1package static 2 3import ( 4 "fmt" 5 stdlog "log" 6 "strings" 7 "time" 8 9 legolog "github.com/go-acme/lego/v4/log" 10 "github.com/sirupsen/logrus" 11 ptypes "github.com/traefik/paerser/types" 12 "github.com/traefik/traefik/v2/pkg/log" 13 "github.com/traefik/traefik/v2/pkg/ping" 14 acmeprovider "github.com/traefik/traefik/v2/pkg/provider/acme" 15 "github.com/traefik/traefik/v2/pkg/provider/consulcatalog" 16 "github.com/traefik/traefik/v2/pkg/provider/docker" 17 "github.com/traefik/traefik/v2/pkg/provider/ecs" 18 "github.com/traefik/traefik/v2/pkg/provider/file" 19 "github.com/traefik/traefik/v2/pkg/provider/http" 20 "github.com/traefik/traefik/v2/pkg/provider/kubernetes/crd" 21 "github.com/traefik/traefik/v2/pkg/provider/kubernetes/gateway" 22 "github.com/traefik/traefik/v2/pkg/provider/kubernetes/ingress" 23 "github.com/traefik/traefik/v2/pkg/provider/kv/consul" 24 "github.com/traefik/traefik/v2/pkg/provider/kv/etcd" 25 "github.com/traefik/traefik/v2/pkg/provider/kv/redis" 26 "github.com/traefik/traefik/v2/pkg/provider/kv/zk" 27 "github.com/traefik/traefik/v2/pkg/provider/marathon" 28 "github.com/traefik/traefik/v2/pkg/provider/rancher" 29 "github.com/traefik/traefik/v2/pkg/provider/rest" 30 "github.com/traefik/traefik/v2/pkg/tls" 31 "github.com/traefik/traefik/v2/pkg/tracing/datadog" 32 "github.com/traefik/traefik/v2/pkg/tracing/elastic" 33 "github.com/traefik/traefik/v2/pkg/tracing/haystack" 34 "github.com/traefik/traefik/v2/pkg/tracing/instana" 35 "github.com/traefik/traefik/v2/pkg/tracing/jaeger" 36 "github.com/traefik/traefik/v2/pkg/tracing/zipkin" 37 "github.com/traefik/traefik/v2/pkg/types" 38) 39 40const ( 41 // DefaultInternalEntryPointName the name of the default internal entry point. 42 DefaultInternalEntryPointName = "traefik" 43 44 // DefaultGraceTimeout controls how long Traefik serves pending requests 45 // prior to shutting down. 46 DefaultGraceTimeout = 10 * time.Second 47 48 // DefaultIdleTimeout before closing an idle connection. 49 DefaultIdleTimeout = 180 * time.Second 50 51 // DefaultAcmeCAServer is the default ACME API endpoint. 52 DefaultAcmeCAServer = "https://acme-v02.api.letsencrypt.org/directory" 53 54 // DefaultUDPTimeout defines how long to wait by default on an idle session, 55 // before releasing all resources related to that session. 56 DefaultUDPTimeout = 3 * time.Second 57) 58 59// Configuration is the static configuration. 60type Configuration struct { 61 Global *Global `description:"Global configuration options" json:"global,omitempty" toml:"global,omitempty" yaml:"global,omitempty" export:"true"` 62 63 ServersTransport *ServersTransport `description:"Servers default transport." json:"serversTransport,omitempty" toml:"serversTransport,omitempty" yaml:"serversTransport,omitempty" export:"true"` 64 EntryPoints EntryPoints `description:"Entry points definition." json:"entryPoints,omitempty" toml:"entryPoints,omitempty" yaml:"entryPoints,omitempty" export:"true"` 65 Providers *Providers `description:"Providers configuration." json:"providers,omitempty" toml:"providers,omitempty" yaml:"providers,omitempty" export:"true"` 66 67 API *API `description:"Enable api/dashboard." json:"api,omitempty" toml:"api,omitempty" yaml:"api,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 68 Metrics *types.Metrics `description:"Enable a metrics exporter." json:"metrics,omitempty" toml:"metrics,omitempty" yaml:"metrics,omitempty" export:"true"` 69 Ping *ping.Handler `description:"Enable ping." json:"ping,omitempty" toml:"ping,omitempty" yaml:"ping,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 70 71 Log *types.TraefikLog `description:"Traefik log settings." json:"log,omitempty" toml:"log,omitempty" yaml:"log,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 72 AccessLog *types.AccessLog `description:"Access log settings." json:"accessLog,omitempty" toml:"accessLog,omitempty" yaml:"accessLog,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 73 Tracing *Tracing `description:"OpenTracing configuration." json:"tracing,omitempty" toml:"tracing,omitempty" yaml:"tracing,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 74 75 HostResolver *types.HostResolverConfig `description:"Enable CNAME Flattening." json:"hostResolver,omitempty" toml:"hostResolver,omitempty" yaml:"hostResolver,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 76 77 CertificatesResolvers map[string]CertificateResolver `description:"Certificates resolvers configuration." json:"certificatesResolvers,omitempty" toml:"certificatesResolvers,omitempty" yaml:"certificatesResolvers,omitempty" export:"true"` 78 79 Pilot *Pilot `description:"Traefik Pilot configuration." json:"pilot,omitempty" toml:"pilot,omitempty" yaml:"pilot,omitempty" export:"true"` 80 81 Experimental *Experimental `description:"experimental features." json:"experimental,omitempty" toml:"experimental,omitempty" yaml:"experimental,omitempty" export:"true"` 82} 83 84// CertificateResolver contains the configuration for the different types of certificates resolver. 85type CertificateResolver struct { 86 ACME *acmeprovider.Configuration `description:"Enable ACME (Let's Encrypt): automatic SSL." json:"acme,omitempty" toml:"acme,omitempty" yaml:"acme,omitempty" export:"true"` 87} 88 89// Global holds the global configuration. 90type Global struct { 91 CheckNewVersion bool `description:"Periodically check if a new version has been released." json:"checkNewVersion,omitempty" toml:"checkNewVersion,omitempty" yaml:"checkNewVersion,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 92 SendAnonymousUsage bool `description:"Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default." json:"sendAnonymousUsage,omitempty" toml:"sendAnonymousUsage,omitempty" yaml:"sendAnonymousUsage,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 93} 94 95// ServersTransport options to configure communication between Traefik and the servers. 96type ServersTransport struct { 97 InsecureSkipVerify bool `description:"Disable SSL certificate verification." json:"insecureSkipVerify,omitempty" toml:"insecureSkipVerify,omitempty" yaml:"insecureSkipVerify,omitempty" export:"true"` 98 RootCAs []tls.FileOrContent `description:"Add cert file for self-signed certificate." json:"rootCAs,omitempty" toml:"rootCAs,omitempty" yaml:"rootCAs,omitempty"` 99 MaxIdleConnsPerHost int `description:"If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, DefaultMaxIdleConnsPerHost is used" json:"maxIdleConnsPerHost,omitempty" toml:"maxIdleConnsPerHost,omitempty" yaml:"maxIdleConnsPerHost,omitempty" export:"true"` 100 ForwardingTimeouts *ForwardingTimeouts `description:"Timeouts for requests forwarded to the backend servers." json:"forwardingTimeouts,omitempty" toml:"forwardingTimeouts,omitempty" yaml:"forwardingTimeouts,omitempty" export:"true"` 101} 102 103// API holds the API configuration. 104type API struct { 105 Insecure bool `description:"Activate API directly on the entryPoint named traefik." json:"insecure,omitempty" toml:"insecure,omitempty" yaml:"insecure,omitempty" export:"true"` 106 Dashboard bool `description:"Activate dashboard." json:"dashboard,omitempty" toml:"dashboard,omitempty" yaml:"dashboard,omitempty" export:"true"` 107 Debug bool `description:"Enable additional endpoints for debugging and profiling." json:"debug,omitempty" toml:"debug,omitempty" yaml:"debug,omitempty" export:"true"` 108 // TODO: Re-enable statistics 109 // Statistics *types.Statistics `description:"Enable more detailed statistics." json:"statistics,omitempty" toml:"statistics,omitempty" yaml:"statistics,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 110} 111 112// SetDefaults sets the default values. 113func (a *API) SetDefaults() { 114 a.Dashboard = true 115} 116 117// RespondingTimeouts contains timeout configurations for incoming requests to the Traefik instance. 118type RespondingTimeouts struct { 119 ReadTimeout ptypes.Duration `description:"ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set." json:"readTimeout,omitempty" toml:"readTimeout,omitempty" yaml:"readTimeout,omitempty" export:"true"` 120 WriteTimeout ptypes.Duration `description:"WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set." json:"writeTimeout,omitempty" toml:"writeTimeout,omitempty" yaml:"writeTimeout,omitempty" export:"true"` 121 IdleTimeout ptypes.Duration `description:"IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set." json:"idleTimeout,omitempty" toml:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty" export:"true"` 122} 123 124// SetDefaults sets the default values. 125func (a *RespondingTimeouts) SetDefaults() { 126 a.IdleTimeout = ptypes.Duration(DefaultIdleTimeout) 127} 128 129// ForwardingTimeouts contains timeout configurations for forwarding requests to the backend servers. 130type ForwardingTimeouts struct { 131 DialTimeout ptypes.Duration `description:"The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists." json:"dialTimeout,omitempty" toml:"dialTimeout,omitempty" yaml:"dialTimeout,omitempty" export:"true"` 132 ResponseHeaderTimeout ptypes.Duration `description:"The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists." json:"responseHeaderTimeout,omitempty" toml:"responseHeaderTimeout,omitempty" yaml:"responseHeaderTimeout,omitempty" export:"true"` 133 IdleConnTimeout ptypes.Duration `description:"The maximum period for which an idle HTTP keep-alive connection will remain open before closing itself" json:"idleConnTimeout,omitempty" toml:"idleConnTimeout,omitempty" yaml:"idleConnTimeout,omitempty" export:"true"` 134} 135 136// SetDefaults sets the default values. 137func (f *ForwardingTimeouts) SetDefaults() { 138 f.DialTimeout = ptypes.Duration(30 * time.Second) 139 f.IdleConnTimeout = ptypes.Duration(90 * time.Second) 140} 141 142// LifeCycle contains configurations relevant to the lifecycle (such as the shutdown phase) of Traefik. 143type LifeCycle struct { 144 RequestAcceptGraceTimeout ptypes.Duration `description:"Duration to keep accepting requests before Traefik initiates the graceful shutdown procedure." json:"requestAcceptGraceTimeout,omitempty" toml:"requestAcceptGraceTimeout,omitempty" yaml:"requestAcceptGraceTimeout,omitempty" export:"true"` 145 GraceTimeOut ptypes.Duration `description:"Duration to give active requests a chance to finish before Traefik stops." json:"graceTimeOut,omitempty" toml:"graceTimeOut,omitempty" yaml:"graceTimeOut,omitempty" export:"true"` 146} 147 148// SetDefaults sets the default values. 149func (a *LifeCycle) SetDefaults() { 150 a.GraceTimeOut = ptypes.Duration(DefaultGraceTimeout) 151} 152 153// Tracing holds the tracing configuration. 154type Tracing struct { 155 ServiceName string `description:"Set the name for this service." json:"serviceName,omitempty" toml:"serviceName,omitempty" yaml:"serviceName,omitempty" export:"true"` 156 SpanNameLimit int `description:"Set the maximum character limit for Span names (default 0 = no limit)." json:"spanNameLimit,omitempty" toml:"spanNameLimit,omitempty" yaml:"spanNameLimit,omitempty" export:"true"` 157 Jaeger *jaeger.Config `description:"Settings for Jaeger." json:"jaeger,omitempty" toml:"jaeger,omitempty" yaml:"jaeger,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 158 Zipkin *zipkin.Config `description:"Settings for Zipkin." json:"zipkin,omitempty" toml:"zipkin,omitempty" yaml:"zipkin,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 159 Datadog *datadog.Config `description:"Settings for Datadog." json:"datadog,omitempty" toml:"datadog,omitempty" yaml:"datadog,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 160 Instana *instana.Config `description:"Settings for Instana." json:"instana,omitempty" toml:"instana,omitempty" yaml:"instana,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 161 Haystack *haystack.Config `description:"Settings for Haystack." json:"haystack,omitempty" toml:"haystack,omitempty" yaml:"haystack,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 162 Elastic *elastic.Config `description:"Settings for Elastic." json:"elastic,omitempty" toml:"elastic,omitempty" yaml:"elastic,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 163} 164 165// SetDefaults sets the default values. 166func (t *Tracing) SetDefaults() { 167 t.ServiceName = "traefik" 168 t.SpanNameLimit = 0 169} 170 171// Providers contains providers configuration. 172type Providers struct { 173 ProvidersThrottleDuration ptypes.Duration `description:"Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time." json:"providersThrottleDuration,omitempty" toml:"providersThrottleDuration,omitempty" yaml:"providersThrottleDuration,omitempty" export:"true"` 174 175 Docker *docker.Provider `description:"Enable Docker backend with default settings." json:"docker,omitempty" toml:"docker,omitempty" yaml:"docker,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 176 File *file.Provider `description:"Enable File backend with default settings." json:"file,omitempty" toml:"file,omitempty" yaml:"file,omitempty" export:"true"` 177 Marathon *marathon.Provider `description:"Enable Marathon backend with default settings." json:"marathon,omitempty" toml:"marathon,omitempty" yaml:"marathon,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 178 KubernetesIngress *ingress.Provider `description:"Enable Kubernetes backend with default settings." json:"kubernetesIngress,omitempty" toml:"kubernetesIngress,omitempty" yaml:"kubernetesIngress,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 179 KubernetesCRD *crd.Provider `description:"Enable Kubernetes backend with default settings." json:"kubernetesCRD,omitempty" toml:"kubernetesCRD,omitempty" yaml:"kubernetesCRD,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 180 KubernetesGateway *gateway.Provider `description:"Enable Kubernetes gateway api provider with default settings." json:"kubernetesGateway,omitempty" toml:"kubernetesGateway,omitempty" yaml:"kubernetesGateway,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 181 Rest *rest.Provider `description:"Enable Rest backend with default settings." json:"rest,omitempty" toml:"rest,omitempty" yaml:"rest,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 182 Rancher *rancher.Provider `description:"Enable Rancher backend with default settings." json:"rancher,omitempty" toml:"rancher,omitempty" yaml:"rancher,omitempty" export:"true" label:"allowEmpty" file:"allowEmpty"` 183 ConsulCatalog *consulcatalog.Provider `description:"Enable ConsulCatalog backend with default settings." json:"consulCatalog,omitempty" toml:"consulCatalog,omitempty" yaml:"consulCatalog,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 184 Ecs *ecs.Provider `description:"Enable AWS ECS backend with default settings." json:"ecs,omitempty" toml:"ecs,omitempty" yaml:"ecs,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 185 186 Consul *consul.Provider `description:"Enable Consul backend with default settings." json:"consul,omitempty" toml:"consul,omitempty" yaml:"consul,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 187 Etcd *etcd.Provider `description:"Enable Etcd backend with default settings." json:"etcd,omitempty" toml:"etcd,omitempty" yaml:"etcd,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 188 ZooKeeper *zk.Provider `description:"Enable ZooKeeper backend with default settings." json:"zooKeeper,omitempty" toml:"zooKeeper,omitempty" yaml:"zooKeeper,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 189 Redis *redis.Provider `description:"Enable Redis backend with default settings." json:"redis,omitempty" toml:"redis,omitempty" yaml:"redis,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 190 HTTP *http.Provider `description:"Enable HTTP backend with default settings." json:"http,omitempty" toml:"http,omitempty" yaml:"http,omitempty" label:"allowEmpty" file:"allowEmpty" export:"true"` 191 192 Plugin map[string]PluginConf `description:"Plugins configuration." json:"plugin,omitempty" toml:"plugin,omitempty" yaml:"plugin,omitempty"` 193} 194 195// SetEffectiveConfiguration adds missing configuration parameters derived from existing ones. 196// It also takes care of maintaining backwards compatibility. 197func (c *Configuration) SetEffectiveConfiguration() { 198 // Creates the default entry point if needed 199 if len(c.EntryPoints) == 0 { 200 ep := &EntryPoint{Address: ":80"} 201 ep.SetDefaults() 202 c.EntryPoints = EntryPoints{"http": ep} 203 } 204 205 // Creates the internal traefik entry point if needed 206 if (c.API != nil && c.API.Insecure) || 207 (c.Ping != nil && !c.Ping.ManualRouting && c.Ping.EntryPoint == DefaultInternalEntryPointName) || 208 (c.Metrics != nil && c.Metrics.Prometheus != nil && !c.Metrics.Prometheus.ManualRouting && c.Metrics.Prometheus.EntryPoint == DefaultInternalEntryPointName) || 209 (c.Providers != nil && c.Providers.Rest != nil && c.Providers.Rest.Insecure) { 210 if _, ok := c.EntryPoints[DefaultInternalEntryPointName]; !ok { 211 ep := &EntryPoint{Address: ":8080"} 212 ep.SetDefaults() 213 c.EntryPoints[DefaultInternalEntryPointName] = ep 214 } 215 } 216 217 if c.Providers.Docker != nil { 218 if c.Providers.Docker.SwarmModeRefreshSeconds <= 0 { 219 c.Providers.Docker.SwarmModeRefreshSeconds = ptypes.Duration(15 * time.Second) 220 } 221 222 if c.Providers.Docker.HTTPClientTimeout < 0 { 223 c.Providers.Docker.HTTPClientTimeout = 0 224 } 225 } 226 227 if c.Providers.Rancher != nil { 228 if c.Providers.Rancher.RefreshSeconds <= 0 { 229 c.Providers.Rancher.RefreshSeconds = 15 230 } 231 } 232 233 // Enable anonymous usage when pilot is enabled. 234 if c.Pilot != nil && c.Pilot.Token != "" { 235 c.Global.SendAnonymousUsage = true 236 } 237 238 // Create Pilot struct to apply default value on undefined configuration. 239 if c.Pilot == nil { 240 c.Pilot = &Pilot{} 241 c.Pilot.SetDefaults() 242 } 243 244 // Disable Gateway API provider if not enabled in experimental 245 if c.Experimental == nil || !c.Experimental.KubernetesGateway { 246 c.Providers.KubernetesGateway = nil 247 } 248 249 if c.Experimental == nil || !c.Experimental.HTTP3 { 250 for epName, ep := range c.EntryPoints { 251 if ep.HTTP3 != nil { 252 ep.HTTP3 = nil 253 log.WithoutContext().Debugf("Disabling HTTP3 configuration for entryPoint %q: HTTP3 is disabled in the experimental configuration section", epName) 254 } 255 } 256 } 257 258 // Configure Gateway API provider 259 if c.Providers.KubernetesGateway != nil { 260 log.WithoutContext().Debugf("Experimental Kubernetes Gateway provider has been activated") 261 entryPoints := make(map[string]gateway.Entrypoint) 262 for epName, entryPoint := range c.EntryPoints { 263 entryPoints[epName] = gateway.Entrypoint{Address: entryPoint.GetAddress(), HasHTTPTLSConf: entryPoint.HTTP.TLS != nil} 264 } 265 266 c.Providers.KubernetesGateway.EntryPoints = entryPoints 267 } 268 269 c.initACMEProvider() 270} 271 272func (c *Configuration) initACMEProvider() { 273 for _, resolver := range c.CertificatesResolvers { 274 if resolver.ACME != nil { 275 resolver.ACME.CAServer = getSafeACMECAServer(resolver.ACME.CAServer) 276 } 277 } 278 279 legolog.Logger = stdlog.New(log.WithoutContext().WriterLevel(logrus.DebugLevel), "legolog: ", 0) 280} 281 282// ValidateConfiguration validate that configuration is coherent. 283func (c *Configuration) ValidateConfiguration() error { 284 var acmeEmail string 285 for name, resolver := range c.CertificatesResolvers { 286 if resolver.ACME == nil { 287 continue 288 } 289 290 if len(resolver.ACME.Storage) == 0 { 291 return fmt.Errorf("unable to initialize certificates resolver %q with no storage location for the certificates", name) 292 } 293 294 if acmeEmail != "" && resolver.ACME.Email != acmeEmail { 295 return fmt.Errorf("unable to initialize certificates resolver %q, all the acme resolvers must use the same email", name) 296 } 297 acmeEmail = resolver.ACME.Email 298 } 299 300 return nil 301} 302 303func getSafeACMECAServer(caServerSrc string) string { 304 if len(caServerSrc) == 0 { 305 return DefaultAcmeCAServer 306 } 307 308 if strings.HasPrefix(caServerSrc, "https://acme-v01.api.letsencrypt.org") { 309 caServer := strings.Replace(caServerSrc, "v01", "v02", 1) 310 log.WithoutContext(). 311 Warnf("The CA server %[1]q refers to a v01 endpoint of the ACME API, please change to %[2]q. Fallback to %[2]q.", caServerSrc, caServer) 312 return caServer 313 } 314 315 if strings.HasPrefix(caServerSrc, "https://acme-staging.api.letsencrypt.org") { 316 caServer := strings.Replace(caServerSrc, "https://acme-staging.api.letsencrypt.org", "https://acme-staging-v02.api.letsencrypt.org", 1) 317 log.WithoutContext(). 318 Warnf("The CA server %[1]q refers to a v01 endpoint of the ACME API, please change to %[2]q. Fallback to %[2]q.", caServerSrc, caServer) 319 return caServer 320 } 321 322 return caServerSrc 323} 324