# Traefik and Nomad Service Discovery One of the best feature of Traefik is to delegate the routing configuration to the application level. With Nomad, Traefik can leverage tags attached to a service to generate routing rules. !!! warning "Tags & sensitive data" We recommend to *not* use tags to store sensitive data (certificates, credentials, etc). Instead, we recommend to store sensitive data in a safer storage (secrets, file, etc). ## Configuration Examples ??? example "Configuring Nomad & Deploying / Exposing one Service" Enabling the nomad provider ```yaml tab="Structured (YAML)" providers: nomad: {} ``` ```toml tab="Structured (TOML)" [providers.nomad] ``` ```bash tab="CLI" --providers.nomad=true ``` Attaching tags to services (in your Nomad job file) ```hcl job "my-service" { datacenters = ["dc1"] group "web" { task "app" { driver = "docker" service { name = "my-service" tags = [ "traefik.http.routers.my-service.rule=Host(`example.com`)", ] } } } } ``` ??? example "Specify a Custom Port for the Container" Forward requests for `http://example.com` to `http://:12345`: ```hcl job "my-service" { datacenters = ["dc1"] group "web" { task "app" { driver = "docker" service { name = "my-service" tags = [ "traefik.http.routers.my-service.rule=Host(`example.com`)", "traefik.http.routers.my-service.service=my-service", "traefik.http.services.my-service.loadbalancer.server.port=12345", ] } } } } ``` !!! important "Traefik Connecting to the Wrong Port: `HTTP/502 Gateway Error`" By default, Traefik uses the first exposed port of a container. Setting the tag `traefik.http.services.xxx.loadbalancer.server.port` overrides that behavior. ??? example "Specifying more than one router and service per container" Forwarding requests to more than one port on a container requires referencing the service loadbalancer port definition using the service parameter on the router. In this example, requests are forwarded for `http://example-a.com` to `http://:8000` in addition to `http://example-b.com` forwarding to `http://:9000`: ```hcl job "my-service" { datacenters = ["dc1"] group "web" { task "app" { driver = "docker" service { name = "my-service" tags = [ "traefik.http.routers.www-router.rule=Host(`example-a.com`)", "traefik.http.routers.www-router.service=www-service", "traefik.http.services.www-service.loadbalancer.server.port=8000", "traefik.http.routers.admin-router.rule=Host(`example-b.com`)", "traefik.http.routers.admin-router.service=admin-service", "traefik.http.services.admin-service.loadbalancer.server.port=9000", ] } } } } ``` ## Configuration Options !!! info "Tags" Tags are case-insensitive. !!! tip "TLS Default Generated Certificates" To learn how to configure Traefik default generated certificate, refer to the [TLS Certificates](../http/tls/tls-certificates.md#acme-default-certificate) page. ### General Traefik creates, for each Nomad service, a corresponding Traefik [service](../http/load-balancing/service.md) and [router](../http/routing/rules-and-priority.md). The Traefik service automatically gets a server per instance in this Nomad service, and the router gets a default rule attached to it, based on the Nomad service name. ### Routers To update the configuration of the Router automatically attached to the service, add tags starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change. For example, to change the rule, you could add the tag ```traefik.http.routers.my-service.rule=Host(`example.com`)```. #### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.http.routers..rule` | See [rule](../http/routing/rules-and-priority.md#rules) for more information. | ```Host(`example.com`)``` | | `traefik.http.routers..ruleSyntax` | See [ruleSyntax](../http/routing/rules-and-priority.md#rulesyntax) for more information.
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax. | `v3` | | `traefik.http.routers..entrypoints` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `web,websecure` | | `traefik.http.routers..middlewares` | See [middlewares overview](../http/middlewares/overview.md) for more information. | `auth,prefix,cb` | | `traefik.http.routers..service` | See [service](../http/load-balancing/service.md) for more information. | `myservice` | | `traefik.http.routers..tls` | See [tls](../http/tls/overview.md) for more information. | `true` | | `traefik.http.routers..tls.certresolver` | See [certResolver](../../install-configuration/tls/certificate-resolvers/overview.md) for more information. | `myresolver` | | `traefik.http.routers..tls.domains[n].main` | See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information. | `example.org` | | `traefik.http.routers..tls.domains[n].sans` | See [domains](../../install-configuration/tls/certificate-resolvers/acme.md#domain-definition) for more information. | `test.example.org,dev.example.org` | | `traefik.http.routers..tls.options` | See [TLS Options](../http/tls/tls-options.md) for more information, and [Conflicting TLS Options](../http/tls/tls-options.md#conflicting-tls-options) when several routers serve the same host name. | `foobar` | | `traefik.http.routers..priority` | See [priority](../http/routing/rules-and-priority.md#priority-calculation) for more information. | `42` | | `traefik.http.routers..observability.accesslogs` | The accessLogs option controls whether the router will produce access-logs. | `true` | | `traefik.http.routers..observability.metrics` | The metrics option controls whether the router will produce metrics. | `true` | | `traefik.http.routers..observability.tracing` | The tracing option controls whether the router will produce traces. | `true` | ### Services To update the configuration of the Service automatically attached to the service, add tags starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change. For example, to change the `passHostHeader` behavior, you'd add the tag `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`. #### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.http.services..loadbalancer.server.port` | Registers a port.
Useful when the service exposes multiples ports. | `8080` | | `traefik.http.services..loadbalancer.server.scheme` | Overrides the default scheme. | `http` | | `traefik.http.services..loadbalancer.server.weight` | Overrides the default weight. | `42` | | `traefik.http.services..loadbalancer.serverstransport` | Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
See [serverstransport](../http/load-balancing/serverstransport.md) for more information. | `foobar@file` | | `traefik.http.services..loadbalancer.passhostheader` | | `true` | | `traefik.http.services..loadbalancer.healthcheck.headers.` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `foobar` | | `traefik.http.services..loadbalancer.healthcheck.hostname` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `example.org` | | `traefik.http.services..loadbalancer.healthcheck.interval` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `10` | | `traefik.http.services..loadbalancer.healthcheck.unhealthyinterval` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `10` | | `traefik.http.services..loadbalancer.healthcheck.path` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `/foo` | | `traefik.http.services..loadbalancer.healthcheck.status` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `42` | | `traefik.http.services..loadbalancer.healthcheck.port` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `42` | | `traefik.http.services..loadbalancer.healthcheck.scheme` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `http` | | `traefik.http.services..loadbalancer.healthcheck.timeout` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `10` | | `traefik.http.services..loadbalancer.healthcheck.followredirects` | See [health check](../http/load-balancing/service.md#health-check) for more information. | `true` | | | | `true` | | | | `true` | | | | `foobar` | | | | `/foobar` | | | | `true` | | | | `none` | | | | `42` | | `traefik.http.services..loadbalancer.responseforwarding.flushinterval` | | `10` | ### Middleware You can declare pieces of middleware using tags starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`redirectscheme`](../http/middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`. More information about available middlewares in the dedicated [middlewares section](../http/middlewares/overview.md). ??? example "Declaring and Referencing a Middleware" ```yaml # ... # Declaring a middleware traefik.http.middlewares.my-redirect.redirectscheme.scheme=https # Referencing a middleware traefik.http.routers.my-service.middlewares=my-redirect ``` !!! warning "Conflicts in Declaration" If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared. ### TCP You can declare TCP Routers and/or Services using tags. ??? example "Declaring TCP Routers and Services" ```yaml traefik.tcp.routers.my-router.rule=HostSNI(`example.com`) traefik.tcp.routers.my-router.tls=true traefik.tcp.services.my-service.loadbalancer.server.port=4123 ``` !!! warning "TCP and HTTP" If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined). You can declare both a TCP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually). #### TCP Routers ##### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.tcp.routers..entrypoints` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `ep1,ep2` | | `traefik.tcp.routers..rule` | See [rule](../tcp/routing/rules-and-priority.md#rules) for more information. | ```HostSNI(`example.com`)``` | | `traefik.tcp.routers..ruleSyntax` | configure the rule syntax to be used for parsing the rule on a per-router basis.
RuleSyntax option is deprecated and will be removed in the next major version.
Please do not use this field and rewrite the router rules to use the v3 syntax. | `v3` | | `traefik.tcp.routers..priority` | See [priority](../tcp/routing/rules-and-priority.md#priority-calculation) for more information. | `42` | | `traefik.tcp.routers..service` | See [service](../tcp/service.md) for more information. | `myservice` | | `traefik.tcp.routers..tls` | See [TLS](../tcp/tls.md) for more information. | `true` | | `traefik.tcp.routers..tls.certresolver` | See [certResolver](../tcp/tls.md#configuration-options) for more information. | `myresolver` | | `traefik.tcp.routers..tls.domains[n].main` | See [TLS](../tcp/tls.md) for more information. | `example.org` | | `traefik.tcp.routers..tls.domains[n].sans` | See [TLS](../tcp/tls.md) for more information. | `test.example.org,dev.example.org` | | `traefik.tcp.routers..tls.options` | See [TLS](../tcp/tls.md#configuration-options) for more information. | `myoptions` | | `traefik.tcp.routers..tls.passthrough` | See [Passthrough](../tcp/tls.md#opt-passthrough) for more information. | `true` | #### TCP Services ##### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.tcp.services..loadbalancer.server.port` | Registers a port of the application. | `423` | | `traefik.tcp.services..loadbalancer.server.tls` | Determines whether to use TLS when dialing with the backend. | `true` | | `traefik.tcp.services..loadbalancer.serverstransport` | Allows to reference a ServersTransport resource that is defined either with the File provider or the Kubernetes CRD one.
See [serverstransport](../tcp/serverstransport.md) for more information. | `foobar@file` | #### TCP Middleware You can declare pieces of middleware using tags starting with `traefik.tcp.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`InFlightConn`](../tcp/middlewares/inflightconn.md) named `test-inflightconn`, you'd write `traefik.tcp.middlewares.test-inflightconn.inflightconn.amount=10`. More information about available middlewares in the dedicated [middlewares section](../tcp/middlewares/overview.md). ??? example "Declaring and Referencing a Middleware" ```yaml # ... # Declaring a middleware traefik.tcp.middlewares.test-inflightconn.inflightconn.amount=10 # Referencing a middleware traefik.tcp.routers.my-service.middlewares=test-inflightconn ``` !!! warning "Conflicts in Declaration" If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared. ### UDP You can declare UDP Routers and/or Services using tags. ??? example "Declaring UDP Routers and Services" ```yaml traefik.udp.routers.my-router.entrypoints=udp traefik.udp.services.my-service.loadbalancer.server.port=4123 ``` !!! warning "UDP and HTTP" If you declare a UDP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no UDP Router/Service is defined). You can declare both a UDP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually). #### UDP Routers ##### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.udp.routers..entrypoints` | See [entry points](../../install-configuration/entrypoints.md) for more information. | `ep1,ep2` | | `traefik.udp.routers..service` | See [service](../udp/service.md) for more information. | `myservice` | #### UDP Services ##### Configuration Options | Label | Description | Value | |------|-------------|-------| | `traefik.udp.services..loadbalancer.server.port` | Registers a port of the application. | `423` | ### Specific Provider Options | Label | Description | Value | |------|-------------|-------| | `traefik.enable` | You can tell Traefik to consider (or not) the service by setting `traefik.enable` to true or false.
This option overrides the value of `exposedByDefault`. | `true` | | `traefik.nomad.canary` | When Nomad orchestrator is a provider (of service registration) for Traefik, one might have the need to distinguish within Traefik between a [Canary](https://learn.hashicorp.com/tutorials/nomad/job-blue-green-and-canary-deployments#deploy-with-canaries) instance of a service, or a production one.
For example if one does not want them to be part of the same load-balancer.

Therefore, this option, which is meant to be provided as one of the values of the `canary_tags` field in the Nomad [service stanza](https://www.nomadproject.io/docs/job-specification/service#canary_tags), allows Traefik to identify that the associated instance is a canary one. | `true` | #### Port Lookup Traefik is capable of detecting the port to use, by following the default Nomad Service Discovery flow. That means, if you just expose lets say port `:1337` on the Nomad job, traefik will pick up this port and use it.