimeout: flaeg.Duration(configuration.DefaultIdleTimeout),
-	}
-
-	// default ForwardingTimeouts
-	forwardingTimeouts := configuration.ForwardingTimeouts{
-		DialTimeout: flaeg.Duration(configuration.DefaultDialTimeout),
-	}
-
-	// default Tracing
-	defaultTracing := tracing.Tracing{
-		Backend:       "jaeger",
-		ServiceName:   "traefik",
-		SpanNameLimit: 0,
-		Jaeger: &jaeger.Config{
-			SamplingServerURL:  "http://localhost:5778/sampling",
-			SamplingType:       "const",
-			SamplingParam:      1.0,
-			LocalAgentHostPort: "127.0.0.1:6831",
-		},
-		Zipkin: &zipkin.Config{
-			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-			SameSpan:     false,
-			ID128Bit:     true,
-			Debug:        false,
-		},
-		DataDog: &datadog.Config{
-			LocalAgentHostPort: "localhost:8126",
-			GlobalTag:          "",
-			Debug:              false,
-		},
-	}
-
-	// default LifeCycle
-	defaultLifeCycle := configuration.LifeCycle{
-		GraceTimeOut: flaeg.Duration(configuration.DefaultGraceTimeout),
-	}
-
-	// default ApiConfiguration
-	defaultAPI := api.Handler{
-		EntryPoint: "traefik",
-		Dashboard:  true,
-	}
-	defaultAPI.Statistics = &types.Statistics{
-		RecentErrors: 10,
-	}
-
-	// default Metrics
-	defaultMetrics := types.Metrics{
-		Prometheus: &types.Prometheus{
-			Buckets:    types.Buckets{0.1, 0.3, 1.2, 5},
-			EntryPoint: configuration.DefaultInternalEntryPointName,
-		},
-		Datadog: &types.Datadog{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		StatsD: &types.Statsd{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		InfluxDB: &types.InfluxDB{
-			Address:      "localhost:8089",
-			Protocol:     "udp",
-			PushInterval: "10s",
-		},
-	}
-
-	defaultResolver := configuration.HostResolverConfig{
-		CnameFlattening: false,
-		ResolvConfig:    "/etc/resolv.conf",
-		ResolvDepth:     5,
-	}
-
-	defaultConfiguration := configuration.GlobalConfiguration{
-		Docker:             &defaultDocker,
-		File:               &defaultFile,
-		Web:                &defaultWeb,
-		Rest:               &defaultRest,
-		Marathon:           &defaultMarathon,
-		Consul:             &defaultConsul,
-		ConsulCatalog:      &defaultConsulCatalog,
-		Etcd:               &defaultEtcd,
-		Zookeeper:          &defaultZookeeper,
-		Boltdb:             &defaultBoltDb,
-		Kubernetes:         &defaultKubernetes,
-		Mesos:              &defaultMesos,
-		ECS:                &defaultECS,
-		Rancher:            &defaultRancher,
-		Eureka:             &defaultEureka,
-		DynamoDB:           &defaultDynamoDB,
-		Retry:              &configuration.Retry{},
-		HealthCheck:        &healthCheck,
-		RespondingTimeouts: &respondingTimeouts,
-		ForwardingTimeouts: &forwardingTimeouts,
-		TraefikLog:         &defaultTraefikLog,
-		AccessLog:          &defaultAccessLog,
-		LifeCycle:          &defaultLifeCycle,
-		Ping:               &defaultPing,
-		API:                &defaultAPI,
-		Metrics:            &defaultMetrics,
-		Tracing:            &defaultTracing,
-		HostResolver:       &defaultResolver,
-	}
-
-	return &TraefikConfiguration{
-		GlobalConfiguration: defaultConfiguration,
-	}
-}
-
-// NewTraefikConfiguration creates a TraefikConfiguration with default values
-func NewTraefikConfiguration() *TraefikConfiguration {
-	return &TraefikConfiguration{
-		GlobalConfiguration: configuration.GlobalConfiguration{
-			AccessLogsFile:            "",
-			TraefikLogsFile:           "",
-			EntryPoints:               map[string]*configuration.EntryPoint{},
-			Constraints:               types.Constraints{},
-			DefaultEntryPoints:        []string{"http"},
-			ProvidersThrottleDuration: flaeg.Duration(2 * time.Second),
-			MaxIdleConnsPerHost:       200,
-			IdleTimeout:               flaeg.Duration(0),
-			HealthCheck: &configuration.HealthCheckConfig{
-				Interval: flaeg.Duration(configuration.DefaultHealthCheckInterval),
+			EntryPoints: make(static.EntryPoints),
+			Providers: &static.Providers{
+				ProvidersThrottleDuration: ptypes.Duration(2 * time.Second),
 			},
-			LifeCycle: &configuration.LifeCycle{
-				GraceTimeOut: flaeg.Duration(configuration.DefaultGraceTimeout),
+			ServersTransport: &static.ServersTransport{
+				MaxIdleConnsPerHost: 200,
+			},
+			TCPServersTransport: &static.TCPServersTransport{
+				DialTimeout:   ptypes.Duration(30 * time.Second),
+				DialKeepAlive: ptypes.Duration(15 * time.Second),
 			},
-			CheckNewVersion: true,
 		},
 		ConfigFile: "",
 	}

cmd/context.go

@@ -1,22 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-	"os/signal"
-	"syscall"
-)
-
-// ContextWithSignal create a context cancelled when SIGINT or SIGTERM are notified
-func ContextWithSignal(ctx context.Context) context.Context {
-	newCtx, cancel := context.WithCancel(ctx)
-	signals := make(chan os.Signal)
-	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
-	go func() {
-		select {
-		case <-signals:
-			cancel()
-		}
-	}()
-	return newCtx
-}

cmd/healthcheck/healthcheck.go

@@ -1,41 +1,40 @@
 package healthcheck
 
 import (
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"net/http"
 	"os"
 	"time"
 
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/configuration"
+	"github.com/traefik/paerser/cli"
+	"github.com/traefik/traefik/v3/pkg/config/static"
 )
 
-// NewCmd builds a new HealthCheck command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "healthcheck",
-		Description:           `Calls traefik /ping to check health (web provider must be enabled)`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run:                   runCmd(traefikConfiguration),
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
+// NewCmd builds a new HealthCheck command.
+func NewCmd(traefikConfiguration *static.Configuration, loaders []cli.ResourceLoader) *cli.Command {
+	return &cli.Command{
+		Name:          "healthcheck",
+		Description:   `Calls Traefik /ping endpoint (disabled by default) to check the health of Traefik.`,
+		Configuration: traefikConfiguration,
+		Run:           runCmd(traefikConfiguration),
+		Resources:     loaders,
 	}
 }
 
-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		traefikConfiguration.GlobalConfiguration.SetEffectiveConfiguration(traefikConfiguration.ConfigFile)
+func runCmd(traefikConfiguration *static.Configuration) func(_ []string) error {
+	return func(_ []string) error {
+		traefikConfiguration.SetEffectiveConfiguration()
 
-		resp, errPing := Do(traefikConfiguration.GlobalConfiguration)
+		resp, errPing := Do(*traefikConfiguration)
+		if resp != nil {
+			resp.Body.Close()
+		}
 		if errPing != nil {
 			fmt.Printf("Error calling healthcheck: %s\n", errPing)
 			os.Exit(1)
 		}
+
 		if resp.StatusCode != http.StatusOK {
 			fmt.Printf("Bad healthcheck status: %s\n", resp.Status)
 			os.Exit(1)
@@ -46,28 +45,40 @@ func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
 	}
 }
 
-// Do try to do a healthcheck
-func Do(globalConfiguration configuration.GlobalConfiguration) (*http.Response, error) {
-	if globalConfiguration.Ping == nil {
+// Do try to do a healthcheck.
+func Do(staticConfiguration static.Configuration) (*http.Response, error) {
+	if staticConfiguration.Ping == nil {
 		return nil, errors.New("please enable `ping` to use health check")
 	}
-	pingEntryPoint, ok := globalConfiguration.EntryPoints[globalConfiguration.Ping.EntryPoint]
-	if !ok {
-		return nil, errors.New("missing `ping` entrypoint")
+
+	ep := staticConfiguration.Ping.EntryPoint
+	if ep == "" {
+		ep = "traefik"
 	}
 
-	client := &http.Client{Timeout: 5 * time.Second}
+	pingEntryPoint, ok := staticConfiguration.EntryPoints[ep]
+	if !ok {
+		return nil, fmt.Errorf("ping: missing %s entry point", ep)
+	}
+
+	client := &http.Client{
+		Timeout: 5 * time.Second,
+		Transport: &http.Transport{
+			Proxy: nil,
+		},
+	}
 	protocol := "http"
-	if pingEntryPoint.TLS != nil {
-		protocol = "https"
-		tr := &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
-		}
-		client.Transport = tr
-	}
+
+	// TODO Handle TLS on ping etc...
+	// if pingEntryPoint.TLS != nil {
+	// 	protocol = "https"
+	// 	tr := &http.Transport{
+	// 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	// 	}
+	// 	client.Transport = tr
+	// }
+
 	path := "/"
-	if globalConfiguration.Web != nil {
-		path = globalConfiguration.Web.Path
-	}
-	return client.Head(protocol + "://" + pingEntryPoint.Address + path + "ping")
+
+	return client.Head(protocol + "://" + pingEntryPoint.GetAddress() + path + "ping")
 }

cmd/internal/gen/centrifuge.go

@@ -0,0 +1,332 @@
+package main
+
+import (
+	"bytes"
+	"fmt"
+	"go/format"
+	"go/importer"
+	"go/token"
+	"go/types"
+	"io"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+
+	"golang.org/x/tools/imports"
+)
+
+// File a kind of AST element that represents a file.
+type File struct {
+	Package  string
+	Imports  []string
+	Elements []Element
+}
+
+// Element is a simplified version of a symbol.
+type Element struct {
+	Name  string
+	Value string
+}
+
+// Centrifuge a centrifuge.
+// Generate Go Structures from Go structures.
+type Centrifuge struct {
+	IncludedImports []string
+	ExcludedTypes   []string
+	ExcludedFiles   []string
+
+	TypeCleaner    func(types.Type, string) string
+	PackageCleaner func(string) string
+
+	rootPkg string
+	fileSet *token.FileSet
+	pkg     *types.Package
+}
+
+// NewCentrifuge creates a new Centrifuge.
+func NewCentrifuge(rootPkg string) (*Centrifuge, error) {
+	fileSet := token.NewFileSet()
+
+	pkg, err := importer.ForCompiler(fileSet, "source", nil).Import(rootPkg)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Centrifuge{
+		fileSet: fileSet,
+		pkg:     pkg,
+		rootPkg: rootPkg,
+
+		TypeCleaner: func(typ types.Type, _ string) string {
+			return typ.String()
+		},
+		PackageCleaner: func(s string) string {
+			return s
+		},
+	}, nil
+}
+
+// Run runs the code extraction and the code generation.
+func (c Centrifuge) Run(dest string, pkgName string) error {
+	files := c.run(c.pkg.Scope(), c.rootPkg, pkgName)
+
+	err := fileWriter{baseDir: dest}.Write(files)
+	if err != nil {
+		return err
+	}
+
+	for _, p := range c.pkg.Imports() {
+		if slices.Contains(c.IncludedImports, p.Path()) {
+			fls := c.run(p.Scope(), p.Path(), p.Name())
+
+			err = fileWriter{baseDir: filepath.Join(dest, p.Name())}.Write(fls)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return err
+}
+
+func (c Centrifuge) run(sc *types.Scope, rootPkg string, pkgName string) map[string]*File {
+	files := map[string]*File{}
+
+	for _, name := range sc.Names() {
+		if slices.Contains(c.ExcludedTypes, name) {
+			continue
+		}
+
+		o := sc.Lookup(name)
+		if !o.Exported() {
+			continue
+		}
+
+		filename := filepath.Base(c.fileSet.File(o.Pos()).Name())
+		if slices.Contains(c.ExcludedFiles, path.Join(rootPkg, filename)) {
+			continue
+		}
+
+		fl, ok := files[filename]
+		if !ok {
+			files[filename] = &File{Package: pkgName}
+			fl = files[filename]
+		}
+
+		elt := Element{
+			Name: name,
+		}
+
+		switch ob := o.(type) {
+		case *types.TypeName:
+
+			switch obj := ob.Type().(*types.Named).Underlying().(type) {
+			case *types.Struct:
+				elt.Value = c.writeStruct(name, obj, rootPkg, fl)
+
+			case *types.Map:
+				elt.Value = fmt.Sprintf("type %s map[%s]%s\n", name, obj.Key().String(), c.TypeCleaner(obj.Elem(), rootPkg))
+
+			case *types.Slice:
+				elt.Value = fmt.Sprintf("type %s []%v\n", name, c.TypeCleaner(obj.Elem(), rootPkg))
+
+			case *types.Basic:
+				elt.Value = fmt.Sprintf("type %s %v\n", name, obj.Name())
+
+			default:
+				log.Printf("OTHER TYPE::: %s %T\n", name, o.Type().(*types.Named).Underlying())
+				continue
+			}
+
+		default:
+			log.Printf("OTHER::: %s %T\n", name, o)
+			continue
+		}
+
+		if len(elt.Value) > 0 {
+			fl.Elements = append(fl.Elements, elt)
+		}
+	}
+
+	return files
+}
+
+func (c Centrifuge) writeStruct(name string, obj *types.Struct, rootPkg string, elt *File) string {
+	b := strings.Builder{}
+	fmt.Fprintf(&b, "type %s struct {\n", name)
+
+	for i := range obj.NumFields() {
+		field := obj.Field(i)
+
+		if !field.Exported() {
+			continue
+		}
+
+		fPkg := c.PackageCleaner(extractPackage(field.Type()))
+		if fPkg != "" && fPkg != rootPkg {
+			elt.Imports = append(elt.Imports, fPkg)
+		}
+
+		fType := c.TypeCleaner(field.Type(), rootPkg)
+
+		if field.Embedded() {
+			fmt.Fprintf(&b, "\t%s\n", fType)
+			continue
+		}
+
+		values, ok := lookupTagValue(obj.Tag(i), "json")
+		if len(values) > 0 && values[0] == "-" {
+			continue
+		}
+
+		fmt.Fprintf(&b, "\t%s %s", field.Name(), fType)
+
+		if ok {
+			fmt.Fprintf(&b, " `json:\"%s\"`", strings.Join(values, ","))
+		}
+
+		b.WriteString("\n")
+	}
+
+	b.WriteString("}\n")
+
+	return b.String()
+}
+
+func lookupTagValue(raw, key string) ([]string, bool) {
+	value, ok := reflect.StructTag(raw).Lookup(key)
+	if !ok {
+		return nil, ok
+	}
+
+	values := strings.Split(value, ",")
+
+	if len(values) < 1 {
+		return nil, true
+	}
+
+	return values, true
+}
+
+func extractPackage(t types.Type) string {
+	switch tu := t.(type) {
+	case *types.Named:
+		return tu.Obj().Pkg().Path()
+
+	case *types.Slice:
+		if v, ok := tu.Elem().(*types.Named); ok {
+			return v.Obj().Pkg().Path()
+		}
+		return ""
+
+	case *types.Map:
+		if v, ok := tu.Elem().(*types.Named); ok {
+			return v.Obj().Pkg().Path()
+		}
+		return ""
+
+	case *types.Pointer:
+		return extractPackage(tu.Elem())
+
+	default:
+		return ""
+	}
+}
+
+type fileWriter struct {
+	baseDir string
+}
+
+func (f fileWriter) Write(files map[string]*File) error {
+	err := os.MkdirAll(f.baseDir, 0o755)
+	if err != nil {
+		return err
+	}
+
+	for name, file := range files {
+		err = f.writeFile(name, file)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (f fileWriter) writeFile(name string, desc *File) error {
+	if len(desc.Elements) == 0 {
+		return nil
+	}
+
+	filename := filepath.Join(f.baseDir, name)
+
+	file, err := os.Create(filename)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+
+	defer func() { _ = file.Close() }()
+
+	b := bytes.NewBufferString("package ")
+	b.WriteString(desc.Package)
+	b.WriteString("\n")
+	b.WriteString("// Code generated by centrifuge. DO NOT EDIT.\n")
+
+	b.WriteString("\n")
+	f.writeImports(b, desc.Imports)
+	b.WriteString("\n")
+
+	for _, elt := range desc.Elements {
+		b.WriteString(elt.Value)
+		b.WriteString("\n")
+	}
+
+	// gofmt
+	source, err := format.Source(b.Bytes())
+	if err != nil {
+		log.Println(b.String())
+		return fmt.Errorf("failed to format sources: %w", err)
+	}
+
+	// goimports
+	process, err := imports.Process(filename, source, nil)
+	if err != nil {
+		log.Println(string(source))
+		return fmt.Errorf("failed to format imports: %w", err)
+	}
+
+	_, err = file.Write(process)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (f fileWriter) writeImports(b io.StringWriter, imports []string) {
+	if len(imports) == 0 {
+		return
+	}
+
+	uniq := map[string]struct{}{}
+
+	sort.Strings(imports)
+
+	_, _ = b.WriteString("import (\n")
+	for _, s := range imports {
+		if _, exist := uniq[s]; exist {
+			continue
+		}
+
+		uniq[s] = struct{}{}
+
+		_, _ = b.WriteString(fmt.Sprintf(`	"%s"`+"\n", s))
+	}
+
+	_, _ = b.WriteString(")\n")
+}

cmd/internal/gen/main.go

@@ -0,0 +1,124 @@
+package main
+
+import (
+	"fmt"
+	"go/build"
+	"go/types"
+	"log"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+)
+
+const rootPkg = "github.com/traefik/traefik/v3/pkg/config/dynamic"
+
+const (
+	destModuleName = "github.com/traefik/genconf"
+	destPkg        = "dynamic"
+)
+
+const marsh = `package %s
+
+import "encoding/json"
+
+type JSONPayload struct {
+	*Configuration
+}
+
+func (c JSONPayload) MarshalJSON() ([]byte, error) {
+	if c.Configuration == nil {
+		return nil, nil
+	}
+
+	return json.Marshal(c.Configuration)
+}
+`
+
+// main generate Go Structures from Go structures.
+// Allows to create an external module (destModuleName) used by the plugin's providers
+// that contains Go structs of the dynamic configuration and nothing else.
+// These Go structs do not have any non-exported fields and do not rely on any external dependencies.
+func main() {
+	dest := filepath.Join(path.Join(build.Default.GOPATH, "src"), destModuleName, destPkg)
+
+	log.Println("Output:", dest)
+
+	err := run(dest)
+	if err != nil {
+		log.Fatal(err)
+	}
+}
+
+func run(dest string) error {
+	centrifuge, err := NewCentrifuge(rootPkg)
+	if err != nil {
+		return err
+	}
+
+	centrifuge.IncludedImports = []string{
+		"github.com/traefik/traefik/v3/pkg/tls",
+		"github.com/traefik/traefik/v3/pkg/types",
+	}
+
+	centrifuge.ExcludedTypes = []string{
+		// tls
+		"CertificateStore", "Manager",
+		// dynamic
+		"Message", "Configurations",
+		// types
+		"HTTPCodeRanges", "HostResolverConfig",
+	}
+
+	centrifuge.ExcludedFiles = []string{
+		"github.com/traefik/traefik/v3/pkg/types/logs.go",
+		"github.com/traefik/traefik/v3/pkg/types/metrics.go",
+	}
+
+	centrifuge.TypeCleaner = cleanType
+	centrifuge.PackageCleaner = cleanPackage
+
+	err = centrifuge.Run(dest, destPkg)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filepath.Join(dest, "marshaler.go"), fmt.Appendf(nil, marsh, destPkg), 0o666)
+}
+
+func cleanType(typ types.Type, base string) string {
+	if typ.String() == "github.com/traefik/traefik/v3/pkg/types.FileOrContent" {
+		return "string"
+	}
+
+	if typ.String() == "[]github.com/traefik/traefik/v3/pkg/types.FileOrContent" {
+		return "[]string"
+	}
+
+	if typ.String() == "github.com/traefik/paerser/types.Duration" {
+		return "string"
+	}
+
+	if strings.Contains(typ.String(), base) {
+		return strings.ReplaceAll(typ.String(), base+".", "")
+	}
+
+	if strings.Contains(typ.String(), "github.com/traefik/traefik/v3/pkg/") {
+		return strings.ReplaceAll(typ.String(), "github.com/traefik/traefik/v3/pkg/", "")
+	}
+
+	return typ.String()
+}
+
+func cleanPackage(src string) string {
+	switch src {
+	case "github.com/traefik/paerser/types":
+		return ""
+	case "github.com/traefik/traefik/v3/pkg/tls":
+		return path.Join(destModuleName, destPkg, "tls")
+	case "github.com/traefik/traefik/v3/pkg/types":
+		return path.Join(destModuleName, destPkg, "types")
+	default:
+		return src
+	}
+}

cmd/storeconfig/storeconfig.go

@@ -1,211 +0,0 @@
-package storeconfig
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	stdlog "log"
-	"os"
-
-	"github.com/abronan/valkeyrie/store"
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/log"
-)
-
-// NewCmd builds a new StoreConfig command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "storeconfig",
-		Description:           `Store the static traefik configuration into a Key-value stores. Traefik will not start.`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
-	}
-}
-
-// Run store config in KV
-func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		if kv == nil {
-			return fmt.Errorf("error using command storeconfig, no Key-value store defined")
-		}
-
-		fileConfig := traefikConfiguration.GlobalConfiguration.File
-		if fileConfig != nil {
-			traefikConfiguration.GlobalConfiguration.File = nil
-			if len(fileConfig.Filename) == 0 && len(fileConfig.Directory) == 0 {
-				fileConfig.Filename = traefikConfiguration.ConfigFile
-			}
-		}
-
-		jsonConf, err := json.Marshal(traefikConfiguration.GlobalConfiguration)
-		if err != nil {
-			return err
-		}
-		stdlog.Printf("Storing configuration: %s\n", jsonConf)
-
-		err = kv.StoreConfig(traefikConfiguration.GlobalConfiguration)
-		if err != nil {
-			return err
-		}
-
-		if fileConfig != nil {
-			jsonConf, err = json.Marshal(fileConfig)
-			if err != nil {
-				return err
-			}
-
-			stdlog.Printf("Storing file configuration: %s\n", jsonConf)
-			config, err := fileConfig.BuildConfiguration()
-			if err != nil {
-				return err
-			}
-
-			stdlog.Print("Writing config to KV")
-			err = kv.StoreConfig(config)
-			if err != nil {
-				return err
-			}
-		}
-
-		if traefikConfiguration.GlobalConfiguration.ACME != nil {
-			account := &acme.Account{}
-
-			// Migrate ACME data from file to KV store if needed
-			if len(traefikConfiguration.GlobalConfiguration.ACME.StorageFile) > 0 {
-				account, err = migrateACMEData(traefikConfiguration.GlobalConfiguration.ACME.StorageFile)
-				if err != nil {
-					return err
-				}
-			}
-
-			accountInitialized, err := keyExists(kv, traefikConfiguration.GlobalConfiguration.ACME.Storage)
-			if err != nil && err != store.ErrKeyNotFound {
-				return err
-			}
-
-			// Check to see if ACME account object is already in kv store
-			if traefikConfiguration.GlobalConfiguration.ACME.OverrideCertificates || !accountInitialized {
-
-				// Store the ACME Account into the KV Store
-				// Certificates in KV Store will be overridden
-				meta := cluster.NewMetadata(account)
-				err = meta.Marshall()
-				if err != nil {
-					return err
-				}
-
-				source := staert.KvSource{
-					Store:  kv,
-					Prefix: traefikConfiguration.GlobalConfiguration.ACME.Storage,
-				}
-
-				err = source.StoreConfig(meta)
-				if err != nil {
-					return err
-				}
-			}
-
-			// Force to delete storagefile
-			return kv.Delete(kv.Prefix + "/acme/storagefile")
-		}
-		return nil
-	}
-}
-
-func keyExists(source *staert.KvSource, key string) (bool, error) {
-	list, err := source.List(key, nil)
-	if err != nil {
-		return false, err
-	}
-
-	return len(list) > 0, nil
-}
-
-// migrateACMEData allows migrating data from acme.json file to KV store in function of the file format
-func migrateACMEData(fileName string) (*acme.Account, error) {
-
-	f, err := os.Open(fileName)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	file, err := ioutil.ReadAll(f)
-	if err != nil {
-		return nil, err
-	}
-
-	// Check if the storage file is not empty before to get data
-	account := &acme.Account{}
-	if len(file) > 0 {
-		accountFromNewFormat, err := acme.FromNewToOldFormat(fileName)
-		if err != nil {
-			return nil, err
-		}
-
-		if accountFromNewFormat == nil {
-			// convert ACME json file to KV store (used for backward compatibility)
-			localStore := acme.NewLocalStore(fileName)
-
-			account, err = localStore.Get()
-			if err != nil {
-				return nil, err
-			}
-
-			err = account.RemoveAccountV1Values()
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			account = accountFromNewFormat
-		}
-	} else {
-		log.Warnf("No data will be imported from the storageFile %q because it is empty.", fileName)
-	}
-
-	err = account.Init()
-	return account, err
-}
-
-// CreateKvSource creates KvSource
-// TLS support is enable for Consul and Etcd backends
-func CreateKvSource(traefikConfiguration *cmd.TraefikConfiguration) (*staert.KvSource, error) {
-	var kv *staert.KvSource
-	var kvStore store.Store
-	var err error
-
-	switch {
-	case traefikConfiguration.Consul != nil:
-		kvStore, err = traefikConfiguration.Consul.CreateStore()
-		kv = &staert.KvSource{
-			Store:  kvStore,
-			Prefix: traefikConfiguration.Consul.Prefix,
-		}
-	case traefikConfiguration.Etcd != nil:
-		kvStore, err = traefikConfiguration.Etcd.CreateStore()
-		kv = &staert.KvSource{
-			Store:  kvStore,
-			Prefix: traefikConfiguration.Etcd.Prefix,
-		}
-	case traefikConfiguration.Zookeeper != nil:
-		kvStore, err = traefikConfiguration.Zookeeper.CreateStore()
-		kv = &staert.KvSource{
-			Store:  kvStore,
-			Prefix: traefikConfiguration.Zookeeper.Prefix,
-		}
-	case traefikConfiguration.Boltdb != nil:
-		kvStore, err = traefikConfiguration.Boltdb.CreateStore()
-		kv = &staert.KvSource{
-			Store:  kvStore,
-			Prefix: traefikConfiguration.Boltdb.Prefix,
-		}
-	}
-	return kv, err
-}

cmd/traefik/logger.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	stdlog "log"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/sirupsen/logrus"
+	"github.com/traefik/traefik/v3/pkg/config/static"
+	"github.com/traefik/traefik/v3/pkg/observability/logs"
+	"gopkg.in/natefinch/lumberjack.v2"
+)
+
+func init() {
+	// hide the first logs before the setup of the logger.
+	zerolog.SetGlobalLevel(zerolog.ErrorLevel)
+}
+
+func setupLogger(ctx context.Context, staticConfiguration *static.Configuration) error {
+	// Validate that the experimental flag is set up at this point,
+	// rather than validating the static configuration before the setupLogger call.
+	// This ensures that validation messages are not logged using an un-configured logger.
+	if staticConfiguration.Log != nil && staticConfiguration.Log.OTLP != nil &&
+		(staticConfiguration.Experimental == nil || !staticConfiguration.Experimental.OTLPLogs) {
+		return errors.New("the experimental OTLPLogs feature must be enabled to use OTLP logging")
+	}
+
+	// configure log format
+	w := getLogWriter(staticConfiguration)
+
+	// configure log level
+	logLevel := getLogLevel(staticConfiguration)
+	zerolog.SetGlobalLevel(logLevel)
+
+	// create logger
+	logger := zerolog.New(w).With().Timestamp()
+	if logLevel <= zerolog.DebugLevel {
+		logger = logger.Caller()
+	}
+
+	log.Logger = logger.Logger().Level(logLevel)
+
+	if staticConfiguration.Log != nil && staticConfiguration.Log.OTLP != nil {
+		var err error
+		log.Logger, err = logs.SetupOTelLogger(ctx, log.Logger, staticConfiguration.Log.OTLP)
+		if err != nil {
+			return fmt.Errorf("setting up OpenTelemetry logger: %w", err)
+		}
+	}
+
+	zerolog.DefaultContextLogger = &log.Logger
+
+	// Global logrus replacement (related to lib like go-rancher-metadata, docker, etc.)
+	logrus.StandardLogger().Out = logs.NoLevel(log.Logger, zerolog.DebugLevel)
+
+	// configure default standard log.
+	stdlog.SetFlags(stdlog.Lshortfile | stdlog.LstdFlags)
+	stdlog.SetOutput(logs.NoLevel(log.Logger, zerolog.DebugLevel))
+
+	return nil
+}
+
+func getLogWriter(staticConfiguration *static.Configuration) io.Writer {
+	var w io.Writer = os.Stdout
+	if staticConfiguration.Log != nil && len(staticConfiguration.Log.FilePath) > 0 {
+		_, _ = os.OpenFile(staticConfiguration.Log.FilePath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0o666)
+		w = &lumberjack.Logger{
+			Filename:   staticConfiguration.Log.FilePath,
+			MaxSize:    staticConfiguration.Log.MaxSize,
+			MaxBackups: staticConfiguration.Log.MaxBackups,
+			MaxAge:     staticConfiguration.Log.MaxAge,
+			Compress:   true,
+		}
+	}
+
+	if staticConfiguration.Log == nil || staticConfiguration.Log.Format != "json" {
+		w = zerolog.ConsoleWriter{
+			Out:        w,
+			TimeFormat: time.RFC3339,
+			NoColor:    staticConfiguration.Log != nil && (staticConfiguration.Log.NoColor || len(staticConfiguration.Log.FilePath) > 0),
+		}
+	}
+
+	return w
+}
+
+func getLogLevel(staticConfiguration *static.Configuration) zerolog.Level {
+	levelStr := "error"
+	if staticConfiguration.Log != nil && staticConfiguration.Log.Level != "" {
+		levelStr = strings.ToLower(staticConfiguration.Log.Level)
+	}
+
+	logLevel, err := zerolog.ParseLevel(strings.ToLower(levelStr))
+	if err != nil {
+		log.Error().Err(err).
+			Str("logLevel", levelStr).
+			Msg("Unspecified or invalid log level, setting the level to default (ERROR)...")
+
+		logLevel = zerolog.ErrorLevel
+	}
+
+	return logLevel
+}

cmd/traefik/plugins.go

@@ -0,0 +1,102 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"path/filepath"
+	"time"
+
+	"github.com/hashicorp/go-retryablehttp"
+	"github.com/rs/zerolog/log"
+	"github.com/traefik/traefik/v3/pkg/config/static"
+	"github.com/traefik/traefik/v3/pkg/observability/logs"
+	"github.com/traefik/traefik/v3/pkg/plugins"
+)
+
+const outputDir = "./plugins-storage/"
+
+func createPluginBuilder(staticConfiguration *static.Configuration) (*plugins.Builder, error) {
+	manager, plgs, localPlgs, err := initPlugins(staticConfiguration)
+	if err != nil {
+		return nil, err
+	}
+
+	return plugins.NewBuilder(manager, plgs, localPlgs)
+}
+
+func initPlugins(staticCfg *static.Configuration) (*plugins.Manager, map[string]plugins.Descriptor, map[string]plugins.LocalDescriptor, error) {
+	err := checkUniquePluginNames(staticCfg.Experimental)
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	var manager *plugins.Manager
+	plgs := map[string]plugins.Descriptor{}
+
+	if hasPlugins(staticCfg) {
+		httpClient := retryablehttp.NewClient()
+		httpClient.Logger = logs.NewRetryableHTTPLogger(log.Logger)
+		httpClient.HTTPClient = &http.Client{Timeout: 10 * time.Second}
+		httpClient.RetryMax = 3
+
+		// Create separate downloader for HTTP operations
+		archivesPath := filepath.Join(outputDir, "archives")
+		downloader, err := plugins.NewRegistryDownloader(plugins.RegistryDownloaderOptions{
+			HTTPClient:   httpClient.HTTPClient,
+			ArchivesPath: archivesPath,
+		})
+		if err != nil {
+			return nil, nil, nil, fmt.Errorf("unable to create plugin downloader: %w", err)
+		}
+
+		opts := plugins.ManagerOptions{
+			Output: outputDir,
+		}
+		manager, err = plugins.NewManager(downloader, opts)
+		if err != nil {
+			return nil, nil, nil, fmt.Errorf("unable to create plugins manager: %w", err)
+		}
+
+		err = plugins.SetupRemotePlugins(manager, staticCfg.Experimental.Plugins)
+		if err != nil {
+			return nil, nil, nil, fmt.Errorf("unable to set up plugins environment: %w", err)
+		}
+
+		plgs = staticCfg.Experimental.Plugins
+	}
+
+	localPlgs := map[string]plugins.LocalDescriptor{}
+
+	if hasLocalPlugins(staticCfg) {
+		err := plugins.SetupLocalPlugins(staticCfg.Experimental.LocalPlugins)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+
+		localPlgs = staticCfg.Experimental.LocalPlugins
+	}
+
+	return manager, plgs, localPlgs, nil
+}
+
+func checkUniquePluginNames(e *static.Experimental) error {
+	if e == nil {
+		return nil
+	}
+
+	for s := range e.LocalPlugins {
+		if _, ok := e.Plugins[s]; ok {
+			return fmt.Errorf("the plugin's name %q must be unique", s)
+		}
+	}
+
+	return nil
+}
+
+func hasPlugins(staticCfg *static.Configuration) bool {
+	return staticCfg.Experimental != nil && len(staticCfg.Experimental.Plugins) > 0
+}
+
+func hasLocalPlugins(staticCfg *static.Configuration) bool {
+	return staticCfg.Experimental != nil && len(staticCfg.Experimental.LocalPlugins) > 0
+}

cmd/traefik/traefik.go

@@ -2,374 +2,670 @@ package main
 
 import (
 	"context"
-	"encoding/json"
-	fmtlog "log"
+	"crypto/x509"
+	"fmt"
+	"io"
+	stdlog "log"
+	"maps"
 	"net/http"
 	"os"
-	"path/filepath"
-	"reflect"
+	"os/signal"
+	"slices"
 	"strings"
+	"syscall"
 	"time"
 
-	"github.com/cenk/backoff"
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/autogen/genstatic"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/bug"
-	"github.com/containous/traefik/cmd/healthcheck"
-	"github.com/containous/traefik/cmd/storeconfig"
-	cmdVersion "github.com/containous/traefik/cmd/version"
-	"github.com/containous/traefik/collector"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/configuration/router"
-	"github.com/containous/traefik/job"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/server"
-	"github.com/containous/traefik/server/uuid"
-	traefiktls "github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
-	"github.com/coreos/go-systemd/daemon"
-	"github.com/elazarl/go-bindata-assetfs"
-	"github.com/ogier/pflag"
+	"github.com/coreos/go-systemd/v22/daemon"
+	"github.com/go-acme/lego/v4/challenge"
+	gokitmetrics "github.com/go-kit/kit/metrics"
+	"github.com/rs/zerolog/log"
 	"github.com/sirupsen/logrus"
-	"github.com/vulcand/oxy/roundrobin"
+	"github.com/spiffe/go-spiffe/v2/workloadapi"
+	"github.com/traefik/paerser/cli"
+	"github.com/traefik/traefik/v3/cmd"
+	"github.com/traefik/traefik/v3/cmd/healthcheck"
+	cmdVersion "github.com/traefik/traefik/v3/cmd/version"
+	tcli "github.com/traefik/traefik/v3/pkg/cli"
+	"github.com/traefik/traefik/v3/pkg/collector"
+	"github.com/traefik/traefik/v3/pkg/config/dynamic"
+	"github.com/traefik/traefik/v3/pkg/config/runtime"
+	"github.com/traefik/traefik/v3/pkg/config/static"
+	"github.com/traefik/traefik/v3/pkg/middlewares/accesslog"
+	"github.com/traefik/traefik/v3/pkg/observability/logs"
+	"github.com/traefik/traefik/v3/pkg/observability/metrics"
+	"github.com/traefik/traefik/v3/pkg/observability/tracing"
+	otypes "github.com/traefik/traefik/v3/pkg/observability/types"
+	"github.com/traefik/traefik/v3/pkg/provider/acme"
+	"github.com/traefik/traefik/v3/pkg/provider/aggregator"
+	"github.com/traefik/traefik/v3/pkg/provider/tailscale"
+	"github.com/traefik/traefik/v3/pkg/provider/traefik"
+	"github.com/traefik/traefik/v3/pkg/proxy"
+	"github.com/traefik/traefik/v3/pkg/proxy/httputil"
+	"github.com/traefik/traefik/v3/pkg/redactor"
+	"github.com/traefik/traefik/v3/pkg/safe"
+	"github.com/traefik/traefik/v3/pkg/server"
+	"github.com/traefik/traefik/v3/pkg/server/middleware"
+	"github.com/traefik/traefik/v3/pkg/server/service"
+	"github.com/traefik/traefik/v3/pkg/tcp"
+	traefiktls "github.com/traefik/traefik/v3/pkg/tls"
+	"github.com/traefik/traefik/v3/pkg/version"
 )
 
 func main() {
 	// traefik config inits
-	traefikConfiguration := cmd.NewTraefikConfiguration()
-	traefikPointersConfiguration := cmd.NewTraefikDefaultPointersConfiguration()
+	tConfig := cmd.NewTraefikConfiguration()
 
-	// traefik Command init
-	traefikCmd := &flaeg.Command{
+	loaders := []cli.ResourceLoader{&tcli.DeprecationLoader{}, &tcli.FileLoader{}, &tcli.FlagLoader{}, &tcli.EnvLoader{}}
+
+	cmdTraefik := &cli.Command{
 		Name: "traefik",
-		Description: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
+		Description: `Traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
 Complete documentation is available at https://traefik.io`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: func() error {
-			runCmd(&traefikConfiguration.GlobalConfiguration, traefikConfiguration.ConfigFile)
-			return nil
+		Configuration: tConfig,
+		Resources:     loaders,
+		Run: func(_ []string) error {
+			return runCmd(&tConfig.Configuration)
 		},
 	}
 
-	// storeconfig Command init
-	storeConfigCmd := storeconfig.NewCmd(traefikConfiguration, traefikPointersConfiguration)
-
-	// init flaeg source
-	f := flaeg.New(traefikCmd, os.Args[1:])
-	// add custom parsers
-	f.AddParser(reflect.TypeOf(configuration.EntryPoints{}), &configuration.EntryPoints{})
-	f.AddParser(reflect.TypeOf(configuration.DefaultEntryPoints{}), &configuration.DefaultEntryPoints{})
-	f.AddParser(reflect.TypeOf(traefiktls.FilesOrContents{}), &traefiktls.FilesOrContents{})
-	f.AddParser(reflect.TypeOf(types.Constraints{}), &types.Constraints{})
-	f.AddParser(reflect.TypeOf(kubernetes.Namespaces{}), &kubernetes.Namespaces{})
-	f.AddParser(reflect.TypeOf(ecs.Clusters{}), &ecs.Clusters{})
-	f.AddParser(reflect.TypeOf([]types.Domain{}), &types.Domains{})
-	f.AddParser(reflect.TypeOf(types.DNSResolvers{}), &types.DNSResolvers{})
-	f.AddParser(reflect.TypeOf(types.Buckets{}), &types.Buckets{})
-	f.AddParser(reflect.TypeOf(types.StatusCodes{}), &types.StatusCodes{})
-	f.AddParser(reflect.TypeOf(types.FieldNames{}), &types.FieldNames{})
-	f.AddParser(reflect.TypeOf(types.FieldHeaderNames{}), &types.FieldHeaderNames{})
-
-	// add commands
-	f.AddCommand(cmdVersion.NewCmd())
-	f.AddCommand(bug.NewCmd(traefikConfiguration, traefikPointersConfiguration))
-	f.AddCommand(storeConfigCmd)
-	f.AddCommand(healthcheck.NewCmd(traefikConfiguration, traefikPointersConfiguration))
-
-	usedCmd, err := f.GetCommand()
+	err := cmdTraefik.AddCommand(healthcheck.NewCmd(&tConfig.Configuration, loaders))
 	if err != nil {
-		fmtlog.Println(err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}
 
-	if _, err := f.Parse(usedCmd); err != nil {
-		if err == pflag.ErrHelp {
-			os.Exit(0)
-		}
-		fmtlog.Printf("Error parsing command: %s\n", err)
-		os.Exit(1)
-	}
-
-	// staert init
-	s := staert.NewStaert(traefikCmd)
-	// init TOML source
-	toml := staert.NewTomlSource("traefik", []string{traefikConfiguration.ConfigFile, "/etc/traefik/", "$HOME/.traefik/", "."})
-
-	// add sources to staert
-	s.AddSource(toml)
-	s.AddSource(f)
-	if _, err := s.LoadConfig(); err != nil {
-		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
-		os.Exit(1)
-	}
-
-	traefikConfiguration.ConfigFile = toml.ConfigFileUsed()
-
-	kv, err := storeconfig.CreateKvSource(traefikConfiguration)
+	err = cmdTraefik.AddCommand(cmdVersion.NewCmd())
 	if err != nil {
-		fmtlog.Printf("Error creating kv store: %s\n", err)
-		os.Exit(1)
-	}
-	storeConfigCmd.Run = storeconfig.Run(kv, traefikConfiguration)
-
-	// if a KV Store is enable and no sub-command called in args
-	if kv != nil && usedCmd == traefikCmd {
-		if traefikConfiguration.Cluster == nil {
-			traefikConfiguration.Cluster = &types.Cluster{Node: uuid.Get()}
-		}
-		if traefikConfiguration.Cluster.Store == nil {
-			traefikConfiguration.Cluster.Store = &types.Store{Prefix: kv.Prefix, Store: kv.Store}
-		}
-		s.AddSource(kv)
-		operation := func() error {
-			_, err := s.LoadConfig()
-			return err
-		}
-		notify := func(err error, time time.Duration) {
-			log.Errorf("Load config error: %+v, retrying in %s", err, time)
-		}
-		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
-		if err != nil {
-			fmtlog.Printf("Error loading configuration: %s\n", err)
-			os.Exit(1)
-		}
-	}
-
-	if err := s.Run(); err != nil {
-		fmtlog.Printf("Error running traefik: %s\n", err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}
 
-	os.Exit(0)
+	err = cli.Execute(cmdTraefik)
+	if err != nil {
+		log.Error().Err(err).Msg("Command error")
+		logrus.Exit(1)
+	}
+
+	logrus.Exit(0)
 }
 
-func runCmd(globalConfiguration *configuration.GlobalConfiguration, configFile string) {
-	configureLogging(globalConfiguration)
+func runCmd(staticConfiguration *static.Configuration) error {
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer cancel()
 
-	if len(configFile) > 0 {
-		log.Infof("Using TOML configuration file %s", configFile)
+	if err := setupLogger(ctx, staticConfiguration); err != nil {
+		return fmt.Errorf("setting up logger: %w", err)
 	}
 
+	log.Warn().Msg("Traefik can reject some encoded characters in the request path." +
+		"When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986)," +
+		"it is recommended to set these options to `false` to avoid split-view situation." +
+		"Refer to the documentation for more details: https://doc.traefik.io/traefik/v3.7/migrate/v3/#encoded-characters-configuration-default-values")
+
 	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment
 
-	if globalConfiguration.AllowMinWeightZero {
-		roundrobin.SetDefaultWeight(0)
+	staticConfiguration.SetEffectiveConfiguration()
+	if err := staticConfiguration.ValidateConfiguration(); err != nil {
+		return err
 	}
 
-	globalConfiguration.SetEffectiveConfiguration(configFile)
-	globalConfiguration.ValidateConfiguration()
+	log.Info().Str("version", version.Version).
+		Msgf("Traefik version %s built on %s", version.Version, version.BuildDate)
 
-	log.Infof("Traefik version %s built on %s", version.Version, version.BuildDate)
-
-	jsonConf, err := json.Marshal(globalConfiguration)
+	redactedStaticConfiguration, err := redactor.RemoveCredentials(staticConfiguration)
 	if err != nil {
-		log.Error(err)
-		log.Debugf("Global configuration loaded [struct] %#v", globalConfiguration)
+		log.Error().Err(err).Msg("Could not redact static configuration")
 	} else {
-		log.Debugf("Global configuration loaded %s", string(jsonConf))
+		log.Debug().RawJSON("staticConfiguration", []byte(redactedStaticConfiguration)).Msg("Static configuration loaded [json]")
 	}
 
-	if globalConfiguration.API != nil && globalConfiguration.API.Dashboard {
-		globalConfiguration.API.DashboardAssets = &assetfs.AssetFS{Asset: genstatic.Asset, AssetInfo: genstatic.AssetInfo, AssetDir: genstatic.AssetDir, Prefix: "static"}
-	}
+	checkNewVersion(staticConfiguration)
 
-	if globalConfiguration.CheckNewVersion {
-		checkNewVersion()
-	}
+	stats(staticConfiguration)
 
-	stats(globalConfiguration)
-
-	providerAggregator := configuration.NewProviderAggregator(globalConfiguration)
-
-	acmeprovider, err := globalConfiguration.InitACMEProvider()
+	svr, err := setupServer(staticConfiguration)
 	if err != nil {
-		log.Errorf("Unable to initialize ACME provider: %v", err)
-	} else if acmeprovider != nil {
-		err = providerAggregator.AddProvider(acmeprovider)
-		if err != nil {
-			log.Errorf("Unable to add ACME provider to the providers list: %v", err)
-			acmeprovider = nil
-		}
+		return err
 	}
 
-	entryPoints := map[string]server.EntryPoint{}
-	for entryPointName, config := range globalConfiguration.EntryPoints {
-
-		entryPoint := server.EntryPoint{
-			Configuration: config,
-		}
-
-		internalRouter := router.NewInternalRouterAggregator(*globalConfiguration, entryPointName)
-		if acmeprovider != nil {
-			if acmeprovider.HTTPChallenge != nil && entryPointName == acmeprovider.HTTPChallenge.EntryPoint {
-				internalRouter.AddRouter(acmeprovider)
-			}
-
-			// TLS ALPN 01
-			if acmeprovider.TLSChallenge != nil && acmeprovider.HTTPChallenge == nil && acmeprovider.DNSChallenge == nil {
-				entryPoint.TLSALPNGetter = acmeprovider.GetTLSALPNCertificate
-			}
-
-			if acmeprovider.OnDemand && entryPointName == acmeprovider.EntryPoint {
-				entryPoint.OnDemandListener = acmeprovider.ListenRequest
-			}
-
-			if entryPointName == acmeprovider.EntryPoint {
-				entryPoint.CertificateStore = traefiktls.NewCertificateStore()
-				acmeprovider.SetCertificateStore(entryPoint.CertificateStore)
-				log.Debugf("Setting Acme Certificate store from Entrypoint: %s", entryPointName)
-			}
-		}
-
-		entryPoint.InternalRouter = internalRouter
-		entryPoints[entryPointName] = entryPoint
+	if staticConfiguration.Ping != nil {
+		staticConfiguration.Ping.WithContext(ctx)
 	}
 
-	svr := server.NewServer(*globalConfiguration, providerAggregator, entryPoints)
-	if acmeprovider != nil && acmeprovider.OnHostRule {
-		acmeprovider.SetConfigListenerChan(make(chan types.Configuration))
-		svr.AddListener(acmeprovider.ListenConfiguration)
-	}
-	ctx := cmd.ContextWithSignal(context.Background())
-
-	if globalConfiguration.Ping != nil {
-		globalConfiguration.Ping.WithContext(ctx)
-	}
-
-	svr.StartWithContext(ctx)
+	svr.Start(ctx)
 	defer svr.Close()
 
 	sent, err := daemon.SdNotify(false, "READY=1")
 	if !sent && err != nil {
-		log.Error("Fail to notify", err)
+		log.Error().Err(err).Msg("Failed to notify")
 	}
 
 	t, err := daemon.SdWatchdogEnabled(false)
 	if err != nil {
-		log.Error("Problem with watchdog", err)
+		log.Error().Err(err).Msg("Could not enable Watchdog")
 	} else if t != 0 {
 		// Send a ping each half time given
-		t = t / 2
-		log.Info("Watchdog activated with timer each ", t)
+		t /= 2
+		log.Info().Msgf("Watchdog activated with timer duration %s", t)
 		safe.Go(func() {
 			tick := time.Tick(t)
 			for range tick {
-				_, errHealthCheck := healthcheck.Do(*globalConfiguration)
-				if globalConfiguration.Ping == nil || errHealthCheck == nil {
+				resp, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				if resp != nil {
+					_ = resp.Body.Close()
+				}
+
+				if staticConfiguration.Ping == nil || errHealthCheck == nil {
 					if ok, _ := daemon.SdNotify(false, "WATCHDOG=1"); !ok {
-						log.Error("Fail to tick watchdog")
+						log.Error().Msg("Fail to tick watchdog")
 					}
 				} else {
-					log.Error(errHealthCheck)
+					log.Error().Err(errHealthCheck).Send()
 				}
 			}
 		})
 	}
 
 	svr.Wait()
-	log.Info("Shutting down")
-	logrus.Exit(0)
+	log.Info().Msg("Shutting down")
+	return nil
 }
 
-func configureLogging(globalConfiguration *configuration.GlobalConfiguration) {
-	// configure default log flags
-	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
+func setupServer(staticConfiguration *static.Configuration) (*server.Server, error) {
+	providerAggregator := aggregator.NewProviderAggregator(*staticConfiguration.Providers)
 
-	// configure log level
-	// an explicitly defined log level always has precedence. if none is
-	// given and debug mode is disabled, the default is ERROR, and DEBUG
-	// otherwise.
-	levelStr := strings.ToLower(globalConfiguration.LogLevel)
-	if levelStr == "" {
-		levelStr = "error"
-		if globalConfiguration.Debug {
-			levelStr = "debug"
-		}
-	}
-	level, err := logrus.ParseLevel(levelStr)
+	ctx := context.Background()
+	routinesPool := safe.NewPool(ctx)
+
+	// adds internal provider
+	err := providerAggregator.AddProvider(traefik.New(*staticConfiguration))
 	if err != nil {
-		log.Error("Error getting level", err)
-	}
-	log.SetLevel(level)
-
-	// configure log output file
-	logFile := globalConfiguration.TraefikLogsFile
-	if len(logFile) > 0 {
-		log.Warn("top-level traefikLogsFile has been deprecated -- please use traefiklog.filepath")
-	}
-	if globalConfiguration.TraefikLog != nil && len(globalConfiguration.TraefikLog.FilePath) > 0 {
-		logFile = globalConfiguration.TraefikLog.FilePath
+		return nil, err
 	}
 
-	// configure log format
-	var formatter logrus.Formatter
-	if globalConfiguration.TraefikLog != nil && globalConfiguration.TraefikLog.Format == "json" {
-		formatter = &logrus.JSONFormatter{}
-	} else {
-		disableColors := len(logFile) > 0
-		formatter = &logrus.TextFormatter{DisableColors: disableColors, FullTimestamp: true, DisableSorting: true}
+	// ACME
+
+	tlsManager := traefiktls.NewManager(staticConfiguration.OCSP)
+	routinesPool.GoCtx(tlsManager.Run)
+
+	httpChallengeProvider := acme.NewChallengeHTTP()
+
+	tlsChallengeProvider := acme.NewChallengeTLSALPN()
+	err = providerAggregator.AddProvider(tlsChallengeProvider)
+	if err != nil {
+		return nil, err
 	}
-	log.SetFormatter(formatter)
 
-	if len(logFile) > 0 {
-		dir := filepath.Dir(logFile)
+	acmeProviders := initACMEProvider(staticConfiguration, providerAggregator, tlsManager, httpChallengeProvider, tlsChallengeProvider, routinesPool)
 
-		if err := os.MkdirAll(dir, 0755); err != nil {
-			log.Errorf("Failed to create log path %s: %s", dir, err)
+	// Tailscale
+
+	tsProviders := initTailscaleProviders(staticConfiguration, providerAggregator)
+
+	// Observability
+
+	metricRegistries := registerMetricClients(staticConfiguration.Metrics)
+	var semConvMetricRegistry *metrics.SemConvMetricsRegistry
+	if staticConfiguration.Metrics != nil && staticConfiguration.Metrics.OTLP != nil {
+		semConvMetricRegistry, err = metrics.NewSemConvMetricRegistry(ctx, staticConfiguration.Metrics.OTLP)
+		if err != nil {
+			return nil, fmt.Errorf("unable to create SemConv metric registry: %w", err)
+		}
+	}
+	metricsRegistry := metrics.NewMultiRegistry(metricRegistries)
+	accessLog := setupAccessLog(ctx, staticConfiguration.AccessLog)
+	tracer, tracerCloser := setupTracing(ctx, staticConfiguration.Tracing)
+	observabilityMgr := middleware.NewObservabilityMgr(*staticConfiguration, metricsRegistry, semConvMetricRegistry, accessLog, tracer, tracerCloser)
+
+	// Entrypoints
+
+	serverEntryPointsTCP, err := server.NewTCPEntryPoints(staticConfiguration.EntryPoints, staticConfiguration.HostResolver, metricsRegistry)
+	if err != nil {
+		return nil, err
+	}
+
+	serverEntryPointsUDP, err := server.NewUDPEntryPoints(staticConfiguration.EntryPoints)
+	if err != nil {
+		return nil, err
+	}
+
+	if staticConfiguration.API != nil {
+		version.DisableDashboardAd = staticConfiguration.API.DisableDashboardAd
+		version.DashboardName = staticConfiguration.API.DashboardName
+	}
+
+	// Plugins
+	pluginLogger := log.Ctx(ctx).With().Logger()
+	hasPlugins := staticConfiguration.Experimental != nil && (staticConfiguration.Experimental.Plugins != nil || staticConfiguration.Experimental.LocalPlugins != nil)
+	if hasPlugins {
+		pluginsList := slices.Collect(maps.Keys(staticConfiguration.Experimental.Plugins))
+		pluginsList = append(pluginsList, slices.Collect(maps.Keys(staticConfiguration.Experimental.LocalPlugins))...)
+
+		pluginLogger = pluginLogger.With().Strs("plugins", pluginsList).Logger()
+		pluginLogger.Info().Msg("Loading plugins...")
+	}
+
+	pluginBuilder, err := createPluginBuilder(staticConfiguration)
+	if err != nil && staticConfiguration.Experimental != nil && staticConfiguration.Experimental.AbortOnPluginFailure {
+		return nil, fmt.Errorf("plugin: failed to create plugin builder: %w", err)
+	}
+	if err != nil {
+		pluginLogger.Err(err).Msg("Plugins are disabled because an error has occurred.")
+	} else if hasPlugins {
+		pluginLogger.Info().Msg("Plugins loaded.")
+	}
+
+	// Providers plugins
+
+	for name, conf := range staticConfiguration.Providers.Plugin {
+		if pluginBuilder == nil {
+			break
 		}
 
-		err = log.OpenFile(logFile)
-		logrus.RegisterExitHandler(func() {
-			if err := log.CloseFile(); err != nil {
-				log.Error("Error closing log", err)
+		p, err := pluginBuilder.BuildProvider(name, conf)
+		if err != nil {
+			return nil, fmt.Errorf("plugin: failed to build provider: %w", err)
+		}
+
+		err = providerAggregator.AddProvider(p)
+		if err != nil {
+			return nil, fmt.Errorf("plugin: failed to add provider: %w", err)
+		}
+	}
+
+	// Service manager factory
+
+	var spiffeX509Source *workloadapi.X509Source
+	if staticConfiguration.Spiffe != nil && staticConfiguration.Spiffe.WorkloadAPIAddr != "" {
+		log.Info().Str("workloadAPIAddr", staticConfiguration.Spiffe.WorkloadAPIAddr).
+			Msg("Waiting on SPIFFE SVID delivery")
+
+		spiffeX509Source, err = workloadapi.NewX509Source(
+			ctx,
+			workloadapi.WithClientOptions(
+				workloadapi.WithAddr(
+					staticConfiguration.Spiffe.WorkloadAPIAddr,
+				),
+			),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("unable to create SPIFFE x509 source: %w", err)
+		}
+		log.Info().Msg("Successfully obtained SPIFFE SVID.")
+	}
+
+	transportManager := service.NewTransportManager(spiffeX509Source)
+
+	var proxyBuilder service.ProxyBuilder = httputil.NewProxyBuilder(transportManager, semConvMetricRegistry)
+	if staticConfiguration.Experimental != nil && staticConfiguration.Experimental.FastProxy != nil {
+		proxyBuilder = proxy.NewSmartBuilder(transportManager, proxyBuilder, *staticConfiguration.Experimental.FastProxy)
+	}
+
+	dialerManager := tcp.NewDialerManager(spiffeX509Source)
+	acmeHTTPHandler := getHTTPChallengeHandler(acmeProviders, httpChallengeProvider)
+	managerFactory := service.NewManagerFactory(*staticConfiguration, routinesPool, observabilityMgr, transportManager, proxyBuilder, acmeHTTPHandler, tlsManager)
+
+	// Router factory
+
+	routerFactory, err := server.NewRouterFactory(*staticConfiguration, managerFactory, tlsManager, observabilityMgr, pluginBuilder, dialerManager)
+	if err != nil {
+		return nil, fmt.Errorf("creating router factory: %w", err)
+	}
+
+	// Watcher
+
+	watcher := server.NewConfigurationWatcher(
+		routinesPool,
+		providerAggregator,
+		getDefaultsEntrypoints(staticConfiguration),
+		"internal",
+	)
+
+	// TLS
+	watcher.AddListener(func(conf dynamic.Configuration) {
+		ctx := context.Background()
+		tlsManager.UpdateConfigs(ctx, conf.TLS.Stores, conf.TLS.Options, conf.TLS.Certificates)
+
+		gauge := metricsRegistry.TLSCertsNotAfterTimestampGauge()
+		for _, certificate := range tlsManager.GetServerCertificates() {
+			appendCertMetric(gauge, certificate)
+		}
+	})
+
+	// Metrics
+	watcher.AddListener(func(_ dynamic.Configuration) {
+		metricsRegistry.ConfigReloadsCounter().Add(1)
+		metricsRegistry.LastConfigReloadSuccessGauge().Set(float64(time.Now().Unix()))
+	})
+
+	// Server Transports
+	watcher.AddListener(func(conf dynamic.Configuration) {
+		transportManager.Update(conf.HTTP.ServersTransports)
+		proxyBuilder.Update(conf.HTTP.ServersTransports)
+		dialerManager.Update(conf.TCP.ServersTransports)
+	})
+
+	// Switch router
+	watcher.AddListener(switchRouter(routerFactory, serverEntryPointsTCP, serverEntryPointsUDP))
+
+	// Metrics
+	if metricsRegistry.IsEpEnabled() || metricsRegistry.IsRouterEnabled() || metricsRegistry.IsSvcEnabled() {
+		var eps []string
+		for key := range serverEntryPointsTCP {
+			eps = append(eps, key)
+		}
+		watcher.AddListener(func(conf dynamic.Configuration) {
+			metrics.OnConfigurationUpdate(conf, eps)
+		})
+	}
+
+	// TLS challenge
+	watcher.AddListener(tlsChallengeProvider.ListenConfiguration)
+
+	// Certificate Resolvers
+
+	resolverNames := map[string]struct{}{}
+
+	// ACME
+	for _, p := range acmeProviders {
+		resolverNames[p.ResolverName] = struct{}{}
+		watcher.AddListener(p.ListenConfiguration)
+	}
+
+	// Tailscale
+	for _, p := range tsProviders {
+		resolverNames[p.ResolverName] = struct{}{}
+		watcher.AddListener(p.HandleConfigUpdate)
+	}
+
+	// Certificate resolver logs
+	watcher.AddListener(func(config dynamic.Configuration) {
+		for rtName, rt := range config.HTTP.Routers {
+			if rt.TLS == nil || rt.TLS.CertResolver == "" {
+				continue
+			}
+
+			if _, ok := resolverNames[rt.TLS.CertResolver]; !ok {
+				log.Error().Err(err).Str(logs.RouterName, rtName).Str("certificateResolver", rt.TLS.CertResolver).
+					Msg("Router uses a nonexistent certificate resolver")
+			}
+		}
+	})
+
+	return server.NewServer(routinesPool, serverEntryPointsTCP, serverEntryPointsUDP, watcher, observabilityMgr), nil
+}
+
+func getHTTPChallengeHandler(acmeProviders []*acme.Provider, httpChallengeProvider http.Handler) http.Handler {
+	var acmeHTTPHandler http.Handler
+	for _, p := range acmeProviders {
+		if p != nil && p.HTTPChallenge != nil {
+			acmeHTTPHandler = httpChallengeProvider
+			break
+		}
+	}
+	return acmeHTTPHandler
+}
+
+func getDefaultsEntrypoints(staticConfiguration *static.Configuration) []string {
+	var defaultEntryPoints []string
+
+	// Determines if at least one EntryPoint is configured to be used by default.
+	var hasDefinedDefaults bool
+	for _, ep := range staticConfiguration.EntryPoints {
+		if ep.AsDefault {
+			hasDefinedDefaults = true
+			break
+		}
+	}
+
+	for name, cfg := range staticConfiguration.EntryPoints {
+		// By default all entrypoints are considered.
+		// If at least one is flagged, then only flagged entrypoints are included.
+		if hasDefinedDefaults && !cfg.AsDefault {
+			continue
+		}
+
+		protocol, err := cfg.GetProtocol()
+		if err != nil {
+			// Should never happen because Traefik should not start if protocol is invalid.
+			log.Error().Err(err).Msg("Invalid protocol")
+		}
+
+		if protocol != "udp" && name != static.DefaultInternalEntryPointName {
+			defaultEntryPoints = append(defaultEntryPoints, name)
+		}
+	}
+
+	slices.Sort(defaultEntryPoints)
+	return defaultEntryPoints
+}
+
+func switchRouter(routerFactory *server.RouterFactory, serverEntryPointsTCP server.TCPEntryPoints, serverEntryPointsUDP server.UDPEntryPoints) func(conf dynamic.Configuration) {
+	return func(conf dynamic.Configuration) {
+		rtConf := runtime.NewConfig(conf)
+
+		routers, udpRouters := routerFactory.CreateRouters(rtConf)
+
+		serverEntryPointsTCP.Switch(routers)
+		serverEntryPointsUDP.Switch(udpRouters)
+	}
+}
+
+// initACMEProvider creates and registers acme.Provider instances corresponding to the configured ACME certificate resolvers.
+func initACMEProvider(c *static.Configuration, providerAggregator *aggregator.ProviderAggregator, tlsManager *traefiktls.Manager, httpChallengeProvider, tlsChallengeProvider challenge.Provider, routinesPool *safe.Pool) []*acme.Provider {
+	localStores := map[string]*acme.LocalStore{}
+
+	var resolvers []*acme.Provider
+	for name, resolver := range c.CertificatesResolvers {
+		if resolver.ACME == nil {
+			continue
+		}
+
+		if localStores[resolver.ACME.Storage] == nil {
+			localStores[resolver.ACME.Storage] = acme.NewLocalStore(resolver.ACME.Storage, routinesPool)
+		}
+
+		p := &acme.Provider{
+			Configuration:         resolver.ACME,
+			Store:                 localStores[resolver.ACME.Storage],
+			ResolverName:          name,
+			HTTPChallengeProvider: httpChallengeProvider,
+			TLSChallengeProvider:  tlsChallengeProvider,
+		}
+
+		if err := providerAggregator.AddProvider(p); err != nil {
+			log.Error().Err(err).Str("resolver", name).Msg("The ACME resolve is skipped from the resolvers list")
+			continue
+		}
+
+		p.SetTLSManager(tlsManager)
+
+		p.SetConfigListenerChan(make(chan dynamic.Configuration))
+
+		resolvers = append(resolvers, p)
+	}
+
+	return resolvers
+}
+
+// initTailscaleProviders creates and registers tailscale.Provider instances corresponding to the configured Tailscale certificate resolvers.
+func initTailscaleProviders(cfg *static.Configuration, providerAggregator *aggregator.ProviderAggregator) []*tailscale.Provider {
+	var providers []*tailscale.Provider
+	for name, resolver := range cfg.CertificatesResolvers {
+		if resolver.Tailscale == nil {
+			continue
+		}
+
+		tsProvider := &tailscale.Provider{ResolverName: name}
+
+		if err := providerAggregator.AddProvider(tsProvider); err != nil {
+			log.Error().Err(err).Str(logs.ProviderName, name).Msg("Unable to create Tailscale provider")
+			continue
+		}
+
+		providers = append(providers, tsProvider)
+	}
+
+	return providers
+}
+
+func registerMetricClients(metricsConfig *otypes.Metrics) []metrics.Registry {
+	if metricsConfig == nil {
+		return nil
+	}
+
+	var registries []metrics.Registry
+
+	if metricsConfig.Prometheus != nil {
+		logger := log.With().Str(logs.MetricsProviderName, "prometheus").Logger()
+
+		prometheusRegister := metrics.RegisterPrometheus(logger.WithContext(context.Background()), metricsConfig.Prometheus)
+		if prometheusRegister != nil {
+			registries = append(registries, prometheusRegister)
+			logger.Debug().Msg("Configured Prometheus metrics")
+		}
+	}
+
+	if metricsConfig.Datadog != nil {
+		logger := log.With().Str(logs.MetricsProviderName, "datadog").Logger()
+
+		registries = append(registries, metrics.RegisterDatadog(logger.WithContext(context.Background()), metricsConfig.Datadog))
+		logger.Debug().
+			Str("address", metricsConfig.Datadog.Address).
+			Str("pushInterval", metricsConfig.Datadog.PushInterval.String()).
+			Msgf("Configured Datadog metrics")
+	}
+
+	if metricsConfig.StatsD != nil {
+		logger := log.With().Str(logs.MetricsProviderName, "statsd").Logger()
+
+		registries = append(registries, metrics.RegisterStatsd(logger.WithContext(context.Background()), metricsConfig.StatsD))
+		logger.Debug().
+			Str("address", metricsConfig.StatsD.Address).
+			Str("pushInterval", metricsConfig.StatsD.PushInterval.String()).
+			Msg("Configured StatsD metrics")
+	}
+
+	if metricsConfig.InfluxDB2 != nil {
+		logger := log.With().Str(logs.MetricsProviderName, "influxdb2").Logger()
+
+		influxDB2Register := metrics.RegisterInfluxDB2(logger.WithContext(context.Background()), metricsConfig.InfluxDB2)
+		if influxDB2Register != nil {
+			registries = append(registries, influxDB2Register)
+			logger.Debug().
+				Str("address", metricsConfig.InfluxDB2.Address).
+				Str("bucket", metricsConfig.InfluxDB2.Bucket).
+				Str("organization", metricsConfig.InfluxDB2.Org).
+				Str("pushInterval", metricsConfig.InfluxDB2.PushInterval.String()).
+				Msg("Configured InfluxDB v2 metrics")
+		}
+	}
+
+	if metricsConfig.OTLP != nil {
+		logger := log.With().Str(logs.MetricsProviderName, "openTelemetry").Logger()
+
+		openTelemetryRegistry := metrics.RegisterOpenTelemetry(logger.WithContext(context.Background()), metricsConfig.OTLP)
+		if openTelemetryRegistry != nil {
+			registries = append(registries, openTelemetryRegistry)
+			logger.Debug().
+				Str("pushInterval", metricsConfig.OTLP.PushInterval.String()).
+				Msg("Configured OpenTelemetry metrics")
+		}
+	}
+
+	return registries
+}
+
+func appendCertMetric(gauge gokitmetrics.Gauge, certificate *x509.Certificate) {
+	slices.Sort(certificate.DNSNames)
+
+	labels := []string{
+		"cn", certificate.Subject.CommonName,
+		"serial", certificate.SerialNumber.String(),
+		"sans", strings.Join(certificate.DNSNames, ","),
+	}
+
+	notAfter := float64(certificate.NotAfter.Unix())
+
+	gauge.With(labels...).Set(notAfter)
+}
+
+func setupAccessLog(ctx context.Context, conf *otypes.AccessLog) *accesslog.Handler {
+	if conf == nil {
+		return nil
+	}
+
+	accessLoggerMiddleware, err := accesslog.NewHandler(ctx, conf)
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to create access logger")
+		return nil
+	}
+
+	return accessLoggerMiddleware
+}
+
+func setupTracing(ctx context.Context, conf *static.Tracing) (*tracing.Tracer, io.Closer) {
+	if conf == nil {
+		return nil, nil
+	}
+
+	tracer, closer, err := tracing.NewTracing(ctx, conf)
+	if err != nil {
+		log.Warn().Err(err).Msg("Unable to create tracer")
+		return nil, nil
+	}
+
+	return tracer, closer
+}
+
+func checkNewVersion(staticConfiguration *static.Configuration) {
+	logger := log.With().Logger()
+
+	if staticConfiguration.Global.CheckNewVersion {
+		logger.Info().Msg(`Version check is enabled.`)
+		logger.Info().Msg(`Traefik checks for new releases to notify you if your version is out of date.`)
+		logger.Info().Msg(`It also collects usage data during this process.`)
+		logger.Info().Msg(`Check the documentation to get more info: https://doc.traefik.io/traefik/contributing/data-collection/`)
+
+		ticker := time.Tick(24 * time.Hour)
+		safe.Go(func() {
+			for time.Sleep(10 * time.Minute); ; <-ticker {
+				version.CheckNewVersion()
 			}
 		})
-		if err != nil {
-			log.Error("Error opening file", err)
-		}
+	} else {
+		logger.Info().Msg(`
+Version check is disabled.
+You will not be notified if a new version is available.
+More details: https://doc.traefik.io/traefik/contributing/data-collection/
+`)
 	}
 }
 
-func checkNewVersion() {
-	ticker := time.Tick(24 * time.Hour)
-	safe.Go(func() {
-		for time.Sleep(10 * time.Minute); ; <-ticker {
-			version.CheckNewVersion()
-		}
-	})
-}
+func stats(staticConfiguration *static.Configuration) {
+	logger := log.With().Logger()
 
-func stats(globalConfiguration *configuration.GlobalConfiguration) {
-	if globalConfiguration.SendAnonymousUsage {
-		log.Info(`
-Stats collection is enabled.
-Many thanks for contributing to Traefik's improvement by allowing us to receive anonymous information from your configuration.
-Help us improve Traefik by leaving this feature on :)
-More details on: https://docs.traefik.io/basics/#collected-data
-`)
-		collect(globalConfiguration)
+	if staticConfiguration.Global.SendAnonymousUsage {
+		logger.Info().Msg(`Stats collection is enabled.`)
+		logger.Info().Msg(`Many thanks for contributing to Traefik's improvement by allowing us to receive anonymous information from your configuration.`)
+		logger.Info().Msg(`Help us improve Traefik by leaving this feature on :)`)
+		logger.Info().Msg(`More details on: https://doc.traefik.io/traefik/contributing/data-collection/`)
+		collect(staticConfiguration)
 	} else {
-		log.Info(`
+		logger.Info().Msg(`
 Stats collection is disabled.
 Help us improve Traefik by turning this feature on :)
-More details on: https://docs.traefik.io/basics/#collected-data
+More details on: https://doc.traefik.io/traefik/contributing/data-collection/
 `)
 	}
 }
 
-func collect(globalConfiguration *configuration.GlobalConfiguration) {
+func collect(staticConfiguration *static.Configuration) {
 	ticker := time.Tick(24 * time.Hour)
 	safe.Go(func() {
 		for time.Sleep(10 * time.Minute); ; <-ticker {
-			if err := collector.Collect(globalConfiguration); err != nil {
-				log.Debug(err)
+			if err := collector.Collect(staticConfiguration); err != nil {
+				log.Debug().Err(err).Send()
 			}
 		}
 	})

cmd/traefik/traefik_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"strings"
+	"testing"
+
+	"github.com/go-kit/kit/metrics"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/traefik/traefik/v3/pkg/config/static"
+)
+
+// FooCert is a PEM-encoded TLS cert.
+// generated from src/crypto/tls:
+// go run generate_cert.go  --rsa-bits 1024 --host foo.org,foo.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=1000000h
+const fooCert = `-----BEGIN CERTIFICATE-----
+MIICHzCCAYigAwIBAgIQXQFLeYRwc5X21t457t2xADANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMCAXDTcwMDEwMTAwMDAwMFoYDzIwODQwMTI5MTYw
+MDAwWjASMRAwDgYDVQQKEwdBY21lIENvMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
+iQKBgQDCjn67GSs/khuGC4GNN+tVo1S+/eSHwr/hWzhfMqO7nYiXkFzmxi+u14CU
+Pda6WOeps7T2/oQEFMxKKg7zYOqkLSbjbE0ZfosopaTvEsZm/AZHAAvoOrAsIJOn
+SEiwy8h0tLA4z1SNR6rmIVQWyqBZEPAhBTQM1z7tFp48FakCFwIDAQABo3QwcjAO
+BgNVHQ8BAf8EBAMCAqQwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0TAQH/BAUw
+AwEB/zAdBgNVHQ4EFgQUDHG3ASzeUezElup9zbPpBn/vjogwGwYDVR0RBBQwEoIH
+Zm9vLm9yZ4IHZm9vLmNvbTANBgkqhkiG9w0BAQsFAAOBgQBT+VLMbB9u27tBX8Aw
+ZrGY3rbNdBGhXVTksrjiF+6ZtDpD3iI56GH9zLxnqvXkgn3u0+Ard5TqF/xmdwVw
+NY0V/aWYfcL2G2auBCQrPvM03ozRnVUwVfP23eUzX2ORNHCYhd2ObQx4krrhs7cJ
+SWxtKwFlstoXY3K2g9oRD9UxdQ==
+-----END CERTIFICATE-----`
+
+// BarCert is a PEM-encoded TLS cert.
+// generated from src/crypto/tls:
+// go run generate_cert.go  --rsa-bits 1024 --host bar.org,bar.com  --ca --start-date "Jan 1 00:00:00 1970" --duration=10000h
+const barCert = `-----BEGIN CERTIFICATE-----
+MIICHTCCAYagAwIBAgIQcuIcNEXzBHPoxna5S6wG4jANBgkqhkiG9w0BAQsFADAS
+MRAwDgYDVQQKEwdBY21lIENvMB4XDTcwMDEwMTAwMDAwMFoXDTcxMDIyMTE2MDAw
+MFowEjEQMA4GA1UEChMHQWNtZSBDbzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
+gYEAqtcrP+KA7D6NjyztGNIPMup9KiBMJ8QL+preog/YHR7SQLO3kGFhpS3WKMab
+SzMypC3ZX1PZjBP5ZzwaV3PFbuwlCkPlyxR2lOWmullgI7mjY0TBeYLDIclIzGRp
+mpSDDSpkW1ay2iJDSpXjlhmwZr84hrCU7BRTQJo91fdsRTsCAwEAAaN0MHIwDgYD
+VR0PAQH/BAQDAgKkMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMB
+Af8wHQYDVR0OBBYEFK8jnzFQvBAgWtfzOyXY4VSkwrTXMBsGA1UdEQQUMBKCB2Jh
+ci5vcmeCB2Jhci5jb20wDQYJKoZIhvcNAQELBQADgYEAJz0ifAExisC/ZSRhWuHz
+7qs1i6Nd4+YgEVR8dR71MChP+AMxucY1/ajVjb9xlLys3GPE90TWSdVppabEVjZY
+Oq11nPKc50ItTt8dMku6t0JHBmzoGdkN0V4zJCBqdQJxhop8JpYJ0S9CW0eT93h3
+ipYQSsmIINGtMXJ8VkP/MlM=
+-----END CERTIFICATE-----`
+
+type gaugeMock struct {
+	metrics map[string]float64
+	labels  string
+}
+
+func (g gaugeMock) With(labelValues ...string) metrics.Gauge {
+	g.labels = strings.Join(labelValues, ",")
+	return g
+}
+
+func (g gaugeMock) Set(value float64) {
+	g.metrics[g.labels] = value
+}
+
+func (g gaugeMock) Add(delta float64) {
+	panic("implement me")
+}
+
+func TestAppendCertMetric(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		certs    []string
+		expected map[string]float64
+	}{
+		{
+			desc:     "No certs",
+			certs:    []string{},
+			expected: map[string]float64{},
+		},
+		{
+			desc:  "One cert",
+			certs: []string{fooCert},
+			expected: map[string]float64{
+				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
+			},
+		},
+		{
+			desc:  "Two certs",
+			certs: []string{fooCert, barCert},
+			expected: map[string]float64{
+				"cn,,serial,123624926713171615935660664614975025408,sans,foo.com,foo.org": 3.6e+09,
+				"cn,,serial,152706022658490889223053211416725817058,sans,bar.com,bar.org": 3.6e+07,
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			gauge := &gaugeMock{
+				metrics: map[string]float64{},
+			}
+
+			for _, cert := range test.certs {
+				block, _ := pem.Decode([]byte(cert))
+				parsedCert, err := x509.ParseCertificate(block.Bytes)
+				require.NoError(t, err)
+
+				appendCertMetric(gauge, parsedCert)
+			}
+
+			assert.Equal(t, test.expected, gauge.metrics)
+		})
+	}
+}
+
+func TestGetDefaultsEntrypoints(t *testing.T) {
+	testCases := []struct {
+		desc        string
+		entrypoints static.EntryPoints
+		expected    []string
+	}{
+		{
+			desc: "Skips special names",
+			entrypoints: map[string]*static.EntryPoint{
+				"web": {
+					Address: ":80",
+				},
+				"traefik": {
+					Address: ":8080",
+				},
+			},
+			expected: []string{"web"},
+		},
+		{
+			desc: "Two EntryPoints not attachable",
+			entrypoints: map[string]*static.EntryPoint{
+				"web": {
+					Address: ":80",
+				},
+				"websecure": {
+					Address: ":443",
+				},
+			},
+			expected: []string{"web", "websecure"},
+		},
+		{
+			desc: "Two EntryPoints only one attachable",
+			entrypoints: map[string]*static.EntryPoint{
+				"web": {
+					Address: ":80",
+				},
+				"websecure": {
+					Address:   ":443",
+					AsDefault: true,
+				},
+			},
+			expected: []string{"websecure"},
+		},
+		{
+			desc: "Two attachable EntryPoints",
+			entrypoints: map[string]*static.EntryPoint{
+				"web": {
+					Address:   ":80",
+					AsDefault: true,
+				},
+				"websecure": {
+					Address:   ":443",
+					AsDefault: true,
+				},
+			},
+			expected: []string{"web", "websecure"},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			actual := getDefaultsEntrypoints(&static.Configuration{
+				EntryPoints: test.entrypoints,
+			})
+
+			assert.ElementsMatch(t, test.expected, actual)
+		})
+	}
+}

cmd/version/version.go

@@ -7,8 +7,8 @@ import (
 	"runtime"
 	"text/template"
 
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/version"
+	"github.com/traefik/paerser/cli"
+	"github.com/traefik/traefik/v3/pkg/version"
 )
 
 var versionTemplate = `Version:      {{.Version}}
@@ -17,25 +17,23 @@ Go version:   {{.GoVersion}}
 Built:        {{.BuildTime}}
 OS/Arch:      {{.Os}}/{{.Arch}}`
 
-// NewCmd builds a new Version command
-func NewCmd() *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "version",
-		Description:           `Print version`,
-		Config:                struct{}{},
-		DefaultPointersConfig: struct{}{},
-		Run: func() error {
+// NewCmd builds a new Version command.
+func NewCmd() *cli.Command {
+	return &cli.Command{
+		Name:          "version",
+		Description:   `Shows the current Traefik version.`,
+		Configuration: nil,
+		Run: func(_ []string) error {
 			if err := GetPrint(os.Stdout); err != nil {
 				return err
 			}
 			fmt.Print("\n")
 			return nil
-
 		},
 	}
 }
 
-// GetPrint write Printable version
+// GetPrint write Printable version.
 func GetPrint(wr io.Writer) error {
 	tmpl, err := template.New("").Parse(versionTemplate)
 	if err != nil {

collector/collector.go

@@ -1,79 +0,0 @@
-package collector
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/json"
-	"net"
-	"net/http"
-	"strconv"
-	"time"
-
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/version"
-	"github.com/mitchellh/hashstructure"
-)
-
-// collectorURL URL where the stats are send
-const collectorURL = "https://collect.traefik.io/619df80498b60f985d766ce62f912b7c"
-
-// Collected data
-type data struct {
-	Version       string
-	Codename      string
-	BuildDate     string
-	Configuration string
-	Hash          string
-}
-
-// Collect anonymous data.
-func Collect(globalConfiguration *configuration.GlobalConfiguration) error {
-	anonConfig, err := anonymize.Do(globalConfiguration, false)
-	if err != nil {
-		return err
-	}
-
-	log.Infof("Anonymous stats sent to %s: %s", collectorURL, anonConfig)
-
-	hashConf, err := hashstructure.Hash(globalConfiguration, nil)
-	if err != nil {
-		return err
-	}
-
-	data := &data{
-		Version:       version.Version,
-		Codename:      version.Codename,
-		BuildDate:     version.BuildDate,
-		Hash:          strconv.FormatUint(hashConf, 10),
-		Configuration: base64.StdEncoding.EncodeToString([]byte(anonConfig)),
-	}
-
-	buf := new(bytes.Buffer)
-	err = json.NewEncoder(buf).Encode(data)
-	if err != nil {
-		return err
-	}
-
-	_, err = makeHTTPClient().Post(collectorURL, "application/json; charset=utf-8", buf)
-	return err
-}
-
-func makeHTTPClient() *http.Client {
-	dialer := &net.Dialer{
-		Timeout:   configuration.DefaultDialTimeout,
-		KeepAlive: 30 * time.Second,
-		DualStack: true,
-	}
-
-	transport := &http.Transport{
-		Proxy:                 http.ProxyFromEnvironment,
-		DialContext:           dialer.DialContext,
-		IdleConnTimeout:       90 * time.Second,
-		TLSHandshakeTimeout:   10 * time.Second,
-		ExpectContinueTimeout: 1 * time.Second,
-	}
-
-	return &http.Client{Transport: transport}
-}

configuration/configuration.go

@@ -1,578 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik-extra-service-fabric"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/datadog"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/ping"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/rest"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/pkg/errors"
-	lego "github.com/xenolf/lego/acme"
-)
-
-const (
-	// DefaultInternalEntryPointName the name of the default internal entry point
-	DefaultInternalEntryPointName = "traefik"
-
-	// DefaultHealthCheckInterval is the default health check interval.
-	DefaultHealthCheckInterval = 30 * time.Second
-
-	// DefaultDialTimeout when connecting to a backend server.
-	DefaultDialTimeout = 30 * time.Second
-
-	// DefaultIdleTimeout before closing an idle connection.
-	DefaultIdleTimeout = 180 * time.Second
-
-	// DefaultGraceTimeout controls how long Traefik serves pending requests
-	// prior to shutting down.
-	DefaultGraceTimeout = 10 * time.Second
-
-	// DefaultAcmeCAServer is the default ACME API endpoint
-	DefaultAcmeCAServer = "https://acme-v02.api.letsencrypt.org/directory"
-)
-
-// GlobalConfiguration holds global configuration (with providers, etc.).
-// It's populated from the traefik configuration file passed as an argument to the binary.
-type GlobalConfiguration struct {
-	LifeCycle                 *LifeCycle        `description:"Timeouts influencing the server life cycle" export:"true"`
-	GraceTimeOut              flaeg.Duration    `short:"g" description:"(Deprecated) Duration to give active requests a chance to finish before Traefik stops" export:"true"` // Deprecated
-	Debug                     bool              `short:"d" description:"Enable debug mode" export:"true"`
-	CheckNewVersion           bool              `description:"Periodically check if a new version has been released" export:"true"`
-	SendAnonymousUsage        bool              `description:"send periodically anonymous usage statistics" export:"true"`
-	AccessLogsFile            string            `description:"(Deprecated) Access logs file" export:"true"` // Deprecated
-	AccessLog                 *types.AccessLog  `description:"Access log settings" export:"true"`
-	TraefikLogsFile           string            `description:"(Deprecated) Traefik logs file. Stdout is used when omitted or empty" export:"true"` // Deprecated
-	TraefikLog                *types.TraefikLog `description:"Traefik log settings" export:"true"`
-	Tracing                   *tracing.Tracing  `description:"OpenTracing configuration" export:"true"`
-	LogLevel                  string            `short:"l" description:"Log level" export:"true"`
-	EntryPoints               EntryPoints       `description:"Entrypoints definition using format: --entryPoints='Name:http Address::8000 Redirect.EntryPoint:https' --entryPoints='Name:https Address::4442 TLS:tests/traefik.crt,tests/traefik.key;prod/traefik.crt,prod/traefik.key'" export:"true"`
-	Cluster                   *types.Cluster
-	Constraints               types.Constraints       `description:"Filter services by constraint, matching with service tags" export:"true"`
-	ACME                      *acme.ACME              `description:"Enable ACME (Let's Encrypt): automatic SSL" export:"true"`
-	DefaultEntryPoints        DefaultEntryPoints      `description:"Entrypoints to be used by frontends that do not specify any entrypoint" export:"true"`
-	ProvidersThrottleDuration flaeg.Duration          `description:"Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time." export:"true"`
-	MaxIdleConnsPerHost       int                     `description:"If non-zero, controls the maximum idle (keep-alive) to keep per-host.  If zero, DefaultMaxIdleConnsPerHost is used" export:"true"`
-	IdleTimeout               flaeg.Duration          `description:"(Deprecated) maximum amount of time an idle (keep-alive) connection will remain idle before closing itself." export:"true"` // Deprecated
-	InsecureSkipVerify        bool                    `description:"Disable SSL certificate verification" export:"true"`
-	RootCAs                   tls.FilesOrContents     `description:"Add cert file for self-signed certificate"`
-	Retry                     *Retry                  `description:"Enable retry sending request if network error" export:"true"`
-	HealthCheck               *HealthCheckConfig      `description:"Health check parameters" export:"true"`
-	RespondingTimeouts        *RespondingTimeouts     `description:"Timeouts for incoming requests to the Traefik instance" export:"true"`
-	ForwardingTimeouts        *ForwardingTimeouts     `description:"Timeouts for requests forwarded to the backend servers" export:"true"`
-	AllowMinWeightZero        bool                    `description:"Allow weight to take 0 as minimum real value." export:"true"`         // Deprecated
-	KeepTrailingSlash         bool                    `description:"Do not remove trailing slash." export:"true"`                         // Deprecated
-	Web                       *WebCompatibility       `description:"(Deprecated) Enable Web backend with default settings" export:"true"` // Deprecated
-	Docker                    *docker.Provider        `description:"Enable Docker backend with default settings" export:"true"`
-	File                      *file.Provider          `description:"Enable File backend with default settings" export:"true"`
-	Marathon                  *marathon.Provider      `description:"Enable Marathon backend with default settings" export:"true"`
-	Consul                    *consul.Provider        `description:"Enable Consul backend with default settings" export:"true"`
-	ConsulCatalog             *consulcatalog.Provider `description:"Enable Consul catalog backend with default settings" export:"true"`
-	Etcd                      *etcd.Provider          `description:"Enable Etcd backend with default settings" export:"true"`
-	Zookeeper                 *zk.Provider            `description:"Enable Zookeeper backend with default settings" export:"true"`
-	Boltdb                    *boltdb.Provider        `description:"Enable Boltdb backend with default settings" export:"true"`
-	Kubernetes                *kubernetes.Provider    `description:"Enable Kubernetes backend with default settings" export:"true"`
-	Mesos                     *mesos.Provider         `description:"Enable Mesos backend with default settings" export:"true"`
-	Eureka                    *eureka.Provider        `description:"Enable Eureka backend with default settings" export:"true"`
-	ECS                       *ecs.Provider           `description:"Enable ECS backend with default settings" export:"true"`
-	Rancher                   *rancher.Provider       `description:"Enable Rancher backend with default settings" export:"true"`
-	DynamoDB                  *dynamodb.Provider      `description:"Enable DynamoDB backend with default settings" export:"true"`
-	ServiceFabric             *servicefabric.Provider `description:"Enable Service Fabric backend with default settings" export:"true"`
-	Rest                      *rest.Provider          `description:"Enable Rest backend with default settings" export:"true"`
-	API                       *api.Handler            `description:"Enable api/dashboard" export:"true"`
-	Metrics                   *types.Metrics          `description:"Enable a metrics exporter" export:"true"`
-	Ping                      *ping.Handler           `description:"Enable ping" export:"true"`
-	HostResolver              *HostResolverConfig     `description:"Enable CNAME Flattening" export:"true"`
-}
-
-// WebCompatibility is a configuration to handle compatibility with deprecated web provider options
-type WebCompatibility struct {
-	Address    string            `description:"(Deprecated) Web administration port" export:"true"`
-	CertFile   string            `description:"(Deprecated) SSL certificate" export:"true"`
-	KeyFile    string            `description:"(Deprecated) SSL certificate" export:"true"`
-	ReadOnly   bool              `description:"(Deprecated) Enable read only API" export:"true"`
-	Statistics *types.Statistics `description:"(Deprecated) Enable more detailed statistics" export:"true"`
-	Metrics    *types.Metrics    `description:"(Deprecated) Enable a metrics exporter" export:"true"`
-	Path       string            `description:"(Deprecated) Root path for dashboard and API" export:"true"`
-	Auth       *types.Auth       `export:"true"`
-	Debug      bool              `export:"true"`
-}
-
-func (gc *GlobalConfiguration) handleWebDeprecation() {
-	if gc.Web != nil {
-		log.Warn("web provider configuration is deprecated, you should use these options : api, rest provider, ping and metrics")
-
-		if gc.API != nil || gc.Metrics != nil || gc.Ping != nil || gc.Rest != nil {
-			log.Warn("web option is ignored if you use it with one of these options : api, rest provider, ping or metrics")
-			return
-		}
-		gc.EntryPoints[DefaultInternalEntryPointName] = &EntryPoint{
-			Address: gc.Web.Address,
-			Auth:    gc.Web.Auth,
-		}
-		if gc.Web.CertFile != "" {
-			gc.EntryPoints[DefaultInternalEntryPointName].TLS = &tls.TLS{
-				Certificates: []tls.Certificate{
-					{
-						CertFile: tls.FileOrContent(gc.Web.CertFile),
-						KeyFile:  tls.FileOrContent(gc.Web.KeyFile),
-					},
-				},
-			}
-		}
-
-		if gc.API == nil {
-			gc.API = &api.Handler{
-				EntryPoint: DefaultInternalEntryPointName,
-				Statistics: gc.Web.Statistics,
-				Dashboard:  true,
-			}
-		}
-
-		if gc.Ping == nil {
-			gc.Ping = &ping.Handler{
-				EntryPoint: DefaultInternalEntryPointName,
-			}
-		}
-
-		if gc.Metrics == nil {
-			gc.Metrics = gc.Web.Metrics
-		}
-
-		if !gc.Debug {
-			gc.Debug = gc.Web.Debug
-		}
-	}
-}
-
-// SetEffectiveConfiguration adds missing configuration parameters derived from existing ones.
-// It also takes care of maintaining backwards compatibility.
-func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
-	if len(gc.EntryPoints) == 0 {
-		gc.EntryPoints = map[string]*EntryPoint{"http": {
-			Address:          ":80",
-			ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-		}}
-		gc.DefaultEntryPoints = []string{"http"}
-	}
-
-	gc.handleWebDeprecation()
-
-	if (gc.API != nil && gc.API.EntryPoint == DefaultInternalEntryPointName) ||
-		(gc.Ping != nil && gc.Ping.EntryPoint == DefaultInternalEntryPointName) ||
-		(gc.Metrics != nil && gc.Metrics.Prometheus != nil && gc.Metrics.Prometheus.EntryPoint == DefaultInternalEntryPointName) ||
-		(gc.Rest != nil && gc.Rest.EntryPoint == DefaultInternalEntryPointName) {
-		if _, ok := gc.EntryPoints[DefaultInternalEntryPointName]; !ok {
-			gc.EntryPoints[DefaultInternalEntryPointName] = &EntryPoint{Address: ":8080"}
-		}
-	}
-
-	for entryPointName := range gc.EntryPoints {
-		entryPoint := gc.EntryPoints[entryPointName]
-		// ForwardedHeaders must be remove in the next breaking version
-		if entryPoint.ForwardedHeaders == nil {
-			entryPoint.ForwardedHeaders = &ForwardedHeaders{Insecure: true}
-		}
-
-		if len(entryPoint.WhitelistSourceRange) > 0 {
-			log.Warnf("Deprecated configuration found: %s. Please use %s.", "whiteListSourceRange", "whiteList.sourceRange")
-
-			if entryPoint.WhiteList == nil {
-				entryPoint.WhiteList = &types.WhiteList{
-					SourceRange: entryPoint.WhitelistSourceRange,
-				}
-				entryPoint.WhitelistSourceRange = nil
-			}
-		}
-
-		if entryPoint.TLS != nil && entryPoint.TLS.DefaultCertificate == nil && len(entryPoint.TLS.Certificates) > 0 {
-			log.Infof("No tls.defaultCertificate given for %s: using the first item in tls.certificates as a fallback.", entryPointName)
-			entryPoint.TLS.DefaultCertificate = &entryPoint.TLS.Certificates[0]
-		}
-	}
-
-	// Make sure LifeCycle isn't nil to spare nil checks elsewhere.
-	if gc.LifeCycle == nil {
-		gc.LifeCycle = &LifeCycle{}
-	}
-
-	// Prefer legacy grace timeout parameter for backwards compatibility reasons.
-	if gc.GraceTimeOut > 0 {
-		log.Warn("top-level grace period configuration has been deprecated -- please use lifecycle grace period")
-		gc.LifeCycle.GraceTimeOut = gc.GraceTimeOut
-	}
-
-	if gc.Docker != nil {
-		if len(gc.Docker.Filename) != 0 && gc.Docker.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Docker.TemplateVersion = 1
-		} else {
-			gc.Docker.TemplateVersion = 2
-		}
-	}
-
-	if gc.Marathon != nil {
-		if len(gc.Marathon.Filename) != 0 && gc.Marathon.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Marathon.TemplateVersion = 1
-		} else {
-			gc.Marathon.TemplateVersion = 2
-		}
-	}
-
-	if gc.Mesos != nil {
-		if len(gc.Mesos.Filename) != 0 && gc.Mesos.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Mesos.TemplateVersion = 1
-		} else {
-			gc.Mesos.TemplateVersion = 2
-		}
-	}
-
-	if gc.Eureka != nil {
-		if gc.Eureka.Delay != 0 {
-			log.Warn("Delay has been deprecated -- please use RefreshSeconds")
-			gc.Eureka.RefreshSeconds = gc.Eureka.Delay
-		}
-	}
-
-	if gc.ECS != nil {
-		if len(gc.ECS.Filename) != 0 && gc.ECS.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.ECS.TemplateVersion = 1
-		} else {
-			gc.ECS.TemplateVersion = 2
-		}
-	}
-
-	if gc.ConsulCatalog != nil {
-		if len(gc.ConsulCatalog.Filename) != 0 && gc.ConsulCatalog.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.ConsulCatalog.TemplateVersion = 1
-		} else {
-			gc.ConsulCatalog.TemplateVersion = 2
-		}
-	}
-
-	if gc.Rancher != nil {
-		if len(gc.Rancher.Filename) != 0 && gc.Rancher.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Rancher.TemplateVersion = 1
-		} else {
-			gc.Rancher.TemplateVersion = 2
-		}
-
-		// Ensure backwards compatibility for now
-		if len(gc.Rancher.AccessKey) > 0 ||
-			len(gc.Rancher.Endpoint) > 0 ||
-			len(gc.Rancher.SecretKey) > 0 {
-
-			if gc.Rancher.API == nil {
-				gc.Rancher.API = &rancher.APIConfiguration{
-					AccessKey: gc.Rancher.AccessKey,
-					SecretKey: gc.Rancher.SecretKey,
-					Endpoint:  gc.Rancher.Endpoint,
-				}
-			}
-			log.Warn("Deprecated configuration found: rancher.[accesskey|secretkey|endpoint]. " +
-				"Please use rancher.api.[accesskey|secretkey|endpoint] instead.")
-		}
-
-		if gc.Rancher.Metadata != nil && len(gc.Rancher.Metadata.Prefix) == 0 {
-			gc.Rancher.Metadata.Prefix = "latest"
-		}
-	}
-
-	if gc.API != nil {
-		gc.API.Debug = gc.Debug
-	}
-
-	if gc.Web != nil && (gc.Web.Path == "" || !strings.HasSuffix(gc.Web.Path, "/")) {
-		gc.Web.Path += "/"
-	}
-
-	if gc.File != nil {
-		gc.File.TraefikFile = configFile
-	}
-
-	gc.initACMEProvider()
-	gc.initTracing()
-}
-
-func (gc *GlobalConfiguration) initTracing() {
-	if gc.Tracing != nil {
-		switch gc.Tracing.Backend {
-		case jaeger.Name:
-			if gc.Tracing.Jaeger == nil {
-				gc.Tracing.Jaeger = &jaeger.Config{
-					SamplingServerURL:  "http://localhost:5778/sampling",
-					SamplingType:       "const",
-					SamplingParam:      1.0,
-					LocalAgentHostPort: "127.0.0.1:6831",
-				}
-			}
-			if gc.Tracing.Zipkin != nil {
-				log.Warn("Zipkin configuration will be ignored")
-				gc.Tracing.Zipkin = nil
-			}
-			if gc.Tracing.DataDog != nil {
-				log.Warn("DataDog configuration will be ignored")
-				gc.Tracing.DataDog = nil
-			}
-		case zipkin.Name:
-			if gc.Tracing.Zipkin == nil {
-				gc.Tracing.Zipkin = &zipkin.Config{
-					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-					SameSpan:     false,
-					ID128Bit:     true,
-					Debug:        false,
-				}
-			}
-			if gc.Tracing.Jaeger != nil {
-				log.Warn("Jaeger configuration will be ignored")
-				gc.Tracing.Jaeger = nil
-			}
-			if gc.Tracing.DataDog != nil {
-				log.Warn("DataDog configuration will be ignored")
-				gc.Tracing.DataDog = nil
-			}
-		case datadog.Name:
-			if gc.Tracing.DataDog == nil {
-				gc.Tracing.DataDog = &datadog.Config{
-					LocalAgentHostPort: "localhost:8126",
-					GlobalTag:          "",
-					Debug:              false,
-				}
-			}
-			if gc.Tracing.Zipkin != nil {
-				log.Warn("Zipkin configuration will be ignored")
-				gc.Tracing.Zipkin = nil
-			}
-			if gc.Tracing.Jaeger != nil {
-				log.Warn("Jaeger configuration will be ignored")
-				gc.Tracing.Jaeger = nil
-			}
-		default:
-			log.Warnf("Unknown tracer %q", gc.Tracing.Backend)
-			return
-		}
-	}
-}
-
-func (gc *GlobalConfiguration) initACMEProvider() {
-	if gc.ACME != nil {
-		gc.ACME.CAServer = getSafeACMECAServer(gc.ACME.CAServer)
-
-		if gc.ACME.DNSChallenge != nil && gc.ACME.HTTPChallenge != nil {
-			log.Warn("Unable to use DNS challenge and HTTP challenge at the same time. Fallback to DNS challenge.")
-			gc.ACME.HTTPChallenge = nil
-		}
-
-		if gc.ACME.DNSChallenge != nil && gc.ACME.TLSChallenge != nil {
-			log.Warn("Unable to use DNS challenge and TLS challenge at the same time. Fallback to DNS challenge.")
-			gc.ACME.TLSChallenge = nil
-		}
-
-		if gc.ACME.HTTPChallenge != nil && gc.ACME.TLSChallenge != nil {
-			log.Warn("Unable to use HTTP challenge and TLS challenge at the same time. Fallback to TLS challenge.")
-			gc.ACME.HTTPChallenge = nil
-		}
-
-		for _, domain := range gc.ACME.Domains {
-			if domain.Main != lego.UnFqdn(domain.Main) {
-				log.Warnf("FQDN detected, please remove the trailing dot: %s", domain.Main)
-			}
-			for _, san := range domain.SANs {
-				if san != lego.UnFqdn(san) {
-					log.Warnf("FQDN detected, please remove the trailing dot: %s", san)
-				}
-			}
-		}
-
-		// TODO: to remove in the future
-		if len(gc.ACME.StorageFile) > 0 && len(gc.ACME.Storage) == 0 {
-			log.Warn("ACME.StorageFile is deprecated, use ACME.Storage instead")
-			gc.ACME.Storage = gc.ACME.StorageFile
-		}
-
-		if len(gc.ACME.DNSProvider) > 0 {
-			log.Warn("ACME.DNSProvider is deprecated, use ACME.DNSChallenge instead")
-			gc.ACME.DNSChallenge = &acmeprovider.DNSChallenge{Provider: gc.ACME.DNSProvider, DelayBeforeCheck: gc.ACME.DelayDontCheckDNS}
-		}
-
-		if gc.ACME.OnDemand {
-			log.Warn("ACME.OnDemand is deprecated")
-		}
-	}
-}
-
-// InitACMEProvider create an acme provider from the ACME part of globalConfiguration
-func (gc *GlobalConfiguration) InitACMEProvider() (*acmeprovider.Provider, error) {
-	if gc.ACME != nil {
-		if len(gc.ACME.Storage) == 0 {
-			// Delete the ACME configuration to avoid starting ACME in cluster mode
-			gc.ACME = nil
-			return nil, errors.New("unable to initialize ACME provider with no storage location for the certificates")
-		}
-		// TODO: Remove when Provider ACME will replace totally ACME
-		// If provider file, use Provider ACME instead of ACME
-		if gc.Cluster == nil {
-			provider := &acmeprovider.Provider{}
-			provider.Configuration = &acmeprovider.Configuration{
-				KeyType:       gc.ACME.KeyType,
-				OnHostRule:    gc.ACME.OnHostRule,
-				OnDemand:      gc.ACME.OnDemand,
-				Email:         gc.ACME.Email,
-				Storage:       gc.ACME.Storage,
-				HTTPChallenge: gc.ACME.HTTPChallenge,
-				DNSChallenge:  gc.ACME.DNSChallenge,
-				TLSChallenge:  gc.ACME.TLSChallenge,
-				Domains:       gc.ACME.Domains,
-				ACMELogging:   gc.ACME.ACMELogging,
-				CAServer:      gc.ACME.CAServer,
-				EntryPoint:    gc.ACME.EntryPoint,
-			}
-
-			store := acmeprovider.NewLocalStore(provider.Storage)
-			provider.Store = store
-			acme.ConvertToNewFormat(provider.Storage)
-			gc.ACME = nil
-			return provider, nil
-		}
-	}
-	return nil, nil
-}
-
-func getSafeACMECAServer(caServerSrc string) string {
-	if len(caServerSrc) == 0 {
-		return DefaultAcmeCAServer
-	}
-
-	if strings.HasPrefix(caServerSrc, "https://acme-v01.api.letsencrypt.org") {
-		caServer := strings.Replace(caServerSrc, "v01", "v02", 1)
-		log.Warnf("The CA server %[1]q refers to a v01 endpoint of the ACME API, please change to %[2]q. Fallback to %[2]q.", caServerSrc, caServer)
-		return caServer
-	}
-
-	if strings.HasPrefix(caServerSrc, "https://acme-staging.api.letsencrypt.org") {
-		caServer := strings.Replace(caServerSrc, "https://acme-staging.api.letsencrypt.org", "https://acme-staging-v02.api.letsencrypt.org", 1)
-		log.Warnf("The CA server %[1]q refers to a v01 endpoint of the ACME API, please change to %[2]q. Fallback to %[2]q.", caServerSrc, caServer)
-		return caServer
-	}
-
-	return caServerSrc
-}
-
-// ValidateConfiguration validate that configuration is coherent
-func (gc *GlobalConfiguration) ValidateConfiguration() {
-	if gc.ACME != nil {
-		if _, ok := gc.EntryPoints[gc.ACME.EntryPoint]; !ok {
-			log.Fatalf("Unknown entrypoint %q for ACME configuration", gc.ACME.EntryPoint)
-		} else {
-			if gc.EntryPoints[gc.ACME.EntryPoint].TLS == nil {
-				log.Fatalf("Entrypoint %q has no TLS configuration for ACME configuration", gc.ACME.EntryPoint)
-			}
-		}
-	}
-}
-
-// DefaultEntryPoints holds default entry points
-type DefaultEntryPoints []string
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (dep *DefaultEntryPoints) String() string {
-	return strings.Join(*dep, ",")
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (dep *DefaultEntryPoints) Set(value string) error {
-	entrypoints := strings.Split(value, ",")
-	if len(entrypoints) == 0 {
-		return fmt.Errorf("bad DefaultEntryPoints format: %s", value)
-	}
-	for _, entrypoint := range entrypoints {
-		*dep = append(*dep, entrypoint)
-	}
-	return nil
-}
-
-// Get return the EntryPoints map
-func (dep *DefaultEntryPoints) Get() interface{} {
-	return *dep
-}
-
-// SetValue sets the EntryPoints map with val
-func (dep *DefaultEntryPoints) SetValue(val interface{}) {
-	*dep = val.(DefaultEntryPoints)
-}
-
-// Type is type of the struct
-func (dep *DefaultEntryPoints) Type() string {
-	return "defaultentrypoints"
-}
-
-// Retry contains request retry config
-type Retry struct {
-	Attempts int `description:"Number of attempts" export:"true"`
-}
-
-// HealthCheckConfig contains health check configuration parameters.
-type HealthCheckConfig struct {
-	Interval flaeg.Duration `description:"Default periodicity of enabled health checks" export:"true"`
-}
-
-// RespondingTimeouts contains timeout configurations for incoming requests to the Traefik instance.
-type RespondingTimeouts struct {
-	ReadTimeout  flaeg.Duration `description:"ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set" export:"true"`
-	WriteTimeout flaeg.Duration `description:"WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set" export:"true"`
-	IdleTimeout  flaeg.Duration `description:"IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. Defaults to 180 seconds. If zero, no timeout is set" export:"true"`
-}
-
-// ForwardingTimeouts contains timeout configurations for forwarding requests to the backend servers.
-type ForwardingTimeouts struct {
-	DialTimeout           flaeg.Duration `description:"The amount of time to wait until a connection to a backend server can be established. Defaults to 30 seconds. If zero, no timeout exists" export:"true"`
-	ResponseHeaderTimeout flaeg.Duration `description:"The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists" export:"true"`
-}
-
-// LifeCycle contains configurations relevant to the lifecycle (such as the
-// shutdown phase) of Traefik.
-type LifeCycle struct {
-	RequestAcceptGraceTimeout flaeg.Duration `description:"Duration to keep accepting requests before Traefik initiates the graceful shutdown procedure"`
-	GraceTimeOut              flaeg.Duration `description:"Duration to give active requests a chance to finish before Traefik stops"`
-}
-
-// HostResolverConfig contain configuration for CNAME Flattening
-type HostResolverConfig struct {
-	CnameFlattening bool   `description:"A flag to enable/disable CNAME flattening" export:"true"`
-	ResolvConfig    string `description:"resolv.conf used for DNS resolving" export:"true"`
-	ResolvDepth     int    `description:"The maximal depth of DNS recursive resolving" export:"true"`
-}

configuration/configuration_test.go

@@ -1,268 +0,0 @@
-package configuration
-
-import (
-	"testing"
-	"time"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/file"
-	"github.com/stretchr/testify/assert"
-)
-
-const defaultConfigFile = "traefik.toml"
-
-func TestSetEffectiveConfigurationGraceTimeout(t *testing.T) {
-	testCases := []struct {
-		desc                  string
-		legacyGraceTimeout    time.Duration
-		lifeCycleGraceTimeout time.Duration
-		wantGraceTimeout      time.Duration
-	}{
-		{
-			desc:               "legacy grace timeout given only",
-			legacyGraceTimeout: 5 * time.Second,
-			wantGraceTimeout:   5 * time.Second,
-		},
-		{
-			desc:                  "legacy and life cycle grace timeouts given",
-			legacyGraceTimeout:    5 * time.Second,
-			lifeCycleGraceTimeout: 12 * time.Second,
-			wantGraceTimeout:      5 * time.Second,
-		},
-		{
-			desc:                  "legacy grace timeout omitted",
-			legacyGraceTimeout:    0,
-			lifeCycleGraceTimeout: 12 * time.Second,
-			wantGraceTimeout:      12 * time.Second,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			gc := &GlobalConfiguration{
-				GraceTimeOut: flaeg.Duration(test.legacyGraceTimeout),
-			}
-			if test.lifeCycleGraceTimeout > 0 {
-				gc.LifeCycle = &LifeCycle{
-					GraceTimeOut: flaeg.Duration(test.lifeCycleGraceTimeout),
-				}
-			}
-
-			gc.SetEffectiveConfiguration(defaultConfigFile)
-
-			assert.Equal(t, test.wantGraceTimeout, time.Duration(gc.LifeCycle.GraceTimeOut))
-		})
-	}
-}
-
-func TestSetEffectiveConfigurationFileProviderFilename(t *testing.T) {
-	testCases := []struct {
-		desc                        string
-		fileProvider                *file.Provider
-		wantFileProviderFilename    string
-		wantFileProviderTraefikFile string
-	}{
-		{
-			desc:                        "no filename for file provider given",
-			fileProvider:                &file.Provider{},
-			wantFileProviderFilename:    "",
-			wantFileProviderTraefikFile: defaultConfigFile,
-		},
-		{
-			desc:                        "filename for file provider given",
-			fileProvider:                &file.Provider{BaseProvider: provider.BaseProvider{Filename: "other.toml"}},
-			wantFileProviderFilename:    "other.toml",
-			wantFileProviderTraefikFile: defaultConfigFile,
-		},
-		{
-			desc:                        "directory for file provider given",
-			fileProvider:                &file.Provider{Directory: "/"},
-			wantFileProviderFilename:    "",
-			wantFileProviderTraefikFile: defaultConfigFile,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			gc := &GlobalConfiguration{
-				File: test.fileProvider,
-			}
-
-			gc.SetEffectiveConfiguration(defaultConfigFile)
-
-			assert.Equal(t, test.wantFileProviderFilename, gc.File.Filename)
-			assert.Equal(t, test.wantFileProviderTraefikFile, gc.File.TraefikFile)
-		})
-	}
-}
-
-func TestSetEffectiveConfigurationTracing(t *testing.T) {
-	testCases := []struct {
-		desc     string
-		tracing  *tracing.Tracing
-		expected *tracing.Tracing
-	}{
-		{
-			desc:     "no tracing configuration",
-			tracing:  &tracing.Tracing{},
-			expected: &tracing.Tracing{},
-		},
-		{
-			desc: "tracing bad backend name",
-			tracing: &tracing.Tracing{
-				Backend: "powpow",
-			},
-			expected: &tracing.Tracing{
-				Backend: "powpow",
-			},
-		},
-		{
-			desc: "tracing jaeger backend name",
-			tracing: &tracing.Tracing{
-				Backend: "jaeger",
-				Zipkin: &zipkin.Config{
-					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-					SameSpan:     false,
-					ID128Bit:     true,
-					Debug:        false,
-				},
-			},
-			expected: &tracing.Tracing{
-				Backend: "jaeger",
-				Jaeger: &jaeger.Config{
-					SamplingServerURL:  "http://localhost:5778/sampling",
-					SamplingType:       "const",
-					SamplingParam:      1.0,
-					LocalAgentHostPort: "127.0.0.1:6831",
-				},
-				Zipkin: nil,
-			},
-		},
-		{
-			desc: "tracing zipkin backend name",
-			tracing: &tracing.Tracing{
-				Backend: "zipkin",
-				Jaeger: &jaeger.Config{
-					SamplingServerURL:  "http://localhost:5778/sampling",
-					SamplingType:       "const",
-					SamplingParam:      1.0,
-					LocalAgentHostPort: "127.0.0.1:6831",
-				},
-			},
-			expected: &tracing.Tracing{
-				Backend: "zipkin",
-				Jaeger:  nil,
-				Zipkin: &zipkin.Config{
-					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-					SameSpan:     false,
-					ID128Bit:     true,
-					Debug:        false,
-				},
-			},
-		},
-		{
-			desc: "tracing zipkin backend name value override",
-			tracing: &tracing.Tracing{
-				Backend: "zipkin",
-				Jaeger: &jaeger.Config{
-					SamplingServerURL:  "http://localhost:5778/sampling",
-					SamplingType:       "const",
-					SamplingParam:      1.0,
-					LocalAgentHostPort: "127.0.0.1:6831",
-				},
-				Zipkin: &zipkin.Config{
-					HTTPEndpoint: "http://powpow:9411/api/v1/spans",
-					SameSpan:     true,
-					ID128Bit:     true,
-					Debug:        true,
-				},
-			},
-			expected: &tracing.Tracing{
-				Backend: "zipkin",
-				Jaeger:  nil,
-				Zipkin: &zipkin.Config{
-					HTTPEndpoint: "http://powpow:9411/api/v1/spans",
-					SameSpan:     true,
-					ID128Bit:     true,
-					Debug:        true,
-				},
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			gc := &GlobalConfiguration{
-				Tracing: test.tracing,
-			}
-
-			gc.SetEffectiveConfiguration(defaultConfigFile)
-
-			assert.Equal(t, test.expected, gc.Tracing)
-		})
-	}
-}
-
-func TestInitACMEProvider(t *testing.T) {
-	testCases := []struct {
-		desc                  string
-		acmeConfiguration     *acme.ACME
-		expectedConfiguration *acmeprovider.Provider
-		noError               bool
-	}{
-		{
-			desc:                  "No ACME configuration",
-			acmeConfiguration:     nil,
-			expectedConfiguration: nil,
-			noError:               true,
-		},
-		{
-			desc:                  "ACME configuration with storage",
-			acmeConfiguration:     &acme.ACME{Storage: "foo/acme.json"},
-			expectedConfiguration: &acmeprovider.Provider{Configuration: &acmeprovider.Configuration{Storage: "foo/acme.json"}},
-			noError:               true,
-		},
-		{
-			desc:                  "ACME configuration with no storage",
-			acmeConfiguration:     &acme.ACME{},
-			expectedConfiguration: nil,
-			noError:               false,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			gc := &GlobalConfiguration{
-				ACME: test.acmeConfiguration,
-			}
-
-			configuration, err := gc.InitACMEProvider()
-
-			assert.True(t, (err == nil) == test.noError)
-
-			if test.expectedConfiguration == nil {
-				assert.Nil(t, configuration)
-			} else {
-				assert.Equal(t, test.expectedConfiguration.Storage, configuration.Storage)
-			}
-		})
-	}
-}

configuration/entrypoints.go

@@ -1,296 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-)
-
-// EntryPoint holds an entry point configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoint struct {
-	Address              string
-	TLS                  *tls.TLS          `export:"true"`
-	Redirect             *types.Redirect   `export:"true"`
-	Auth                 *types.Auth       `export:"true"`
-	WhitelistSourceRange []string          // Deprecated
-	WhiteList            *types.WhiteList  `export:"true"`
-	Compress             bool              `export:"true"`
-	ProxyProtocol        *ProxyProtocol    `export:"true"`
-	ForwardedHeaders     *ForwardedHeaders `export:"true"`
-}
-
-// ProxyProtocol contains Proxy-Protocol configuration
-type ProxyProtocol struct {
-	Insecure   bool `export:"true"`
-	TrustedIPs []string
-}
-
-// ForwardedHeaders Trust client forwarding headers
-type ForwardedHeaders struct {
-	Insecure   bool `export:"true"`
-	TrustedIPs []string
-}
-
-// EntryPoints holds entry points configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoints map[string]*EntryPoint
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (ep EntryPoints) String() string {
-	return fmt.Sprintf("%+v", map[string]*EntryPoint(ep))
-}
-
-// Get return the EntryPoints map
-func (ep *EntryPoints) Get() interface{} {
-	return *ep
-}
-
-// SetValue sets the EntryPoints map with val
-func (ep *EntryPoints) SetValue(val interface{}) {
-	*ep = val.(EntryPoints)
-}
-
-// Type is type of the struct
-func (ep *EntryPoints) Type() string {
-	return "entrypoints"
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (ep *EntryPoints) Set(value string) error {
-	result := parseEntryPointsConfiguration(value)
-
-	var whiteListSourceRange []string
-	if len(result["whitelistsourcerange"]) > 0 {
-		whiteListSourceRange = strings.Split(result["whitelistsourcerange"], ",")
-	}
-
-	compress := toBool(result, "compress")
-
-	configTLS, err := makeEntryPointTLS(result)
-	if err != nil {
-		return err
-	}
-
-	(*ep)[result["name"]] = &EntryPoint{
-		Address:              result["address"],
-		TLS:                  configTLS,
-		Auth:                 makeEntryPointAuth(result),
-		Redirect:             makeEntryPointRedirect(result),
-		Compress:             compress,
-		WhitelistSourceRange: whiteListSourceRange,
-		WhiteList:            makeWhiteList(result),
-		ProxyProtocol:        makeEntryPointProxyProtocol(result),
-		ForwardedHeaders:     makeEntryPointForwardedHeaders(result),
-	}
-
-	return nil
-}
-
-func makeWhiteList(result map[string]string) *types.WhiteList {
-	var wl *types.WhiteList
-	if rawRange, ok := result["whitelist_sourcerange"]; ok {
-		wl = &types.WhiteList{
-			SourceRange:      strings.Split(rawRange, ","),
-			UseXForwardedFor: toBool(result, "whitelist_usexforwardedfor"),
-		}
-	}
-	return wl
-}
-
-func makeEntryPointAuth(result map[string]string) *types.Auth {
-	var basic *types.Basic
-	if v, ok := result["auth_basic_users"]; ok {
-		basic = &types.Basic{
-			Users:        strings.Split(v, ","),
-			RemoveHeader: toBool(result, "auth_basic_removeheader"),
-		}
-	}
-
-	var digest *types.Digest
-	if v, ok := result["auth_digest_users"]; ok {
-		digest = &types.Digest{
-			Users:        strings.Split(v, ","),
-			RemoveHeader: toBool(result, "auth_digest_removeheader"),
-		}
-	}
-
-	var forward *types.Forward
-	if address, ok := result["auth_forward_address"]; ok {
-		var clientTLS *types.ClientTLS
-
-		cert := result["auth_forward_tls_cert"]
-		key := result["auth_forward_tls_key"]
-		insecureSkipVerify := toBool(result, "auth_forward_tls_insecureskipverify")
-
-		if len(cert) > 0 && len(key) > 0 || insecureSkipVerify {
-			clientTLS = &types.ClientTLS{
-				CA:                 result["auth_forward_tls_ca"],
-				CAOptional:         toBool(result, "auth_forward_tls_caoptional"),
-				Cert:               cert,
-				Key:                key,
-				InsecureSkipVerify: insecureSkipVerify,
-			}
-		}
-
-		var authResponseHeaders []string
-		if v, ok := result["auth_forward_authresponseheaders"]; ok {
-			authResponseHeaders = strings.Split(v, ",")
-		}
-
-		forward = &types.Forward{
-			Address:             address,
-			TLS:                 clientTLS,
-			TrustForwardHeader:  toBool(result, "auth_forward_trustforwardheader"),
-			AuthResponseHeaders: authResponseHeaders,
-		}
-	}
-
-	var auth *types.Auth
-	if basic != nil || digest != nil || forward != nil {
-		auth = &types.Auth{
-			Basic:       basic,
-			Digest:      digest,
-			Forward:     forward,
-			HeaderField: result["auth_headerfield"],
-		}
-	}
-
-	return auth
-}
-
-func makeEntryPointProxyProtocol(result map[string]string) *ProxyProtocol {
-	var proxyProtocol *ProxyProtocol
-
-	ppTrustedIPs := result["proxyprotocol_trustedips"]
-	if len(result["proxyprotocol_insecure"]) > 0 || len(ppTrustedIPs) > 0 {
-		proxyProtocol = &ProxyProtocol{
-			Insecure: toBool(result, "proxyprotocol_insecure"),
-		}
-		if len(ppTrustedIPs) > 0 {
-			proxyProtocol.TrustedIPs = strings.Split(ppTrustedIPs, ",")
-		}
-	}
-
-	if proxyProtocol != nil && proxyProtocol.Insecure {
-		log.Warn("ProxyProtocol.Insecure:true is dangerous. Please use 'ProxyProtocol.TrustedIPs:IPs' and remove 'ProxyProtocol.Insecure:true'")
-	}
-
-	return proxyProtocol
-}
-
-func makeEntryPointForwardedHeaders(result map[string]string) *ForwardedHeaders {
-	// TODO must be changed to false by default in the next breaking version.
-	forwardedHeaders := &ForwardedHeaders{Insecure: true}
-	if _, ok := result["forwardedheaders_insecure"]; ok {
-		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
-	}
-
-	fhTrustedIPs := result["forwardedheaders_trustedips"]
-	if len(fhTrustedIPs) > 0 {
-		// TODO must be removed in the next breaking version.
-		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
-		forwardedHeaders.TrustedIPs = strings.Split(fhTrustedIPs, ",")
-	}
-
-	return forwardedHeaders
-}
-
-func makeEntryPointRedirect(result map[string]string) *types.Redirect {
-	var redirect *types.Redirect
-
-	if len(result["redirect_entrypoint"]) > 0 || len(result["redirect_regex"]) > 0 || len(result["redirect_replacement"]) > 0 {
-		redirect = &types.Redirect{
-			EntryPoint:  result["redirect_entrypoint"],
-			Regex:       result["redirect_regex"],
-			Replacement: result["redirect_replacement"],
-			Permanent:   toBool(result, "redirect_permanent"),
-		}
-	}
-
-	return redirect
-}
-
-func makeEntryPointTLS(result map[string]string) (*tls.TLS, error) {
-	var configTLS *tls.TLS
-
-	if len(result["tls"]) > 0 {
-		certs := tls.Certificates{}
-		if err := certs.Set(result["tls"]); err != nil {
-			return nil, err
-		}
-		configTLS = &tls.TLS{
-			Certificates: certs,
-		}
-	} else if len(result["tls_acme"]) > 0 {
-		configTLS = &tls.TLS{
-			Certificates: tls.Certificates{},
-		}
-	}
-
-	if configTLS != nil {
-		if len(result["ca"]) > 0 {
-			files := tls.FilesOrContents{}
-			files.Set(result["ca"])
-			optional := toBool(result, "ca_optional")
-			configTLS.ClientCA = tls.ClientCA{
-				Files:    files,
-				Optional: optional,
-			}
-		}
-
-		if len(result["tls_minversion"]) > 0 {
-			configTLS.MinVersion = result["tls_minversion"]
-		}
-
-		if len(result["tls_ciphersuites"]) > 0 {
-			configTLS.CipherSuites = strings.Split(result["tls_ciphersuites"], ",")
-		}
-
-		if len(result["tls_snistrict"]) > 0 {
-			configTLS.SniStrict = toBool(result, "tls_snistrict")
-		}
-
-		if len(result["tls_defaultcertificate_cert"]) > 0 && len(result["tls_defaultcertificate_key"]) > 0 {
-			configTLS.DefaultCertificate = &tls.Certificate{
-				CertFile: tls.FileOrContent(result["tls_defaultcertificate_cert"]),
-				KeyFile:  tls.FileOrContent(result["tls_defaultcertificate_key"]),
-			}
-		}
-	}
-
-	return configTLS, nil
-}
-
-func parseEntryPointsConfiguration(raw string) map[string]string {
-	sections := strings.Fields(raw)
-
-	config := make(map[string]string)
-	for _, part := range sections {
-		field := strings.SplitN(part, ":", 2)
-		name := strings.ToLower(strings.Replace(field[0], ".", "_", -1))
-		if len(field) > 1 {
-			config[name] = field[1]
-		} else {
-			if strings.EqualFold(name, "TLS") {
-				config["tls_acme"] = "TLS"
-			} else {
-				config[name] = ""
-			}
-		}
-	}
-	return config
-}
-
-func toBool(conf map[string]string, key string) bool {
-	if val, ok := conf[key]; ok {
-		return strings.EqualFold(val, "true") ||
-			strings.EqualFold(val, "enable") ||
-			strings.EqualFold(val, "on")
-	}
-	return false
-}

configuration/entrypoints_test.go

@@ -1,493 +0,0 @@
-package configuration
-
-import (
-	"testing"
-
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_parseEntryPointsConfiguration(t *testing.T) {
-	testCases := []struct {
-		name           string
-		value          string
-		expectedResult map[string]string
-	}{
-		{
-			name: "all parameters",
-			value: "Name:foo " +
-				"Address::8000 " +
-				"TLS:goo,gii " +
-				"TLS " +
-				"TLS.MinVersion:VersionTLS11 " +
-				"TLS.CipherSuites:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA " +
-				"CA:car " +
-				"CA.Optional:true " +
-				"Redirect.EntryPoint:https " +
-				"Redirect.Regex:http://localhost/(.*) " +
-				"Redirect.Replacement:http://mydomain/$1 " +
-				"Redirect.Permanent:true " +
-				"Compress:true " +
-				"ProxyProtocol.TrustedIPs:192.168.0.1 " +
-				"ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"Auth.Basic.RemoveHeader:true " +
-				"Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"Auth.Digest.RemoveHeader:true " +
-				"Auth.HeaderField:X-WebAuth-User " +
-				"Auth.Forward.Address:https://authserver.com/auth " +
-				"Auth.Forward.AuthResponseHeaders:X-Auth,X-Test,X-Secret " +
-				"Auth.Forward.TrustForwardHeader:true " +
-				"Auth.Forward.TLS.CA:path/to/local.crt " +
-				"Auth.Forward.TLS.CAOptional:true " +
-				"Auth.Forward.TLS.Cert:path/to/foo.cert " +
-				"Auth.Forward.TLS.Key:path/to/foo.key " +
-				"Auth.Forward.TLS.InsecureSkipVerify:true " +
-				"WhiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.sourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.useXForwardedFor:true ",
-			expectedResult: map[string]string{
-				"address":                             ":8000",
-				"auth_basic_users":                    "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-				"auth_basic_removeheader":             "true",
-				"auth_digest_users":                   "test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-				"auth_digest_removeheader":            "true",
-				"auth_forward_address":                "https://authserver.com/auth",
-				"auth_forward_authresponseheaders":    "X-Auth,X-Test,X-Secret",
-				"auth_forward_tls_ca":                 "path/to/local.crt",
-				"auth_forward_tls_caoptional":         "true",
-				"auth_forward_tls_cert":               "path/to/foo.cert",
-				"auth_forward_tls_insecureskipverify": "true",
-				"auth_forward_tls_key":                "path/to/foo.key",
-				"auth_forward_trustforwardheader":     "true",
-				"auth_headerfield":                    "X-WebAuth-User",
-				"ca":                                  "car",
-				"ca_optional":                         "true",
-				"compress":                            "true",
-				"forwardedheaders_trustedips":         "10.0.0.3/24,20.0.0.3/24",
-				"name":                                "foo",
-				"proxyprotocol_trustedips":            "192.168.0.1",
-				"redirect_entrypoint":                 "https",
-				"redirect_permanent":                  "true",
-				"redirect_regex":                      "http://localhost/(.*)",
-				"redirect_replacement":                "http://mydomain/$1",
-				"tls":                                 "goo,gii",
-				"tls_acme":                            "TLS",
-				"tls_ciphersuites":                    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
-				"tls_minversion":                      "VersionTLS11",
-				"whitelistsourcerange":                "10.42.0.0/16,152.89.1.33/32,afed:be44::/16",
-				"whitelist_sourcerange":               "10.42.0.0/16,152.89.1.33/32,afed:be44::/16",
-				"whitelist_usexforwardedfor":          "true",
-			},
-		},
-		{
-			name:  "compress on",
-			value: "name:foo Compress:on",
-			expectedResult: map[string]string{
-				"name":     "foo",
-				"compress": "on",
-			},
-		},
-		{
-			name:  "TLS",
-			value: "Name:foo TLS:goo TLS",
-			expectedResult: map[string]string{
-				"name":     "foo",
-				"tls":      "goo",
-				"tls_acme": "TLS",
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			conf := parseEntryPointsConfiguration(test.value)
-
-			assert.Len(t, conf, len(test.expectedResult))
-			assert.Equal(t, test.expectedResult, conf)
-		})
-	}
-}
-
-func Test_toBool(t *testing.T) {
-	testCases := []struct {
-		name         string
-		value        string
-		key          string
-		expectedBool bool
-	}{
-		{
-			name:         "on",
-			value:        "on",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "true",
-			value:        "true",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "enable",
-			value:        "enable",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "arbitrary string",
-			value:        "bar",
-			key:          "foo",
-			expectedBool: false,
-		},
-		{
-			name:         "no existing entry",
-			value:        "bar",
-			key:          "fii",
-			expectedBool: false,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			conf := map[string]string{
-				"foo": test.value,
-			}
-
-			result := toBool(conf, test.key)
-
-			assert.Equal(t, test.expectedBool, result)
-		})
-	}
-}
-
-func TestEntryPoints_Set(t *testing.T) {
-	testCases := []struct {
-		name                   string
-		expression             string
-		expectedEntryPointName string
-		expectedEntryPoint     *EntryPoint
-	}{
-		{
-			name: "all parameters camelcase",
-			expression: "Name:foo " +
-				"Address::8000 " +
-				"TLS:goo,gii;foo,fii " +
-				"TLS " +
-				"TLS.MinVersion:VersionTLS11 " +
-				"TLS.CipherSuites:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA " +
-				"CA:car " +
-				"CA.Optional:true " +
-				"Redirect.EntryPoint:https " +
-				"Redirect.Regex:http://localhost/(.*) " +
-				"Redirect.Replacement:http://mydomain/$1 " +
-				"Redirect.Permanent:true " +
-				"Compress:true " +
-				"ProxyProtocol.TrustedIPs:192.168.0.1 " +
-				"ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"Auth.Basic.RemoveHeader:true " +
-				"Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"Auth.Digest.RemoveHeader:true " +
-				"Auth.HeaderField:X-WebAuth-User " +
-				"Auth.Forward.Address:https://authserver.com/auth " +
-				"Auth.Forward.AuthResponseHeaders:X-Auth,X-Test,X-Secret " +
-				"Auth.Forward.TrustForwardHeader:true " +
-				"Auth.Forward.TLS.CA:path/to/local.crt " +
-				"Auth.Forward.TLS.CAOptional:true " +
-				"Auth.Forward.TLS.Cert:path/to/foo.cert " +
-				"Auth.Forward.TLS.Key:path/to/foo.key " +
-				"Auth.Forward.TLS.InsecureSkipVerify:true " +
-				"WhiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.sourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.useXForwardedFor:true ",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Address: ":8000",
-				TLS: &tls.TLS{
-					MinVersion:   "VersionTLS11",
-					CipherSuites: []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"},
-					Certificates: tls.Certificates{
-						{
-							CertFile: tls.FileOrContent("goo"),
-							KeyFile:  tls.FileOrContent("gii"),
-						},
-						{
-							CertFile: tls.FileOrContent("foo"),
-							KeyFile:  tls.FileOrContent("fii"),
-						},
-					},
-					ClientCA: tls.ClientCA{
-						Files:    tls.FilesOrContents{"car"},
-						Optional: true,
-					},
-				},
-				Redirect: &types.Redirect{
-					EntryPoint:  "https",
-					Regex:       "http://localhost/(.*)",
-					Replacement: "http://mydomain/$1",
-					Permanent:   true,
-				},
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						RemoveHeader: true,
-						Users: types.Users{
-							"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
-							"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-						},
-					},
-					Digest: &types.Digest{
-						RemoveHeader: true,
-						Users: types.Users{
-							"test:traefik:a2688e031edb4be6a3797f3882655c05",
-							"test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-						},
-					},
-					Forward: &types.Forward{
-						Address:             "https://authserver.com/auth",
-						AuthResponseHeaders: []string{"X-Auth", "X-Test", "X-Secret"},
-						TLS: &types.ClientTLS{
-							CA:                 "path/to/local.crt",
-							CAOptional:         true,
-							Cert:               "path/to/foo.cert",
-							Key:                "path/to/foo.key",
-							InsecureSkipVerify: true,
-						},
-						TrustForwardHeader: true,
-					},
-					HeaderField: "X-WebAuth-User",
-				},
-				WhitelistSourceRange: []string{
-					"10.42.0.0/16",
-					"152.89.1.33/32",
-					"afed:be44::/16",
-				},
-				WhiteList: &types.WhiteList{
-					SourceRange: []string{
-						"10.42.0.0/16",
-						"152.89.1.33/32",
-						"afed:be44::/16",
-					},
-					UseXForwardedFor: true,
-				},
-				Compress: true,
-				ProxyProtocol: &ProxyProtocol{
-					Insecure:   false,
-					TrustedIPs: []string{"192.168.0.1"},
-				},
-				ForwardedHeaders: &ForwardedHeaders{
-					Insecure: false,
-					TrustedIPs: []string{
-						"10.0.0.3/24",
-						"20.0.0.3/24",
-					},
-				},
-			},
-		},
-		{
-			name: "all parameters lowercase",
-			expression: "Name:foo " +
-				"address::8000 " +
-				"tls:goo,gii;foo,fii " +
-				"tls " +
-				"tls.minversion:VersionTLS11 " +
-				"tls.ciphersuites:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA " +
-				"ca:car " +
-				"ca.Optional:true " +
-				"redirect.entryPoint:https " +
-				"redirect.regex:http://localhost/(.*) " +
-				"redirect.replacement:http://mydomain/$1 " +
-				"redirect.permanent:true " +
-				"compress:true " +
-				"whiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"proxyProtocol.TrustedIPs:192.168.0.1 " +
-				"forwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"auth.basic.users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"auth.digest.users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"auth.headerField:X-WebAuth-User " +
-				"auth.forward.address:https://authserver.com/auth " +
-				"auth.forward.authResponseHeaders:X-Auth,X-Test,X-Secret " +
-				"auth.forward.trustForwardHeader:true " +
-				"auth.forward.tls.ca:path/to/local.crt " +
-				"auth.forward.tls.caOptional:true " +
-				"auth.forward.tls.cert:path/to/foo.cert " +
-				"auth.forward.tls.key:path/to/foo.key " +
-				"auth.forward.tls.insecureSkipVerify:true ",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Address: ":8000",
-				TLS: &tls.TLS{
-					MinVersion:   "VersionTLS11",
-					CipherSuites: []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA384", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"},
-					Certificates: tls.Certificates{
-						{
-							CertFile: tls.FileOrContent("goo"),
-							KeyFile:  tls.FileOrContent("gii"),
-						},
-						{
-							CertFile: tls.FileOrContent("foo"),
-							KeyFile:  tls.FileOrContent("fii"),
-						},
-					},
-					ClientCA: tls.ClientCA{
-						Files:    tls.FilesOrContents{"car"},
-						Optional: true,
-					},
-				},
-				Redirect: &types.Redirect{
-					EntryPoint:  "https",
-					Regex:       "http://localhost/(.*)",
-					Replacement: "http://mydomain/$1",
-					Permanent:   true,
-				},
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						Users: types.Users{
-							"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
-							"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-						},
-					},
-					Digest: &types.Digest{
-						Users: types.Users{
-							"test:traefik:a2688e031edb4be6a3797f3882655c05",
-							"test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-						},
-					},
-					Forward: &types.Forward{
-						Address:             "https://authserver.com/auth",
-						AuthResponseHeaders: []string{"X-Auth", "X-Test", "X-Secret"},
-						TLS: &types.ClientTLS{
-							CA:                 "path/to/local.crt",
-							CAOptional:         true,
-							Cert:               "path/to/foo.cert",
-							Key:                "path/to/foo.key",
-							InsecureSkipVerify: true,
-						},
-						TrustForwardHeader: true,
-					},
-					HeaderField: "X-WebAuth-User",
-				},
-				WhitelistSourceRange: []string{
-					"10.42.0.0/16",
-					"152.89.1.33/32",
-					"afed:be44::/16",
-				},
-				Compress: true,
-				ProxyProtocol: &ProxyProtocol{
-					Insecure:   false,
-					TrustedIPs: []string{"192.168.0.1"},
-				},
-				ForwardedHeaders: &ForwardedHeaders{
-					Insecure: false,
-					TrustedIPs: []string{
-						"10.0.0.3/24",
-						"20.0.0.3/24",
-					},
-				},
-			},
-		},
-		{
-			name:                   "default",
-			expression:             "Name:foo",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders insecure true",
-			expression:             "Name:foo ForwardedHeaders.Insecure:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders insecure false",
-			expression:             "Name:foo ForwardedHeaders.Insecure:false",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: false},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders TrustedIPs",
-			expression:             "Name:foo ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{
-					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
-				},
-			},
-		},
-		{
-			name:                   "ProxyProtocol insecure true",
-			expression:             "Name:foo ProxyProtocol.Insecure:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol:    &ProxyProtocol{Insecure: true},
-			},
-		},
-		{
-			name:                   "ProxyProtocol insecure false",
-			expression:             "Name:foo ProxyProtocol.Insecure:false",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol:    &ProxyProtocol{},
-			},
-		},
-		{
-			name:                   "ProxyProtocol TrustedIPs",
-			expression:             "Name:foo ProxyProtocol.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol: &ProxyProtocol{
-					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
-				},
-			},
-		},
-		{
-			name:                   "compress on",
-			expression:             "Name:foo Compress:on",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Compress:         true,
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "compress true",
-			expression:             "Name:foo Compress:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Compress:         true,
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			eps := EntryPoints{}
-			err := eps.Set(test.expression)
-			require.NoError(t, err)
-
-			ep := eps[test.expectedEntryPointName]
-			assert.EqualValues(t, test.expectedEntryPoint, ep)
-		})
-	}
-}

configuration/provider_aggregator.go

@@ -1,113 +0,0 @@
-package configuration
-
-import (
-	"encoding/json"
-
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-)
-
-// ProviderAggregator aggregate providers
-type ProviderAggregator struct {
-	providers   []provider.Provider
-	constraints types.Constraints
-}
-
-// NewProviderAggregator return an aggregate of all the providers configured in GlobalConfiguration
-func NewProviderAggregator(gc *GlobalConfiguration) ProviderAggregator {
-	provider := ProviderAggregator{
-		constraints: gc.Constraints,
-	}
-	if gc.Docker != nil {
-		provider.quietAddProvider(gc.Docker)
-	}
-	if gc.Marathon != nil {
-		provider.quietAddProvider(gc.Marathon)
-	}
-	if gc.File != nil {
-		provider.quietAddProvider(gc.File)
-	}
-	if gc.Rest != nil {
-		provider.quietAddProvider(gc.Rest)
-	}
-	if gc.Consul != nil {
-		provider.quietAddProvider(gc.Consul)
-	}
-	if gc.ConsulCatalog != nil {
-		provider.quietAddProvider(gc.ConsulCatalog)
-	}
-	if gc.Etcd != nil {
-		provider.quietAddProvider(gc.Etcd)
-	}
-	if gc.Zookeeper != nil {
-		provider.quietAddProvider(gc.Zookeeper)
-	}
-	if gc.Boltdb != nil {
-		provider.quietAddProvider(gc.Boltdb)
-	}
-	if gc.Kubernetes != nil {
-		provider.quietAddProvider(gc.Kubernetes)
-	}
-	if gc.Mesos != nil {
-		provider.quietAddProvider(gc.Mesos)
-	}
-	if gc.Eureka != nil {
-		provider.quietAddProvider(gc.Eureka)
-	}
-	if gc.ECS != nil {
-		provider.quietAddProvider(gc.ECS)
-	}
-	if gc.Rancher != nil {
-		provider.quietAddProvider(gc.Rancher)
-	}
-	if gc.DynamoDB != nil {
-		provider.quietAddProvider(gc.DynamoDB)
-	}
-	if gc.ServiceFabric != nil {
-		provider.quietAddProvider(gc.ServiceFabric)
-	}
-	return provider
-}
-
-func (p *ProviderAggregator) quietAddProvider(provider provider.Provider) {
-	err := p.AddProvider(provider)
-	if err != nil {
-		log.Errorf("Error initializing provider %T: %v", provider, err)
-	}
-}
-
-// AddProvider add a provider in the providers map
-func (p *ProviderAggregator) AddProvider(provider provider.Provider) error {
-	err := provider.Init(p.constraints)
-	if err != nil {
-		return err
-	}
-	p.providers = append(p.providers, provider)
-	return nil
-}
-
-// Init the provider
-func (p ProviderAggregator) Init(_ types.Constraints) error {
-	return nil
-}
-
-// Provide call the provide method of every providers
-func (p ProviderAggregator) Provide(configurationChan chan<- types.ConfigMessage, pool *safe.Pool) error {
-	for _, p := range p.providers {
-		jsonConf, err := json.Marshal(p)
-		if err != nil {
-			log.Debugf("Unable to marshal provider conf %T with error: %v", p, err)
-		}
-		log.Infof("Starting provider %T %s", p, jsonConf)
-		currentProvider := p
-		safe.Go(func() {
-			err := currentProvider.Provide(configurationChan, pool)
-			if err != nil {
-				log.Errorf("Error starting provider %T: %v", p, err)
-			}
-		})
-	}
-	return nil
-}

configuration/router/internal_router.go

@@ -1,132 +0,0 @@
-package router
-
-import (
-	"github.com/containous/mux"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/metrics"
-	"github.com/containous/traefik/middlewares"
-	mauth "github.com/containous/traefik/middlewares/auth"
-	"github.com/containous/traefik/types"
-	"github.com/urfave/negroni"
-)
-
-// NewInternalRouterAggregator Create a new internalRouterAggregator
-func NewInternalRouterAggregator(globalConfiguration configuration.GlobalConfiguration, entryPointName string) *InternalRouterAggregator {
-	var serverMiddlewares []negroni.Handler
-
-	if globalConfiguration.EntryPoints[entryPointName].WhiteList != nil {
-		ipWhitelistMiddleware, err := middlewares.NewIPWhiteLister(
-			globalConfiguration.EntryPoints[entryPointName].WhiteList.SourceRange,
-			globalConfiguration.EntryPoints[entryPointName].WhiteList.UseXForwardedFor)
-		if err != nil {
-			log.Fatalf("Error creating whitelist middleware: %s", err)
-		}
-		if ipWhitelistMiddleware != nil {
-			serverMiddlewares = append(serverMiddlewares, ipWhitelistMiddleware)
-		}
-	}
-
-	if globalConfiguration.EntryPoints[entryPointName].Auth != nil {
-		authMiddleware, err := mauth.NewAuthenticator(globalConfiguration.EntryPoints[entryPointName].Auth, nil)
-		if err != nil {
-			log.Fatalf("Error creating authenticator middleware: %s", err)
-		}
-		serverMiddlewares = append(serverMiddlewares, authMiddleware)
-	}
-
-	router := InternalRouterAggregator{}
-	routerWithPrefix := InternalRouterAggregator{}
-	routerWithPrefixAndMiddleware := InternalRouterAggregator{}
-
-	if globalConfiguration.Metrics != nil && globalConfiguration.Metrics.Prometheus != nil && globalConfiguration.Metrics.Prometheus.EntryPoint == entryPointName {
-		routerWithPrefixAndMiddleware.AddRouter(metrics.PrometheusHandler{})
-	}
-
-	if globalConfiguration.Rest != nil && globalConfiguration.Rest.EntryPoint == entryPointName {
-		routerWithPrefixAndMiddleware.AddRouter(globalConfiguration.Rest)
-	}
-
-	if globalConfiguration.API != nil && globalConfiguration.API.EntryPoint == entryPointName {
-		routerWithPrefixAndMiddleware.AddRouter(globalConfiguration.API)
-	}
-
-	if globalConfiguration.Ping != nil && globalConfiguration.Ping.EntryPoint == entryPointName {
-		routerWithPrefix.AddRouter(globalConfiguration.Ping)
-	}
-
-	if globalConfiguration.ACME != nil && globalConfiguration.ACME.HTTPChallenge != nil && globalConfiguration.ACME.HTTPChallenge.EntryPoint == entryPointName {
-		router.AddRouter(globalConfiguration.ACME)
-	}
-
-	realRouterWithMiddleware := WithMiddleware{router: &routerWithPrefixAndMiddleware, routerMiddlewares: serverMiddlewares}
-	if globalConfiguration.Web != nil && globalConfiguration.Web.Path != "" {
-		router.AddRouter(&WithPrefix{PathPrefix: globalConfiguration.Web.Path, Router: &routerWithPrefix})
-		router.AddRouter(&WithPrefix{PathPrefix: globalConfiguration.Web.Path, Router: &realRouterWithMiddleware})
-	} else {
-		router.AddRouter(&routerWithPrefix)
-		router.AddRouter(&realRouterWithMiddleware)
-	}
-
-	return &router
-}
-
-// WithMiddleware router with internal middleware
-type WithMiddleware struct {
-	router            types.InternalRouter
-	routerMiddlewares []negroni.Handler
-}
-
-// AddRoutes Add routes to the router
-func (wm *WithMiddleware) AddRoutes(systemRouter *mux.Router) {
-	realRouter := systemRouter.PathPrefix("/").Subrouter()
-
-	wm.router.AddRoutes(realRouter)
-
-	if len(wm.routerMiddlewares) > 0 {
-		realRouter.Walk(wrapRoute(wm.routerMiddlewares))
-	}
-}
-
-// WithPrefix router which add a prefix
-type WithPrefix struct {
-	Router     types.InternalRouter
-	PathPrefix string
-}
-
-// AddRoutes Add routes to the router
-func (wp *WithPrefix) AddRoutes(systemRouter *mux.Router) {
-	realRouter := systemRouter.PathPrefix("/").Subrouter()
-	if wp.PathPrefix != "" {
-		realRouter = systemRouter.PathPrefix(wp.PathPrefix).Subrouter()
-		realRouter.StrictSlash(true)
-		realRouter.SkipClean(true)
-	}
-	wp.Router.AddRoutes(realRouter)
-}
-
-// InternalRouterAggregator InternalRouter that aggregate other internalRouter
-type InternalRouterAggregator struct {
-	internalRouters []types.InternalRouter
-}
-
-// AddRouter add a router in the aggregator
-func (r *InternalRouterAggregator) AddRouter(router types.InternalRouter) {
-	r.internalRouters = append(r.internalRouters, router)
-}
-
-// AddRoutes Add routes to the router
-func (r *InternalRouterAggregator) AddRoutes(systemRouter *mux.Router) {
-	for _, router := range r.internalRouters {
-		router.AddRoutes(systemRouter)
-	}
-}
-
-// wrapRoute with middlewares
-func wrapRoute(middlewares []negroni.Handler) func(*mux.Route, *mux.Router, []*mux.Route) error {
-	return func(route *mux.Route, router *mux.Router, ancestors []*mux.Route) error {
-		middles := append(middlewares, negroni.Wrap(route.GetHandler()))
-		route.Handler(negroni.New(middles...))
-		return nil
-	}
-}

configuration/router/internal_router_test.go

@@ -1,346 +0,0 @@
-package router
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/containous/mux"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/ping"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/urfave/negroni"
-)
-
-func TestNewInternalRouterAggregatorWithWebPath(t *testing.T) {
-	currentConfiguration := &safe.Safe{}
-	currentConfiguration.Set(types.Configurations{})
-
-	globalConfiguration := configuration.GlobalConfiguration{
-		Web: &configuration.WebCompatibility{
-			Path: "/prefix",
-		},
-		API: &api.Handler{
-			EntryPoint:            "traefik",
-			CurrentConfigurations: currentConfiguration,
-		},
-		Ping: &ping.Handler{
-			EntryPoint: "traefik",
-		},
-		ACME: &acme.ACME{
-			HTTPChallenge: &acmeprovider.HTTPChallenge{
-				EntryPoint: "traefik",
-			},
-		},
-		EntryPoints: configuration.EntryPoints{
-			"traefik": &configuration.EntryPoint{},
-		},
-	}
-
-	testCases := []struct {
-		desc               string
-		testedURL          string
-		expectedStatusCode int
-	}{
-		{
-			desc:               "Ping without prefix",
-			testedURL:          "/ping",
-			expectedStatusCode: 502,
-		},
-		{
-			desc:               "Ping with prefix",
-			testedURL:          "/prefix/ping",
-			expectedStatusCode: 200,
-		},
-		{
-			desc:               "acme without prefix",
-			testedURL:          "/.well-known/acme-challenge/token",
-			expectedStatusCode: 404,
-		},
-		{
-			desc:               "api without prefix",
-			testedURL:          "/api",
-			expectedStatusCode: 502,
-		},
-		{
-			desc:               "api with prefix",
-			testedURL:          "/prefix/api",
-			expectedStatusCode: 200,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			router := NewInternalRouterAggregator(globalConfiguration, "traefik")
-
-			internalMuxRouter := mux.NewRouter()
-			router.AddRoutes(internalMuxRouter)
-			internalMuxRouter.NotFoundHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(http.StatusBadGateway)
-			})
-
-			recorder := httptest.NewRecorder()
-			request := httptest.NewRequest(http.MethodGet, test.testedURL, nil)
-			internalMuxRouter.ServeHTTP(recorder, request)
-
-			assert.Equal(t, test.expectedStatusCode, recorder.Code)
-		})
-	}
-}
-
-func TestNewInternalRouterAggregatorWithAuth(t *testing.T) {
-	currentConfiguration := &safe.Safe{}
-	currentConfiguration.Set(types.Configurations{})
-
-	globalConfiguration := configuration.GlobalConfiguration{
-		API: &api.Handler{
-			EntryPoint:            "traefik",
-			CurrentConfigurations: currentConfiguration,
-		},
-		Ping: &ping.Handler{
-			EntryPoint: "traefik",
-		},
-		ACME: &acme.ACME{
-			HTTPChallenge: &acmeprovider.HTTPChallenge{
-				EntryPoint: "traefik",
-			},
-		},
-		EntryPoints: configuration.EntryPoints{
-			"traefik": &configuration.EntryPoint{
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						Users: types.Users{"test:test"},
-					},
-				},
-			},
-		},
-	}
-
-	testCases := []struct {
-		desc               string
-		testedURL          string
-		expectedStatusCode int
-	}{
-		{
-			desc:               "Wrong url",
-			testedURL:          "/wrong",
-			expectedStatusCode: 502,
-		},
-		{
-			desc:               "Ping without auth",
-			testedURL:          "/ping",
-			expectedStatusCode: 200,
-		},
-		{
-			desc:               "acme without auth",
-			testedURL:          "/.well-known/acme-challenge/token",
-			expectedStatusCode: 404,
-		},
-		{
-			desc:               "api with auth",
-			testedURL:          "/api",
-			expectedStatusCode: 401,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			router := NewInternalRouterAggregator(globalConfiguration, "traefik")
-
-			internalMuxRouter := mux.NewRouter()
-			router.AddRoutes(internalMuxRouter)
-			internalMuxRouter.NotFoundHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(http.StatusBadGateway)
-			})
-
-			recorder := httptest.NewRecorder()
-			request := httptest.NewRequest(http.MethodGet, test.testedURL, nil)
-			internalMuxRouter.ServeHTTP(recorder, request)
-
-			assert.Equal(t, test.expectedStatusCode, recorder.Code)
-		})
-	}
-}
-
-func TestNewInternalRouterAggregatorWithAuthAndPrefix(t *testing.T) {
-	currentConfiguration := &safe.Safe{}
-	currentConfiguration.Set(types.Configurations{})
-
-	globalConfiguration := configuration.GlobalConfiguration{
-		Web: &configuration.WebCompatibility{
-			Path: "/prefix",
-		},
-		API: &api.Handler{
-			EntryPoint:            "traefik",
-			CurrentConfigurations: currentConfiguration,
-		},
-		Ping: &ping.Handler{
-			EntryPoint: "traefik",
-		},
-		ACME: &acme.ACME{
-			HTTPChallenge: &acmeprovider.HTTPChallenge{
-				EntryPoint: "traefik",
-			},
-		},
-		EntryPoints: configuration.EntryPoints{
-			"traefik": &configuration.EntryPoint{
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						Users: types.Users{"test:test"},
-					},
-				},
-			},
-		},
-	}
-
-	testCases := []struct {
-		desc               string
-		testedURL          string
-		expectedStatusCode int
-	}{
-		{
-			desc:               "Ping without prefix",
-			testedURL:          "/ping",
-			expectedStatusCode: 502,
-		},
-		{
-			desc:               "Ping without auth and with prefix",
-			testedURL:          "/prefix/ping",
-			expectedStatusCode: 200,
-		},
-		{
-			desc:               "acme without auth and without prefix",
-			testedURL:          "/.well-known/acme-challenge/token",
-			expectedStatusCode: 404,
-		},
-		{
-			desc:               "api with auth and prefix",
-			testedURL:          "/prefix/api",
-			expectedStatusCode: 401,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			router := NewInternalRouterAggregator(globalConfiguration, "traefik")
-
-			internalMuxRouter := mux.NewRouter()
-			router.AddRoutes(internalMuxRouter)
-			internalMuxRouter.NotFoundHandler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(http.StatusBadGateway)
-			})
-
-			recorder := httptest.NewRecorder()
-			request := httptest.NewRequest(http.MethodGet, test.testedURL, nil)
-			internalMuxRouter.ServeHTTP(recorder, request)
-
-			assert.Equal(t, test.expectedStatusCode, recorder.Code)
-		})
-	}
-}
-
-type MockInternalRouterFunc func(systemRouter *mux.Router)
-
-func (m MockInternalRouterFunc) AddRoutes(systemRouter *mux.Router) {
-	m(systemRouter)
-}
-
-func TestWithMiddleware(t *testing.T) {
-	router := WithMiddleware{
-		router: MockInternalRouterFunc(func(systemRouter *mux.Router) {
-			systemRouter.Handle("/test", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.Write([]byte("router"))
-			}))
-		}),
-		routerMiddlewares: []negroni.Handler{
-			negroni.HandlerFunc(func(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-				rw.Write([]byte("before middleware1|"))
-				next.ServeHTTP(rw, r)
-				rw.Write([]byte("|after middleware1"))
-
-			}),
-			negroni.HandlerFunc(func(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-				rw.Write([]byte("before middleware2|"))
-				next.ServeHTTP(rw, r)
-				rw.Write([]byte("|after middleware2"))
-			}),
-		},
-	}
-
-	internalMuxRouter := mux.NewRouter()
-	router.AddRoutes(internalMuxRouter)
-
-	recorder := httptest.NewRecorder()
-	request := httptest.NewRequest(http.MethodGet, "/test", nil)
-	internalMuxRouter.ServeHTTP(recorder, request)
-
-	obtained := recorder.Body.String()
-
-	assert.Equal(t, "before middleware1|before middleware2|router|after middleware2|after middleware1", obtained)
-}
-
-func TestWithPrefix(t *testing.T) {
-	testCases := []struct {
-		desc               string
-		prefix             string
-		testedURL          string
-		expectedStatusCode int
-	}{
-		{
-			desc:               "No prefix",
-			testedURL:          "/test",
-			expectedStatusCode: 200,
-		},
-		{
-			desc:               "With prefix and wrong url",
-			prefix:             "/prefix",
-			testedURL:          "/test",
-			expectedStatusCode: 404,
-		},
-		{
-			desc:               "With prefix",
-			prefix:             "/prefix",
-			testedURL:          "/prefix/test",
-			expectedStatusCode: 200,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			router := WithPrefix{
-				Router: MockInternalRouterFunc(func(systemRouter *mux.Router) {
-					systemRouter.Handle("/test", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-						w.WriteHeader(http.StatusOK)
-					}))
-				}),
-
-				PathPrefix: test.prefix,
-			}
-			internalMuxRouter := mux.NewRouter()
-			router.AddRoutes(internalMuxRouter)
-
-			recorder := httptest.NewRecorder()
-			request := httptest.NewRequest(http.MethodGet, test.testedURL, nil)
-			internalMuxRouter.ServeHTTP(recorder, request)
-
-			assert.Equal(t, test.expectedStatusCode, recorder.Code)
-		})
-	}
-}

contrib/scripts/dumpcerts.sh

@@ -1,170 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2017 Brian 'redbeard' Harrington <redbeard@dead-city.org>
-#
-# dumpcerts.sh - A simple utility to explode a Traefik acme.json file into a
-#                directory of certificates and a private key
-#
-# Usage - dumpcerts.sh /etc/traefik/acme.json /etc/ssl/
-#
-# Dependencies -
-#   util-linux
-#   openssl
-#   jq
-# The MIT License (MIT)
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-
-# Exit codes:
-# 1 - A component is missing or could not be read
-# 2 - There was a problem reading acme.json
-# 4 - The destination certificate directory does not exist
-# 8 - Missing private key
-
-set -o errexit
-set -o pipefail
-set -o nounset
-
-USAGE="$(basename "$0") <path to acme> <destination cert directory>"
-
-# Platform variations
-case "$(uname)" in
-	'Linux')
-		# On Linux, -d should always work. --decode does not work with Alpine's busybox-binary
-		CMD_DECODE_BASE64="base64 -d"
-		;;
-	*)
-		# Max OS-X supports --decode and -D, but --decode may be supported by other platforms as well.
-		CMD_DECODE_BASE64="base64 --decode"
-		;;
-esac
-
-# Allow us to exit on a missing jq binary
-exit_jq() {
-	echo "
-You must have the binary 'jq' to use this.
-jq is available at: https://stedolan.github.io/jq/download/
-
-${USAGE}" >&2
-	exit 1
-}
-
-bad_acme() {
-	echo "
-There was a problem parsing your acme.json file.
-
-${USAGE}" >&2
-	exit 2
-}
-
-if [ $# -ne 2 ]; then
-	echo "
-Insufficient number of parameters.
-
-${USAGE}" >&2
-	exit 1
-fi
-
-readonly acmefile="${1}"
-readonly certdir="${2%/}"
-
-if [ ! -r "${acmefile}" ]; then
-	echo "
-There was a problem reading from '${acmefile}'
-We need to read this file to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 2
-fi
-
-
-if [ ! -d "${certdir}" ]; then
-	echo "
-Path ${certdir} does not seem to be a directory
-We need a directory in which to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 4
-fi
-
-jq=$(command -v jq) || exit_jq
-
-priv=$(${jq} -e -r '.Account.PrivateKey' "${acmefile}") || bad_acme
-
-if [ ! -n "${priv}" ]; then
-	echo "
-There didn't seem to be a private key in ${acmefile}.
-Please ensure that there is a key in this file and try again." >&2
-	exit 8
-fi
-
-# If they do not exist, create the needed subdirectories for our assets
-# and place each in a variable for later use, normalizing the path
-mkdir -p "${certdir}"/{certs,private}
-
-pdir="${certdir}/private/"
-cdir="${certdir}/certs/"
-
-# Save the existing umask, change the default mode to 600, then
-# after writing the private key switch it back to the default
-oldumask=$(umask)
-umask 177
-trap 'umask ${oldumask}' EXIT
-
-# traefik stores the private key in stripped base64 format but the certificates
-# bundled as a base64 object without stripping headers.  This normalizes the
-# headers and formatting.
-#
-# In testing this out it was a balance between the following mechanisms:
-# gawk:
-#  echo ${priv} | awk 'BEGIN {print "-----BEGIN RSA PRIVATE KEY-----"}
-#     {gsub(/.{64}/,"&\n")}1
-#     END {print "-----END RSA PRIVATE KEY-----"}' > "${pdir}/letsencrypt.key"
-#
-# openssl:
-# echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-#   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-#
-# and sed:
-# echo "-----BEGIN RSA PRIVATE KEY-----" > "${pdir}/letsencrypt.key"
-# echo ${priv} | sed -E 's/(.{64})/\1\n/g' >> "${pdir}/letsencrypt.key"
-# sed -i '$ d' "${pdir}/letsencrypt.key"
-# echo "-----END RSA PRIVATE KEY-----" >> "${pdir}/letsencrypt.key"
-# openssl rsa -noout -in "${pdir}/letsencrypt.key" -check  # To check if the key is valid
-
-# In the end, openssl was chosen because most users will need this script
-# *because* of openssl combined with the fact that it will refuse to write the
-# key if it does not parse out correctly. The other mechanisms were left as
-# comments so that the user can choose the mechanism most appropriate to them.
-echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-
-# Process the certificates for each of the domains in acme.json
-for domain in $(jq -r '.Certificates[].Domain.Main' ${acmefile}); do
-	# Traefik stores a cert bundle for each domain.  Within this cert
-	# bundle there is both proper the certificate and the Let's Encrypt CA
-	echo "Extracting cert bundle for ${domain}"
-	cert=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-         	select (.Domain.Main == $domain )| .Certificate' ${acmefile}) || bad_acme
-	echo "${cert}" | ${CMD_DECODE_BASE64} > "${cdir}/${domain}.crt"
-
-	echo "Extracting private key for ${domain}"
-	key=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-		select (.Domain.Main == $domain )| .Key' ${acmefile}) || bad_acme
-	echo "${key}" | ${CMD_DECODE_BASE64} > "${pdir}/${domain}.key"
-done

contrib/systemd/traefik.service

@@ -1,11 +1,41 @@
 [Unit]
 Description=Traefik
+Documentation=https://doc.traefik.io/traefik/
+#After=network-online.target
+#AssertFileIsExecutable=/usr/bin/traefik
+#AssertPathExists=/etc/traefik/traefik.toml
 
 [Service]
+# Run traefik as its own user (create new user with: useradd -r -s /bin/false -U -M traefik)
+#User=traefik
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+# configure service behavior
 Type=notify
-ExecStart=/usr/bin/traefik --configFile=/etc/traefik.toml
+#ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.toml
 Restart=always
 WatchdogSec=1s
 
+# lock down system access
+# prohibit any operating system and configuration modification
+#ProtectSystem=strict
+# create separate, new (and empty) /tmp and /var/tmp filesystems
+#PrivateTmp=true
+# make /home directories inaccessible
+#ProtectHome=true
+# turns off access to physical devices (/dev/...)
+#PrivateDevices=true
+# make kernel settings (procfs and sysfs) read-only
+#ProtectKernelTunables=true
+# make cgroups /sys/fs/cgroup read-only
+#ProtectControlGroups=true
+
+# allow writing of acme.json
+#ReadWritePaths=/etc/traefik/acme.json
+# depending on log and entrypoint configuration, you may need to allow writing to other paths, too
+
+# limit number of processes in this unit
+#LimitNPROC=1
+
 [Install]
 WantedBy=multi-user.target

docs.Dockerfile

@@ -1,10 +0,0 @@
-FROM alpine:3.7
-
-ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/.local/bin
-
-COPY requirements.txt /mkdocs/
-WORKDIR /mkdocs
-VOLUME /mkdocs
-
-RUN apk --no-cache --no-progress add py-pip \
-  && pip install --user -r requirements.txt

docs/.dockerignore

@@ -0,0 +1 @@
+site/

docs/.markdownlint.json

@@ -0,0 +1,13 @@
+{
+    "no-hard-tabs": false,
+    "MD007": { "indent": 4 },
+    "MD009": false,
+    "MD013": false,
+    "MD024": false,
+    "MD025": false,
+    "MD026": false,
+    "MD033": false,
+    "MD034": false,
+    "MD036": false,
+    "MD046": false
+}

docs/CNAME

@@ -1 +0,0 @@
-docs.traefik.io

docs/Makefile

@@ -0,0 +1,65 @@
+#######
+# This Makefile contains all targets related to the documentation
+#######
+
+DOCS_VERIFY_SKIP ?= false
+DOCS_LINT_SKIP ?= false
+
+TRAEFIK_DOCS_BUILD_IMAGE ?= traefik-docs
+TRAEFIK_DOCS_CHECK_IMAGE ?= $(TRAEFIK_DOCS_BUILD_IMAGE)-check
+
+SITE_DIR := $(CURDIR)/site
+
+DOCKER_RUN_DOC_PORT := 8000
+DOCKER_RUN_DOC_MOUNTS := -v $(CURDIR):/mkdocs
+DOCKER_RUN_DOC_OPTS := --rm $(DOCKER_RUN_DOC_MOUNTS) -p $(DOCKER_RUN_DOC_PORT):8000
+
+# Default: generates the documentation into $(SITE_DIR)
+.PHONY: docs
+docs: docs-clean docs-image docs-lint docs-build docs-verify
+
+# Writer Mode: build and serve docs on http://localhost:8000 with livereload
+.PHONY: docs-serve
+docs-serve: docs-image
+	docker run  $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOCS_BUILD_IMAGE) mkdocs serve -a 0.0.0.0:8000
+
+## Pull image for doc building
+.PHONY: docs-pull-images
+docs-pull-images:
+	grep --no-filename -E '^FROM' ./*.Dockerfile \
+		| awk '{print $$2}' \
+		| sort \
+		| uniq \
+		| xargs -P 6 -n 1 docker pull
+
+# Utilities Targets for each step
+.PHONY: docs-image
+docs-image:
+	docker build -t $(TRAEFIK_DOCS_BUILD_IMAGE) -f docs.Dockerfile ./
+
+.PHONY: docs-build
+docs-build: docs-image
+	docker run $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOCS_BUILD_IMAGE) sh -c "mkdocs build \
+		&& chown -R $(shell id -u):$(shell id -g) ./site"
+
+.PHONY: docs-verify
+docs-verify: docs-build
+ifneq ("$(DOCS_VERIFY_SKIP)", "true")
+	docker build -t $(TRAEFIK_DOCS_CHECK_IMAGE) -f check.Dockerfile ./
+	docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOCS_CHECK_IMAGE) /verify.sh
+else
+	echo "DOCS_VERIFY_SKIP is true: no verification done."
+endif
+
+.PHONY: docs-lint
+docs-lint:
+ifneq ("$(DOCS_LINT_SKIP)", "true")
+	docker build -t $(TRAEFIK_DOCS_CHECK_IMAGE) -f check.Dockerfile ./
+	docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOCS_CHECK_IMAGE) /lint.sh
+else
+	echo "DOCS_LINT_SKIP is true: no linting done."
+endif
+
+.PHONY: docs-clean
+docs-clean:
+	rm -rf $(SITE_DIR)