# Traefik EntryPoints Documentation
Listening for Incoming Connections/Requests
{: .subtitle }
### Configuration Example
```yaml tab="File (YAML)"
entryPoints:
web:
address: :80
http:
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
observability:
accessLogs: false
metrics: false
tracing: false
websecure:
address: :443
http:
tls: {}
middlewares:
- default-auth@kubernetescrd
- default-strip@kubernetescrd
```
```toml tab="File (TOML)"
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.http]
[entryPoints.web.http.redirections.entryPoint]
to = "websecure"
scheme = "https"
permanent = true
[entryPoints.web.observability]
accessLogs = false
metrics = false
tracing = false
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http]
middlewares = ["default-auth@kubernetescrd", "default-strip@kubernetescrd"]
[entryPoints.websecure.http.tls]
```
```yaml tab="Helm Chart Values"
## Values file
ports:
web:
port: :80
websecure:
port: :443
tls:
enabled: true
middlewares:
- default-auth@kubernetescrd
- default-strip@kubernetescrd
additionalArguments:
- --entryPoints.web.http.redirections.entryPoint.to=websecure
- --entryPoints.web.http.redirections.entryPoint.scheme=https
- --entryPoints.web.http.redirections.entryPoint.permanent=true
- --entryPoints.web.observability.accessLogs=false
- --entryPoints.web.observability.metrics=false
- --entryPoints.web.observability.tracing=false
```
!!! tip
In the Helm Chart, the entryPoints `web` (port 80), `websecure` (port 443), `traefik` (port 8080) and `metrics` (port 9100) are created by default.
The entryPoints `web`, `websecure` are exposed by default using a Service.
The default behaviors can be overridden in the Helm Chart.
## Configuration Options
| Field | Description | Default | Required |
|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------------------------------------------------------|:---------|
| `address` | Define the port, and optionally the hostname, on which to listen for incoming connections and packets.
It also defines the protocol to use (TCP or UDP).
If no protocol is specified, the default is TCP. The format is:`[host]:port[/tcp\|/udp] | - | Yes |
| `asDefault` | Mark the `entryPoint` to be in the list of default `entryPoints`.
`entryPoints`in this list are used (by default) on HTTP and TCP routers that do not define their own `entryPoints` option.
More information [here](#asdefault). | false | No |
| `allowACMEByPass` | Enables handling of ACME TLS and HTTP challenges with custom routers instead of the internal ACME router. | false | No |
| | List of Connection headers that are allowed to pass through the middleware chain before being removed. | - | No |
| | Add the compatibility headers `X-Forwarded-Scheme` and `X-Scheme`. | false | No |
| | Set the insecure mode to always trust the forwarded headers information (`X-Forwarded-*`).
We recommend to use this option only for tests purposes, not in production. | false | No |
| | Set the IPs or CIDR from where Traefik trusts the forwarded headers information (`X-Forwarded-*`). | - | No |
| | When set to `true`, Traefik will not append the client's `RemoteAddr` to the `X-Forwarded-For` header. The existing header is preserved as-is. If no `X-Forwarded-For` header exists, none will be added. | false | No |
| `http.redirections.`
`entryPoint.to` | The target element to enable (permanent) redirecting of all incoming requests on an entry point to another one.
The target element can be an entry point name (ex: `websecure`), or a port (`:443`). | - | Yes |
| `http.redirections.`
`entryPoint.scheme` | The target scheme to use for (permanent) redirection of all incoming requests. | https | No |
| `http.redirections.`
`entryPoint.permanent` | Enable permanent redirecting of all incoming requests on an entry point to another one changing the scheme.
The target element, it can be an entry point name (ex: `websecure`), or a port (`:443`). | true | No |
| `http.redirections.`
`entryPoint.priority` | Default priority applied to the routers attached to the `entryPoint`. | MaxInt-1 (`2147483646` on 32-bit, `9223372036854775806` on 64-bit) | No |
| `http.encodedCharacters` | Defines which encoded characters are allowed in the request path. More information [here](#encoded-characters). | false | No |
| `http.encodedCharacters.`
`allowEncodedSlash` | Defines whether requests with encoded slash characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedBackSlash` | Defines whether requests with encoded back slash characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedNullCharacter` | Defines whether requests with encoded null characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedSemicolon` | Defines whether requests with encoded semicolon characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedPercent` | Defines whether requests with encoded percent characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedQuestionMark` | Defines whether requests with encoded question mark characters in the path are allowed. | true | No |
| `http.encodedCharacters.`
`allowEncodedHash` | Defines whether requests with encoded hash characters in the path are allowed. | true | No |
| `http.encodeQuerySemicolons` | Enable query semicolons encoding.
Use this option to avoid non-encoded semicolons to be interpreted as query parameter separators by Traefik.
When using this option, the non-encoded semicolons characters in query will be transmitted encoded to the backend.
More information [here](#encodequerysemicolons). | false | No |
| | Defines the strategy to handle the requests carrying a header whose name aliases another header name (keep, delete, and reject).
More information [here](#aliasheadersstrategy). | keep | No |
| `http.sanitizePath` | Defines whether to enable the request path sanitization.
More information [here](#sanitizepath). | true | No |
| | Set the maximum size of request headers in bytes. | 1048576 | No |
| | Set the maximum number of request header values Traefik reads for each request. A request exceeding this limit is rejected with a `431 Request Header Fields Too Large` status.
Comma-separated values in a single header line count as one value, while values sent on multiple header lines count once per line.
This option applies to HTTP/1 and HTTP/2 only; it has no effect on HTTP/3 requests. | 500 | No |
| `http.middlewares` | Set the list of middlewares that are prepended by default to the list of middlewares of each router associated to the named entry point.
More information [here](#httpmiddlewares). | - | No |
| `http.tls` | Enable TLS on every router attached to the `entryPoint`.
If no certificate are set, a default self-signed certificate is generated by Traefik.
We recommend to not use self signed certificates in production. | - | No |
| `http.tls.options` | Apply TLS options on every router attached to the `entryPoint`.
These options apply only while the router does not define its own `tls` section.
Defining a router `tls` section (even empty, or with any field such as `certResolver`) replaces the entrypoint TLS configuration for that router (no merge).
More information in the [dedicated section](../../reference/routing-configuration/http/tls/tls-options.md) and [HTTP TLS overview](../../reference/routing-configuration/http/tls/overview.md). | - | No |
| `http.tls.certResolver` | Apply a certificate resolver on every router attached to the `entryPoint`.
Like `http.tls.options`, this applies only while the router does not define its own `tls` section.
Defining a router `tls` section (even empty, or with any field such as `certResolver`) replaces the entrypoint TLS configuration for that router (no merge).
More information in the [dedicated section](./tls/certificate-resolvers/overview.md) and [HTTP TLS overview](../../reference/routing-configuration/http/tls/overview.md). | - | No |
| `http2.`
`maxConcurrentStreams` | Set the number of concurrent streams per connection that each client is allowed to initiate.
The value must be greater than zero. | 250 | No |
| | Set the maximum size of the decoder header compression table. This controls the maximum size of the header cache that the server is willing to maintain so the client does not need to repeatedly send the same header across requests in the same http2 connection.
This value is only a maximum, the other end of the connection can use a lower size. | 4096 | No |
| | Set the maximum size of the encoder header compression table. This controls the maximum size of the header cache that the server is willing to maintain when sending headers to the client, allowing the server to reduce the amount of duplicate headers it is sending in responses.
This value is only a maximum, the other end of the connection can use a lower size. | 4096 | No |
| `http3` | Enable HTTP/3 protocol on the `entryPoint`.
HTTP/3 requires a TCP `entryPoint`. as HTTP/3 always starts as a TCP connection that then gets upgraded to UDP. In most scenarios, this `entryPoint` is the same as the one used for TLS traffic.
More information [here](#http3). | - | No |
| `http3.advertisedPort` | Set the UDP port to advertise as the HTTP/3 authority.
It defaults to the entryPoint's address port.
It can be used to override the authority in the `alt-svc` header, for example if the public facing port is different from where Traefik is listening. | - | No |
| `observability.`
`accessLogs` | Defines whether a router attached to this EntryPoint produces access-logs by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
| `observability.`
`metrics` | Defines whether a router attached to this EntryPoint produces metrics by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
| `observability.`
`tracing` | Defines whether a router attached to this EntryPoint produces traces by default. Nonetheless, a router defining its own observability configuration will opt-out from this default. | true | No |
| `observability.`
`traceVerbosity` | Defines the tracing verbosity level for routers attached to this EntryPoint. Possible values: `minimal` (default), `detailed`. Routers can override this value in their own observability configuration.
More information [here](#traceverbosity). | minimal | No |
| `proxyProtocol.`
`trustedIPs` | Enable PROXY protocol with Trusted IPs.
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
| `proxyProtocol.`
`insecure` | Enable PROXY protocol trusting every incoming connection.
Every remote client address will be replaced (`trustedIPs`) won't have any effect).
Traefik supports [PROXY protocol](https://www.haproxy.org/download/2.0/doc/proxy-protocol.txt) version 1 and 2.
If PROXY protocol header parsing is enabled for the entry point, this entry point can accept connections with or without PROXY protocol headers.
If the PROXY protocol header is passed, then the version is determined automatically.
We recommend to use this option only for tests purposes, not in production.
More information [here](#proxyprotocol-and-load-balancers). | - | No |
| `reusePort` | Enable `entryPoints` from the same or different processes listening on the same TCP/UDP port by utilizing the `SO_REUSEPORT` socket option.
It also allows the kernel to act like a load balancer to distribute incoming connections between entry points.
More information [here](#reuseport). | false | No |
| `transport.`
`respondingTimeouts.`
`readTimeout` | Set the timeouts for incoming requests to the Traefik instance. This is the maximum duration for reading the entire request, including the body. Setting them has no effect for UDP `entryPoints`.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 60s (seconds) | No |
| `transport.`
`respondingTimeouts.`
`writeTimeout` | Maximum duration before timing out writes of the response.
It covers the time from the end of the request header read to the end of the response write.
If zero, no timeout exists.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds. | 0s (seconds) | No |
| `transport.`
`respondingTimeouts.`
`idleTimeout` | Maximum duration an idle (keep-alive) connection will remain idle before closing itself.
If zero, no timeout exists
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 180s (seconds) | No |
| `transport.`
`lifeCycle.`
`graceTimeOut` | Set the duration to give active requests a chance to finish before Traefik stops.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds
In this time frame no new requests are accepted. | 10s (seconds) | No |
| `transport.`
`lifeCycle.`
`requestAcceptGraceTimeout` | Set the duration to keep accepting requests prior to initiating the graceful termination period (as defined by the `transportlifeCycle.graceTimeOut` option).
This option is meant to give downstream load-balancers sufficient time to take Traefik out of rotation.
Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
If no units are provided, the value is parsed assuming seconds | 0s (seconds) | No |
| `transport.`
`keepAliveMaxRequests` | Set the maximum number of requests Traefik can handle before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY).
Zero means no limit. | 0 | No |
| `transport.`
`keepAliveMaxTime` | Set the maximum duration Traefik can handle requests before sending a `Connection: Close` header to the client (for HTTP2, Traefik sends a GOAWAY). Zero means no limit. | 0s (seconds) | No |
| `udp.timeout` | Define how long to wait on an idle session before releasing the related resources.
The Timeout value must be greater than zero. | 3s (seconds) | No |
### asDefault
If there is no entryPoint with the `asDefault` option set to `true`, then the
list of default entryPoints includes all HTTP/TCP entryPoints.
If at least one entryPoint has the `asDefault` option set to `true`,
then the list of default entryPoints includes only entryPoints that have the
`asDefault` option set to `true`.
Some built-in entryPoints are always excluded from the list, namely: `traefik`.
The `asDefault` option has no effect on UDP entryPoints.
When a UDP router does not define the entryPoints option, it is attached to all
available UDP entryPoints.
### allowACMEByPass
By default, Traefik creates an internal router with the highest possible priority (`MaxInt`) to handle
ACME HTTP and TLS challenges. This ensures that certificate challenges always succeed,
but it also prevents any user-defined router from intercepting challenge requests on the same entrypoint.
When `allowACMEByPass` is set to `true` on an entrypoint:
- The internal ACME HTTP challenge router is created **without** an explicit high priority,
allowing user-defined routers to handle challenge requests instead.
- The TLS-ALPN challenge passthrough is enabled on the entrypoint,
allowing user-defined TLS routers to handle TLS challenges.
This is useful when you need custom handling of ACME challenges,
for example when using a dedicated service to solve HTTP-01 or TLS-ALPN-01 challenges.
!!! note
When no TLS challenge resolver is configured, `allowACMEByPass` is implicitly enabled
for TLS passthrough on all entrypoints.
!!! note
When `allowACMEByPass` is enabled and the entrypoint has an HTTP redirect configured
(via `http.redirections.entryPoint`), the redirect router automatically excludes
the ACME challenge path (`/.well-known/acme-challenge/`).
This allows user-defined ACME challenge routers to handle challenge requests
without being overridden by the redirect.
```yaml tab="File (YAML)"
entryPoints:
web:
address: ":80"
allowACMEByPass: true
```
```toml tab="File (TOML)"
[entryPoints.web]
address = ":80"
allowACMEByPass = true
```
```bash tab="CLI"
--entryPoints.web.address=:80
--entryPoints.web.allowACMEByPass=true
```
### http.middlewares
- You can attach a list of [middlewares](../../reference/routing-configuration/http/middlewares/overview.md)
to each entryPoint.
- The middlewares will take effect only if the rule matches, and before forwarding
the request to the service.
- Middlewares are applied in the same order as their declaration.
- Middlewares are applied by default to every router exposed through the EntryPoint
(the Middlewares declared on the [IngressRoute](../../reference/routing-configuration/kubernetes/crd/http/ingressroute.md#middleware)
or the [Ingress](../../reference/routing-configuration/kubernetes/ingress.md#on-ingress)
are applied after the ones declared on the Entrypoint)
- Middlewares must be referenced by their **fully qualified name**, including the
[provider namespace](../../reference/install-configuration/providers/overview.md#provider-namespace)
suffix (`@`). The exact value depends on the
provider that declares the middleware:
| Provider | Format | Example |
|--------------------|-----------------------------------------------------|-------------------------------|
| File | `@file` | `strip@file` |
| Docker | `@docker` | `strip@docker` |
| Kubernetes CRD | `-@kubernetescrd` | `default-auth@kubernetescrd` |
When [`safeNaming`](../../reference/install-configuration/providers/kubernetes/kubernetes-crd.md#safenaming) is enabled, the Kubernetes CRD value becomes `_@kubernetescrd`, using the same `_` separator as the other names generated by the provider.
```yaml tab="File (YAML)"
entryPoints:
web:
address: :80
http:
middlewares:
- default-auth@kubernetescrd
- strip@file
```
```yaml tab="Helm Chart Values"
ports:
web:
port: :80
http:
middlewares:
- default-auth@kubernetescrd
- strip@file
```
### encodeQuerySemicolons
Behavior examples:
| EncodeQuerySemicolons | Request Query | Resulting Request Query |
|-----------------------|---------------------|-------------------------|
| false | foo=bar;baz=bar | foo=bar&baz=bar |
| true | foo=bar;baz=bar | foo=bar%3Bbaz=bar |
| false | foo=bar&baz=bar;foo | foo=bar&baz=bar&foo |
| true | foo=bar&baz=bar;foo | foo=bar&baz=bar%3Bfoo |
### aliasHeadersStrategy
_Optional, Default=keep_
The `aliasHeadersStrategy` option defines how the request headers whose name aliases another header name are handled before routing:
- `keep`: request headers with an aliasing name are forwarded as is (default).
- `delete`: any request header whose name contains a character which is neither a letter, a digit, nor a dash is silently removed from the request.
- `reject`: any request carrying a header whose name contains a character which is neither a letter, a digit, nor a dash is rejected with a `400 Bad Request` response.
Go canonicalizes header names on dashes only, so it handles `X-Auth-User`, `X_Auth_User` and `X.Auth.User` as three
distinct headers, while the backends deriving their variable names from the header names (CGI, WSGI, PHP, NGINX, ...)
read them all as the same `HTTP_X_AUTH_USER` variable.
Underscores and dots are not the only characters concerned: every character HTTP allows in a header name except the
letters, the digits and the dash builds such an alias, that is `!`, `#`, `$`, `%`, `&`, `'`, `*`, `+`, `.`, `^`, `_`,
`` ` ``, `|` and `~`. See the [Headers with Aliasing Names](../../security/header-aliases.md) security documentation
for more details.
The middlewares managing request headers (e.g. the ForwardAuth `authResponseHeaders` option) only manage the canonical
form of the headers they set, and rely on this option to not be spoofed with an aliasing name.
Traefik logs a warning at startup for every entry point left without this option configured.
A default for every entry point can be set once with the
[`global.aliasHeadersStrategy`](./configuration-options.md#opt-global-aliasheadersstrategy) option.
An explicit per-entry-point value always takes precedence, and when neither is set the behavior is unchanged (`keep`).
Entry points that still use the deprecated `underscoreHeadersStrategy` option are left alone, so their behavior is unchanged as well.
!!! warning "Security"
Backends normalizing the header names can be spoofed with an aliasing name of a header they trust.
Setting the `aliasHeadersStrategy` option to `delete` or `reject` is recommended when such backends are exposed.
The `delete` and `reject` strategies apply to every request header: a legitimate header whose name contains
such a character (e.g. `X_Request_Id`) is dropped or rejected as well.
```yaml tab="File (YAML)"
entryPoints:
websecure:
address: ':443'
http:
aliasHeadersStrategy: delete
```
```toml tab="File (TOML)"
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.http]
aliasHeadersStrategy = "delete"
```
```bash tab="CLI"
--entryPoints.websecure.address=:443
--entryPoints.websecure.http.aliasHeadersStrategy=delete
```
#### Examples
| AliasHeadersStrategy | Request Headers | Result |
|----------------------|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------|
| keep | `X-Auth-User: legit`
`X.Auth.User: spoof`
`X!Auth!User: spoof` | `X-Auth-User: legit`
`X.Auth.User: spoof`
`X!Auth!User: spoof` reach the backend |
| delete | `X-Auth-User: legit`
`X.Auth.User: spoof`
`X!Auth!User: spoof` | Only `X-Auth-User: legit` reaches the backend |
| reject | `X-Auth-User: legit`
`X.Auth.User: spoof`
`X!Auth!User: spoof` | Request rejected with `400 Bad Request` |
### sanitizePath
The `sanitizePath` option defines whether to enable the request path sanitization.
When disabled, the incoming request path is passed to the backend as is.
This can be useful when dealing with legacy clients that are not url-encoding data in the request path.
For example, as base64 uses the “/” character internally,
if it's not url encoded,
it can lead to unsafe routing when the `sanitizePath` option is set to `false`.
!!! warning "Security"
Setting the sanitizePath option to false is not safe.
Ensure every request is properly url encoded instead.
#### Examples
| SanitizePath | Request Path | Resulting Request Path |
|--------------|-----------------|------------------------|
| false | /./foo/bar | /./foo/bar |
| true | /./foo/bar | /foo/bar |
| false | /foo/../bar | /foo/../bar |
| true | /foo/../bar | /bar |
| false | /foo/bar// | /foo/bar// |
| true | /foo/bar// | /foo/bar/ |
| false | /./foo/../bar// | /./foo/../bar// |
| true | /./foo/../bar// | /bar/ |
### Encoded Characters
You can configure Traefik to control the handling of encoded characters in request paths for security purposes.
By default, Traefik do not reject requests with path containing certain encoded characters that could be used in path traversal or other security attacks.
!!! info
This check is not done against the request query parameters,
but only against the request path as defined in [RFC3986 section-3](https://datatracker.ietf.org/doc/html/rfc3986#section-3).
!!! info "Security Considerations"
When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986) and notably decode encoded reserved characters in the request path,
it is recommended to set these options to `false` to avoid split-view situation and helps prevent path traversal attacks or other malicious attempts to bypass security controls.
Here is the list of the encoded characters that are allowed by default:
| Encoded Character | Character |
|------------------------------------------------------------------------------------|-------------------------|
| `%2f` or `%2F` | `/` (slash) |
| `%5c` or `%5C` | `\` (backslash) |
| `%00` | `NULL` (null character) |
| `%3b` or `%3B` | `;` (semicolon) |
| `%25` | `%` (percent) |
| `%3f` or `%3F` | `?` (question mark) |
| `%23` | `#` (hash) |
### Forwarded Headers
You can configure Traefik to trust the forwarded headers information (`X-Forwarded-*`).
??? info "`forwardedHeaders.trustedIPs`"
Trusting Forwarded Headers from specific IPs.
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
web:
address: ":80"
forwardedHeaders:
trustedIPs:
- "127.0.0.1/32"
- "192.168.1.7"
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
```
```bash tab="CLI"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.trustedIPs=127.0.0.1/32,192.168.1.7
```
??? info "`forwardedHeaders.insecure`"
Insecure Mode (Always Trusting Forwarded Headers).
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
web:
address: ":80"
forwardedHeaders:
insecure: true
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
insecure = true
```
```bash tab="CLI"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.insecure
```
??? info "`forwardedHeaders.connection`"
As per RFC7230, Traefik respects the Connection options from the client request.
By doing so, it removes any header field(s) listed in the request Connection header and the Connection header field itself when empty.
The removal happens as soon as the request is handled by Traefik,
thus the removed headers are not available when the request passes through the middleware chain.
The `connection` option lists the Connection headers allowed to passthrough the middleware chain before their removal.
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
web:
address: ":80"
forwardedHeaders:
connection:
- foobar
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.web]
address = ":80"
[entryPoints.web.forwardedHeaders]
connection = ["foobar"]
```
```bash tab="CLI"
## Static configuration
--entryPoints.web.address=:80
--entryPoints.web.forwardedHeaders.connection=foobar
```
??? info "`forwardedHeaders.addXForwardedSchemeHeaders`"
Add the compatibility headers `X-Forwarded-Scheme` and `X-Scheme` next to `X-Forwarded-Proto`.
This is primarily useful when migrating from ingress-nginx and your applications still rely on these legacy headers.
When enabled, these compatibility headers follow the same value as `X-Forwarded-Proto`.
```yaml tab="File (YAML)"
## Static configuration
entryPoints:
websecure:
address: ":443"
forwardedHeaders:
addXForwardedSchemeHeaders: true
```
```toml tab="File (TOML)"
## Static configuration
[entryPoints]
[entryPoints.websecure]
address = ":443"
[entryPoints.websecure.forwardedHeaders]
addXForwardedSchemeHeaders = true
```
```bash tab="CLI"
## Static configuration
--entryPoints.websecure.address=:443
--entryPoints.websecure.forwardedHeaders.addXForwardedSchemeHeaders=true
```
### HTTP3
As HTTP/3 actually uses UDP, when Traefik is configured with a TCP `entryPoint`
on port N with HTTP/3 enabled, the underlying HTTP/3 server that is started
automatically listens on UDP port N too. As a consequence,
it means port N cannot be used by another UDP `entryPoint`.
Since HTTP/3 requires the use of TLS,
only routers with TLS enabled will be usable with HTTP/3.
### ProxyProtocol and Load-Balancers
The replacement of the remote client address will occur only for IP addresses listed in `trustedIPs`. This is where you specify your load balancer IPs or CIDR ranges.
When queuing Traefik behind another load-balancer, make sure to configure
PROXY protocol on both sides.
Not doing so could introduce a security risk in your system (enabling request forgery).
### reusePort
#### Examples
Many processes on the same EntryPoint:
```yaml tab="File (YAML)"
entryPoints:
web:
address: ":80"
reusePort: true
```
```yaml tab="Helm Chart Values"
## Values file
additionalArguments:
- --entryPoints.web.reusePort=true
```
Many processes on the same EntryPoint on another host:
```yaml tab="File (YAML)"
entryPoints:
web:
address: ":80"
reusePort: true
privateWeb:
address: "192.168.1.2:80"
reusePort: true
```
```yaml tab="Helm Chart Values"
additionalArguments:
- --entryPoints.web.reusePort=true
- --entryPoints.privateWeb.address=192.168.1.2:80
- --entryPoints.privateWeb.reusePort=true
```
#### Supported platforms
The `reusePort` option currently works only on Linux, FreeBSD, OpenBSD and Darwin.
It will be ignored on other platforms.
There is a known bug in the Linux kernel that may cause unintended TCP connection
failures when using the `reusePort` option. For more details, see [here](https://lwn.net/Articles/853637/).
#### Canary deployment
Use the `reusePort` option with the other option `transport.lifeCycle.gracetimeout`
to do
canary deployments against Traefik itself. Like upgrading Traefik version
or reloading the static configuration without any service downtime.
### traceVerbosity
`observability.traceVerbosity` defines the tracing verbosity level for routers attached to this EntryPoint.
Routers can override this value in their own observability configuration.
Possible values are:
- `minimal`: produces a single server span and one client span for each request processed by a router.
- `detailed`: enables the creation of additional spans for each middleware executed for each request processed by a router.
## Systemd Socket Activation
Traefik supports [systemd socket activation](https://www.freedesktop.org/software/systemd/man/latest/systemd-socket-activate.html).
When a socket activation file descriptor name matches an EntryPoint name, the corresponding file descriptor will be used as the TCP/UDP listener for the matching EntryPoint.
```bash
systemd-socket-activate -l 80 -l 443 --fdname web:websecure ./traefik --entrypoints.web --entrypoints.websecure
```
!!! warning "EntryPoint Address"
When a socket activation file descriptor name matches an EntryPoint name, its address configuration is ignored. To support UDP routing, the address must have the `/udp` suffix (`--entrypoints.my-udp-entrypoint.address=/udp`).
!!! warning "Docker Support"
Socket activation is not supported by Docker but works with Podman containers.
!!! warning "Multiple listeners in socket file"
Each systemd socket file must contain only one Listen directive, except in the case of HTTP/3, where the file must include both ListenStream and ListenDatagram directives. To set up TCP and UDP listeners on the same port, use multiple socket files with different entrypoints names.