Prepare release v1.4.4

Fix raw path handling in strip prefix
Remove GzipHandler Fork
2017-11-23 11:48:03 +01:00 · 2017-11-21 14:28:03 +01:00 · 2017-11-20 18:32:03 +01:00 · 2017-11-20 15:16:03 +01:00 · 2017-11-20 11:42:03 +01:00 · 2017-11-20 09:42:02 +01:00
183 changed files with 9267 additions and 2575 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -16,8 +16,21 @@ HOW TO WRITE A GOOD PULL REQUEST?

 -->

-### Description
+### What does this PR do?

-<!--
-Briefly describe the pull request in a few paragraphs.
-->
+<!-- A brief description of the change being made with this pull request. -->
+
+
+### Motivation
+
+<!-- What inspired you to submit this pull request? -->
+
+
+### More
+
+- [ ] Added/updated tests
+- [ ] Added/updated documentation
+
+### Additional Notes
+
+<!-- Anything else we should know when reviewing? -->
--- a/.travis.yml
+++ b/.travis.yml
@@ -36,6 +36,7 @@ deploy:
    on:
      repo: containous/traefik
      tags: true
+      condition: ${TRAVIS_TAG} =~ ^v[0-9]+\.[0-9]+\.[0-9]+$
  - provider: releases
    api_key: ${GITHUB_TOKEN}
    file: dist/traefik*
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,384 @@
 # Change Log

+## [v1.4.4](https://github.com/containous/traefik/tree/v1.4.4) (2017-11-21)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.3...v1.4.4)
+
+**Enhancements:**
+- **[middleware]** Remove GzipHandler Fork ([#2436](https://github.com/containous/traefik/pull/2436) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[docker]** Fix problems about duplicated and missing Docker backends/frontends. ([#2434](https://github.com/containous/traefik/pull/2434) by [nmengin](https://github.com/nmengin))
+- **[middleware]** Fix raw path handling in strip prefix ([#2382](https://github.com/containous/traefik/pull/2382) by [marco-jantke](https://github.com/marco-jantke))
+- **[rancher]** Fix issue with label traefik.backend.loadbalancer.stickiness.cookieName ([#2423](https://github.com/containous/traefik/pull/2423) by [rawmind0](https://github.com/rawmind0))
+- http.Server log goes to Debug level. ([#2420](https://github.com/containous/traefik/pull/2420) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- Documentation archive ([#2405](https://github.com/containous/traefik/pull/2405) by [ldez](https://github.com/ldez))
+
+## [v1.4.3](https://github.com/containous/traefik/tree/v1.4.3) (2017-11-14)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.2...v1.4.3)
+
+**Bug fixes:**
+- **[consulcatalog]** Fix Traefik reload if Consul Catalog tags change ([#2389](https://github.com/containous/traefik/pull/2389) by [mmatur](https://github.com/mmatur))
+- **[kv]** Add Traefik prefix to the KV key ([#2400](https://github.com/containous/traefik/pull/2400) by [nmengin](https://github.com/nmengin))
+- **[middleware]** Flush and Status code ([#2403](https://github.com/containous/traefik/pull/2403) by [ldez](https://github.com/ldez))
+- **[middleware]** Exclude GRPC from compress ([#2391](https://github.com/containous/traefik/pull/2391) by [ldez](https://github.com/ldez))
+- **[middleware]** Keep status when stream mode and compress ([#2380](https://github.com/containous/traefik/pull/2380) by [Juliens](https://github.com/Juliens))
+
+**Documentation:**
+- **[acme]** Fix some typos ([#2363](https://github.com/containous/traefik/pull/2363) by [tomsaleeba](https://github.com/tomsaleeba))
+- **[docker]** Minor fix for docker volume vs created directory ([#2372](https://github.com/containous/traefik/pull/2372) by [visibilityspots](https://github.com/visibilityspots))
+- **[k8s]** Link corrected ([#2385](https://github.com/containous/traefik/pull/2385) by [xlazex](https://github.com/xlazex))
+
+**Misc:**
+- **[k8s]** Add secret creation to docs for kubernetes backend ([#2374](https://github.com/containous/traefik/pull/2374) by [shadycuz](https://github.com/shadycuz))
+
+## [v1.4.2](https://github.com/containous/traefik/tree/v1.4.2) (2017-11-02)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.1...v1.4.2)
+
+**Bug fixes:**
+- **[cluster]** Fix datastore corruption on reload due to shrinking config size ([#2340](https://github.com/containous/traefik/pull/2340) by [else](https://github.com/else))
+- **[docker,docker/swarm]** Make frontend names differents for similar routes ([#2338](https://github.com/containous/traefik/pull/2338) by [nmengin](https://github.com/nmengin))
+- **[docker]** Fix IP address when Docker container network mode is container ([#2331](https://github.com/containous/traefik/pull/2331) by [nmengin](https://github.com/nmengin))
+- **[docker]** Make the traefik.port label optional when using service labels in Docker containers. ([#2330](https://github.com/containous/traefik/pull/2330) by [nmengin](https://github.com/nmengin))
+- **[docker]** Add unique ID to Docker services replicas ([#2314](https://github.com/containous/traefik/pull/2314) by [nmengin](https://github.com/nmengin))
+- **[marathon]** Missing Backend key in configuration when application has no tasks ([#2333](https://github.com/containous/traefik/pull/2333) by [aantono](https://github.com/aantono))
+- Remove hardcoded runtime.GOMAXPROCS. ([#2317](https://github.com/containous/traefik/pull/2317) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[k8s]** fixed dead link in kubernetes backend config docs ([#2337](https://github.com/containous/traefik/pull/2337) by [perplexa](https://github.com/perplexa))
+- **[k8s]** Fix the k8s docs example deployment yaml ([#2308](https://github.com/containous/traefik/pull/2308) by [gnur](https://github.com/gnur))
+- Minor grammar change ([#2350](https://github.com/containous/traefik/pull/2350) by [haxorjim](https://github.com/haxorjim))
+- Minor typo ([#2343](https://github.com/containous/traefik/pull/2343) by [burningTyger](https://github.com/burningTyger))
+
+## [v1.4.1](https://github.com/containous/traefik/tree/v1.4.1) (2017-10-24)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.0...v1.4.1)
+
+**Bug fixes:**
+- **[docker]** Network filter ([#2301](https://github.com/containous/traefik/pull/2301) by [ldez](https://github.com/ldez))
+- **[healthcheck]** Fix healthcheck path ([#2295](https://github.com/containous/traefik/pull/2295) by [emilevauge](https://github.com/emilevauge))
+- **[rules]** Regex capturing group. ([#2296](https://github.com/containous/traefik/pull/2296) by [ldez](https://github.com/ldez))
+- **[websocket]** Force http/1.1 for websocket ([#2292](https://github.com/containous/traefik/pull/2292) by [Juliens](https://github.com/Juliens))
+- Stream mode when http2 ([#2309](https://github.com/containous/traefik/pull/2309) by [Juliens](https://github.com/Juliens))
+- Enhance Trust Forwarded Headers ([#2302](https://github.com/containous/traefik/pull/2302) by [ldez](https://github.com/ldez))
+
+## [v1.4.0](https://github.com/containous/traefik/tree/v1.4.0) (2017-10-16)
+[All Commits](https://github.com/containous/traefik/compare/v1.3.0-rc1...v1.4.0)
+
+**Enhancements:**
+- **[acme]** Display Traefik logs in integration tests ([#2114](https://github.com/containous/traefik/pull/2114) by [ldez](https://github.com/ldez))
+- **[acme]** Make the ACME developments testing easier ([#1769](https://github.com/containous/traefik/pull/1769) by [nmengin](https://github.com/nmengin))
+- **[acme]** contrib: Dump keys/certs from acme.json to files ([#1484](https://github.com/containous/traefik/pull/1484) by [brianredbeard](https://github.com/brianredbeard))
+- **[api]** Add HTTP HEAD handling to /ping endpoint ([#1768](https://github.com/containous/traefik/pull/1768) by [martinbaillie](https://github.com/martinbaillie))
+- **[authentication,consulcatalog]** Add Basic auth for consul catalog ([#2027](https://github.com/containous/traefik/pull/2027) by [mmatur](https://github.com/mmatur))
+- **[authentication,marathon]** Add marathon label to configure basic auth ([#1799](https://github.com/containous/traefik/pull/1799) by [nikore](https://github.com/nikore))
+- **[authentication,ecs]** Add basic auth for ecs ([#2026](https://github.com/containous/traefik/pull/2026) by [mmatur](https://github.com/mmatur))
+- **[authentication,middleware]** Add forward authentication option ([#1972](https://github.com/containous/traefik/pull/1972) by [drampelt](https://github.com/drampelt))
+- **[authentication]** Manage Headers for the Authentication forwarding. ([#2132](https://github.com/containous/traefik/pull/2132) by [ldez](https://github.com/ldez))
+- **[consulcatalog,sticky-session]** Enable loadbalancer.sticky for Consul Catalog ([#1917](https://github.com/containous/traefik/pull/1917) by [nbonneval](https://github.com/nbonneval))
+- **[consulcatalog]** Exposed by default feature in Consul Catalog ([#2006](https://github.com/containous/traefik/pull/2006) by [mmatur](https://github.com/mmatur))
+- **[consulcatalog]** Speeding up consul catalog health change detection ([#1694](https://github.com/containous/traefik/pull/1694) by [vholovko](https://github.com/vholovko))
+- **[consulcatalog]** Enhanced flexibility in Consul Catalog configuration ([#1565](https://github.com/containous/traefik/pull/1565) by [aantono](https://github.com/aantono))
+- **[docker,k8s]** IP Whitelists for Frontend (with Docker- &amp; Kubernetes-Provider Support) ([#1332](https://github.com/containous/traefik/pull/1332) by [MaZderMind](https://github.com/MaZderMind))
+- **[ecs,sticky-session]** Enable loadbalancer.sticky for ECS ([#1925](https://github.com/containous/traefik/pull/1925) by [mmatur](https://github.com/mmatur))
+- **[ecs]** Add support for several ECS backends ([#1913](https://github.com/containous/traefik/pull/1913) by [mmatur](https://github.com/mmatur))
+- **[file]** Allow file provider to load service config from files in a directory. ([#1672](https://github.com/containous/traefik/pull/1672) by [rjshep](https://github.com/rjshep))
+- **[healthcheck]** Add healthcheck command ([#1982](https://github.com/containous/traefik/pull/1982) by [emilevauge](https://github.com/emilevauge))
+- **[healthcheck]** Allow overriding the port used for healthchecks ([#1567](https://github.com/containous/traefik/pull/1567) by [bakins](https://github.com/bakins))
+- **[k8s,rules]** kubernetes ingress rewrite-target implementation ([#1723](https://github.com/containous/traefik/pull/1723) by [mlaccetti](https://github.com/mlaccetti))
+- **[k8s]** Added ability to override frontend priority for k8s ingress router ([#1874](https://github.com/containous/traefik/pull/1874) by [DiverOfDark](https://github.com/DiverOfDark))
+- **[kv]** Adds definitions to backend kv template for health checking ([#1644](https://github.com/containous/traefik/pull/1644) by [zachomedia](https://github.com/zachomedia))
+- **[logs,dynamodb,ecs,marathon]** Link some providers logs to Traefik ([#1746](https://github.com/containous/traefik/pull/1746) by [ldez](https://github.com/ldez))
+- **[logs,marathon]** remove confusing go-marathon log message ([#1810](https://github.com/containous/traefik/pull/1810) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs]** Send traefik logs to stdout instead stderr ([#2054](https://github.com/containous/traefik/pull/2054) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs]** enable logging to stdout for access logs ([#1683](https://github.com/containous/traefik/pull/1683) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs]** Logs &amp; errors review ([#1673](https://github.com/containous/traefik/pull/1673) by [ldez](https://github.com/ldez))
+- **[logs]** Switch access logging to logrus ([#1647](https://github.com/containous/traefik/pull/1647) by [rjshep](https://github.com/rjshep))
+- **[logs]** log X-Forwarded-For as ClientHost if present ([#1946](https://github.com/containous/traefik/pull/1946) by [mildis](https://github.com/mildis))
+- **[logs]** Restore: First stage of access logging middleware. ([#1571](https://github.com/containous/traefik/pull/1571) by [ldez](https://github.com/ldez))
+- **[logs]** Add log file close and reopen on receipt of SIGUSR1 ([#1761](https://github.com/containous/traefik/pull/1761) by [rjshep](https://github.com/rjshep))
+- **[logs]** add RetryAttempts to AccessLog in JSON format ([#1793](https://github.com/containous/traefik/pull/1793) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs]** Add JSON as access logging format ([#1669](https://github.com/containous/traefik/pull/1669) by [rjshep](https://github.com/rjshep))
+- **[marathon]** Support multi-port service routing for containers running on Marathon ([#1742](https://github.com/containous/traefik/pull/1742) by [aantono](https://github.com/aantono))
+- **[marathon]** Improve Marathon integration tests. ([#1406](https://github.com/containous/traefik/pull/1406) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Exported getSubDomain function from Marathon provider ([#1693](https://github.com/containous/traefik/pull/1693) by [aantono](https://github.com/aantono))
+- **[marathon]** Use test builder. ([#1871](https://github.com/containous/traefik/pull/1871) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Add support for readiness checks. ([#1883](https://github.com/containous/traefik/pull/1883) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Move marathon mock ([#1732](https://github.com/containous/traefik/pull/1732) by [ldez](https://github.com/ldez))
+- **[marathon]** Use single API call to fetch Marathon resources. ([#1815](https://github.com/containous/traefik/pull/1815) by [timoreimann](https://github.com/timoreimann))
+- **[metrics]** Added RetryMetrics to DataDog and StatsD providers ([#1884](https://github.com/containous/traefik/pull/1884) by [aantono](https://github.com/aantono))
+- **[metrics]** Extract metrics to own package and refactor implementations ([#1968](https://github.com/containous/traefik/pull/1968) by [marco-jantke](https://github.com/marco-jantke))
+- **[metrics]** Add metrics for backend_retries_total ([#1504](https://github.com/containous/traefik/pull/1504) by [marco-jantke](https://github.com/marco-jantke))
+- **[metrics]** Add status code to request duration metric ([#1755](https://github.com/containous/traefik/pull/1755) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Add trusted whitelist proxy protocol ([#2234](https://github.com/containous/traefik/pull/2234) by [emilevauge](https://github.com/emilevauge)))
+- **[metrics]** DataDog and StatsD Metrics Support ([#1701](https://github.com/containous/traefik/pull/1701) by [aantono](https://github.com/aantono))
+- **[middleware]** Create Header Middleware ([#1236](https://github.com/containous/traefik/pull/1236) by [dtomcej](https://github.com/dtomcej))
+- **[middleware]** Add configurable timeouts and curate default timeout settings ([#1873](https://github.com/containous/traefik/pull/1873) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Fix command bug content. ([#2002](https://github.com/containous/traefik/pull/2002) by [ldez](https://github.com/ldez))
+- **[middleware]** Retry only on real network errors ([#1549](https://github.com/containous/traefik/pull/1549) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Return 503 on empty backend ([#1748](https://github.com/containous/traefik/pull/1748) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Custom Error Pages ([#1675](https://github.com/containous/traefik/pull/1675) by [bparli](https://github.com/bparli))
+- **[oxy]** Support X-Forwarded-Port. ([#1960](https://github.com/containous/traefik/pull/1960) by [ldez](https://github.com/ldez))
+- **[provider,tls]** Added a check to ensure clientTLS configuration contains either a cert or a key ([#1932](https://github.com/containous/traefik/pull/1932) by [aantono](https://github.com/aantono))
+- **[provider]** Deflake integration tests ([#1599](https://github.com/containous/traefik/pull/1599) by [ldez](https://github.com/ldez))
+- **[provider]** Factorize labels ([#1843](https://github.com/containous/traefik/pull/1843) by [ldez](https://github.com/ldez))
+- **[provider]** Replace go routine by Safe.Go ([#1879](https://github.com/containous/traefik/pull/1879) by [ldez](https://github.com/ldez))
+- **[rancher]** Refactor into dual Rancher API/Metadata providers ([#1563](https://github.com/containous/traefik/pull/1563) by [martinbaillie](https://github.com/martinbaillie))
+- **[rules]** Add support for Query String filtering ([#1934](https://github.com/containous/traefik/pull/1934) by [driverpt](https://github.com/driverpt))
+- **[rules]** Simplify stripPrefix and stripPrefixRegex tests ([#1699](https://github.com/containous/traefik/pull/1699) by [ldez](https://github.com/ldez))
+- **[rules]** Enhance rules tests. ([#1679](https://github.com/containous/traefik/pull/1679) by [ldez](https://github.com/ldez))
+- **[sticky-session]** make the cookie name unique to the backend being served ([#1716](https://github.com/containous/traefik/pull/1716) by [richardjq](https://github.com/richardjq))
+- **[tls]** Handle RootCAs certificate ([#1789](https://github.com/containous/traefik/pull/1789) by [Juliens](https://github.com/Juliens))
+- **[tls]** enable TLS client forwarding ([#1446](https://github.com/containous/traefik/pull/1446) by [drewwells](https://github.com/drewwells))
+- **[websocket]** Add tests for urlencoded part in url ([#2199](https://github.com/containous/traefik/pull/2199) by [Juliens](https://github.com/Juliens))
+- **[websocket]** Add test for SSL TERMINATION in Websocket IT ([#2063](https://github.com/containous/traefik/pull/2063) by [Juliens](https://github.com/Juliens)
+- **[webui]** Proxy in dev mode ([#1544](https://github.com/containous/traefik/pull/1544) by [maxwo](https://github.com/maxwo))
+- **[webui]** Minor Health UI fixes ([#1651](https://github.com/containous/traefik/pull/1651) by [mihaitodor](https://github.com/mihaitodor))
+- Fail fast in IT and fix some flaky tests ([#2126](https://github.com/containous/traefik/pull/2126) by [ldez](https://github.com/ldez))
+- extract lb configuration steps into method ([#1841](https://github.com/containous/traefik/pull/1841) by [marco-jantke](https://github.com/marco-jantke))
+- Add whitelist configuration option for entrypoints ([#1702](https://github.com/containous/traefik/pull/1702) by [christopherobin](https://github.com/christopherobin))
+- Enhance integration tests ([#1842](https://github.com/containous/traefik/pull/1842) by [ldez](https://github.com/ldez))
+- Add helloworld tests with gRPC ([#1845](https://github.com/containous/traefik/pull/1845) by [Juliens](https://github.com/Juliens))
+- Add the sprig functions in the template engine ([#1891](https://github.com/containous/traefik/pull/1891) by [thomasbach76](https://github.com/thomasbach76))
+- Refactor globalConfiguration / WebProvider ([#1938](https://github.com/containous/traefik/pull/1938) by [Juliens](https://github.com/Juliens))
+- Code cleaning. ([#1956](https://github.com/containous/traefik/pull/1956) by [ldez](https://github.com/ldez))
+- Add proxy protocol ([#2004](https://github.com/containous/traefik/pull/2004) by [emilevauge](https://github.com/emilevauge))
+- Bump gorilla/mux version. ([#1954](https://github.com/containous/traefik/pull/1954) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[cluster,kv]** Be certain to clear our marshalled representation before reloading it ([#2165](https://github.com/containous/traefik/pull/2165) by [gozer](https://github.com/gozer))
+- **[consulcatalog,docker,ecs,k8s,kv,marathon,rancher,sticky-session]** Backward compatibility for sticky ([#2266](https://github.com/containous/traefik/pull/2266) by [ldez](https://github.com/ldez))
+- **[consulcatalog,docker,ecs,k8s,marathon,rancher,sticky-session]** Stickiness cookie name ([#2232](https://github.com/containous/traefik/pull/2232) by [ldez](https://github.com/ldez))
+- **[consulcatalog,docker,ecs,k8s,marathon,rancher,sticky-session]** Stickiness cookie name. ([#2251](https://github.com/containous/traefik/pull/2251) by [ldez](https://github.com/ldez))
+- **[consulcatalog]** Fix consul catalog retry ([#2263](https://github.com/containous/traefik/pull/2263) by [mmatur](https://github.com/mmatur))
+- **[consulcatalog]** Flaky tests and refresh problem in consul catalog ([#2148](https://github.com/containous/traefik/pull/2148) by [Juliens](https://github.com/Juliens))
+- **[consulcatalog]** Consul catalog failed to remove service  ([#2157](https://github.com/containous/traefik/pull/2157) by [Juliens](https://github.com/Juliens))
+- **[consulcatalog]** Fix Consul Catalog refresh ([#2089](https://github.com/containous/traefik/pull/2089) by [Juliens](https://github.com/Juliens))
+- **[docker]** Changed Docker network filter to allow any swarm network ([#2244](https://github.com/containous/traefik/pull/2244) by [pistolero](https://github.com/pistolero))
+- **[docker]** Error handling for docker swarm mode ([#1533](https://github.com/containous/traefik/pull/1533) by [tanyadegurechaff](https://github.com/tanyadegurechaff))
+- **[ecs]** Handle empty ECS Clusters properly ([#2170](https://github.com/containous/traefik/pull/2170) by [jeffreykoetsier](https://github.com/jeffreykoetsier))
+- **[healthcheck]** Fix healthcheck port ([#2131](https://github.com/containous/traefik/pull/2131) by [fredix](https://github.com/fredix))
+- **[healthcheck]** Bind healthcheck to backend by entryPointName ([#1868](https://github.com/containous/traefik/pull/1868) by [chrigl](https://github.com/chrigl))
+- **[k8s]** Continue processing on invalid auth-realm annotation. ([#2252](https://github.com/containous/traefik/pull/2252) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Use default frontend priority of zero. ([#1906](https://github.com/containous/traefik/pull/1906) by [timoreimann](https://github.com/timoreimann))
+- **[kv]** add retry backoff to staert config loading ([#2268](https://github.com/containous/traefik/pull/2268) by [emilevauge](https://github.com/emilevauge))
+- **[logs,middleware]** Enable loss less rotation of log files ([#2062](https://github.com/containous/traefik/pull/2062) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs,middleware]** Access log default values ([#2061](https://github.com/containous/traefik/pull/2061) by [ldez](https://github.com/ldez))
+- **[logs]** Fix flakiness in log rotation test ([#2213](https://github.com/containous/traefik/pull/2213) by [marco-jantke](https://github.com/marco-jantke))
+- **[marathon]** Assign filtered tasks to apps contained in slice. ([#1881](https://github.com/containous/traefik/pull/1881) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Fix fallback to other nodes for Marathon ([#1740](https://github.com/containous/traefik/pull/1740) by [marco-jantke](https://github.com/marco-jantke))
+- **[metrics]** prometheus, HTTP method and utf8 ([#2081](https://github.com/containous/traefik/pull/2081) by [ldez](https://github.com/ldez))
+- **[middleware]** Enable prefix matching within slash boundaries ([#2214](https://github.com/containous/traefik/pull/2214) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Fix SSE subscriptions when retries are enabled ([#2145](https://github.com/containous/traefik/pull/2145) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** compress: preserve status code ([#1948](https://github.com/containous/traefik/pull/1948) by [ldez](https://github.com/ldez))
+- **[rancher]** Add stack name to backend name generation to fix rancher metadata backend ([#2107](https://github.com/containous/traefik/pull/2107) by [SantoDE](https://github.com/SantoDE))
+- **[rancher]** Rancher host IP address ([#2101](https://github.com/containous/traefik/pull/2101) by [matq007](https://github.com/matq007))
+- **[rancher]** fix seconds to really be seconds ([#2259](https://github.com/containous/traefik/pull/2259) by [SantoDE](https://github.com/SantoDE))
+- **[rancher]** fix rancher api environment get ([#2053](https://github.com/containous/traefik/pull/2053) by [SantoDE](https://github.com/SantoDE))
+- **[sticky-session]** Sanitize cookie names. ([#2216](https://github.com/containous/traefik/pull/2216) by [timoreimann](https://github.com/timoreimann))
+- **[sticky-session]** Setting the Cookie Path explicitly to root ([#1950](https://github.com/containous/traefik/pull/1950) by [marcopaga](https://github.com/marcopaga))
+- **[websocket]** Forward upgrade error from backend ([#2187](https://github.com/containous/traefik/pull/2187) by [Juliens](https://github.com/Juliens))
+- **[websocket]** RawPath and Transfer TLSConfig in websocket ([#2088](https://github.com/containous/traefik/pull/2088) by [Juliens](https://github.com/Juliens))
+- Nil body retries ([#2258](https://github.com/containous/traefik/pull/2258) by [Juliens](https://github.com/Juliens))
+- Fix deprecated IdleTimeout config ([#2143](https://github.com/containous/traefik/pull/2143) by [marco-jantke](https://github.com/marco-jantke))
+- Fixes entry points configuration. ([#2120](https://github.com/containous/traefik/pull/2120) by [ldez](https://github.com/ldez))
+- Delay first version check ([#2215](https://github.com/containous/traefik/pull/2215) by [emilevauge](https://github.com/emilevauge))
+- Move http2 configure transport  ([#2231](https://github.com/containous/traefik/pull/2231) by [Juliens](https://github.com/Juliens))
+- Fix error in prepareServer ([#2076](https://github.com/containous/traefik/pull/2076) by [emilevauge](https://github.com/emilevauge))
+- New entry point parser. ([#2248](https://github.com/containous/traefik/pull/2248) by [ldez](https://github.com/ldez))
+- Add TrustForwardHeader options. ([#2262](https://github.com/containous/traefik/pull/2262) by [ldez](https://github.com/ldez))
+- `bug` command. ([#2178](https://github.com/containous/traefik/pull/2178) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme,provider]** Enhance documentation readability. ([#2095](https://github.com/containous/traefik/pull/2095) by [ldez](https://github.com/ldez))
+- **[acme,provider]** Fix whitespaces ([#2075](https://github.com/containous/traefik/pull/2075) by [chulkilee](https://github.com/chulkilee))
+- **[acme,provider]** Re-organize documentation ([#2012](https://github.com/containous/traefik/pull/2012) by [jmaitrehenry](https://github.com/jmaitrehenry))
+- **[acme]** Fix grammar ([#2208](https://github.com/containous/traefik/pull/2208) by [mvasin](https://github.com/mvasin))
+- **[acme]** Add guide for Docker, Traefik &amp; Letsencrypt ([#1923](https://github.com/containous/traefik/pull/1923) by [mvdstam](https://github.com/mvdstam))
+- **[acme]** Improve Let&#39;s Encrypt documentation ([#1885](https://github.com/containous/traefik/pull/1885) by [nmengin](https://github.com/nmengin))
+- **[acme]** Update docs for dnsimple env vars. ([#1872](https://github.com/containous/traefik/pull/1872) by [untalpierre](https://github.com/untalpierre))
+- **[api]** Add examples of proxying ping ([#2102](https://github.com/containous/traefik/pull/2102) by [deitch](https://github.com/deitch))
+- **[authentication,k8s]** traefik controller access to secrets ([#1707](https://github.com/containous/traefik/pull/1707) by [spinto](https://github.com/spinto))
+- **[consul,tls]** doc change regarding consul SSL ([#1774](https://github.com/containous/traefik/pull/1774) by [bitsofinfo](https://github.com/bitsofinfo))
+- **[consulcatalog,docker,ecs,k8s,marathon,rancher,sticky-session]** Stickiness documentation ([#2238](https://github.com/containous/traefik/pull/2238) by [ldez](https://github.com/ldez))
+- **[consul]** added consul acl token note ([#1720](https://github.com/containous/traefik/pull/1720) by [bitsofinfo](https://github.com/bitsofinfo))
+- **[docker]** Updating Docker output and curl for sticky sessions ([#2150](https://github.com/containous/traefik/pull/2150) by [jtyr](https://github.com/jtyr))
+- **[docker]** Add more visibility to docker stack deploy label issue ([#1984](https://github.com/containous/traefik/pull/1984) by [jmaitrehenry](https://github.com/jmaitrehenry))
+- **[ecs]** Fix IAM policy sid. ([#2066](https://github.com/containous/traefik/pull/2066) by [charlieoleary](https://github.com/charlieoleary))
+- **[k8s,marathon]** Mark Marathon and Kubernetes as constraint-supporting. ([#1964](https://github.com/containous/traefik/pull/1964) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Add guide section on production advice, esp. CPU. ([#2113](https://github.com/containous/traefik/pull/2113) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Document ways to partition Ingresses in the k8s guide. ([#2223](https://github.com/containous/traefik/pull/2223) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Remove pod from RBAC rules. ([#2229](https://github.com/containous/traefik/pull/2229) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Quote priority values in annotation examples. ([#2230](https://github.com/containous/traefik/pull/2230) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Fix invalid service yaml example ([#2059](https://github.com/containous/traefik/pull/2059) by [kairen](https://github.com/kairen))
+- **[k8s]** Update usage of `.local` with `.minikube` in k8s docs ([#1551](https://github.com/containous/traefik/pull/1551) by [errm](https://github.com/errm))
+- **[k8s]** Update the documentation to use DaemonSet or Deployment ([#1735](https://github.com/containous/traefik/pull/1735) by [saschagrunert](https://github.com/saschagrunert))
+- **[k8s]** Fix docs about default namespaces. ([#1961](https://github.com/containous/traefik/pull/1961) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Moved namespace to correct place ([#1911](https://github.com/containous/traefik/pull/1911) by [markround](https://github.com/markround))
+- **[k8s]** examples/k8s: fix ui ingress port out of sync with deployment ([#1943](https://github.com/containous/traefik/pull/1943) by [borancar](https://github.com/borancar))
+- **[k8s]** Add secrets resource to in-line RBAC spec. ([#1890](https://github.com/containous/traefik/pull/1890) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Improve documentation. ([#1831](https://github.com/containous/traefik/pull/1831) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Fix documentation glitches. ([#1996](https://github.com/containous/traefik/pull/1996) by [timoreimann](https://github.com/timoreimann))
+- **[metrics]** Enhance web backend documentation ([#2122](https://github.com/containous/traefik/pull/2122) by [ldez](https://github.com/ldez))
+- **[mesos]** fix: documentation Mesos. ([#2029](https://github.com/containous/traefik/pull/2029) by [ldez](https://github.com/ldez))
+- **[middleware]** Improve compression documentation ([#2184](https://github.com/containous/traefik/pull/2184) by [errm](https://github.com/errm))
+- **[provider]** Clarify that provider-enabling argument parameters set all defaults. ([#1830](https://github.com/containous/traefik/pull/1830) by [timoreimann](https://github.com/timoreimann))
+- **[rancher]** Update Rancher documentation. ([#1776](https://github.com/containous/traefik/pull/1776) by [ldez](https://github.com/ldez))
+- **[webui]** Document yarnpkg. ([#1558](https://github.com/containous/traefik/pull/1558) by [Stibbons](https://github.com/Stibbons))
+- Add forward auth documentation. ([#2110](https://github.com/containous/traefik/pull/2110) by [ldez](https://github.com/ldez))
+- User guide gRPC ([#2108](https://github.com/containous/traefik/pull/2108) by [Juliens](https://github.com/Juliens))
+- Document custom error page restrictions. ([#2104](https://github.com/containous/traefik/pull/2104) by [timoreimann](https://github.com/timoreimann))
+- Prepare release v1.4.0-rc3 ([#2135](https://github.com/containous/traefik/pull/2135) by [Juliens](https://github.com/Juliens))
+- Update gRPC example ([#2191](https://github.com/containous/traefik/pull/2191) by [jsenon](https://github.com/jsenon))
+- Prepare release v1.4.0-rc2 ([#2091](https://github.com/containous/traefik/pull/2091) by [ldez](https://github.com/ldez))
+- Fix grammar mistake in the kv-config docs ([#2197](https://github.com/containous/traefik/pull/2197) by [chr4](https://github.com/chr4))
+- Update cluster.md ([#2073](https://github.com/containous/traefik/pull/2073) by [kmbremner](https://github.com/kmbremner))
+- Prepare release v1.4.0-rc4 ([#2201](https://github.com/containous/traefik/pull/2201) by [nmengin](https://github.com/nmengin))
+- Prepare release v1.4.0-rc5 ([#2241](https://github.com/containous/traefik/pull/2241) by [ldez](https://github.com/ldez))
+- Enhance documentation. ([#2048](https://github.com/containous/traefik/pull/2048) by [ldez](https://github.com/ldez))
+- doc: add notes on server urls with path ([#2045](https://github.com/containous/traefik/pull/2045) by [chulkilee](https://github.com/chulkilee))
+- Enhance security headers doc. ([#2042](https://github.com/containous/traefik/pull/2042) by [ldez](https://github.com/ldez))
+- HTTPS for images, video and links in docs. ([#2041](https://github.com/containous/traefik/pull/2041) by [ldez](https://github.com/ldez))
+- Fix error pages configuration. ([#2038](https://github.com/containous/traefik/pull/2038) by [ldez](https://github.com/ldez))
+- Fix Proxy Protocol documentation ([#2253](https://github.com/containous/traefik/pull/2253) by [emilevauge](https://github.com/emilevauge))
+- Update GraceTimeOut documentation ([#1875](https://github.com/containous/traefik/pull/1875) by [marco-jantke](https://github.com/marco-jantke))
+- Release cycle. ([#1812](https://github.com/containous/traefik/pull/1812) by [ldez](https://github.com/ldez))
+- Update contributing guide build steps ([#1801](https://github.com/containous/traefik/pull/1801) by [jsturtevant](https://github.com/jsturtevant))
+- Add Nicolas Mengin to maintainers ([#1792](https://github.com/containous/traefik/pull/1792) by [emilevauge](https://github.com/emilevauge))
+- Add Julien Salleyron to maintainers ([#1790](https://github.com/containous/traefik/pull/1790) by [emilevauge](https://github.com/emilevauge))
+- Change to a more flexible PR review process ([#1781](https://github.com/containous/traefik/pull/1781) by [emilevauge](https://github.com/emilevauge))
+- Traefik &#34;bug&#34; command documentation ([#1811](https://github.com/containous/traefik/pull/1811) by [ldez](https://github.com/ldez))
+- Change Traefik intro video ([#1893](https://github.com/containous/traefik/pull/1893) by [emilevauge](https://github.com/emilevauge))
+- Prepare release v1.4.0-rc1 ([#2021](https://github.com/containous/traefik/pull/2021) by [ldez](https://github.com/ldez))
+- Add play-with-docker example ([#1726](https://github.com/containous/traefik/pull/1726) by [marcosnils](https://github.com/marcosnils))
+- Add Marco Jantke to maintainers ([#1980](https://github.com/containous/traefik/pull/1980) by [emilevauge](https://github.com/emilevauge))
+- Remove Russel from maintainers ([#1614](https://github.com/containous/traefik/pull/1614) by [emilevauge](https://github.com/emilevauge))
+- Update CONTRIBUTING.md. ([#1667](https://github.com/containous/traefik/pull/1667) by [timoreimann](https://github.com/timoreimann))
+- drop &#34;slave&#34; wording for &#34;worker&#34; ([#1645](https://github.com/containous/traefik/pull/1645) by [djalal](https://github.com/djalal))
+- Use more inclusive language in README.md {guys =&gt; folks} ([#1640](https://github.com/containous/traefik/pull/1640) by [igorwwwwwwwwwwwwwwwwwwww](https://github.com/igorwwwwwwwwwwwwwwwwwwww))
+- Remove Thomas Recloux from maintainers ([#1616](https://github.com/containous/traefik/pull/1616) by [emilevauge](https://github.com/emilevauge))
+- Update documentation for 1.4 release ([#2011](https://github.com/containous/traefik/pull/2011) by [emilevauge](https://github.com/emilevauge))
+- Small toml documentation update ([#1603](https://github.com/containous/traefik/pull/1603) by [antoine-aumjaud](https://github.com/antoine-aumjaud))
+- Add @ldez to maintainers ([#1589](https://github.com/containous/traefik/pull/1589) by [emilevauge](https://github.com/emilevauge))
+- doc: add labels documentation. ([#1582](https://github.com/containous/traefik/pull/1582) by [ldez](https://github.com/ldez))
+- Update golang version in contributing guide ([#2018](https://github.com/containous/traefik/pull/2018) by [ArikaChen](https://github.com/ArikaChen))
+- toml page - replace li by table ([#1995](https://github.com/containous/traefik/pull/1995) by [jmaitrehenry](https://github.com/jmaitrehenry))
+
+**Misc:**
+- Merge v1.3.7 ([#2013](https://github.com/containous/traefik/pull/2013) by [ldez](https://github.com/ldez))
+- Merge 1.3.6 ([#1992](https://github.com/containous/traefik/pull/1992) by [ldez](https://github.com/ldez))
+- Merge 1.3.5 ([#1909](https://github.com/containous/traefik/pull/1909) by [ldez](https://github.com/ldez))
+- Merge 1.3.3 ([#1836](https://github.com/containous/traefik/pull/1836) by [ldez](https://github.com/ldez))
+- Merge v1.3.2 to master  ([#1809](https://github.com/containous/traefik/pull/1809) by [ldez](https://github.com/ldez))
+- Merge current v1.3 ([#1797](https://github.com/containous/traefik/pull/1797) by [ldez](https://github.com/ldez))
+- Merge current v1.3 ([#1786](https://github.com/containous/traefik/pull/1786) by [ldez](https://github.com/ldez))
+- Merge v1.3.1 to master ([#1763](https://github.com/containous/traefik/pull/1763) by [ldez](https://github.com/ldez))
+- Merge current v1.3 ([#1753](https://github.com/containous/traefik/pull/1753) by [ldez](https://github.com/ldez))
+- Merge current v1.3 ([#1705](https://github.com/containous/traefik/pull/1705) by [ldez](https://github.com/ldez))
+- Merge current v1.3 to master ([#1697](https://github.com/containous/traefik/pull/1697) by [ldez](https://github.com/ldez))
+- Merge v1 3 0 ([#1692](https://github.com/containous/traefik/pull/1692) by [ldez](https://github.com/ldez))
+- Merge current v1.3 to master (rc3) ([#1666](https://github.com/containous/traefik/pull/1666) by [ldez](https://github.com/ldez))
+- Merge current v1.3 to master  ([#1643](https://github.com/containous/traefik/pull/1643) by [ldez](https://github.com/ldez))
+- Merge v1.3.0-rc2 master ([#1613](https://github.com/containous/traefik/pull/1613) by [emilevauge](https://github.com/emilevauge))
+- Merge v1.3 branch into master [2017-05-11] ([#1548](https://github.com/containous/traefik/pull/1548) by [timoreimann](https://github.com/timoreimann))
+
+## [v1.4.0-rc5](https://github.com/containous/traefik/tree/v1.4.0-rc5) (2017-10-10)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.0-rc4...v1.4.0-rc5)
+
+**Enhancements:**
+- **[middleware]** Add trusted whitelist proxy protocol ([#2234](https://github.com/containous/traefik/pull/2234) by [emilevauge](https://github.com/emilevauge))
+
+**Bug fixes:**
+- **[consul,docker,ecs,k8s,marathon,rancher,sticky-session]** Stickiness cookie name ([#2232](https://github.com/containous/traefik/pull/2232) by [ldez](https://github.com/ldez))
+- **[logs]** Fix flakiness in log rotation test ([#2213](https://github.com/containous/traefik/pull/2213) by [marco-jantke](https://github.com/marco-jantke))
+- **[middleware]** Enable prefix matching within slash boundaries ([#2214](https://github.com/containous/traefik/pull/2214) by [marco-jantke](https://github.com/marco-jantke))
+- **[sticky-session]** Sanitize cookie names. ([#2216](https://github.com/containous/traefik/pull/2216) by [timoreimann](https://github.com/timoreimann))
+- Move http2 configure transport  ([#2231](https://github.com/containous/traefik/pull/2231) by [Juliens](https://github.com/Juliens))
+- Delay first version check ([#2215](https://github.com/containous/traefik/pull/2215) by [emilevauge](https://github.com/emilevauge))
+
+**Documentation:**
+- **[acme]** Fix grammar ([#2208](https://github.com/containous/traefik/pull/2208) by [mvasin](https://github.com/mvasin))
+- **[docker,ecs,k8s,marathon,rancher]** Stickiness documentation ([#2238](https://github.com/containous/traefik/pull/2238) by [ldez](https://github.com/ldez))
+- **[k8s]** Quote priority values in annotation examples. ([#2230](https://github.com/containous/traefik/pull/2230) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Remove pod from RBAC rules. ([#2229](https://github.com/containous/traefik/pull/2229) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Document ways to partition Ingresses in the k8s guide. ([#2223](https://github.com/containous/traefik/pull/2223) by [timoreimann](https://github.com/timoreimann))
+
+## [v1.4.0-rc4](https://github.com/containous/traefik/tree/v1.4.0-rc4) (2017-10-02)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.0-rc3...v1.4.0-rc4)
+
+**Bug fixes:**
+- **[cluster,kv]** Be certain to clear our marshalled representation before reloading it ([#2165](https://github.com/containous/traefik/pull/2165) by [gozer](https://github.com/gozer))
+- **[consulcatalog]** Consul catalog failed to remove service  ([#2157](https://github.com/containous/traefik/pull/2157) by [Juliens](https://github.com/Juliens))
+- **[consulcatalog]** Flaky tests and refresh problem in consul catalog ([#2148](https://github.com/containous/traefik/pull/2148) by [Juliens](https://github.com/Juliens))
+- **[ecs]** Handle empty ECS Clusters properly ([#2170](https://github.com/containous/traefik/pull/2170) by [jeffreykoetsier](https://github.com/jeffreykoetsier))
+- **[middleware]** Fix SSE subscriptions when retries are enabled ([#2145](https://github.com/containous/traefik/pull/2145) by [marco-jantke](https://github.com/marco-jantke))
+- **[websocket]** Forward upgrade error from backend ([#2187](https://github.com/containous/traefik/pull/2187) by [Juliens](https://github.com/Juliens))
+- `bug` command. ([#2178](https://github.com/containous/traefik/pull/2178) by [ldez](https://github.com/ldez))
+- Fix deprecated IdleTimeout config ([#2143](https://github.com/containous/traefik/pull/2143) by [marco-jantke](https://github.com/marco-jantke))
+
+**Documentation:**
+- **[docker]** Updating Docker output and curl for sticky sessions ([#2150](https://github.com/containous/traefik/pull/2150) by [jtyr](https://github.com/jtyr))
+- **[middleware]** Improve compression documentation ([#2184](https://github.com/containous/traefik/pull/2184) by [errm](https://github.com/errm))
+- Fix grammar mistake in the kv-config docs ([#2197](https://github.com/containous/traefik/pull/2197) by [chr4](https://github.com/chr4))
+- Update gRPC example ([#2191](https://github.com/containous/traefik/pull/2191) by [jsenon](https://github.com/jsenon))
+
+**Misc:**
+- **[websocket]** Add tests for urlencoded part in url ([#2199](https://github.com/containous/traefik/pull/2199) by [Juliens](https://github.com/Juliens))
+
+## [v1.4.0-rc3](https://github.com/containous/traefik/tree/v1.4.0-rc3) (2017-09-18)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.0-rc2...v1.4.0-rc3)
+
+**Enhancements:**
+- **[acme]** Display Traefik logs in integration tests ([#2114](https://github.com/containous/traefik/pull/2114) by [ldez](https://github.com/ldez))
+- **[authentication]** Manage Headers for the Authentication forwarding. ([#2132](https://github.com/containous/traefik/pull/2132) by [ldez](https://github.com/ldez))
+- Fail fast in IT and fix some flaky tests ([#2126](https://github.com/containous/traefik/pull/2126) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[consul]** Fix Consul Catalog refresh ([#2089](https://github.com/containous/traefik/pull/2089) by [Juliens](https://github.com/Juliens))
+- **[healthcheck]** Fix healthcheck port ([#2131](https://github.com/containous/traefik/pull/2131) by [fredix](https://github.com/fredix))
+- **[logs,middleware]** Enable loss less rotation of log files ([#2062](https://github.com/containous/traefik/pull/2062) by [marco-jantke](https://github.com/marco-jantke))
+- **[rancher]** Add stack name to backend name generation to fix rancher metadata backend ([#2107](https://github.com/containous/traefik/pull/2107) by [SantoDE](https://github.com/SantoDE))
+- **[rancher]** Rancher host IP address ([#2101](https://github.com/containous/traefik/pull/2101) by [matq007](https://github.com/matq007))
+- Fixes entry points configuration. ([#2120](https://github.com/containous/traefik/pull/2120) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme,provider]** Enhance documentation readability. ([#2095](https://github.com/containous/traefik/pull/2095) by [ldez](https://github.com/ldez))
+- **[api]** Add examples of proxying ping ([#2102](https://github.com/containous/traefik/pull/2102) by [deitch](https://github.com/deitch))
+- **[k8s]** Add guide section on production advice, esp. CPU. ([#2113](https://github.com/containous/traefik/pull/2113) by [timoreimann](https://github.com/timoreimann))
+- **[metrics]** Enhance web backend documentation ([#2122](https://github.com/containous/traefik/pull/2122) by [ldez](https://github.com/ldez))
+- Add forward auth documentation. ([#2110](https://github.com/containous/traefik/pull/2110) by [ldez](https://github.com/ldez))
+- User guide gRPC ([#2108](https://github.com/containous/traefik/pull/2108) by [Juliens](https://github.com/Juliens))
+- Document custom error page restrictions. ([#2104](https://github.com/containous/traefik/pull/2104) by [timoreimann](https://github.com/timoreimann))
+
+## [v1.4.0-rc2](https://github.com/containous/traefik/tree/v1.4.0-rc2) (2017-09-08)
+[All Commits](https://github.com/containous/traefik/compare/v1.4.0-rc1...v1.4.0-rc2)
+
+**Enhancements:**
+- **[authentication,consul]** Add Basic auth for consul catalog ([#2027](https://github.com/containous/traefik/pull/2027) by [mmatur](https://github.com/mmatur))
+- **[authentication,ecs]** Add basic auth for ecs ([#2026](https://github.com/containous/traefik/pull/2026) by [mmatur](https://github.com/mmatur))
+- **[logs]** Send traefik logs to stdout instead stderr ([#2054](https://github.com/containous/traefik/pull/2054) by [marco-jantke](https://github.com/marco-jantke))
+- **[websocket]** Add test for SSL TERMINATION in Websocket IT ([#2063](https://github.com/containous/traefik/pull/2063) by [Juliens](https://github.com/Juliens))
+
+**Bug fixes:**
+- **[consul]** Fix consul catalog refresh problems ([#2089](https://github.com/containous/traefik/pull/2089) by [Juliens](https://github.com/Juliens))
+- **[logs,middleware]** Access log default values ([#2061](https://github.com/containous/traefik/pull/2061) by [ldez](https://github.com/ldez))
+- **[metrics]** prometheus, HTTP method and utf8 ([#2081](https://github.com/containous/traefik/pull/2081) by [ldez](https://github.com/ldez))
+- **[rancher]** fix rancher api environment get ([#2053](https://github.com/containous/traefik/pull/2053) by [SantoDE](https://github.com/SantoDE))
+- **[websocket]** RawPath and Transfer TLSConfig in websocket ([#2088](https://github.com/containous/traefik/pull/2088) by [Juliens](https://github.com/Juliens))
+- Fix error in prepareServer ([#2076](https://github.com/containous/traefik/pull/2076) by [emilevauge](https://github.com/emilevauge))
+
+**Documentation:**
+- **[acme,provider]** Fix whitespaces ([#2075](https://github.com/containous/traefik/pull/2075) by [chulkilee](https://github.com/chulkilee))
+- **[ecs]** Fix IAM policy sid. ([#2066](https://github.com/containous/traefik/pull/2066) by [charlieoleary](https://github.com/charlieoleary))
+- **[k8s]** Fix invalid service yaml example ([#2059](https://github.com/containous/traefik/pull/2059) by [kairen](https://github.com/kairen))
+- **[mesos]** fix: documentation Mesos. ([#2029](https://github.com/containous/traefik/pull/2029) by [ldez](https://github.com/ldez))
+- Update cluster.md ([#2073](https://github.com/containous/traefik/pull/2073) by [kmbremner](https://github.com/kmbremner))
+- Enhance documentation. ([#2048](https://github.com/containous/traefik/pull/2048) by [ldez](https://github.com/ldez))
+- doc: add notes on server urls with path ([#2045](https://github.com/containous/traefik/pull/2045) by [chulkilee](https://github.com/chulkilee))
+- Enhance security headers doc. ([#2042](https://github.com/containous/traefik/pull/2042) by [ldez](https://github.com/ldez))
+- HTTPS for images, video and links in docs. ([#2041](https://github.com/containous/traefik/pull/2041) by [ldez](https://github.com/ldez))
+- Fix error pages configuration. ([#2038](https://github.com/containous/traefik/pull/2038) by [ldez](https://github.com/ldez))
+
 ## [v1.4.0-rc1](https://github.com/containous/traefik/tree/v1.4.0-rc1) (2017-08-28)
 [All Commits](https://github.com/containous/traefik/compare/v1.3.0-rc1...v1.4.0-rc1)

@@ -143,6 +522,12 @@
 - Merge current v1.3 to master  ([#1643](https://github.com/containous/traefik/pull/1643) by [ldez](https://github.com/ldez))
 - Merge v1.3.0-rc2 master ([#1613](https://github.com/containous/traefik/pull/1613) by [emilevauge](https://github.com/emilevauge))

+## [v1.3.8](https://github.com/containous/traefik/tree/v1.3.8) (2017-09-07)
+[All Commits](https://github.com/containous/traefik/compare/v1.3.7...v1.3.8)
+
+**Bug fixes:**
+- **[middleware]** Compress and Webscocket ([#2079](https://github.com/containous/traefik/pull/2079) by [ldez](https://github.com/ldez))
+
 ## [v1.3.7](https://github.com/containous/traefik/tree/v1.3.7) (2017-08-25)
 [All Commits](https://github.com/containous/traefik/compare/v1.3.6...v1.3.7)

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,7 +2,7 @@

 ## Building

-You need either [Docker](https://github.com/docker/docker) and `make` (Method 1), or `go` (Method 2) in order to build traefik. For changes to its dependencies, the `glide` dependency management tool and `glide-vc` plugin are required.
+You need either [Docker](https://github.com/docker/docker) and `make` (Method 1), or `go` (Method 2) in order to build Traefik. For changes to its dependencies, the `glide` dependency management tool and `glide-vc` plugin are required.

 ### Method 1: Using `Docker` and `Makefile`

--- a/6
+++ b/6
@@ -97,7 +97,7 @@ dist:

 run-dev:
 	go generate
-	go build
+	go build ./cmd/traefik
 	./traefik

 generate-webui: build-webui
@@ -114,9 +114,7 @@ fmt:
 	gofmt -s -l -w $(SRCS)

 pull-images:
-	for f in $(shell find ./integration/resources/compose/ -type f); do \
-		docker-compose -f $$f pull; \
-	done
+	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml | awk '{print $$2}' | sort | uniq  | xargs -P 6 -n 1 docker pull

 help: ## this help
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
--- a/README.md
+++ b/README.md
@@ -17,20 +17,20 @@ It supports several backends ([Docker](https://www.docker.com/), [Swarm mode](ht

 ---

-| **[Overview](#overview)** |
-**[Features](#features)** |
-**[Supported backends](#supported-backends)** |
-**[Quickstart](#quickstart)** |
-**[Web UI](#web-ui)** |
-**[Test it](#test-it)** |
-**[Documentation](#documentation)** |
-**[Support](#support)** |
-**[Release cycle](#release-cycle)** |
+. **[Overview](#overview)** .
+**[Features](#features)** .
+**[Supported backends](#supported-backends)** .
+**[Quickstart](#quickstart)** .
+**[Web UI](#web-ui)** .
+**[Test it](#test-it)** .
+**[Documentation](#documentation)** .

-| **[Contributing](#contributing)** |
-**[Maintainers](#maintainers)** |
-**[Plumbing](#plumbing)** |
-**[Credits](#credits)** |
+. **[Support](#support)** .
+**[Release cycle](#release-cycle)** .
+**[Contributing](#contributing)** .
+**[Maintainers](#maintainers)** .
+**[Plumbing](#plumbing)** .
+**[Credits](#credits)** .

 ---

@@ -61,7 +61,7 @@ Run it and forget it!

 - [It's fast](https://docs.traefik.io/benchmarks)
 - No dependency hell, single binary made with go
- [Tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) official docker image
+- [Tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) docker image
 - Rest API
 - Hot-reloading of configuration. No need to restart the process
 - Circuit breakers, retry
--- a/acme/account.go
+++ b/acme/account.go
@@ -178,7 +178,7 @@ func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain D
 			return nil
 		}
 	}
-	return fmt.Errorf("Certificate to renew not found for domain %s", domain.Main)
+	return fmt.Errorf("certificate to renew not found for domain %s", domain.Main)
 }

 func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, domain Domain) (*DomainsCertificate, error) {
--- a/acme/challengeProvider.go
+++ b/acme/challengeProvider.go
@@ -43,7 +43,7 @@ func (c *challengeProvider) getCertificate(domain string) (cert *tls.Certificate
 				}
 			}
 		}
-		return fmt.Errorf("Cannot find challenge cert for domain %s", domain)
+		return fmt.Errorf("cannot find challenge cert for domain %s", domain)
 	}
 	notify := func(err error, time time.Duration) {
 		log.Errorf("Error getting cert: %v, retrying in %s", err, time)
--- a/auth/forward.go
+++ b/auth/forward.go
@@ -1,60 +0,0 @@
-package auth
-
-import (
-	"io/ioutil"
-	"net/http"
-
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/types"
-)
-
-// Forward the authentication to a external server
-func Forward(forward *types.Forward, w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-	httpClient := http.Client{}
-
-	if forward.TLS != nil {
-		tlsConfig, err := forward.TLS.CreateTLSConfig()
-		if err != nil {
-			log.Debugf("Impossible to configure TLS to call %s. Cause %s", forward.Address, err)
-			w.WriteHeader(http.StatusInternalServerError)
-			return
-		}
-		httpClient.Transport = &http.Transport{
-			TLSClientConfig: tlsConfig,
-		}
-
-	}
-
-	forwardReq, err := http.NewRequest(http.MethodGet, forward.Address, nil)
-	if err != nil {
-		log.Debugf("Error calling %s. Cause %s", forward.Address, err)
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	forwardReq.Header = r.Header
-
-	forwardResponse, forwardErr := httpClient.Do(forwardReq)
-	if forwardErr != nil {
-		log.Debugf("Error calling %s. Cause: %s", forward.Address, forwardErr)
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-
-	body, readError := ioutil.ReadAll(forwardResponse.Body)
-	if readError != nil {
-		log.Debugf("Error reading body %s. Cause: %s", forward.Address, readError)
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	defer forwardResponse.Body.Close()
-
-	if forwardResponse.StatusCode < http.StatusOK || forwardResponse.StatusCode >= http.StatusMultipleChoices {
-		log.Debugf("Remote error %s. StatusCode: %d", forward.Address, forwardResponse.StatusCode)
-		w.WriteHeader(forwardResponse.StatusCode)
-		w.Write(body)
-		return
-	}
-
-	r.RequestURI = r.URL.RequestURI()
-	next(w, r)
-}
--- a/cluster/datastore.go
+++ b/cluster/datastore.go
@@ -119,19 +119,8 @@ func (d *Datastore) watchChanges() error {

 func (d *Datastore) reload() error {
 	log.Debug("Datastore reload")
-	d.localLock.Lock()
-	err := d.kv.LoadConfig(d.meta)
-	if err != nil {
-		d.localLock.Unlock()
-		return err
-	}
-	err = d.meta.unmarshall()
-	if err != nil {
-		d.localLock.Unlock()
-		return err
-	}
-	d.localLock.Unlock()
-	return nil
+	_, err := d.Load()
+	return err
 }

 // Begin creates a transaction with the KV store.
@@ -199,6 +188,10 @@ func (d *Datastore) get() *Metadata {
 func (d *Datastore) Load() (Object, error) {
 	d.localLock.Lock()
 	defer d.localLock.Unlock()
+
+	// clear Object first, as mapstructure's decoder doesn't have ZeroFields set to true for merging purposes
+	d.meta.Object = d.meta.Object[:0]
+
 	err := d.kv.LoadConfig(d.meta)
 	if err != nil {
 		return nil, err
--- a/cmd/traefik/anonymize/anonymize.go
+++ b/cmd/traefik/anonymize/anonymize.go
@@ -0,0 +1,136 @@
+package anonymize
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"regexp"
+
+	"github.com/mitchellh/copystructure"
+	"github.com/mvdan/xurls"
+)
+
+const (
+	maskShort = "xxxx"
+	maskLarge = maskShort + maskShort + maskShort + maskShort + maskShort + maskShort + maskShort + maskShort
+)
+
+// Do configuration.
+func Do(baseConfig interface{}, indent bool) (string, error) {
+	anomConfig, err := copystructure.Copy(baseConfig)
+	if err != nil {
+		return "", err
+	}
+
+	val := reflect.ValueOf(anomConfig)
+
+	err = doOnStruct(val)
+	if err != nil {
+		return "", err
+	}
+
+	configJSON, err := marshal(anomConfig, indent)
+	if err != nil {
+		return "", err
+	}
+
+	return doOnJSON(string(configJSON)), nil
+}
+
+func doOnJSON(input string) string {
+	mailExp := regexp.MustCompile(`\w[-._\w]*\w@\w[-._\w]*\w\.\w{2,3}"`)
+	return xurls.Relaxed.ReplaceAllString(mailExp.ReplaceAllString(input, maskLarge+"\""), maskLarge)
+}
+
+func doOnStruct(field reflect.Value) error {
+	switch field.Kind() {
+	case reflect.Ptr:
+		if !field.IsNil() {
+			if err := doOnStruct(field.Elem()); err != nil {
+				return err
+			}
+		}
+	case reflect.Struct:
+		for i := 0; i < field.NumField(); i++ {
+			fld := field.Field(i)
+			stField := field.Type().Field(i)
+			if !isExported(stField) {
+				continue
+			}
+			if stField.Tag.Get("export") == "true" {
+				if err := doOnStruct(fld); err != nil {
+					return err
+				}
+			} else {
+				if err := reset(fld, stField.Name); err != nil {
+					return err
+				}
+			}
+		}
+	case reflect.Map:
+		for _, key := range field.MapKeys() {
+			if err := doOnStruct(field.MapIndex(key)); err != nil {
+				return err
+			}
+		}
+	case reflect.Slice:
+		for j := 0; j < field.Len(); j++ {
+			if err := doOnStruct(field.Index(j)); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func reset(field reflect.Value, name string) error {
+	if !field.CanSet() {
+		return fmt.Errorf("cannot reset field %s", name)
+	}
+
+	switch field.Kind() {
+	case reflect.Ptr:
+		if !field.IsNil() {
+			field.Set(reflect.Zero(field.Type()))
+		}
+	case reflect.Struct:
+		if field.IsValid() {
+			field.Set(reflect.Zero(field.Type()))
+		}
+	case reflect.String:
+		if field.String() != "" {
+			field.Set(reflect.ValueOf(maskShort))
+		}
+	case reflect.Map:
+		if field.Len() > 0 {
+			field.Set(reflect.MakeMap(field.Type()))
+		}
+	case reflect.Slice:
+		if field.Len() > 0 {
+			field.Set(reflect.MakeSlice(field.Type(), 0, 0))
+		}
+	case reflect.Interface:
+		if !field.IsNil() {
+			return reset(field.Elem(), "")
+		}
+	default:
+		// Primitive type
+		field.Set(reflect.Zero(field.Type()))
+	}
+	return nil
+}
+
+// isExported return true is a struct field is exported, else false
+func isExported(f reflect.StructField) bool {
+	if f.PkgPath != "" && !f.Anonymous {
+		return false
+	}
+	return true
+}
+
+func marshal(anomConfig interface{}, indent bool) ([]byte, error) {
+	if indent {
+		return json.MarshalIndent(anomConfig, "", " ")
+	}
+	return json.Marshal(anomConfig)
+}
--- a/cmd/traefik/anonymize/anonymize_config_test.go
+++ b/cmd/traefik/anonymize/anonymize_config_test.go
@@ -0,0 +1,670 @@
+package anonymize
+
+import (
+	"crypto/tls"
+	"testing"
+	"time"
+
+	"github.com/containous/flaeg"
+	"github.com/containous/traefik/acme"
+	"github.com/containous/traefik/configuration"
+	"github.com/containous/traefik/middlewares"
+	"github.com/containous/traefik/provider"
+	"github.com/containous/traefik/provider/boltdb"
+	"github.com/containous/traefik/provider/consul"
+	"github.com/containous/traefik/provider/docker"
+	"github.com/containous/traefik/provider/dynamodb"
+	"github.com/containous/traefik/provider/ecs"
+	"github.com/containous/traefik/provider/etcd"
+	"github.com/containous/traefik/provider/eureka"
+	"github.com/containous/traefik/provider/file"
+	"github.com/containous/traefik/provider/kubernetes"
+	"github.com/containous/traefik/provider/kv"
+	"github.com/containous/traefik/provider/marathon"
+	"github.com/containous/traefik/provider/mesos"
+	"github.com/containous/traefik/provider/rancher"
+	"github.com/containous/traefik/provider/web"
+	"github.com/containous/traefik/provider/zk"
+	"github.com/containous/traefik/safe"
+	"github.com/containous/traefik/types"
+	thoas_stats "github.com/thoas/stats"
+)
+
+func TestDo_globalConfiguration(t *testing.T) {
+
+	config := &configuration.GlobalConfiguration{}
+
+	config.GraceTimeOut = flaeg.Duration(666 * time.Second)
+	config.Debug = true
+	config.CheckNewVersion = true
+	config.AccessLogsFile = "AccessLogsFile"
+	config.AccessLog = &types.AccessLog{
+		FilePath: "AccessLog FilePath",
+		Format:   "AccessLog Format",
+	}
+	config.TraefikLogsFile = "TraefikLogsFile"
+	config.LogLevel = "LogLevel"
+	config.EntryPoints = configuration.EntryPoints{
+		"foo": {
+			Network: "foo Network",
+			Address: "foo Address",
+			TLS: &configuration.TLS{
+				MinVersion:   "foo MinVersion",
+				CipherSuites: []string{"foo CipherSuites 1", "foo CipherSuites 2", "foo CipherSuites 3"},
+				Certificates: configuration.Certificates{
+					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
+					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
+				},
+				ClientCAFiles: []string{"foo ClientCAFiles 1", "foo ClientCAFiles 2", "foo ClientCAFiles 3"},
+			},
+			Redirect: &configuration.Redirect{
+				Replacement: "foo Replacement",
+				Regex:       "foo Regex",
+				EntryPoint:  "foo EntryPoint",
+			},
+			Auth: &types.Auth{
+				Basic: &types.Basic{
+					UsersFile: "foo Basic UsersFile",
+					Users:     types.Users{"foo Basic Users 1", "foo Basic Users 2", "foo Basic Users 3"},
+				},
+				Digest: &types.Digest{
+					UsersFile: "foo Digest UsersFile",
+					Users:     types.Users{"foo Digest Users 1", "foo Digest Users 2", "foo Digest Users 3"},
+				},
+				Forward: &types.Forward{
+					Address: "foo Address",
+					TLS: &types.ClientTLS{
+						CA:                 "foo CA",
+						Cert:               "foo Cert",
+						Key:                "foo Key",
+						InsecureSkipVerify: true,
+					},
+					TrustForwardHeader: true,
+				},
+			},
+			WhitelistSourceRange: []string{"foo WhitelistSourceRange 1", "foo WhitelistSourceRange 2", "foo WhitelistSourceRange 3"},
+			Compress:             true,
+			ProxyProtocol: &configuration.ProxyProtocol{
+				TrustedIPs: []string{"127.0.0.1/32", "192.168.0.1"},
+			},
+		},
+		"fii": {
+			Network: "fii Network",
+			Address: "fii Address",
+			TLS: &configuration.TLS{
+				MinVersion:   "fii MinVersion",
+				CipherSuites: []string{"fii CipherSuites 1", "fii CipherSuites 2", "fii CipherSuites 3"},
+				Certificates: configuration.Certificates{
+					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
+					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
+				},
+				ClientCAFiles: []string{"fii ClientCAFiles 1", "fii ClientCAFiles 2", "fii ClientCAFiles 3"},
+			},
+			Redirect: &configuration.Redirect{
+				Replacement: "fii Replacement",
+				Regex:       "fii Regex",
+				EntryPoint:  "fii EntryPoint",
+			},
+			Auth: &types.Auth{
+				Basic: &types.Basic{
+					UsersFile: "fii Basic UsersFile",
+					Users:     types.Users{"fii Basic Users 1", "fii Basic Users 2", "fii Basic Users 3"},
+				},
+				Digest: &types.Digest{
+					UsersFile: "fii Digest UsersFile",
+					Users:     types.Users{"fii Digest Users 1", "fii Digest Users 2", "fii Digest Users 3"},
+				},
+				Forward: &types.Forward{
+					Address: "fii Address",
+					TLS: &types.ClientTLS{
+						CA:                 "fii CA",
+						Cert:               "fii Cert",
+						Key:                "fii Key",
+						InsecureSkipVerify: true,
+					},
+					TrustForwardHeader: true,
+				},
+			},
+			WhitelistSourceRange: []string{"fii WhitelistSourceRange 1", "fii WhitelistSourceRange 2", "fii WhitelistSourceRange 3"},
+			Compress:             true,
+			ProxyProtocol: &configuration.ProxyProtocol{
+				TrustedIPs: []string{"127.0.0.1/32", "192.168.0.1"},
+			},
+		},
+	}
+	config.Cluster = &types.Cluster{
+		Node: "Cluster Node",
+		Store: &types.Store{
+			Prefix: "Cluster Store Prefix",
+			// ...
+		},
+	}
+	config.Constraints = types.Constraints{
+		{
+			Key:       "Constraints Key 1",
+			Regex:     "Constraints Regex 2",
+			MustMatch: true,
+		},
+		{
+			Key:       "Constraints Key 1",
+			Regex:     "Constraints Regex 2",
+			MustMatch: true,
+		},
+	}
+	config.ACME = &acme.ACME{
+		Email: "acme Email",
+		Domains: []acme.Domain{
+			{
+				Main: "Domains Main",
+				SANs: []string{"Domains acme SANs 1", "Domains acme SANs 2", "Domains acme SANs 3"},
+			},
+		},
+		Storage:           "Storage",
+		StorageFile:       "StorageFile",
+		OnDemand:          true,
+		OnHostRule:        true,
+		CAServer:          "CAServer",
+		EntryPoint:        "EntryPoint",
+		DNSProvider:       "DNSProvider",
+		DelayDontCheckDNS: 666,
+		ACMELogging:       true,
+		TLSConfig: &tls.Config{
+			InsecureSkipVerify: true,
+			// ...
+		},
+	}
+	config.DefaultEntryPoints = configuration.DefaultEntryPoints{"DefaultEntryPoints 1", "DefaultEntryPoints 2", "DefaultEntryPoints 3"}
+	config.ProvidersThrottleDuration = flaeg.Duration(666 * time.Second)
+	config.MaxIdleConnsPerHost = 666
+	config.IdleTimeout = flaeg.Duration(666 * time.Second)
+	config.InsecureSkipVerify = true
+	config.RootCAs = configuration.RootCAs{"RootCAs 1", "RootCAs 2", "RootCAs 3"}
+	config.Retry = &configuration.Retry{
+		Attempts: 666,
+	}
+	config.HealthCheck = &configuration.HealthCheckConfig{
+		Interval: flaeg.Duration(666 * time.Second),
+	}
+	config.RespondingTimeouts = &configuration.RespondingTimeouts{
+		ReadTimeout:  flaeg.Duration(666 * time.Second),
+		WriteTimeout: flaeg.Duration(666 * time.Second),
+		IdleTimeout:  flaeg.Duration(666 * time.Second),
+	}
+	config.ForwardingTimeouts = &configuration.ForwardingTimeouts{
+		DialTimeout:           flaeg.Duration(666 * time.Second),
+		ResponseHeaderTimeout: flaeg.Duration(666 * time.Second),
+	}
+	config.Docker = &docker.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "docker Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "docker Constraints Key 1",
+					Regex:     "docker Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "docker Constraints Key 1",
+					Regex:     "docker Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint: "docker Endpoint",
+		Domain:   "docker Domain",
+		TLS: &types.ClientTLS{
+			CA:                 "docker CA",
+			Cert:               "docker Cert",
+			Key:                "docker Key",
+			InsecureSkipVerify: true,
+		},
+		ExposedByDefault: true,
+		UseBindPortIP:    true,
+		SwarmMode:        true,
+	}
+	config.File = &file.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "file Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "file Constraints Key 1",
+					Regex:     "file Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "file Constraints Key 1",
+					Regex:     "file Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Directory: "file Directory",
+	}
+	config.Web = &web.Provider{
+		Address:  "web Address",
+		CertFile: "web CertFile",
+		KeyFile:  "web KeyFile",
+		ReadOnly: true,
+		Statistics: &types.Statistics{
+			RecentErrors: 666,
+		},
+		Metrics: &types.Metrics{
+			Prometheus: &types.Prometheus{
+				Buckets: types.Buckets{6.5, 6.6, 6.7},
+			},
+			Datadog: &types.Datadog{
+				Address:      "Datadog Address",
+				PushInterval: "Datadog PushInterval",
+			},
+			StatsD: &types.Statsd{
+				Address:      "StatsD Address",
+				PushInterval: "StatsD PushInterval",
+			},
+		},
+		Path: "web Path",
+		Auth: &types.Auth{
+			Basic: &types.Basic{
+				UsersFile: "web Basic UsersFile",
+				Users:     types.Users{"web Basic Users 1", "web Basic Users 2", "web Basic Users 3"},
+			},
+			Digest: &types.Digest{
+				UsersFile: "web Digest UsersFile",
+				Users:     types.Users{"web Digest Users 1", "web Digest Users 2", "web Digest Users 3"},
+			},
+			Forward: &types.Forward{
+				Address: "web Address",
+				TLS: &types.ClientTLS{
+					CA:                 "web CA",
+					Cert:               "web Cert",
+					Key:                "web Key",
+					InsecureSkipVerify: true,
+				},
+				TrustForwardHeader: true,
+			},
+		},
+		Debug: true,
+		CurrentConfigurations: &safe.Safe{},
+		Stats: &thoas_stats.Stats{
+			Uptime:              time.Now(),
+			Pid:                 666,
+			ResponseCounts:      map[string]int{"foo": 1, "fii": 2, "fuu": 3},
+			TotalResponseCounts: map[string]int{"foo": 1, "fii": 2, "fuu": 3},
+			TotalResponseTime:   time.Now(),
+		},
+		StatsRecorder: &middlewares.StatsRecorder{},
+	}
+	config.Marathon = &marathon.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "marathon Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "marathon Constraints Key 1",
+					Regex:     "marathon Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "marathon Constraints Key 1",
+					Regex:     "marathon Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint:                "",
+		Domain:                  "",
+		ExposedByDefault:        true,
+		GroupsAsSubDomains:      true,
+		DCOSToken:               "",
+		MarathonLBCompatibility: true,
+		TLS: &types.ClientTLS{
+			CA:                 "marathon CA",
+			Cert:               "marathon Cert",
+			Key:                "marathon Key",
+			InsecureSkipVerify: true,
+		},
+		DialerTimeout:     flaeg.Duration(666 * time.Second),
+		KeepAlive:         flaeg.Duration(666 * time.Second),
+		ForceTaskHostname: true,
+		Basic: &marathon.Basic{
+			HTTPBasicAuthUser: "marathon HTTPBasicAuthUser",
+			HTTPBasicPassword: "marathon HTTPBasicPassword",
+		},
+		RespectReadinessChecks: true,
+	}
+	config.ConsulCatalog = &consul.CatalogProvider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "ConsulCatalog Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "ConsulCatalog Constraints Key 1",
+					Regex:     "ConsulCatalog Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "ConsulCatalog Constraints Key 1",
+					Regex:     "ConsulCatalog Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint:         "ConsulCatalog Endpoint",
+		Domain:           "ConsulCatalog Domain",
+		ExposedByDefault: true,
+		Prefix:           "ConsulCatalog Prefix",
+		FrontEndRule:     "ConsulCatalog FrontEndRule",
+	}
+	config.Kubernetes = &kubernetes.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "k8s Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "k8s Constraints Key 1",
+					Regex:     "k8s Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "k8s Constraints Key 1",
+					Regex:     "k8s Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint:               "k8s Endpoint",
+		Token:                  "k8s Token",
+		CertAuthFilePath:       "k8s CertAuthFilePath",
+		DisablePassHostHeaders: true,
+		Namespaces:             kubernetes.Namespaces{"k8s Namespaces 1", "k8s Namespaces 2", "k8s Namespaces 3"},
+		LabelSelector:          "k8s LabelSelector",
+	}
+	config.Mesos = &mesos.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "mesos Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "mesos Constraints Key 1",
+					Regex:     "mesos Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "mesos Constraints Key 1",
+					Regex:     "mesos Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint:           "mesos Endpoint",
+		Domain:             "mesos Domain",
+		ExposedByDefault:   true,
+		GroupsAsSubDomains: true,
+		ZkDetectionTimeout: 666,
+		RefreshSeconds:     666,
+		IPSources:          "mesos IPSources",
+		StateTimeoutSecond: 666,
+		Masters:            []string{"mesos Masters 1", "mesos Masters 2", "mesos Masters 3"},
+	}
+	config.Eureka = &eureka.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "eureka Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "eureka Constraints Key 1",
+					Regex:     "eureka Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "eureka Constraints Key 1",
+					Regex:     "eureka Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Endpoint: "eureka Endpoint",
+		Delay:    "eureka Delay",
+	}
+	config.ECS = &ecs.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "ecs Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "ecs Constraints Key 1",
+					Regex:     "ecs Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "ecs Constraints Key 1",
+					Regex:     "ecs Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		Domain:               "ecs Domain",
+		ExposedByDefault:     true,
+		RefreshSeconds:       666,
+		Clusters:             ecs.Clusters{"ecs Clusters 1", "ecs Clusters 2", "ecs Clusters 3"},
+		Cluster:              "ecs Cluster",
+		AutoDiscoverClusters: true,
+		Region:               "ecs Region",
+		AccessKeyID:          "ecs AccessKeyID",
+		SecretAccessKey:      "ecs SecretAccessKey",
+	}
+	config.Rancher = &rancher.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "rancher Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "rancher Constraints Key 1",
+					Regex:     "rancher Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "rancher Constraints Key 1",
+					Regex:     "rancher Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		APIConfiguration: rancher.APIConfiguration{
+			Endpoint:  "rancher Endpoint",
+			AccessKey: "rancher AccessKey",
+			SecretKey: "rancher SecretKey",
+		},
+		API: &rancher.APIConfiguration{
+			Endpoint:  "rancher Endpoint",
+			AccessKey: "rancher AccessKey",
+			SecretKey: "rancher SecretKey",
+		},
+		Metadata: &rancher.MetadataConfiguration{
+			IntervalPoll: true,
+			Prefix:       "rancher Metadata Prefix",
+		},
+		Domain:                    "rancher Domain",
+		RefreshSeconds:            666,
+		ExposedByDefault:          true,
+		EnableServiceHealthFilter: true,
+	}
+	config.DynamoDB = &dynamodb.Provider{
+		BaseProvider: provider.BaseProvider{
+			Watch:    true,
+			Filename: "dynamodb Filename",
+			Constraints: types.Constraints{
+				{
+					Key:       "dynamodb Constraints Key 1",
+					Regex:     "dynamodb Constraints Regex 2",
+					MustMatch: true,
+				},
+				{
+					Key:       "dynamodb Constraints Key 1",
+					Regex:     "dynamodb Constraints Regex 2",
+					MustMatch: true,
+				},
+			},
+			Trace: true,
+			DebugLogGeneratedTemplate: true,
+		},
+		AccessKeyID:     "dynamodb AccessKeyID",
+		RefreshSeconds:  666,
+		Region:          "dynamodb Region",
+		SecretAccessKey: "dynamodb SecretAccessKey",
+		TableName:       "dynamodb TableName",
+		Endpoint:        "dynamodb Endpoint",
+	}
+	config.Etcd = &etcd.Provider{
+		Provider: kv.Provider{
+			BaseProvider: provider.BaseProvider{
+				Watch:    true,
+				Filename: "etcd Filename",
+				Constraints: types.Constraints{
+					{
+						Key:       "etcd Constraints Key 1",
+						Regex:     "etcd Constraints Regex 2",
+						MustMatch: true,
+					},
+					{
+						Key:       "etcd Constraints Key 1",
+						Regex:     "etcd Constraints Regex 2",
+						MustMatch: true,
+					},
+				},
+				Trace: true,
+				DebugLogGeneratedTemplate: true,
+			},
+			Endpoint: "etcd Endpoint",
+			Prefix:   "etcd Prefix",
+			TLS: &types.ClientTLS{
+				CA:                 "etcd CA",
+				Cert:               "etcd Cert",
+				Key:                "etcd Key",
+				InsecureSkipVerify: true,
+			},
+			Username: "etcd Username",
+			Password: "etcd Password",
+		},
+	}
+	config.Zookeeper = &zk.Provider{
+		Provider: kv.Provider{
+			BaseProvider: provider.BaseProvider{
+				Watch:    true,
+				Filename: "zk Filename",
+				Constraints: types.Constraints{
+					{
+						Key:       "zk Constraints Key 1",
+						Regex:     "zk Constraints Regex 2",
+						MustMatch: true,
+					},
+					{
+						Key:       "zk Constraints Key 1",
+						Regex:     "zk Constraints Regex 2",
+						MustMatch: true,
+					},
+				},
+				Trace: true,
+				DebugLogGeneratedTemplate: true,
+			},
+			Endpoint: "zk Endpoint",
+			Prefix:   "zk Prefix",
+			TLS: &types.ClientTLS{
+				CA:                 "zk CA",
+				Cert:               "zk Cert",
+				Key:                "zk Key",
+				InsecureSkipVerify: true,
+			},
+			Username: "zk Username",
+			Password: "zk Password",
+		},
+	}
+	config.Boltdb = &boltdb.Provider{
+		Provider: kv.Provider{
+			BaseProvider: provider.BaseProvider{
+				Watch:    true,
+				Filename: "boltdb Filename",
+				Constraints: types.Constraints{
+					{
+						Key:       "boltdb Constraints Key 1",
+						Regex:     "boltdb Constraints Regex 2",
+						MustMatch: true,
+					},
+					{
+						Key:       "boltdb Constraints Key 1",
+						Regex:     "boltdb Constraints Regex 2",
+						MustMatch: true,
+					},
+				},
+				Trace: true,
+				DebugLogGeneratedTemplate: true,
+			},
+			Endpoint: "boltdb Endpoint",
+			Prefix:   "boltdb Prefix",
+			TLS: &types.ClientTLS{
+				CA:                 "boltdb CA",
+				Cert:               "boltdb Cert",
+				Key:                "boltdb Key",
+				InsecureSkipVerify: true,
+			},
+			Username: "boltdb Username",
+			Password: "boltdb Password",
+		},
+	}
+	config.Consul = &consul.Provider{
+		Provider: kv.Provider{
+			BaseProvider: provider.BaseProvider{
+				Watch:    true,
+				Filename: "consul Filename",
+				Constraints: types.Constraints{
+					{
+						Key:       "consul Constraints Key 1",
+						Regex:     "consul Constraints Regex 2",
+						MustMatch: true,
+					},
+					{
+						Key:       "consul Constraints Key 1",
+						Regex:     "consul Constraints Regex 2",
+						MustMatch: true,
+					},
+				},
+				Trace: true,
+				DebugLogGeneratedTemplate: true,
+			},
+			Endpoint: "consul Endpoint",
+			Prefix:   "consul Prefix",
+			TLS: &types.ClientTLS{
+				CA:                 "consul CA",
+				Cert:               "consul Cert",
+				Key:                "consul Key",
+				InsecureSkipVerify: true,
+			},
+			Username: "consul Username",
+			Password: "consul Password",
+		},
+	}
+
+	cleanJSON, err := Do(config, true)
+	if err != nil {
+		t.Fatal(err, cleanJSON)
+	}
+}
--- a/cmd/traefik/anonymize/anonymize_doOnJSON_test.go
+++ b/cmd/traefik/anonymize/anonymize_doOnJSON_test.go
@@ -0,0 +1,239 @@
+package anonymize
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_doOnJSON(t *testing.T) {
+	baseConfiguration := `
+{
+ "GraceTimeOut": 10000000000,
+ "Debug": false,
+ "CheckNewVersion": true,
+ "AccessLogsFile": "",
+ "TraefikLogsFile": "",
+ "LogLevel": "ERROR",
+ "EntryPoints": {
+  "http": {
+   "Network": "",
+   "Address": ":80",
+   "TLS": null,
+   "Redirect": {
+    "EntryPoint": "https",
+    "Regex": "",
+    "Replacement": ""
+   },
+   "Auth": null,
+   "Compress": false
+  },
+  "https": {
+   "Network": "",
+   "Address": ":443",
+   "TLS": {
+    "MinVersion": "",
+    "CipherSuites": null,
+    "Certificates": null,
+    "ClientCAFiles": null
+   },
+   "Redirect": null,
+   "Auth": null,
+   "Compress": false
+  }
+ },
+ "Cluster": null,
+ "Constraints": [],
+ "ACME": {
+  "Email": "foo@bar.com",
+  "Domains": [
+   {
+    "Main": "foo@bar.com",
+    "SANs": null
+   },
+   {
+    "Main": "foo@bar.com",
+    "SANs": null
+   }
+  ],
+  "Storage": "",
+  "StorageFile": "/acme/acme.json",
+  "OnDemand": true,
+  "OnHostRule": true,
+  "CAServer": "",
+  "EntryPoint": "https",
+  "DNSProvider": "",
+  "DelayDontCheckDNS": 0,
+  "ACMELogging": false,
+  "TLSConfig": null
+ },
+ "DefaultEntryPoints": [
+  "https",
+  "http"
+ ],
+ "ProvidersThrottleDuration": 2000000000,
+ "MaxIdleConnsPerHost": 200,
+ "IdleTimeout": 180000000000,
+ "InsecureSkipVerify": false,
+ "Retry": null,
+ "HealthCheck": {
+  "Interval": 30000000000
+ },
+ "Docker": null,
+ "File": null,
+ "Web": null,
+ "Marathon": null,
+ "Consul": null,
+ "ConsulCatalog": null,
+ "Etcd": null,
+ "Zookeeper": null,
+ "Boltdb": null,
+ "Kubernetes": null,
+ "Mesos": null,
+ "Eureka": null,
+ "ECS": null,
+ "Rancher": null,
+ "DynamoDB": null,
+ "ConfigFile": "/etc/traefik/traefik.toml"
+}
+`
+	expectedConfiguration := `
+{
+ "GraceTimeOut": 10000000000,
+ "Debug": false,
+ "CheckNewVersion": true,
+ "AccessLogsFile": "",
+ "TraefikLogsFile": "",
+ "LogLevel": "ERROR",
+ "EntryPoints": {
+  "http": {
+   "Network": "",
+   "Address": ":80",
+   "TLS": null,
+   "Redirect": {
+    "EntryPoint": "https",
+    "Regex": "",
+    "Replacement": ""
+   },
+   "Auth": null,
+   "Compress": false
+  },
+  "https": {
+   "Network": "",
+   "Address": ":443",
+   "TLS": {
+    "MinVersion": "",
+    "CipherSuites": null,
+    "Certificates": null,
+    "ClientCAFiles": null
+   },
+   "Redirect": null,
+   "Auth": null,
+   "Compress": false
+  }
+ },
+ "Cluster": null,
+ "Constraints": [],
+ "ACME": {
+  "Email": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+  "Domains": [
+   {
+    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+    "SANs": null
+   },
+   {
+    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+    "SANs": null
+   }
+  ],
+  "Storage": "",
+  "StorageFile": "/acme/acme.json",
+  "OnDemand": true,
+  "OnHostRule": true,
+  "CAServer": "",
+  "EntryPoint": "https",
+  "DNSProvider": "",
+  "DelayDontCheckDNS": 0,
+  "ACMELogging": false,
+  "TLSConfig": null
+ },
+ "DefaultEntryPoints": [
+  "https",
+  "http"
+ ],
+ "ProvidersThrottleDuration": 2000000000,
+ "MaxIdleConnsPerHost": 200,
+ "IdleTimeout": 180000000000,
+ "InsecureSkipVerify": false,
+ "Retry": null,
+ "HealthCheck": {
+  "Interval": 30000000000
+ },
+ "Docker": null,
+ "File": null,
+ "Web": null,
+ "Marathon": null,
+ "Consul": null,
+ "ConsulCatalog": null,
+ "Etcd": null,
+ "Zookeeper": null,
+ "Boltdb": null,
+ "Kubernetes": null,
+ "Mesos": null,
+ "Eureka": null,
+ "ECS": null,
+ "Rancher": null,
+ "DynamoDB": null,
+ "ConfigFile": "/etc/traefik/traefik.toml"
+}
+`
+	anomConfiguration := doOnJSON(baseConfiguration)
+
+	if anomConfiguration != expectedConfiguration {
+		t.Errorf("Got %s, want %s.", anomConfiguration, expectedConfiguration)
+	}
+}
+
+func Test_doOnJSON_simple(t *testing.T) {
+	testCases := []struct {
+		name           string
+		input          string
+		expectedOutput string
+	}{
+		{
+			name: "email",
+			input: `{
+				"email1": "goo@example.com",
+				"email2": "foo.bargoo@example.com",
+				"email3": "foo.bargoo@example.com.us"
+			}`,
+			expectedOutput: `{
+				"email1": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+				"email2": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+				"email3": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+			}`,
+		},
+		{
+			name: "url",
+			input: `{
+				"URL": "foo domain.com foo",
+				"URL": "foo sub.domain.com foo",
+				"URL": "foo sub.sub.domain.com foo",
+				"URL": "foo sub.sub.sub.domain.com.us foo"
+			}`,
+			expectedOutput: `{
+				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
+				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
+				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo",
+				"URL": "foo xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx foo"
+			}`,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+			output := doOnJSON(test.input)
+			assert.Equal(t, test.expectedOutput, output)
+		})
+	}
+}
--- a/cmd/traefik/anonymize/anonymize_doOnStruct_test.go
+++ b/cmd/traefik/anonymize/anonymize_doOnStruct_test.go
@@ -0,0 +1,176 @@
+package anonymize
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+type Courgette struct {
+	Ji string
+	Ho string
+}
+type Tomate struct {
+	Ji string
+	Ho string
+}
+
+type Carotte struct {
+	Name        string
+	Value       int
+	Courgette   Courgette
+	ECourgette  Courgette `export:"true"`
+	Pourgette   *Courgette
+	EPourgette  *Courgette `export:"true"`
+	Aubergine   map[string]string
+	EAubergine  map[string]string `export:"true"`
+	SAubergine  map[string]Tomate
+	ESAubergine map[string]Tomate `export:"true"`
+	PSAubergine map[string]*Tomate
+	EPAubergine map[string]*Tomate `export:"true"`
+}
+
+func Test_doOnStruct(t *testing.T) {
+	testCase := []struct {
+		name     string
+		base     *Carotte
+		expected *Carotte
+		hasError bool
+	}{
+		{
+			name: "primitive",
+			base: &Carotte{
+				Name:  "koko",
+				Value: 666,
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+			},
+		},
+		{
+			name: "struct",
+			base: &Carotte{
+				Name: "koko",
+				Courgette: Courgette{
+					Ji: "huu",
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+			},
+		},
+		{
+			name: "pointer",
+			base: &Carotte{
+				Name: "koko",
+				Pourgette: &Courgette{
+					Ji: "hoo",
+				},
+			},
+			expected: &Carotte{
+				Name:      "xxxx",
+				Pourgette: nil,
+			},
+		},
+		{
+			name: "export struct",
+			base: &Carotte{
+				Name: "koko",
+				ECourgette: Courgette{
+					Ji: "huu",
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+				ECourgette: Courgette{
+					Ji: "xxxx",
+				},
+			},
+		},
+		{
+			name: "export pointer struct",
+			base: &Carotte{
+				Name: "koko",
+				ECourgette: Courgette{
+					Ji: "huu",
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+				ECourgette: Courgette{
+					Ji: "xxxx",
+				},
+			},
+		},
+		{
+			name: "export map string/string",
+			base: &Carotte{
+				Name: "koko",
+				EAubergine: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+				EAubergine: map[string]string{
+					"foo": "bar",
+				},
+			},
+		},
+		{
+			name: "export map string/pointer",
+			base: &Carotte{
+				Name: "koko",
+				EPAubergine: map[string]*Tomate{
+					"foo": {
+						Ji: "fdskljf",
+					},
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+				EPAubergine: map[string]*Tomate{
+					"foo": {
+						Ji: "xxxx",
+					},
+				},
+			},
+		},
+		{
+			name: "export map string/struct (UNSAFE)",
+			base: &Carotte{
+				Name: "koko",
+				ESAubergine: map[string]Tomate{
+					"foo": {
+						Ji: "JiJiJi",
+					},
+				},
+			},
+			expected: &Carotte{
+				Name: "xxxx",
+				ESAubergine: map[string]Tomate{
+					"foo": {
+						Ji: "JiJiJi",
+					},
+				},
+			},
+			hasError: true,
+		},
+	}
+
+	for _, test := range testCase {
+		t.Run(test.name, func(t *testing.T) {
+			val := reflect.ValueOf(test.base).Elem()
+			err := doOnStruct(val)
+			if !test.hasError && err != nil {
+				t.Fatal(err)
+			}
+			if test.hasError && err == nil {
+				t.Fatal("Got no error but want an error.")
+			}
+
+			assert.EqualValues(t, test.expected, test.base)
+		})
+	}
+}
--- a/cmd/traefik/bug.go
+++ b/cmd/traefik/bug.go
@@ -2,20 +2,18 @@ package main

 import (
 	"bytes"
-	"encoding/json"
 	"fmt"
 	"net/url"
 	"os/exec"
-	"regexp"
 	"runtime"
 	"text/template"

 	"github.com/containous/flaeg"
-	"github.com/mvdan/xurls"
+	"github.com/containous/traefik/cmd/traefik/anonymize"
 )

-var (
-	bugtracker  = "https://github.com/containous/traefik/issues/new"
+const (
+	bugTracker  = "https://github.com/containous/traefik/issues/new"
 	bugTemplate = `<!--
 DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.

@@ -94,50 +92,67 @@ func newBugCmd(traefikConfiguration interface{}, traefikPointersConfiguration in
 		Description:           `Report an issue on Traefik bugtracker`,
 		Config:                traefikConfiguration,
 		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: func() error {
-			var version bytes.Buffer
-			if err := getVersionPrint(&version); err != nil {
-				return err
-			}
-
-			tmpl, err := template.New("").Parse(bugTemplate)
-			if err != nil {
-				return err
-			}
-
-			configJSON, err := json.MarshalIndent(traefikConfiguration, "", " ")
-			if err != nil {
-				return err
-			}
-
-			v := struct {
-				Version       string
-				Configuration string
-			}{
-				Version:       version.String(),
-				Configuration: anonymize(string(configJSON)),
-			}
-
-			var bug bytes.Buffer
-			if err := tmpl.Execute(&bug, v); err != nil {
-				return err
-			}
-
-			body := bug.String()
-			URL := bugtracker + "?body=" + url.QueryEscape(body)
-			if err := openBrowser(URL); err != nil {
-				fmt.Printf("Please file a new issue at %s using this template:\n\n", bugtracker)
-				fmt.Print(body)
-			}
-
-			return nil
-		},
+		Run: runBugCmd(traefikConfiguration),
 		Metadata: map[string]string{
 			"parseAllSources": "true",
 		},
 	}
 }

+func runBugCmd(traefikConfiguration interface{}) func() error {
+	return func() error {
+
+		body, err := createBugReport(traefikConfiguration)
+		if err != nil {
+			return err
+		}
+
+		sendBugReport(body)
+
+		return nil
+	}
+}
+
+func createBugReport(traefikConfiguration interface{}) (string, error) {
+	var version bytes.Buffer
+	if err := getVersionPrint(&version); err != nil {
+		return "", err
+	}
+
+	tmpl, err := template.New("bug").Parse(bugTemplate)
+	if err != nil {
+		return "", err
+	}
+
+	config, err := anonymize.Do(&traefikConfiguration, true)
+	if err != nil {
+		return "", err
+	}
+
+	v := struct {
+		Version       string
+		Configuration string
+	}{
+		Version:       version.String(),
+		Configuration: config,
+	}
+
+	var bug bytes.Buffer
+	if err := tmpl.Execute(&bug, v); err != nil {
+		return "", err
+	}
+
+	return bug.String(), nil
+}
+
+func sendBugReport(body string) {
+	URL := bugTracker + "?body=" + url.QueryEscape(body)
+	if err := openBrowser(URL); err != nil {
+		fmt.Printf("Please file a new issue at %s using this template:\n\n", bugTracker)
+		fmt.Print(body)
+	}
+}
+
 func openBrowser(URL string) error {
 	var err error
 	switch runtime.GOOS {
@@ -152,9 +167,3 @@ func openBrowser(URL string) error {
 	}
 	return err
 }
-
-func anonymize(input string) string {
-	replace := "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx\""
-	mailExp := regexp.MustCompile(`\w[-._\w]*\w@\w[-._\w]*\w\.\w{2,3}"`)
-	return xurls.Relaxed.ReplaceAllString(mailExp.ReplaceAllString(input, replace), replace)
-}
--- a/cmd/traefik/bug_test.go
+++ b/cmd/traefik/bug_test.go
@@ -2,192 +2,48 @@ package main

 import (
 	"testing"
+
+	"github.com/containous/traefik/cmd/traefik/anonymize"
+	"github.com/containous/traefik/configuration"
+	"github.com/containous/traefik/provider/file"
+	"github.com/stretchr/testify/assert"
 )

-func Test_anonymize(t *testing.T) {
-	baseConfiguration := `
-{
- "GraceTimeOut": 10000000000,
- "Debug": false,
- "CheckNewVersion": true,
- "AccessLogsFile": "",
- "TraefikLogsFile": "",
- "LogLevel": "ERROR",
- "EntryPoints": {
-  "http": {
-   "Network": "",
-   "Address": ":80",
-   "TLS": null,
-   "Redirect": {
-    "EntryPoint": "https",
-    "Regex": "",
-    "Replacement": ""
-   },
-   "Auth": null,
-   "Compress": false
-  },
-  "https": {
-   "Network": "",
-   "Address": ":443",
-   "TLS": {
-    "MinVersion": "",
-    "CipherSuites": null,
-    "Certificates": null,
-    "ClientCAFiles": null
-   },
-   "Redirect": null,
-   "Auth": null,
-   "Compress": false
-  }
- },
- "Cluster": null,
- "Constraints": [],
- "ACME": {
-  "Email": "foo@bar.com",
-  "Domains": [
-   {
-    "Main": "foo@bar.com",
-    "SANs": null
-   },
-   {
-    "Main": "foo@bar.com",
-    "SANs": null
-   }
-  ],
-  "Storage": "",
-  "StorageFile": "/acme/acme.json",
-  "OnDemand": true,
-  "OnHostRule": true,
-  "CAServer": "",
-  "EntryPoint": "https",
-  "DNSProvider": "",
-  "DelayDontCheckDNS": 0,
-  "ACMELogging": false,
-  "TLSConfig": null
- },
- "DefaultEntryPoints": [
-  "https",
-  "http"
- ],
- "ProvidersThrottleDuration": 2000000000,
- "MaxIdleConnsPerHost": 200,
- "IdleTimeout": 180000000000,
- "InsecureSkipVerify": false,
- "Retry": null,
- "HealthCheck": {
-  "Interval": 30000000000
- },
- "Docker": null,
- "File": null,
- "Web": null,
- "Marathon": null,
- "Consul": null,
- "ConsulCatalog": null,
- "Etcd": null,
- "Zookeeper": null,
- "Boltdb": null,
- "Kubernetes": null,
- "Mesos": null,
- "Eureka": null,
- "ECS": null,
- "Rancher": null,
- "DynamoDB": null,
- "ConfigFile": "/etc/traefik/traefik.toml"
-}
-`
-	expectedConfiguration := `
-{
- "GraceTimeOut": 10000000000,
- "Debug": false,
- "CheckNewVersion": true,
- "AccessLogsFile": "",
- "TraefikLogsFile": "",
- "LogLevel": "ERROR",
- "EntryPoints": {
-  "http": {
-   "Network": "",
-   "Address": ":80",
-   "TLS": null,
-   "Redirect": {
-    "EntryPoint": "https",
-    "Regex": "",
-    "Replacement": ""
-   },
-   "Auth": null,
-   "Compress": false
-  },
-  "https": {
-   "Network": "",
-   "Address": ":443",
-   "TLS": {
-    "MinVersion": "",
-    "CipherSuites": null,
-    "Certificates": null,
-    "ClientCAFiles": null
-   },
-   "Redirect": null,
-   "Auth": null,
-   "Compress": false
-  }
- },
- "Cluster": null,
- "Constraints": [],
- "ACME": {
-  "Email": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-  "Domains": [
-   {
-    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-    "SANs": null
-   },
-   {
-    "Main": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-    "SANs": null
-   }
-  ],
-  "Storage": "",
-  "StorageFile": "/acme/acme.json",
-  "OnDemand": true,
-  "OnHostRule": true,
-  "CAServer": "",
-  "EntryPoint": "https",
-  "DNSProvider": "",
-  "DelayDontCheckDNS": 0,
-  "ACMELogging": false,
-  "TLSConfig": null
- },
- "DefaultEntryPoints": [
-  "https",
-  "http"
- ],
- "ProvidersThrottleDuration": 2000000000,
- "MaxIdleConnsPerHost": 200,
- "IdleTimeout": 180000000000,
- "InsecureSkipVerify": false,
- "Retry": null,
- "HealthCheck": {
-  "Interval": 30000000000
- },
- "Docker": null,
- "File": null,
- "Web": null,
- "Marathon": null,
- "Consul": null,
- "ConsulCatalog": null,
- "Etcd": null,
- "Zookeeper": null,
- "Boltdb": null,
- "Kubernetes": null,
- "Mesos": null,
- "Eureka": null,
- "ECS": null,
- "Rancher": null,
- "DynamoDB": null,
- "ConfigFile": "/etc/traefik/traefik.toml"
-}
-`
-	anomConfiguration := anonymize(baseConfiguration)
-
-	if anomConfiguration != expectedConfiguration {
-		t.Errorf("Got %s, want %s.", anomConfiguration, expectedConfiguration)
+func Test_createBugReport(t *testing.T) {
+	traefikConfiguration := TraefikConfiguration{
+		ConfigFile: "FOO",
+		GlobalConfiguration: configuration.GlobalConfiguration{
+			EntryPoints: configuration.EntryPoints{
+				"goo": &configuration.EntryPoint{
+					Address: "hoo.bar",
+				},
+			},
+			File: &file.Provider{
+				Directory: "BAR",
+			},
+			RootCAs: configuration.RootCAs{"fllf"},
+		},
 	}
+
+	report, err := createBugReport(traefikConfiguration)
+	assert.NoError(t, err, report)
+}
+
+func Test_anonymize_traefikConfiguration(t *testing.T) {
+	traefikConfiguration := &TraefikConfiguration{
+		ConfigFile: "FOO",
+		GlobalConfiguration: configuration.GlobalConfiguration{
+			EntryPoints: configuration.EntryPoints{
+				"goo": &configuration.EntryPoint{
+					Address: "hoo.bar",
+				},
+			},
+			File: &file.Provider{
+				Directory: "BAR",
+			},
+		},
+	}
+	_, err := anonymize.Do(traefikConfiguration, true)
+	assert.NoError(t, err)
+	assert.Equal(t, "hoo.bar", traefikConfiguration.GlobalConfiguration.EntryPoints["goo"].Address)
 }
--- a/cmd/traefik/configuration.go
+++ b/cmd/traefik/configuration.go
@@ -12,6 +12,7 @@ import (
 	"github.com/containous/traefik/provider/dynamodb"
 	"github.com/containous/traefik/provider/ecs"
 	"github.com/containous/traefik/provider/etcd"
+	"github.com/containous/traefik/provider/eureka"
 	"github.com/containous/traefik/provider/file"
 	"github.com/containous/traefik/provider/kubernetes"
 	"github.com/containous/traefik/provider/marathon"
@@ -24,8 +25,8 @@ import (

 // TraefikConfiguration holds GlobalConfiguration and other stuff
 type TraefikConfiguration struct {
-	configuration.GlobalConfiguration `mapstructure:",squash"`
-	ConfigFile                        string `short:"c" description:"Configuration file to use (TOML)."`
+	configuration.GlobalConfiguration `mapstructure:",squash" export:"true"`
+	ConfigFile                        string `short:"c" description:"Configuration file to use (TOML)." export:"true"`
 }

 // NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
@@ -148,30 +149,52 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultDynamoDB.TableName = "traefik"
 	defaultDynamoDB.Watch = true

+	// default Eureka
+	var defaultEureka eureka.Provider
+	defaultEureka.Delay = "30s"
+
 	// default AccessLog
 	defaultAccessLog := types.AccessLog{
 		Format:   accesslog.CommonFormat,
 		FilePath: "",
 	}

+	// default HealthCheckConfig
+	healthCheck := configuration.HealthCheckConfig{
+		Interval: flaeg.Duration(configuration.DefaultHealthCheckInterval),
+	}
+
+	// default RespondingTimeouts
+	respondingTimeouts := configuration.RespondingTimeouts{
+		IdleTimeout: flaeg.Duration(configuration.DefaultIdleTimeout),
+	}
+
+	// default ForwardingTimeouts
+	forwardingTimeouts := configuration.ForwardingTimeouts{
+		DialTimeout: flaeg.Duration(configuration.DefaultDialTimeout),
+	}
+
 	defaultConfiguration := configuration.GlobalConfiguration{
-		Docker:        &defaultDocker,
-		File:          &defaultFile,
-		Web:           &defaultWeb,
-		Marathon:      &defaultMarathon,
-		Consul:        &defaultConsul,
-		ConsulCatalog: &defaultConsulCatalog,
-		Etcd:          &defaultEtcd,
-		Zookeeper:     &defaultZookeeper,
-		Boltdb:        &defaultBoltDb,
-		Kubernetes:    &defaultKubernetes,
-		Mesos:         &defaultMesos,
-		ECS:           &defaultECS,
-		Rancher:       &defaultRancher,
-		DynamoDB:      &defaultDynamoDB,
-		Retry:         &configuration.Retry{},
-		HealthCheck:   &configuration.HealthCheckConfig{},
-		AccessLog:     &defaultAccessLog,
+		Docker:             &defaultDocker,
+		File:               &defaultFile,
+		Web:                &defaultWeb,
+		Marathon:           &defaultMarathon,
+		Consul:             &defaultConsul,
+		ConsulCatalog:      &defaultConsulCatalog,
+		Etcd:               &defaultEtcd,
+		Zookeeper:          &defaultZookeeper,
+		Boltdb:             &defaultBoltDb,
+		Kubernetes:         &defaultKubernetes,
+		Mesos:              &defaultMesos,
+		ECS:                &defaultECS,
+		Rancher:            &defaultRancher,
+		Eureka:             &defaultEureka,
+		DynamoDB:           &defaultDynamoDB,
+		Retry:              &configuration.Retry{},
+		HealthCheck:        &healthCheck,
+		AccessLog:          &defaultAccessLog,
+		RespondingTimeouts: &respondingTimeouts,
+		ForwardingTimeouts: &forwardingTimeouts,
 	}

 	return &TraefikConfiguration{
@@ -196,12 +219,6 @@ func NewTraefikConfiguration() *TraefikConfiguration {
 			HealthCheck: &configuration.HealthCheckConfig{
 				Interval: flaeg.Duration(configuration.DefaultHealthCheckInterval),
 			},
-			RespondingTimeouts: &configuration.RespondingTimeouts{
-				IdleTimeout: flaeg.Duration(configuration.DefaultIdleTimeout),
-			},
-			ForwardingTimeouts: &configuration.ForwardingTimeouts{
-				DialTimeout: flaeg.Duration(configuration.DefaultDialTimeout),
-			},
 			CheckNewVersion: true,
 		},
 		ConfigFile: "",
--- a/cmd/traefik/traefik.go
+++ b/cmd/traefik/traefik.go
@@ -9,32 +9,30 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
-	"runtime"
 	"strings"
 	"time"

 	"github.com/Sirupsen/logrus"
+	"github.com/cenk/backoff"
 	"github.com/containous/flaeg"
 	"github.com/containous/staert"
 	"github.com/containous/traefik/acme"
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/configuration"
+	"github.com/containous/traefik/job"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/provider/ecs"
 	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/rancher"
 	"github.com/containous/traefik/safe"
 	"github.com/containous/traefik/server"
+	"github.com/containous/traefik/server/uuid"
 	"github.com/containous/traefik/types"
 	"github.com/containous/traefik/version"
 	"github.com/coreos/go-systemd/daemon"
 	"github.com/docker/libkv/store"
-	"github.com/satori/go.uuid"
 )

 func main() {
-	runtime.GOMAXPROCS(runtime.NumCPU())
-
 	//traefik config inits
 	traefikConfiguration := NewTraefikConfiguration()
 	traefikPointersConfiguration := NewTraefikDefaultPointersConfiguration()
@@ -119,6 +117,8 @@ Complete documentation is available at https://traefik.io`,
 		Config:                traefikConfiguration,
 		DefaultPointersConfig: traefikPointersConfiguration,
 		Run: func() error {
+			traefikConfiguration.GlobalConfiguration.SetEffectiveConfiguration()
+
 			if traefikConfiguration.Web == nil {
 				fmt.Println("Please enable the web provider to use healtcheck.")
 				os.Exit(1)
@@ -132,7 +132,8 @@ Complete documentation is available at https://traefik.io`,
 				}
 				client.Transport = tr
 			}
-			resp, err := client.Head(protocol + "://" + traefikConfiguration.Web.Address + "/ping")
+
+			resp, err := client.Head(protocol + "://" + traefikConfiguration.Web.Address + traefikConfiguration.Web.Path + "ping")
 			if err != nil {
 				fmt.Printf("Error calling healthcheck: %s\n", err)
 				os.Exit(1)
@@ -188,7 +189,7 @@ Complete documentation is available at https://traefik.io`,
 	s.AddSource(toml)
 	s.AddSource(f)
 	if _, err := s.LoadConfig(); err != nil {
-		fmtlog.Println(fmt.Errorf("Error reading TOML config file %s : %s", toml.ConfigFileUsed(), err))
+		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
 		os.Exit(-1)
 	}

@@ -203,13 +204,21 @@ Complete documentation is available at https://traefik.io`,
 	// IF a KV Store is enable and no sub-command called in args
 	if kv != nil && usedCmd == traefikCmd {
 		if traefikConfiguration.Cluster == nil {
-			traefikConfiguration.Cluster = &types.Cluster{Node: uuid.NewV4().String()}
+			traefikConfiguration.Cluster = &types.Cluster{Node: uuid.Get()}
 		}
 		if traefikConfiguration.Cluster.Store == nil {
 			traefikConfiguration.Cluster.Store = &types.Store{Prefix: kv.Prefix, Store: kv.Store}
 		}
 		s.AddSource(kv)
-		if _, err := s.LoadConfig(); err != nil {
+		operation := func() error {
+			_, err := s.LoadConfig()
+			return err
+		}
+		notify := func(err error, time time.Duration) {
+			log.Errorf("Load config error: %+v, retrying in %s", err, time)
+		}
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
+		if err != nil {
 			fmtlog.Printf("Error loading configuration: %s\n", err)
 			os.Exit(-1)
 		}
@@ -228,36 +237,7 @@ func run(globalConfiguration *configuration.GlobalConfiguration) {

 	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment

-	if len(globalConfiguration.EntryPoints) == 0 {
-		globalConfiguration.EntryPoints = map[string]*configuration.EntryPoint{"http": {Address: ":80"}}
-		globalConfiguration.DefaultEntryPoints = []string{"http"}
-	}
-
-	if globalConfiguration.Rancher != nil {
-		// Ensure backwards compatibility for now
-		if len(globalConfiguration.Rancher.AccessKey) > 0 ||
-			len(globalConfiguration.Rancher.Endpoint) > 0 ||
-			len(globalConfiguration.Rancher.SecretKey) > 0 {
-
-			if globalConfiguration.Rancher.API == nil {
-				globalConfiguration.Rancher.API = &rancher.APIConfiguration{
-					AccessKey: globalConfiguration.Rancher.AccessKey,
-					SecretKey: globalConfiguration.Rancher.SecretKey,
-					Endpoint:  globalConfiguration.Rancher.Endpoint,
-				}
-			}
-			log.Warn("Deprecated configuration found: rancher.[accesskey|secretkey|endpoint]. " +
-				"Please use rancher.api.[accesskey|secretkey|endpoint] instead.")
-		}
-
-		if globalConfiguration.Rancher.Metadata != nil && len(globalConfiguration.Rancher.Metadata.Prefix) == 0 {
-			globalConfiguration.Rancher.Metadata.Prefix = "latest"
-		}
-	}
-
-	if globalConfiguration.Debug {
-		globalConfiguration.LogLevel = "DEBUG"
-	}
+	globalConfiguration.SetEffectiveConfiguration()

 	// logging
 	level, err := logrus.ParseLevel(strings.ToLower(globalConfiguration.LogLevel))
@@ -265,6 +245,7 @@ func run(globalConfiguration *configuration.GlobalConfiguration) {
 		log.Error("Error getting level", err)
 	}
 	log.SetLevel(level)
+
 	if len(globalConfiguration.TraefikLogsFile) > 0 {
 		dir := filepath.Dir(globalConfiguration.TraefikLogsFile)

@@ -291,16 +272,7 @@ func run(globalConfiguration *configuration.GlobalConfiguration) {
 	log.Infof("Traefik version %s built on %s", version.Version, version.BuildDate)

 	if globalConfiguration.CheckNewVersion {
-		ticker := time.NewTicker(24 * time.Hour)
-		safe.Go(func() {
-			version.CheckNewVersion()
-			for {
-				select {
-				case <-ticker.C:
-					version.CheckNewVersion()
-				}
-			}
-		})
+		checkNewVersion()
 	}

 	log.Debugf("Global configuration loaded %s", string(jsonConf))
@@ -366,3 +338,17 @@ func CreateKvSource(traefikConfiguration *TraefikConfiguration) (*staert.KvSourc
 	}
 	return kv, err
 }
+
+func checkNewVersion() {
+	ticker := time.NewTicker(24 * time.Hour)
+	safe.Go(func() {
+		time.Sleep(10 * time.Minute)
+		version.CheckNewVersion()
+		for {
+			select {
+			case <-ticker.C:
+				version.CheckNewVersion()
+			}
+		}
+	})
+}
--- a/configuration/configuration.go
+++ b/configuration/configuration.go
@@ -5,12 +5,12 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"regexp"
 	"strings"
 	"time"

 	"github.com/containous/flaeg"
 	"github.com/containous/traefik/acme"
+	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/provider/boltdb"
 	"github.com/containous/traefik/provider/consul"
 	"github.com/containous/traefik/provider/docker"
@@ -42,42 +42,92 @@ const (
 // GlobalConfiguration holds global configuration (with providers, etc.).
 // It's populated from the traefik configuration file passed as an argument to the binary.
 type GlobalConfiguration struct {
-	GraceTimeOut              flaeg.Duration          `short:"g" description:"Duration to give active requests a chance to finish before Traefik stops"`
-	Debug                     bool                    `short:"d" description:"Enable debug mode"`
-	CheckNewVersion           bool                    `description:"Periodically check if a new version has been released"`
-	AccessLogsFile            string                  `description:"(Deprecated) Access logs file"` // Deprecated
-	AccessLog                 *types.AccessLog        `description:"Access log settings"`
-	TraefikLogsFile           string                  `description:"Traefik logs file. Stdout is used when omitted or empty"`
-	LogLevel                  string                  `short:"l" description:"Log level"`
-	EntryPoints               EntryPoints             `description:"Entrypoints definition using format: --entryPoints='Name:http Address::8000 Redirect.EntryPoint:https' --entryPoints='Name:https Address::4442 TLS:tests/traefik.crt,tests/traefik.key;prod/traefik.crt,prod/traefik.key'"`
-	Cluster                   *types.Cluster          `description:"Enable clustering"`
-	Constraints               types.Constraints       `description:"Filter services by constraint, matching with service tags"`
-	ACME                      *acme.ACME              `description:"Enable ACME (Let's Encrypt): automatic SSL"`
-	DefaultEntryPoints        DefaultEntryPoints      `description:"Entrypoints to be used by frontends that do not specify any entrypoint"`
-	ProvidersThrottleDuration flaeg.Duration          `description:"Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time."`
-	MaxIdleConnsPerHost       int                     `description:"If non-zero, controls the maximum idle (keep-alive) to keep per-host.  If zero, DefaultMaxIdleConnsPerHost is used"`
-	IdleTimeout               flaeg.Duration          `description:"(Deprecated) maximum amount of time an idle (keep-alive) connection will remain idle before closing itself."` // Deprecated
-	InsecureSkipVerify        bool                    `description:"Disable SSL certificate verification"`
-	RootCAs                   RootCAs                 `description:"Add cert file for self-signed certicate"`
-	Retry                     *Retry                  `description:"Enable retry sending request if network error"`
-	HealthCheck               *HealthCheckConfig      `description:"Health check parameters"`
-	RespondingTimeouts        *RespondingTimeouts     `description:"Timeouts for incoming requests to the Traefik instance"`
-	ForwardingTimeouts        *ForwardingTimeouts     `description:"Timeouts for requests forwarded to the backend servers"`
-	Docker                    *docker.Provider        `description:"Enable Docker backend with default settings"`
-	File                      *file.Provider          `description:"Enable File backend with default settings"`
-	Web                       *web.Provider           `description:"Enable Web backend with default settings"`
-	Marathon                  *marathon.Provider      `description:"Enable Marathon backend with default settings"`
-	Consul                    *consul.Provider        `description:"Enable Consul backend with default settings"`
-	ConsulCatalog             *consul.CatalogProvider `description:"Enable Consul catalog backend with default settings"`
-	Etcd                      *etcd.Provider          `description:"Enable Etcd backend with default settings"`
-	Zookeeper                 *zk.Provider            `description:"Enable Zookeeper backend with default settings"`
-	Boltdb                    *boltdb.Provider        `description:"Enable Boltdb backend with default settings"`
-	Kubernetes                *kubernetes.Provider    `description:"Enable Kubernetes backend with default settings"`
-	Mesos                     *mesos.Provider         `description:"Enable Mesos backend with default settings"`
-	Eureka                    *eureka.Provider        `description:"Enable Eureka backend with default settings"`
-	ECS                       *ecs.Provider           `description:"Enable ECS backend with default settings"`
-	Rancher                   *rancher.Provider       `description:"Enable Rancher backend with default settings"`
-	DynamoDB                  *dynamodb.Provider      `description:"Enable DynamoDB backend with default settings"`
+	GraceTimeOut              flaeg.Duration          `short:"g" description:"Duration to give active requests a chance to finish before Traefik stops" export:"true"`
+	Debug                     bool                    `short:"d" description:"Enable debug mode" export:"true"`
+	CheckNewVersion           bool                    `description:"Periodically check if a new version has been released" export:"true"`
+	AccessLogsFile            string                  `description:"(Deprecated) Access logs file" export:"true"` // Deprecated
+	AccessLog                 *types.AccessLog        `description:"Access log settings" export:"true"`
+	TraefikLogsFile           string                  `description:"Traefik logs file. Stdout is used when omitted or empty" export:"true"`
+	LogLevel                  string                  `short:"l" description:"Log level" export:"true"`
+	EntryPoints               EntryPoints             `description:"Entrypoints definition using format: --entryPoints='Name:http Address::8000 Redirect.EntryPoint:https' --entryPoints='Name:https Address::4442 TLS:tests/traefik.crt,tests/traefik.key;prod/traefik.crt,prod/traefik.key'" export:"true"`
+	Cluster                   *types.Cluster          `description:"Enable clustering" export:"true"`
+	Constraints               types.Constraints       `description:"Filter services by constraint, matching with service tags" export:"true"`
+	ACME                      *acme.ACME              `description:"Enable ACME (Let's Encrypt): automatic SSL" export:"true"`
+	DefaultEntryPoints        DefaultEntryPoints      `description:"Entrypoints to be used by frontends that do not specify any entrypoint" export:"true"`
+	ProvidersThrottleDuration flaeg.Duration          `description:"Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time." export:"true"`
+	MaxIdleConnsPerHost       int                     `description:"If non-zero, controls the maximum idle (keep-alive) to keep per-host.  If zero, DefaultMaxIdleConnsPerHost is used" export:"true"`
+	IdleTimeout               flaeg.Duration          `description:"(Deprecated) maximum amount of time an idle (keep-alive) connection will remain idle before closing itself." export:"true"` // Deprecated
+	InsecureSkipVerify        bool                    `description:"Disable SSL certificate verification" export:"true"`
+	RootCAs                   RootCAs                 `description:"Add cert file for self-signed certificate"`
+	Retry                     *Retry                  `description:"Enable retry sending request if network error" export:"true"`
+	HealthCheck               *HealthCheckConfig      `description:"Health check parameters" export:"true"`
+	RespondingTimeouts        *RespondingTimeouts     `description:"Timeouts for incoming requests to the Traefik instance" export:"true"`
+	ForwardingTimeouts        *ForwardingTimeouts     `description:"Timeouts for requests forwarded to the backend servers" export:"true"`
+	Docker                    *docker.Provider        `description:"Enable Docker backend with default settings" export:"true"`
+	File                      *file.Provider          `description:"Enable File backend with default settings" export:"true"`
+	Web                       *web.Provider           `description:"Enable Web backend with default settings" export:"true"`
+	Marathon                  *marathon.Provider      `description:"Enable Marathon backend with default settings" export:"true"`
+	Consul                    *consul.Provider        `description:"Enable Consul backend with default settings" export:"true"`
+	ConsulCatalog             *consul.CatalogProvider `description:"Enable Consul catalog backend with default settings" export:"true"`
+	Etcd                      *etcd.Provider          `description:"Enable Etcd backend with default settings" export:"true"`
+	Zookeeper                 *zk.Provider            `description:"Enable Zookeeper backend with default settings" export:"true"`
+	Boltdb                    *boltdb.Provider        `description:"Enable Boltdb backend with default settings" export:"true"`
+	Kubernetes                *kubernetes.Provider    `description:"Enable Kubernetes backend with default settings" export:"true"`
+	Mesos                     *mesos.Provider         `description:"Enable Mesos backend with default settings" export:"true"`
+	Eureka                    *eureka.Provider        `description:"Enable Eureka backend with default settings" export:"true"`
+	ECS                       *ecs.Provider           `description:"Enable ECS backend with default settings" export:"true"`
+	Rancher                   *rancher.Provider       `description:"Enable Rancher backend with default settings" export:"true"`
+	DynamoDB                  *dynamodb.Provider      `description:"Enable DynamoDB backend with default settings" export:"true"`
+}
+
+// SetEffectiveConfiguration adds missing configuration parameters derived from existing ones.
+// It also takes care of maintaining backwards compatibility.
+func (gc *GlobalConfiguration) SetEffectiveConfiguration() {
+	if len(gc.EntryPoints) == 0 {
+		gc.EntryPoints = map[string]*EntryPoint{"http": {
+			Address:          ":80",
+			ForwardedHeaders: &ForwardedHeaders{Insecure: true},
+		}}
+		gc.DefaultEntryPoints = []string{"http"}
+	}
+
+	// ForwardedHeaders must be remove in the next breaking version
+	for entryPointName := range gc.EntryPoints {
+		entryPoint := gc.EntryPoints[entryPointName]
+		if entryPoint.ForwardedHeaders == nil {
+			entryPoint.ForwardedHeaders = &ForwardedHeaders{Insecure: true}
+		}
+	}
+
+	if gc.Rancher != nil {
+		// Ensure backwards compatibility for now
+		if len(gc.Rancher.AccessKey) > 0 ||
+			len(gc.Rancher.Endpoint) > 0 ||
+			len(gc.Rancher.SecretKey) > 0 {
+
+			if gc.Rancher.API == nil {
+				gc.Rancher.API = &rancher.APIConfiguration{
+					AccessKey: gc.Rancher.AccessKey,
+					SecretKey: gc.Rancher.SecretKey,
+					Endpoint:  gc.Rancher.Endpoint,
+				}
+			}
+			log.Warn("Deprecated configuration found: rancher.[accesskey|secretkey|endpoint]. " +
+				"Please use rancher.api.[accesskey|secretkey|endpoint] instead.")
+		}
+
+		if gc.Rancher.Metadata != nil && len(gc.Rancher.Metadata.Prefix) == 0 {
+			gc.Rancher.Metadata.Prefix = "latest"
+		}
+	}
+
+	if gc.Debug {
+		gc.LogLevel = "DEBUG"
+	}
+
+	if gc.Web != nil && (gc.Web.Path == "" || !strings.HasSuffix(gc.Web.Path, "/")) {
+		gc.Web.Path += "/"
+	}
 }

 // DefaultEntryPoints holds default entry points
@@ -193,76 +243,112 @@ func (ep *EntryPoints) String() string {
 // Set's argument is a string to be parsed to set the flag.
 // It's a comma-separated list, so we split it.
 func (ep *EntryPoints) Set(value string) error {
-	regex := regexp.MustCompile(`(?:Name:(?P<Name>\S*))\s*(?:Address:(?P<Address>\S*))?\s*(?:TLS:(?P<TLS>\S*))?\s*((?P<TLSACME>TLS))?\s*(?:CA:(?P<CA>\S*))?\s*(?:Redirect.EntryPoint:(?P<RedirectEntryPoint>\S*))?\s*(?:Redirect.Regex:(?P<RedirectRegex>\\S*))?\s*(?:Redirect.Replacement:(?P<RedirectReplacement>\S*))?\s*(?:Compress:(?P<Compress>\S*))?\s*(?:WhiteListSourceRange:(?P<WhiteListSourceRange>\S*))?\s*(?:ProxyProtocol:(?P<ProxyProtocol>\S*))?`)
-	match := regex.FindAllStringSubmatch(value, -1)
-	if match == nil {
-		return fmt.Errorf("bad EntryPoints format: %s", value)
-	}
-	matchResult := match[0]
-	result := make(map[string]string)
-	for i, name := range regex.SubexpNames() {
-		if i != 0 {
-			result[name] = matchResult[i]
-		}
-	}
+	result := parseEntryPointsConfiguration(value)
+
 	var configTLS *TLS
-	if len(result["TLS"]) > 0 {
+	if len(result["tls"]) > 0 {
 		certs := Certificates{}
-		if err := certs.Set(result["TLS"]); err != nil {
+		if err := certs.Set(result["tls"]); err != nil {
 			return err
 		}
 		configTLS = &TLS{
 			Certificates: certs,
 		}
-	} else if len(result["TLSACME"]) > 0 {
+	} else if len(result["tls_acme"]) > 0 {
 		configTLS = &TLS{
 			Certificates: Certificates{},
 		}
 	}
-	if len(result["CA"]) > 0 {
-		files := strings.Split(result["CA"], ",")
+	if len(result["ca"]) > 0 {
+		files := strings.Split(result["ca"], ",")
 		configTLS.ClientCAFiles = files
 	}
 	var redirect *Redirect
-	if len(result["RedirectEntryPoint"]) > 0 || len(result["RedirectRegex"]) > 0 || len(result["RedirectReplacement"]) > 0 {
+	if len(result["redirect_entrypoint"]) > 0 || len(result["redirect_regex"]) > 0 || len(result["redirect_replacement"]) > 0 {
 		redirect = &Redirect{
-			EntryPoint:  result["RedirectEntryPoint"],
-			Regex:       result["RedirectRegex"],
-			Replacement: result["RedirectReplacement"],
+			EntryPoint:  result["redirect_entrypoint"],
+			Regex:       result["redirect_regex"],
+			Replacement: result["redirect_replacement"],
 		}
 	}

-	compress := false
-	if len(result["Compress"]) > 0 {
-		compress = strings.EqualFold(result["Compress"], "true") ||
-			strings.EqualFold(result["Compress"], "enable") ||
-			strings.EqualFold(result["Compress"], "on")
-	}
-
 	whiteListSourceRange := []string{}
-	if len(result["WhiteListSourceRange"]) > 0 {
-		whiteListSourceRange = strings.Split(result["WhiteListSourceRange"], ",")
+	if len(result["whitelistsourcerange"]) > 0 {
+		whiteListSourceRange = strings.Split(result["whitelistsourcerange"], ",")
 	}

-	proxyprotocol := false
-	if len(result["ProxyProtocol"]) > 0 {
-		proxyprotocol = strings.EqualFold(result["ProxyProtocol"], "true") ||
-			strings.EqualFold(result["ProxyProtocol"], "enable") ||
-			strings.EqualFold(result["ProxyProtocol"], "on")
+	compress := toBool(result, "compress")
+
+	var proxyProtocol *ProxyProtocol
+	ppTrustedIPs := result["proxyprotocol_trustedips"]
+	if len(result["proxyprotocol_insecure"]) > 0 || len(ppTrustedIPs) > 0 {
+		proxyProtocol = &ProxyProtocol{
+			Insecure: toBool(result, "proxyprotocol_insecure"),
+		}
+		if len(ppTrustedIPs) > 0 {
+			proxyProtocol.TrustedIPs = strings.Split(ppTrustedIPs, ",")
+		}
 	}

-	(*ep)[result["Name"]] = &EntryPoint{
-		Address:              result["Address"],
+	// TODO must be changed to false by default in the next breaking version.
+	forwardedHeaders := &ForwardedHeaders{Insecure: true}
+	if _, ok := result["forwardedheaders_insecure"]; ok {
+		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
+	}
+
+	fhTrustedIPs := result["forwardedheaders_trustedips"]
+	if len(fhTrustedIPs) > 0 {
+		// TODO must be removed in the next breaking version.
+		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
+		forwardedHeaders.TrustedIPs = strings.Split(fhTrustedIPs, ",")
+	}
+
+	if proxyProtocol != nil && proxyProtocol.Insecure {
+		log.Warn("ProxyProtocol.Insecure:true is dangerous. Please use 'ProxyProtocol.TrustedIPs:IPs' and remove 'ProxyProtocol.Insecure:true'")
+	}
+
+	(*ep)[result["name"]] = &EntryPoint{
+		Address:              result["address"],
 		TLS:                  configTLS,
 		Redirect:             redirect,
 		Compress:             compress,
 		WhitelistSourceRange: whiteListSourceRange,
-		ProxyProtocol:        proxyprotocol,
+		ProxyProtocol:        proxyProtocol,
+		ForwardedHeaders:     forwardedHeaders,
 	}

 	return nil
 }

+func parseEntryPointsConfiguration(raw string) map[string]string {
+	sections := strings.Fields(raw)
+
+	config := make(map[string]string)
+	for _, part := range sections {
+		field := strings.SplitN(part, ":", 2)
+		name := strings.ToLower(strings.Replace(field[0], ".", "_", -1))
+		if len(field) > 1 {
+			config[name] = field[1]
+		} else {
+			if strings.EqualFold(name, "TLS") {
+				config["tls_acme"] = "TLS"
+			} else {
+				config[name] = ""
+			}
+		}
+	}
+	return config
+}
+
+func toBool(conf map[string]string, key string) bool {
+	if val, ok := conf[key]; ok {
+		return strings.EqualFold(val, "true") ||
+			strings.EqualFold(val, "enable") ||
+			strings.EqualFold(val, "on")
+	}
+	return false
+}
+
 // Get return the EntryPoints map
 func (ep *EntryPoints) Get() interface{} {
 	return EntryPoints(*ep)
@@ -282,12 +368,13 @@ func (ep *EntryPoints) Type() string {
 type EntryPoint struct {
 	Network              string
 	Address              string
-	TLS                  *TLS
-	Redirect             *Redirect
-	Auth                 *types.Auth
+	TLS                  *TLS        `export:"true"`
+	Redirect             *Redirect   `export:"true"`
+	Auth                 *types.Auth `export:"true"`
 	WhitelistSourceRange []string
-	Compress             bool
-	ProxyProtocol        bool
+	Compress             bool              `export:"true"`
+	ProxyProtocol        *ProxyProtocol    `export:"true"`
+	ForwardedHeaders     *ForwardedHeaders `export:"true"`
 }

 // Redirect configures a redirection of an entry point to another, or to an URL
@@ -299,7 +386,7 @@ type Redirect struct {

 // TLS configures TLS for an entry point
 type TLS struct {
-	MinVersion    string
+	MinVersion    string `export:"true"`
 	CipherSuites  []string
 	Certificates  Certificates
 	ClientCAFiles []string
@@ -349,8 +436,6 @@ func (certs *Certificates) CreateTLSConfig() (*tls.Config, error) {
 	config.Certificates = []tls.Certificate{}
 	certsSlice := []Certificate(*certs)
 	for _, v := range certsSlice {
-		cert := tls.Certificate{}
-
 		var err error

 		certContent, err := v.CertFile.Read()
@@ -363,7 +448,7 @@ func (certs *Certificates) CreateTLSConfig() (*tls.Config, error) {
 			return nil, err
 		}

-		cert, err = tls.X509KeyPair(certContent, keyContent)
+		cert, err := tls.X509KeyPair(certContent, keyContent)
 		if err != nil {
 			return nil, err
 		}
@@ -418,23 +503,35 @@ type Certificate struct {

 // Retry contains request retry config
 type Retry struct {
-	Attempts int `description:"Number of attempts"`
+	Attempts int `description:"Number of attempts" export:"true"`
 }

 // HealthCheckConfig contains health check configuration parameters.
 type HealthCheckConfig struct {
-	Interval flaeg.Duration `description:"Default periodicity of enabled health checks"`
+	Interval flaeg.Duration `description:"Default periodicity of enabled health checks" export:"true"`
 }

 // RespondingTimeouts contains timeout configurations for incoming requests to the Traefik instance.
 type RespondingTimeouts struct {
-	ReadTimeout  flaeg.Duration `description:"ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set"`
-	WriteTimeout flaeg.Duration `description:"WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set"`
-	IdleTimeout  flaeg.Duration `description:"IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. Defaults to 180 seconds. If zero, no timeout is set"`
+	ReadTimeout  flaeg.Duration `description:"ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set" export:"true"`
+	WriteTimeout flaeg.Duration `description:"WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set" export:"true"`
+	IdleTimeout  flaeg.Duration `description:"IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. Defaults to 180 seconds. If zero, no timeout is set" export:"true"`
 }

 // ForwardingTimeouts contains timeout configurations for forwarding requests to the backend servers.
 type ForwardingTimeouts struct {
-	DialTimeout           flaeg.Duration `description:"The amount of time to wait until a connection to a backend server can be established. Defaults to 30 seconds. If zero, no timeout exists"`
-	ResponseHeaderTimeout flaeg.Duration `description:"The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists"`
+	DialTimeout           flaeg.Duration `description:"The amount of time to wait until a connection to a backend server can be established. Defaults to 30 seconds. If zero, no timeout exists" export:"true"`
+	ResponseHeaderTimeout flaeg.Duration `description:"The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists" export:"true"`
+}
+
+// ProxyProtocol contains Proxy-Protocol configuration
+type ProxyProtocol struct {
+	Insecure   bool
+	TrustedIPs []string
+}
+
+// ForwardedHeaders Trust client forwarding headers
+type ForwardedHeaders struct {
+	Insecure   bool
+	TrustedIPs []string
 }
--- a/configuration/configuration_test.go
+++ b/configuration/configuration_test.go
@@ -0,0 +1,293 @@
+package configuration
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_parseEntryPointsConfiguration(t *testing.T) {
+	testCases := []struct {
+		name           string
+		value          string
+		expectedResult map[string]string
+	}{
+		{
+			name:  "all parameters",
+			value: "Name:foo TLS:goo TLS CA:car Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:WhiteListSourceRange ProxyProtocol.TrustedIPs:192.168.0.1 ProxyProtocol.Insecure:false Address::8000",
+			expectedResult: map[string]string{
+				"name":                     "foo",
+				"address":                  ":8000",
+				"ca":                       "car",
+				"tls":                      "goo",
+				"tls_acme":                 "TLS",
+				"redirect_entrypoint":      "RedirectEntryPoint",
+				"redirect_regex":           "RedirectRegex",
+				"redirect_replacement":     "RedirectReplacement",
+				"whitelistsourcerange":     "WhiteListSourceRange",
+				"proxyprotocol_trustedips": "192.168.0.1",
+				"proxyprotocol_insecure":   "false",
+				"compress":                 "true",
+			},
+		},
+		{
+			name:  "compress on",
+			value: "name:foo Compress:on",
+			expectedResult: map[string]string{
+				"name":     "foo",
+				"compress": "on",
+			},
+		},
+		{
+			name:  "TLS",
+			value: "Name:foo TLS:goo TLS",
+			expectedResult: map[string]string{
+				"name":     "foo",
+				"tls":      "goo",
+				"tls_acme": "TLS",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			conf := parseEntryPointsConfiguration(test.value)
+
+			assert.Len(t, conf, len(test.expectedResult))
+			assert.Equal(t, test.expectedResult, conf)
+		})
+	}
+}
+
+func Test_toBool(t *testing.T) {
+	testCases := []struct {
+		name         string
+		value        string
+		key          string
+		expectedBool bool
+	}{
+		{
+			name:         "on",
+			value:        "on",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "true",
+			value:        "true",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "enable",
+			value:        "enable",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "arbitrary string",
+			value:        "bar",
+			key:          "foo",
+			expectedBool: false,
+		},
+		{
+			name:         "no existing entry",
+			value:        "bar",
+			key:          "fii",
+			expectedBool: false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			conf := map[string]string{
+				"foo": test.value,
+			}
+
+			result := toBool(conf, test.key)
+
+			assert.Equal(t, test.expectedBool, result)
+		})
+	}
+}
+
+func TestEntryPoints_Set(t *testing.T) {
+	testCases := []struct {
+		name                   string
+		expression             string
+		expectedEntryPointName string
+		expectedEntryPoint     *EntryPoint
+	}{
+		{
+			name:                   "all parameters camelcase",
+			expression:             "Name:foo Address::8000 TLS:goo,gii TLS CA:car Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:Range ProxyProtocol.TrustedIPs:192.168.0.1 ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Address: ":8000",
+				Redirect: &Redirect{
+					EntryPoint:  "RedirectEntryPoint",
+					Regex:       "RedirectRegex",
+					Replacement: "RedirectReplacement",
+				},
+				Compress: true,
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"192.168.0.1"},
+				},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+				WhitelistSourceRange: []string{"Range"},
+				TLS: &TLS{
+					ClientCAFiles: []string{"car"},
+					Certificates: Certificates{
+						{
+							CertFile: FileOrContent("goo"),
+							KeyFile:  FileOrContent("gii"),
+						},
+					},
+				},
+			},
+		},
+		{
+			name:                   "all parameters lowercase",
+			expression:             "name:foo address::8000 tls:goo,gii tls ca:car redirect.entryPoint:RedirectEntryPoint redirect.regex:RedirectRegex redirect.replacement:RedirectReplacement compress:true whiteListSourceRange:Range proxyProtocol.trustedIPs:192.168.0.1 forwardedHeaders.trustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Address: ":8000",
+				Redirect: &Redirect{
+					EntryPoint:  "RedirectEntryPoint",
+					Regex:       "RedirectRegex",
+					Replacement: "RedirectReplacement",
+				},
+				Compress: true,
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"192.168.0.1"},
+				},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+				WhitelistSourceRange: []string{"Range"},
+				TLS: &TLS{
+					ClientCAFiles: []string{"car"},
+					Certificates: Certificates{
+						{
+							CertFile: FileOrContent("goo"),
+							KeyFile:  FileOrContent("gii"),
+						},
+					},
+				},
+			},
+		},
+		{
+			name:                   "default",
+			expression:             "Name:foo",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders insecure true",
+			expression:             "Name:foo ForwardedHeaders.Insecure:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders insecure false",
+			expression:             "Name:foo ForwardedHeaders.Insecure:false",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: false},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders TrustedIPs",
+			expression:             "Name:foo ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+			},
+		},
+		{
+			name:                   "ProxyProtocol insecure true",
+			expression:             "Name:foo ProxyProtocol.Insecure:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol:        &ProxyProtocol{Insecure: true},
+			},
+		},
+		{
+			name:                   "ProxyProtocol insecure false",
+			expression:             "Name:foo ProxyProtocol.Insecure:false",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol:        &ProxyProtocol{},
+			},
+		},
+		{
+			name:                   "ProxyProtocol TrustedIPs",
+			expression:             "Name:foo ProxyProtocol.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+			},
+		},
+		{
+			name:                   "compress on",
+			expression:             "Name:foo Compress:on",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Compress:             true,
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "compress true",
+			expression:             "Name:foo Compress:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Compress:             true,
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			eps := EntryPoints{}
+			err := eps.Set(test.expression)
+			require.NoError(t, err)
+
+			ep := eps[test.expectedEntryPointName]
+			assert.EqualValues(t, test.expectedEntryPoint, ep)
+		})
+	}
+}
--- a/docs/archive.md
+++ b/docs/archive.md
@@ -0,0 +1,17 @@
+## Previous documentation
+
+- [Latest stable](https://docs.traefik.io)
+
+- [Experimental](https://master--traefik-docs.netlify.com/)
+
+- [v1.4 aka Roquefort](http://v1-4.archive.docs.traefik.io/) 
+
+- [v1.3 aka Raclette](http://v1-3.archive.docs.traefik.io/)
+
+- [v1.2 aka Morbier](http://v1-2.archive.docs.traefik.io/)
+
+- [v1.1 aka Camembert](http://v1-1.archive.docs.traefik.io/)
+
+## More
+
+[Change log](https://github.com/containous/traefik/blob/master/CHANGELOG.md)
--- a/docs/basics.md
+++ b/docs/basics.md
@@ -2,7 +2,7 @@

 ## Concepts

-Let's take our example from the [overview](https://docs.traefik.io/#overview) again:
+Let's take our example from the [overview](/#overview) again:


 > Imagine that you have deployed a bunch of microservices on your infrastructure. You probably used a service registry (like etcd or consul) and/or an orchestrator (swarm, Mesos/Marathon) to manage all these services.
@@ -185,6 +185,7 @@ In TOML file, you can use multiple routes:
 ```

 Here `frontend3` will forward the traffic to the `backend2` if the rules `Host:test3.localhost` **AND** `Path:/test` are matched.
+
 You can also use the notation using a `;` separator, same result:

 ```toml
@@ -208,7 +209,8 @@ Finally, you can create a rule to bind multiple domains or Path to a frontend, u

 #### Rules Order

-When combining `Modifier` rules with `Matcher` rules, it is important to remember that `Modifier` rules **ALWAYS** apply after the `Matcher` rules.  
+When combining `Modifier` rules with `Matcher` rules, it is important to remember that `Modifier` rules **ALWAYS** apply after the `Matcher` rules.
+
 The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portion of the rule will apply first, and the `Modifier` will apply later.

 - `PathStrip`
@@ -252,7 +254,8 @@ Here, `frontend1` will be matched before `frontend2` (`10 > 5`).

 #### Custom headers

-Custom headers can be configured through the frontends, to add headers to either requests or responses that match the frontend's rules. This allows for setting headers such as `X-Script-Name` to be added to the request, or custom headers to be added to the response:
+Custom headers can be configured through the frontends, to add headers to either requests or responses that match the frontend's rules.
+This allows for setting headers such as `X-Script-Name` to be added to the request, or custom headers to be added to the response.

 ```toml
 [frontends]
@@ -270,7 +273,10 @@ In this example, all matches to the path `/cheese` will have the `X-Script-Name`

 #### Security headers

-Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above. This functionality allows for some easy security features to quickly be set. An example of some of the security headers:
+Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above.
+This functionality allows for some easy security features to quickly be set.
+
+An example of some of the security headers:

 ```toml
 [frontends]
@@ -290,15 +296,18 @@ Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc

 In this example, traffic routed through the first frontend will have the `X-Frame-Options` header set to `DENY`, and the second will only allow HTTPS request through, otherwise will return a 301 HTTPS redirect.

-The detailed documentation for those security headers can be found in [unrolled/secure](https://github.com/unrolled/secure#available-options).
+!!! note
+    The detailed documentation for those security headers can be found in [unrolled/secure](https://github.com/unrolled/secure#available-options).

 ### Backends

 A backend is responsible to load-balance the traffic coming from one or more frontends to a set of http servers.
+
 Various methods of load-balancing are supported:

 - `wrr`: Weighted Round Robin
- `drr`: Dynamic Round Robin: increases weights on servers that perform better than others. It also rolls back to original weights if the servers have changed.
+- `drr`: Dynamic Round Robin: increases weights on servers that perform better than others.
+    It also rolls back to original weights if the servers have changed.

 A circuit breaker can also be applied to a backend, preventing high loads on failing servers.
 Initial state is Standby. CB observes the statistics and does not modify the request.
@@ -337,11 +346,31 @@ For example:
 - Another possible value for `extractorfunc` is `client.ip` which will categorize requests based on client source ip.
 - Lastly `extractorfunc` can take the value of `request.header.ANY_HEADER` which will categorize requests based on `ANY_HEADER` that you provide.

-Sticky sessions are supported with both load balancers. When sticky sessions are enabled, a cookie called `_TRAEFIK_BACKEND` is set on the initial
-request. On subsequent requests, the client will be directed to the backend stored in the cookie if it is still healthy. If not, a new backend
-will be assigned.
+### Sticky sessions
+
+Sticky sessions are supported with both load balancers.  
+When sticky sessions are enabled, a cookie is set on the initial request.
+The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
+On subsequent requests, the client will be directed to the backend stored in the cookie if it is still healthy.
+If not, a new backend will be assigned.
+
+
+```toml
+[backends]
+  [backends.backend1]
+    # Enable sticky session
+    [backends.backend1.loadbalancer.stickiness]
+
+    # Customize the cookie name
+    #
+    # Optional
+    # Default: a sha1 (6 chars)
+    #
+    #  cookieName = "my_cookie"
+```
+
+The deprecated way:

-For example:
 ```toml
 [backends]
  [backends.backend1]
@@ -349,12 +378,11 @@ For example:
      sticky = true
 ```

-A health check can be configured in order to remove a backend from LB rotation
-as long as it keeps returning HTTP status codes other than 200 OK to HTTP GET
-requests periodically carried out by Traefik. The check is defined by a path
-appended to the backend URL and an interval (given in a format understood by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) specifying how
-often the health check should be executed (the default being 30 seconds).
-Each backend must respond to the health check within 5 seconds.
+### Health Check
+
+A health check can be configured in order to remove a backend from LB rotation as long as it keeps returning HTTP status codes other than `200 OK` to HTTP GET requests periodically carried out by Traefik.  
+The check is defined by a pathappended to the backend URL and an interval (given in a format understood by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) specifying how often the health check should be executed (the default being 30 seconds).
+Each backend must respond to the health check within 5 seconds.  
 By default, the port of the backend server is used, however, this may be overridden.

 A recovering backend returning 200 OK responses again is being returned to the
@@ -437,7 +465,9 @@ Each item takes precedence over the item below it:

 It means that arguments override configuration file, and key-value store overrides arguments.

-Note that the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider. It must not be used if a configuration source with less precedence wants to set a non-default provider value.
+!!! note 
+    the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider.  
+    It must not be used if a configuration source with less precedence wants to set a non-default provider value.

 #### Configuration file

@@ -503,18 +533,19 @@ traefik [command] [--flag=flag_argument]
 List of Træfik available commands with description :

 - `version` : Print version
- `storeconfig` : Store the static traefik configuration into a Key-value stores. Please refer to the [Store Træfik configuration](/user-guide/kv-config/#store-trfk-configuration) section to get documentation on it.
+- `storeconfig` : Store the static Traefik configuration into a Key-value stores. Please refer to the [Store Træfik configuration](/user-guide/kv-config/#store-trfk-configuration) section to get documentation on it.
 - `bug`: The easiest way to submit a pre-filled issue.
- `healthcheck`: Calls traefik `/ping` to check health.
+- `healthcheck`: Calls Traefik `/ping` to check health.

 Each command may have related flags.
+
 All those related flags will be displayed with :

 ```bash
 traefik [command] --help
 ```

-Note that each command is described at the beginning of the help section:
+Each command is described at the beginning of the help section:

 ```bash
 traefik --help
@@ -528,16 +559,20 @@ Here is the easiest way to submit a pre-filled issue on [Træfik GitHub](https:/
 traefik bug
 ```

-See https://www.youtube.com/watch?v=Lyz62L8m93I.
+Watch [this demo](https://www.youtube.com/watch?v=Lyz62L8m93I).

 ### Command: healthcheck

 This command allows to check the health of Traefik. Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy.
+
 This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism.

-Note: the `web` provider must be enabled to allow `/ping` calls by the `healthcheck` command.
+!!! note
+    The [`web` provider](/configuration/backends/web) must be enabled to allow `/ping` calls by the `healthcheck` command.

 ```bash
-$ traefik healthcheck
+traefik healthcheck
+```
+```bash
 OK: http://:8082/ping
 ```
--- a/docs/benchmarks.md
+++ b/docs/benchmarks.md
@@ -14,7 +14,7 @@ I used 4 VMs for the tests with the following configuration:
 ## Setup

 1. One VM used to launch the benchmarking tool [wrk](https://github.com/wg/wrk)
-2. One VM for traefik (v1.0.0-beta.416) / nginx (v1.4.6)
+2. One VM for Traefik (v1.0.0-beta.416) / nginx (v1.4.6)
 3. Two VMs for 2 backend servers in go [whoami](https://github.com/emilevauge/whoamI/)

 Each VM has been tuned using the following limits:
@@ -182,7 +182,8 @@ Requests/sec:  33591.67
 Transfer/sec:      4.97MB
 ```

-### traefik:
+### Traefik:
+
 ```shell
 wrk -t20 -c1000 -d60s -H "Host: test.traefik" --latency  http://IP-traefik:8000/bench
 Running 1m test @ http://IP-traefik:8000/bench
@@ -209,5 +210,5 @@ Not bad for young project :) !
 Some areas of possible improvements:

 - Use [GO_REUSEPORT](https://github.com/kavu/go_reuseport) listener
- Run a separate server instance per CPU core with `GOMAXPROCS=1` (it appears during benchmarks that there is a lot more context switches with traefik than with nginx)
+- Run a separate server instance per CPU core with `GOMAXPROCS=1` (it appears during benchmarks that there is a lot more context switches with Traefik than with nginx)

--- a/docs/configuration/acme.md
+++ b/docs/configuration/acme.md
@@ -1,33 +1,31 @@
-## ACME (Let's Encrypt) configuration
+# ACME (Let's Encrypt) configuration
+
+See also [Let's Encrypt examples](/user-guide/examples/#lets-encrypt-support) and [Docker & Let's Encrypt user guide](/user-guide/docker-and-lets-encrypt).
+
+## Configuration

 ```toml
-# Sample entrypoint configuration when using ACME
+# Sample entrypoint configuration when using ACME.
 [entryPoints]
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

-# Enable ACME (Let's Encrypt): automatic SSL
+# Enable ACME (Let's Encrypt): automatic SSL.
 [acme]

-# Email address used for registration
+# Email address used for registration.
 #
 # Required
 #
 email = "test@traefik.io"

 # File or key used for certificates storage.
-# WARNING, if you use Traefik in Docker, you have 2 options:
-#  - create a file on your host and mount it as a volume
-#      storageFile = "acme.json"
-#      $ docker run -v "/my/host/acme.json:acme.json" traefik
-#  - mount the folder containing the file as a volume
-#      storageFile = "/etc/traefik/acme/acme.json"
-#      $ docker run -v "/my/host/acme:/etc/traefik/acme" traefik
 #
 # Required
 #
-storage = "acme.json" # or "traefik/acme/account" if using KV store
+storage = "acme.json"
+# or `storage = "traefik/acme/account"` if using KV store.

 # Entrypoint to proxy acme challenge/apply certificates to.
 # WARNING, must point to an entrypoint on port 443
@@ -36,71 +34,49 @@ storage = "acme.json" # or "traefik/acme/account" if using KV store
 #
 entryPoint = "https"

-# Use a DNS based acme challenge rather than external HTTPS access, e.g. for a firewalled server
-# Select the provider that matches the DNS domain that will host the challenge TXT record,
-# and provide environment variables with access keys to enable setting it:
-#  - cloudflare: CLOUDFLARE_EMAIL, CLOUDFLARE_API_KEY
-#  - digitalocean: DO_AUTH_TOKEN
-#  - dnsimple: DNSIMPLE_EMAIL, DNSIMPLE_OAUTH_TOKEN
-#  - dnsmadeeasy: DNSMADEEASY_API_KEY, DNSMADEEASY_API_SECRET
-#  - exoscale: EXOSCALE_API_KEY, EXOSCALE_API_SECRET
-#  - gandi: GANDI_API_KEY
-#  - linode: LINODE_API_KEY
-#  - manual: none, but run traefik interactively & turn on acmeLogging to see instructions & press Enter
-#  - namecheap: NAMECHEAP_API_USER, NAMECHEAP_API_KEY
-#  - rfc2136: RFC2136_TSIG_KEY, RFC2136_TSIG_SECRET, RFC2136_TSIG_ALGORITHM, RFC2136_NAMESERVER
-#  - route53: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, or configured user/instance IAM profile
-#  - dyn: DYN_CUSTOMER_NAME, DYN_USER_NAME, DYN_PASSWORD
-#  - vultr: VULTR_API_KEY
-#  - ovh: OVH_ENDPOINT, OVH_APPLICATION_KEY, OVH_APPLICATION_SECRET, OVH_CONSUMER_KEY
-#  - pdns: PDNS_API_KEY, PDNS_API_URL
+# Use a DNS based acme challenge rather than external HTTPS access
+#
 #
 # Optional
 #
 # dnsProvider = "digitalocean"

-# By default, the dnsProvider will verify the TXT DNS challenge record before letting ACME verify
+# By default, the dnsProvider will verify the TXT DNS challenge record before letting ACME verify.
 # If delayDontCheckDNS is greater than zero, avoid this & instead just wait so many seconds.
-# Useful if internal networks block external DNS queries
+# Useful if internal networks block external DNS queries.
 #
 # Optional
 #
 # delayDontCheckDNS = 0

-# If true, display debug log messages from the acme client library
+# If true, display debug log messages from the acme client library.
 #
 # Optional
 #
 # acmeLogging = true

-# Enable on demand certificate. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate.
-# WARNING, TLS handshakes will be slow when requesting a hostname certificate for the first time, this can leads to DoS attacks.
-# WARNING, Take note that Let's Encrypt have rate limiting: https://letsencrypt.org/docs/rate-limits
+# Enable on demand certificate.
 #
 # Optional
 #
 # onDemand = true

-# Enable certificate generation on frontends Host rules. This will request a certificate from Let's Encrypt for each frontend with a Host rule.
-# For example, a rule Host:test1.traefik.io,test2.traefik.io will request a certificate with main domain test1.traefik.io and SAN test2.traefik.io.
+# Enable certificate generation on frontends Host rules.
 #
 # Optional
 #
-# OnHostRule = true
+# onHostRule = true

-# CA server to use
-# Uncomment the line to run on the staging let's encrypt server
-# Leave comment to go to prod
+# CA server to use.
+# - Uncomment the line to run on the staging let's encrypt server.
+# - Leave comment to go to prod.
 #
 # Optional
 #
 # caServer = "https://acme-staging.api.letsencrypt.org/directory"

-# Domains list
-# You can provide SANs (alternative domains) to each main domain
-# All domains must have A/AAAA records pointing to Traefik
-# WARNING, Take note that Let's Encrypt have rate limiting: https://letsencrypt.org/docs/rate-limits
-# Each domain & SANs will lead to a certificate request.
+# Domains list.
+#
 # [[acme.domains]]
 # main = "local1.com"
 # sans = ["test1.local1.com", "test2.local1.com"]
@@ -112,3 +88,151 @@ entryPoint = "https"
 # [[acme.domains]]
 # main = "local4.com"
 ```
+
+### `storage`
+
+```toml
+[acme]
+# ...
+storage = "acme.json"
+# ...
+```
+
+File or key used for certificates storage.
+
+**WARNING** If you use Traefik in Docker, you have 2 options:
+
+- create a file on your host and mount it as a volume:
+```toml
+storage = "acme.json"
+```
+```bash
+docker run -v "/my/host/acme.json:acme.json" traefik
+```
+
+- mount the folder containing the file as a volume
+```toml
+storage = "/etc/traefik/acme/acme.json"
+```
+```bash
+docker run -v "/my/host/acme:/etc/traefik/acme" traefik
+```
+
+### `dnsProvider`
+
+```toml
+[acme]
+# ...
+dnsProvider = "digitalocean"
+# ...
+```
+
+Use a DNS based acme challenge rather than external HTTPS access, e.g. for a firewalled server.
+
+Select the provider that matches the DNS domain that will host the challenge TXT record, and provide environment variables with access keys to enable setting it:
+
+| Provider                                     | Configuration                                                                                             |
+|----------------------------------------------|-----------------------------------------------------------------------------------------------------------|
+| [Cloudflare](https://www.cloudflare.com)     | `CLOUDFLARE_EMAIL`, `CLOUDFLARE_API_KEY`                                                                  |
+| [DigitalOcean](https://www.digitalocean.com) | `DO_AUTH_TOKEN`                                                                                           |
+| [DNSimple](https://dnsimple.com)             | `DNSIMPLE_EMAIL`, `DNSIMPLE_OAUTH_TOKEN`                                                                  |
+| [DNS Made Easy](https://dnsmadeeasy.com)     | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`                                                           |
+| [Exoscale](https://www.exoscale.ch)          | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`                                                                 |
+| [Gandi](https://www.gandi.net)               | `GANDI_API_KEY`                                                                                           |
+| [Linode](https://www.linode.com)             | `LINODE_API_KEY`                                                                                          |
+| manual                                       | none, but run Traefik interactively & turn on `acmeLogging` to see instructions & press <kbd>Enter</kbd>. |
+| [Namecheap](https://www.namecheap.com)       | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                 |
+| RFC2136                                      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                 |
+| [Route 53](https://aws.amazon.com/route53/)  | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, or configured user/instance IAM profile.      |
+| [dyn](https://dyn.com)                       | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                      |
+| [VULTR](https://www.vultr.com)               | `VULTR_API_KEY`                                                                                           |
+| [OVH](https://www.ovh.com)                   | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                       |
+| [pdns](https://www.powerdns.com)             | `PDNS_API_KEY`, `PDNS_API_URL`                                                                            |
+
+### `delayDontCheckDNS`
+
+```toml
+[acme]
+# ...
+delayDontCheckDNS = 0
+# ...
+```
+
+By default, the dnsProvider will verify the TXT DNS challenge record before letting ACME verify.  
+If `delayDontCheckDNS` is greater than zero, avoid this & instead just wait so many seconds.
+
+Useful if internal networks block external DNS queries.
+
+### `onDemand`
+
+```toml
+[acme]
+# ...
+onDemand = true
+# ...
+```
+
+Enable on demand certificate.
+
+This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate.
+
+!!! warning
+    TLS handshakes will be slow when requesting a hostname certificate for the first time, this can lead to DoS attacks.
+    
+!!! warning
+    Take note that Let's Encrypt have [rate limiting](https://letsencrypt.org/docs/rate-limits)
+
+### `onHostRule`
+
+```toml
+[acme]
+# ...
+onHostRule = true
+# ...
+```
+
+Enable certificate generation on frontends Host rules.
+
+This will request a certificate from Let's Encrypt for each frontend with a Host rule.
+
+For example, a rule `Host:test1.traefik.io,test2.traefik.io` will request a certificate with main domain `test1.traefik.io` and SAN `test2.traefik.io`.
+
+### `caServer`
+
+```toml
+[acme]
+# ...
+caServer = "https://acme-staging.api.letsencrypt.org/directory"
+# ...
+```
+
+CA server to use.
+
+- Uncomment the line to run on the staging Let's Encrypt server.
+- Leave comment to go to prod.
+
+### `domains`
+
+```toml
+[acme]
+# ...
+[[acme.domains]]
+main = "local1.com"
+sans = ["test1.local1.com", "test2.local1.com"]
+[[acme.domains]]
+main = "local2.com"
+sans = ["test1.local2.com", "test2.local2.com"]
+[[acme.domains]]
+main = "local3.com"
+[[acme.domains]]
+main = "local4.com"
+# ...
+```
+
+You can provide SANs (alternative domains) to each main domain.
+All domains must have A/AAAA records pointing to Traefik.
+
+!!! warning
+    Take note that Let's Encrypt have [rate limiting](https://letsencrypt.org/docs/rate-limits).
+
+Each domain & SANs will lead to a certificate request.
--- a/docs/configuration/backends/boltdb.md
+++ b/docs/configuration/backends/boltdb.md
@@ -1,36 +1,59 @@
 # BoltDB Backend

-Træfik can be configured to use BoltDB as a backend configuration:
+Træfik can be configured to use BoltDB as a backend configuration.

 ```toml
 ################################################################
 # BoltDB configuration backend
 ################################################################

-# Enable BoltDB configuration backend
+# Enable BoltDB configuration backend.
 [boltdb]

-# BoltDB file
+# BoltDB file.
 #
 # Required
+# Default: "127.0.0.1:4001"
 #
 endpoint = "/my.db"

-# Enable watch BoltDB changes
+# Enable watch BoltDB changes.
 #
 # Optional
+# Default: true
 #
 watch = true

 # Prefix used for KV store.
 #
 # Optional
+# Default: "/traefik"
 #
 prefix = "/traefik"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 filename = "boltdb.tmpl"
+
+# Use BoltDB user/pass authentication.
+#
+# Optional
+#
+# username = foo
+# password = bar
+
+# Enable BoltDB TLS connection.
+#
+# Optional
+#
+#    [boltdb.tls]
+#    ca = "/etc/ssl/ca.crt"
+#    cert = "/etc/ssl/boltdb.crt"
+#    key = "/etc/ssl/boltdb.key"
+#    insecureskipverify = true
 ```
+
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
--- a/docs/configuration/backends/consul.md
+++ b/docs/configuration/backends/consul.md
@@ -2,90 +2,101 @@

 ## Consul Key-Value backend

-Træfik can be configured to use Consul as a backend configuration:
+Træfik can be configured to use Consul as a backend configuration.

 ```toml
 ################################################################
 # Consul KV configuration backend
 ################################################################

-# Enable Consul KV configuration backend
+# Enable Consul KV configuration backend.
 [consul]

-# Consul server endpoint
+# Consul server endpoint.
 #
 # Required
+# Default: "127.0.0.1:8500"
 #
 endpoint = "127.0.0.1:8500"

-# Enable watch Consul changes
+# Enable watch Consul changes.
 #
 # Optional
+# Default: true
 #
 watch = true

 # Prefix used for KV store.
 #
 # Optional
+# Default: traefik
 #
 prefix = "traefik"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "consul.tmpl"

-# Enable consul TLS connection
+# Use Consul user/pass authentication.
 #
 # Optional
 #
-# [consul.tls]
-# ca = "/etc/ssl/ca.crt"
-# cert = "/etc/ssl/consul.crt"
-# key = "/etc/ssl/consul.key"
-# insecureskipverify = true
+# username = foo
+# password = bar
+
+# Enable Consul TLS connection.
+#
+# Optional
+#
+#    [consul.tls]
+#    ca = "/etc/ssl/ca.crt"
+#    cert = "/etc/ssl/consul.crt"
+#    key = "/etc/ssl/consul.key"
+#    insecureskipverify = true
 ```

-Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on traefik KV structure.
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).

-## Consul catalog backend
+Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure.

-Træfik can be configured to use service discovery catalog of Consul as a backend configuration:
+
+## Consul Catalog backend
+
+Træfik can be configured to use service discovery catalog of Consul as a backend configuration.

 ```toml
 ################################################################
 # Consul Catalog configuration backend
 ################################################################

-# Enable Consul Catalog configuration backend
+# Enable Consul Catalog configuration backend.
 [consulCatalog]

-# Consul server endpoint
+# Consul server endpoint.
 #
 # Required
+# Default: "127.0.0.1:8500"
 #
 endpoint = "127.0.0.1:8500"

-# Default domain used.
-#
-# Optional
-#
-domain = "consul.localhost"
-
-# Expose Consul catalog services by default in traefik
+# Expose Consul catalog services by default in Traefik.
 #
 # Optional
+# Default: true
 #
 exposedByDefault = false

-# Prefix for Consul catalog tags
+# Prefix for Consul catalog tags.
 #
 # Optional
+# Default: "traefik"
 #
 prefix = "traefik"

-# Default frontEnd Rule for Consul services
+# Default frontEnd Rule for Consul services.
 #
 # The format is a Go Template with:
 # - ".ServiceName", ".Domain" and ".Attributes" available
@@ -93,25 +104,33 @@ prefix = "traefik"
 # - "getAttribute(...)" function uses prefixed tag names based on "prefix" value
 #
 # Optional
+# Default: "Host:{{.ServiceName}}.{{.Domain}}"
 #
 #frontEndRule = "Host:{{.ServiceName}}.{{Domain}}"
 ```

-This backend will create routes matching on hostname based on the service name used in consul.
+This backend will create routes matching on hostname based on the service name used in Consul.

-Additional settings can be defined using Consul Catalog tags:
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).

-| Tag                                               | Description                                                                                                                                                                        |
-|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                            | Disable this container in Træfik                                                                                                                                                   |
-| `traefik.protocol=https`                          | Override the default `http` protocol                                                                                                                                               |
-| `traefik.backend.weight=10`                       | Assign this weight to the container                                                                                                                                                |
-| `traefik.backend.circuitbreaker=EXPR`             | Create a [circuit breaker](/basics/#backends) to be used against the backend, ex: `NetworkErrorRatio() > 0.`                                                                       |
-| `traefik.backend.loadbalancer=drr`                | Override the default load balancing mode                                                                                                                                           |
-| `traefik.backend.maxconn.amount=10`               | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                               |
-| `traefik.backend.maxconn.extractorfunc=client.ip` | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
-| `traefik.frontend.rule=Host:test.traefik.io`      | Override the default frontend rule (Default: `Host:{{.ServiceName}}.{{.Domain}}`).                                                                                                 |
-| `traefik.frontend.passHostHeader=true`            | Forward client `Host` header to the backend.                                                                                                                                       |
-| `traefik.frontend.priority=10`                    | Override default frontend priority                                                                                                                                                 |
-| `traefik.frontend.entryPoints=http,https`         | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                                                                                           |
-| `traefik.frontend.auth.basic=EXPR`                | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                   |
+### Tags
+
+Additional settings can be defined using Consul Catalog tags.
+
+| Tag                                                       | Description                                                                                                                                                                        |
+|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.enable=false`                                    | Disable this container in Træfik                                                                                                                                                   |
+| `traefik.protocol=https`                                  | Override the default `http` protocol                                                                                                                                               |
+| `traefik.backend.weight=10`                               | Assign this weight to the container                                                                                                                                                |
+| `traefik.backend.circuitbreaker=EXPR`                     | Create a [circuit breaker](/basics/#backends) to be used against the backend, ex: `NetworkErrorRatio() > 0.`                                                                       |
+| `traefik.backend.maxconn.amount=10`                       | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                               |
+| `traefik.backend.maxconn.extractorfunc=client.ip`         | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
+| `traefik.frontend.rule=Host:test.traefik.io`              | Override the default frontend rule (Default: `Host:{{.ServiceName}}.{{.Domain}}`).                                                                                                 |
+| `traefik.frontend.passHostHeader=true`                    | Forward client `Host` header to the backend.                                                                                                                                       |
+| `traefik.frontend.priority=10`                            | Override default frontend priority                                                                                                                                                 |
+| `traefik.frontend.entryPoints=http,https`                 | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                                                                                           |
+| `traefik.frontend.auth.basic=EXPR`                        | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                   |
+| `traefik.backend.loadbalancer=drr`                        | override the default `wrr` load balancer algorithm                                                                                                                                 |
+| `traefik.backend.loadbalancer.stickiness=true`            | enable backend sticky sessions                                                                                                                                                     |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                                                                                                                   |
+| `traefik.backend.loadbalancer.sticky=true`                | enable backend sticky sessions (DEPRECATED)                                                                                                                                        |
--- a/docs/configuration/backends/docker.md
+++ b/docs/configuration/backends/docker.md
@@ -9,7 +9,7 @@ Træfik can be configured to use Docker as a backend configuration.
 # Docker configuration backend
 ################################################################

-# Enable Docker configuration backend
+# Enable Docker configuration backend.
 [docker]

 # Docker server endpoint. Can be a tcp or a unix socket endpoint.
@@ -25,41 +25,43 @@ endpoint = "unix:///var/run/docker.sock"
 #
 domain = "docker.localhost"

-# Enable watch docker changes
+# Enable watch docker changes.
 #
 # Optional
 #
 watch = true

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "docker.tmpl"

-# Expose containers by default in traefik
-# If set to false, containers that don't have `traefik.enable=true` will be ignored
+# Expose containers by default in Traefik.
+# If set to false, containers that don't have `traefik.enable=true` will be ignored.
 #
 # Optional
 # Default: true
 #
 exposedbydefault = true

-# Use the IP address from the binded port instead of the inner network one. For specific use-case :)
+# Use the IP address from the binded port instead of the inner network one.
+# For specific use-case :)
 #
 # Optional
 # Default: false
 #
 usebindportip = true

-# Use Swarm Mode services as data provider
+# Use Swarm Mode services as data provider.
 #
 # Optional
 # Default: false
 #
 swarmmode = false

-# Enable docker TLS connection
+# Enable docker TLS connection.
 #
 # Optional
 #
@@ -70,6 +72,9 @@ swarmmode = false
 #  insecureskipverify = true
 ```

+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
+
+
 ## Docker Swarm Mode

 ```toml
@@ -77,10 +82,11 @@ swarmmode = false
 # Docker Swarmmode configuration backend
 ################################################################

-# Enable Docker configuration backend
+# Enable Docker configuration backend.
 [docker]

-# Docker server endpoint. Can be a tcp or a unix socket endpoint.
+# Docker server endpoint.
+# Can be a tcp or a unix socket endpoint.
 #
 # Required
 # Default: "unix:///var/run/docker.sock"
@@ -95,63 +101,79 @@ endpoint = "tcp://127.0.0.1:2375"
 #
 domain = "docker.localhost"

-# Enable watch docker changes
+# Enable watch docker changes.
 #
 # Optional
+# Default: true
 #
 watch = true

-# Use Docker Swarm Mode as data provider
+# Use Docker Swarm Mode as data provider.
+#
+# Optional
+# Default: false
+#
 swarmmode = true

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "docker.tmpl"

-# Expose services by default in traefik
+# Expose services by default in Traefik.
 #
 # Optional
 # Default: true
 #
 exposedbydefault = false

-# Enable docker TLS connection
+# Enable docker TLS connection.
 #
 # Optional
 #
-#  [swarm.tls]
+#  [docker.tls]
 #  ca = "/etc/ssl/ca.crt"
 #  cert = "/etc/ssl/docker.crt"
 #  key = "/etc/ssl/docker.key"
 #  insecureskipverify = true
 ```

-## Labels can be used on containers to override default behaviour
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).

-| Label                                             | Description                                                                                                                                                                                                                                                                                                                                                                                                                   |
-|---------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.backend=foo`                             | Give the name `foo` to the generated backend for this container.                                                                                                                                                                                                                                                                                                                                                              |
-| `traefik.backend.maxconn.amount=10`               | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                                                                                                                                                                                                                                                                          |
-| `traefik.backend.maxconn.extractorfunc=client.ip` | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect.                                                                                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.method=drr`         | Override the default `wrr` load balancer algorithm                                                                                                                                                                                                                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.sticky=true`        | Enable backend sticky sessions                                                                                                                                                                                                                                                                                                                                                                                                |
-| `traefik.backend.loadbalancer.swarm=true`         | Use Swarm's inbuilt load balancer (only relevant under Swarm Mode).                                                                                                                                                                                                                                                                                                                                                           |
-| `traefik.backend.circuitbreaker.expression=EXPR`  | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                                                                                                                                                                                                                  |
-| `traefik.port=80`                                 | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                                                                                                                                                                                                                        |
-| `traefik.protocol=https`                          | Override the default `http` protocol                                                                                                                                                                                                                                                                                                                                                                                          |
-| `traefik.weight=10`                               | Assign this weight to the container                                                                                                                                                                                                                                                                                                                                                                                           |
-| `traefik.enable=false`                            | Disable this container in Træfik                                                                                                                                                                                                                                                                                                                                                                                              |
-| `traefik.frontend.rule=EXPR`                      | Override the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                                                                                                                                                                                                                   |
-| `traefik.frontend.passHostHeader=true`            | Forward client `Host` header to the backend.                                                                                                                                                                                                                                                                                                                                                                                  |
-| `traefik.frontend.priority=10`                    | Override default frontend priority                                                                                                                                                                                                                                                                                                                                                                                            |
-| `traefik.frontend.entryPoints=http,https`         | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`                                                                                                                                                                                                                                                                                                                                       |
-| `traefik.frontend.auth.basic=EXPR`                | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                                                                                                                                                                                                                              |
-| `traefik.frontend.whitelistSourceRange:RANGE`     | List of IP-Ranges which are allowed to access. An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access.                                                                                                                                                                                                           |
-| `traefik.docker.network`                          | Set the docker network to use for connections to this container. If a container is linked to several networks, be sure to set the proper network name (you can check with docker inspect <container_id>) otherwise it will randomly pick one (depending on how docker is returning them). For instance when deploying docker `stack` from compose files, the compose defined networks will be prefixed with the `stack` name. |
+## Labels: overriding default behaviour

-### Services labels can be used for overriding default behaviour
+### On Containers
+
+Labels can be used on containers to override default behaviour.
+
+| Label                                                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                     |
+|-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.backend=foo`                                     | Give the name `foo` to the generated backend for this container.                                                                                                                                                                                                                                                                                                                                                                |
+| `traefik.backend.maxconn.amount=10`                       | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                                                                                                                                                                                                                                                                            |
+| `traefik.backend.maxconn.extractorfunc=client.ip`         | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect.                                                                                                                                                                                                                                              |
+| `traefik.backend.loadbalancer.method=drr`                 | Override the default `wrr` load balancer algorithm                                                                                                                                                                                                                                                                                                                                                                              |
+| `traefik.backend.loadbalancer.stickiness=true`            | Enable backend sticky sessions                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                                                                                                                                                                                                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.sticky=true`                | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                                                                                                                                                                                                                                     |
+| `traefik.backend.loadbalancer.swarm=true`                 | Use Swarm's inbuilt load balancer (only relevant under Swarm Mode).                                                                                                                                                                                                                                                                                                                                                             |
+| `traefik.backend.circuitbreaker.expression=EXPR`          | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                                                                                                                                                                                                                    |
+| `traefik.port=80`                                         | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                                                                                                                                                                                                                          |
+| `traefik.protocol=https`                                  | Override the default `http` protocol                                                                                                                                                                                                                                                                                                                                                                                            |
+| `traefik.weight=10`                                       | Assign this weight to the container                                                                                                                                                                                                                                                                                                                                                                                             |
+| `traefik.enable=false`                                    | Disable this container in Træfik                                                                                                                                                                                                                                                                                                                                                                                                |
+| `traefik.frontend.rule=EXPR`                              | Override the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                                                                                                                                                                                                                     |
+| `traefik.frontend.passHostHeader=true`                    | Forward client `Host` header to the backend.                                                                                                                                                                                                                                                                                                                                                                                    |
+| `traefik.frontend.priority=10`                            | Override default frontend priority                                                                                                                                                                                                                                                                                                                                                                                              |
+| `traefik.frontend.entryPoints=http,https`                 | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`                                                                                                                                                                                                                                                                                                                                         |
+| `traefik.frontend.auth.basic=EXPR`                        | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                                                                                                                                                                                                                                |
+| `traefik.frontend.whitelistSourceRange:RANGE`             | List of IP-Ranges which are allowed to access. An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access.                                                                                                                                                                                                             |
+| `traefik.docker.network`                                  | Set the docker network to use for connections to this container. If a container is linked to several networks, be sure to set the proper network name (you can check with `docker inspect <container_id>`) otherwise it will randomly pick one (depending on how docker is returning them). For instance when deploying docker `stack` from compose files, the compose defined networks will be prefixed with the `stack` name. |
+
+### On Service
+
+Services labels can be used for overriding default behaviour

 | Label                                             | Description                                                                                      |
 |---------------------------------------------------|--------------------------------------------------------------------------------------------------|
@@ -165,6 +187,12 @@ exposedbydefault = false
 | `traefik.<service-name>.frontend.priority`        | Overrides `traefik.frontend.priority`.                                                           |
 | `traefik.<service-name>.frontend.rule`            | Overrides `traefik.frontend.rule`.                                                               |

+
+!!! note
+    if a label is defined both as a `container label` and a `service label` (for example `traefik.<service-name>.port=PORT` and `traefik.port=PORT` ), the `service label` is used to defined the `<service-name>` property (`port` in the example).
+    It's possible to mix `container labels` and `service labels`, in this case `container labels` are used as default value for missing `service labels` but no frontends are going to be created with the `container labels`.
+    More details in this [example](/user-guide/docker-and-lets-encrypt/#labels).
+
 !!! warning
    when running inside a container, Træfik will need network access through:

--- a/docs/configuration/backends/dynamodb.md
+++ b/docs/configuration/backends/dynamodb.md
@@ -1,63 +1,71 @@
 # DynamoDB Backend

-Træfik can be configured to use Amazon DynamoDB as a backend configuration:
+Træfik can be configured to use Amazon DynamoDB as a backend configuration.
+
+## Configuration

 ```toml
 ################################################################
 # DynamoDB configuration backend
 ################################################################

-# Enable DynamoDB configuration backend
+# Enable DynamoDB configuration backend.
 [dynamodb]

-# DyanmoDB Table Name
-#
-# Optional
-#
-TableName = "traefik"
-
-# Enable watch DynamoDB changes
-#
-# Optional
-#
-Watch = true
-
-# Polling interval (in seconds)
-#
-# Optional
-#
-RefreshSeconds = 15
-
-# Region to use when connecting to AWS
+# Region to use when connecting to AWS.
 #
 # Required
 #
-Region = "us-west-1"
+region = "us-west-1"

-# AccessKeyID to use when connecting to AWS
+# DyanmoDB Table Name.
+#
+# Optional
+# Default: "traefik"
+#
+tableName = "traefik"
+
+# Enable watch DynamoDB changes.
+#
+# Optional
+# Default: true
+#
+watch = true
+
+# Polling interval (in seconds).
+#
+# Optional
+# Default: 15
+#
+refreshSeconds = 15
+
+# AccessKeyID to use when connecting to AWS.
 #
 # Optional
 #
-AccessKeyID = "abc"
+accessKeyID = "abc"

-# SecretAccessKey to use when connecting to AWS
+# SecretAccessKey to use when connecting to AWS.
 #
 # Optional
 #
-SecretAccessKey = "123"
+secretAccessKey = "123"

-# Endpoint of local dynamodb instance for testing
+# Endpoint of local dynamodb instance for testing?
 #
 # Optional
 #
-Endpoint = "http://localhost:8080"
+endpoint = "http://localhost:8080"
 ```

+## Table Items
+
 Items in the `dynamodb` table must have three attributes:

 - `id` (string): The id is the primary key.
 - `name`(string): The name is used as the name of the frontend or backend.
- `frontend` or `backend` (map): This attribute's structure matches exactly the structure of a Frontend or Backend type in traefik.  
+- `frontend` or `backend` (map): This attribute's structure matches exactly the structure of a Frontend or Backend type in Traefik.  
    See `types/types.go` for details.  
    The presence or absence of this attribute determines its type.
    So an item should never have both a `frontend` and a `backend` attribute.
+
--- a/docs/configuration/backends/ecs.md
+++ b/docs/configuration/backends/ecs.md
@@ -1,102 +1,99 @@
 # ECS Backend

-Træfik can be configured to use Amazon ECS as a backend configuration:
+Træfik can be configured to use Amazon ECS as a backend configuration.
+
+## Configuration

 ```toml
 ################################################################
 # ECS configuration backend
 ################################################################

-# Enable ECS configuration backend
+# Enable ECS configuration backend.
 [ecs]

-# ECS Cluster Name
+# ECS Cluster Name.
 #
-# DEPRECATED - Please use Clusters
+# DEPRECATED - Please use `clusters`.
 #
-Cluster = "default"
+cluster = "default"

-# ECS Clusters Name
+# ECS Clusters Name.
 #
 # Optional
 # Default: ["default"]
 #
-Clusters = ["default"]
+clusters = ["default"]

-# Enable watch ECS changes
+# Enable watch ECS changes.
 #
 # Optional
 # Default: true
 #
-Watch = true
+watch = true

-# Enable auto discover ECS clusters
+# Default domain used.
+#
+# Optional
+# Default: ""
+#
+domain = "ecs.localhost"
+
+# Enable auto discover ECS clusters.
 #
 # Optional
 # Default: false
 #
-AutoDiscoverClusters = false
+autoDiscoverClusters = false

-# Polling interval (in seconds)
+# Polling interval (in seconds).
 #
 # Optional
 # Default: 15
 #
-RefreshSeconds = 15
+refreshSeconds = 15

-# Expose ECS services by default in traefik
+# Expose ECS services by default in Traefik.
 #
 # Optional
 # Default: true
 #
-ExposedByDefault = false
+exposedByDefault = false

-# Region to use when connecting to AWS
+# Region to use when connecting to AWS.
 #
 # Optional
 #
-Region = "us-east-1"
+region = "us-east-1"

-# AccessKeyID to use when connecting to AWS
+# AccessKeyID to use when connecting to AWS.
 #
 # Optional
 #
-AccessKeyID = "abc"
+accessKeyID = "abc"

-# SecretAccessKey to use when connecting to AWS
+# SecretAccessKey to use when connecting to AWS.
 #
 # Optional
 #
-SecretAccessKey = "123"
+secretAccessKey = "123"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "ecs.tmpl"
 ```

-Labels can be used on task containers to override default behaviour:
-
-| Label                                             | Description                                                                              |
-|---------------------------------------------------|------------------------------------------------------------------------------------------|
-| `traefik.protocol=https`                          | override the default `http` protocol                                                     |
-| `traefik.weight=10`                               | assign this weight to the container                                                      |
-| `traefik.enable=false`                            | disable this container in Træfik                                                         |
-| `traefik.backend.loadbalancer.method=drr`         | override the default `wrr` load balancer algorithm                                       |
-| `traefik.backend.loadbalancer.sticky=true`        | enable backend sticky sessions                                                           |
-| `traefik.frontend.rule=Host:test.traefik.io`      | override the default frontend rule (Default: `Host:{containerName}.{domain}`).           |
-| `traefik.frontend.passHostHeader=true`            | forward client `Host` header to the backend.                                             |
-| `traefik.frontend.priority=10`                    | override default frontend priority                                                       |
-| `traefik.frontend.entryPoints=http,https`         | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
-| `traefik.frontend.auth.basic=EXPR`                | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`         |
-
 If `AccessKeyID`/`SecretAccessKey` is not given credentials will be resolved in the following order:

 - From environment variables; `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`.
 - Shared credentials, determined by `AWS_PROFILE` and `AWS_SHARED_CREDENTIALS_FILE`, defaults to `default` and `~/.aws/credentials`.
 - EC2 instance role or ECS task role

+## Policy
+
 Træfik needs the following policy to read ECS information:

 ```json
@@ -122,3 +119,22 @@ Træfik needs the following policy to read ECS information:
    ]
 }
 ```
+
+## Labels: overriding default behaviour
+
+Labels can be used on task containers to override default behaviour:
+
+| Label                                                     | Description                                                                              |
+|-----------------------------------------------------------|------------------------------------------------------------------------------------------|
+| `traefik.protocol=https`                                  | override the default `http` protocol                                                     |
+| `traefik.weight=10`                                       | assign this weight to the container                                                      |
+| `traefik.enable=false`                                    | disable this container in Træfik                                                         |
+| `traefik.backend.loadbalancer.method=drr`                 | override the default `wrr` load balancer algorithm                                       |
+| `traefik.backend.loadbalancer.stickiness=true`            | enable backend sticky sessions                                                           |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                         |
+| `traefik.backend.loadbalancer.sticky=true`                | enable backend sticky sessions (DEPRECATED)                                              |
+| `traefik.frontend.rule=Host:test.traefik.io`              | override the default frontend rule (Default: `Host:{containerName}.{domain}`).           |
+| `traefik.frontend.passHostHeader=true`                    | forward client `Host` header to the backend.                                             |
+| `traefik.frontend.priority=10`                            | override default frontend priority                                                       |
+| `traefik.frontend.entryPoints=http,https`                 | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
+| `traefik.frontend.auth.basic=EXPR`                        | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`         |
--- a/docs/configuration/backends/etcd.md
+++ b/docs/configuration/backends/etcd.md
@@ -1,55 +1,61 @@
 # Etcd Backend

-Træfik can be configured to use Etcd as a backend configuration:
+Træfik can be configured to use Etcd as a backend configuration.

 ```toml
 ################################################################
 # Etcd configuration backend
 ################################################################

-# Enable Etcd configuration backend
+# Enable Etcd configuration backend.
 [etcd]

-# Etcd server endpoint
+# Etcd server endpoint.
 #
 # Required
+# Default: "127.0.0.1:2379"
 #
 endpoint = "127.0.0.1:2379"

-# Enable watch Etcd changes
+# Enable watch Etcd changes.
 #
 # Optional
+# Default: true
 #
 watch = true

 # Prefix used for KV store.
 #
 # Optional
+# Default: "/traefik"
 #
 prefix = "/traefik"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "etcd.tmpl"

-# Use etcd user/pass authentication
+# Use etcd user/pass authentication.
 #
 # Optional
 #
 # username = foo
 # password = bar

-# Enable etcd TLS connection
+# Enable etcd TLS connection.
 #
 # Optional
 #
-# [etcd.tls]
-# ca = "/etc/ssl/ca.crt"
-# cert = "/etc/ssl/etcd.crt"
-# key = "/etc/ssl/etcd.key"
-# insecureskipverify = true
+#    [etcd.tls]
+#    ca = "/etc/ssl/ca.crt"
+#    cert = "/etc/ssl/etcd.crt"
+#    key = "/etc/ssl/etcd.key"
+#    insecureskipverify = true
 ```

-Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on traefik KV structure.
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
+
+Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure.
--- a/docs/configuration/backends/eureka.md
+++ b/docs/configuration/backends/eureka.md
@@ -1,29 +1,30 @@
 # Eureka Backend

-Træfik can be configured to use Eureka as a backend configuration:
+Træfik can be configured to use Eureka as a backend configuration.

 ```toml
 ################################################################
 # Eureka configuration backend
 ################################################################

-# Enable Eureka configuration backend
+# Enable Eureka configuration backend.
 [eureka]

 # Eureka server endpoint.
-# endpoint := "http://my.eureka.server/eureka"
 #
 # Required
 #
 endpoint = "http://my.eureka.server/eureka"

-# Override default configuration time between refresh
+# Override default configuration time between refresh.
 #
 # Optional
-# default 30s
+# Default: 30s
+#
 delay = "1m"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
--- a/docs/configuration/backends/file.md
+++ b/docs/configuration/backends/file.md
@@ -1,6 +1,12 @@
 # File Backends

-Like any other reverse proxy, Træfik can be configured with a file. You have three choices:
+Like any other reverse proxy, Træfik can be configured with a file.
+
+You have three choices:
+
+- [Simple](/configuration/backends/file/#simple)
+- [Rules in a Separate File](/configuration/backends/file/#rules-in-a-separate-file)
+- [Multiple `.toml` Files](/configuration/backends/file/#multiple-toml-files)

 ## Simple

@@ -145,7 +151,7 @@ filename = "rules.toml"
  rule = "Path:/test"
 ```

-## Multiple .toml Files
+## Multiple `.toml` Files

 You could have multiple `.toml` files in a directory:

--- a/docs/configuration/backends/kubernetes.md
+++ b/docs/configuration/backends/kubernetes.md
@@ -1,30 +1,23 @@
 # Kubernetes Ingress Backend

-Træfik can be configured to use Kubernetes Ingress as a backend configuration:
+Træfik can be configured to use Kubernetes Ingress as a backend configuration.
+
+See also [Kubernetes user guide](/user-guide/kubernetes). 
+
+
+## Configuration

 ```toml
 ################################################################
 # Kubernetes Ingress configuration backend
 ################################################################
-# Enable Kubernetes Ingress configuration backend
+
+# Enable Kubernetes Ingress configuration backend.
 [kubernetes]

-# Kubernetes server endpoint
+# Kubernetes server endpoint.
 #
-# When deployed as a replication controller in Kubernetes, Traefik will use
-# the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT
-# to construct the endpoint.
-# Secure token will be found in /var/run/secrets/kubernetes.io/serviceaccount/token
-# and SSL CA cert in /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-#
-# The endpoint may be given to override the environment variable values.
-#
-# When the environment variables are not found, Traefik will try to connect to
-# the Kubernetes API server with an external-cluster client. In this case, the
-# endpoint is required. Specifically, it may be set to the URL used by
-# `kubectl proxy` to connect to a Kubernetes cluster from localhost.
-#
-# Optional for in-cluster configuration, required otherwise
+# Optional for in-cluster configuration, required otherwise.
 # Default: empty
 #
 # endpoint = "http://localhost:8080"
@@ -36,8 +29,8 @@ Træfik can be configured to use Kubernetes Ingress as a backend configuration:
 #
 # token = "my token"

-# Path to the certificate authority file used for the Kubernetes client
-# configuration.
+# Path to the certificate authority file.
+# Used for the Kubernetes client configuration.
 #
 # Optional
 # Default: empty
@@ -52,44 +45,84 @@ Træfik can be configured to use Kubernetes Ingress as a backend configuration:
 # namespaces = ["default", "production"]

 # Ingress label selector to identify Ingress objects that should be processed.
-# See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors for details.
 #
 # Optional
 # Default: empty (process all Ingresses)
 #
 # labelselector = "A and not B"
+
+# Disable PassHost Headers.
+#
+# Optional
+# Default: false
+#
+# disablePassHostHeaders = true
 ```

+### `endpoint`
+
+The Kubernetes server endpoint.
+
+When deployed as a replication controller in Kubernetes, Traefik will use the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` to construct the endpoint.
+
+Secure token will be found in `/var/run/secrets/kubernetes.io/serviceaccount/token` and SSL CA cert in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`
+
+The endpoint may be given to override the environment variable values.
+
+When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client.
+In this case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster from localhost.
+
+### `labelselector`
+
+Ingress label selector to identify Ingress objects that should be processed.
+
+See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.
+
+
+## Annotations
+
 Annotations can be used on containers to override default behaviour for the whole Ingress resource:

- `traefik.frontend.rule.type: PathPrefixStrip`: override the default frontend rule type (Default: `PathPrefix`).
- `traefik.frontend.priority: 3`: override the default frontend rule priority (Default: `len(Path)`).
+- `traefik.frontend.rule.type: PathPrefixStrip`  
+    Override the default frontend rule type. Default: `PathPrefix`.
+- `traefik.frontend.priority: "3"`
+    Override the default frontend rule priority.

 Annotations can be used on the Kubernetes service to override default behaviour:

- `traefik.backend.loadbalancer.method=drr`: override the default `wrr` load balancer algorithm
- `traefik.backend.loadbalancer.sticky=true`: enable backend sticky sessions
+- `traefik.backend.loadbalancer.method=drr`  
+    Override the default `wrr` load balancer algorithm
+- `traefik.backend.loadbalancer.stickiness=true`      
+    Enable backend sticky sessions
+- `traefik.backend.loadbalancer.stickiness.cookieName=NAME`      
+    Manually set the cookie name for sticky sessions
+- `traefik.backend.loadbalancer.sticky=true`      
+    Enable backend sticky sessions (DEPRECATED)

 You can find here an example [ingress](https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml) and [replication controller](https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik.yaml).

-Additionally, an annotation can be used on Kubernetes services to set the [circuit breaker expression](https://docs.traefik.io/basics/#backends) for a backend.
+Additionally, an annotation can be used on Kubernetes services to set the [circuit breaker expression](/basics/#backends) for a backend.

- `traefik.backend.circuitbreaker: <expression>`: set the circuit breaker expression for the backend (Default: nil).
+- `traefik.backend.circuitbreaker: <expression>`  
+    Set the circuit breaker expression for the backend. Default: `nil`.

-As known from nginx when used as Kubernetes Ingress Controller, a List of IP-Ranges which are allowed to access can be configured by using an ingress annotation:
+As known from nginx when used as Kubernetes Ingress Controller, a list of IP-Ranges which are allowed to access can be configured by using an ingress annotation:

 - `ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"`

-An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access.
+An unset or empty list allows all Source-IPs to access.
+If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access.


 ### Authentication

 Is possible to add additional authentication annotations in the Ingress rule.
-The source of the authentication is a secret that contains usernames and passwords inside the the key auth.
+The source of the authentication is a secret that contains usernames and passwords inside the key auth.

 - `ingress.kubernetes.io/auth-type`: `basic`
- `ingress.kubernetes.io/auth-secret`: contains the usernames and passwords with access to the paths defined in the Ingress Rule.
+- `ingress.kubernetes.io/auth-secret`: `mysecret`  
+    Contains the usernames and passwords with access to the paths defined in the Ingress Rule.

 The secret must be created in the same namespace as the Ingress rule.

--- a/docs/configuration/backends/marathon.md
+++ b/docs/configuration/backends/marathon.md
@@ -1,26 +1,33 @@
 # Marathon Backend

-Træfik can be configured to use Marathon as a backend configuration:
+Træfik can be configured to use Marathon as a backend configuration.
+
+See also [Marathon user guide](/user-guide/marathon).
+ 
+
+## Configuration

 ```toml
 ################################################################
 # Mesos/Marathon configuration backend
 ################################################################

-# Enable Marathon configuration backend
+# Enable Marathon configuration backend.
 [marathon]

 # Marathon server endpoint.
 # You can also specify multiple endpoint for Marathon:
-# endpoint := "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+# endpoint = "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
 #
 # Required
+# Default: "http://127.0.0.1:8080"
 #
 endpoint = "http://127.0.0.1:8080"

-# Enable watch Marathon changes
+# Enable watch Marathon changes.
 #
 # Optional
+# Default: true
 #
 watch = true

@@ -31,20 +38,21 @@ watch = true
 #
 domain = "marathon.localhost"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "marathon.tmpl"

-# Expose Marathon apps by default in traefik
+# Expose Marathon apps by default in Traefik.
 #
 # Optional
 # Default: true
 #
-# exposedByDefault = true
+# exposedByDefault = false

-# Convert Marathon groups to subdomains
+# Convert Marathon groups to subdomains.
 # Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain}
 # with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain}
 #
@@ -53,52 +61,54 @@ domain = "marathon.localhost"
 #
 # groupsAsSubDomains = true

-# Enable compatibility with marathon-lb labels
+# Enable compatibility with marathon-lb labels.
 #
 # Optional
 # Default: false
 #
 # marathonLBCompatibility = true

-# Enable Marathon basic authentication
+# Enable Marathon basic authentication.
 #
 # Optional
 #
-#  [marathon.basic]
-#  httpBasicAuthUser = "foo"
-#  httpBasicPassword = "bar"
+#    [marathon.basic]
+#    httpBasicAuthUser = "foo"
+#    httpBasicPassword = "bar"

 # TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
 #
 # Optional
 #
-# [marathon.TLS]
-# CA = "/etc/ssl/ca.crt"
-# Cert = "/etc/ssl/marathon.cert"
-# Key = "/etc/ssl/marathon.key"
-# InsecureSkipVerify = true
+#    [marathon.TLS]
+#    CA = "/etc/ssl/ca.crt"
+#    Cert = "/etc/ssl/marathon.cert"
+#    Key = "/etc/ssl/marathon.key"
+#    InsecureSkipVerify = true

-# DCOSToken for DCOS environment, This will override the Authorization header
+# DCOSToken for DCOS environment.
+# This will override the Authorization header.
 #
 # Optional
 #
 # dcosToken = "xxxxxx"

-# Override DialerTimeout
+# Override DialerTimeout.
 # Amount of time to allow the Marathon provider to wait to open a TCP connection
 # to a Marathon master.
 # Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming
-# seconds.
+# values (digits).
+# If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "60s"
+#
 # dialerTimeout = "60s"

 # Set the TCP Keep Alive interval for the Marathon HTTP Client.
 # Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming
-# seconds.
+# values (digits).
+# If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "10s"
@@ -113,21 +123,28 @@ domain = "marathon.localhost"
 # Optional
 # Default: false
 #
-# forceTaskHostname = false
+# forceTaskHostname = true

 # Applications may define readiness checks which are probed by Marathon during
-# deployments periodically and the results exposed via the API. Enabling the
-# following parameter causes Traefik to filter out tasks whose readiness checks
-# have not succeeded.
-# Note that the checks are only valid at deployment times. See the Marathon
-# guide for details.
+# deployments periodically and the results exposed via the API.
+# Enabling the following parameter causes Traefik to filter out tasks
+# whose readiness checks have not succeeded.
+# Note that the checks are only valid at deployment times.
+# See the Marathon guide for details.
 #
 # Optional
 # Default: false
 #
-# respectReadinessChecks = false
+# respectReadinessChecks = true
 ```

+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
+
+
+## Labels: overriding default behaviour
+
+### On Containers
+
 Labels can be used on containers to override default behaviour:

 | Label                                                                 | Description                                                                                                                                                                        |
@@ -136,7 +153,9 @@ Labels can be used on containers to override default behaviour:
 | `traefik.backend.maxconn.amount=10`                                   | set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                               |
 | `traefik.backend.maxconn.extractorfunc=client.ip`                     | set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
 | `traefik.backend.loadbalancer.method=drr`                             | override the default `wrr` load balancer algorithm                                                                                                                                 |
-| `traefik.backend.loadbalancer.sticky=true`                            | enable backend sticky sessions                                                                                                                                                     |
+| `traefik.backend.loadbalancer.sticky=true`                            | enable backend sticky sessions (DEPRECATED)                                                                                                                                        |
+| `traefik.backend.loadbalancer.stickiness=true`                        | enable backend sticky sessions                                                                                                                                                     |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`             | Manually set the cookie name for sticky sessions                                                                                                                                   |
 | `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                       |
 | `traefik.backend.healthcheck.path=/health`                            | set the Traefik health check path [default: no health checks]                                                                                                                      |
 | `traefik.backend.healthcheck.interval=5s`                             | sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s]                                                                                   |
@@ -151,6 +170,8 @@ Labels can be used on containers to override default behaviour:
 | `traefik.frontend.entryPoints=http,https`                             | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                                                                                           |
 | `traefik.frontend.auth.basic=EXPR`                                    | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`.                                                                                                  |

+### On Services
+
 If several ports need to be exposed from a container, the services labels can be used:

 | Label                                                  | Description                                                                                          |
--- a/docs/configuration/backends/mesos.md
+++ b/docs/configuration/backends/mesos.md
@@ -1,13 +1,13 @@
 # Mesos Generic Backend

-Træfik can be configured to use Mesos as a backend configuration:
+Træfik can be configured to use Mesos as a backend configuration.

 ```toml
 ################################################################
 # Mesos configuration backend
 ################################################################

-# Enable Mesos configuration backend
+# Enable Mesos configuration backend.
 [mesos]

 # Mesos server endpoint.
@@ -16,12 +16,14 @@ Træfik can be configured to use Mesos as a backend configuration:
 # endpoint = "zk://192.168.35.20:2181,192.168.35.21:2181,192.168.35.22:2181/mesos"
 #
 # Required
+# Default: "http://127.0.0.1:5050"
 #
 endpoint = "http://127.0.0.1:8080"

-# Enable watch Mesos changes
+# Enable watch Mesos changes.
 #
 # Optional
+# Default: true
 #
 watch = true

@@ -32,18 +34,19 @@ watch = true
 #
 domain = "mesos.localhost"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "mesos.tmpl"

-# Expose Mesos apps by default in traefik
+# Expose Mesos apps by default in Traefik.
 #
 # Optional
-# Default: false
+# Default: true
 #
-# ExposedByDefault = true
+# ExposedByDefault = false

 # TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
 #
@@ -52,30 +55,39 @@ domain = "mesos.localhost"
 # [mesos.TLS]
 # InsecureSkipVerify = true

-# Zookeeper timeout (in seconds)
+# Zookeeper timeout (in seconds).
 #
 # Optional
 # Default: 30
 #
 # ZkDetectionTimeout = 30

-# Polling interval (in seconds)
+# Polling interval (in seconds).
 #
 # Optional
 # Default: 30
 #
 # RefreshSeconds = 30

-# IP sources (e.g. host, docker, mesos, rkt)
+# IP sources (e.g. host, docker, mesos, rkt).
 #
 # Optional
 #
 # IPSources = "host"

-# HTTP Timeout (in seconds)
+# HTTP Timeout (in seconds).
 #
 # Optional
 # Default: 30
 #
 # StateTimeoutSecond = "30"
+
+# Convert groups to subdomains.
+# Default behavior: /foo/bar/myapp => foo-bar-myapp.{defaultDomain}
+# with groupsAsSubDomains enabled: /foo/bar/myapp => myapp.bar.foo.{defaultDomain}
+#
+# Optional
+# Default: false
+#
+# groupsAsSubDomains = true
 ```
--- a/docs/configuration/backends/rancher.md
+++ b/docs/configuration/backends/rancher.md
@@ -1,13 +1,15 @@
 # Rancher Backend

-Træfik can be configured to use Rancher as a backend configuration:
+Træfik can be configured to use Rancher as a backend configuration.
+
+## Global Configuration

 ```toml
 ################################################################
 # Rancher configuration backend
 ################################################################

-# Enable Rancher configuration backend
+# Enable Rancher configuration backend.
 [rancher]

 # Default domain used.
@@ -17,27 +19,28 @@ Træfik can be configured to use Rancher as a backend configuration:
 #
 domain = "rancher.localhost"

-# Enable watch Rancher changes
+# Enable watch Rancher changes.
 #
 # Optional
 # Default: true
 #
 watch = true

-# Polling interval (in seconds)
+# Polling interval (in seconds).
 #
 # Optional
+# Default: 15
 #
 refreshSeconds = 15

-# Expose Rancher services by default in traefik
+# Expose Rancher services by default in Traefik.
 #
 # Optional
 # Default: true
 #
 exposedByDefault = false

-# Filter services with unhealthy states and inactive states
+# Filter services with unhealthy states and inactive states.
 #
 # Optional
 # Default: false
@@ -45,18 +48,20 @@ exposedByDefault = false
 enableServiceHealthFilter = true
 ```

+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
+
 ## Rancher Metadata Service

 ```toml
 # Enable Rancher metadata service configuration backend instead of the API
-# configuration backend
+# configuration backend.
 #
 # Optional
 # Default: false
 #
 [rancher.metadata]

-# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds`
+# Poll the Rancher metadata service for changes every `rancher.RefreshSeconds`.
 # NOTE: this is less accurate than the default long polling technique which
 # will provide near instantaneous updates to Traefik
 #
@@ -65,7 +70,7 @@ enableServiceHealthFilter = true
 #
 intervalPoll = true

-# Prefix used for accessing the Rancher metadata service
+# Prefix used for accessing the Rancher metadata service.
 #
 # Optional
 # Default: "/latest"
@@ -76,24 +81,24 @@ prefix = "/2016-07-29"
 ## Rancher API

 ```toml
-# Enable Rancher API configuration backend
+# Enable Rancher API configuration backend.
 #
 # Optional
 # Default: true
 #
 [rancher.api]

-# Endpoint to use when connecting to the Rancher API
+# Endpoint to use when connecting to the Rancher API.
 #
 # Required
 endpoint = "http://rancherserver.example.com/v1"

-# AccessKey to use when connecting to the Rancher API
+# AccessKey to use when connecting to the Rancher API.
 #
 # Required
 accessKey = "XXXXXXXXXXXXXXXXXXXX"

-# SecretKey to use when connecting to the Rancher API
+# SecretKey to use when connecting to the Rancher API.
 #
 # Required
 secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
@@ -102,20 +107,25 @@ secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 !!! note
    If Traefik needs access to the Rancher API, you need to set the `endpoint`, `accesskey` and `secretkey` parameters.

-    To enable traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`.
+    To enable Traefik to fetch information about the Environment it's deployed in only, you need to create an `Environment API Key`.
    This can be found within the API Key advanced options.

-## Labels
+## Labels: overriding default behaviour

 Labels can be used on task containers to override default behaviour:

-| Label                                        | Description                                                                              |
-|----------------------------------------------|------------------------------------------------------------------------------------------|
-| `traefik.protocol=https`                     | override the default `http` protocol                                                     |
-| `traefik.weight=10`                          | assign this weight to the container                                                      |
-| `traefik.enable=false`                       | disable this container in Træfik                                                         |
-| `traefik.frontend.rule=Host:test.traefik.io` | override the default frontend rule (Default: `Host:{containerName}.{domain}`).           |
-| `traefik.frontend.passHostHeader=true`       | forward client `Host` header to the backend.                                             |
-| `traefik.frontend.priority=10`               | override default frontend priority                                                       |
-| `traefik.frontend.entryPoints=http,https`    | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
-| `traefik.frontend.auth.basic=EXPR`           | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`.        |
+| Label                                                                 | Description                                                                              |
+|-----------------------------------------------------------------------|------------------------------------------------------------------------------------------|
+| `traefik.protocol=https`                                              | Override the default `http` protocol                                                     |
+| `traefik.weight=10`                                                   | Assign this weight to the container                                                      |
+| `traefik.enable=false`                                                | Disable this container in Træfik                                                         |
+| `traefik.frontend.rule=Host:test.traefik.io`                          | Override the default frontend rule (Default: `Host:{containerName}.{domain}`).           |
+| `traefik.frontend.passHostHeader=true`                                | Forward client `Host` header to the backend.                                             |
+| `traefik.frontend.priority=10`                                        | Override default frontend priority                                                       |
+| `traefik.frontend.entryPoints=http,https`                             | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
+| `traefik.frontend.auth.basic=EXPR`                                    | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`.        |
+| `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | Create a [circuit breaker](/basics/#backends) to be used against the backend             |
+| `traefik.backend.loadbalancer.method=drr`                             | Override the default `wrr` load balancer algorithm                                       |
+| `traefik.backend.loadbalancer.stickiness=true`                        | Enable backend sticky sessions                                                           |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`             | Manually set the cookie name for sticky sessions                                         |
+| `traefik.backend.loadbalancer.sticky=true`                            | Enable backend sticky sessions (DEPRECATED)                                              |
--- a/docs/configuration/backends/web.md
+++ b/docs/configuration/backends/web.md
@@ -3,35 +3,35 @@
 Træfik can be configured:

 - using a RESTful api.
- to use a metric system (like Prometheus, DataDog or StatD, ...).
+- to use a monitoring system (like Prometheus, DataDog or StatD, ...).
 - to expose a Web Dashboard.

 ## Configuration

 ```toml
+# Enable web backend.
 [web]

-# Web administration port
+# Web administration port.
 #
 # Required
+# Default: ":8080"
 #
 address = ":8080"

-# SSL certificate and key used
+# SSL certificate and key used.
 #
 # Optional
 #
-# CertFile = "traefik.crt"
-# KeyFile = "traefik.key"
+# certFile = "traefik.crt"
+# keyFile = "traefik.key"

-# Set REST API to read-only mode
+# Set REST API to read-only mode.
 #
 # Optional
-# ReadOnly = false
-
-# Enable more detailed statistics
-# [web.statistics]
-#   RecentErrors = 10
+# Default: false
+#
+readOnly = true
 ```

 ## Web UI
@@ -42,7 +42,10 @@ address = ":8080"

 ### Authentication

- Basic Authentication
+!!! note
+    The `/ping` path of the api is excluded from authentication (since 1.4).
+
+#### Basic Authentication

 Passwords can be encoded in MD5, SHA1 and BCrypt: you can use `htpasswd` to generate those ones.

@@ -50,13 +53,18 @@ Users can be specified directly in the toml file, or indirectly by referencing a
 if both are provided, the two are merged, with external file contents having precedence.

 ```toml
+[web]
+# ...
+
 # To enable basic auth on the webui with 2 user/pass: test:test and test2:test2
-  [web.auth.basic]
-    users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
-    usersFile = "/path/to/.htpasswd"
+[web.auth.basic]
+users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
+usersFile = "/path/to/.htpasswd"
+
+# ...
 ```

- Digest Authentication
+#### Digest Authentication

 You can use `htdigest` to generate those ones.

@@ -64,10 +72,15 @@ Users can be specified directly in the toml file, or indirectly by referencing a
 if both are provided, the two are merged, with external file contents having precedence

 ```toml
+[web]
+# ...
+
 # To enable digest auth on the webui with 2 user/realm/pass: test:traefik:test and test2:traefik:test2
-  [web.auth.digest]
-    users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
-    usersFile = "/path/to/.htdigest"
+[web.auth.digest]
+users = ["test:traefik:a2688e031edb4be6a3797f3882655c05 ", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
+usersFile = "/path/to/.htdigest"
+
+# ...
 ```


@@ -75,32 +88,96 @@ Users can be specified directly in the toml file, or indirectly by referencing a

 You can enable Traefik to export internal metrics to different monitoring systems.

- Prometheus
+### Prometheus

 ```toml
+[web]
+# ...
+
 # To enable Traefik to export internal metrics to Prometheus
 [web.metrics.prometheus]
-  Buckets=[0.1,0.3,1.2,5.0]
+
+# Buckets for latency metrics
+#
+# Optional
+# Default: [0.1, 0.3, 1.2, 5]
+buckets=[0.1,0.3,1.2,5.0]
+    
+# ...
 ```

- DataDog
+### DataDog

 ```toml
+[web]
+# ...
+
 # DataDog metrics exporter type
 [web.metrics.datadog]
-  Address = "localhost:8125"
-  Pushinterval = "10s"
+
+# DataDog's address.
+#
+# Required
+# Default: "localhost:8125"
+#
+address = "localhost:8125"
+
+# DataDog push interval
+#
+# Optional
+# Default: "10s"
+#
+pushinterval = "10s"
+
+# ...
 ```

- StatsD
+### StatsD

 ```toml
+[web]
+# ...
+
 # StatsD metrics exporter type
 [web.metrics.statsd]
-  Address = "localhost:8125"
-  Pushinterval = "10s"
+
+# StatD's address.
+#
+# Required
+# Default: "localhost:8125"
+#
+address = "localhost:8125"
+
+# StatD push interval
+#
+# Optional
+# Default: "10s"
+#
+pushinterval = "10s"
+
+# ...
 ```

+
+## Statistics
+
+```toml
+[web]
+# ...
+
+# Enable more detailed statistics.
+[web.statistics]
+
+# Number of recent errors logged.
+#
+# Default: 10
+#
+recentErrors = 10
+
+# ...
+```
+
+
 ## API

 | Path                                                            |     Method    | Description                                                                                        |
@@ -126,7 +203,7 @@ You can enable Traefik to export internal metrics to different monitoring system
 #### Ping

 ```shell
-$ curl -sv "http://localhost:8080/ping"
+curl -sv "http://localhost:8080/ping"
 ```
 ```shell
 *   Trying ::1...
@@ -148,7 +225,7 @@ OK
 #### Health

 ```shell
-$ curl -s "http://localhost:8080/health" | jq .
+curl -s "http://localhost:8080/health" | jq .
 ```
 ```json
 {
@@ -209,7 +286,7 @@ $ curl -s "http://localhost:8080/health" | jq .
 #### Provider configurations

 ```shell
-$ curl -s "http://localhost:8080/api" | jq .
+curl -s "http://localhost:8080/api" | jq .
 ```
 ```json
 {
--- a/docs/configuration/backends/zookeeper.md
+++ b/docs/configuration/backends/zookeeper.md
@@ -1,38 +1,61 @@
 # Zookeeper Backend

-Træfik can be configured to use Zookeeper as a backend configuration:
+Træfik can be configured to use Zookeeper as a backend configuration.

 ```toml
 ################################################################
 # Zookeeper configuration backend
 ################################################################

-# Enable Zookeeperconfiguration backend
+# Enable Zookeeperconfiguration backend.
 [zookeeper]

-# Zookeeper server endpoint
+# Zookeeper server endpoint.
 #
 # Required
+# Default: "127.0.0.1:2181"
 #
 endpoint = "127.0.0.1:2181"

-# Enable watch Zookeeper changes
+# Enable watch Zookeeper changes.
 #
 # Optional
+# Default: true
 #
 watch = true

 # Prefix used for KV store.
 #
 # Optional
+# Default: "/traefik"
 #
-prefix = "traefik"
+prefix = "/traefik"

-# Override default configuration template. For advanced users :)
+# Override default configuration template.
+# For advanced users :)
 #
 # Optional
 #
 # filename = "zookeeper.tmpl"
+
+# Use Zookeeper user/pass authentication.
+#
+# Optional
+#
+# username = foo
+# password = bar
+
+# Enable Zookeeper TLS connection.
+#
+# Optional
+#
+#    [zookeeper.tls]
+#    ca = "/etc/ssl/ca.crt"
+#    cert = "/etc/ssl/zookeeper.crt"
+#    key = "/etc/ssl/zookeeper.key"
+#    insecureskipverify = true
 ```

-Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on traefik KV structure.
+To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
+
+Please refer to the [Key Value storage structure](/user-guide/kv-config/#key-value-storage-structure) section to get documentation on Traefik KV structure.
--- a/docs/configuration/commons.md
+++ b/docs/configuration/commons.md
@@ -4,45 +4,34 @@

 ```toml
 # Duration to give active requests a chance to finish before Traefik stops.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
-# If no units are provided, the value is parsed assuming seconds.
-# Note: in this time frame no new requests are accepted.
 #
 # Optional
 # Default: "10s"
 #
 # graceTimeOut = "10s"

-# Enable debug mode
+# Enable debug mode.
 #
 # Optional
 # Default: false
 #
 # debug = true

-# Periodically check if a new version has been released
+# Periodically check if a new version has been released.
 #
 # Optional
 # Default: true
 #
 # checkNewVersion = false

-# Backends throttle duration: minimum duration in seconds between 2 events from providers
-# before applying a new configuration. It avoids unnecessary reloads if multiples events
-# are sent in a short amount of time.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming
-# seconds.
+# Backends throttle duration.
 #
 # Optional
 # Default: "2s"
 #
 # ProvidersThrottleDuration = "2s"

-# Controls the maximum idle (keep-alive) connections to keep per-host. If zero, DefaultMaxIdleConnsPerHost
-# from the Go standard library net/http module is used.
-# If you encounter 'too many open files' errors, you can either increase this
-# value or change the `ulimit`.
+# Controls the maximum idle (keep-alive) connections to keep per-host.
 #
 # Optional
 # Default: 200
@@ -50,15 +39,15 @@
 # MaxIdleConnsPerHost = 200

 # If set to true invalid SSL certificates are accepted for backends.
-# Note: This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.
+# This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.
 #
 # Optional
 # Default: false
 #
 # InsecureSkipVerify = true

-# Register Certificates in the RootCA. This certificates will be use for backends calls.
-# Note: You can use file path or cert content directly
+# Register Certificates in the RootCA.
+#
 # Optional
 # Default: []
 #
@@ -73,6 +62,29 @@
 # defaultEntryPoints = ["http", "https"]
 ```

+- `graceTimeOut`: Duration to give active requests a chance to finish before Traefik stops.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.  
+**Note:** in this time frame no new requests are accepted.
+
+- `ProvidersThrottleDuration`: Backends throttle duration: minimum duration in seconds between 2 events from providers before applying a new configuration.
+It avoids unnecessary reloads if multiples events are sent in a short amount of time.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
+- `MaxIdleConnsPerHost`: Controls the maximum idle (keep-alive) connections to keep per-host.  
+If zero, `DefaultMaxIdleConnsPerHost` from the Go standard library net/http module is used.
+If you encounter 'too many open files' errors, you can either increase this value or change the `ulimit`.
+
+- `InsecureSkipVerify` : If set to true invalid SSL certificates are accepted for backends.  
+**Note:** This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.
+
+- `RootCAs`: Register Certificates in the RootCA. This certificates will be use for backends calls.  
+**Note** You can use file path or cert content directly
+
+- `defaultEntryPoints`: Entrypoints to be used by frontends that do not specify any entrypoint.  
+Each frontend can specify its own entrypoints.
+

 ## Constraints

@@ -80,18 +92,6 @@ In a micro-service architecture, with a central service discovery, setting const

 Træfik filters services according to service attributes/tags set in your configuration backends.

-Supported backends:
-
- Docker
- Consul K/V
- BoltDB
- Zookeeper
- Etcd
- Consul Catalog
- Rancher
- Marathon
- Kubernetes (using a provider-specific mechanism based on label selectors)
-
 Supported filters:

 - `tag`
@@ -120,14 +120,27 @@ constraints = ["tag!=us-*", "tag!=asia-*"]

 ### Backend-specific

+Supported backends:
+
+- Docker
+- Consul K/V
+- BoltDB
+- Zookeeper
+- Etcd
+- Consul Catalog
+- Rancher
+- Marathon
+- Kubernetes (using a provider-specific mechanism based on label selectors)
+
 ```toml
 # Backend-specific constraint
 [consulCatalog]
-endpoint = "127.0.0.1:8500"
+# ...
 constraints = ["tag==api"]

+# Backend-specific constraint
 [marathon]
-endpoint = "127.0.0.1:8800"
+# ...
 constraints = ["tag==api", "tag!=v*-beta"]
 ```

@@ -190,14 +203,17 @@ Traefik will close and reopen its log files, assuming they're configured, on rec
 This allows the logs to be rotated and processed by an external program, such as `logrotate`.

 !!! note
-    that this does not work on Windows due to the lack of USR signals.
+    This does not work on Windows due to the lack of USR signals.


 ## Custom Error pages

 Custom error pages can be returned, in lieu of the default, according to frontend-configured ranges of HTTP Status codes.
+
 In the example below, if a 503 status is returned from the frontend "website", the custom error page at http://2.3.4.5/503.html is returned with the actual status code set in the HTTP header.
-Note, the `503.html` page itself is not hosted on traefik, but some other infrastructure.
+
+!!! note
+    The `503.html` page itself is not hosted on Traefik, but some other infrastructure.

 ```toml
 [frontends]
@@ -226,6 +242,9 @@ Instead, the query parameter can also be set to some generic error page like so:
 Now the `500s.html` error page is returned for the configured code range.
 The configured status code ranges are inclusive; that is, in the above example, the `500s.html` page will be returned for status codes `500` through, and including, `599`.

+Custom error pages are easiest to implement using the file provider.
+For dynamic providers, the corresponding template file needs to be customized accordingly and referenced in the Traefik configuration.
+

 ## Retry Configuration

@@ -248,12 +267,7 @@ The configured status code ranges are inclusive; that is, in the above example,
 # Enable custom health check options.
 [healthcheck]

-# Set the default health check interval. Will only be effective if health check
-# paths are defined. Given provider-specific support, the value may be
-# overridden on a per-backend basis.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming
-# seconds.
+# Set the default health check interval.
 #
 # Optional
 # Default: "30s"
@@ -261,6 +275,11 @@ The configured status code ranges are inclusive; that is, in the above example,
 # interval = "30s"
 ```

+- `interval` set the default health check interval.  
+Will only be effective if health check paths are defined.  
+Given provider-specific support, the value may be overridden on a per-backend basis.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).  
+If no units are provided, the value is parsed assuming seconds.

 ## Timeouts

@@ -272,20 +291,13 @@ The configured status code ranges are inclusive; that is, in the above example,
 [respondingTimeouts]

 # readTimeout is the maximum duration for reading the entire request, including the body.
-# If zero, no timeout exists.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "0s"
 #
 # readTimeout = "5s"

-# writeTimeout is the maximum duration before timing out writes of the response. It covers the time from the end of
-# the request header read to the end of the response write.
-# If zero, no timeout exists.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming seconds.
+# writeTimeout is the maximum duration before timing out writes of the response.
 #
 # Optional
 # Default: "0s"
@@ -293,9 +305,6 @@ The configured status code ranges are inclusive; that is, in the above example,
 # writeTimeout = "5s"

 # idleTimeout is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.
-# If zero, no timeout exists.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "180s"
@@ -303,6 +312,22 @@ The configured status code ranges are inclusive; that is, in the above example,
 # idleTimeout = "360s"
 ```

+- `readTimeout` is the maximum duration for reading the entire request, including the body.  
+If zero, no timeout exists.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
+- `writeTimeout` is the maximum duration before timing out writes of the response.  
+It covers the time from the end of the request header read to the end of the response write.
+If zero, no timeout exists.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
+- `idleTimeout` is the maximum duration an idle (keep-alive) connection will remain idle before closing itself.  
+If zero, no timeout exists.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
 ### Forwarding Timeouts

 `forwardingTimeouts` are timeouts for requests forwarded to the backend servers.
@@ -311,9 +336,6 @@ The configured status code ranges are inclusive; that is, in the above example,
 [forwardingTimeouts]

 # dialTimeout is the amount of time to wait until a connection to a backend server can be established.
-# If zero, no timeout exists.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "30s"
@@ -321,9 +343,6 @@ The configured status code ranges are inclusive; that is, in the above example,
 # dialTimeout = "30s"

 # responseHeaderTimeout is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any).
-# If zero, no timeout exists.
-# Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw
-# values (digits). If no units are provided, the value is parsed assuming seconds.
 #
 # Optional
 # Default: "0s"
@@ -331,6 +350,17 @@ The configured status code ranges are inclusive; that is, in the above example,
 # responseHeaderTimeout = "0s"
 ```

+- `dialTimeout` is the amount of time to wait until a connection to a backend server can be established.  
+If zero, no timeout exists.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
+- `responseHeaderTimeout` is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any).  
+If zero, no timeout exists.  
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration) or as raw values (digits).
+If no units are provided, the value is parsed assuming seconds.
+
+
 ### Idle Timeout (deprecated)

 Use [respondingTimeouts](/configuration/commons/#responding-timeouts) instead of `IdleTimeout`.
--- a/docs/configuration/entrypoints.md
+++ b/docs/configuration/entrypoints.md
@@ -109,23 +109,55 @@ Users can be specified directly in the toml file, or indirectly by referencing a
  usersFile = "/path/to/.htdigest"
 ```

+### Forward Authentication
+
+This configuration will first forward the request to `http://authserver.com/auth`.
+
+If the response code is 2XX, access is granted and the original request is performed.
+Otherwise, the response from the auth server is returned.
+
+```toml
+[entryPoints]
+  [entryPoints.http]
+    # ...
+    # To enable forward auth on an entrypoint
+    [entryPoints.http.auth.forward]
+    address = "https://authserver.com/auth"
+    
+    # Trust existing X-Forwarded-* headers.
+    # Useful with another reverse proxy in front of Traefik.
+    #
+    # Optional
+    # Default: false
+    #
+    trustForwardHeader = true
+    
+    # Enable forward auth TLS connection.
+    #
+    # Optional
+    #
+    [entryPoints.http.auth.forward.tls]
+    cert = "authserver.crt"
+    key = "authserver.key"
+```
+
 ## Specify Minimum TLS Version

-To specify an https entrypoint with a minimum TLS version, and specifying an array of cipher suites (from crypto/tls).
+To specify an https entry point with a minimum TLS version, and specifying an array of cipher suites (from crypto/tls).

 ```toml
 [entryPoints]
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
-    MinVersion = "VersionTLS12"
-    CipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"]
+    minVersion = "VersionTLS12"
+    cipherSuites = ["TLS_RSA_WITH_AES_256_GCM_SHA384"]
      [[entryPoints.https.tls.certificates]]
-      CertFile = "integration/fixtures/https/snitest.com.cert"
-      KeyFile = "integration/fixtures/https/snitest.com.key"
+      certFile = "integration/fixtures/https/snitest.com.cert"
+      keyFile = "integration/fixtures/https/snitest.com.key"
      [[entryPoints.https.tls.certificates]]
-      CertFile = "integration/fixtures/https/snitest.org.cert"
-      KeyFile = "integration/fixtures/https/snitest.org.key"
+      certFile = "integration/fixtures/https/snitest.org.cert"
+      keyFile = "integration/fixtures/https/snitest.org.key"
 ```

 ## Compression
@@ -139,6 +171,12 @@ To enable compression support using gzip format.
  compress = true
 ```

+Responses are compressed when:
+
+* The response body is larger than `512` bytes
+* And the `Accept-Encoding` request header contains `gzip`
+* And the response is not already compressed, i.e. the `Content-Encoding` response header is not already set.
+
 ## Whitelisting

 To enable IP whitelisting at the entrypoint level.
@@ -147,16 +185,55 @@ To enable IP whitelisting at the entrypoint level.
 [entryPoints]
  [entryPoints.http]
  address = ":80"
-  whiteListSourceRange = ["127.0.0.1/32"]
+  whiteListSourceRange = ["127.0.0.1/32", "192.168.1.7"]
 ```

-## ProxyProtocol Support
+## ProxyProtocol

 To enable [ProxyProtocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) support.
+Only IPs in `trustedIPs` will lead to remote client address replacement: you should declare your load-balancer IP or CIDR range here (in testing environment, you can trust everyone using `insecure = true`).
+
+!!! danger
+    When queuing Træfik behind another load-balancer, be sure to carefully configure Proxy Protocol on both sides.
+    Otherwise, it could introduce a security risk in your system by forging requests. 

 ```toml
 [entryPoints]
  [entryPoints.http]
-  address = ":80"
-  proxyprotocol = true
+    address = ":80"
+
+    # Enable ProxyProtocol
+    [entryPoints.http.proxyProtocol]
+      # List of trusted IPs
+      #
+      # Required
+      # Default: []
+      #
+      trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
+
+      # Insecure mode FOR TESTING ENVIRONNEMENT ONLY
+      #
+      # Optional
+      # Default: false
+      #
+      # insecure = true
+```
+
+## Forwarded Header
+
+Only IPs in `trustedIPs` will be authorized to trust the client forwarded headers (`X-Forwarded-*`).
+
+```toml
+[entryPoints]
+  [entryPoints.http]
+    address = ":80"
+
+    # Enable Forwarded Headers
+    [entryPoints.http.forwardedHeaders]
+      # List of trusted IPs
+      #
+      # Required
+      # Default: []
+      #
+      trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
 ```
--- a/docs/img/grpc.svg
+++ b/docs/img/grpc.svg
--- a/docs/index.md
+++ b/docs/index.md
@@ -4,7 +4,7 @@

 [![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
 [![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io)
-[![Go Report Card](https://goreportcard.com/badge/kubernetes/helm)](https://goreportcard.com/report/containous/traefik)
+[![Go Report Card](https://goreportcard.com/badge/github.com/containous/traefik)](https://goreportcard.com/report/github.com/containous/traefik)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
 [![Join the chat at https://traefik.herokuapp.com](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://traefik.herokuapp.com)
 [![Twitter](https://img.shields.io/twitter/follow/traefikproxy.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefikproxy)
@@ -37,9 +37,9 @@ Run it and forget it!

 ## Features

- [It's fast](https://docs.traefik.io/benchmarks)
+- [It's fast](/benchmarks)
 - No dependency hell, single binary made with go
- [Tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) official docker image
+- [Tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) docker image
 - Rest API
 - Hot-reloading of configuration. No need to restart the process
 - Circuit breakers, retry
--- a/docs/theme/styles/extra.css
+++ b/docs/theme/styles/extra.css
@@ -9,7 +9,12 @@
 .md-typeset__table td code {
    word-break: unset;
 }
+
 .md-typeset__table tr :nth-child(1) {
    word-wrap: break-word;
    max-width: 30em;
 }
+
+p {
+    text-align: justify;
+}
--- a/docs/user-guide/cluster.md
+++ b/docs/user-guide/cluster.md
@@ -1,21 +1,25 @@
 # Clustering / High Availability (beta)

 This guide explains how to use Træfik in high availability mode.
+
 In order to deploy and configure multiple Træfik instances, without copying the same configuration file on each instance, we will use a distributed Key-Value store.

 ## Prerequisites

 You will need a working KV store cluster.
+_(Currently, we recommend [Consul](https://consul.io) .)_

 ## File configuration to KV store migration

 We created a special Træfik command to help configuring your Key Value store from a Træfik TOML configuration file.
+
 Please refer to [this section](/user-guide/kv-config/#store-configuration-in-key-value-store) to get more details.

 ## Deploy a Træfik cluster

 Once your Træfik configuration is uploaded on your KV store, you can start each Træfik instance.
+
 A Træfik cluster is based on a manager/worker model.
+
 When starting, Træfik will elect a manager.
 If this instance fails, another manager will be automatically elected.
-
--- a/docs/user-guide/docker-and-lets-encrypt.md
+++ b/docs/user-guide/docker-and-lets-encrypt.md
@@ -1,20 +1,25 @@
 # Docker & Traefik

-In this use case, we want to use Traefik as a _layer-7_ load balancer with SSL termination for a set of micro-services used to run a web application.
-We also want to automatically _discover any services_ on the Docker host and let Traefik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly.
+In this use case, we want to use Træfik as a _layer-7_ load balancer with SSL termination for a set of micro-services used to run a web application.
+
+We also want to automatically _discover any services_ on the Docker host and let Træfik reconfigure itself automatically when containers get created (or shut down) so HTTP traffic can be routed accordingly.
+
 In addition, we want to use Let's Encrypt to automatically generate and renew SSL certificates per hostname.

 ## Setting Up

 In order for this to work, you'll need a server with a public IP address, with Docker installed on it.
+
 In this example, we're using the fictitious domain _my-awesome-app.org_.
+
 In real-life, you'll want to use your own domain and have the DNS configured accordingly so the hostname records you'll want to use point to the aforementioned public IP address.

 ## Networking

 Docker containers can only communicate with each other over TCP when they share at least one network.
 This makes sense from a topological point of view in the context of networking, since Docker under the hood creates IPTable rules so containers can't reach other containers _unless you'd want to_.
-In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Traefik) will reside in.
+
+In this example, we're going to use a single network called `web` where all containers that are handling HTTP traffic (including Træfik) will reside in.

 On the Docker host, run the following command:

@@ -22,7 +27,7 @@ On the Docker host, run the following command:
 docker network create web
 ```

-Now, let's create a directory on the server where we will configure the rest of Traefik:
+Now, let's create a directory on the server where we will configure the rest of Træfik:

 ```shell
 mkdir -p /opt/traefik
@@ -36,7 +41,8 @@ touch /opt/traefik/acme.json && chmod 600 /opt/traefik/acme.json
 touch /opt/traefik/traefik.toml
 ```

-The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Traefik.
+The `docker-compose.yml` file will provide us with a simple, consistent and more importantly, a deterministic way to create Træfik.
+
 The contents of the file is as follows:

 ```yaml
@@ -53,8 +59,8 @@ services:
      - web
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
-      - /srv/traefik/traefik.toml:/traefik.toml
-      - /srv/traefik/acme.json:/acme.json
+      - /opt/traefik/traefik.toml:/traefik.toml
+      - /opt/traefik/acme.json:/acme.json
    container_name: traefik

 networks:
@@ -62,13 +68,13 @@ networks:
    external: true
 ```

-As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container.
-Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Traefik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down).
+As you can see, we're mounting the `traefik.toml` file as well as the (empty) `acme.json` file in the container.  
+Also, we're mounting the `/var/run/docker.sock` Docker socket in the container as well, so Træfik can listen to Docker events and reconfigure it's own internal configuration when containers are created (or shut down).  
 Also, we're making sure the container is automatically restarted by the Docker engine in case of problems (or: if the server is rebooted).
-We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on.
+We're publishing the default HTTP ports `80` and `443` on the host, and making sure the container is placed within the `web` network we've created earlier on.  
 Finally, we're giving this container a static name called `traefik`.

-Let's take a look at a simply `traefik.toml` configuration as well before we'll create the Traefik container:
+Let's take a look at a simple `traefik.toml` configuration as well before we'll create the Træfik container:

 ```toml
 debug = false
@@ -103,18 +109,21 @@ OnHostRule = true
 This is the minimum configuration required to do the following:

 - Log `ERROR`-level messages (or more severe) to the console, but silence `DEBUG`-level messagse
- Check for new versions of Traefik periodically
+- Check for new versions of Træfik periodically
 - Create two entry points, namely an `HTTP` endpoint on port `80`, and an `HTTPS` endpoint on port `443` where all incoming traffic on port `80` will immediately get redirected to `HTTPS`.
- Enable the Docker configuration backend and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Traefik by default, we'll get into this in a bit!**
- Enable automatic request and configuration of SSL certificates using Let's Encrypt. These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises.
+- Enable the Docker configuration backend and listen for container events on the Docker unix socket we've mounted earlier. However, **new containers will not be exposed by Træfik by default, we'll get into this in a bit!**
+- Enable automatic request and configuration of SSL certificates using Let's Encrypt.
+    These certificates will be stored in the `acme.json` file, which you can back-up yourself and store off-premises.

-Alright, let's boot the container. From the `/opt/traefik` directory, run `docker-compose up -d` which will create and start the Traefik container.
+Alright, let's boot the container. From the `/opt/traefik` directory, run `docker-compose up -d` which will create and start the Træfik container.

 ## Exposing Web Services to the Outside World

-Now that we've fully configured and started Traefik, it's time to get our applications running!
+Now that we've fully configured and started Træfik, it's time to get our applications running!

-Let's take a simple example of a micro-service project consisting of various services, where some will be exposed to the outside world and some will not. The `docker-compose.yml` of our project looks like this:
+Let's take a simple example of a micro-service project consisting of various services, where some will be exposed to the outside world and some will not. 
+
+The `docker-compose.yml` of our project looks like this:

 ```yaml
 version: "2.1"
@@ -139,6 +148,10 @@ services:
      - "traefik.frontend.rule=Host:app.my-awesome-app.org"
      - "traefik.enable=true"
      - "traefik.port=9000"
+      - "traefik.default.protocol=http"
+      - "traefik.admin.frontend.rule=Host:admin-app.my-awesome-app.org"
+      - "traefik.admin.protocol=https"
+      - "traefik.admin.port=9443"

  db:
    image: my-docker-registry.com/back-end/5.7
@@ -173,16 +186,19 @@ networks:
    external: true
 ```

-Here, we can see a set of services with two applications that we're actually exposing to the outside world.
-Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks.
+Here, we can see a set of services with two applications that we're actually exposing to the outside world.  
+Notice how there isn't a single container that has any published ports to the host -- everything is routed through Docker networks.  
 Also, only the containers that we want traffic to get routed to are attached to the `web` network we created at the start of this document.
+
 Since the `traefik` container we've created and started earlier is also attached to this network, HTTP requests can now get routed to these containers.

 ### Labels

-As mentioned earlier, we don't want containers exposed automatically by Traefik.
+As mentioned earlier, we don't want containers exposed automatically by Træfik.
+
 The reason behind this is simple: we want to have control over this process ourselves.
-Thanks to Docker labels, we can tell Traefik how to create it's internal routing configuration.
+Thanks to Docker labels, we can tell Træfik how to create it's internal routing configuration.
+
 Let's take a look at the labels themselves for the `app` service, which is a HTTP webservice listing on port 9000:

 ```yaml
@@ -191,27 +207,56 @@ Let's take a look at the labels themselves for the `app` service, which is a HTT
 - "traefik.frontend.rule=Host:app.my-awesome-app.org"
 - "traefik.enable=true"
 - "traefik.port=9000"
+- "traefik.default.protocol=http"
+- "traefik.admin.frontend.rule=Host:admin-app.my-awesome-app.org"
+- "traefik.admin.protocol=https"
+- "traefik.admin.port=9443"
 ```

+We use both `container labels` and `service labels`.
+
+#### Container labels
+
 First, we specify the `backend` name which corresponds to the actual service we're routing **to**.
-We also tell Traefik to use the `web` network to route HTTP traffic to this container. With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`.
-Essentially, this is the actual rule used for Layer-7 load balancing.
-With the `traefik.enable` label, we tell Traefik to include this container in it's internal configuration.
-Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on.
+
+We also tell Træfik to use the `web` network to route HTTP traffic to this container. 
+With the `traefik.enable` label, we tell Træfik to include this container in it's internal configuration.
+
+With the `frontend.rule` label, we tell Træfik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`.
+Essentially, this is the actual rule used for Layer-7 load balancing. 
+
+Finally but not unimportantly, we tell Træfik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on.
+
+### Service labels
+
+`Service labels` allow managing many routes for the same container.
+
+When both `container labels` and `service labels` are defined, `container labels` are just used as default values for missing `service labels` but no frontend/backend are going to be defined only with these labels.
+Obviously, labels `traefik.frontend.rule` and `traefik.port` described above, will only be used to complete information set in `service labels` during the container frontends/bakends creation.
+
+In the example, two service names are defined : `default` and `admin`.
+They allow creating two frontends and two backends.
+
+- `default` has only one `service label` : `traefik.default.protocol`.
+Træfik will use values set in `traefik.frontend.rule` and `traefik.port` to create the `default` frontend and backend.
+The frontend listens to incoming HTTP requests which contain the `Host` `app.my-awesome-app.org` and redirect them in `HTTP` to the port `9000` of the backend.
+- `admin` has all the `services labels` needed to create the `admin` frontend and backend (`traefik.admin.frontend.rule`, `traefik.admin.protocol`, `traefik.admin.port`).
+Træfik will create a frontend to listen to incoming HTTP requests which contain the `Host` `admin-app.my-awesome-app.org` and redirect them in `HTTPS` to the port `9443` of the backend.

 #### Gotchas and tips

- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label.
-    If a container exposes multiple ports, Traefik may forward traffic to the wrong port.
+- Always specify the correct port where the container expects HTTP traffic using `traefik.port` label.  
+    If a container exposes multiple ports, Træfik may forward traffic to the wrong port.
    Even if a container only exposes one port, you should always write configuration defensively and explicitly.
- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Traefik will automatically be reachable from the outside world, for everyone and everyone to see.
+- Should you choose to enable the `exposedbydefault` flag in the `traefik.toml` configuration, be aware that all containers that are placed in the same network as Træfik will automatically be reachable from the outside world, for everyone and everyone to see.
    Usually, this is a bad idea.
- With the `traefik.frontend.auth.basic` label, it's possible for Traefik to provide a HTTP basic-auth challenge for the endpoints you provide the label for.
- Traefik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics
- Traefik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol.
+- With the `traefik.frontend.auth.basic` label, it's possible for Træfik to provide a HTTP basic-auth challenge for the endpoints you provide the label for.
+- Træfik has built-in support to automatically export [Prometheus](https://prometheus.io) metrics
+- Træfik supports websockets out of the box. In the example above, the `events`-service could be a NodeJS-based application which allows clients to connect using websocket protocol.
    Thanks to the fact that HTTPS in our example is enforced, these websockets are automatically secure as well (WSS)

 ### Final thoughts

-Using Traefik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, performant and self-configuring solution for your projects.
+Using Træfik as a Layer-7 load balancer in combination with both Docker and Let's Encrypt provides you with an extremely flexible, powerful and self-configuring solution for your projects.
+
 With Let's Encrypt, your endpoints are automatically secured with production-ready SSL certificates that are renewed automatically as well.
--- a/docs/user-guide/examples.md
+++ b/docs/user-guide/examples.md
@@ -22,11 +22,11 @@ defaultEntryPoints = ["http", "https"]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
-      CertFile = "integration/fixtures/https/snitest.com.cert"
-      KeyFile = "integration/fixtures/https/snitest.com.key"
+      certFile = "integration/fixtures/https/snitest.com.cert"
+      keyFile = "integration/fixtures/https/snitest.com.key"
      [[entryPoints.https.tls.certificates]]
-      CertFile = "integration/fixtures/https/snitest.org.cert"
-      KeyFile = "integration/fixtures/https/snitest.org.key"
+      certFile = "integration/fixtures/https/snitest.org.cert"
+      keyFile = "integration/fixtures/https/snitest.org.key"
 ```
 Note that we can either give path to certificate file or directly the file content itself ([like in this TOML example](/user-guide/kv-config/#upload-the-configuration-in-the-key-value-store)).

@@ -43,8 +43,8 @@ defaultEntryPoints = ["http", "https"]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
-      CertFile = "examples/traefik.crt"
-      KeyFile = "examples/traefik.key"
+      certFile = "examples/traefik.crt"
+      keyFile = "examples/traefik.key"
 ```

 ## Let's Encrypt support
@@ -76,6 +76,7 @@ entryPoint = "https"
 ```

 This configuration allows generating Let's Encrypt certificates for the four domains `local[1-4].com` with described SANs.
+
 Traefik generates these certificates when it starts and it needs to be restart if new domains are added.

 ### OnHostRule option
@@ -106,6 +107,7 @@ entryPoint = "https"
 ```

 This configuration allows generating Let's Encrypt certificates for the four domains `local[1-4].com`.
+
 Traefik generates these certificates when it starts.

 If a backend is added with a `onHost` rule, Traefik will automatically generate the Let's Encrypt certificate for the new domain.
@@ -121,10 +123,9 @@ If a backend is added with a `onHost` rule, Traefik will automatically generate
 [acme]
 email = "test@traefik.io"
 storage = "acme.json"
-OnDemand = true
+onDemand = true
 caServer = "http://172.18.0.1:4000/directory"
 entryPoint = "https"
-
 ```

 This configuration allows generating a Let's Encrypt certificate during the first HTTPS request on a new domain.
@@ -136,7 +137,7 @@ This configuration allows generating a Let's Encrypt certificate during the firs
    * TLS handshakes will be slow when requesting a hostname certificate for the first time, this can leads to DDoS attacks.
    * Let's Encrypt have rate limiting: https://letsencrypt.org/docs/rate-limits

-    That's why, it's better to use the `onHostRule` optin if possible.
+    That's why, it's better to use the `onHostRule` option if possible.

 ### DNS challenge

@@ -166,8 +167,10 @@ entryPoint = "https"
  main = "local4.com"
 ```

-DNS challenge needs environment variables to be executed. This variables have to be set on the machine/container which host Traefik.
-These variables has described [in this section](toml/#acme-lets-encrypt-configuration).
+DNS challenge needs environment variables to be executed.
+This variables have to be set on the machine/container which host Traefik.
+
+These variables are described [in this section](/configuration/acme/#dnsprovider).

 ### OnHostRule option and provided certificates

@@ -177,8 +180,8 @@ These variables has described [in this section](toml/#acme-lets-encrypt-configur
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
-      CertFile = "examples/traefik.crt"
-      KeyFile = "examples/traefik.key"
+      certFile = "examples/traefik.crt"
+      keyFile = "examples/traefik.key"

 [acme]
 email = "test@traefik.io"
@@ -195,7 +198,7 @@ Traefik will only try to generate a Let's encrypt certificate if the domain cann

 #### Prerequisites

-Before to use Let's Encrypt in a Traefik cluster, take a look to [the key-value store explanations](/user-guide/kv-config) and more precisely to [this section](/user-guide/kv-config/#store-configuration-in-key-value-store) in the way to know how to migrate from a acme local storage *(acme.json file)* to a key-value store configuration.
+Before you use Let's Encrypt in a Traefik cluster, take a look to [the key-value store explanations](/user-guide/kv-config) and more precisely at [this section](/user-guide/kv-config/#store-configuration-in-key-value-store), which will describe how to migrate from a acme local storage *(acme.json file)* to a key-value store configuration.

 #### Configuration

@@ -226,7 +229,6 @@ entryPoint = "https"
  endpoint = "127.0.0.1:8500"
  watch = true
  prefix = "traefik"
-
 ```

 This configuration allows to use the key `traefik/acme/account` to get/set Let's Encrypt certificates content.
@@ -277,7 +279,7 @@ defaultEntryPoints = ["http"]
 ## Pass Authenticated user to application via headers

 Providing an authentication method as described above, it is possible to pass the user to the application
-via a configurable header value
+via a configurable header value.

 ```toml
 defaultEntryPoints = ["http"]
@@ -293,6 +295,91 @@ defaultEntryPoints = ["http"]
 ## Override the Traefik HTTP server IdleTimeout and/or throttle configurations from re-loading too quickly

 ```toml
-IdleTimeout = "360s"
-ProvidersThrottleDuration = "5s"
+providersThrottleDuration = "5s"
+
+[respondingTimeouts]
+idleTimeout = "360s"
 ```
+
+## Securing Ping Health Check
+
+The `/ping` health-check URL is enabled together with the web admin panel, enabled with the command-line `--web` or config file option `[web]`.
+Thus, if you have a regular path for `/foo` and an entrypoint on `:80`, you would access them as follows:
+
+* Regular path: `http://hostname:80/foo`
+* Admin panel: `http://hostname:8080/`
+* Ping URL: `http://hostname:8080/ping`
+
+However, for security reasons, you may want to be able to expose the `/ping` health-check URL to outside health-checkers, e.g. an Internet service or cloud load-balancer, _without_ exposing your admin panel's port.
+In many environments, the security staff may not _allow_ you to expose it.
+
+You have two options:
+
+* Enable `/ping` on a regular entrypoint
+* Enable `/ping` on a dedicated port
+
+### Enable ping health check on a regular entrypoint
+
+To proxy `/ping` from a regular entrypoint to the admin one without exposing the panel, do the following:
+
+```toml
+[backends]
+  [backends.traefik]
+    [backends.traefik.servers.server1]
+    url = "http://localhost:8080"
+    weight = 10
+
+[frontends]
+  [frontends.traefikadmin]
+  backend = "traefik"
+    [frontends.traefikadmin.routes.ping]
+    rule = "Path:/ping"
+```
+
+The above creates a new backend called `traefik`, listening on `http://localhost:8080`, i.e. the local admin port.
+We only expose the admin panel via the `frontend` named `traefikadmin`, and only expose the `/ping` Path.
+Be careful with the `traefikadmin` frontend. If you do _not_ specify a `Path:` rule, you would expose the entire dashboard.
+
+### Enable ping health check on dedicated port
+
+If you do not want to or cannot expose the health-check on a regular entrypoint - e.g. your security rules do not allow it, or you have a conflicting path - then you can enable health-check on its own entrypoint.
+Use the following config:
+
+```toml
+defaultEntryPoints = ["http"]
+
+[entryPoints]
+  [entryPoints.http]
+  address = ":80"
+  [entryPoints.ping]
+  address = ":8082"
+
+[backends]
+  [backends.traefik]
+    [backends.traefik.servers.server1]
+    url = "http://localhost:8080"
+    weight = 10
+
+[frontends]
+  [frontends.traefikadmin]
+  backend = "traefik"
+  entrypoints = ["ping"]
+    [frontends.traefikadmin.routes.ping]
+    rule = "Path:/ping"
+```
+
+The above is similar to the previous example, but instead of enabling `/ping` on the _default_ entrypoint, we enable it on a _dedicated_ entrypoint.
+
+In the above example, you would access a regular path, admin panel and health-check as follows:
+
+* Regular path: `http://hostname:80/foo`
+* Admin panel: `http://hostname:8080/`
+* Ping URL: `http://hostname:8082/ping`
+
+Note the dedicated port `:8082` for `/ping`.
+
+In the above example, it is _very_ important to create a named dedicated entrypoint, and do **not** include it in `defaultEntryPoints`.
+Otherwise, you are likely to expose _all_ services via that entrypoint.
+
+In the above example, we have two entrypoints, `http` and `ping`, but we only included `http` in `defaultEntryPoints`, while explicitly tying `frontend.traefikadmin` to the `ping` entrypoint.
+This ensures that all the "normal" frontends will be exposed via entrypoint `http` and _not_ via entrypoint `ping`.
--- a/docs/user-guide/grpc.md
+++ b/docs/user-guide/grpc.md
@@ -0,0 +1,151 @@
+# gRPC example
+
+This section explains how to use Traefik as reverse proxy for gRPC application with self-signed certificates.
+
+!!! warning
+    As gRPC needs HTTP2, we need HTTPS certificates on both gRPC Server and Træfik.
+
+<p align="center">
+<img src="/img/grpc.svg" alt="gRPC architecture" title="gRPC architecture" />
+</p>
+
+## gRPC Server certificate
+
+In order to secure the gRPC server, we generate a self-signed certificate for backend url:
+
+```bash
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./backend.key -out ./backend.cert
+```
+
+That will prompt for information, the important answer is:
+
+```
+Common Name (e.g. server FQDN or YOUR name) []: backend.local
+```
+
+## gRPC Client certificate
+
+Generate your self-signed certificate for frontend url:
+
+```bash
+openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ./frontend.key -out ./frontend.cert
+```
+
+with
+
+```
+Common Name (e.g. server FQDN or YOUR name) []: frontend.local
+```
+
+## Træfik configuration
+
+At last, we configure our Træfik instance to use both self-signed certificates.
+
+```toml
+defaultEntryPoints = ["https"]
+
+# For secure connection on backend.local
+RootCAs = [ "./backend.cert" ]
+
+[entryPoints]
+  [entryPoints.https]
+  address = ":4443"
+    [entryPoints.https.tls]
+     # For secure connection on frontend.local
+     [[entryPoints.https.tls.certificates]]
+     certFile = "./frontend.cert"
+     keyFile  = "./frontend.key"
+
+
+[web]
+  address = ":8080"
+
+[file]
+
+[backends]
+  [backends.backend1]
+    [backends.backend1.servers.server1]
+    # Access on backend with HTTPS
+    url = "https://backend.local:8080"
+
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "Host:frontend.local"
+```
+
+!!! warning
+    With some backends, the server URLs use the IP, so you may need to configure `InsecureSkipVerify` instead of the `RootCAS` to activate HTTPS without hostname verification.
+
+## Conclusion
+
+We don't need specific configuration to use gRPC in Træfik, we just need to be careful that all the exchanges (between client and Træfik, and between Træfik and backend) are HTTPS communications because gRPC uses HTTP2.
+
+## A gRPC example in go
+
+We will use the gRPC greeter example in [grpc-go](https://github.com/grpc/grpc-go/tree/master/examples/helloworld)
+
+!!! warning
+    In order to use this gRPC example, we need to modify it to use HTTPS
+
+So we modify the "gRPC server example" to use our own self-signed certificate:
+
+```go
+// ...
+
+// Read cert and key file
+BackendCert, _ := ioutil.ReadFile("./backend.cert")
+BackendKey, _ := ioutil.ReadFile("./backend.key")
+
+// Generate Certificate struct
+cert, err := tls.X509KeyPair(BackendCert, BackendKey)
+if err != nil {
+  log.Fatalf("failed to parse certificate: %v", err)
+}
+
+// Create credentials
+creds := credentials.NewServerTLSFromCert(&cert)
+
+// Use Credentials in gRPC server options
+serverOption := grpc.Creds(creds)
+var s *grpc.Server = grpc.NewServer(serverOption)
+defer s.Stop()
+
+pb.RegisterGreeterServer(s, &server{})
+err := s.Serve(lis)
+
+// ...
+```
+
+Next we will modify gRPC Client to use our Træfik self-signed certificate:
+
+```go
+// ...
+
+// Read cert file
+FrontendCert, _ := ioutil.ReadFile("./frontend.cert")
+
+// Create CertPool
+roots := x509.NewCertPool()
+roots.AppendCertsFromPEM(FrontendCert)
+
+// Create credentials
+credsClient := credentials.NewClientTLSFromCert(roots, "")
+
+// Dial with specific Transport (with credentials)
+conn, err := grpc.Dial("frontend.local:4443", grpc.WithTransportCredentials(credsClient))
+if err != nil {
+    log.Fatalf("did not connect: %v", err)
+}
+
+defer conn.Close()
+client := pb.NewGreeterClient(conn)
+
+name := "World"
+r, err := client.SayHello(context.Background(), &pb.HelloRequest{Name: name})
+
+// ...
+```
+
--- a/docs/user-guide/kubernetes.md
+++ b/docs/user-guide/kubernetes.md
@@ -1,6 +1,7 @@
 # Kubernetes Ingress Controller

 This guide explains how to use Træfik as an Ingress controller in a Kubernetes cluster.
+
 If you are not familiar with Ingresses in Kubernetes you might want to read the [Kubernetes user guide](https://kubernetes.io/docs/concepts/services-networking/ingress/)

 The config files used in this guide can be found in the [examples directory](https://github.com/containous/traefik/tree/master/examples/k8s)
@@ -31,7 +32,6 @@ rules:
  - apiGroups:
      - ""
    resources:
-      - pods
      - services
      - endpoints
      - secrets
@@ -72,13 +72,14 @@ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/exa

 It is possible to use Træfik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object,
 whereas both options have their own pros and cons:
- The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DeaemonSet.
-It is possible to exclusively run a Service on a dedicated set of machines using taints and tolerations with a DaemonSet.
-On the other hand the DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with a Deployment.
+ 
+- The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DeaemonSet.  
+- It is possible to exclusively run a Service on a dedicated set of machines using taints and tolerations with a DaemonSet.  
+- On the other hand the DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with a Deployment.

 The Deployment objects looks like this:

-```yml
+```yaml
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -117,6 +118,7 @@ kind: Service
 apiVersion: v1
 metadata:
  name: traefik-ingress-service
+  namespace: kube-system
 spec:
  selector:
    k8s-app: traefik-ingress-lb
@@ -131,7 +133,8 @@ spec:
 ```
 [examples/k8s/traefik-deployment.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/traefik-deployment.yaml)

-> The Service will expose two NodePorts which allow access to the ingress and the web interface.
+!!! note
+    The Service will expose two NodePorts which allow access to the ingress and the web interface.

 The DaemonSet objects looks not much different:

@@ -180,6 +183,7 @@ kind: Service
 apiVersion: v1
 metadata:
  name: traefik-ingress-service
+  namespace: kube-system
 spec:
  selector:
    k8s-app: traefik-ingress-lb
@@ -198,20 +202,20 @@ spec:
 To deploy Træfik to your cluster start by submitting one of the YAML files to the cluster with `kubectl`:

 ```shell
-$ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-deployment.yaml
+kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-deployment.yaml
 ```

 ```shell
-$ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml
+kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/traefik-ds.yaml
 ```

-There are some significant differences between using Deployments and DaemonSets.
-The Deployment has easier up and down scaling possibilities. It can implement full pod lifecycle and supports rolling updates from Kubernetes 1.2.
-At least one Pod is needed to run the Deployment.
-The DaemonSet automatically scales to all nodes that meets a specific selector and guarantees to fill nodes one at a time.
-Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well.
-
+There are some significant differences between using Deployments and DaemonSets:

+- The Deployment has easier up and down scaling possibilities.
+    It can implement full pod lifecycle and supports rolling updates from Kubernetes 1.2.
+    At least one Pod is needed to run the Deployment.
+- The DaemonSet automatically scales to all nodes that meets a specific selector and guarantees to fill nodes one at a time.
+    Rolling updates are fully supported from Kubernetes 1.7 for DaemonSets as well.

 ### Check the Pods

@@ -220,8 +224,10 @@ Now lets check if our command was successful.
 Start by listing the pods in the `kube-system` namespace:

 ```shell
-$ kubectl --namespace=kube-system get pods
+kubectl --namespace=kube-system get pods
+```

+```
 NAME                                         READY     STATUS    RESTARTS   AGE
 kube-addon-manager-minikubevm                1/1       Running   0          4h
 kubernetes-dashboard-s8krj                   1/1       Running   0          4h
@@ -231,14 +237,17 @@ traefik-ingress-controller-678226159-eqseo   1/1       Running   0          7m
 You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched a Pod, and it is now running.
 _It might take a few moments for kubernetes to pull the Træfik image and start the container._

-> You could also check the deployment with the Kubernetes dashboard, run
-> `minikube dashboard` to open it in your browser, then choose the `kube-system`
-> namespace from the menu at the top right of the screen.
+!!! note
+    You could also check the deployment with the Kubernetes dashboard, run
+    `minikube dashboard` to open it in your browser, then choose the `kube-system`
+    namespace from the menu at the top right of the screen.

 You should now be able to access Træfik on port 80 of your Minikube instance when using the DaemonSet:

 ```sh
 curl $(minikube ip)
+```
+```
 404 page not found
 ```

@@ -246,20 +255,24 @@ If you decided to use the deployment, then you need to target the correct NodePo

 ```sh
 curl $(minikube ip):<NODEPORT>
+```
+```
 404 page not found
 ```

-> We expect to see a 404 response here as we haven't yet given Træfik any configuration.
+!!! note
+    We expect to see a 404 response here as we haven't yet given Træfik any configuration.

 ## Deploy Træfik using Helm Chart

 Instead of installing Træfik via an own object, you can also use the Træfik Helm chart.
+
 This allows more complex configuration via Kubernetes [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configmap/) and enabled TLS certificates.

 Install Træfik chart by:

 ```shell
-$ helm install stable/traefik
+helm install stable/traefik
 ```

 For more information, check out [the doc](https://github.com/kubernetes/charts/tree/master/stable/traefik).
@@ -305,9 +318,8 @@ kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/exa

 Now lets setup an entry in our /etc/hosts file to route `traefik-ui.minikube` to our cluster.

-> In production you would want to set up real dns entries.
-
-> You can get the ip address of your minikube instance by running `minikube ip`
+In production you would want to set up real dns entries.  
+You can get the ip address of your minikube instance by running `minikube ip`

 ```shell
 echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts
@@ -315,6 +327,72 @@ echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts

 We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) in the browser and view the Træfik Web UI.

+## Basic Authentication
+
+It's possible to add additional authentication annotations in the Ingress rule.
+The source of the authentication is a secret that contains usernames and passwords inside the key auth.
+To read about basic auth limitations see the [Kubernetes Ingress](/configuration/backends/kubernetes) configuration page.
+
+#### Creating the Secret
+
+A. Use `htpasswd` to create a file containing the username and the base64-encoded password:
+
+```shell
+htpasswd -c ./auth myusername
+```
+
+You will be prompted for a password which you will have to enter twice.
+`htpasswd` will create a file with the following:
+
+```shell
+cat auth
+```
+```
+myusername:$apr1$78Jyn/1K$ERHKVRPPlzAX8eBtLuvRZ0
+```
+
+B. Now use `kubectl` to create a secret in the monitoring namespace using the file created by `htpasswd`.
+
+```shell
+kubectl create secret generic mysecret --from-file auth --namespace=monitoring
+```
+
+!!! note
+    Secret must be in same namespace as the ingress rule.
+
+C. Create the ingress using the following annotations to specify basic auth and that the username and password is stored in `mysecret`.
+
+- `ingress.kubernetes.io/auth-type: "basic"`
+- `ingress.kubernetes.io/auth-secret: "mysecret"`
+
+Following is a full ingress example based on Prometheus:
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+ name: prometheus-dashboard
+ namespace: monitoring
+ annotations:
+   kubernetes.io/ingress.class: traefik
+   ingress.kubernetes.io/auth-type: "basic"
+   ingress.kubernetes.io/auth-secret: "mysecret"
+spec:
+ rules:
+ - host: dashboard.prometheus.example.com
+   http:
+     paths:
+     - backend:
+         serviceName: prometheus
+         servicePort: 9090
+```
+
+You can apply the example ingress as following:
+
+```shell
+kubectl create -f prometheus-ingress.yaml -n monitoring
+```
+
 ## Name based routing

 In this example we are going to setup websites for 3 of the United Kingdoms best loved cheeses, Cheddar, Stilton and Wensleydale.
@@ -346,13 +424,6 @@ spec:
      containers:
      - name: cheese
        image: errm/cheese:stilton
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-          limits:
-            cpu: 100m
-            memory: 50Mi
        ports:
        - containerPort: 80
 ---
@@ -379,13 +450,6 @@ spec:
      containers:
      - name: cheese
        image: errm/cheese:cheddar
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-          limits:
-            cpu: 100m
-            memory: 50Mi
        ports:
        - containerPort: 80
 ---
@@ -412,13 +476,6 @@ spec:
      containers:
      - name: cheese
        image: errm/cheese:wensleydale
-        resources:
-          requests:
-            cpu: 100m
-            memory: 50Mi
-          limits:
-            cpu: 100m
-            memory: 50Mi
        ports:
        - containerPort: 80
 ```
@@ -474,8 +531,8 @@ spec:
    task: wensleydale
 ```

-> Notice that we also set a [circuit breaker expression](https://docs.traefik.io/basics/#backends) for one of the backends
-> by setting the `traefik.backend.circuitbreaker` annotation on the service.
+!!! note
+    We also set a [circuit breaker expression](/basics/#backends) for one of the backends by setting the `traefik.backend.circuitbreaker` annotation on the service.


 [examples/k8s/cheese-services.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-services.yaml)
@@ -519,13 +576,15 @@ spec:
 ```
 [examples/k8s/cheese-ingress.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-ingress.yaml)

-> Notice that we list each hostname, and add a backend service.
+!!! note
+    we list each hostname, and add a backend service.

 ```shell
 kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml
 ```

-Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host. Along with a backend listing for each service with a Server set up for each pod.
+Now visit the [Træfik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host.
+Along with a backend listing for each service with a Server set up for each pod.

 If you edit your `/etc/hosts` again you should be able to access the cheese websites in your browser.

@@ -543,7 +602,6 @@ Now lets suppose that our fictional client has decided that while they are super

 No problem, we say, why don't we reconfigure the sites to host all 3 under one domain.

-
 ```yaml
 apiVersion: extensions/v1beta1
 kind: Ingress
@@ -572,9 +630,8 @@ spec:
 ```
 [examples/k8s/cheeses-ingress.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheeses-ingress.yaml)

-> Notice that we are configuring Træfik to strip the prefix from the url path
-> with the `traefik.frontend.rule.type` annotation so that we can use
-> the containers from the previous example without modification.
+!!! note
+    we are configuring Træfik to strip the prefix from the url path with the `traefik.frontend.rule.type` annotation so that we can use the containers from the previous example without modification.

 ```shell
 kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheeses-ingress.yaml
@@ -601,7 +658,7 @@ kind: Ingress
 metadata:
  name: wildcard-cheeses
  annotations:
-    traefik.frontend.priority: 1
+    traefik.frontend.priority: "1"
 spec:
  rules:
  - host: *.minikube
@@ -616,7 +673,7 @@ kind: Ingress
 metadata:
  name: specific-cheeses
  annotations:
-    traefik.frontend.priority: 2
+    traefik.frontend.priority: "2"
 spec:
  rules:
  - host: specific.minikube
@@ -628,22 +685,25 @@ spec:
          servicePort: http
 ```

+Note that priority values must be quoted to avoid them being interpreted as numbers (which are illegal for annotations).

 ## Forwarding to ExternalNames

 When specifying an [ExternalName](https://kubernetes.io/docs/concepts/services-networking/service/#services-without-selectors),
-Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443.
+Træfik will forward requests to the given host accordingly and use HTTPS when the Service port matches 443.  
 This still requires setting up a proper port mapping on the Service from the Ingress port to the (external) Service port.

 ## Disable passing the Host header

 By default Træfik will pass the incoming Host header on to the upstream resource.
+
 There are times however where you may not want this to be the case.
 For example if your service is of the ExternalName type.

 ### Disable entirely

 Add the following to your toml config:
+
 ```toml
 disablePassHostHeaders = true
 ```
@@ -653,6 +713,7 @@ disablePassHostHeaders = true
 To disable passing the Host header per ingress resource set the `traefik.frontend.passHostHeader` annotation on your ingress to `false`.

 Here is an example ingress definition:
+
 ```yaml
 apiVersion: extensions/v1beta1
 kind: Ingress
@@ -673,6 +734,7 @@ spec:
 ```

 And an example service definition:
+
 ```yaml
 apiVersion: v1
 kind: Service
@@ -693,11 +755,33 @@ If you were to visit `example.com/static` the request would then be passed onto
    So you could set `disablePassHostHeaders` to `true` in your toml file and then enable passing
    the host header per ingress if you wanted.

-## Excluding an ingress from Træfik
+## Partitioning the Ingress object space

-You can control which ingress Træfik cares about by using the `kubernetes.io/ingress.class` annotation.
-By default if the annotation is not set at all Træfik will include the ingress.
-If the annotation is set to anything other than traefik or a blank string Træfik will ignore it.
+By default, Træfik processes every Ingress objects it observes. At times, however, it may be desirable to ignore certain objects. The following sub-sections describe common use cases and how they can be handled with Træfik.

+### Between Træfik and other Ingress controller implementations

-![](https://i.giphy.com/ujUdrdpX7Ok5W.gif)
+Sometimes Træfik runs along other Ingress controller implementations. One such example is when both Træfik and a cloud provider Ingress controller are active.
+
+The `kubernetes.io/ingress.class` annotation can be attached to any Ingress object in order to control whether Træfik should handle it.
+
+If the annotation is missing, contains an empty value, or the value `traefik`, then the Træfik controller will take responsibility and process the associated Ingress object. If the annotation contains any other value (usually the name of a different Ingress controller), Træfik will ignore the object.
+
+### Between multiple Træfik Deployments
+
+Sometimes multiple Træfik Deployments are supposed to run concurrently. For instance, it is conceivable to have one Deployment deal with internal and another one with external traffic.
+
+For such cases, it is advisable to classify Ingress objects through a label and configure the `labelSelector` option per each Træfik Deployment accordingly. To stick with the internal/external example above, all Ingress objects meant for internal traffic could receive a `traffic-type: internal` label while objects designated for external traffic receive a `traffic-type: external` label. The label selectors on the Træfik Deployments would then be `traffic-type=internal` and `traffic-type=external`, respectively.
+
+## Production advice
+
+### Resource limitations
+
+The examples shown deliberately do not specify any [resource limitations](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/) as there is no one size fits all.
+
+In a production environment, however, it is important to set proper bounds, especially with regards to CPU:
+
+- too strict and Traefik will be throttled while serving requests (as Kubernetes imposes hard quotas)
+- too loose and Traefik may waste resources not available for other containers
+
+When in doubt, you should measure your resource needs, and adjust requests and limits accordingly.
--- a/docs/user-guide/kv-config.md
+++ b/docs/user-guide/kv-config.md
@@ -14,13 +14,16 @@ Træfik supports several Key-value stores:
 ## Static configuration in Key-value store

 We will see the steps to set it up with an easy example.
-Note that we could do the same with any other Key-value Store.

-## docker-compose file for Consul
+!!! note
+    We could do the same with any other Key-value Store.

-The Træfik global configuration will be getted from a [Consul](https://consul.io) store.
+### docker-compose file for Consul
+
+The Træfik global configuration will be retrieved from a [Consul](https://consul.io) store.

 First we have to launch Consul in a container.
+
 The [docker-compose file](https://docs.docker.com/compose/compose-file/) allows us to launch Consul and four instances of the trivial app [emilevauge/whoamI](https://github.com/emilevauge/whoamI) :

 ```yaml
@@ -51,12 +54,12 @@ whoami4:
  image: emilevauge/whoami
 ```

-## Upload the configuration in the Key-value store
+### Upload the configuration in the Key-value store

-We should now fill the store with the Træfik global configuration, as we do with a [TOML file configuration](/toml).
+We should now fill the store with the Træfik global configuration, as we do with a [TOML file configuration](/toml).  
 To do that, we can send the Key-value pairs via [curl commands](https://www.consul.io/intro/getting-started/kv.html) or via the [Web UI](https://www.consul.io/intro/getting-started/ui.html).

-Fortunately, Træfik allows automation of this process using the `storeconfig` subcommand.
+Fortunately, Træfik allows automation of this process using the `storeconfig` subcommand.  
 Please refer to the [store Træfik configuration](/user-guide/kv-config/#store-configuration-in-key-value-store) section to get documentation on it.

 Here is the toml configuration we would like to store in the Key-value Store  :
@@ -83,7 +86,6 @@ defaultEntryPoints = ["http", "https"]
                      <key file content>
                      -----END CERTIFICATE-----"""

-
 [consul]
  endpoint = "127.0.0.1:8500"
  watch = true
@@ -118,9 +120,10 @@ In case you are setting key values manually:

 Note that we can either give path to certificate file or directly the file content itself.

-## Launch Træfik
+### Launch Træfik

 We will now launch Træfik in a container.
+
 We use CLI flags to setup the connection between Træfik and Consul.
 All the rest of the global configuration is stored in Consul.

@@ -138,21 +141,54 @@ traefik:
 !!! warning
    Be careful to give the correct IP address and port in the flag `--consul.endpoint`.

-## Consul ACL Token support
+### Consul ACL Token support

-To specify a Consul ACL token for Traefik, we have to set a System Environment variable named `CONSUL_HTTP_TOKEN` prior to starting traefik. This variable must be initialized with the ACL token value.
+To specify a Consul ACL token for Traefik, we have to set a System Environment variable named `CONSUL_HTTP_TOKEN` prior to starting Traefik.
+This variable must be initialized with the ACL token value.

 If Traefik is launched into a Docker container, the variable `CONSUL_HTTP_TOKEN` can be initialized with the `-e` Docker option : `-e "CONSUL_HTTP_TOKEN=[consul-acl-token-value]"`

-## TLS support
+If a Consul ACL is used to restrict Træfik read/write access, one of the following configurations is needed.
+
+- HCL format :
+
+```
+    key "traefik" {
+        policy = "write"
+    },
+    
+    session "" {
+        policy = "write"
+    }
+```
+
+- JSON format :
+
+```json
+{
+    "key": {
+        "traefik": {
+          "policy": "write"
+        }
+    },
+    "session": {
+        "": {
+        "policy": "write"
+        }
+    }
+}
+```
+
+### TLS support

 To connect to a Consul endpoint using SSL, simply specify `https://` in the `consul.endpoint` property

 - `--consul.endpoint=https://[consul-host]:[consul-ssl-port]`

-## TLS support with client certificates
+### TLS support with client certificates

 So far, only [Consul](https://consul.io) and [etcd](https://coreos.com/etcd/) support TLS connections with client certificates.
+
 To set it up, we should enable [consul security](https://www.consul.io/docs/internals/security.html) (or [etcd security](https://coreos.com/etcd/docs/latest/security.html)).

 Then, we have to provide CA, Cert and Key to Træfik using `consul` flags :
@@ -169,18 +205,20 @@ Or etcd flags :
 - `--etcd.tls.cert=path/to/the/file`
 - `--etcd.tls.key=path/to/the/file`

-Note that we can either give directly directly the file content itself (instead of the path to certificate) in a TOML file configuration.
+!! note
+    We can either give directly directly the file content itself (instead of the path to certificate) in a TOML file configuration.

 Remember the command `traefik --help` to display the updated list of flags.

-# Dynamic configuration in Key-value store
+## Dynamic configuration in Key-value store

 Following our example, we will provide backends/frontends rules to Træfik.

-Note that this section is independent of the way Træfik got its static configuration.
-It means that the static configuration can either come from the same Key-value store or from any other sources.
+!!! note
+    This section is independent of the way Træfik got its static configuration.
+    It means that the static configuration can either come from the same Key-value store or from any other sources.

-## Key-value storage structure
+### Key-value storage structure

 Here is the toml configuration we would like to store in the store :

@@ -272,14 +310,15 @@ And there, the same dynamic configuration in a KV Store (using `prefix = "traefi
 | `/traefik/frontends/frontend2/entrypoints`         | `http,https`       |
 | `/traefik/frontends/frontend2/routes/test_2/rule`  | `PathPrefix:/test` |

-## Atomic configuration changes
+### Atomic configuration changes

 Træfik can watch the backends/frontends configuration changes and generate its configuration automatically.

-Note that only backends/frontends rules are dynamic, the rest of the Træfik configuration stay static.
+!!! note
+    Only backends/frontends rules are dynamic, the rest of the Træfik configuration stay static.

-The [Etcd](https://github.com/coreos/etcd/issues/860) and [Consul](https://github.com/hashicorp/consul/issues/886) backends do not support updating multiple keys atomically.
-As a result, it may be possible for Træfik to read an intermediate configuration state despite judicious use of the `--providersThrottleDuration` flag.
+The [Etcd](https://github.com/coreos/etcd/issues/860) and [Consul](https://github.com/hashicorp/consul/issues/886) backends do not support updating multiple keys atomically.  
+As a result, it may be possible for Træfik to read an intermediate configuration state despite judicious use of the `--providersThrottleDuration` flag.  
 To solve this problem, Træfik supports a special key called `/traefik/alias`.
 If set, Træfik use the value as an alternative key prefix.

@@ -292,6 +331,7 @@ Given the key structure below, Træfik will use the `http://172.17.0.2:80` as it
 | `/traefik_configurations/1/backends/backend1/servers/server1/weight`    | `10`                        |

 When an atomic configuration change is required, you may write a new configuration at an alternative prefix.
+
 Here, although the `/traefik_configurations/2/...` keys have been set, the old configuration is still active because the `/traefik/alias` key still points to `/traefik_configurations/1`:

 | Key                                                                     | Value                       |
@@ -305,6 +345,7 @@ Here, although the `/traefik_configurations/2/...` keys have been set, the old c
 | `/traefik_configurations/2/backends/backend1/servers/server2/weight`    | `5`                        |

 Once the `/traefik/alias` key is updated, the new `/traefik_configurations/2` configuration becomes active atomically.
+
 Here, we have a 50% balance between the `http://172.17.0.3:80` and the `http://172.17.0.4:80` hosts while no traffic is sent to the `172.17.0.2:80` host:

 | Key                                                                     | Value                       |
@@ -317,22 +358,25 @@ Here, we have a 50% balance between the `http://172.17.0.3:80` and the `http://1
 | `/traefik_configurations/2/backends/backend1/servers/server2/url`       | `http://172.17.0.4:80`      |
 | `/traefik_configurations/2/backends/backend1/servers/server2/weight`    | `5`                        |

-Note that Træfik *will not watch for key changes in the `/traefik_configurations` prefix*. It will only watch for changes in the `/traefik/alias`.
-Further, if the `/traefik/alias` key is set, all other configuration with `/traefik/backends` or `/traefik/frontends` prefix are ignored.
+!!! note
+    Træfik *will not watch for key changes in the `/traefik_configurations` prefix*. It will only watch for changes in the `/traefik/alias`.  
+    Further, if the `/traefik/alias` key is set, all other configuration with `/traefik/backends` or `/traefik/frontends` prefix are ignored.

-# Store configuration in Key-value store
+## Store configuration in Key-value store
+
+!!! note
+    Don't forget to [setup the connection between Træfik and Key-value store](/user-guide/kv-config/#launch-trfk).

-Don't forget to [setup the connection between Træfik and Key-value store](/user-guide/kv-config/#launch-trfk).
 The static Træfik configuration in a key-value store can be automatically created and updated, using the [`storeconfig` subcommand](/basics/#commands).

 ```bash
 traefik storeconfig [flags] ...
 ```
 This command is here only to automate the [process which upload the configuration into the Key-value store](/user-guide/kv-config/#upload-the-configuration-in-the-key-value-store).
-Træfik will not start but the [static configuration](/basics/#static-trfk-configuration) will be uploaded into the Key-value store.
+Træfik will not start but the [static configuration](/basics/#static-trfk-configuration) will be uploaded into the Key-value store.  
 If you configured ACME (Let's Encrypt), your registration account and your certificates will also be uploaded.

-To upload your ACME certificates to the KV store, get your traefik TOML file and add the new `storage` option in the `acme` section:
+To upload your ACME certificates to the KV store, get your Traefik TOML file and add the new `storage` option in the `acme` section:

 ```toml
 [acme]
--- a/docs/user-guide/marathon.md
+++ b/docs/user-guide/marathon.md
@@ -2,7 +2,7 @@

 This guide explains how to integrate Marathon and operate the cluster in a reliable way from Traefik's standpoint.

-# Host detection
+## Host detection

 Marathon offers multiple ways to run (Docker-containerized) applications, the most popular ones being

@@ -14,9 +14,11 @@ Traefik tries to detect the configured mode and route traffic to the right IP ad

 Given the complexity of the subject, it is possible that the heuristic fails.
 Apart from filing an issue and waiting for the feature request / bug report to get addressed, one workaround for such situations is to customize the Marathon template file to the individual needs.
-(Note that this does _not_ require rebuilding Traefik but only to point the `filename` configuration parameter to a customized version of the `marathon.tmpl` file on Traefik startup.)

-# Port detection
+!!! note
+    This does _not_ require rebuilding Traefik but only to point the `filename` configuration parameter to a customized version of the `marathon.tmpl` file on Traefik startup.
+
+## Port detection

 Traefik also attempts to determine the right port (which is a [non-trivial matter in Marathon](https://mesosphere.github.io/marathon/docs/ports.html)).
 Following is the order by which Traefik tries to identify the port (the first one that yields a positive result will be used):
@@ -26,9 +28,9 @@ Following is the order by which Traefik tries to identify the port (the first on
 1. The port from the application's `portDefinitions` field (possibly indexed through the `traefik.portIndex` label, otherwise the first one).
 1. The port from the application's `ipAddressPerTask` field (possibly indexed through the `traefik.portIndex` label, otherwise the first one).

-# Achieving high availability
+## Achieving high availability

-## Scenarios
+### Scenarios

 There are three scenarios where the availability of a Marathon application could be impaired along with the risk of losing or failing requests:

@@ -36,27 +38,29 @@ There are three scenarios where the availability of a Marathon application could
 - During the shutdown phase when Traefik still routes requests to the backend while the backend is already terminating.
 - During a failure of the application when Traefik has not yet identified the backend as being erroneous.

-The first two scenarios are common with every rolling upgrade of an application (i.e., a new version release or configuration update).
+The first two scenarios are common with every rolling upgrade of an application (i.e. a new version release or configuration update).

 The following sub-sections describe how to resolve or mitigate each scenario.

-### Startup
+#### Startup

 It is possible to define [readiness checks](https://mesosphere.github.io/marathon/docs/readiness-checks.html) (available since Marathon version 1.1) per application and have Marathon take these into account during the startup phase.
-The idea is that each application provides an HTTP endpoint that Marathon queries periodically during an ongoing deployment in order to mark the associated readiness check result as successful if and only if the endpoint returns a response within the configured HTTP code range.
+
+The idea is that each application provides an HTTP endpoint that Marathon queries periodically during an ongoing deployment in order to mark the associated readiness check result as successful if and only if the endpoint returns a response within the configured HTTP code range.  
 As long as the check keeps failing, Marathon will not proceed with the deployment (within the configured upgrade strategy bounds).

 Beginning with version 1.4, Traefik respects readiness check results if the Traefik option is set and checks are configured on the applications accordingly.
-Note that due to the way readiness check results are currently exposed by the Marathon API, ready tasks may be taken into rotation with a small delay.
-It is on the order of one readiness check timeout interval (as configured on the application specifiation) and guarantees that non-ready tasks do not receive traffic prematurely.
+
+!!! note
+    Due to the way readiness check results are currently exposed by the Marathon API, ready tasks may be taken into rotation with a small delay.
+    It is on the order of one readiness check timeout interval (as configured on the application specifiation) and guarantees that non-ready tasks do not receive traffic prematurely.

 If readiness checks are not possible, a current mitigation strategy is to enable [retries](/configuration/commons#retry-configuration) and make sure that a sufficient number of healthy application tasks exist so that one retry will likely hit one of those.
 Apart from its probabilistic nature, the workaround comes at the price of increased latency.

-### Shutdown
+#### Shutdown

-It is possible to install a [termination handler](https://mesosphere.github.io/marathon/docs/health-checks.html) (available since Marathon version 1.3) with each application whose responsibility it is to delay the shutdown process long enough until the backend has been taken out of load-balancing rotation with reasonable confidence
-(i.e., Traefik has received an update from the Marathon event bus, recomputes the available Marathon backends, and applies the new configuration).
+It is possible to install a [termination handler](https://mesosphere.github.io/marathon/docs/health-checks.html) (available since Marathon version 1.3) with each application whose responsibility it is to delay the shutdown process long enough until the backend has been taken out of load-balancing rotation with reasonable confidence (i.e., Traefik has received an update from the Marathon event bus, recomputes the available Marathon backends, and applies the new configuration).  
 Specifically, each termination handler should install a signal handler listening for a SIGTERM signal and implement the following steps on signal reception:

 1. Disable Keep-Alive HTTP connections.
@@ -70,12 +74,13 @@ Traefik already ignores Marathon tasks whose state does not match `TASK_RUNNING`
 How long HTTP requests should continue to be accepted in step 2 depends on how long Traefik needs to receive and process the Marathon configuration update.
 Under regular operational conditions, it should be on the order of seconds, with 10 seconds possibly being a good default value.

-Again, configuring Traefik to do retries (as discussed in the previous section) can serve as a decent workaround strategy.
+Again, configuring Traefik to do retries (as discussed in the previous section) can serve as a decent workaround strategy.  
 Paired with termination handlers, they would cover for those cases where either the termination sequence or Traefik cannot complete their part of the orchestration process in time.

-### Failure
+#### Failure

 A failing application always happens unexpectedly, and hence, it is very difficult or even impossible to rule out the adversal effects categorically.
+
 Failure reasons vary broadly and could stretch from unacceptable slowness, a task crash, or a network split.

 There are two mitigaton efforts:
@@ -85,19 +90,22 @@ There are two mitigaton efforts:

 The Marathon health check makes sure that applications once deemed dysfunctional are being rescheduled to different slaves.
 However, they might take a while to get triggered and the follow-up processes to complete.
+
 For that reason, the Treafik health check provides an additional check that responds more rapidly and does not require a configuration reload to happen.
 Additionally, it protects from cases that the Marathon health check may not be able to cover, such as a network split.

-## (Non-)Alternatives
+### (Non-)Alternatives

-There are a few alternatives of varying quality that are frequently asked for. The remaining section is going to explore them along with a benefit/cost trade-off.
+There are a few alternatives of varying quality that are frequently asked for.

-### Reusing Marathon health checks
+The remaining section is going to explore them along with a benefit/cost trade-off.
+
+#### Reusing Marathon health checks

 It may seem obvious to reuse the Marathon health checks as a signal to Traefik whether an application should be taken into load-balancing rotation or not.

 Apart from the increased latency a failing health check may have, a major problem with this is is that Marathon does not persist the health check results.
-Consequently, if a master re-election occurs in the Marathon clusters, all health check results will revert to the _unknown_ state, effectively causing all applications inside the cluster to become unavailable and leading to a complete cluster failure.
+Consequently, if a master re-election occurs in the Marathon clusters, all health check results will revert to the _unknown_ state, effectively causing all applications inside the cluster to become unavailable and leading to a complete cluster failure.  
 Re-elections do not only happen during regular maintenance work (often requiring rolling upgrades of the Marathon nodes) but also when the Marathon leader fails spontaneously.
 As such, there is no way to handle this situation deterministically.

@@ -106,11 +114,14 @@ Finally, Marathon health checks are not mandatory (the default is to use the tas
 Traefik used to use the health check results as a strict requirement but moved away from it as [users reported the dramatic consequences](https://github.com/containous/traefik/issues/653).
 If health check results are known to exist, however, they will be used to signal task availability.

-### Draining
+#### Draining

-Another common approach is to let a proxy drain backends that are supposed to shut down. That is, once a backend is supposed to shut down, Traefik would stop forwarding requests.
+Another common approach is to let a proxy drain backends that are supposed to shut down.
+That is, once a backend is supposed to shut down, Traefik would stop forwarding requests.
+
+On the plus side, this would not require any modifications to the application in question.
+However, implementing this fully within Traefik seems like a non-trivial undertaking.

-On the plus side, this would not require any modifications to the application in question. However, implementing this fully within Traefik seems like a non-trivial undertaking.
 Additionally, the approach is less flexible compared to a custom termination handler since only the latter allows for the implementation of custom termination sequences that go beyond simple request draining (e.g., persisting a snapshot state to disk prior to terminating).

 The feature is currently not implemented; a request for draining in general is at [issue 41](https://github.com/containous/traefik/issues/41).
--- a/docs/user-guide/swarm-mode.md
+++ b/docs/user-guide/swarm-mode.md
@@ -7,18 +7,19 @@ The cluster consists of:
 - 3 servers
 - 1 manager
 - 2 workers
- 1 [overlay](https://docs.docker.com/engine/userguide/networking/dockernetworks/#an-overlay-network) network
-(multi-host networking)
+- 1 [overlay](https://docs.docker.com/engine/userguide/networking/dockernetworks/#an-overlay-network) network (multi-host networking)
+

 ## Prerequisites

 1. You will need to install [docker-machine](https://docs.docker.com/machine/)
 2. You will need the latest [VirtualBox](https://www.virtualbox.org/wiki/Downloads)

+
 ## Cluster provisioning

-First, let's create all the required nodes. It's a shorter version of
-the [swarm tutorial](https://docs.docker.com/engine/swarm/swarm-tutorial/).
+First, let's create all the required nodes.
+It's a shorter version of the [swarm tutorial](https://docs.docker.com/engine/swarm/swarm-tutorial/).

 ```shell
 docker-machine create -d virtualbox manager
@@ -26,11 +27,11 @@ docker-machine create -d virtualbox worker1
 docker-machine create -d virtualbox worker2
 ```

-Then, let's setup the cluster, in order :
+Then, let's setup the cluster, in order:

 1. initialize the cluster
-2. get the token for other host to join
-3. on both workers, join the cluster with the token
+1. get the token for other host to join
+1. on both workers, join the cluster with the token

 ```shell
 docker-machine ssh manager "docker swarm init \
@@ -60,9 +61,9 @@ docker-machine ssh manager docker node ls
 ```
 ```
 ID                           HOSTNAME  STATUS  AVAILABILITY  MANAGER STATUS
-2a770ov9vixeadep674265u1n    worker1   Ready   Active
-dbi3or4q8ii8elbws70g4hkdh *  manager   Ready   Active        Leader
-esbhhy6vnqv90xomjaomdgy46    worker2   Ready   Active
+013v16l1sbuwjqcn7ucbu4jwt    worker1   Ready   Active
+8buzkquycd17jqjber0mo2gn8    worker2   Ready   Active
+fnpj8ozfc85zvahx2r540xfcf *  manager   Ready   Active        Leader
 ```

 Finally, let's create a network for Træfik to use.
@@ -71,11 +72,11 @@ Finally, let's create a network for Træfik to use.
 docker-machine ssh manager "docker network create --driver=overlay traefik-net"
 ```

+
 ## Deploy Træfik

 Let's deploy Træfik as a docker service in our cluster.
-The only requirement for Træfik to work with swarm mode is that it needs to run on a manager node — we are going to use a
-[constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for that.
+The only requirement for Træfik to work with swarm mode is that it needs to run on a manager node - we are going to use a [constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for that.

 ```shell
 docker-machine ssh manager "docker service create \
@@ -94,17 +95,20 @@ docker-machine ssh manager "docker service create \

 Let's explain this command:

- `--publish 80:80 --publish 8080:8080`: we publish port `80` and `8080` on the cluster.
- `--constraint=node.role==manager`: we ask docker to schedule Træfik on a manager node.
- `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock`:
-  we bind mount the docker socket where Træfik is scheduled to be able to speak to the daemon.
- `--network traefik-net`: we attach the Træfik service (and thus the underlying container) to the `traefik-net` network.
- `--docker`: enable docker backend, and `--docker.swarmmode` to enable the swarm mode on Træfik.
- `--web`: activate the webUI on port 8080
+| Option                                                                      | Description                                                                                    |
+|-----------------------------------------------------------------------------|------------------------------------------------------------------------------------------------|
+| `--publish 80:80 --publish 8080:8080`                                       | we publish port `80` and `8080` on the cluster.                                                |
+| `--constraint=node.role==manager`                                           | we ask docker to schedule Træfik on a manager node.                                            |
+| `--mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock` | we bind mount the docker socket where Træfik is scheduled to be able to speak to the daemon.   |
+| `--network traefik-net`                                                     | we attach the Træfik service (and thus the underlying container) to the `traefik-net` network. |
+| `--docker`                                                                  | enable docker backend, and `--docker.swarmmode` to enable the swarm mode on Træfik.            |
+| `--web`                                                                     | activate the webUI on port 8080                                                                |
+

 ## Deploy your apps

-We can now deploy our app on the cluster, here [whoami](https://github.com/emilevauge/whoami), a simple web server in Go. We start 2 services, on the `traefik-net` network.
+We can now deploy our app on the cluster, here [whoami](https://github.com/emilevauge/whoami), a simple web server in Go.
+We start 2 services, on the `traefik-net` network.

 ```shell
 docker-machine ssh manager "docker service create \
@@ -121,9 +125,12 @@ docker-machine ssh manager "docker service create \
 	emilevauge/whoami"
 ```

-Note that we set whoami1 to use sticky sessions (`--label traefik.backend.loadbalancer.sticky=true`).  We'll demonstrate that later.
+!!! note
+    We set `whoami1` to use sticky sessions (`--label traefik.backend.loadbalancer.stickiness=true`).
+    We'll demonstrate that later.

-**Note**: If using `docker stack deploy`, there is [a specific way that the labels must be defined in the docker-compose file](https://github.com/containous/traefik/issues/994#issuecomment-269095109).
+!!! note
+    If using `docker stack deploy`, there is [a specific way that the labels must be defined in the docker-compose file](https://github.com/containous/traefik/issues/994#issuecomment-269095109).

 Check that everything is scheduled and started:

@@ -131,188 +138,196 @@ Check that everything is scheduled and started:
 docker-machine ssh manager "docker service ls"
 ```
 ```
-ID            NAME     REPLICAS  IMAGE              COMMAND
-ab046gpaqtln  whoami0  1/1       emilevauge/whoami
-cgfg5ifzrpgm  whoami1  1/1       emilevauge/whoami
-dtpl249tfghc  traefik  1/1       traefik            --docker --docker.swarmmode --docker.domain=traefik --docker.watch --web
+ID            NAME     MODE        REPLICAS  IMAGE                     PORTS
+moq3dq4xqv6t  traefik  replicated  1/1       traefik:latest            *:80->80/tcp,*:8080->8080/tcp
+ysil6oto1wim  whoami0  replicated  1/1       emilevauge/whoami:latest
+z9re2mnl34k4  whoami1  replicated  1/1       emilevauge/whoami:latest
 ```

+
 ## Access to your apps through Træfik

 ```shell
 curl -H Host:whoami0.traefik http://$(docker-machine ip manager)
 ```
 ```yaml
-Hostname: 8147a7746e7a
+Hostname: 5b0b3d148359
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.3
-IP: fe80::42:aff:fe00:903
-IP: 172.18.0.3
-IP: fe80::42:acff:fe12:3
+IP: 10.0.0.8
+IP: 10.0.0.4
+IP: 172.18.0.5
 GET / HTTP/1.1
-Host: 10.0.9.3:80
-User-Agent: curl/7.35.0
+Host: whoami0.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.3:80
+X-Forwarded-For: 10.255.0.2
+X-Forwarded-Host: whoami0.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```
 ```shell
 curl -H Host:whoami1.traefik http://$(docker-machine ip manager)
 ```
 ```yaml
-Hostname: ba2c21488299
+Hostname: 3633163970f6
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.4
-IP: fe80::42:aff:fe00:904
-IP: 172.18.0.2
-IP: fe80::42:acff:fe12:2
+IP: 10.0.0.14
+IP: 10.0.0.6
+IP: 172.18.0.5
 GET / HTTP/1.1
-Host: 10.0.9.4:80
-User-Agent: curl/7.35.0
+Host: whoami1.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.4:80
+X-Forwarded-For: 10.255.0.2
+X-Forwarded-Host: whoami1.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```

-Note that as Træfik is published, you can access it from any machine and not only the manager.
+!!! note
+    As Træfik is published, you can access it from any machine and not only the manager.

 ```shell
 curl -H Host:whoami0.traefik http://$(docker-machine ip worker1)
 ```
 ```yaml
-Hostname: 8147a7746e7a
+Hostname: 5b0b3d148359
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.3
-IP: fe80::42:aff:fe00:903
-IP: 172.18.0.3
-IP: fe80::42:acff:fe12:3
+IP: 10.0.0.8
+IP: 10.0.0.4
+IP: 172.18.0.5
 GET / HTTP/1.1
-Host: 10.0.9.3:80
-User-Agent: curl/7.35.0
+Host: whoami0.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.3:80
+X-Forwarded-For: 10.255.0.3
+X-Forwarded-Host: whoami0.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```
 ```shell
 curl -H Host:whoami1.traefik http://$(docker-machine ip worker2)
 ```
 ```yaml
-Hostname: ba2c21488299
+Hostname: 3633163970f6
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.4
-IP: fe80::42:aff:fe00:904
-IP: 172.18.0.2
-IP: fe80::42:acff:fe12:2
+IP: 10.0.0.14
+IP: 10.0.0.6
+IP: 172.18.0.5
 GET / HTTP/1.1
-Host: 10.0.9.4:80
-User-Agent: curl/7.35.0
+Host: whoami1.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.4:80
+X-Forwarded-For: 10.255.0.4
+X-Forwarded-Host: whoami1.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```

 ## Scale both services

 ```shell
 docker-machine ssh manager "docker service scale whoami0=5"
-
 docker-machine ssh manager "docker service scale whoami1=5"
 ```

-
 Check that we now have 5 replicas of each `whoami` service:

 ```shell
 docker-machine ssh manager "docker service ls"
 ```
 ```
-ID            NAME     REPLICAS  IMAGE              COMMAND
-ab046gpaqtln  whoami0  5/5       emilevauge/whoami
-cgfg5ifzrpgm  whoami1  5/5       emilevauge/whoami
-dtpl249tfghc  traefik  1/1       traefik            --docker --docker.swarmmode --docker.domain=traefik --docker.watch --web
+ID            NAME     MODE        REPLICAS  IMAGE                     PORTS
+moq3dq4xqv6t  traefik  replicated  1/1       traefik:latest            *:80->80/tcp,*:8080->8080/tcp
+ysil6oto1wim  whoami0  replicated  5/5       emilevauge/whoami:latest
+z9re2mnl34k4  whoami1  replicated  5/5       emilevauge/whoami:latest
 ```
-## Access to your whoami0 through Træfik multiple times.
+
+## Access to your `whoami0` through Træfik multiple times.

 Repeat the following command multiple times and note that the Hostname changes each time as Traefik load balances each request against the 5 tasks:

 ```shell
 curl -H Host:whoami0.traefik http://$(docker-machine ip manager)
 ```
-
 ```yaml
-Hostname: 8147a7746e7a
+Hostname: f3138d15b567
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.3
-IP: fe80::42:aff:fe00:903
+IP: 10.0.0.5
+IP: 10.0.0.4
 IP: 172.18.0.3
-IP: fe80::42:acff:fe12:3
 GET / HTTP/1.1
-Host: 10.0.9.3:80
-User-Agent: curl/7.35.0
+Host: whoami0.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.3:80
+X-Forwarded-For: 10.255.0.2
+X-Forwarded-Host: whoami0.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```

-Do the same against whoami1:
+Do the same against `whoami1`:

 ```shell
-curl -H Host:whoami1.traefik http://$(docker-machine ip manager)
+curl -c cookies.txt -H Host:whoami1.traefik http://$(docker-machine ip manager)
 ```
-
 ```yaml
-Hostname: ba2c21488299
+Hostname: 348e2f7bf432
 IP: 127.0.0.1
-IP: ::1
-IP: 10.0.9.4
-IP: fe80::42:aff:fe00:904
-IP: 172.18.0.2
-IP: fe80::42:acff:fe12:2
+IP: 10.0.0.15
+IP: 10.0.0.6
+IP: 172.18.0.6
 GET / HTTP/1.1
-Host: 10.0.9.4:80
-User-Agent: curl/7.35.0
+Host: whoami1.traefik
+User-Agent: curl/7.55.1
 Accept: */*
 Accept-Encoding: gzip
-X-Forwarded-For: 192.168.99.1
-X-Forwarded-Host: 10.0.9.4:80
+X-Forwarded-For: 10.255.0.2
+X-Forwarded-Host: whoami1.traefik
 X-Forwarded-Proto: http
-X-Forwarded-Server: 8fbc39271b4c
+X-Forwarded-Server: 77fc29c69fe4
 ```
-Wait, I thought we added the sticky flag to `whoami1`?  Traefik relies on a cookie to maintain stickyness so you'll need to test this with a browser.

-First you need to add `whoami1.traefik` to your hosts file:
+Because the sticky sessions require cookies to work, we used the `-c cookies.txt` option to store the cookie into a file.
+The cookie contains the IP of the container to which the session sticks:

 ```shell
-if [ -n "$(grep whoami1.traefik /etc/hosts)" ];
-then
-    echo "whoami1.traefik already exists (make sure the ip is current)";
-else
-    sudo -- sh -c -e "echo '$(docker-machine ip manager)\twhoami1.traefik' >> /etc/hosts";
-fi
+cat ./cookies.txt
+```
+```
+# Netscape HTTP Cookie File
+# https://curl.haxx.se/docs/http-cookies.html
+# This file was generated by libcurl! Edit at your own risk.
+
+whoami1.traefik FALSE  /  FALSE  0  _TRAEFIK_BACKEND  http://10.0.0.15:80
 ```

-Now open your browser and go to http://whoami1.traefik/
+If you load the cookies file (`-b cookies.txt`) for the next request, you will see that stickiness is maintained:

-You will now see that stickyness is maintained.
+```shell
+curl -b cookies.txt -H Host:whoami1.traefik http://$(docker-machine ip manager)
+```
+```yaml
+Hostname: 348e2f7bf432
+IP: 127.0.0.1
+IP: 10.0.0.15
+IP: 10.0.0.6
+IP: 172.18.0.6
+GET / HTTP/1.1
+Host: whoami1.traefik
+User-Agent: curl/7.55.1
+Accept: */*
+Accept-Encoding: gzip
+Cookie: _TRAEFIK_BACKEND=http://10.0.0.15:80
+X-Forwarded-For: 10.255.0.2
+X-Forwarded-Host: whoami1.traefik
+X-Forwarded-Proto: http
+X-Forwarded-Server: 77fc29c69fe4
+```

 ![](https://i.giphy.com/ujUdrdpX7Ok5W.gif)
--- a/docs/user-guide/swarm.md
+++ b/docs/user-guide/swarm.md
@@ -1,6 +1,7 @@
 # Swarm cluster

 This section explains how to create a multi-host [swarm](https://docs.docker.com/swarm) cluster using [docker-machine](https://docs.docker.com/machine/) and how to deploy Træfik on it.
+
 The cluster consists of:

 - 2 servers
@@ -97,14 +98,17 @@ docker $(docker-machine config mhs-demo0) run \

 Let's explain this command:

- `-p 80:80 -p 8080:8080`: we bind ports 80 and 8080
- `--net=my-net`: run the container on the network my-net
- `-v /var/lib/boot2docker/:/ssl`: mount the ssl keys generated by docker-machine
- `-c /dev/null`: empty config file
- `--docker`: enable docker backend
- `--docker.endpoint=tcp://172.18.0.1:3376`: connect to the swarm master using the docker_gwbridge network
- `--docker.tls`: enable TLS using the docker-machine keys
- `--web`: activate the webUI on port 8080
+| Option                                    | Description                                                   |
+|-------------------------------------------|---------------------------------------------------------------|
+| `-p 80:80 -p 8080:8080`                   | we bind ports 80 and 8080                                     |
+| `--net=my-net`                            | run the container on the network my-net                       |
+| `-v /var/lib/boot2docker/:/ssl`           | mount the ssl keys generated by docker-machine                |
+| `-c /dev/null`                            | empty config file                                             |
+| `--docker`                                | enable docker backend                                         |
+| `--docker.endpoint=tcp://172.18.0.1:3376` | connect to the swarm master using the docker_gwbridge network |
+| `--docker.tls`                            | enable TLS using the docker-machine keys                      |
+| `--web`                                   | activate the webUI on port 8080                               |
+

 ## Deploy your apps

--- a/examples/accessLog/traefik.ab.toml
+++ b/examples/accessLog/traefik.ab.toml
@@ -19,19 +19,19 @@ address = ":7888"
 ################################################################
 # rules
 ################################################################
- [backends]
-   [backends.backend]
-     [backends.backend.LoadBalancer]
-       method = "drr"
-     [backends.backend.servers.server1]
-       url = "http://127.0.0.1:8081"
-     [backends.backend.servers.server2]
-       url = "http://127.0.0.1:8082"
-     [backends.backend.servers.server3]
-       url = "http://127.0.0.1:8083"
- [frontends]
-   [frontends.frontend]
-   backend = "backend"
-   passHostHeader = true
-     [frontends.frontend.routes.test]
-     rule = "Path: /test"
+  [backends]
+    [backends.backend]
+      [backends.backend.LoadBalancer]
+      method = "drr"
+      [backends.backend.servers.server1]
+      url = "http://127.0.0.1:8081"
+      [backends.backend.servers.server2]
+      url = "http://127.0.0.1:8082"
+      [backends.backend.servers.server3]
+      url = "http://127.0.0.1:8083"
+  [frontends]
+    [frontends.frontend]
+    backend = "backend"
+    passHostHeader = true
+      [frontends.frontend.routes.test]
+      rule = "Path: /test"
--- a/examples/accessLog/traefik.example.toml
+++ b/examples/accessLog/traefik.example.toml
@@ -19,24 +19,24 @@ address = ":7888"
 ################################################################
 # rules
 ################################################################
- [backends]
-   [backends.backend1]
-     [backends.backend1.servers.server1]
-       url = "http://127.0.0.1:8081"
-   [backends.backend2]
-     [backends.backend2.LoadBalancer]
-       method = "drr"
-     [backends.backend2.servers.server1]
-       url = "http://127.0.0.1:8082"
-     [backends.backend2.servers.server2]
-       url = "http://127.0.0.1:8083"
+  [backends]
+    [backends.backend1]
+      [backends.backend1.servers.server1]
+      url = "http://127.0.0.1:8081"
+    [backends.backend2]
+      [backends.backend2.LoadBalancer]
+      method = "drr"
+      [backends.backend2.servers.server1]
+      url = "http://127.0.0.1:8082"
+      [backends.backend2.servers.server2]
+      url = "http://127.0.0.1:8083"
  [frontends]
-   [frontends.frontend1]
-   backend = "backend1"
-     [frontends.frontend1.routes.test_1]
-     rule = "Path: /test1"
-   [frontends.frontend2]
-   backend = "backend2"
-   passHostHeader = true
-     [frontends.frontend2.routes.test_2]
-     rule = "Path: /test2"
+    [frontends.frontend1]
+    backend = "backend1"
+      [frontends.frontend1.routes.test_1]
+      rule = "Path: /test1"
+    [frontends.frontend2]
+    backend = "backend2"
+    passHostHeader = true
+      [frontends.frontend2.routes.test_2]
+      rule = "Path: /test2"
--- a/examples/acme/acme.toml
+++ b/examples/acme/acme.toml
@@ -6,7 +6,7 @@ defaultEntryPoints = ["http", "https"]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
-        entryPoint = "https"
+    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
@@ -22,7 +22,7 @@ caServer = "http://traefik.localhost.com:4000/directory"


 [web]
-  address = ":8080"
+address = ":8080"

 [docker]
 endpoint = "unix:///var/run/docker.sock"
--- a/examples/k8s/traefik-rbac.yaml
+++ b/examples/k8s/traefik-rbac.yaml
@@ -7,7 +7,6 @@ rules:
  - apiGroups:
      - ""
    resources:
-      - pods
      - services
      - endpoints
      - secrets
--- a/glide.lock
+++ b/glide.lock
@@ -1,5 +1,5 @@
-hash: 7b973a5de5444f7f29252ae78529ee50569174b2c17f4aa89bf15aaf2553c6b7
-updated: 2017-08-25T11:52:16.848940186+02:00
+hash: de7e6a0069090a5811c003db434da19fe31efcf0c9429d3ccb676295708f0d2b
+updated: 2017-10-24T14:08:11.364720581+02:00
 imports:
 - name: cloud.google.com/go
  version: 2e6a95edb1071d750f6d7db777bf66cd2997af6c
@@ -89,7 +89,7 @@ imports:
 - name: github.com/containous/flaeg
  version: b5d2dc5878df07c2d74413348186982e7b865871
 - name: github.com/containous/mux
-  version: af6ea922f7683d9706834157e6b0610e22ccb2db
+  version: 06ccd3e75091eb659b1d720cda0e16bc7057954c
 - name: github.com/containous/staert
  version: 1e26a71803e428fd933f5f9c8e50a26878f53147
 - name: github.com/coreos/etcd
@@ -370,8 +370,12 @@ imports:
  version: f533f7a102197536779ea3a8cb881d639e21ec5a
 - name: github.com/miekg/dns
  version: 8060d9f51305bbe024b99679454e62f552cd0b0b
+- name: github.com/mitchellh/copystructure
+  version: d23ffcb85de31694d6ccaa23ccb4a03e55c1303f
 - name: github.com/mitchellh/mapstructure
  version: d0303fe809921458f417bcf828397a65db30a7e4
+- name: github.com/mitchellh/reflectwalk
+  version: 63d60e9d0dbc60cf9164e6510889b0db6683d98c
 - name: github.com/mvdan/xurls
  version: db96455566f05ffe42bd6ac671f05eeb1152b45d
 - name: github.com/Nvveen/Gotty
@@ -379,9 +383,7 @@ imports:
  repo: https://github.com/ijc25/Gotty.git
  vcs: git
 - name: github.com/NYTimes/gziphandler
-  version: 824b33f2a7457025697878c865c323f801118043
-  repo: https://github.com/containous/gziphandler.git
-  vcs: git
+  version: d6f46609c7629af3a02d791a4666866eed3cbd3e
 - name: github.com/ogier/pflag
  version: 45c278ab3607870051a2ea9040bb85fcb8557481
 - name: github.com/opencontainers/go-digest
@@ -479,7 +481,7 @@ imports:
 - name: github.com/urfave/negroni
  version: 490e6a555d47ca891a89a150d0c1ef3922dfffe9
 - name: github.com/vulcand/oxy
-  version: 6c94d2888dba2b1a15a89b8a2ca515fc85e07477
+  version: 7e9763c4dc71b9758379da3581e6495c145caaab
  repo: https://github.com/containous/oxy.git
  vcs: git
  subpackages:
@@ -779,7 +781,9 @@ testImports:
 - name: github.com/flynn/go-shlex
  version: 3f9db97f856818214da2e1057f8ad84803971cff
 - name: github.com/go-check/check
-  version: 11d3bc7aa68e238947792f30573146a3231fc0f1
+  version: ca0bf163426aa183d03fd4949101785c0347f273
+  repo: https://github.com/containous/check.git
+  vcs: git
 - name: github.com/gorilla/mux
  version: e444e69cbd2e2e3e0749a2f3c717cec491552bbf
 - name: github.com/libkermit/compose
--- a/glide.yaml
+++ b/glide.yaml
@@ -12,7 +12,7 @@ import:
 - package: github.com/cenk/backoff
 - package: github.com/containous/flaeg
 - package: github.com/vulcand/oxy
-  version: 6c94d2888dba2b1a15a89b8a2ca515fc85e07477
+  version: 7e9763c4dc71b9758379da3581e6495c145caaab
  repo: https://github.com/containous/oxy.git
  vcs: git
  subpackages:
@@ -79,9 +79,6 @@ import:
  vcs: git
 - package: github.com/abbot/go-http-auth
 - package: github.com/NYTimes/gziphandler
-  repo: https://github.com/containous/gziphandler.git
-  vcs: git
-  version: ^v1002.0.0
 - package: github.com/docker/leadership
 - package: github.com/satori/go.uuid
  version: ^1.1.0
@@ -203,12 +200,15 @@ import:
  version: e039e20e500c2c025d9145be375e27cf42a94174
 - package: github.com/armon/go-proxyproto
  version: 48572f11356f1843b694f21a290d4f1006bc5e47
+- package: github.com/mitchellh/copystructure
 testImport:
 - package: github.com/stvp/go-udp-testing
 - package: github.com/docker/libcompose
  version: 1b708aac26a4fc6f9bff31728a8e3a252ef57dbd
 - package: github.com/go-check/check
-  version: 11d3bc7aa68e238947792f30573146a3231fc0f1
+  version: fork-containous
+  repo: https://github.com/containous/check.git
+  vcs: git
 - package: github.com/libkermit/compose
  version: 2048f803f56422a65b455f918d4a61704dc94603
  subpackages:
--- a/healthcheck/healthcheck.go
+++ b/healthcheck/healthcheck.go
@@ -35,7 +35,7 @@ type Options struct {
 }

 func (opt Options) String() string {
-	return fmt.Sprintf("[Path: %s Interval: %s]", opt.Path, opt.Interval)
+	return fmt.Sprintf("[Path: %s Port: %d Interval: %s]", opt.Path, opt.Port, opt.Interval)
 }

 // BackendHealthCheck HealthCheck configuration for a backend
@@ -131,14 +131,14 @@ func checkBackend(currentBackend *BackendHealthCheck) {
 }

 func (backend *BackendHealthCheck) newRequest(serverURL *url.URL) (*http.Request, error) {
-	if backend.Options.Port == 0 {
+	if backend.Port == 0 {
 		return http.NewRequest("GET", serverURL.String()+backend.Path, nil)
 	}

 	// copy the url and add the port to the host
 	u := &url.URL{}
 	*u = *serverURL
-	u.Host = net.JoinHostPort(u.Hostname(), strconv.Itoa(backend.Options.Port))
+	u.Host = net.JoinHostPort(u.Hostname(), strconv.Itoa(backend.Port))
 	u.Path = u.Path + backend.Path

 	return http.NewRequest("GET", u.String(), nil)
--- a/integration/access_log_test.go
+++ b/integration/access_log_test.go
@@ -30,7 +30,8 @@ func (s *AccessLogSuite) TestAccessLog(c *check.C) {
 	os.Remove(traefikTestLogFile)

 	// Start Traefik
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/access_log_config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -96,7 +97,7 @@ func CheckAccessLogFormat(c *check.C, line string, i int) {
 	tokens, err := shellwords.Parse(line)
 	c.Assert(err, checker.IsNil)
 	c.Assert(tokens, checker.HasLen, 14)
-	c.Assert(tokens[6], checker.Matches, `^\d{3}$`)
+	c.Assert(tokens[6], checker.Matches, `^(-|\d{3})$`)
 	c.Assert(tokens[10], checker.Equals, fmt.Sprintf("%d", i+1))
 	c.Assert(tokens[11], checker.HasPrefix, "frontend")
 	c.Assert(tokens[12], checker.HasPrefix, "http://127.0.0.1:808")
--- a/integration/acme_test.go
+++ b/integration/acme_test.go
@@ -4,6 +4,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"net/http"
+	"os"
 	"time"

 	"github.com/containous/traefik/integration/try"
@@ -101,8 +102,10 @@ func (s *AcmeSuite) retrieveAcmeCertificate(c *check.C, testCase AcmeTestCase) {
 		OnDemand:    testCase.onDemand,
 		OnHostRule:  !testCase.onDemand,
 	})
+	defer os.Remove(file)

-	cmd, output := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -120,8 +123,6 @@ func (s *AcmeSuite) retrieveAcmeCertificate(c *check.C, testCase AcmeTestCase) {
 		_, err := client.Get("https://127.0.0.1:5001")
 		return err
 	})
-	// TODO: waiting a refactor of integration tests
-	s.displayTraefikLog(c, output)
 	c.Assert(err, checker.IsNil)

 	tr = &http.Transport{
--- a/integration/constraint_test.go
+++ b/integration/constraint_test.go
@@ -80,12 +80,13 @@ func (s *ConstraintSuite) deregisterService(name string, address string) error {
 }

 func (s *ConstraintSuite) TestMatchConstraintGlobal(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--constraints=tag==api")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -105,12 +106,13 @@ func (s *ConstraintSuite) TestMatchConstraintGlobal(c *check.C) {
 }

 func (s *ConstraintSuite) TestDoesNotMatchConstraintGlobal(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--constraints=tag==api")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -130,12 +132,13 @@ func (s *ConstraintSuite) TestDoesNotMatchConstraintGlobal(c *check.C) {
 }

 func (s *ConstraintSuite) TestMatchConstraintProvider(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--consulCatalog.constraints=tag==api")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -155,12 +158,13 @@ func (s *ConstraintSuite) TestMatchConstraintProvider(c *check.C) {
 }

 func (s *ConstraintSuite) TestDoesNotMatchConstraintProvider(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--consulCatalog.constraints=tag==api")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -180,13 +184,14 @@ func (s *ConstraintSuite) TestDoesNotMatchConstraintProvider(c *check.C) {
 }

 func (s *ConstraintSuite) TestMatchMultipleConstraint(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--consulCatalog.constraints=tag==api",
 		"--constraints=tag!=us-*")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -206,13 +211,14 @@ func (s *ConstraintSuite) TestMatchMultipleConstraint(c *check.C) {
 }

 func (s *ConstraintSuite) TestDoesNotMatchMultipleConstraint(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost",
 		"--consulCatalog.constraints=tag==api",
 		"--constraints=tag!=us-*")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/consul_catalog_test.go
+++ b/integration/consul_catalog_test.go
@@ -24,19 +24,20 @@ func (s *ConsulCatalogSuite) SetUpSuite(c *check.C) {
 	s.composeProject.Start(c)

 	consul := s.composeProject.Container(c, "consul")
-
 	s.consulIP = consul.NetworkSettings.IPAddress
 	config := api.DefaultConfig()
 	config.Address = s.consulIP + ":8500"
-	consulClient, err := api.NewClient(config)
-	if err != nil {
-		c.Fatalf("Error creating consul client. %v", err)
-	}
-	s.consulClient = consulClient
+	s.createConsulClient(config, c)

 	// Wait for consul to elect itself leader
-	err = try.Do(3*time.Second, func() error {
-		leader, err := consulClient.Status().Leader()
+	err := s.waitToElectConsulLeader()
+	c.Assert(err, checker.IsNil)
+
+}
+
+func (s *ConsulCatalogSuite) waitToElectConsulLeader() error {
+	return try.Do(15*time.Second, func() error {
+		leader, err := s.consulClient.Status().Leader()

 		if err != nil || len(leader) == 0 {
 			return fmt.Errorf("Leader not found. %v", err)
@@ -44,7 +45,17 @@ func (s *ConsulCatalogSuite) SetUpSuite(c *check.C) {

 		return nil
 	})
-	c.Assert(err, checker.IsNil)
+}
+func (s *ConsulCatalogSuite) createConsulClient(config *api.Config, c *check.C) *api.Client {
+	consulClient, err := api.NewClient(config)
+	if err != nil {
+		c.Fatalf("Error creating consul client. %v", err)
+	}
+	s.consulClient = consulClient
+	return consulClient
+}
+func (s *ConsulCatalogSuite) startConsulService(c *check.C) {
+
 }

 func (s *ConsulCatalogSuite) registerService(name string, address string, port int, tags []string) error {
@@ -104,10 +115,11 @@ func (s *ConsulCatalogSuite) deregisterService(name string, address string) erro
 }

 func (s *ConsulCatalogSuite) TestSimpleConfiguration(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -119,20 +131,24 @@ func (s *ConsulCatalogSuite) TestSimpleConfiguration(c *check.C) {
 }

 func (s *ConsulCatalogSuite) TestSingleService(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()

+	// Wait for Traefik to turn ready.
+	err = try.GetRequest("http://127.0.0.1:8000/", 2*time.Second, try.StatusCodeIs(http.StatusNotFound))
+	c.Assert(err, checker.IsNil)
+
 	nginx := s.composeProject.Container(c, "nginx1")

 	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{})
 	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
-	defer s.deregisterService("test", nginx.NetworkSettings.IPAddress)

 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
 	c.Assert(err, checker.IsNil)
@@ -140,15 +156,21 @@ func (s *ConsulCatalogSuite) TestSingleService(c *check.C) {

 	err = try.Request(req, 10*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
 	c.Assert(err, checker.IsNil)
+
+	s.deregisterService("test", nginx.NetworkSettings.IPAddress)
+	err = try.Request(req, 10*time.Second, try.StatusCodeIs(http.StatusNotFound), try.HasBody())
+	c.Assert(err, checker.IsNil)
+
 }

 func (s *ConsulCatalogSuite) TestExposedByDefaultFalseSingleService(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.exposedByDefault=false",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -168,12 +190,13 @@ func (s *ConsulCatalogSuite) TestExposedByDefaultFalseSingleService(c *check.C)
 }

 func (s *ConsulCatalogSuite) TestExposedByDefaultFalseSimpleServiceMultipleNode(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.exposedByDefault=false",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -198,12 +221,13 @@ func (s *ConsulCatalogSuite) TestExposedByDefaultFalseSimpleServiceMultipleNode(
 }

 func (s *ConsulCatalogSuite) TestExposedByDefaultTrueSimpleServiceMultipleNode(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.exposedByDefault=true",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -232,12 +256,13 @@ func (s *ConsulCatalogSuite) TestExposedByDefaultTrueSimpleServiceMultipleNode(c
 }

 func (s *ConsulCatalogSuite) TestRefreshConfigWithMultipleNodeWithoutHealthCheck(c *check.C) {
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.exposedByDefault=true",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -251,6 +276,7 @@ func (s *ConsulCatalogSuite) TestRefreshConfigWithMultipleNodeWithoutHealthCheck

 	err = s.registerAgentService("test", nginx.NetworkSettings.IPAddress, 80, []string{"name=nginx1"})
 	c.Assert(err, checker.IsNil, check.Commentf("Error registering agent service"))
+	defer s.deregisterAgentService(nginx.NetworkSettings.IPAddress)

 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
 	c.Assert(err, checker.IsNil)
@@ -283,20 +309,17 @@ func (s *ConsulCatalogSuite) TestRefreshConfigWithMultipleNodeWithoutHealthCheck
 }

 func (s *ConsulCatalogSuite) TestBasicAuthSimpleService(c *check.C) {
-	cmd, output := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/consul_catalog/simple.toml"),
 		"--consulCatalog",
 		"--consulCatalog.exposedByDefault=true",
 		"--consulCatalog.endpoint="+s.consulIP+":8500",
 		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()

-	defer func() {
-		s.displayTraefikLog(c, output)
-	}()
-
 	nginx := s.composeProject.Container(c, "nginx1")

 	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{
@@ -320,3 +343,124 @@ func (s *ConsulCatalogSuite) TestBasicAuthSimpleService(c *check.C) {
 	err = try.Request(req, 5*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
 	c.Assert(err, checker.IsNil)
 }
+
+func (s *ConsulCatalogSuite) TestRefreshConfigTagChange(c *check.C) {
+	cmd, display := s.traefikCmd(
+		withConfigFile("fixtures/consul_catalog/simple.toml"),
+		"--consulCatalog",
+		"--consulCatalog.exposedByDefault=false",
+		"--consulCatalog.watch=true",
+		"--consulCatalog.endpoint="+s.consulIP+":8500",
+		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	nginx := s.composeProject.Container(c, "nginx1")
+
+	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{"name=nginx1", "traefik.enable=false", "traefik.backend.circuitbreaker=NetworkErrorRatio() > 0.5"})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+	defer s.deregisterService("test", nginx.NetworkSettings.IPAddress)
+
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 5*time.Second, try.BodyContains("nginx1"))
+	c.Assert(err, checker.NotNil)
+
+	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{"name=nginx1", "traefik.enable=true", "traefik.backend.circuitbreaker=ResponseCodeRatio(500, 600, 0, 600) > 0.5"})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	c.Assert(err, checker.IsNil)
+	req.Host = "test.consul.localhost"
+
+	err = try.Request(req, 20*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
+	c.Assert(err, checker.IsNil)
+
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("nginx1"))
+	c.Assert(err, checker.IsNil)
+}
+
+func (s *ConsulCatalogSuite) TestCircuitBreaker(c *check.C) {
+	cmd, display := s.traefikCmd(
+		withConfigFile("fixtures/consul_catalog/simple.toml"),
+		"--retry",
+		"--retry.attempts=1",
+		"--forwardingTimeouts.dialTimeout=5s",
+		"--forwardingTimeouts.responseHeaderTimeout=10s",
+		"--consulCatalog",
+		"--consulCatalog.exposedByDefault=false",
+		"--consulCatalog.watch=true",
+		"--consulCatalog.endpoint="+s.consulIP+":8500",
+		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	nginx := s.composeProject.Container(c, "nginx1")
+	nginx2 := s.composeProject.Container(c, "nginx2")
+	nginx3 := s.composeProject.Container(c, "nginx3")
+
+	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{"name=nginx1", "traefik.enable=true", "traefik.backend.circuitbreaker=NetworkErrorRatio() > 0.5"})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+	defer s.deregisterService("test", nginx.NetworkSettings.IPAddress)
+	err = s.registerService("test", nginx2.NetworkSettings.IPAddress, 42, []string{"name=nginx2", "traefik.enable=true", "traefik.backend.circuitbreaker=NetworkErrorRatio() > 0.5"})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+	defer s.deregisterService("test", nginx2.NetworkSettings.IPAddress)
+	err = s.registerService("test", nginx3.NetworkSettings.IPAddress, 42, []string{"name=nginx3", "traefik.enable=true", "traefik.backend.circuitbreaker=NetworkErrorRatio() > 0.5"})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+	defer s.deregisterService("test", nginx3.NetworkSettings.IPAddress)
+
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	c.Assert(err, checker.IsNil)
+	req.Host = "test.consul.localhost"
+
+	err = try.Request(req, 20*time.Second, try.StatusCodeIs(http.StatusServiceUnavailable), try.HasBody())
+	c.Assert(err, checker.IsNil)
+}
+
+func (s *ConsulCatalogSuite) TestRetryWithConsulServer(c *check.C) {
+	//Scale consul to 0 to be able to start traefik before and test retry
+	s.composeProject.Scale(c, "consul", 0)
+
+	cmd, display := s.traefikCmd(
+		withConfigFile("fixtures/consul_catalog/simple.toml"),
+		"--consulCatalog",
+		"--consulCatalog.watch=false",
+		"--consulCatalog.exposedByDefault=true",
+		"--consulCatalog.endpoint="+s.consulIP+":8500",
+		"--consulCatalog.domain=consul.localhost")
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	// Wait for Traefik to turn ready.
+	err = try.GetRequest("http://127.0.0.1:8000/", 2*time.Second, try.StatusCodeIs(http.StatusNotFound))
+	c.Assert(err, checker.IsNil)
+
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	c.Assert(err, checker.IsNil)
+	req.Host = "test.consul.localhost"
+
+	// Request should fail
+	err = try.Request(req, 2*time.Second, try.StatusCodeIs(http.StatusNotFound), try.HasBody())
+	c.Assert(err, checker.IsNil)
+
+	// Scale consul to 1
+	s.composeProject.Scale(c, "consul", 1)
+	s.waitToElectConsulLeader()
+
+	nginx := s.composeProject.Container(c, "nginx1")
+	// Register service
+	err = s.registerService("test", nginx.NetworkSettings.IPAddress, 80, []string{})
+	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
+
+	// Provider consul catalog should be present
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("consul_catalog"))
+	c.Assert(err, checker.IsNil)
+
+	// Should be ok
+	err = try.Request(req, 10*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
+	c.Assert(err, checker.IsNil)
+}
--- a/integration/consul_test.go
+++ b/integration/consul_test.go
@@ -95,7 +95,8 @@ func (s *ConsulSuite) TestSimpleConfiguration(c *check.C) {
 	file := s.adaptFile(c, "fixtures/consul/simple.toml", struct{ ConsulHost string }{consulHost})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -111,7 +112,8 @@ func (s *ConsulSuite) TestNominalConfiguration(c *check.C) {
 	file := s.adaptFile(c, "fixtures/consul/simple.toml", struct{ ConsulHost string }{consulHost})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -210,10 +212,11 @@ func (s *ConsulSuite) TestGlobalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)

 	// start traefik
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/simple_web.toml"),
 		"--consul",
 		"--consul.endpoint="+consulHost+":8500")
+	defer display(c)

 	err = cmd.Start()
 	c.Assert(err, checker.IsNil)
@@ -297,7 +300,7 @@ func (s *ConsulSuite) skipTestGlobalConfigurationWithClientTLS(c *check.C) {
 	c.Assert(err, checker.IsNil)

 	// start traefik
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/simple_web.toml"),
 		"--consul",
 		"--consul.endpoint="+consulHost+":8585",
@@ -305,6 +308,7 @@ func (s *ConsulSuite) skipTestGlobalConfigurationWithClientTLS(c *check.C) {
 		"--consul.tls.cert=resources/tls/consul.cert",
 		"--consul.tls.key=resources/tls/consul.key",
 		"--consul.tls.insecureskipverify")
+	defer display(c)

 	err = cmd.Start()
 	c.Assert(err, checker.IsNil)
@@ -319,10 +323,11 @@ func (s *ConsulSuite) TestCommandStoreConfig(c *check.C) {
 	s.setupConsul(c)
 	consulHost := s.composeProject.Container(c, "consul").NetworkSettings.IPAddress

-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		"storeconfig",
 		withConfigFile("fixtures/simple_web.toml"),
 		"--consul.endpoint="+consulHost+":8500")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)

--- a/integration/docker_test.go
+++ b/integration/docker_test.go
@@ -79,7 +79,8 @@ func (s *DockerSuite) TestSimpleConfiguration(c *check.C) {
 	file := s.adaptFileForHost(c, "fixtures/docker/simple.toml")
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -96,7 +97,8 @@ func (s *DockerSuite) TestDefaultDockerContainers(c *check.C) {
 	name := s.startContainer(c, "swarm:1.0.0", "manage", "token://blablabla")

 	// Start traefik
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -127,20 +129,34 @@ func (s *DockerSuite) TestDockerContainersWithLabels(c *check.C) {
 	}
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")

+	// Start another container by replacing a '.' by a '-'
+	labels = map[string]string{
+		types.LabelFrontendRule: "Host:my-super.host",
+	}
+	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blablabla")
 	// Start traefik
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()

 	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/version", nil)
 	c.Assert(err, checker.IsNil)
-	req.Host = "my.super.host"
+	req.Host = "my-super.host"

 	// FIXME Need to wait than 500 milliseconds more (for swarm or traefik to boot up ?)
 	resp, err := try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
 	c.Assert(err, checker.IsNil)

+	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/version", nil)
+	c.Assert(err, checker.IsNil)
+	req.Host = "my.super.host"
+
+	// FIXME Need to wait than 500 milliseconds more (for swarm or traefik to boot up ?)
+	resp, err = try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	c.Assert(err, checker.IsNil)
+
 	body, err := ioutil.ReadAll(resp.Body)
 	c.Assert(err, checker.IsNil)

@@ -160,7 +176,8 @@ func (s *DockerSuite) TestDockerContainersWithOneMissingLabels(c *check.C) {
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")

 	// Start traefik
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -175,3 +192,40 @@ func (s *DockerSuite) TestDockerContainersWithOneMissingLabels(c *check.C) {
 	err = try.Request(req, 1500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
 	c.Assert(err, checker.IsNil)
 }
+
+// TestDockerContainersWithServiceLabels allows cheking the labels behavior
+// Use service label if defined and compete information with container labels.
+func (s *DockerSuite) TestDockerContainersWithServiceLabels(c *check.C) {
+	file := s.adaptFileForHost(c, "fixtures/docker/simple.toml")
+	defer os.Remove(file)
+	// Start a container with some labels
+	labels := map[string]string{
+		types.LabelPrefix + "servicename.frontend.rule": "Host:my.super.host",
+		types.LabelFrontendRule:                         "Host:my.wrong.host",
+		types.LabelPort:                                 "2375",
+	}
+	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")
+
+	// Start traefik
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/version", nil)
+	c.Assert(err, checker.IsNil)
+	req.Host = "my.super.host"
+
+	// FIXME Need to wait than 500 milliseconds more (for swarm or traefik to boot up ?)
+	resp, err := try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	c.Assert(err, checker.IsNil)
+
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, checker.IsNil)
+
+	var version map[string]interface{}
+
+	c.Assert(json.Unmarshal(body, &version), checker.IsNil)
+	c.Assert(version["Version"], checker.Equals, "swarm/1.0.0")
+}
--- a/integration/dynamodb_test.go
+++ b/integration/dynamodb_test.go
@@ -147,7 +147,8 @@ func (s *DynamoDBSuite) TestSimpleConfiguration(c *check.C) {
 	dynamoURL := "http://" + s.composeProject.Container(c, "dynamo").NetworkSettings.IPAddress + ":8000"
 	file := s.adaptFile(c, "fixtures/dynamodb/simple.toml", struct{ DynamoURL string }{dynamoURL})
 	defer os.Remove(file)
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/error_pages_test.go
+++ b/integration/error_pages_test.go
@@ -33,7 +33,8 @@ func (s *ErrorPagesSuite) TestSimpleConfiguration(c *check.C) {
 	}{s.BackendIP, s.ErrorPageIP})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -55,7 +56,8 @@ func (s *ErrorPagesSuite) TestErrorPage(c *check.C) {
 	}{s.BackendIP, s.ErrorPageIP})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/etcd_test.go
+++ b/integration/etcd_test.go
@@ -64,7 +64,8 @@ func (s *EtcdSuite) TestSimpleConfiguration(c *check.C) {
 	file := s.adaptFile(c, "fixtures/etcd/simple.toml", struct{ EtcdHost string }{etcdHost})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -81,7 +82,8 @@ func (s *EtcdSuite) TestNominalConfiguration(c *check.C) {
 	file := s.adaptFile(c, "fixtures/etcd/simple.toml", struct{ EtcdHost string }{etcdHost})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -200,10 +202,11 @@ func (s *EtcdSuite) TestGlobalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)

 	// start traefik
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/simple_web.toml"),
 		"--etcd",
 		"--etcd.endpoint="+etcdHost+":4001")
+	defer display(c)
 	err = cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -279,10 +282,11 @@ func (s *EtcdSuite) TestGlobalConfiguration(c *check.C) {
 func (s *EtcdSuite) TestCertificatesContentstWithSNIConfigHandshake(c *check.C) {
 	etcdHost := s.composeProject.Container(c, "etcd").NetworkSettings.IPAddress
 	// start traefik
-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/simple_web.toml"),
 		"--etcd",
 		"--etcd.endpoint="+etcdHost+":4001")
+	defer display(c)

 	whoami1IP := s.composeProject.Container(c, "whoami1").NetworkSettings.IPAddress
 	whoami2IP := s.composeProject.Container(c, "whoami2").NetworkSettings.IPAddress
@@ -387,10 +391,11 @@ func (s *EtcdSuite) TestCertificatesContentstWithSNIConfigHandshake(c *check.C)
 func (s *EtcdSuite) TestCommandStoreConfig(c *check.C) {
 	etcdHost := s.composeProject.Container(c, "etcd").NetworkSettings.IPAddress

-	cmd, _ := s.cmdTraefik(
+	cmd, display := s.traefikCmd(
 		"storeconfig",
 		withConfigFile("fixtures/simple_web.toml"),
 		"--etcd.endpoint="+etcdHost+":4001")
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)

--- a/integration/eureka_test.go
+++ b/integration/eureka_test.go
@@ -40,7 +40,8 @@ func (s *EurekaSuite) TestSimpleConfiguration(c *check.C) {

 	file := s.adaptFile(c, "fixtures/eureka/simple.toml", struct{ EurekaHost string }{s.eurekaIP})
 	defer os.Remove(file)
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/file_test.go
+++ b/integration/file_test.go
@@ -19,7 +19,8 @@ func (s *FileSuite) SetUpSuite(c *check.C) {
 }

 func (s *FileSuite) TestSimpleConfiguration(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/file/simple.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/file/simple.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -31,7 +32,8 @@ func (s *FileSuite) TestSimpleConfiguration(c *check.C) {

 // #56 regression test, make sure it does not fail
 func (s *FileSuite) TestSimpleConfigurationNoPanic(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/file/56-simple-panic.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/file/56-simple-panic.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -42,8 +44,8 @@ func (s *FileSuite) TestSimpleConfigurationNoPanic(c *check.C) {
 }

 func (s *FileSuite) TestDirectoryConfiguration(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/file/directory.toml"))
-
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/file/directory.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/fixtures/access_log_config.toml
+++ b/integration/fixtures/access_log_config.toml
@@ -9,6 +9,8 @@ defaultEntryPoints = ["http"]
  [entryPoints.http]
  address = ":8000"

+checkNewVersion = false
+
 ################################################################
 # Web configuration backend
 ################################################################
--- a/integration/fixtures/grpc/config_insecure.toml
+++ b/integration/fixtures/grpc/config_insecure.toml
@@ -0,0 +1,29 @@
+defaultEntryPoints = ["https"]
+
+InsecureSkipVerify = true
+
+[entryPoints]
+  [entryPoints.https]
+  address = ":4443"
+    [entryPoints.https.tls]
+     [[entryPoints.https.tls.certificates]]
+     CertFile = """{{ .CertContent }}"""
+     KeyFile  = """{{ .KeyContent }}"""
+
+
+[web]
+  address = ":8080"
+
+[file]
+
+[backends]
+  [backends.backend1]
+    [backends.backend1.servers.server1]
+    url = "https://127.0.0.1:{{ .GRPCServerPort }}"
+
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "Host:127.0.0.1"
--- a/integration/fixtures/healthcheck/port_overload.toml
+++ b/integration/fixtures/healthcheck/port_overload.toml
@@ -0,0 +1,26 @@
+defaultEntryPoints = ["http"]
+
+logLevel = "DEBUG"
+
+[entryPoints]
+  [entryPoints.http]
+  address = ":8000"
+
+[web]
+  address = ":8080"
+
+[file]
+[backends]
+  [backends.backend1]
+    [backends.backend1.healthcheck]
+    path = "/health"
+    port = 80
+    interval = "1s"
+    [backends.backend1.servers.server1]
+    url = "http://{{.Server1}}:81"
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "Host:test.localhost"
--- a/integration/fixtures/log_rotation_config.toml
+++ b/integration/fixtures/log_rotation_config.toml
@@ -9,6 +9,8 @@ defaultEntryPoints = ["http"]
  [entryPoints.http]
  address = ":8000"

+checkNewVersion = false
+
 ################################################################
 # Web configuration backend
 ################################################################
--- a/integration/fixtures/traefik_log_config.toml
+++ b/integration/fixtures/traefik_log_config.toml
@@ -4,8 +4,10 @@
 traefikLogsFile = "traefik.log"
 accessLogsFile = "access.log"
 logLevel = "DEBUG"
-checkNewVersion = false
 defaultEntryPoints = ["http"]
+
+checkNewVersion = false
+
 [entryPoints]
  [entryPoints.http]
  address = ":8000"
--- a/integration/fixtures/websocket/config.toml
+++ b/integration/fixtures/websocket/config.toml
@@ -21,4 +21,4 @@ logLevel = "DEBUG"
  [frontends.frontend1]
  backend = "backend1"
    [frontends.frontend1.routes.test_1]
-    rule = "Path:/ws"
+    rule = "PathPrefix:/ws"
--- a/integration/fixtures/websocket/config_https.toml
+++ b/integration/fixtures/websocket/config_https.toml
@@ -1,6 +1,7 @@
 defaultEntryPoints = ["wss"]

 logLevel = "DEBUG"
+InsecureSkipVerify=true

 [entryPoints]
  [entryPoints.wss]
@@ -24,4 +25,4 @@ logLevel = "DEBUG"
  [frontends.frontend1]
  backend = "backend1"
    [frontends.frontend1.routes.test_1]
-    rule = "Path:/ws"
+    rule = "Path:/echo,/ws"
--- a/integration/grpc_test.go
+++ b/integration/grpc_test.go
@@ -1,8 +1,10 @@
 package integration

 import (
+	"crypto/rand"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"io/ioutil"
 	"net"
 	"os"
@@ -22,9 +24,11 @@ var LocalhostKey []byte
 // GRPCSuite
 type GRPCSuite struct{ BaseSuite }

-type myserver struct{}
+type myserver struct {
+	stopStreamExample chan bool
+}

-func (suite *GRPCSuite) SetUpSuite(c *check.C) {
+func (s *GRPCSuite) SetUpSuite(c *check.C) {
 	var err error
 	LocalhostCert, err = ioutil.ReadFile("./resources/tls/local.cert")
 	c.Assert(err, check.IsNil)
@@ -36,7 +40,15 @@ func (s *myserver) SayHello(ctx context.Context, in *helloworld.HelloRequest) (*
 	return &helloworld.HelloReply{Message: "Hello " + in.Name}, nil
 }

-func startGRPCServer(lis net.Listener) error {
+func (s *myserver) StreamExample(in *helloworld.StreamExampleRequest, server helloworld.Greeter_StreamExampleServer) error {
+	data := make([]byte, 512)
+	rand.Read(data)
+	server.Send(&helloworld.StreamExampleReply{Data: string(data)})
+	<-s.stopStreamExample
+	return nil
+}
+
+func startGRPCServer(lis net.Listener, server *myserver) error {
 	cert, err := tls.X509KeyPair(LocalhostCert, LocalhostKey)
 	if err != nil {
 		return err
@@ -45,26 +57,30 @@ func startGRPCServer(lis net.Listener) error {
 	creds := credentials.NewServerTLSFromCert(&cert)
 	serverOption := grpc.Creds(creds)

-	var s *grpc.Server = grpc.NewServer(serverOption)
+	s := grpc.NewServer(serverOption)
 	defer s.Stop()

-	helloworld.RegisterGreeterServer(s, &myserver{})
+	helloworld.RegisterGreeterServer(s, server)
 	return s.Serve(lis)
 }
-
-func callHelloClientGRPC() (string, error) {
+func getHelloClientGRPC() (helloworld.GreeterClient, func() error, error) {
 	roots := x509.NewCertPool()
 	roots.AppendCertsFromPEM(LocalhostCert)
 	credsClient := credentials.NewClientTLSFromCert(roots, "")
 	conn, err := grpc.Dial("127.0.0.1:4443", grpc.WithTransportCredentials(credsClient))
+	if err != nil {
+		return nil, func() error { return nil }, err
+	}
+	return helloworld.NewGreeterClient(conn), conn.Close, nil
+
+}
+
+func callHelloClientGRPC(name string) (string, error) {
+	client, closer, err := getHelloClientGRPC()
+	defer closer()
 	if err != nil {
 		return "", err
 	}
-
-	defer conn.Close()
-	client := helloworld.NewGreeterClient(conn)
-
-	name := "World"
 	r, err := client.SayHello(context.Background(), &helloworld.HelloRequest{Name: name})
 	if err != nil {
 		return "", err
@@ -72,18 +88,31 @@ func callHelloClientGRPC() (string, error) {
 	return r.Message, nil
 }

-func (suite *GRPCSuite) TestGRPC(c *check.C) {
+func callStreamExampleClientGRPC() (helloworld.Greeter_StreamExampleClient, func() error, error) {
+	client, closer, err := getHelloClientGRPC()
+	if err != nil {
+		return nil, closer, err
+	}
+	t, err := client.StreamExample(context.Background(), &helloworld.StreamExampleRequest{})
+	if err != nil {
+		return nil, closer, err
+	}
+
+	return t, closer, nil
+}
+
+func (s *GRPCSuite) TestGRPC(c *check.C) {
 	lis, err := net.Listen("tcp", ":0")
 	_, port, err := net.SplitHostPort(lis.Addr().String())
 	c.Assert(err, check.IsNil)

 	go func() {
-		err := startGRPCServer(lis)
+		err := startGRPCServer(lis, &myserver{})
 		c.Log(err)
 		c.Assert(err, check.IsNil)
 	}()

-	file := suite.adaptFile(c, "fixtures/grpc/config.toml", struct {
+	file := s.adaptFile(c, "fixtures/grpc/config.toml", struct {
 		CertContent    string
 		KeyContent     string
 		GRPCServerPort string
@@ -94,7 +123,8 @@ func (suite *GRPCSuite) TestGRPC(c *check.C) {
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)

 	err = cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -105,10 +135,110 @@ func (suite *GRPCSuite) TestGRPC(c *check.C) {
 	c.Assert(err, check.IsNil)
 	var response string
 	err = try.Do(1*time.Second, func() error {
-		response, err = callHelloClientGRPC()
+		response, err = callHelloClientGRPC("World")
 		return err
 	})

 	c.Assert(err, check.IsNil)
 	c.Assert(response, check.Equals, "Hello World")
 }
+
+func (s *GRPCSuite) TestGRPCInsecure(c *check.C) {
+	lis, err := net.Listen("tcp", ":0")
+	_, port, err := net.SplitHostPort(lis.Addr().String())
+	c.Assert(err, check.IsNil)
+
+	go func() {
+		err := startGRPCServer(lis, &myserver{})
+		c.Log(err)
+		c.Assert(err, check.IsNil)
+	}()
+
+	file := s.adaptFile(c, "fixtures/grpc/config_insecure.toml", struct {
+		CertContent    string
+		KeyContent     string
+		GRPCServerPort string
+	}{
+		CertContent:    string(LocalhostCert),
+		KeyContent:     string(LocalhostKey),
+		GRPCServerPort: port,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+
+	err = cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for Traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 1*time.Second, try.BodyContains("Host:127.0.0.1"))
+	c.Assert(err, check.IsNil)
+	var response string
+	err = try.Do(1*time.Second, func() error {
+		response, err = callHelloClientGRPC("World")
+		return err
+	})
+
+	c.Assert(err, check.IsNil)
+	c.Assert(response, check.Equals, "Hello World")
+}
+
+func (s *GRPCSuite) TestGRPCBuffer(c *check.C) {
+	stopStreamExample := make(chan bool)
+	defer func() { stopStreamExample <- true }()
+	lis, err := net.Listen("tcp", ":0")
+	_, port, err := net.SplitHostPort(lis.Addr().String())
+	c.Assert(err, check.IsNil)
+
+	go func() {
+		err := startGRPCServer(lis, &myserver{
+			stopStreamExample: stopStreamExample,
+		})
+		c.Log(err)
+		c.Assert(err, check.IsNil)
+	}()
+
+	file := s.adaptFile(c, "fixtures/grpc/config.toml", struct {
+		CertContent    string
+		KeyContent     string
+		GRPCServerPort string
+	}{
+		CertContent:    string(LocalhostCert),
+		KeyContent:     string(LocalhostKey),
+		GRPCServerPort: port,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+
+	err = cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for Traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 1*time.Second, try.BodyContains("Host:127.0.0.1"))
+	c.Assert(err, check.IsNil)
+	var client helloworld.Greeter_StreamExampleClient
+	client, closer, err := callStreamExampleClientGRPC()
+	defer closer()
+
+	received := make(chan bool)
+	go func() {
+		tr, _ := client.Recv()
+		c.Assert(len(tr.Data), check.Equals, 512)
+		received <- true
+	}()
+
+	err = try.Do(time.Second*10, func() error {
+		select {
+		case <-received:
+			return nil
+		default:
+			return errors.New("failed to receive stream data")
+		}
+	})
+	c.Assert(err, check.IsNil)
+}
--- a/integration/healthcheck_test.go
+++ b/integration/healthcheck_test.go
@@ -34,7 +34,8 @@ func (s *HealthCheckSuite) TestSimpleConfiguration(c *check.C) {
 	}{s.whoami1IP, s.whoami2IP})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -112,7 +113,8 @@ func (s *HealthCheckSuite) doTestMultipleEntrypoints(c *check.C, fixture string)
 	}{s.whoami1IP, s.whoami2IP})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -163,3 +165,50 @@ func (s *HealthCheckSuite) doTestMultipleEntrypoints(c *check.C, fixture string)
 	err = try.Request(frontend1Req, 2*time.Second, try.BodyContains(s.whoami1IP))
 	c.Assert(err, checker.Not(checker.IsNil))
 }
+
+func (s *HealthCheckSuite) TestPortOverload(c *check.C) {
+
+	// Set one whoami health to 200
+	client := &http.Client{}
+	statusInternalServerErrorReq, err := http.NewRequest(http.MethodPost, "http://"+s.whoami1IP+"/health", bytes.NewBuffer([]byte("200")))
+	c.Assert(err, checker.IsNil)
+	_, err = client.Do(statusInternalServerErrorReq)
+	c.Assert(err, checker.IsNil)
+
+	file := s.adaptFile(c, "fixtures/healthcheck/port_overload.toml", struct {
+		Server1 string
+	}{s.whoami1IP})
+	defer os.Remove(file)
+
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+	err = cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("Host:test.localhost"))
+	c.Assert(err, checker.IsNil)
+
+	frontendHealthReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/health", nil)
+	c.Assert(err, checker.IsNil)
+	frontendHealthReq.Host = "test.localhost"
+
+	//We test bad gateway because we use an invalid port for the backend
+	err = try.Request(frontendHealthReq, 500*time.Millisecond, try.StatusCodeIs(http.StatusBadGateway))
+	c.Assert(err, checker.IsNil)
+
+	// Set one whoami health to 500
+	statusInternalServerErrorReq, err = http.NewRequest(http.MethodPost, "http://"+s.whoami1IP+"/health", bytes.NewBuffer([]byte("500")))
+	c.Assert(err, checker.IsNil)
+	_, err = client.Do(statusInternalServerErrorReq)
+	c.Assert(err, checker.IsNil)
+
+	// Waiting for Traefik healthcheck
+	try.Sleep(2 * time.Second)
+
+	// Verify no backend service is available due to failing health checks
+	err = try.Request(frontendHealthReq, 3*time.Second, try.StatusCodeIs(http.StatusServiceUnavailable))
+	c.Assert(err, checker.IsNil)
+
+}
--- a/integration/helloworld/helloworld.pb.go
+++ b/integration/helloworld/helloworld.pb.go
@@ -10,6 +10,8 @@ It is generated from these files:
 It has these top-level messages:
 	HelloRequest
 	HelloReply
+	StreamExampleRequest
+	StreamExampleReply
 */
 package helloworld

@@ -67,9 +69,35 @@ func (m *HelloReply) GetMessage() string {
 	return ""
 }

+type StreamExampleRequest struct {
+}
+
+func (m *StreamExampleRequest) Reset()                    { *m = StreamExampleRequest{} }
+func (m *StreamExampleRequest) String() string            { return proto.CompactTextString(m) }
+func (*StreamExampleRequest) ProtoMessage()               {}
+func (*StreamExampleRequest) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{2} }
+
+type StreamExampleReply struct {
+	Data string `protobuf:"bytes,1,opt,name=data" json:"data,omitempty"`
+}
+
+func (m *StreamExampleReply) Reset()                    { *m = StreamExampleReply{} }
+func (m *StreamExampleReply) String() string            { return proto.CompactTextString(m) }
+func (*StreamExampleReply) ProtoMessage()               {}
+func (*StreamExampleReply) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{3} }
+
+func (m *StreamExampleReply) GetData() string {
+	if m != nil {
+		return m.Data
+	}
+	return ""
+}
+
 func init() {
 	proto.RegisterType((*HelloRequest)(nil), "helloworld.HelloRequest")
 	proto.RegisterType((*HelloReply)(nil), "helloworld.HelloReply")
+	proto.RegisterType((*StreamExampleRequest)(nil), "helloworld.StreamExampleRequest")
+	proto.RegisterType((*StreamExampleReply)(nil), "helloworld.StreamExampleReply")
 }

 // Reference imports to suppress errors if they are not otherwise used.
@@ -85,6 +113,8 @@ const _ = grpc.SupportPackageIsVersion4
 type GreeterClient interface {
 	// Sends a greeting
 	SayHello(ctx context.Context, in *HelloRequest, opts ...grpc.CallOption) (*HelloReply, error)
+	// Tick me
+	StreamExample(ctx context.Context, in *StreamExampleRequest, opts ...grpc.CallOption) (Greeter_StreamExampleClient, error)
 }

 type greeterClient struct {
@@ -104,11 +134,45 @@ func (c *greeterClient) SayHello(ctx context.Context, in *HelloRequest, opts ...
 	return out, nil
 }

+func (c *greeterClient) StreamExample(ctx context.Context, in *StreamExampleRequest, opts ...grpc.CallOption) (Greeter_StreamExampleClient, error) {
+	stream, err := grpc.NewClientStream(ctx, &_Greeter_serviceDesc.Streams[0], c.cc, "/helloworld.Greeter/StreamExample", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &greeterStreamExampleClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Greeter_StreamExampleClient interface {
+	Recv() (*StreamExampleReply, error)
+	grpc.ClientStream
+}
+
+type greeterStreamExampleClient struct {
+	grpc.ClientStream
+}
+
+func (x *greeterStreamExampleClient) Recv() (*StreamExampleReply, error) {
+	m := new(StreamExampleReply)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
 // Server API for Greeter service

 type GreeterServer interface {
 	// Sends a greeting
 	SayHello(context.Context, *HelloRequest) (*HelloReply, error)
+	// Tick me
+	StreamExample(*StreamExampleRequest, Greeter_StreamExampleServer) error
 }

 func RegisterGreeterServer(s *grpc.Server, srv GreeterServer) {
@@ -133,6 +197,27 @@ func _Greeter_SayHello_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }

+func _Greeter_StreamExample_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamExampleRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(GreeterServer).StreamExample(m, &greeterStreamExampleServer{stream})
+}
+
+type Greeter_StreamExampleServer interface {
+	Send(*StreamExampleReply) error
+	grpc.ServerStream
+}
+
+type greeterStreamExampleServer struct {
+	grpc.ServerStream
+}
+
+func (x *greeterStreamExampleServer) Send(m *StreamExampleReply) error {
+	return x.ServerStream.SendMsg(m)
+}
+
 var _Greeter_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "helloworld.Greeter",
 	HandlerType: (*GreeterServer)(nil),
@@ -142,23 +227,33 @@ var _Greeter_serviceDesc = grpc.ServiceDesc{
 			Handler:    _Greeter_SayHello_Handler,
 		},
 	},
-	Streams:  []grpc.StreamDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StreamExample",
+			Handler:       _Greeter_StreamExample_Handler,
+			ServerStreams: true,
+		},
+	},
 	Metadata: "helloworld.proto",
 }

 func init() { proto.RegisterFile("helloworld.proto", fileDescriptor0) }

 var fileDescriptor0 = []byte{
-	// 175 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x12, 0xc8, 0x48, 0xcd, 0xc9,
-	0xc9, 0x2f, 0xcf, 0x2f, 0xca, 0x49, 0xd1, 0x2b, 0x28, 0xca, 0x2f, 0xc9, 0x17, 0xe2, 0x42, 0x88,
-	0x28, 0x29, 0x71, 0xf1, 0x78, 0x80, 0x78, 0x41, 0xa9, 0x85, 0xa5, 0xa9, 0xc5, 0x25, 0x42, 0x42,
-	0x5c, 0x2c, 0x79, 0x89, 0xb9, 0xa9, 0x12, 0x8c, 0x0a, 0x8c, 0x1a, 0x9c, 0x41, 0x60, 0xb6, 0x92,
-	0x1a, 0x17, 0x17, 0x54, 0x4d, 0x41, 0x4e, 0xa5, 0x90, 0x04, 0x17, 0x7b, 0x6e, 0x6a, 0x71, 0x71,
-	0x62, 0x3a, 0x4c, 0x11, 0x8c, 0x6b, 0xe4, 0xc9, 0xc5, 0xee, 0x5e, 0x94, 0x9a, 0x5a, 0x92, 0x5a,
-	0x24, 0x64, 0xc7, 0xc5, 0x11, 0x9c, 0x58, 0x09, 0xd6, 0x25, 0x24, 0xa1, 0x87, 0xe4, 0x02, 0x64,
-	0xcb, 0xa4, 0xc4, 0xb0, 0xc8, 0x14, 0xe4, 0x54, 0x2a, 0x31, 0x38, 0x19, 0x70, 0x49, 0x67, 0xe6,
-	0xeb, 0xa5, 0x17, 0x15, 0x24, 0xeb, 0xa5, 0x56, 0x24, 0xe6, 0x16, 0xe4, 0xa4, 0x16, 0x23, 0xa9,
-	0x75, 0xe2, 0x07, 0x2b, 0x0e, 0x07, 0xb1, 0x03, 0x40, 0x5e, 0x0a, 0x60, 0x4c, 0x62, 0x03, 0xfb,
-	0xcd, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0x0f, 0xb7, 0xcd, 0xf2, 0xef, 0x00, 0x00, 0x00,
+	// 231 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x7c, 0x50, 0xc1, 0x4a, 0xc4, 0x30,
+	0x10, 0x35, 0xb0, 0xb8, 0x3a, 0x28, 0xca, 0x20, 0x4b, 0x59, 0x41, 0x96, 0x1c, 0x64, 0x4f, 0xa1,
+	0xe8, 0xdd, 0x43, 0x41, 0xf4, 0x58, 0x5a, 0xc4, 0x73, 0xb4, 0x43, 0x15, 0x12, 0x13, 0x93, 0x88,
+	0xf6, 0x6f, 0xfc, 0x54, 0x49, 0x6c, 0x31, 0x4a, 0xf1, 0xf6, 0x66, 0xe6, 0xe5, 0xbd, 0x97, 0x07,
+	0xc7, 0x4f, 0xa4, 0x94, 0x79, 0x37, 0x4e, 0x75, 0xc2, 0x3a, 0x13, 0x0c, 0xc2, 0xcf, 0x86, 0x73,
+	0x38, 0xb8, 0x8d, 0x53, 0x43, 0xaf, 0x6f, 0xe4, 0x03, 0x22, 0x2c, 0x5e, 0xa4, 0xa6, 0x82, 0x6d,
+	0xd8, 0x76, 0xbf, 0x49, 0x98, 0x9f, 0x03, 0x8c, 0x1c, 0xab, 0x06, 0x2c, 0x60, 0xa9, 0xc9, 0x7b,
+	0xd9, 0x4f, 0xa4, 0x69, 0xe4, 0x2b, 0x38, 0x69, 0x83, 0x23, 0xa9, 0xaf, 0x3f, 0xa4, 0xb6, 0x8a,
+	0x46, 0x4d, 0xbe, 0x05, 0xfc, 0xb3, 0x8f, 0x3a, 0x08, 0x8b, 0x4e, 0x06, 0x39, 0x39, 0x45, 0x7c,
+	0xf1, 0xc9, 0x60, 0x79, 0xe3, 0x88, 0x02, 0x39, 0xbc, 0x82, 0xbd, 0x56, 0x0e, 0xc9, 0x18, 0x0b,
+	0x91, 0x7d, 0x22, 0xcf, 0xbb, 0x5e, 0xcd, 0x5c, 0xac, 0x1a, 0xf8, 0x0e, 0xde, 0xc1, 0xe1, 0x2f,
+	0x57, 0xdc, 0xe4, 0xd4, 0xb9, 0xa0, 0xeb, 0xb3, 0x7f, 0x18, 0x49, 0xb4, 0x64, 0x55, 0x09, 0xa7,
+	0xcf, 0x46, 0xf4, 0xce, 0x3e, 0x0a, 0xfa, 0xbe, 0xf9, 0xec, 0x55, 0x75, 0x94, 0x32, 0xdc, 0x47,
+	0x5c, 0xc7, 0xb2, 0x6b, 0xf6, 0xb0, 0x9b, 0x5a, 0xbf, 0xfc, 0x0a, 0x00, 0x00, 0xff, 0xff, 0x6f,
+	0x5f, 0xae, 0xb8, 0x89, 0x01, 0x00, 0x00,
 }
--- a/integration/helloworld/helloworld.proto
+++ b/integration/helloworld/helloworld.proto
@@ -9,7 +9,10 @@ package helloworld;
 // The greeting service definition.
 service Greeter {
  // Sends a greeting
-  rpc SayHello (HelloRequest) returns (HelloReply) {}
+  rpc SayHello (HelloRequest) returns (HelloReply) {};
+
+  rpc StreamExample (StreamExampleRequest) returns (stream StreamExampleReply) {};
+
 }

 // The request message containing the user's name.
@@ -21,3 +24,9 @@ message HelloRequest {
 message HelloReply {
  string message = 1;
 }
+
+message StreamExampleRequest {}
+
+message StreamExampleReply {
+    string data = 1;
+}
--- a/integration/https_test.go
+++ b/integration/https_test.go
@@ -20,7 +20,8 @@ type HTTPSSuite struct{ BaseSuite }
 // "snitest.com", which happens to match the CN of 'snitest.com.crt'. The test
 // verifies that traefik presents the correct certificate.
 func (s *HTTPSSuite) TestWithSNIConfigHandshake(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/https/https_sni.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/https_sni.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -53,7 +54,8 @@ func (s *HTTPSSuite) TestWithSNIConfigHandshake(c *check.C) {
 // SNI hostnames of "snitest.org" and "snitest.com". The test verifies
 // that traefik routes the requests to the expected backends.
 func (s *HTTPSSuite) TestWithSNIConfigRoute(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/https/https_sni.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/https_sni.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -111,7 +113,8 @@ func (s *HTTPSSuite) TestWithSNIConfigRoute(c *check.C) {
 // TestWithClientCertificateAuthentication
 // The client has to send a certificate signed by a CA trusted by the server
 func (s *HTTPSSuite) TestWithClientCertificateAuthentication(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/https/clientca/https_1ca1config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/clientca/https_1ca1config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -157,7 +160,8 @@ func (s *HTTPSSuite) TestWithClientCertificateAuthentication(c *check.C) {
 // TestWithClientCertificateAuthentication
 // Use two CA:s and test that clients with client signed by either of them can connect
 func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipeCAs(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/https/clientca/https_2ca1config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/clientca/https_2ca1config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -217,7 +221,8 @@ func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipeCAs(c *check.
 // TestWithClientCertificateAuthentication
 // Use two CA:s in two different files and test that clients with client signed by either of them can connect
 func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipeCAsMultipleFiles(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/https/clientca/https_2ca2config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/clientca/https_2ca2config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -281,7 +286,8 @@ func (s *HTTPSSuite) TestWithRootCAsContentForHTTPSOnBackend(c *check.C) {

 	file := s.adaptFile(c, "fixtures/https/rootcas/https.toml", struct{ BackendHost string }{backend.URL})
 	defer os.Remove(file)
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -302,7 +308,8 @@ func (s *HTTPSSuite) TestWithRootCAsFileForHTTPSOnBackend(c *check.C) {

 	file := s.adaptFile(c, "fixtures/https/rootcas/https_with_file.toml", struct{ BackendHost string }{backend.URL})
 	defer os.Remove(file)
-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 	"text/template"

+	"github.com/containous/traefik/log"
 	"github.com/go-check/check"
 	compose "github.com/libkermit/compose/check"
 	checker "github.com/vdemeester/shakers"
@@ -87,12 +88,21 @@ func (s *BaseSuite) cmdTraefik(args ...string) (*exec.Cmd, *bytes.Buffer) {
 	return cmd, &out
 }

+func (s *BaseSuite) traefikCmd(args ...string) (*exec.Cmd, func(*check.C)) {
+	cmd, out := s.cmdTraefik(args...)
+	return cmd, func(c *check.C) {
+		if c.Failed() {
+			s.displayTraefikLog(c, out)
+		}
+	}
+}
+
 func (s *BaseSuite) displayTraefikLog(c *check.C, output *bytes.Buffer) {
 	if output == nil || output.Len() == 0 {
-		fmt.Printf("%s: No Traefik logs present.", c.TestName())
+		log.Printf("%s: No Traefik logs.", c.TestName())
 	} else {
-		fmt.Printf("%s: Traefik logs: ", c.TestName())
-		fmt.Println(output.String())
+		log.Printf("%s: Traefik logs: ", c.TestName())
+		log.Println(output.String())
 	}
 }

--- a/integration/log_rotation_test.go
+++ b/integration/log_rotation_test.go
@@ -20,7 +20,8 @@ type LogRotationSuite struct{ BaseSuite }

 func (s *LogRotationSuite) TestAccessLogRotation(c *check.C) {
 	// Start Traefik
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/access_log_config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -56,10 +57,19 @@ func (s *LogRotationSuite) TestAccessLogRotation(c *check.C) {
 	c.Assert(err, checker.IsNil)

 	// Verify access.log.rotated output as expected
+	logAccessLogFile(c, traefikTestAccessLogFile+".rotated")
 	lineCount := verifyLogLines(c, traefikTestAccessLogFile+".rotated", 0, true)
 	c.Assert(lineCount, checker.GreaterOrEqualThan, 1)

+	// make sure that the access log file is at least created before we do assertions on it
+	err = try.Do(1*time.Second, func() error {
+		_, err := os.Stat(traefikTestAccessLogFile)
+		return err
+	})
+	c.Assert(err, checker.IsNil, check.Commentf("access log file was not created in time"))
+
 	// Verify access.log output as expected
+	logAccessLogFile(c, traefikTestAccessLogFile)
 	lineCount = verifyLogLines(c, traefikTestAccessLogFile, lineCount, true)
 	c.Assert(lineCount, checker.Equals, 3)

@@ -68,7 +78,8 @@ func (s *LogRotationSuite) TestAccessLogRotation(c *check.C) {

 func (s *LogRotationSuite) TestTraefikLogRotation(c *check.C) {
 	// Start Traefik
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/traefik_log_config.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/traefik_log_config.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -109,6 +120,12 @@ func (s *LogRotationSuite) TestTraefikLogRotation(c *check.C) {
 	c.Assert(lineCount, checker.GreaterOrEqualThan, 7)
 }

+func logAccessLogFile(c *check.C, fileName string) {
+	output, err := ioutil.ReadFile(fileName)
+	c.Assert(err, checker.IsNil)
+	c.Logf("Contents of file %s\n%s", fileName, string(output))
+}
+
 func verifyEmptyErrorLog(c *check.C, name string) {
 	err := try.Do(5*time.Second, func() error {
 		traefikLog, e2 := ioutil.ReadFile(name)
@@ -128,7 +145,6 @@ func verifyLogLines(c *check.C, fileName string, countInit int, accessLog bool)
 	count := countInit
 	for rotatedLog.Scan() {
 		line := rotatedLog.Text()
-		c.Log(line)
 		if accessLog {
 			if len(line) > 0 {
 				CheckAccessLogFormat(c, line, count)
--- a/integration/marathon_test.go
+++ b/integration/marathon_test.go
@@ -88,7 +88,8 @@ func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 		MarathonURL string
 	}{s.marathonURL})
 	defer os.Remove(file)
-	cmd, output := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
@@ -103,16 +104,6 @@ func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 	client, err := marathon.NewClient(config)
 	c.Assert(err, checker.IsNil)

-	// Show the Traefik log if any assertion fails. If the entire test runs
-	// to a successful completion, we flip the flag at the very end and don't
-	// display anything.
-	showTraefikLog := true
-	defer func() {
-		if showTraefikLog {
-			s.displayTraefikLog(c, output)
-		}
-	}()
-
 	// Create test application to be deployed.
 	app := marathon.NewDockerApplication().
 		Name("/whoami").
@@ -146,6 +137,4 @@ func (s *MarathonSuite) TestConfigurationUpdate(c *check.C) {
 	// Query application via Traefik.
 	err = try.GetRequest("http://127.0.0.1:8000/app", 30*time.Second, try.StatusCodeIs(http.StatusOK))
 	c.Assert(err, checker.IsNil)
-
-	showTraefikLog = false
 }
--- a/integration/mesos_test.go
+++ b/integration/mesos_test.go
@@ -17,7 +17,8 @@ func (s *MesosSuite) SetUpSuite(c *check.C) {
 }

 func (s *MesosSuite) TestSimpleConfiguration(c *check.C) {
-	cmd, _ := s.cmdTraefik(withConfigFile("fixtures/mesos/simple.toml"))
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/mesos/simple.toml"))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/resources/compose/consul_catalog.yml
+++ b/integration/resources/compose/consul_catalog.yml
@@ -1,6 +1,6 @@
 consul:
-  image: progrium/consul
-  command: -server -bootstrap -log-level debug -ui-dir /ui
+  image: consul
+  command: agent -server -bootstrap-expect 1 -client 0.0.0.0 -log-level debug -ui
  ports:
    - "8400:8400"
    - "8500:8500"
@@ -15,3 +15,5 @@ nginx1:
  image: nginx:alpine
 nginx2:
  image: nginx:alpine
+nginx3:
+  image: nginx:alpine
--- a/integration/timeout_test.go
+++ b/integration/timeout_test.go
@@ -24,7 +24,8 @@ func (s *TimeoutSuite) TestForwardingTimeouts(c *check.C) {
 	}{httpTimeoutEndpoint})
 	defer os.Remove(file)

-	cmd, _ := s.cmdTraefik(withConfigFile(file))
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
--- a/integration/websocket_test.go
+++ b/integration/websocket_test.go
@@ -3,6 +3,7 @@ package integration
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/base64"
 	"io/ioutil"
 	"net"
 	"net/http"
@@ -20,7 +21,7 @@ import (
 // WebsocketSuite
 type WebsocketSuite struct{ BaseSuite }

-func (suite *WebsocketSuite) TestBase(c *check.C) {
+func (s *WebsocketSuite) TestBase(c *check.C) {
 	var upgrader = gorillawebsocket.Upgrader{} // use default options

 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -41,14 +42,15 @@ func (suite *WebsocketSuite) TestBase(c *check.C) {
 		}
 	}))

-	file := suite.adaptFile(c, "fixtures/websocket/config.toml", struct {
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
 		WebsocketServer string
 	}{
 		WebsocketServer: srv.URL,
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file), "--debug")
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)

 	err := cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -69,7 +71,7 @@ func (suite *WebsocketSuite) TestBase(c *check.C) {
 	c.Assert(string(msg), checker.Equals, "OK")
 }

-func (suite *WebsocketSuite) TestWrongOrigin(c *check.C) {
+func (s *WebsocketSuite) TestWrongOrigin(c *check.C) {
 	var upgrader = gorillawebsocket.Upgrader{} // use default options

 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -90,14 +92,15 @@ func (suite *WebsocketSuite) TestWrongOrigin(c *check.C) {
 		}
 	}))

-	file := suite.adaptFile(c, "fixtures/websocket/config.toml", struct {
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
 		WebsocketServer string
 	}{
 		WebsocketServer: srv.URL,
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file), "--debug")
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)

 	err := cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -117,7 +120,7 @@ func (suite *WebsocketSuite) TestWrongOrigin(c *check.C) {
 	c.Assert(err, checker.ErrorMatches, "bad status")
 }

-func (suite *WebsocketSuite) TestOrigin(c *check.C) {
+func (s *WebsocketSuite) TestOrigin(c *check.C) {
 	// use default options
 	var upgrader = gorillawebsocket.Upgrader{}

@@ -139,14 +142,15 @@ func (suite *WebsocketSuite) TestOrigin(c *check.C) {
 		}
 	}))

-	file := suite.adaptFile(c, "fixtures/websocket/config.toml", struct {
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
 		WebsocketServer string
 	}{
 		WebsocketServer: srv.URL,
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file), "--debug")
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)

 	err := cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -176,7 +180,7 @@ func (suite *WebsocketSuite) TestOrigin(c *check.C) {

 }

-func (suite *WebsocketSuite) TestWrongOriginIgnoredByServer(c *check.C) {
+func (s *WebsocketSuite) TestWrongOriginIgnoredByServer(c *check.C) {
 	var upgrader = gorillawebsocket.Upgrader{CheckOrigin: func(r *http.Request) bool {
 		return true
 	}}
@@ -199,14 +203,15 @@ func (suite *WebsocketSuite) TestWrongOriginIgnoredByServer(c *check.C) {
 		}
 	}))

-	file := suite.adaptFile(c, "fixtures/websocket/config.toml", struct {
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
 		WebsocketServer string
 	}{
 		WebsocketServer: srv.URL,
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file), "--debug")
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)

 	err := cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -236,7 +241,7 @@ func (suite *WebsocketSuite) TestWrongOriginIgnoredByServer(c *check.C) {

 }

-func (suite *WebsocketSuite) TestSSLTermination(c *check.C) {
+func (s *WebsocketSuite) TestSSLTermination(c *check.C) {
 	var upgrader = gorillawebsocket.Upgrader{} // use default options

 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -256,14 +261,15 @@ func (suite *WebsocketSuite) TestSSLTermination(c *check.C) {
 			}
 		}
 	}))
-	file := suite.adaptFile(c, "fixtures/websocket/config_https.toml", struct {
+	file := s.adaptFile(c, "fixtures/websocket/config_https.toml", struct {
 		WebsocketServer string
 	}{
 		WebsocketServer: srv.URL,
 	})

 	defer os.Remove(file)
-	cmd, _ := suite.cmdTraefik(withConfigFile(file), "--debug")
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)

 	err := cmd.Start()
 	c.Assert(err, check.IsNil)
@@ -290,3 +296,210 @@ func (suite *WebsocketSuite) TestSSLTermination(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	c.Assert(string(msg), checker.Equals, "OK")
 }
+
+func (s *WebsocketSuite) TestBasicAuth(c *check.C) {
+	var upgrader = gorillawebsocket.Upgrader{} // use default options
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r, nil)
+
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+
+		user, password, _ := r.BasicAuth()
+		c.Assert(user, check.Equals, "traefiker")
+		c.Assert(password, check.Equals, "secret")
+
+		for {
+			mt, message, err := conn.ReadMessage()
+			if err != nil {
+				break
+			}
+			err = conn.WriteMessage(mt, message)
+			if err != nil {
+				break
+			}
+		}
+	}))
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
+		WebsocketServer string
+	}{
+		WebsocketServer: srv.URL,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)
+
+	err := cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("127.0.0.1"))
+	c.Assert(err, checker.IsNil)
+
+	config, err := websocket.NewConfig("ws://127.0.0.1:8000/ws", "ws://127.0.0.1:8000")
+	auth := "traefiker:secret"
+	config.Header.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(auth)))
+
+	c.Assert(err, check.IsNil)
+
+	conn, err := net.DialTimeout("tcp", "127.0.0.1:8000", time.Second)
+	c.Assert(err, checker.IsNil)
+	client, err := websocket.NewClient(config, conn)
+	c.Assert(err, checker.IsNil)
+
+	n, err := client.Write([]byte("OK"))
+	c.Assert(err, checker.IsNil)
+	c.Assert(n, checker.Equals, 2)
+
+	msg := make([]byte, 2)
+	n, err = client.Read(msg)
+	c.Assert(err, checker.IsNil)
+	c.Assert(n, checker.Equals, 2)
+	c.Assert(string(msg), checker.Equals, "OK")
+}
+
+func (s *WebsocketSuite) TestSpecificResponseFromBackend(c *check.C) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(401)
+	}))
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
+		WebsocketServer string
+	}{
+		WebsocketServer: srv.URL,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)
+
+	err := cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("127.0.0.1"))
+	c.Assert(err, checker.IsNil)
+
+	_, resp, err := gorillawebsocket.DefaultDialer.Dial("ws://127.0.0.1:8000/ws", nil)
+	c.Assert(err, checker.NotNil)
+	c.Assert(resp.StatusCode, check.Equals, 401)
+
+}
+
+func (s *WebsocketSuite) TestURLWithURLEncodedChar(c *check.C) {
+	var upgrader = gorillawebsocket.Upgrader{} // use default options
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c.Assert(r.URL.Path, check.Equals, "/ws/http%3A%2F%2Ftest")
+		conn, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		for {
+			mt, message, err := conn.ReadMessage()
+			if err != nil {
+				break
+			}
+			err = conn.WriteMessage(mt, message)
+			if err != nil {
+				break
+			}
+		}
+	}))
+
+	file := s.adaptFile(c, "fixtures/websocket/config.toml", struct {
+		WebsocketServer string
+	}{
+		WebsocketServer: srv.URL,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug")
+	defer display(c)
+
+	err := cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("127.0.0.1"))
+	c.Assert(err, checker.IsNil)
+
+	conn, _, err := gorillawebsocket.DefaultDialer.Dial("ws://127.0.0.1:8000/ws/http%3A%2F%2Ftest", nil)
+	c.Assert(err, checker.IsNil)
+
+	err = conn.WriteMessage(gorillawebsocket.TextMessage, []byte("OK"))
+	c.Assert(err, checker.IsNil)
+
+	_, msg, err := conn.ReadMessage()
+	c.Assert(err, checker.IsNil)
+	c.Assert(string(msg), checker.Equals, "OK")
+}
+
+func (s *WebsocketSuite) TestSSLhttp2(c *check.C) {
+	var upgrader = gorillawebsocket.Upgrader{} // use default options
+
+	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c, err := upgrader.Upgrade(w, r, nil)
+		if err != nil {
+			return
+		}
+		defer c.Close()
+		for {
+			mt, message, err := c.ReadMessage()
+			if err != nil {
+				break
+			}
+			err = c.WriteMessage(mt, message)
+			if err != nil {
+				break
+			}
+		}
+	}))
+
+	ts.TLS = &tls.Config{}
+	ts.TLS.NextProtos = append(ts.TLS.NextProtos, `h2`)
+	ts.TLS.NextProtos = append(ts.TLS.NextProtos, `http/1.1`)
+	ts.StartTLS()
+
+	file := s.adaptFile(c, "fixtures/websocket/config_https.toml", struct {
+		WebsocketServer string
+	}{
+		WebsocketServer: ts.URL,
+	})
+
+	defer os.Remove(file)
+	cmd, display := s.traefikCmd(withConfigFile(file), "--debug", "--accesslog")
+	defer display(c)
+
+	err := cmd.Start()
+	c.Assert(err, check.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.BodyContains("127.0.0.1"))
+	c.Assert(err, checker.IsNil)
+
+	//Add client self-signed cert
+	roots := x509.NewCertPool()
+	certContent, err := ioutil.ReadFile("./resources/tls/local.cert")
+	roots.AppendCertsFromPEM(certContent)
+	gorillawebsocket.DefaultDialer.TLSClientConfig = &tls.Config{
+		RootCAs: roots,
+	}
+	conn, _, err := gorillawebsocket.DefaultDialer.Dial("wss://127.0.0.1:8000/echo", nil)
+	c.Assert(err, checker.IsNil)
+
+	err = conn.WriteMessage(gorillawebsocket.TextMessage, []byte("OK"))
+	c.Assert(err, checker.IsNil)
+
+	_, msg, err := conn.ReadMessage()
+	c.Assert(err, checker.IsNil)
+	c.Assert(string(msg), checker.Equals, "OK")
+}
--- a/log/logger.go
+++ b/log/logger.go
@@ -227,8 +227,10 @@ func RotateFile() error {
 		return nil
 	}

-	if err := CloseFile(); err != nil {
-		return fmt.Errorf("error closing log file: %s", err)
+	if logFile != nil {
+		defer func(f *os.File) {
+			f.Close()
+		}(logFile)
 	}

 	if err := OpenFile(logFilePath); err != nil {
--- a/log/logger_test.go
+++ b/log/logger_test.go
@@ -0,0 +1,79 @@
+package log
+
+import (
+	"io/ioutil"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLogRotation(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "traefik_")
+	if err != nil {
+		t.Fatalf("Error setting up temporary directory: %s", err)
+	}
+
+	fileName := tempDir + "traefik.log"
+	if err := OpenFile(fileName); err != nil {
+		t.Fatalf("Error opening temporary file %s: %s", fileName, err)
+	}
+	defer CloseFile()
+
+	rotatedFileName := fileName + ".rotated"
+
+	iterations := 20
+	halfDone := make(chan bool)
+	writeDone := make(chan bool)
+	go func() {
+		for i := 0; i < iterations; i++ {
+			Println("Test log line")
+			if i == iterations/2 {
+				halfDone <- true
+			}
+		}
+		writeDone <- true
+	}()
+
+	<-halfDone
+	err = os.Rename(fileName, rotatedFileName)
+	if err != nil {
+		t.Fatalf("Error renaming file: %s", err)
+	}
+
+	err = RotateFile()
+	if err != nil {
+		t.Fatalf("Error rotating file: %s", err)
+	}
+
+	select {
+	case <-writeDone:
+		gotLineCount := lineCount(t, fileName) + lineCount(t, rotatedFileName)
+		if iterations != gotLineCount {
+			t.Errorf("Wanted %d written log lines, got %d", iterations, gotLineCount)
+		}
+	case <-time.After(500 * time.Millisecond):
+		t.Fatalf("test timed out")
+	}
+
+	close(halfDone)
+	close(writeDone)
+}
+
+func lineCount(t *testing.T, fileName string) int {
+	t.Helper()
+	fileContents, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		t.Fatalf("Error reading from file %s: %s", fileName, err)
+	}
+
+	count := 0
+	for _, line := range strings.Split(string(fileContents), "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		count++
+	}
+
+	return count
+}
--- a/middlewares/accesslog/logger.go
+++ b/middlewares/accesslog/logger.go
@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"sync"
 	"sync/atomic"
 	"time"

@@ -34,6 +35,7 @@ type LogHandler struct {
 	logger   *logrus.Logger
 	file     *os.File
 	filePath string
+	mu       sync.Mutex
 }

 // NewLogHandler creates a new LogHandler
@@ -148,14 +150,19 @@ func (l *LogHandler) Close() error {
 // by an external source.
 func (l *LogHandler) Rotate() error {
 	var err error
-	if err = l.Close(); err != nil {
-		return err
+
+	if l.file != nil {
+		defer func(f *os.File) {
+			f.Close()
+		}(l.file)
 	}

 	l.file, err = os.OpenFile(l.filePath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0664)
 	if err != nil {
 		return err
 	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
 	l.logger.Out = l.file
 	return nil
 }
@@ -226,6 +233,8 @@ func (l *LogHandler) logTheRoundTrip(logDataTable *LogData, crr *captureRequestR
 		fields["downstream_"+k] = logDataTable.DownstreamResponse.Get(k)
 	}

+	l.mu.Lock()
+	defer l.mu.Unlock()
 	l.logger.WithFields(fields).Println()
 }

--- a/middlewares/accesslog/logger_test.go
+++ b/middlewares/accesslog/logger_test.go
@@ -10,7 +10,9 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strings"
 	"testing"
+	"time"

 	"github.com/containous/traefik/types"
 	shellwords "github.com/mattn/go-shellwords"
@@ -36,6 +38,84 @@ var (
 	testRetryAttempts       = 2
 )

+func TestLogRotation(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "traefik_")
+	if err != nil {
+		t.Fatalf("Error setting up temporary directory: %s", err)
+	}
+
+	fileName := tempDir + "traefik.log"
+	rotatedFileName := fileName + ".rotated"
+
+	config := &types.AccessLog{FilePath: fileName, Format: CommonFormat}
+	logHandler, err := NewLogHandler(config)
+	if err != nil {
+		t.Fatalf("Error creating new log handler: %s", err)
+	}
+	defer logHandler.Close()
+
+	recorder := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "http://localhost", nil)
+	next := func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusOK)
+	}
+
+	iterations := 20
+	halfDone := make(chan bool)
+	writeDone := make(chan bool)
+	go func() {
+		for i := 0; i < iterations; i++ {
+			logHandler.ServeHTTP(recorder, req, next)
+			if i == iterations/2 {
+				halfDone <- true
+			}
+		}
+		writeDone <- true
+	}()
+
+	<-halfDone
+	err = os.Rename(fileName, rotatedFileName)
+	if err != nil {
+		t.Fatalf("Error renaming file: %s", err)
+	}
+
+	err = logHandler.Rotate()
+	if err != nil {
+		t.Fatalf("Error rotating file: %s", err)
+	}
+
+	select {
+	case <-writeDone:
+		gotLineCount := lineCount(t, fileName) + lineCount(t, rotatedFileName)
+		if iterations != gotLineCount {
+			t.Errorf("Wanted %d written log lines, got %d", iterations, gotLineCount)
+		}
+	case <-time.After(500 * time.Millisecond):
+		t.Fatalf("test timed out")
+	}
+
+	close(halfDone)
+	close(writeDone)
+}
+
+func lineCount(t *testing.T, fileName string) int {
+	t.Helper()
+	fileContents, err := ioutil.ReadFile(fileName)
+	if err != nil {
+		t.Fatalf("Error reading from file %s: %s", fileName, err)
+	}
+
+	count := 0
+	for _, line := range strings.Split(string(fileContents), "\n") {
+		if strings.TrimSpace(line) == "" {
+			continue
+		}
+		count++
+	}
+
+	return count
+}
+
 func TestLoggerCLF(t *testing.T) {
 	tmpDir := createTempDir(t, CommonFormat)
 	defer os.RemoveAll(tmpDir)
--- a/middlewares/auth/authenticator.go
+++ b/middlewares/auth/authenticator.go
@@ -1,4 +1,4 @@
-package middlewares
+package auth

 import (
 	"fmt"
@@ -7,7 +7,6 @@ import (
 	"strings"

 	goauth "github.com/abbot/go-http-auth"
-	"github.com/containous/traefik/auth"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/types"
 	"github.com/urfave/negroni"
@@ -19,7 +18,7 @@ type Authenticator struct {
 	users   map[string]string
 }

-// NewAuthenticator builds a new Autenticator given a config
+// NewAuthenticator builds a new Authenticator given a config
 func NewAuthenticator(authConfig *types.Auth) (*Authenticator, error) {
 	if authConfig == nil {
 		return nil, fmt.Errorf("Error creating Authenticator: auth is nil")
@@ -64,52 +63,12 @@ func NewAuthenticator(authConfig *types.Auth) (*Authenticator, error) {
 		})
 	} else if authConfig.Forward != nil {
 		authenticator.handler = negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-			auth.Forward(authConfig.Forward, w, r, next)
+			Forward(authConfig.Forward, w, r, next)
 		})
 	}
 	return &authenticator, nil
 }

-func parserBasicUsers(basic *types.Basic) (map[string]string, error) {
-	var userStrs []string
-	if basic.UsersFile != "" {
-		var err error
-		if userStrs, err = getLinesFromFile(basic.UsersFile); err != nil {
-			return nil, err
-		}
-	}
-	userStrs = append(basic.Users, userStrs...)
-	userMap := make(map[string]string)
-	for _, user := range userStrs {
-		split := strings.Split(user, ":")
-		if len(split) != 2 {
-			return nil, fmt.Errorf("Error parsing Authenticator user: %v", user)
-		}
-		userMap[split[0]] = split[1]
-	}
-	return userMap, nil
-}
-
-func parserDigestUsers(digest *types.Digest) (map[string]string, error) {
-	var userStrs []string
-	if digest.UsersFile != "" {
-		var err error
-		if userStrs, err = getLinesFromFile(digest.UsersFile); err != nil {
-			return nil, err
-		}
-	}
-	userStrs = append(digest.Users, userStrs...)
-	userMap := make(map[string]string)
-	for _, user := range userStrs {
-		split := strings.Split(user, ":")
-		if len(split) != 3 {
-			return nil, fmt.Errorf("Error parsing Authenticator user: %v", user)
-		}
-		userMap[split[0]+":"+split[1]] = split[2]
-	}
-	return userMap, nil
-}
-
 func getLinesFromFile(filename string) ([]string, error) {
 	dat, err := ioutil.ReadFile(filename)
 	if err != nil {
--- a/middlewares/auth/authenticator_test.go
+++ b/middlewares/auth/authenticator_test.go
@@ -1,4 +1,4 @@
-package middlewares
+package auth

 import (
 	"fmt"
@@ -157,7 +157,7 @@ func TestDigestAuthFail(t *testing.T) {
 }

 func TestBasicAuthUserHeader(t *testing.T) {
-	authMiddleware, err := NewAuthenticator(&types.Auth{
+	middleware, err := NewAuthenticator(&types.Auth{
 		Basic: &types.Basic{
 			Users: []string{"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"},
 		},
@@ -169,7 +169,7 @@ func TestBasicAuthUserHeader(t *testing.T) {
 		assert.Equal(t, "test", r.Header["X-Webauth-User"][0], "auth user should be set")
 		fmt.Fprintln(w, "traefik")
 	})
-	n := negroni.New(authMiddleware)
+	n := negroni.New(middleware)
 	n.UseHandler(handler)
 	ts := httptest.NewServer(n)
 	defer ts.Close()
@@ -186,67 +186,3 @@ func TestBasicAuthUserHeader(t *testing.T) {
 	assert.NoError(t, err, "there should be no error")
 	assert.Equal(t, "traefik\n", string(body), "they should be equal")
 }
-
-func TestForwardAuthFail(t *testing.T) {
-	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		http.Error(w, "Forbidden", http.StatusForbidden)
-	}))
-	defer authTs.Close()
-
-	authMiddleware, err := NewAuthenticator(&types.Auth{
-		Forward: &types.Forward{
-			Address: authTs.URL,
-		},
-	})
-	assert.NoError(t, err, "there should be no error")
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "traefik")
-	})
-	n := negroni.New(authMiddleware)
-	n.UseHandler(handler)
-	ts := httptest.NewServer(n)
-	defer ts.Close()
-
-	client := &http.Client{}
-	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
-	res, err := client.Do(req)
-	assert.NoError(t, err, "there should be no error")
-	assert.Equal(t, http.StatusForbidden, res.StatusCode, "they should be equal")
-
-	body, err := ioutil.ReadAll(res.Body)
-	assert.NoError(t, err, "there should be no error")
-	assert.Equal(t, "Forbidden\n", string(body), "they should be equal")
-}
-
-func TestForwardAuthSuccess(t *testing.T) {
-	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "Success")
-	}))
-	defer authTs.Close()
-
-	authMiddleware, err := NewAuthenticator(&types.Auth{
-		Forward: &types.Forward{
-			Address: authTs.URL,
-		},
-	})
-	assert.NoError(t, err, "there should be no error")
-
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "traefik")
-	})
-	n := negroni.New(authMiddleware)
-	n.UseHandler(handler)
-	ts := httptest.NewServer(n)
-	defer ts.Close()
-
-	client := &http.Client{}
-	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
-	res, err := client.Do(req)
-	assert.NoError(t, err, "there should be no error")
-	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
-
-	body, err := ioutil.ReadAll(res.Body)
-	assert.NoError(t, err, "there should be no error")
-	assert.Equal(t, "traefik\n", string(body), "they should be equal")
-}
--- a/middlewares/auth/forward.go
+++ b/middlewares/auth/forward.go
@@ -0,0 +1,97 @@
+package auth
+
+import (
+	"io/ioutil"
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/containous/traefik/log"
+	"github.com/containous/traefik/types"
+	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/utils"
+)
+
+// Forward the authentication to a external server
+func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+	httpClient := http.Client{}
+
+	if config.TLS != nil {
+		tlsConfig, err := config.TLS.CreateTLSConfig()
+		if err != nil {
+			log.Debugf("Impossible to configure TLS to call %s. Cause %s", config.Address, err)
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+		httpClient.Transport = &http.Transport{
+			TLSClientConfig: tlsConfig,
+		}
+	}
+
+	forwardReq, err := http.NewRequest(http.MethodGet, config.Address, nil)
+	if err != nil {
+		log.Debugf("Error calling %s. Cause %s", config.Address, err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	writeHeader(r, forwardReq, config.TrustForwardHeader)
+
+	forwardResponse, forwardErr := httpClient.Do(forwardReq)
+	if forwardErr != nil {
+		log.Debugf("Error calling %s. Cause: %s", config.Address, forwardErr)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	body, readError := ioutil.ReadAll(forwardResponse.Body)
+	if readError != nil {
+		log.Debugf("Error reading body %s. Cause: %s", config.Address, readError)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	defer forwardResponse.Body.Close()
+
+	if forwardResponse.StatusCode < http.StatusOK || forwardResponse.StatusCode >= http.StatusMultipleChoices {
+		log.Debugf("Remote error %s. StatusCode: %d", config.Address, forwardResponse.StatusCode)
+		w.WriteHeader(forwardResponse.StatusCode)
+		w.Write(body)
+		return
+	}
+
+	r.RequestURI = r.URL.RequestURI()
+	next(w, r)
+}
+
+func writeHeader(req *http.Request, forwardReq *http.Request, trustForwardHeader bool) {
+	utils.CopyHeaders(forwardReq.Header, req.Header)
+
+	if clientIP, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
+		if trustForwardHeader {
+			if prior, ok := req.Header[forward.XForwardedFor]; ok {
+				clientIP = strings.Join(prior, ", ") + ", " + clientIP
+			}
+		}
+		forwardReq.Header.Set(forward.XForwardedFor, clientIP)
+	}
+
+	if xfp := req.Header.Get(forward.XForwardedProto); xfp != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedProto, xfp)
+	} else if req.TLS != nil {
+		forwardReq.Header.Set(forward.XForwardedProto, "https")
+	} else {
+		forwardReq.Header.Set(forward.XForwardedProto, "http")
+	}
+
+	if xfp := req.Header.Get(forward.XForwardedPort); xfp != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedPort, xfp)
+	}
+
+	if xfh := req.Header.Get(forward.XForwardedHost); xfh != "" && trustForwardHeader {
+		forwardReq.Header.Set(forward.XForwardedHost, xfh)
+	} else if req.Host != "" {
+		forwardReq.Header.Set(forward.XForwardedHost, req.Host)
+	} else {
+		forwardReq.Header.Del(forward.XForwardedHost)
+	}
+}
--- a/middlewares/auth/forward_test.go
+++ b/middlewares/auth/forward_test.go
@@ -0,0 +1,162 @@
+package auth
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/containous/traefik/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/urfave/negroni"
+)
+
+func TestForwardAuthFail(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "Forbidden", http.StatusForbidden)
+	}))
+	defer server.Close()
+
+	middleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: server.URL,
+		},
+	})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := client.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusForbidden, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "Forbidden\n", string(body), "they should be equal")
+}
+
+func TestForwardAuthSuccess(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "Success")
+	}))
+	defer server.Close()
+
+	middleware, err := NewAuthenticator(&types.Auth{
+		Forward: &types.Forward{
+			Address: server.URL,
+		},
+	})
+	assert.NoError(t, err, "there should be no error")
+
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "traefik")
+	})
+	n := negroni.New(middleware)
+	n.UseHandler(handler)
+	ts := httptest.NewServer(n)
+	defer ts.Close()
+
+	client := &http.Client{}
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	res, err := client.Do(req)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, http.StatusOK, res.StatusCode, "they should be equal")
+
+	body, err := ioutil.ReadAll(res.Body)
+	assert.NoError(t, err, "there should be no error")
+	assert.Equal(t, "traefik\n", string(body), "they should be equal")
+}
+
+func Test_writeHeader(t *testing.T) {
+
+	testCases := []struct {
+		name               string
+		headers            map[string]string
+		trustForwardHeader bool
+		emptyHost          bool
+		expectedHeaders    map[string]string
+	}{
+		{
+			name: "trust Forward Header",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+		},
+		{
+			name: "not trust Forward Header",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: false,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "foo.bar",
+			},
+		},
+		{
+			name: "trust Forward Header with empty Host",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: true,
+			emptyHost:          true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+		},
+		{
+			name: "not trust Forward Header with empty Host",
+			headers: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "fii.bir",
+			},
+			trustForwardHeader: false,
+			emptyHost:          true,
+			expectedHeaders: map[string]string{
+				"Accept":           "application/json",
+				"X-Forwarded-Host": "",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.name, func(t *testing.T) {
+
+			req := testhelpers.MustNewRequest(http.MethodGet, "http://foo.bar", nil)
+			for key, value := range test.headers {
+				req.Header.Set(key, value)
+			}
+
+			if test.emptyHost {
+				req.Host = ""
+			}
+
+			forwardReq := testhelpers.MustNewRequest(http.MethodGet, "http://foo.bar", nil)
+
+			writeHeader(req, forwardReq, test.trustForwardHeader)
+
+			for key, value := range test.expectedHeaders {
+				assert.Equal(t, value, forwardReq.Header.Get(key))
+			}
+		})
+	}
+}
--- a/middlewares/auth/parser.go
+++ b/middlewares/auth/parser.go
@@ -0,0 +1,48 @@
+package auth
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/containous/traefik/types"
+)
+
+func parserBasicUsers(basic *types.Basic) (map[string]string, error) {
+	var userStrs []string
+	if basic.UsersFile != "" {
+		var err error
+		if userStrs, err = getLinesFromFile(basic.UsersFile); err != nil {
+			return nil, err
+		}
+	}
+	userStrs = append(basic.Users, userStrs...)
+	userMap := make(map[string]string)
+	for _, user := range userStrs {
+		split := strings.Split(user, ":")
+		if len(split) != 2 {
+			return nil, fmt.Errorf("Error parsing Authenticator user: %v", user)
+		}
+		userMap[split[0]] = split[1]
+	}
+	return userMap, nil
+}
+
+func parserDigestUsers(digest *types.Digest) (map[string]string, error) {
+	var userStrs []string
+	if digest.UsersFile != "" {
+		var err error
+		if userStrs, err = getLinesFromFile(digest.UsersFile); err != nil {
+			return nil, err
+		}
+	}
+	userStrs = append(digest.Users, userStrs...)
+	userMap := make(map[string]string)
+	for _, user := range userStrs {
+		split := strings.Split(user, ":")
+		if len(split) != 3 {
+			return nil, fmt.Errorf("Error parsing Authenticator user: %v", user)
+		}
+		userMap[split[0]+":"+split[1]] = split[2]
+	}
+	return userMap, nil
+}
--- a/middlewares/compress.go
+++ b/middlewares/compress.go
@@ -3,6 +3,7 @@ package middlewares
 import (
 	"compress/gzip"
 	"net/http"
+	"strings"

 	"github.com/NYTimes/gziphandler"
 	"github.com/containous/traefik/log"
@@ -13,12 +14,16 @@ type Compress struct{}

 // ServerHTTP is a function used by Negroni
 func (c *Compress) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-	gzipHandler(next).ServeHTTP(rw, r)
+	contentType := r.Header.Get("Content-Type")
+	if strings.HasPrefix(contentType, "application/grpc") {
+		next.ServeHTTP(rw, r)
+	} else {
+		gzipHandler(next).ServeHTTP(rw, r)
+	}
 }

 func gzipHandler(h http.Handler) http.Handler {
 	wrapper, err := gziphandler.GzipHandlerWithOpts(
-		&gziphandler.GzipResponseWriterWrapper{},
 		gziphandler.CompressionLevel(gzip.DefaultCompression),
 		gziphandler.MinSize(gziphandler.DefaultMinSize))
 	if err != nil {
--- a/middlewares/compress_test.go
+++ b/middlewares/compress_test.go
@@ -16,6 +16,7 @@ import (
 const (
 	acceptEncodingHeader  = "Accept-Encoding"
 	contentEncodingHeader = "Content-Encoding"
+	contentTypeHeader     = "Content-Type"
 	varyHeader            = "Vary"
 	gzipValue             = "gzip"
 )
@@ -81,6 +82,26 @@ func TestShouldNotCompressWhenNoAcceptEncodingHeader(t *testing.T) {
 	assert.EqualValues(t, rw.Body.Bytes(), fakeBody)
 }

+func TestShouldNotCompressWhenGRPC(t *testing.T) {
+	handler := &Compress{}
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://localhost", nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+	req.Header.Add(contentTypeHeader, "application/grpc")
+
+	baseBody := generateBytes(gziphandler.DefaultMinSize)
+	next := func(rw http.ResponseWriter, r *http.Request) {
+		rw.Write(baseBody)
+	}
+
+	rw := httptest.NewRecorder()
+	handler.ServeHTTP(rw, req, next)
+
+	assert.Empty(t, rw.Header().Get(acceptEncodingHeader))
+	assert.Empty(t, rw.Header().Get(contentEncodingHeader))
+	assert.EqualValues(t, rw.Body.Bytes(), baseBody)
+}
+
 func TestIntegrationShouldNotCompress(t *testing.T) {
 	fakeCompressedBody := generateBytes(100000)
 	comp := &Compress{}
@@ -137,6 +158,31 @@ func TestIntegrationShouldNotCompress(t *testing.T) {
 	}
 }

+func TestShouldWriteHeaderWhenFlush(t *testing.T) {
+	comp := &Compress{}
+	negro := negroni.New(comp)
+	negro.UseHandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		rw.Header().Add(contentEncodingHeader, gzipValue)
+		rw.Header().Add(varyHeader, acceptEncodingHeader)
+		rw.WriteHeader(http.StatusUnauthorized)
+		rw.(http.Flusher).Flush()
+		rw.Write([]byte("short"))
+	})
+	ts := httptest.NewServer(negro)
+	defer ts.Close()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	req.Header.Add(acceptEncodingHeader, gzipValue)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+
+	assert.Equal(t, gzipValue, resp.Header.Get(contentEncodingHeader))
+	assert.Equal(t, acceptEncodingHeader, resp.Header.Get(varyHeader))
+}
+
 func TestIntegrationShouldCompress(t *testing.T) {
 	fakeBody := generateBytes(100000)

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
SALLEYRON Julien	419d46c958	Prepare release v1.4.4	2017-11-23 11:48:03 +01:00
Marco Jantke	676b79db42	Fix raw path handling in strip prefix	2017-11-21 14:28:03 +01:00
Ludovic Fernandez	c9129b8ecf	Remove GzipHandler Fork	2017-11-20 18:32:03 +01:00
NicoMen	6619a787a3	Fix problems about duplicated and missing Docker backends/frontends.	2017-11-20 15:16:03 +01:00
Raúl Sánchez	aae17c817b	Fix issue with label traefik.backend.loadbalancer.stickiness.cookieName	2017-11-20 11:42:03 +01:00
Ludovic Fernandez	8fe5c22075	Exclude RC from doc publication.	2017-11-20 09:42:02 +01:00
Ludovic Fernandez	1a4564d998	http.Server log goes to Debug level.	2017-11-18 01:10:03 +01:00
Ludovic Fernandez	66be04f39e	Documentation archive	2017-11-16 09:20:03 +01:00
NicoMen	77b111702b	Prepare release v1.4.3	2017-11-14 12:06:03 +01:00
NicoMen	96a7cc483f	Add Traefik prefix to the KV key	2017-11-14 11:38:03 +01:00
Ludovic Fernandez	1e3506848a	Flush and errorcode	2017-11-14 11:16:03 +01:00
Michael	5ee2cae85c	Fix Traefik reload if Consul Catalog tags change	2017-11-13 12:14:02 +01:00
Ludovic Fernandez	5c119fe2d6	Exclude GRPC from compress	2017-11-10 14:12:02 +01:00
Ivan Rogov	2f62ec3632	Link corrected	2017-11-09 15:54:04 +01:00
Levi Blaney	56affb90ae	Add secret creation to docs for kubernetes backend	2017-11-09 10:52:03 +01:00
SALLEYRON Julien	9bd0fff319	Keep status when stream mode and compress	2017-11-09 00:48:03 +01:00
Jan Collijs	58a438167b	Minor fix for docker volume vs created directory	2017-11-08 15:12:03 +01:00
Tom Saleeba	bc8d68bd31	docs: fix some typos	2017-11-07 11:50:03 +01:00
Bernhard Millauer	70812c70fc	Postfix windows binaries with .exe	2017-11-03 17:02:14 +01:00
Ludovic Fernandez	0347537f43	Freeze version of mkdocs-material.	2017-11-02 14:38:03 +01:00
Ludovic Fernandez	db9b18f121	Prepare release v1.4.2	2017-11-02 12:28:03 +01:00
Jim Hribar	fc4d670c88	Minor grammar change	2017-11-02 10:38:03 +01:00
Alex Antonov	02035d4942	Missing Backend key in configuration when application has no tasks	2017-11-01 11:26:03 +01:00
Ludovic Fernandez	d3c7681bc5	New PR template	2017-10-30 16:38:03 +01:00
NicoMen	dc66db4abe	Make the traefik.port label optional when using service labels in Docker containers.	2017-10-30 15:10:05 +01:00
NicoMen	a0e1cf8376	Fix IP address when Docker container network mode is container	2017-10-30 14:36:04 +01:00
Daniel König	5292b84f4f	fixed dead link in kubernetes backend config docs	2017-10-30 14:04:03 +01:00
burningTyger	b27455a36f	entrypoints -> entryPoints	2017-10-30 13:20:03 +01:00
NicoMen	da7b6f0baf	Make frontend names differents for similar routes	2017-10-30 12:06:03 +01:00
Simon Elsbrock	9b5845f1cb	Fix datastore corruption on reload due to shrinking config size	2017-10-30 11:22:04 +01:00
Erwin de Keijzer	1b2cb53d4f	Fix the k8s docs example deployment yaml	2017-10-25 16:58:04 +02:00
Ludovic Fernandez	3158e51c62	Remove hardcoded runtime.GOMAXPROCS.	2017-10-25 16:16:02 +02:00
NicoMen	f0371da838	Add unique ID to Docker services replicas	2017-10-25 10:00:03 +02:00
NicoMen	44b82e6231	Fix mkdocs version	2017-10-24 18:06:03 +02:00
Michael	04f0bf3070	Prepare release v1.4.1	2017-10-24 15:52:04 +02:00
SALLEYRON Julien	7400c39511	Stream mode when http2	2017-10-24 14:38:02 +02:00
Ludovic Fernandez	35ca40c3de	Enhance Trust Forwarded Headers	2017-10-23 16:12:03 +02:00
Emile Vauge	de821fc305	fix healthcheck path	2017-10-23 15:48:03 +02:00
Fernandez Ludovic	e3cac7d0e5	fix(docker): Network filter.	2017-10-23 14:20:03 +02:00
Ludovic Fernandez	81f7aa9df2	Regex capturing group.	2017-10-23 10:20:02 +02:00
SALLEYRON Julien	afbad56012	Force http/1.1 for websocket	2017-10-20 17:38:04 +02:00
Ludovic Fernandez	9c8df8b9ce	Fix 1.4.0 release date	2017-10-16 19:44:02 +02:00
Ludovic Fernandez	ff4c7b82bc	Prepare release v1.4.0	2017-10-16 18:42:03 +02:00
Emile Vauge	47ff51e640	add retry backoff to staert config loading	2017-10-16 18:06:04 +02:00
Ludovic Fernandez	08503655d9	Backward compatibility for sticky	2017-10-16 17:38:03 +02:00
Michael	3afd6024b5	Fix consul catalog retry	2017-10-16 16:58:03 +02:00
Ludovic Fernandez	aa308b7a3a	Add TrustForwardHeader options.	2017-10-16 12:46:03 +02:00
Ludovic Fernandez	9598f646f5	New entry point parser.	2017-10-13 15:04:02 +02:00
Sergey Kirillov	8af39bdaf7	Changed Docker network filter to allow any swarm network	2017-10-13 12:00:03 +02:00
Ludovic Fernandez	8cb3f0835a	Stickiness cookie name.	2017-10-12 17:50:03 +02:00
Manuel Zapf	cba0898e4f	fix seconds to really be seconds	2017-10-12 16:26:03 +02:00
Timo Reimann	8d158402f3	Continue processing on invalid auth-realm annotation.	2017-10-12 15:48:03 +02:00
SALLEYRON Julien	7f2582e3b6	Nil body retries	2017-10-12 15:10:04 +02:00
Emile Vauge	dbc796359f	Fix Proxy Protocol documentation	2017-10-12 11:10:03 +02:00
Ludovic Fernandez	7a2ce59563	Prepare release v1.4.0-rc5	2017-10-10 15:50:03 +02:00
Ludovic Fernandez	14cec7e610	Stickiness documentation	2017-10-10 15:24:03 +02:00
Emile Vauge	6287a3dd53	Add trusted whitelist proxy protocol	2017-10-10 14:50:03 +02:00
SALLEYRON Julien	93a1db77c5	Move http2 configure transport	2017-10-10 12:14:03 +02:00
Ludovic Fernandez	a9d4b09bdb	Stickiness cookie name	2017-10-10 11:10:02 +02:00
Timo Reimann	ed2eb7b5a6	Quote priority values in annotation examples.	2017-10-09 14:16:03 +02:00
Timo Reimann	18d8537d29	Document ways to partition Ingresses in the k8s guide.	2017-10-09 12:36:03 +02:00
Timo Reimann	72f3b1ed39	Remove pod from RBAC rules.	2017-10-09 12:12:03 +02:00
Marco Jantke	fd70e6edb1	enable prefix matching within slash boundaries	2017-10-06 11:34:03 +02:00
Shane Smith-Sahnow	5a578c5375	Updating make run-dev	2017-10-06 10:44:03 +02:00
Marco Jantke	9db8773055	fix flakiness in log rotation test	2017-10-06 09:20:13 +02:00
Timo Reimann	8a67434380	Sanitize cookie names.	2017-10-05 12:14:03 +02:00
Emile Vauge	c94e5f3589	Delay first version check	2017-10-05 08:42:02 +02:00
vermishelle	adef7200f6	Fix grammar	2017-10-03 10:22:03 +02:00
NicoMen	f8d36fda28	Prepare release v1.4.0-rc4	2017-10-02 16:00:03 +02:00
SALLEYRON Julien	4fe9cc7730	Add tests for urlencoded part in url	2017-10-02 15:36:02 +02:00
Chris Aumann	758b7f875b	Fix grammar mistake in the kv-config docs	2017-10-02 14:58:04 +02:00
Ludovic Fernandez	0b97a67cfa	CI: speed up pull images.	2017-10-02 14:22:03 +02:00
Julien Senon	ec5976bbc9	Update gRPC example	2017-10-02 11:34:03 +02:00
Ludovic Fernandez	5cc49e2931	`bug` command.	2017-10-02 10:32:02 +02:00
SALLEYRON Julien	b6752a2c02	Forward upgrade error from backend	2017-09-29 21:04:03 +02:00
jeffreykoetsier	d41e28fc36	Handle empty ECS Clusters properly	2017-09-29 16:56:03 +02:00
SALLEYRON Julien	64c52a6921	Consul catalog remove service failed	2017-09-29 16:30:03 +02:00
Ed Robinson	691a678b19	Improve compression documentation	2017-09-29 10:34:03 +02:00
Timo Reimann	1ba7fd91ff	grep to-be-pulled-images directly to avoid newline issue.	2017-09-26 14:44:03 +02:00
Jiri Tyr	dd23ceeead	Updating Docker output and curl for sticky sessions	2017-09-22 17:22:03 +02:00
Ludovic Fernandez	058fa1367b	CI: speed up pull images.	2017-09-22 16:46:03 +02:00
Philippe M. Chiasson	9db12374ea	Be certain to clear our marshalled representation before reloading it	2017-09-22 16:14:03 +02:00
SALLEYRON Julien	a941739f8a	Change pull image command in Makefile	2017-09-20 20:02:02 +02:00
SALLEYRON Julien	795a346006	Flaky tests and refresh problem in consul catalog	2017-09-20 19:08:02 +02:00
Marco Jantke	9d00da7285	fix SSE subscriptions when retries are enabled	2017-09-20 18:40:03 +02:00
Marco Jantke	52c1909f24	Fix deprecated IdleTimeout config	2017-09-20 18:14:03 +02:00
SALLEYRON Julien	f9225c54ff	Prepare release v1.4.0-rc3	2017-09-18 18:20:03 +02:00
Ludovic Fernandez	cb05f36976	Manage Headers for the Authentication forwarding.	2017-09-18 17:48:07 +02:00
Frédéric Logier	49e0e20ce2	fix healthcheck port	2017-09-18 15:50:03 +02:00
Ludovic Fernandez	7c35337999	Remove GZIPHandler fork.	2017-09-18 11:04:03 +02:00
Fernandez Ludovic	2296aab5a8	refactor: unflaky access log.	2017-09-18 09:44:03 +02:00
Fernandez Ludovic	ce3b255f1a	chore: Use go-check fork.	2017-09-18 09:44:03 +02:00
SALLEYRON Julien	3942f3366d	User guide gRPC	2017-09-16 10:56:02 +02:00
Ludovic Fernandez	df76cc33a5	Fixes entry points configuration.	2017-09-15 20:56:04 +02:00
Marco Jantke	cf387d5a6d	Enable loss less rotation of log files	2017-09-15 15:02:03 +02:00
Martin Proks	0a0cf87625	Fix rancher host IP address	2017-09-15 12:30:03 +02:00
Ludovic Fernandez	1a2544610d	Enhance web backend documentation	2017-09-15 09:18:03 +02:00
Ludovic Fernandez	5229b7cfba	Add forward auth documentation.	2017-09-14 21:26:02 +02:00
Timo Reimann	243b45881d	Document custom error page restrictions.	2017-09-14 08:50:02 +02:00
Avi Deitcher	883028d981	Add examples of proxying ping	2017-09-13 15:24:03 +02:00
Ludovic Fernandez	bdeb7bfb9f	Display Traefik logs in integration test	2017-09-13 10:34:04 +02:00
Timo Reimann	5305a16350	Add guide section on production advice, esp. CPU.	2017-09-12 19:56:04 +02:00
Manuel Zapf	63b581935d	Add stack name to backend name generation to fix rancher metadata backend	2017-09-12 15:06:04 +02:00
Ludovic Fernandez	c7c9349b00	Enhance documentation readability.	2017-09-11 19:10:04 +02:00
Ludovic Fernandez	6d28c52f59	Prepare release v1.4.0-rc2	2017-09-08 21:28:02 +02:00