Prepare release v1.6.0

Document custom k8s ingress class usage in guide.
Add redirect section.
2018-04-30 23:20:05 +02:00 · 2018-04-30 20:28:03 +02:00 · 2018-04-30 12:28:03 +02:00 · 2018-04-30 12:08:03 +02:00 · 2018-04-30 09:24:04 +02:00 · 2018-04-27 14:54:03 +02:00
203 changed files with 9750 additions and 6798 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@
 /traefik
 /traefik.toml
 /static/
+/webui/.tmp/
 .vscode/
 /site/
 *.log
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,214 @@
 # Change Log

+## [v1.6.0](https://github.com/containous/traefik/tree/v1.6.0) (2018-04-30)
+[All Commits](https://github.com/containous/traefik/compare/v1.5.0-rc1...v1.6.0)
+
+**Enhancements:**
+- **[acme]** Create backup file during migration from ACME V1 to ACME V2 ([#3191](https://github.com/containous/traefik/pull/3191) by [nmengin](https://github.com/nmengin))
+- **[acme]** Generate wildcard certificate with SANs in ACME ([#3167](https://github.com/containous/traefik/pull/3167) by [nmengin](https://github.com/nmengin))
+- **[acme]** ACME V2 Integration ([#3063](https://github.com/containous/traefik/pull/3063) by [nmengin](https://github.com/nmengin))
+- **[acme]** Create ACME Provider ([#2889](https://github.com/containous/traefik/pull/2889) by [nmengin](https://github.com/nmengin))
+- **[acme]** Bump Lego Version for GoDaddy DNS Provider ([#2482](https://github.com/containous/traefik/pull/2482) by [sjawhar](https://github.com/sjawhar))
+- **[acme]** Delete TLS-SNI-01 challenge from ACME ([#2971](https://github.com/containous/traefik/pull/2971) by [nmengin](https://github.com/nmengin))
+- **[acme]** Simplify storing renewed acme certificate ([#2614](https://github.com/containous/traefik/pull/2614) by [ferhatelmas](https://github.com/ferhatelmas))
+- **[acme]** Update Lego (Gandi API v5, cloudxns, ...) ([#2844](https://github.com/containous/traefik/pull/2844) by [ldez](https://github.com/ldez))
+- **[acme]** Remove acme provider dependency in server ([#3225](https://github.com/containous/traefik/pull/3225) by [Juliens](https://github.com/Juliens))
+- **[api,cluster]** Added cluster/leader endpoint ([#3009](https://github.com/containous/traefik/pull/3009) by [aantono](https://github.com/aantono))
+- **[api,cluster]** Improved cluster api to include the current leader node ([#3100](https://github.com/containous/traefik/pull/3100) by [aantono](https://github.com/aantono))
+- **[authentication]** Forward Authentication: add X-Forwarded-Uri ([#2398](https://github.com/containous/traefik/pull/2398) by [sebastianbauer](https://github.com/sebastianbauer))
+- **[boltdb,consul,etcd,kv,zk]** Add all available configuration to KV Backend ([#2652](https://github.com/containous/traefik/pull/2652) by [ldez](https://github.com/ldez))
+- **[boltdb,consul,etcd,kv,zk]** homogenization of templates: KV ([#2661](https://github.com/containous/traefik/pull/2661) by [ldez](https://github.com/ldez))
+- **[boltdb,consul,etcd,kv,zk]** Homogenization of the providers (part 1):  KV ([#2616](https://github.com/containous/traefik/pull/2616) by [ldez](https://github.com/ldez))
+- **[consul,consulcatalog]** Homogenization of templates: Consul Catalog ([#2668](https://github.com/containous/traefik/pull/2668) by [ldez](https://github.com/ldez))
+- **[consul,consulcatalog]** Split consul and consul catalog. ([#2655](https://github.com/containous/traefik/pull/2655) by [ldez](https://github.com/ldez))
+- **[consulcatalog,ecs,mesos]** Factorize labels managements. ([#3099](https://github.com/containous/traefik/pull/3099) by [ldez](https://github.com/ldez))
+- **[consulcatalog]** TLS Support for ConsulCatalog ([#2900](https://github.com/containous/traefik/pull/2900) by [mmatur](https://github.com/mmatur))
+- **[consulcatalog]** Check for endpoints while detecting Consul service changes ([#2882](https://github.com/containous/traefik/pull/2882) by [caseycs](https://github.com/caseycs))
+- **[consulcatalog]** Add all available tags to Consul Catalog Backend ([#2646](https://github.com/containous/traefik/pull/2646) by [ldez](https://github.com/ldez))
+- **[docker,docker/swarm]** Fix support for macvlan driver in docker provider ([#2827](https://github.com/containous/traefik/pull/2827) by [mmatur](https://github.com/mmatur))
+- **[docker,marathon,rancher]** Segments Labels: Rancher &amp; Marathon ([#3073](https://github.com/containous/traefik/pull/3073) by [ldez](https://github.com/ldez))
+- **[docker]** Custom headers by service labels for docker backends ([#2514](https://github.com/containous/traefik/pull/2514) by [Tiscs](https://github.com/Tiscs))
+- **[docker]** Homogenization of templates: Docker ([#2659](https://github.com/containous/traefik/pull/2659) by [ldez](https://github.com/ldez))
+- **[docker]** Add all available labels to Docker Backend ([#2584](https://github.com/containous/traefik/pull/2584) by [ldez](https://github.com/ldez))
+- **[docker]** Segment labels: Docker ([#3055](https://github.com/containous/traefik/pull/3055) by [ldez](https://github.com/ldez))
+- **[dynamodb,ecs]** Upgrade AWS SKD to version v1.13.1 ([#2908](https://github.com/containous/traefik/pull/2908) by [mmatur](https://github.com/mmatur))
+- **[ecs]** Factorize labels managements. ([#3159](https://github.com/containous/traefik/pull/3159) by [ldez](https://github.com/ldez))
+- **[ecs]** Homogenization of templates: ECS ([#2663](https://github.com/containous/traefik/pull/2663) by [ldez](https://github.com/ldez))
+- **[ecs]** Add all available labels to ECS Backend ([#2605](https://github.com/containous/traefik/pull/2605) by [ldez](https://github.com/ldez))
+- **[eureka]** Homogenization of templates: Eureka  ([#2846](https://github.com/containous/traefik/pull/2846) by [ldez](https://github.com/ldez))
+- **[eureka]** Replace Delay by RefreshSecond in Eureka ([#2972](https://github.com/containous/traefik/pull/2972) by [ldez](https://github.com/ldez))
+- **[file]** Added support for templates to file provider ([#2991](https://github.com/containous/traefik/pull/2991) by [aantono](https://github.com/aantono))
+- **[healthcheck]** Toggle /ping to artificially return unhealthy response on SIGTERM during requestAcceptGraceTimeout interval ([#3062](https://github.com/containous/traefik/pull/3062) by [ravilr](https://github.com/ravilr))
+- **[healthcheck]** Add HTTP headers to healthcheck. ([#3047](https://github.com/containous/traefik/pull/3047) by [zetaab](https://github.com/zetaab))
+- **[healthcheck]** Improve logging output for failing healthchecks ([#2443](https://github.com/containous/traefik/pull/2443) by [marco-jantke](https://github.com/marco-jantke))
+- **[k8s,tls]** Add support for fetching k8s Ingress TLS data from secrets ([#2439](https://github.com/containous/traefik/pull/2439) by [gopenguin](https://github.com/gopenguin))
+- **[k8s]** Builders in k8s tests ([#2513](https://github.com/containous/traefik/pull/2513) by [ldez](https://github.com/ldez))
+- **[k8s]** Support multi-port services. ([#3121](https://github.com/containous/traefik/pull/3121) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Bump kubernetes/client-go ([#2848](https://github.com/containous/traefik/pull/2848) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Add all available annotations to k8s Backend ([#2612](https://github.com/containous/traefik/pull/2612) by [ldez](https://github.com/ldez))
+- **[k8s]** Allow custom value for kubernetes.io/ingress.class annotation ([#2222](https://github.com/containous/traefik/pull/2222) by [yuvipanda](https://github.com/yuvipanda))
+- **[k8s]** Introduce k8s informer factory ([#2867](https://github.com/containous/traefik/pull/2867) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Add app-root annotation support for kubernetes ingress ([#2522](https://github.com/containous/traefik/pull/2522) by [yue9944882](https://github.com/yue9944882))
+- **[logs,middleware]** Add access log filter for retry attempts ([#3042](https://github.com/containous/traefik/pull/3042) by [marco-jantke](https://github.com/marco-jantke))
+- **[logs,middleware]** Ultimate Access log filter ([#2988](https://github.com/containous/traefik/pull/2988) by [mmatur](https://github.com/mmatur))
+- **[logs,middleware]** Add username in accesslog ([#2111](https://github.com/containous/traefik/pull/2111) by [bastiaanb](https://github.com/bastiaanb))
+- **[logs]** Display file log when test fails. ([#2801](https://github.com/containous/traefik/pull/2801) by [ldez](https://github.com/ldez))
+- **[logs]** Allow overriding the log level in debug mode. ([#3050](https://github.com/containous/traefik/pull/3050) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** Remove health check filter from Marathon tasks. ([#2817](https://github.com/containous/traefik/pull/2817) by [timoreimann](https://github.com/timoreimann))
+- **[marathon]** homogenization of templates: Marathon ([#2665](https://github.com/containous/traefik/pull/2665) by [ldez](https://github.com/ldez))
+- **[marathon]** Add all available labels to Marathon Backend ([#2602](https://github.com/containous/traefik/pull/2602) by [ldez](https://github.com/ldez))
+- **[mesos]** Add all available labels to Mesos Backend  ([#2687](https://github.com/containous/traefik/pull/2687) by [ldez](https://github.com/ldez))
+- **[metrics]** Added missing metrics to registry for DataDog and StatsD ([#2890](https://github.com/containous/traefik/pull/2890) by [aantono](https://github.com/aantono))
+- **[metrics]** Extend metrics and rebuild prometheus exporting logic ([#2567](https://github.com/containous/traefik/pull/2567) by [marco-jantke](https://github.com/marco-jantke))
+- **[metrics]** Remove unnecessary conversion ([#2850](https://github.com/containous/traefik/pull/2850) by [ferhatelmas](https://github.com/ferhatelmas))
+- **[metrics]** Added entrypoint metrics to influxdb ([#2992](https://github.com/containous/traefik/pull/2992) by [adityacs](https://github.com/adityacs))
+- **[middleware,consul,consulcatalog,docker,ecs,k8s,marathon,mesos,rancher]** New option in secure middleware ([#2958](https://github.com/containous/traefik/pull/2958) by [mmatur](https://github.com/mmatur))
+- **[middleware,consulcatalog,docker,ecs,k8s,kv,marathon,mesos,rancher]** Ability to use &#34;X-Forwarded-For&#34; as a source of IP for white list. ([#3070](https://github.com/containous/traefik/pull/3070) by [ldez](https://github.com/ldez))
+- **[middleware,docker]** Use pointer of error pages ([#2607](https://github.com/containous/traefik/pull/2607) by [ldez](https://github.com/ldez))
+- **[middleware,provider]** Redirection: permanent move option. ([#2774](https://github.com/containous/traefik/pull/2774) by [ldez](https://github.com/ldez))
+- **[middleware]** Add tests on IPWhiteLister. ([#3106](https://github.com/containous/traefik/pull/3106) by [ldez](https://github.com/ldez))
+- **[middleware]** Add new options to the CLI entrypoint definition.  ([#2799](https://github.com/containous/traefik/pull/2799) by [ldez](https://github.com/ldez))
+- **[middleware]** Change port of traefik for error pages integration test ([#2907](https://github.com/containous/traefik/pull/2907) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Request buffering middleware ([#2217](https://github.com/containous/traefik/pull/2217) by [harnash](https://github.com/harnash))
+- **[middleware]** Remove unnecessary returns in tracing setup ([#2880](https://github.com/containous/traefik/pull/2880) by [ferhatelmas](https://github.com/ferhatelmas))
+- **[middleware]** Extract internal router creation from server ([#3204](https://github.com/containous/traefik/pull/3204) by [Juliens](https://github.com/Juliens))
+- **[provider]** Homogenization of the providers (part 1) ([#2518](https://github.com/containous/traefik/pull/2518) by [ldez](https://github.com/ldez))
+- **[provider]** No error pages must return nil. ([#2610](https://github.com/containous/traefik/pull/2610) by [ldez](https://github.com/ldez))
+- **[rancher]** Add all available labels to Rancher Backend ([#2601](https://github.com/containous/traefik/pull/2601) by [ldez](https://github.com/ldez))
+- **[rancher]** Homogenization of templates: Rancher ([#2662](https://github.com/containous/traefik/pull/2662) by [ldez](https://github.com/ldez))
+- **[rules]** Externalize Træfik rules in a dedicated package ([#2933](https://github.com/containous/traefik/pull/2933) by [nmengin](https://github.com/nmengin))
+- **[servicefabric]** Use shared label system ([#3197](https://github.com/containous/traefik/pull/3197) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Add white list for Service Fabric ([#3079](https://github.com/containous/traefik/pull/3079) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Update Service Fabric backend. ([#3064](https://github.com/containous/traefik/pull/3064) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Add HTTP headers to healthcheck. ([#3205](https://github.com/containous/traefik/pull/3205) by [ldez](https://github.com/ldez))
+- **[tls]** Support TLS MinVersion and CipherSuite as CLI option. ([#3107](https://github.com/containous/traefik/pull/3107) by [ldez](https://github.com/ldez))
+- **[tls]** Use default entryPoints when certificates are added with no entryPoints. ([#2534](https://github.com/containous/traefik/pull/2534) by [nmengin](https://github.com/nmengin))
+- **[tracing]** Opentracing support ([#2587](https://github.com/containous/traefik/pull/2587) by [mmatur](https://github.com/mmatur))
+- **[tracing]** Handle zipkin collector creation ([#2860](https://github.com/containous/traefik/pull/2860) by [ferhatelmas](https://github.com/ferhatelmas))
+- **[webui]** New web ui ([#2226](https://github.com/containous/traefik/pull/2226) by [jkuri](https://github.com/jkuri))
+- **[webui]** Add status code text to webui bar chart tooltip ([#2639](https://github.com/containous/traefik/pull/2639) by [wader](https://github.com/wader))
+- Separate command from the main package ([#2951](https://github.com/containous/traefik/pull/2951) by [Juliens](https://github.com/Juliens))
+- Logger and Leaks ([#2847](https://github.com/containous/traefik/pull/2847) by [ldez](https://github.com/ldez))
+- Use context in Server ([#3007](https://github.com/containous/traefik/pull/3007) by [Juliens](https://github.com/Juliens))
+
+**Bug fixes:**
+- **[acme]** Update lego. ([#3158](https://github.com/containous/traefik/pull/3158) by [ldez](https://github.com/ldez))
+- **[acme]** Fix panic with wrong ACME configuration ([#3084](https://github.com/containous/traefik/pull/3084) by [nmengin](https://github.com/nmengin))
+- **[acme]** Minor updates to dumpcerts.sh ([#3116](https://github.com/containous/traefik/pull/3116) by [mathuin](https://github.com/mathuin))
+- **[acme]** Add ACME certificates only on ACME EntryPoint ([#3136](https://github.com/containous/traefik/pull/3136) by [nmengin](https://github.com/nmengin))
+- **[acme]** Add TTL and custom Timeout in DigitalOcean DNS provider  ([#3143](https://github.com/containous/traefik/pull/3143) by [ldez](https://github.com/ldez))
+- **[acme]** Fix acme.json file automatic creation ([#3156](https://github.com/containous/traefik/pull/3156) by [nmengin](https://github.com/nmengin))
+- **[acme]** Fix wildcard match to ACME domains in cluster mode ([#3080](https://github.com/containous/traefik/pull/3080) by [oldmantaiter](https://github.com/oldmantaiter))
+- **[acme]** Check all the C/N and SANs of provided certificates before generating ACME certificates in ACME provider ([#2970](https://github.com/containous/traefik/pull/2970) by [nmengin](https://github.com/nmengin))
+- **[acme]** Does not generate ACME certificate if domain is checked by dynamic certificate ([#3238](https://github.com/containous/traefik/pull/3238) by [Juliens](https://github.com/Juliens))
+- **[api,cluster]** Moved /api/cluster/leadership handler under public routes (requires no authentication) ([#3101](https://github.com/containous/traefik/pull/3101) by [aantono](https://github.com/aantono))
+- **[authentication,middleware]** Forward auth: copy response headers when auth failed. ([#3207](https://github.com/containous/traefik/pull/3207) by [ldez](https://github.com/ldez))
+- **[consul,docker,ecs,eureka,k8s,kv,marathon,mesos,rancher]** Server weight zero ([#3130](https://github.com/containous/traefik/pull/3130) by [ldez](https://github.com/ldez))
+- **[docker,marathon,mesos,rancher]** Fix:  label &#39;traefik.domain&#39; ([#3201](https://github.com/containous/traefik/pull/3201) by [ldez](https://github.com/ldez))
+- **[docker,k8s,marathon]** Fix custom headers template ([#2622](https://github.com/containous/traefik/pull/2622) by [ldez](https://github.com/ldez))
+- **[docker,rancher]** Ignore server for container with empty IP address. ([#3213](https://github.com/containous/traefik/pull/3213) by [ldez](https://github.com/ldez))
+- **[docker,rancher]** Frontend rule and segment labels. ([#3091](https://github.com/containous/traefik/pull/3091) by [ldez](https://github.com/ldez))
+- **[docker]** Fix multiple frontends with docker-compose --scale ([#3190](https://github.com/containous/traefik/pull/3190) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[k8s]** Fixes prefixed annotations support. ([#3110](https://github.com/containous/traefik/pull/3110) by [ldez](https://github.com/ldez))
+- **[k8s]** Limit label selector to Ingress factory. ([#3137](https://github.com/containous/traefik/pull/3137) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Missing annotation prefix support. ([#2915](https://github.com/containous/traefik/pull/2915) by [ldez](https://github.com/ldez))
+- **[k8s]** Remove hardcoded frontend prefix in Kubernetes template ([#2914](https://github.com/containous/traefik/pull/2914) by [psalaberria002](https://github.com/psalaberria002))
+- **[logs,middleware]** Fix bad access log ([#2682](https://github.com/containous/traefik/pull/2682) by [mmatur](https://github.com/mmatur))
+- **[marathon]** Several apps with same backend name in Marathon. ([#3109](https://github.com/containous/traefik/pull/3109) by [ldez](https://github.com/ldez))
+- **[mesos]** fix: overflow on 32 bits arch. ([#3127](https://github.com/containous/traefik/pull/3127) by [ldez](https://github.com/ldez))
+- **[metrics]** Fix duplicated tags in InfluxDB ([#3189](https://github.com/containous/traefik/pull/3189) by [mmatur](https://github.com/mmatur))
+- **[middleware,consul,consulcatalog,docker,ecs,kv,marathon,mesos,rancher]** Fix: error pages ([#3138](https://github.com/containous/traefik/pull/3138) by [ldez](https://github.com/ldez))
+- **[middleware,tracing]** Fix nil value when tracing is enabled ([#3192](https://github.com/containous/traefik/pull/3192) by [mmatur](https://github.com/mmatur))
+- **[middleware,tracing]** Fix &lt;nil&gt; tracer value in KV ([#2911](https://github.com/containous/traefik/pull/2911) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Fix panic in atomic on ARM and x86-32 platforms ([#3195](https://github.com/containous/traefik/pull/3195) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Redirect to HTTPS first before basic auth if header redirect (secure) is set ([#3187](https://github.com/containous/traefik/pull/3187) by [SantoDE](https://github.com/SantoDE))
+- **[middleware]** Fix error pages redirect and headers. ([#3217](https://github.com/containous/traefik/pull/3217) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix whitelist and XFF. ([#3211](https://github.com/containous/traefik/pull/3211) by [ldez](https://github.com/ldez))
+- **[middleware]** Use responseModifier to override secure headers ([#2946](https://github.com/containous/traefik/pull/2946) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Correct conditional setting of buffering retry expression. ([#2865](https://github.com/containous/traefik/pull/2865) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix high memory usage in retry middleware ([#2740](https://github.com/containous/traefik/pull/2740) by [marco-jantke](https://github.com/marco-jantke))
+- **[provider]** Add some missing quotes in templates ([#2973](https://github.com/containous/traefik/pull/2973) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Fix backend name for stateful service and more. ([#3183](https://github.com/containous/traefik/pull/3183) by [ldez](https://github.com/ldez))
+- **[tracing]** Tracing statusCodeTracker need to implement CloseNotify ([#2733](https://github.com/containous/traefik/pull/2733) by [mmatur](https://github.com/mmatur))
+- **[tracing]** Fix missing configuration for jaeger reporter ([#2720](https://github.com/containous/traefik/pull/2720) by [mmatur](https://github.com/mmatur))
+- **[tracing]** Fix integration tests in tracing ([#2759](https://github.com/containous/traefik/pull/2759) by [mmatur](https://github.com/mmatur))
+- **[webui]** Remove useless ACME tab from UI. ([#3154](https://github.com/containous/traefik/pull/3154) by [ldez](https://github.com/ldez))
+- **[webui]** Add redirect section. ([#3243](https://github.com/containous/traefik/pull/3243) by [ldez](https://github.com/ldez))
+- Remove unnecessary mutex usage in health checks ([#2726](https://github.com/containous/traefik/pull/2726) by [marco-jantke](https://github.com/marco-jantke))
+- Add missing argument in log. ([#3188](https://github.com/containous/traefik/pull/3188) by [chemidy](https://github.com/chemidy))
+
+**Documentation:**
+- **[docker]** Add default values for some Docker labels ([#2604](https://github.com/containous/traefik/pull/2604) by [ldez](https://github.com/ldez))
+- **[file]** Add documentation about Templating in backend file ([#3223](https://github.com/containous/traefik/pull/3223) by [nmengin](https://github.com/nmengin))
+- **[k8s]** Update kubernetes.md ([#3093](https://github.com/containous/traefik/pull/3093) by [rdrgporto](https://github.com/rdrgporto))
+- **[k8s]** Update kubernetes.md ([#3171](https://github.com/containous/traefik/pull/3171) by [andreyfedoseev](https://github.com/andreyfedoseev))
+- **[k8s]** Document custom k8s ingress class usage in guide. ([#3242](https://github.com/containous/traefik/pull/3242) by [timoreimann](https://github.com/timoreimann))
+- **[k8s]** Update traefik-ds.yaml with --api command line parameter ([#2803](https://github.com/containous/traefik/pull/2803) by [maniankara](https://github.com/maniankara))
+- **[k8s]** Remove web provider in example ([#2807](https://github.com/containous/traefik/pull/2807) by [pigletfly](https://github.com/pigletfly))
+- **[k8s]** Drop capabilities in Kubernetes DaemonSet example ([#3028](https://github.com/containous/traefik/pull/3028) by [nogoegst](https://github.com/nogoegst))
+- **[k8s]** Docs: Fix typos in k8s user-guide ([#2898](https://github.com/containous/traefik/pull/2898) by [cez81](https://github.com/cez81))
+- **[k8s]** Change boolean annotation values to string ([#2839](https://github.com/containous/traefik/pull/2839) by [hobti01](https://github.com/hobti01))
+- **[provider]** Fix template version documentation. ([#3184](https://github.com/containous/traefik/pull/3184) by [ldez](https://github.com/ldez))
+- **[provider]** Cleaning labels/annotations documentation. ([#3245](https://github.com/containous/traefik/pull/3245) by [ldez](https://github.com/ldez))
+- **[provider]** Split security labels and custom labels documentation. ([#2872](https://github.com/containous/traefik/pull/2872) by [ldez](https://github.com/ldez))
+- **[provider]** Remove non-supported label. ([#3065](https://github.com/containous/traefik/pull/3065) by [ldez](https://github.com/ldez))
+- **[provider]** Remove obsolete paragraph about error pages. ([#2608](https://github.com/containous/traefik/pull/2608) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Update SF white list documentation section. ([#3082](https://github.com/containous/traefik/pull/3082) by [ldez](https://github.com/ldez))
+- **[servicefabric]** Add SF to supported backends in docs ([#3033](https://github.com/containous/traefik/pull/3033) by [lawrencegripper](https://github.com/lawrencegripper))
+- **[tracing]** Add Tracing entry in the documentation. ([#2713](https://github.com/containous/traefik/pull/2713) by [ldez](https://github.com/ldez))
+- **[tracing]** Fix documentation for tracing with Jaeger ([#3227](https://github.com/containous/traefik/pull/3227) by [mmatur](https://github.com/mmatur))
+- **[webui]** doc: update Traefik images. ([#3241](https://github.com/containous/traefik/pull/3241) by [ldez](https://github.com/ldez))
+- Fix typo in doc for rate limit label ([#2790](https://github.com/containous/traefik/pull/2790) by [mmatur](https://github.com/mmatur))
+- Fix typo in documentation ([#3215](https://github.com/containous/traefik/pull/3215) by [arnaslu](https://github.com/arnaslu))
+- Update some examples ([#3150](https://github.com/containous/traefik/pull/3150) by [zaporylie](https://github.com/zaporylie))
+- Normalize parameter names in configs ([#3132](https://github.com/containous/traefik/pull/3132) by [kachkaev](https://github.com/kachkaev))
+- Fixed documentation urls on README.md ([#3102](https://github.com/containous/traefik/pull/3102) by [emir](https://github.com/emir))
+- Minor improvements to documentation ([#3221](https://github.com/containous/traefik/pull/3221) by [colincoller](https://github.com/colincoller))
+- Fix basic documentation ([#3086](https://github.com/containous/traefik/pull/3086) by [mmatur](https://github.com/mmatur))
+- Fix typo and tweak formatting in quickstart ([#3250](https://github.com/containous/traefik/pull/3250) by [alexymik](https://github.com/alexymik))
+- Prepare release v1.6.0-rc5 ([#3179](https://github.com/containous/traefik/pull/3179) by [Juliens](https://github.com/Juliens))
+- Prepare release v1.6.0-rc6 ([#3199](https://github.com/containous/traefik/pull/3199) by [mmatur](https://github.com/mmatur))
+- Prepare release v1.6.0-rc4 ([#3126](https://github.com/containous/traefik/pull/3126) by [ldez](https://github.com/ldez))
+- Prepare release v1.6.0-rc3 ([#3096](https://github.com/containous/traefik/pull/3096) by [ldez](https://github.com/ldez))
+- Prepare release v1.6.0-rc2 ([#3087](https://github.com/containous/traefik/pull/3087) by [nmengin](https://github.com/nmengin))
+- Prepare release v1.6.0-rc1 ([#3078](https://github.com/containous/traefik/pull/3078) by [Juliens](https://github.com/Juliens))
+
+**Misc:**
+- **[oxy]** Disable closeNotify when method GET for http pipelining ([#3108](https://github.com/containous/traefik/pull/3108) by [Juliens](https://github.com/Juliens))
+- **[boltdb,consul,etcd,kv,zk]** Migrate from libkv to valkeyrie library ([#2743](https://github.com/containous/traefik/pull/2743) by [nmengin](https://github.com/nmengin))
+- Fix Service Fabric docs to use v1.6 labels ([#3209](https://github.com/containous/traefik/pull/3209) by [jjcollinge](https://github.com/jjcollinge))
+- Merge v1.6.0-rc6 into master ([#3203](https://github.com/containous/traefik/pull/3203) by [ldez](https://github.com/ldez))
+- Merge v1.6.0-rc5 into master  ([#3180](https://github.com/containous/traefik/pull/3180) by [ldez](https://github.com/ldez))
+- Merge v1.6.0-rc4 into master  ([#3129](https://github.com/containous/traefik/pull/3129) by [ldez](https://github.com/ldez))
+- Merge v1.5.4 into master  ([#3024](https://github.com/containous/traefik/pull/3024) by [ldez](https://github.com/ldez))
+- Merge v1.5.3 into master ([#2943](https://github.com/containous/traefik/pull/2943) by [ldez](https://github.com/ldez))
+- Merge v1.5.2 into master  ([#2843](https://github.com/containous/traefik/pull/2843) by [ldez](https://github.com/ldez))
+- Merge v1.5.1 into master ([#2781](https://github.com/containous/traefik/pull/2781) by [ldez](https://github.com/ldez))
+- Merge v1.5.0-rc5 into master ([#2708](https://github.com/containous/traefik/pull/2708) by [ldez](https://github.com/ldez))
+- Merge v1.5.0-rc3 into master ([#2600](https://github.com/containous/traefik/pull/2600) by [ldez](https://github.com/ldez))
+- Merge v1.5.0-rc2 into master ([#2536](https://github.com/containous/traefik/pull/2536) by [ldez](https://github.com/ldez))
+- Drop unnecessary type conversions ([#2583](https://github.com/containous/traefik/pull/2583) by [ferhatelmas](https://github.com/ferhatelmas))
+- Code simplification ([#2516](https://github.com/containous/traefik/pull/2516) by [ferhatelmas](https://github.com/ferhatelmas))
+
+## [v1.6.0-rc6](https://github.com/containous/traefik/tree/v1.6.0-rc6) (2018-04-17)
+[All Commits](https://github.com/containous/traefik/compare/v1.6.0-rc5...v1.6.0-rc6)
+
+**Enhancements:**
+- **[acme]** Create backup file during migration from ACME V1 to ACME V2 ([#3191](https://github.com/containous/traefik/pull/3191) by [nmengin](https://github.com/nmengin))
+- **[servicefabric]** Use shared label system ([#3197](https://github.com/containous/traefik/pull/3197) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[docker]** Fix multiple frontends with docker-compose --scale ([#3190](https://github.com/containous/traefik/pull/3190) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[metrics]** Fix duplicated tags in InfluxDB ([#3189](https://github.com/containous/traefik/pull/3189) by [mmatur](https://github.com/mmatur))
+- **[middleware,tracing]** Fix nil value when tracing is enabled ([#3192](https://github.com/containous/traefik/pull/3192) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Fix panic in atomic on ARM and x86-32 platforms ([#3195](https://github.com/containous/traefik/pull/3195) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Redirect to HTTPS first before basic auth if header redirect (secure) is set ([#3187](https://github.com/containous/traefik/pull/3187) by [SantoDE](https://github.com/SantoDE))
+- **[servicefabric]** Fix backend name for stateful service and more. ([#3183](https://github.com/containous/traefik/pull/3183) by [ldez](https://github.com/ldez))
+- Add missing argument in log. ([#3188](https://github.com/containous/traefik/pull/3188) by [chemidy](https://github.com/chemidy))
+
+**Documentation:**
+- **[provider]** Fix template version documentation. ([#3184](https://github.com/containous/traefik/pull/3184) by [ldez](https://github.com/ldez))
+
 ## [v1.6.0-rc5](https://github.com/containous/traefik/tree/v1.6.0-rc5) (2018-04-12)
 [All Commits](https://github.com/containous/traefik/compare/v1.6.0-rc4...v1.6.0-rc5)

--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -263,8 +263,8 @@
 [[projects]]
  name = "github.com/containous/traefik-extra-service-fabric"
  packages = ["."]
-  revision = "503022efdc178146d598911092af75690510a80c"
-  version = "v1.1.3"
+  revision = "2889df8d4f84315e6e527588554ed0ce9d062305"
+  version = "v1.1.5"

 [[projects]]
  name = "github.com/coreos/bbolt"
@@ -569,8 +569,8 @@
    "metrics/statsd",
    "util/conn"
  ]
-  revision = "f66b0e13579bfc5a48b9e2a94b1209c107ea1f41"
-  version = "v0.3.0"
+  revision = "ca4112baa34cb55091301bdc13b1420a122b1b9e"
+  version = "v0.7.0"

 [[projects]]
  name = "github.com/go-logfmt/logfmt"
@@ -761,7 +761,6 @@
  version = "v1.3.7"

 [[projects]]
-  branch = "master"
  name = "github.com/jjcollinge/servicefabric"
  packages = ["."]
  revision = "8eebe170fa1ba25d3dfb928b3f86a7313b13b9fe"
@@ -1675,6 +1674,6 @@
 [solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
-  inputs-digest = "c441208e9bf330e85e2939b383515f58a4957286960b43c444e6f512d1ff94ee"
+  inputs-digest = "c7d91203842be1915ca08a31917a079489bff7ffc6f2e494330e9556b4730a06"
  solver-name = "gps-cdcl"
  solver-version = 1
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -66,7 +66,7 @@

 [[constraint]]
  name = "github.com/containous/traefik-extra-service-fabric"
-  version = "1.1.3"
+  version = "1.1.5"

 [[constraint]]
  name = "github.com/coreos/go-systemd"
@@ -97,7 +97,7 @@

 [[constraint]]
  name = "github.com/go-kit/kit"
-  version = "0.3.0"
+  version = "0.7.0"

 [[constraint]]
  branch = "master"
--- a/acme/localStore.go
+++ b/acme/localStore.go
@@ -46,38 +46,42 @@ func (s *LocalStore) Get() (*Account, error) {
 		if err := json.Unmarshal(file, &account); err != nil {
 			return nil, err
 		}
-
-		// Check if ACME Account is in ACME V1 format
-		if account != nil && account.Registration != nil {
-			isOldRegistration, err := regexp.MatchString(acme.RegistrationURLPathV1Regexp, account.Registration.URI)
-			if err != nil {
-				return nil, err
-			}
-
-			if isOldRegistration {
-				account.Email = ""
-				account.Registration = nil
-				account.PrivateKey = nil
-			}
-		}
 	}

 	return account, nil
 }

+// RemoveAccountV1Values removes ACME account V1 values
+func RemoveAccountV1Values(account *Account) error {
+	// Check if ACME Account is in ACME V1 format
+	if account != nil && account.Registration != nil {
+		isOldRegistration, err := regexp.MatchString(acme.RegistrationURLPathV1Regexp, account.Registration.URI)
+		if err != nil {
+			return err
+		}
+
+		if isOldRegistration {
+			account.Email = ""
+			account.Registration = nil
+			account.PrivateKey = nil
+		}
+	}
+	return nil
+}
+
 // ConvertToNewFormat converts old acme.json format to the new one and store the result into the file (used for the backward compatibility)
 func ConvertToNewFormat(fileName string) {
 	localStore := acme.NewLocalStore(fileName)

 	storeAccount, err := localStore.GetAccount()
 	if err != nil {
-		log.Warnf("Failed to read new account, ACME data conversion is not available : %v", err)
+		log.Errorf("Failed to read new account, ACME data conversion is not available : %v", err)
 		return
 	}

 	storeCertificates, err := localStore.GetCertificates()
 	if err != nil {
-		log.Warnf("Failed to read new certificates, ACME data conversion is not available : %v", err)
+		log.Errorf("Failed to read new certificates, ACME data conversion is not available : %v", err)
 		return
 	}

@@ -86,13 +90,25 @@ func ConvertToNewFormat(fileName string) {

 		account, err := localStore.Get()
 		if err != nil {
-			log.Warnf("Failed to read old account, ACME data conversion is not available : %v", err)
+			log.Errorf("Failed to read old account, ACME data conversion is not available : %v", err)
 			return
 		}

 		// Convert ACME data from old to new format
 		newAccount := &acme.Account{}
 		if account != nil && len(account.Email) > 0 {
+			err = backupACMEFile(fileName, account)
+			if err != nil {
+				log.Errorf("Unable to create a backup for the V1 formatted ACME file: %s", err.Error())
+				return
+			}
+
+			err = RemoveAccountV1Values(account)
+			if err != nil {
+				log.Errorf("Unable to remove ACME Account V1 values: %s", err.Error())
+				return
+			}
+
 			newAccount = &acme.Account{
 				PrivateKey:   account.PrivateKey,
 				Registration: account.Registration,
@@ -107,8 +123,8 @@ func ConvertToNewFormat(fileName string) {
 					Domain:      cert.Domains,
 				})
 			}
-			// If account is in the old format, storeCertificates is nil or empty
-			// and has to be initialized
+
+			// If account is in the old format, storeCertificates is nil or empty and has to be initialized
 			storeCertificates = newCertificates
 		}

@@ -119,7 +135,16 @@ func ConvertToNewFormat(fileName string) {
 	}
 }

-// FromNewToOldFormat converts new acme.json format to the old one (used for the backward compatibility)
+func backupACMEFile(originalFileName string, account interface{}) error {
+	// write account to file
+	data, err := json.MarshalIndent(account, "", "  ")
+	if err != nil {
+		return err
+	}
+	return ioutil.WriteFile(originalFileName+".bak", data, 0600)
+}
+
+// FromNewToOldFormat converts new acme account to the old one (used for the backward compatibility)
 func FromNewToOldFormat(fileName string) (*Account, error) {
 	localStore := acme.NewLocalStore(fileName)

--- a/api/dashboard.go
+++ b/api/dashboard.go
@@ -14,9 +14,19 @@ type DashboardHandler struct{}
 // AddRoutes add dashboard routes on a router
 func (g DashboardHandler) AddRoutes(router *mux.Router) {
 	// Expose dashboard
-	router.Methods(http.MethodGet).Path("/").HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-		http.Redirect(response, request, request.Header.Get("X-Forwarded-Prefix")+"/dashboard/", 302)
-	})
-	router.Methods(http.MethodGet).PathPrefix("/dashboard/").
+	router.Methods(http.MethodGet).
+		Path("/").
+		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+			http.Redirect(response, request, request.Header.Get("X-Forwarded-Prefix")+"/dashboard/", 302)
+		})
+
+	router.Methods(http.MethodGet).
+		Path("/dashboard/status").
+		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+			http.Redirect(response, request, "/dashboard/", 302)
+		})
+
+	router.Methods(http.MethodGet).
+		PathPrefix("/dashboard/").
 		Handler(http.StripPrefix("/dashboard/", http.FileServer(&assetfs.AssetFS{Asset: genstatic.Asset, AssetInfo: genstatic.AssetInfo, AssetDir: genstatic.AssetDir, Prefix: "static"})))
 }
--- a/cmd/configuration.go
+++ b/cmd/configuration.go
@@ -220,7 +220,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 			SamplingServerURL:  "http://localhost:5778/sampling",
 			SamplingType:       "const",
 			SamplingParam:      1.0,
-			LocalAgentHostPort: "127.0.0.1:6832",
+			LocalAgentHostPort: "127.0.0.1:6831",
 		},
 		Zipkin: &zipkin.Config{
 			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
--- a/cmd/storeconfig/storeconfig.go
+++ b/cmd/storeconfig/storeconfig.go
@@ -134,10 +134,16 @@ func migrateACMEData(fileName string) (*acme.Account, error) {
 		if accountFromNewFormat == nil {
 			// convert ACME json file to KV store (used for backward compatibility)
 			localStore := acme.NewLocalStore(fileName)
+
 			account, err = localStore.Get()
 			if err != nil {
 				return nil, err
 			}
+
+			err = acme.RemoveAccountV1Values(account)
+			if err != nil {
+				return nil, err
+			}
 		} else {
 			account = accountFromNewFormat
 		}
--- a/configuration/configuration.go
+++ b/configuration/configuration.go
@@ -11,6 +11,8 @@ import (
 	"github.com/containous/traefik/api"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/middlewares/tracing"
+	"github.com/containous/traefik/middlewares/tracing/jaeger"
+	"github.com/containous/traefik/middlewares/tracing/zipkin"
 	"github.com/containous/traefik/ping"
 	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/provider/boltdb"
@@ -313,6 +315,43 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 	}

 	gc.initACMEProvider()
+	gc.initTracing()
+}
+
+func (gc *GlobalConfiguration) initTracing() {
+	if gc.Tracing != nil {
+		switch gc.Tracing.Backend {
+		case jaeger.Name:
+			if gc.Tracing.Jaeger == nil {
+				gc.Tracing.Jaeger = &jaeger.Config{
+					SamplingServerURL:  "http://localhost:5778/sampling",
+					SamplingType:       "const",
+					SamplingParam:      1.0,
+					LocalAgentHostPort: "127.0.0.1:6831",
+				}
+			}
+			if gc.Tracing.Zipkin != nil {
+				log.Warn("Zipkin configuration will be ignored")
+				gc.Tracing.Zipkin = nil
+			}
+		case zipkin.Name:
+			if gc.Tracing.Zipkin == nil {
+				gc.Tracing.Zipkin = &zipkin.Config{
+					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
+					SameSpan:     false,
+					ID128Bit:     true,
+					Debug:        false,
+				}
+			}
+			if gc.Tracing.Jaeger != nil {
+				log.Warn("Jaeger configuration will be ignored")
+				gc.Tracing.Jaeger = nil
+			}
+		default:
+			log.Warnf("Unknown tracer %q", gc.Tracing.Backend)
+			return
+		}
+	}
 }

 func (gc *GlobalConfiguration) initACMEProvider() {
--- a/configuration/configuration_test.go
+++ b/configuration/configuration_test.go
@@ -5,14 +5,18 @@ import (
 	"time"

 	"github.com/containous/flaeg"
+	"github.com/containous/traefik/middlewares/tracing"
+	"github.com/containous/traefik/middlewares/tracing/jaeger"
+	"github.com/containous/traefik/middlewares/tracing/zipkin"
 	"github.com/containous/traefik/provider"
 	"github.com/containous/traefik/provider/file"
+	"github.com/stretchr/testify/assert"
 )

 const defaultConfigFile = "traefik.toml"

 func TestSetEffectiveConfigurationGraceTimeout(t *testing.T) {
-	tests := []struct {
+	testCases := []struct {
 		desc                  string
 		legacyGraceTimeout    time.Duration
 		lifeCycleGraceTimeout time.Duration
@@ -37,10 +41,11 @@ func TestSetEffectiveConfigurationGraceTimeout(t *testing.T) {
 		},
 	}

-	for _, test := range tests {
+	for _, test := range testCases {
 		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
+
 			gc := &GlobalConfiguration{
 				GraceTimeOut: flaeg.Duration(test.legacyGraceTimeout),
 			}
@@ -52,17 +57,14 @@ func TestSetEffectiveConfigurationGraceTimeout(t *testing.T) {

 			gc.SetEffectiveConfiguration(defaultConfigFile)

-			gotGraceTimeout := time.Duration(gc.LifeCycle.GraceTimeOut)
-			if gotGraceTimeout != test.wantGraceTimeout {
-				t.Fatalf("got effective grace timeout %d, want %d", gotGraceTimeout, test.wantGraceTimeout)
-			}
+			assert.Equal(t, test.wantGraceTimeout, time.Duration(gc.LifeCycle.GraceTimeOut))

 		})
 	}
 }

 func TestSetEffectiveConfigurationFileProviderFilename(t *testing.T) {
-	tests := []struct {
+	testCases := []struct {
 		desc                     string
 		fileProvider             *file.Provider
 		wantFileProviderFilename string
@@ -84,20 +86,128 @@ func TestSetEffectiveConfigurationFileProviderFilename(t *testing.T) {
 		},
 	}

-	for _, test := range tests {
+	for _, test := range testCases {
 		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
+
 			gc := &GlobalConfiguration{
 				File: test.fileProvider,
 			}

 			gc.SetEffectiveConfiguration(defaultConfigFile)

-			gotFileProviderFilename := gc.File.Filename
-			if gotFileProviderFilename != test.wantFileProviderFilename {
-				t.Fatalf("got file provider file name %q, want %q", gotFileProviderFilename, test.wantFileProviderFilename)
-			}
+			assert.Equal(t, test.wantFileProviderFilename, gc.File.Filename)
+		})
+	}
+}
+
+func TestSetEffectiveConfigurationTracing(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		tracing  *tracing.Tracing
+		expected *tracing.Tracing
+	}{
+		{
+			desc:     "no tracing configuration",
+			tracing:  &tracing.Tracing{},
+			expected: &tracing.Tracing{},
+		},
+		{
+			desc: "tracing bad backend name",
+			tracing: &tracing.Tracing{
+				Backend: "powpow",
+			},
+			expected: &tracing.Tracing{
+				Backend: "powpow",
+			},
+		},
+		{
+			desc: "tracing jaeger backend name",
+			tracing: &tracing.Tracing{
+				Backend: "jaeger",
+				Zipkin: &zipkin.Config{
+					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
+					SameSpan:     false,
+					ID128Bit:     true,
+					Debug:        false,
+				},
+			},
+			expected: &tracing.Tracing{
+				Backend: "jaeger",
+				Jaeger: &jaeger.Config{
+					SamplingServerURL:  "http://localhost:5778/sampling",
+					SamplingType:       "const",
+					SamplingParam:      1.0,
+					LocalAgentHostPort: "127.0.0.1:6831",
+				},
+				Zipkin: nil,
+			},
+		},
+		{
+			desc: "tracing zipkin backend name",
+			tracing: &tracing.Tracing{
+				Backend: "zipkin",
+				Jaeger: &jaeger.Config{
+					SamplingServerURL:  "http://localhost:5778/sampling",
+					SamplingType:       "const",
+					SamplingParam:      1.0,
+					LocalAgentHostPort: "127.0.0.1:6831",
+				},
+			},
+			expected: &tracing.Tracing{
+				Backend: "zipkin",
+				Jaeger:  nil,
+				Zipkin: &zipkin.Config{
+					HTTPEndpoint: "http://localhost:9411/api/v1/spans",
+					SameSpan:     false,
+					ID128Bit:     true,
+					Debug:        false,
+				},
+			},
+		},
+		{
+			desc: "tracing zipkin backend name value override",
+			tracing: &tracing.Tracing{
+				Backend: "zipkin",
+				Jaeger: &jaeger.Config{
+					SamplingServerURL:  "http://localhost:5778/sampling",
+					SamplingType:       "const",
+					SamplingParam:      1.0,
+					LocalAgentHostPort: "127.0.0.1:6831",
+				},
+				Zipkin: &zipkin.Config{
+					HTTPEndpoint: "http://powpow:9411/api/v1/spans",
+					SameSpan:     true,
+					ID128Bit:     true,
+					Debug:        true,
+				},
+			},
+			expected: &tracing.Tracing{
+				Backend: "zipkin",
+				Jaeger:  nil,
+				Zipkin: &zipkin.Config{
+					HTTPEndpoint: "http://powpow:9411/api/v1/spans",
+					SameSpan:     true,
+					ID128Bit:     true,
+					Debug:        true,
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			gc := &GlobalConfiguration{
+				Tracing: test.tracing,
+			}
+
+			gc.SetEffectiveConfiguration(defaultConfigFile)
+
+			assert.Equal(t, test.expected, gc.Tracing)
 		})
 	}
 }
--- a/docs/basics.md
+++ b/docs/basics.md
@@ -262,7 +262,7 @@ This allows for setting headers such as `X-Script-Name` to be added to the reque
 !!! warning
    If the custom header name is the same as one header name of the request or response, it will be replaced.

-In this example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, and the `X-Custom-Response-Header` added to the response.
+In this example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request and the `X-Custom-Response-Header` header added to the response.

 ```toml
 [frontends]
@@ -276,7 +276,7 @@ In this example, all matches to the path `/cheese` will have the `X-Script-Name`
    rule = "PathPrefixStrip:/cheese"
 ```

-In this second  example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` removed to the request and the `X-Custom-Response-Header` removed to the response.
+In this second  example, all matches to the path `/cheese` will have the `X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` header removed from the request, and the `X-Custom-Response-Header` header removed from the response.

 ```toml
 [frontends]
@@ -323,12 +323,49 @@ In this example, traffic routed through the first frontend will have the `X-Fram

 A backend is responsible to load-balance the traffic coming from one or more frontends to a set of http servers.

+#### Servers
+
+Servers are simply defined using a `url`. You can also apply a custom `weight` to each server (this will be used by load-balancing).
+
+!!! note
+    Paths in `url` are ignored. Use `Modifier` to specify paths instead.
+
+Here is an example of backends and servers definition:
+
+```toml
+[backends]
+  [backends.backend1]
+    # ...
+    [backends.backend1.servers.server1]
+    url = "http://172.17.0.2:80"
+    weight = 10
+    [backends.backend1.servers.server2]
+    url = "http://172.17.0.3:80"
+    weight = 1
+  [backends.backend2]
+    # ...
+    [backends.backend2.servers.server1]
+    url = "http://172.17.0.4:80"
+    weight = 1
+    [backends.backend2.servers.server2]
+    url = "http://172.17.0.5:80"
+    weight = 2
+```
+
+- Two backends are defined: `backend1` and `backend2`
+- `backend1` will forward the traffic to two servers: `http://172.17.0.2:80"` with weight `10` and `http://172.17.0.3:80` with weight `1`.
+- `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2`.
+
+#### Load-balancing
+
 Various methods of load-balancing are supported:

 - `wrr`: Weighted Round Robin.
 - `drr`: Dynamic Round Robin: increases weights on servers that perform better than others.
    It also rolls back to original weights if the servers have changed.

+#### Circuit breakers
+
 A circuit breaker can also be applied to a backend, preventing high loads on failing servers.
 Initial state is Standby. CB observes the statistics and does not modify the request.
 In case the condition matches, CB enters Tripped state, where it responds with predefined code or redirects to another frontend.
@@ -346,6 +383,26 @@ For example:
 - `LatencyAtQuantileMS(50.0) > 50`:  watch latency at quantile in milliseconds.
 - `ResponseCodeRatio(500, 600, 0, 600) > 0.5`: ratio of response codes in ranges [500-600) and [0-600).

+Here is an example of backends and servers definition:
+
+```toml
+[backends]
+  [backends.backend1]
+    [backends.backend1.circuitbreaker]
+    expression = "NetworkErrorRatio() > 0.5"
+    [backends.backend1.servers.server1]
+    url = "http://172.17.0.2:80"
+    weight = 10
+    [backends.backend1.servers.server2]
+    url = "http://172.17.0.3:80"
+    weight = 1
+```
+
+- `backend1` will forward the traffic to two servers: `http://172.17.0.2:80"` with weight `10` and `http://172.17.0.3:80` with weight `1` using default `wrr` load-balancing strategy.
+- a circuit breaker is added on `backend1` using the expression `NetworkErrorRatio() > 0.5`: watch error ratio over 10 second sliding window
+
+#### Maximum connections
+
 To proactively prevent backends from being overwhelmed with high load, a maximum connection limit can also be applied to each backend.

 Maximum connections can be configured by specifying an integer value for `maxconn.amount` and `maxconn.extractorfunc` which is a strategy used to determine how to categorize requests in order to evaluate the maximum connections.
@@ -357,13 +414,14 @@ For example:
    [backends.backend1.maxconn]
       amount = 10
       extractorfunc = "request.host"
+   # ...
 ```

 - `backend1` will return `HTTP code 429 Too Many Requests` if there are already 10 requests in progress for the same Host header.
 - Another possible value for `extractorfunc` is `client.ip` which will categorize requests based on client source ip.
 - Lastly `extractorfunc` can take the value of `request.header.ANY_HEADER` which will categorize requests based on `ANY_HEADER` that you provide.

-### Sticky sessions
+#### Sticky sessions

 Sticky sessions are supported with both load balancers.  
 When sticky sessions are enabled, a cookie is set on the initial request.
@@ -371,7 +429,6 @@ The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).
 On subsequent requests, the client will be directed to the backend stored in the cookie if it is still healthy.
 If not, a new backend will be assigned.

-
 ```toml
 [backends]
  [backends.backend1]
@@ -395,10 +452,10 @@ The deprecated way:
      sticky = true
 ```

-### Health Check
+#### Health Check

 A health check can be configured in order to remove a backend from LB rotation as long as it keeps returning HTTP status codes other than `200 OK` to HTTP GET requests periodically carried out by Traefik.  
-The check is defined by a pathappended to the backend URL and an interval (given in a format understood by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) specifying how often the health check should be executed (the default being 30 seconds).
+The check is defined by a path appended to the backend URL and an interval (given in a format understood by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration)) specifying how often the health check should be executed (the default being 30 seconds).
 Each backend must respond to the health check within 5 seconds.  
 By default, the port of the backend server is used, however, this may be overridden.

@@ -424,43 +481,6 @@ To use a different port for the healthcheck:
    port = 8080
 ```

-### Servers
-
-Servers are simply defined using a `url`. You can also apply a custom `weight` to each server (this will be used by load-balancing).
-
-!!! note
-    Paths in `url` are ignored. Use `Modifier` to specify paths instead.
-
-Here is an example of backends and servers definition:
-
-```toml
-[backends]
-  [backends.backend1]
-    [backends.backend1.circuitbreaker]
-    expression = "NetworkErrorRatio() > 0.5"
-    [backends.backend1.servers.server1]
-    url = "http://172.17.0.2:80"
-    weight = 10
-    [backends.backend1.servers.server2]
-    url = "http://172.17.0.3:80"
-    weight = 1
-  [backends.backend2]
-    [backends.backend2.LoadBalancer]
-    method = "drr"
-    [backends.backend2.servers.server1]
-    url = "http://172.17.0.4:80"
-    weight = 1
-    [backends.backend2.servers.server2]
-    url = "http://172.17.0.5:80"
-    weight = 2
-```
-
- Two backends are defined: `backend1` and `backend2`
- `backend1` will forward the traffic to two servers: `http://172.17.0.2:80"` with weight `10` and `http://172.17.0.3:80` with weight `1` using default `wrr` load-balancing strategy.
- `backend2` will forward the traffic to two servers: `http://172.17.0.4:80"` with weight `1` and `http://172.17.0.5:80` with weight `2` using `drr` load-balancing strategy.
- a circuit breaker is added on `backend1` using the expression `NetworkErrorRatio() > 0.5`: watch error ratio over 10 second sliding window
-
-
 ## Configuration

 Træfik's configuration has two parts:
--- a/docs/configuration/acme.md
+++ b/docs/configuration/acme.md
@@ -543,3 +543,14 @@ Do not hesitate to complete it.
 | [RFC2136](https://tools.ietf.org/html/rfc2136)         | `rfc2136`      | Not tested yet                   |
 | [Route 53](https://aws.amazon.com/route53/)            | `route53`      | YES                              |
 | [VULTR](https://www.vultr.com)                         | `vultr`        | Not tested yet                   |
+
+## ACME V2 migration
+
+During migration from ACME V1 to ACME V2 with a storage file, a backup is created with the content of the ACME V1 file.
+To obtain the name of the backup file, Træfik concatenates the option `acme.storage` and the suffix `.bak`.
+
+For example : if `acme.storage` value is `/etc/traefik/acme/acme.json`, the backup file will be named `/etc/traefik/acme/acme.json.bak`.
+
+!!! note
+    When Træfik is launched in a container, do not forget to create a volume of the parent folder to get the backup file on the host.
+    Otherwise, the backup file will be deleted when the container will be stopped and Træfik will not generate it again.
--- a/docs/configuration/backends/consulcatalog.md
+++ b/docs/configuration/backends/consulcatalog.md
@@ -73,7 +73,7 @@ prefix = "traefik"
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2
 ```

 This backend will create routes matching on hostname based on the service name used in Consul.
@@ -90,7 +90,6 @@ Additional settings can be defined using Consul Catalog tags.
 | Label                                                       | Description                                                                                                                                                                                                            |
 |-------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `<prefix>.enable=false`                                     | Disable this container in Træfik.                                                                                                                                                                                      |
-| `<prefix>.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
 | `<prefix>.protocol=https`                                   | Override the default `http` protocol.                                                                                                                                                                                  |
 | `<prefix>.weight=10`                                        | Assign this weight to the container.                                                                                                                                                                                   |
 | `traefik.backend.buffering.maxRequestBodyBytes=0`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
@@ -146,7 +145,17 @@ Additional settings can be defined using Consul Catalog tags.
 | Label                                                     | Description                                                                                                                                                                                         |
 |-----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `<prefix>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
+| `<prefix>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `<prefix>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `<prefix>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `<prefix>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `<prefix>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `<prefix>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `<prefix>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `<prefix>.frontend.headers.hostsProxyHeaders=EXPR`        | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `<prefix>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| `<prefix>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `<prefix>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `<prefix>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `<prefix>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `<prefix>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -154,16 +163,6 @@ Additional settings can be defined using Consul Catalog tags.
 | `<prefix>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `<prefix>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `<prefix>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `<prefix>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `<prefix>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `<prefix>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `<prefix>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `<prefix>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `<prefix>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `<prefix>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `<prefix>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `<prefix>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `<prefix>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

 ### Examples

--- a/docs/configuration/backends/docker.md
+++ b/docs/configuration/backends/docker.md
@@ -46,7 +46,7 @@ watch = true
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2

 # Expose containers by default in Traefik.
 # If set to false, containers that don't have `traefik.enable=true` will be ignored.
@@ -139,7 +139,7 @@ swarmMode = true
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2

 # Expose services by default in Traefik.
 #
@@ -196,6 +196,7 @@ Labels can be used on containers to override default behavior.
 | Label                                                      | Description                                                                                                                                                                                                               |
 |------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.docker.network`                                   | Set the docker network to use for connections to this container. [1]                                                                                                                                                      |
+| `traefik.domain`                                           | Default domain used for frontend rules.                                                                                                                                                                                   |
 | `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                          |
 | `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                    |
 | `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                      |
@@ -254,7 +255,17 @@ Or if your service references external network use it's name instead.
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
+| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -262,16 +273,6 @@ Or if your service references external network use it's name instead.
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

 ### On containers with Multiple Ports (segment labels)

@@ -281,62 +282,63 @@ You can define as many segments as ports exposed in a container.

 Segment labels override the default behavior.

-| Label                                                                     | Description                                                                                      |
-|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the segment labels could be used. |
-| `traefik.<segment_name>.protocol`                                         | Overrides `traefik.protocol`.                                                                    |
-| `traefik.<segment_name>.weight`                                           | Assign this segment weight. Overrides `traefik.weight`.                                          |
-| `traefik.<segment_name>.frontend.auth.basic`                              | Sets a Basic Auth for that frontend                                                              |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this segment frontend to `BACKEND`. Default is to assign to the segment backend.          |
-| `traefik.<segment_name>.frontend.entryPoints`                             | Overrides `traefik.frontend.entrypoints`                                                         |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.passHostHeader`                          | Overrides `traefik.frontend.passHostHeader`.                                                     |
-| `traefik.<segment_name>.frontend.passTLSCert`                             | Overrides `traefik.frontend.passTLSCert`.                                                        |
-| `traefik.<segment_name>.frontend.priority`                                | Overrides `traefik.frontend.priority`.                                                           |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                     |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                               |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                       |
-| `traefik.<segment_name>.frontend.rule`                                    | Overrides `traefik.frontend.rule`.                                                               |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                              |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Overrides `traefik.frontend.whiteList.useXForwardedFor`.                                         |
+| Label                                                                     | Description                                                 |
+|---------------------------------------------------------------------------|-------------------------------------------------------------|
+| `traefik.<segment_name>.domain=DOMAIN`                                    | Same as `traefik.domain`                                    |
+| `traefik.<segment_name>.port=PORT`                                        | Same as `traefik.port`                                      |
+| `traefik.<segment_name>.protocol=http`                                    | Same as `traefik.protocol`                                  |
+| `traefik.<segment_name>.weight=10`                                        | Same as `traefik.weight`                                    |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                         | Same as `traefik.frontend.auth.basic`                       |
+| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Same as `traefik.frontend.backend`                          |
+| `traefik.<segment_name>.frontend.entryPoints=https`                       | Same as `traefik.frontend.entryPoints`                      |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | Same as `traefik.frontend.errors.<name>.backend`            |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | Same as `traefik.frontend.errors.<name>.query`              |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | Same as `traefik.frontend.errors.<name>.status`             |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                     | Same as `traefik.frontend.passHostHeader`                   |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                        | Same as `traefik.frontend.passTLSCert`                      |
+| `traefik.<segment_name>.frontend.priority=10`                             | Same as `traefik.frontend.priority`                         |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | Same as `traefik.frontend.rateLimit.extractorFunc`          |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`  |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | Same as `traefik.frontend.rateLimit.rateSet.<name>.average` |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`   |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Same as `traefik.frontend.redirect.entryPoint`              |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Same as `traefik.frontend.redirect.regex`                   |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement`             |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Same as `traefik.frontend.redirect.permanent`               |
+| `traefik.<segment_name>.frontend.rule=EXP`                                | Same as `traefik.frontend.rule`                             |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Same as `traefik.frontend.whiteList.sourceRange`            |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Same as `traefik.frontend.whiteList.useXForwardedFor`       |

 #### Custom Headers

-| Label                                                                | Description                                                                                                                                                                         |
-|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
+| Label                                                                | Description                                              |
+|----------------------------------------------------------------------|----------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders`  |
+| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` |

 #### Security Headers

-| Label                                                                   | Description                                                                                                                                                                                         |
-|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Label                                                                   | Description                                                  |
+|-------------------------------------------------------------------------|--------------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Same as `traefik.frontend.headers.allowedHosts`              |
+| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Same as `traefik.frontend.headers.browserXSSFilter`          |
+| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Same as `traefik.frontend.headers.contentSecurityPolicy`     |
+| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Same as `traefik.frontend.headers.contentTypeNosniff`        |
+| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Same as `traefik.frontend.headers.customBrowserXSSValue`     |
+| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Same as `traefik.frontend.headers.customFrameOptionsValue`   |
+| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Same as `traefik.frontend.headers.forceSTSHeader`            |
+| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Same as `traefik.frontend.headers.frameDeny`                 |
+| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR`        | Same as `traefik.frontend.headers.hostsProxyHeaders`         |
+| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | Same as `traefik.frontend.headers.isDevelopment`             |
+| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Same as `traefik.frontend.headers.publicKey`                 |
+| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Same as `traefik.frontend.headers.referrerPolicy`            |
+| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Same as `traefik.frontend.headers.SSLRedirect`               |
+| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Same as `traefik.frontend.headers.SSLTemporaryRedirect`      |
+| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | Same as `traefik.frontend.headers.SSLHost`                   |
+| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Same as `traefik.frontend.headers.SSLProxyHeaders=EXPR`      |
+| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Same as `traefik.frontend.headers.STSSeconds=315360000`      |
+| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Same as `traefik.frontend.headers.STSIncludeSubdomains=true` |
+| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Same as `traefik.frontend.headers.STSPreload=true`           |

 !!! note
    If a label is defined both as a `container label` and a `segment label` (for example `traefik.<segment_name>.port=PORT` and `traefik.port=PORT` ), the `segment label` is used to defined the `<segment_name>` property (`port` in the example).
--- a/docs/configuration/backends/ecs.md
+++ b/docs/configuration/backends/ecs.md
@@ -33,6 +33,7 @@ clusters = ["default"]
 watch = true

 # Default domain used.
+# Can be overridden by setting the "traefik.domain" label.
 #
 # Optional
 # Default: ""
@@ -92,7 +93,7 @@ secretAccessKey = "123"
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2
 ```

 If `accessKeyID`/`secretAccessKey` is not given credentials will be resolved in the following order:
@@ -135,6 +136,7 @@ Labels can be used on task containers to override default behaviour:

 | Label                                                      | Description                                                                                                                                                                                                            |
 |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                           | Default domain used for frontend rules.                                                                                                                                                                                |
 | `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
 | `traefik.port=80`                                          | Override the default `port` value. Overrides `NetworkBindings` from Docker Container                                                                                                                                   |
 | `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                   |
@@ -187,7 +189,17 @@ Labels can be used on task containers to override default behaviour:
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
+| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
+| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -195,13 +207,3 @@ Labels can be used on task containers to override default behaviour:
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
--- a/docs/configuration/backends/file.md
+++ b/docs/configuration/backends/file.md
@@ -140,19 +140,20 @@ Træfik can be configured with a file.
  # ...
 ```

-## Configuration mode
+## Configuration Mode

-You have three choices:
+You have two choices:

- [Simple](/configuration/backends/file/#simple)
- [Rules in a Separate File](/configuration/backends/file/#rules-in-a-separate-file)
- [Multiple `.toml` Files](/configuration/backends/file/#multiple-toml-files)
+- [Rules in Træfik configuration file](/configuration/backends/file/#rules-in-trfik-configuration-file)
+- [Rules in dedicated files](/configuration/backends/file/#rules-in-dedicated-files)

 To enable the file backend, you must either pass the `--file` option to the Træfik binary or put the `[file]` section (with or without inner settings) in the configuration file.

 The configuration file allows managing both backends/frontends and HTTPS certificates (which are not [Let's Encrypt](https://letsencrypt.org) certificates generated through Træfik).

-### Simple
+TOML templating can be used if rules are not defined in the Træfik configuration file.
+
+### Rules in Træfik Configuration File

 Add your configuration at the end of the global configuration file `traefik.toml`:

@@ -197,9 +198,16 @@ defaultEntryPoints = ["http", "https"]
    Adding certificates directly to the entryPoint is still maintained but certificates declared in this way cannot be managed dynamically.
    It's recommended to use the file provider to declare certificates.

-### Rules in a Separate File
+!!! warning
+    TOML templating cannot be used if rules are defined in the Træfik configuration file.

-Put your rules in a separate file, for example `rules.toml`:
+### Rules in Dedicated Files
+
+Træfik allows defining rules in one or more separate files.
+
+#### One Separate File
+
+You have to specify the file path in the `file.filename` option.

 ```toml
 # traefik.toml
@@ -213,8 +221,31 @@ defaultEntryPoints = ["http", "https"]

 [file]
  filename = "rules.toml"
+  watch = true
 ```

+The option `file.watch` allows Træfik to watch file changes automatically.
+
+#### Multiple Separated Files
+
+You could have multiple `.toml` files in a directory (and recursively in its sub-directories):
+
+```toml
+[file]
+  directory = "/path/to/config/"
+  watch = true
+```
+
+The option `file.watch` allows Træfik to watch file changes automatically.
+
+#### Separate Files Content
+
+If you are defining rules in one or more separate files, you can use two formats.
+
+##### Simple Format
+
+Backends, Frontends and TLS certificates are defined one at time, as described in the file `rules.toml`:
+
 ```toml
 # rules.toml
 [backends]
@@ -239,18 +270,34 @@ defaultEntryPoints = ["http", "https"]
  # ...
 ```

-### Multiple `.toml` Files
+##### TOML Templating

-You could have multiple `.toml` files in a directory (and recursively in its sub-directories):
+!!! warning
+    TOML templating can only be used **if rules are defined in one or more separate files**.
+    Templating will not work in the Træfik configuration file.
+
+Træfik allows using TOML templating.
+
+Thus, it's possible to define easily lot of Backends, Frontends and TLS certificates as described in the file `template-rules.toml` :

 ```toml
-[file]
-  directory = "/path/to/config/"
-```
+# template-rules.toml
+[backends]
+{{ range $i, $e := until 100 }}
+  [backends.backend{{ $e }}]
+    #...
+{{ end }}

-If you want Træfik to watch file changes automatically, just add:
+[frontends]
+{{ range $i, $e := until 100 }}
+  [frontends.frontend{{ $e }}]
+    #...
+{{ end }}

-```toml
-[file]
-  watch = true
+
+# HTTPS certificate
+{{ range $i, $e := until 100 }}
+[[tls]]
+    #...
+{{ end }}
 ```
--- a/docs/configuration/backends/kubernetes.md
+++ b/docs/configuration/backends/kubernetes.md
@@ -218,28 +218,28 @@ The following security annotations are applicable on the Ingress object:
 |                        Annotation                         |                                                                                             Description                                                                                             |
 | ----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `ingress.kubernetes.io/allowed-hosts: EXPR`               | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                             |
+| `ingress.kubernetes.io/browser-xss-filter: "true"`        | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `ingress.kubernetes.io/content-security-policy: VALUE`    | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `ingress.kubernetes.io/content-type-nosniff: "true"`      | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `ingress.kubernetes.io/custom-browser-xss-value: VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `ingress.kubernetes.io/force-hsts: "false"`               | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `ingress.kubernetes.io/frame-deny: "false"`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
+| `ingress.kubernetes.io/hsts-max-age: "315360000"`         | Sets the max-age of the HSTS header.                                                                                                                                                                |
+| `ingress.kubernetes.io/hsts-include-subdomains: "true"`   | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
+| `ingress.kubernetes.io/hsts-preload: "true"`              | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
+| `ingress.kubernetes.io/is-development: "false"`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 | `ingress.kubernetes.io/proxy-headers: EXPR`               | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                      |
+| `ingress.kubernetes.io/public-key: VALUE`                 | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `ingress.kubernetes.io/referrer-policy: VALUE`            | Adds referrer policy  header.                                                                                                                                                                       |
 | `ingress.kubernetes.io/ssl-redirect: "true"`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `ingress.kubernetes.io/ssl-temporary-redirect: "true"`    | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `ingress.kubernetes.io/ssl-host: HOST`                    | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `ingress.kubernetes.io/ssl-proxy-headers: EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
-| `ingress.kubernetes.io/hsts-max-age: "315360000"`         | Sets the max-age of the HSTS header.                                                                                                                                                                |
-| `ingress.kubernetes.io/hsts-include-subdomains: "true"`   | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
-| `ingress.kubernetes.io/hsts-preload: "true"`              | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
-| `ingress.kubernetes.io/force-hsts: "false"`               | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `ingress.kubernetes.io/frame-deny: "false"`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `ingress.kubernetes.io/content-type-nosniff: "true"`      | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `ingress.kubernetes.io/browser-xss-filter: "true"`        | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `ingress.kubernetes.io/custom-browser-xss-value: VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `ingress.kubernetes.io/content-security-policy: VALUE`    | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `ingress.kubernetes.io/public-key: VALUE`                 | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `ingress.kubernetes.io/referrer-policy: VALUE`            | Adds referrer policy  header.                                                                                                                                                                       |
-| `ingress.kubernetes.io/is-development: "false"`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

 ### Authentication

-Is possible to add additional authentication annotations to the Ingress object.
+Additional authentication annotations can be added to the Ingress object.
 The source of the authentication is a Secret object that contains the credentials.

 | Annotation                                    | Description                                                                                                 |
@@ -253,3 +253,12 @@ The following limitations hold:

 - The realm is not configurable; the only supported (and default) value is `traefik`.
 - The Secret must contain a single file only.
+
+### TLS certificates management
+
+TLS certificates can be managed in Secrets objects.
+More information are available in the  [User Guide](/user-guide/kubernetes/#add-a-tls-certificate-to-the-ingress).
+
+!!! note
+    Only TLS certificates provided by users can be stored in Kubernetes Secrets.
+    [Let's Encrypt](https://letsencrypt.org) certificates cannot be managed in Kubernets Secrets yet. 
--- a/docs/configuration/backends/marathon.md
+++ b/docs/configuration/backends/marathon.md
@@ -52,7 +52,7 @@ domain = "marathon.localhost"
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2

 # Expose Marathon apps by default in Traefik.
 #
@@ -171,6 +171,7 @@ The following labels can be defined on Marathon applications. They adjust the be

 | Label                                                      | Description                                                                                                                                                                                                            |
 |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                           | Default domain used for frontend rules.                                                                                                                                                                                |
 | `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
 | `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
 | `traefik.portIndex=1`                                      | Register port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                           |
@@ -225,7 +226,17 @@ The following labels can be defined on Marathon applications. They adjust the be
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
+| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -233,16 +244,6 @@ The following labels can be defined on Marathon applications. They adjust the be
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

 ### Applications with Multiple Ports (segment labels)

@@ -252,61 +253,61 @@ You can define as many segments as ports exposed in an application.

 Segment labels override the default behavior.

-| Label                                                                     | Description                                                                                          |
-|---------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.portIndex=1`                                      | Create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. |
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the service labels could be used.     |
-| `traefik.<segment_name>.protocol=http`                                    | Overrides `traefik.protocol`.                                                                        |
-| `traefik.<segment_name>.weight=10`                                        | Assign this service weight. Overrides `traefik.weight`.                                              |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                         | Sets a Basic Auth for that frontend                                                                  |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this service frontend to `BACKEND`. Default is to assign to the service backend.              |
-| `traefik.<segment_name>.frontend.entryPoints=https`                       | Overrides `traefik.frontend.entrypoints`                                                             |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                     | Overrides `traefik.frontend.passHostHeader`.                                                         |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                        | Overrides `traefik.frontend.passTLSCert`.                                                            |
-| `traefik.<segment_name>.frontend.priority=10`                             | Overrides `traefik.frontend.priority`.                                                               |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                    |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                         |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                                   |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                           |
-| `traefik.<segment_name>.frontend.rule=EXP`                                | Overrides `traefik.frontend.rule`. Default: `{service_name}.{sub_domain}.{domain}`                   |
-| `traefik.<segment_name>.frontend.whitelistSourceRange=RANGE`              | Overrides `traefik.frontend.whitelistSourceRange`.                                                   |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                                  |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                               |
+| Label                                                                     | Description                                                 |
+|---------------------------------------------------------------------------|-------------------------------------------------------------|
+| `traefik.<segment_name>.domain=DOMAIN`                                    | Same as `traefik.domain`                                    |
+| `traefik.<segment_name>.portIndex=1`                                      | Same as `traefik.portIndex`                                 |
+| `traefik.<segment_name>.port=PORT`                                        | Same as `traefik.port`                                      |
+| `traefik.<segment_name>.protocol=http`                                    | Same as `traefik.protocol`                                  |
+| `traefik.<segment_name>.weight=10`                                        | Same as `traefik.weight`                                    |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                         | Same as `traefik.frontend.auth.basic`                       |
+| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Same as `traefik.frontend.backend`                          |
+| `traefik.<segment_name>.frontend.entryPoints=https`                       | Same as `traefik.frontend.entryPoints`                      |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | Same as `traefik.frontend.errors.<name>.backend`            |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | Same as `traefik.frontend.errors.<name>.query`              |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | Same as `traefik.frontend.errors.<name>.status`             |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                     | Same as `traefik.frontend.passHostHeader`                   |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                        | Same as `traefik.frontend.passTLSCert`                      |
+| `traefik.<segment_name>.frontend.priority=10`                             | Same as `traefik.frontend.priority`                         |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | Same as `traefik.frontend.rateLimit.extractorFunc`          |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`  |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | Same as `traefik.frontend.rateLimit.rateSet.<name>.average` |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`   |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Same as `traefik.frontend.redirect.entryPoint`              |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Same as `traefik.frontend.redirect.regex`                   |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement`             |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Same as `traefik.frontend.redirect.permanent`               |
+| `traefik.<segment_name>.frontend.rule=EXP`                                | Same as `traefik.frontend.rule`                             |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Same as `traefik.frontend.whiteList.sourceRange`            |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Same as `traefik.frontend.whiteList.useXForwardedFor`       |

 #### Custom Headers

-| Label                                                                | Description                                                                                                                                                                         |
-|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
+| Label                                                                | Description                                              |
+|----------------------------------------------------------------------|----------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders`  |
+| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` |

 #### Security Headers

-| Label                                                                   | Description                                                                                                                                                                                         |
-|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Label                                                                   | Description                                                  |
+|-------------------------------------------------------------------------|--------------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Same as `traefik.frontend.headers.allowedHosts`              |
+| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Same as `traefik.frontend.headers.browserXSSFilter`          |
+| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Same as `traefik.frontend.headers.contentSecurityPolicy`     |
+| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Same as `traefik.frontend.headers.contentTypeNosniff`        |
+| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Same as `traefik.frontend.headers.customBrowserXSSValue`     |
+| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Same as `traefik.frontend.headers.customFrameOptionsValue`   |
+| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Same as `traefik.frontend.headers.forceSTSHeader`            |
+| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Same as `traefik.frontend.headers.frameDeny`                 |
+| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR`        | Same as `traefik.frontend.headers.hostsProxyHeaders`         |
+| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | Same as `traefik.frontend.headers.isDevelopment`             |
+| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Same as `traefik.frontend.headers.publicKey`                 |
+| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Same as `traefik.frontend.headers.referrerPolicy`            |
+| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Same as `traefik.frontend.headers.SSLRedirect`               |
+| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Same as `traefik.frontend.headers.SSLTemporaryRedirect`      |
+| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | Same as `traefik.frontend.headers.SSLHost`                   |
+| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Same as `traefik.frontend.headers.SSLProxyHeaders=EXPR`      |
+| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Same as `traefik.frontend.headers.STSSeconds=315360000`      |
+| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Same as `traefik.frontend.headers.STSIncludeSubdomains=true` |
+| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Same as `traefik.frontend.headers.STSPreload=true`           |
--- a/docs/configuration/backends/mesos.md
+++ b/docs/configuration/backends/mesos.md
@@ -55,7 +55,7 @@ domain = "mesos.localhost"
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2

 # TLS client configuration. https://golang.org/pkg/crypto/tls/#Config
 #
@@ -108,6 +108,7 @@ The following labels can be defined on Mesos tasks. They adjust the behavior for

 | Label                                                      | Description                                                                                                                                                                                                            |
 |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                           | Default domain used for frontend rules.                                                                                                                                                                                |
 | `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
 | `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
 | `traefik.portIndex=1`                                      | Register port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                           |
@@ -160,7 +161,17 @@ The following labels can be defined on Mesos tasks. They adjust the behavior for
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
+| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -168,13 +179,3 @@ The following labels can be defined on Mesos tasks. They adjust the behavior for
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
--- a/docs/configuration/backends/rancher.md
+++ b/docs/configuration/backends/rancher.md
@@ -61,7 +61,7 @@ enableServiceHealthFilter = true
 # - "1": previous template version (must be used only with older custom templates, see "filename")
 # - "2": current template version (must be used to force template version when "filename" is used)
 #
-# templateVersion = "2"
+# templateVersion = 2
 ```

 To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
@@ -140,6 +140,7 @@ Labels can be used on task containers to override default behavior:

 | Label                                                      | Description                                                                                                                                                                                                               |
 |------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                           | Default domain used for frontend rules.                                                                                                                                                                                   |
 | `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                          |
 | `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                    |
 | `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                      |
@@ -192,7 +193,17 @@ Labels can be used on task containers to override default behavior:
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR`        | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
+| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
+| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
@@ -200,16 +211,6 @@ Labels can be used on task containers to override default behavior:
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

 ### On containers with Multiple Ports (segment labels)

@@ -219,59 +220,60 @@ You can define as many segments as ports exposed in a container.

 Segment labels override the default behavior.

-| Label                                                                     | Description                                                                                      |
-|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the segment labels could be used. |
-| `traefik.<segment_name>.protocol`                                         | Overrides `traefik.protocol`.                                                                    |
-| `traefik.<segment_name>.weight`                                           | Assign this segment weight. Overrides `traefik.weight`.                                          |
-| `traefik.<segment_name>.frontend.auth.basic`                              | Sets a Basic Auth for that frontend                                                              |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this segment frontend to `BACKEND`. Default is to assign to the segment backend.          |
-| `traefik.<segment_name>.frontend.entryPoints`                             | Overrides `traefik.frontend.entrypoints`                                                         |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.passHostHeader`                          | Overrides `traefik.frontend.passHostHeader`.                                                     |
-| `traefik.<segment_name>.frontend.passTLSCert`                             | Overrides `traefik.frontend.passTLSCert`.                                                        |
-| `traefik.<segment_name>.frontend.priority`                                | Overrides `traefik.frontend.priority`.                                                           |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                     |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                               |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                       |
-| `traefik.<segment_name>.frontend.rule`                                    | Overrides `traefik.frontend.rule`.                                                               |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                              |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Overrides `traefik.frontend.whiteList.useXForwardedFor`.                                         |
+| Label                                                                     | Description                                                 |
+|---------------------------------------------------------------------------|-------------------------------------------------------------|
+| `traefik.<segment_name>.domain=DOMAIN`                                    | Same as `traefik.domain`                                    |
+| `traefik.<segment_name>.port=PORT`                                        | Same as `traefik.port`                                      |
+| `traefik.<segment_name>.protocol=http`                                    | Same as `traefik.protocol`                                  |
+| `traefik.<segment_name>.weight=10`                                        | Same as `traefik.weight`                                    |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                         | Same as `traefik.frontend.auth.basic`                       |
+| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Same as `traefik.frontend.backend`                          |
+| `traefik.<segment_name>.frontend.entryPoints=https`                       | Same as `traefik.frontend.entryPoints`                      |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | Same as `traefik.frontend.errors.<name>.backend`            |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | Same as `traefik.frontend.errors.<name>.query`              |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | Same as `traefik.frontend.errors.<name>.status`             |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                     | Same as `traefik.frontend.passHostHeader`                   |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                        | Same as `traefik.frontend.passTLSCert`                      |
+| `traefik.<segment_name>.frontend.priority=10`                             | Same as `traefik.frontend.priority`                         |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | Same as `traefik.frontend.rateLimit.extractorFunc`          |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`  |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | Same as `traefik.frontend.rateLimit.rateSet.<name>.average` |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`   |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Same as `traefik.frontend.redirect.entryPoint`              |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Same as `traefik.frontend.redirect.regex`                   |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Same as `traefik.frontend.redirect.replacement`             |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Same as `traefik.frontend.redirect.permanent`               |
+| `traefik.<segment_name>.frontend.rule=EXP`                                | Same as `traefik.frontend.rule`                             |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Same as `traefik.frontend.whiteList.sourceRange`            |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Same as `traefik.frontend.whiteList.useXForwardedFor`       |

 #### Custom Headers

-| Label                                                                | Description                                                     |
-|----------------------------------------------------------------------|-----------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | overrides `traefik.frontend.headers.customRequestHeaders=EXPR ` |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | overrides `traefik.frontend.headers.customResponseHeaders=EXPR` |
+| Label                                                                | Description                                                |
+|----------------------------------------------------------------------|------------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | overrides `traefik.frontend.headers.customRequestHeaders`  |
+| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | overrides `traefik.frontend.headers.customResponseHeaders` |

 #### Security Headers

-| Label                                                                   | Description                                                        |
-|-------------------------------------------------------------------------|--------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | overrides `traefik.frontend.headers.allowedHosts=EXPR`             |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR`        | overrides `traefik.frontend.headers.hostsProxyHeaders=EXPR`        |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | overrides `traefik.frontend.headers.SSLRedirect=true`              |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | overrides `traefik.frontend.headers.SSLTemporaryRedirect=true`     |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | overrides `traefik.frontend.headers.SSLHost=HOST`                  |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | overrides `traefik.frontend.headers.SSLProxyHeaders=EXPR`          |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | overrides `traefik.frontend.headers.STSSeconds=315360000`          |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | overrides `traefik.frontend.headers.STSIncludeSubdomains=true`     |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | overrides `traefik.frontend.headers.STSPreload=true`               |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | overrides `traefik.frontend.headers.forceSTSHeader=false`          |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | overrides `traefik.frontend.headers.frameDeny=false`               |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | overrides `traefik.frontend.headers.customFrameOptionsValue=VALUE` |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | overrides `traefik.frontend.headers.contentTypeNosniff=true`       |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | overrides `traefik.frontend.headers.browserXSSFilter=true`         |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | overrides `traefik.frontend.headers.customBrowserXSSValue=VALUE`   |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | overrides `traefik.frontend.headers.contentSecurityPolicy=VALUE`   |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | overrides `traefik.frontend.headers.publicKey=VALUE`               |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | overrides `traefik.frontend.headers.referrerPolicy=VALUE`          |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | overrides `traefik.frontend.headers.isDevelopment=false`           |
+| Label                                                                   | Description                                                  |
+|-------------------------------------------------------------------------|--------------------------------------------------------------|
+| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | overrides `traefik.frontend.headers.allowedHosts`            |
+| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | overrides `traefik.frontend.headers.browserXSSFilter`        |
+| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | overrides `traefik.frontend.headers.contentSecurityPolicy`   |
+| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | overrides `traefik.frontend.headers.contentTypeNosniff`      |
+| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | overrides `traefik.frontend.headers.customBrowserXSSValue`   |
+| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | overrides `traefik.frontend.headers.customFrameOptionsValue` |
+| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | overrides `traefik.frontend.headers.forceSTSHeader`          |
+| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | overrides `traefik.frontend.headers.frameDeny`               |
+| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR`        | overrides `traefik.frontend.headers.hostsProxyHeaders`       |
+| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | overrides `traefik.frontend.headers.isDevelopment`           |
+| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | overrides `traefik.frontend.headers.publicKey`               |
+| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | overrides `traefik.frontend.headers.referrerPolicy`          |
+| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | overrides `traefik.frontend.headers.SSLRedirect`             |
+| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | overrides `traefik.frontend.headers.SSLTemporaryRedirect`    |
+| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | overrides `traefik.frontend.headers.SSLHost`                 |
+| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | overrides `traefik.frontend.headers.SSLProxyHeaders`         |
+| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | overrides `traefik.frontend.headers.STSSeconds`              |
+| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | overrides `traefik.frontend.headers.STSIncludeSubdomains`    |
+| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | overrides `traefik.frontend.headers.STSPreload`              |
--- a/docs/configuration/backends/servicefabric.md
+++ b/docs/configuration/backends/servicefabric.md
@@ -61,7 +61,7 @@ Here is an example of an extension setting Træfik labels:
      <Extension Name="Traefik">
        <Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
          <Label Key="traefik.frontend.rule.example2">PathPrefixStrip: /a/path/to/strip</Label>
-          <Label Key="traefik.expose">true</Label>
+          <Label Key="traefik.enable">true</Label> 
          <Label Key="traefik.frontend.passHostHeader">true</Label>
        </Labels>
      </Extension>
--- a/docs/configuration/entrypoints.md
+++ b/docs/configuration/entrypoints.md
@@ -118,7 +118,7 @@ Compress:true
 WhiteList.SourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16
 WhiteList.UseXForwardedFor:true
 ProxyProtocol.TrustedIPs:192.168.0.1
-ProxyProtocol.Insecure:tue
+ProxyProtocol.Insecure:true
 ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24
 Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
 Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e
--- a/docs/configuration/tracing.md
+++ b/docs/configuration/tracing.md
@@ -48,11 +48,14 @@ Træfik supports two backends: Jaeger and Zipkin.

    # Local Agent Host Port instructs reporter to send spans to jaeger-agent at this address
    #
-    # Default: "127.0.0.1:6832"
+    # Default: "127.0.0.1:6831"
    #
-    localAgentHostPort = "127.0.0.1:6832"
+    localAgentHostPort = "127.0.0.1:6831"
 ```

+!!! warning
+    Træfik is only able to send data over compact thrift protocol to the [Jaeger agent](https://www.jaegertracing.io/docs/deployment/#agent). 
+
 ## Zipkin

 ```toml
--- a/docs/img/apollo-logo.png
+++ b/docs/img/apollo-logo.png
--- a/docs/img/asteris.logo.png
+++ b/docs/img/asteris.logo.png
--- a/docs/img/mantl-logo.png
+++ b/docs/img/mantl-logo.png
--- a/docs/img/traefik-health.png
+++ b/docs/img/traefik-health.png
--- a/docs/img/web.frontend.png
+++ b/docs/img/web.frontend.png
--- a/docs/index.md
+++ b/docs/index.md
@@ -19,13 +19,14 @@ Telling Træfik where your orchestrator is could be the _only_ configuration ste
 Imagine that you have deployed a bunch of microservices with the help of an orchestrator (like Swarm or Kubernetes) or a service registry (like etcd or consul).
 Now you want users to access these microservices, and you need a reverse proxy.

-Traditional reverse-proxies require that you configure _each_ route that will connect paths and subdomains to _each_ microservice. In an environment where you add, remove, kill, upgrade, or scale your services _many_ times a day, the task of keeping the routes up to date becomes tedious. 
+Traditional reverse-proxies require that you configure _each_ route that will connect paths and subdomains to _each_ microservice.
+In an environment where you add, remove, kill, upgrade, or scale your services _many_ times a day, the task of keeping the routes up to date becomes tedious.

 **This is when Træfik can help you!**

-Træfik listens to your service registry/orchestrator API and instantly generates the routes so your microservices are connected to the outside world -- without further intervention from your part. 
+Træfik listens to your service registry/orchestrator API and instantly generates the routes so your microservices are connected to the outside world -- without further intervention from your part.

-**Run Træfik and let it do the work for you!** 
+**Run Træfik and let it do the work for you!**
 _(But if you'd rather configure some of your routes manually, Træfik supports that too!)_

 ![Architecture](img/architecture.png)
@@ -76,13 +77,13 @@ version: '3'

 services:
  reverse-proxy:
-    image: traefik #The official Traefik docker image
-    command: --api --docker #Enables the web UI and tells Træfik to listen to docker
+    image: traefik # The official Traefik docker image
+    command: --api --docker # Enables the web UI and tells Træfik to listen to docker
    ports:
-      - "80:80"     #The HTTP port
-      - "8080:8080" #The Web UI (enabled by --api)
+      - "80:80"     # The HTTP port
+      - "8080:8080" # The Web UI (enabled by --api)
    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock #So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
 ```

 **That's it. Now you can launch Træfik!**
@@ -90,21 +91,21 @@ services:
 Start your `reverse-proxy` with the following command:

 ```shell
-docker-compose up -d reverse-proxy 
+docker-compose up -d reverse-proxy
 ```

 You can open a browser and go to [http://localhost:8080](http://localhost:8080) to see Træfik's dashboard (we'll go back there once we have launched a service in step 2).

-### 2 — Launch a Service — Træfik Detects It and Creates a Route for You 
+### 2 — Launch a Service — Træfik Detects It and Creates a Route for You

-Now that we have a Træfik instance up and running, we will deploy new services. 
+Now that we have a Træfik instance up and running, we will deploy new services.

-Edit your `docker-compose.yml` file and add the following at the end of your file. 
+Edit your `docker-compose.yml` file and add the following at the end of your file.

 ```yaml
-# ... 
+# ...
  whoami:
-    image: emilevauge/whoami #A container that exposes an API to show it's IP address
+    image: emilevauge/whoami # A container that exposes an API to show its IP address
    labels:
      - "traefik.frontend.rule=Host:whoami.docker.localhost"
 ```
@@ -112,7 +113,7 @@ Edit your `docker-compose.yml` file and add the following at the end of your fil
 The above defines `whoami`: a simple web service that outputs information about the machine it is deployed on (its IP address, host, and so on).

 Start the `whoami` service with the following command:
- 
+
 ```shell
 docker-compose up -d whoami
 ```
@@ -135,9 +136,9 @@ IP: 172.27.0.3
 ### 3 — Launch More Instances — Traefik Load Balances Them

 Run more instances of your `whoami` service with the following command:
- 
+
 ```shell
-docker-compose up -d --scale whoami=2 
+docker-compose up -d --scale whoami=2
 ```

 Go back to your browser ([http://localhost:8080](http://localhost:8080)) and see that Træfik has automatically detected the new instance of the container.
@@ -164,9 +165,10 @@ IP: 172.27.0.4

 ### 4 — Enjoy Træfik's Magic

-Now that you have a basic understanding of how Træfik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](https://docs.traefik.io/) and let Træfik work for you! Whatever your infrastructure is, there is probably [an available Træfik backend](https://docs.traefik.io/configuration/backends/available) that will do the job. 
+Now that you have a basic understanding of how Træfik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](/) and let Træfik work for you!
+Whatever your infrastructure is, there is probably [an available Træfik backend](/#supported-backends) that will do the job.

-Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Træfik's let's encrypt integration](https://docs.traefik.io/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](https://docs.traefik.io/user-guide/docker-and-lets-encrypt/).
+Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Træfik's let's encrypt integration](/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](/user-guide/docker-and-lets-encrypt/).

 ## Resources

@@ -196,4 +198,4 @@ Using the tiny Docker image:

 ```shell
 docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik
-```
+```
--- a/docs/user-guide/kubernetes.md
+++ b/docs/user-guide/kubernetes.md
@@ -350,7 +350,8 @@ We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube)
 ### Add a TLS Certificate to the Ingress

 !!! note
-    For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. For more details see [here](/configuration/entrypoints/).
+    For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point.
+    For more details see [here](/configuration/entrypoints/).

 To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource.

@@ -374,7 +375,8 @@ spec:
   - secretName: traefik-ui-tls-cert
 ```

-In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress. The following two commands will generate a new certificate and create a secret containing the key and cert files.
+In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress.
+The following two commands will generate a new certificate and create a secret containing the key and cert files.

 ```shell
 openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=traefik-ui.minikube"
@@ -384,13 +386,16 @@ kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=tls.key --cer
 If there are any errors while loading the TLS section of an ingress, the whole ingress will be skipped.

 !!! note
-    The secret must have two entries named `tls.key`and `tls.crt`. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details.
+    The secret must have two entries named `tls.key`and `tls.crt`.
+    See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details.

 !!! note
-    The TLS certificates will be added to all entrypoints defined by the ingress annotation `traefik.frontend.entryPoints`. If no such annotation is provided, the TLS certificates will be added to all TLS-enabled `defaultEntryPoints`.
+    The TLS certificates will be added to all entrypoints defined by the ingress annotation `traefik.frontend.entryPoints`.
+    If no such annotation is provided, the TLS certificates will be added to all TLS-enabled `defaultEntryPoints`.

 !!! note
-    The field `hosts` in the TLS configuration is ignored. Instead, the domains provided by the certificate are used for this purpose. It is recommended to not use wildcard certificates as they will match globally.
+    The field `hosts` in the TLS configuration is ignored. Instead, the domains provided by the certificate are used for this purpose.
+    It is recommended to not use wildcard certificates as they will match globally.

 ## Basic Authentication

@@ -831,13 +836,21 @@ Sometimes Træfik runs along other Ingress controller implementations. One such

 The `kubernetes.io/ingress.class` annotation can be attached to any Ingress object in order to control whether Træfik should handle it.

-If the annotation is missing, contains an empty value, or the value `traefik`, then the Træfik controller will take responsibility and process the associated Ingress object. If the annotation contains any other value (usually the name of a different Ingress controller), Træfik will ignore the object.
+If the annotation is missing, contains an empty value, or the value `traefik`, then the Træfik controller will take responsibility and process the associated Ingress object.
+If the annotation contains any other value (usually the name of a different Ingress controller), Træfik will ignore the object.
+
+It is also possible to set the `ingressClass` option in Træfik to a particular value.
+If that's the case and the value contains a `traefik` prefix, then only those Ingress objects matching the same value will be processed.
+For instance, setting the option to `traefik-internal` causes Træfik to process Ingress objects with the same `kubernetes.io/ingress.class` annotation value, ignoring all other objects (including those with a `traefik` value, empty value, and missing annotation).

 ### Between multiple Træfik Deployments

-Sometimes multiple Træfik Deployments are supposed to run concurrently. For instance, it is conceivable to have one Deployment deal with internal and another one with external traffic.
+Sometimes multiple Træfik Deployments are supposed to run concurrently.
+For instance, it is conceivable to have one Deployment deal with internal and another one with external traffic.

-For such cases, it is advisable to classify Ingress objects through a label and configure the `labelSelector` option per each Træfik Deployment accordingly. To stick with the internal/external example above, all Ingress objects meant for internal traffic could receive a `traffic-type: internal` label while objects designated for external traffic receive a `traffic-type: external` label. The label selectors on the Træfik Deployments would then be `traffic-type=internal` and `traffic-type=external`, respectively.
+For such cases, it is advisable to classify Ingress objects through a label and configure the `labelSelector` option per each Træfik Deployment accordingly.
+To stick with the internal/external example above, all Ingress objects meant for internal traffic could receive a `traffic-type: internal` label while objects designated for external traffic receive a `traffic-type: external` label.
+The label selectors on the Træfik Deployments would then be `traffic-type=internal` and `traffic-type=external`, respectively.

 ## Production advice

--- a/examples/quickstart/README.md
+++ b/examples/quickstart/README.md
@@ -13,11 +13,11 @@ version: '3'

 services:
  reverse-proxy:
-    image: traefik #The official Traefik docker image
-    command: --api --docker #Enables the web UI and tells Træfik to listen to docker
+    image: traefik # The official Traefik docker image
+    command: --api --docker # Enables the web UI and tells Træfik to listen to docker
    ports:
-      - "80:80"     #The HTTP port
-      - "8080:8080" #The Web UI (enabled by --api)
+      - "80:80"     # The HTTP port
+      - "8080:8080" # The Web UI (enabled by --api)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock #So that Traefik can listen to the Docker events
 ```
@@ -41,7 +41,7 @@ Edit your `docker-compose.yml` file and add the following at the end of your fil
 ```yaml
 # ... 
  whoami:
-    image: emilevauge/whoami #A container that exposes an API to show it's IP address
+    image: emilevauge/whoami # A container that exposes an API to show its IP address
    labels:
      - "traefik.frontend.rule=Host:whoami.docker.localhost"
 ```
@@ -101,6 +101,7 @@ IP: 172.27.0.4

 ### 4 — Enjoy Træfik's Magic

-Now that you have a basic understanding of how Træfik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](https://docs.traefik.io/) and let Træfik work for you! Whatever your infrastructure is, there is probably [an available Træfik backend](https://docs.traefik.io/configuration/backends/available) that will do the job. 
+Now that you have a basic understanding of how Træfik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](https://docs.traefik.io/) and let Træfik work for you!
+Whatever your infrastructure is, there is probably [an available Træfik backend](https://docs.traefik.io/#supported-backends) that will do the job.

-Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Træfik's let's encrypt integration](https://docs.traefik.io/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](https://docs.traefik.io/user-guide/docker-and-lets-encrypt/).
+Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Træfik's let's encrypt integration](https://docs.traefik.io/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](https://docs.traefik.io/user-guide/docker-and-lets-encrypt/).
--- a/integration/consul_test.go
+++ b/integration/consul_test.go
@@ -194,12 +194,14 @@ func (s *ConsulSuite) TestNominalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)

 	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/test2", nil)
-	try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
+	c.Assert(err, checker.IsNil)
+	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
 	c.Assert(err, checker.IsNil)

 	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
+	c.Assert(err, checker.IsNil)
 	req.Host = "test2.localhost"
-	try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
+	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
 	c.Assert(err, checker.IsNil)
 }

--- a/integration/docker_compose_test.go
+++ b/integration/docker_compose_test.go
@@ -0,0 +1,78 @@
+package integration
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/containous/traefik/integration/try"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/containous/traefik/types"
+	"github.com/go-check/check"
+	checker "github.com/vdemeester/shakers"
+)
+
+const (
+	composeProject = "minimal"
+)
+
+// Docker test suites
+type DockerComposeSuite struct {
+	BaseSuite
+}
+
+func (s *DockerComposeSuite) SetUpSuite(c *check.C) {
+	s.createComposeProject(c, composeProject)
+	s.composeProject.Start(c)
+}
+
+func (s *DockerComposeSuite) TearDownSuite(c *check.C) {
+	// shutdown and delete compose project
+	if s.composeProject != nil {
+		s.composeProject.Stop(c)
+	}
+}
+
+func (s *DockerComposeSuite) TestComposeScale(c *check.C) {
+	var serviceCount = 2
+	var composeService = "whoami1"
+
+	s.composeProject.Scale(c, composeService, serviceCount)
+
+	file := s.adaptFileForHost(c, "fixtures/docker/simple.toml")
+	defer os.Remove(file)
+
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	req.Host = "my.super.host"
+
+	_, err = try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	c.Assert(err, checker.IsNil)
+
+	resp, err := http.Get("http://127.0.0.1:8080/api/providers/docker")
+	c.Assert(err, checker.IsNil)
+
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, checker.IsNil)
+
+	var provider types.Configuration
+	c.Assert(json.Unmarshal(body, &provider), checker.IsNil)
+
+	// check that we have only one backend with n servers
+	c.Assert(provider.Backends, checker.HasLen, 1)
+
+	myBackend := provider.Backends["backend-"+composeService+"-integrationtest"+composeProject]
+	c.Assert(myBackend, checker.NotNil)
+	c.Assert(myBackend.Servers, checker.HasLen, serviceCount)
+
+	// check that we have only one frontend
+	c.Assert(provider.Frontends, checker.HasLen, 1)
+}
--- a/integration/docker_test.go
+++ b/integration/docker_test.go
@@ -99,7 +99,7 @@ func (s *DockerSuite) TestSimpleConfiguration(c *check.C) {
 	defer cmd.Process.Kill()

 	// TODO validate : run on 80
-	// Expected a 404 as we did not comfigure anything
+	// Expected a 404 as we did not configure anything
 	err = try.GetRequest("http://127.0.0.1:8000/", 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound))
 	c.Assert(err, checker.IsNil)
 }
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -41,6 +41,7 @@ func init() {
 		check.Suite(&ConstraintSuite{})
 		check.Suite(&ConsulCatalogSuite{})
 		check.Suite(&ConsulSuite{})
+		check.Suite(&DockerComposeSuite{})
 		check.Suite(&DockerSuite{})
 		check.Suite(&DynamoDBSuite{})
 		check.Suite(&EtcdSuite{})
--- a/integration/resources/compose/minimal.yml
+++ b/integration/resources/compose/minimal.yml
@@ -0,0 +1,4 @@
+whoami1:
+  image: emilevauge/whoami
+  labels:
+    - traefik.frontend.rule=PathPrefix:/whoami
--- a/metrics/influxdb_test.go
+++ b/metrics/influxdb_test.go
@@ -24,21 +24,21 @@ func TestInfluxDB(t *testing.T) {
 	}

 	expectedBackend := []string{
-		`(traefik\.backend\.requests\.total,code=200,method=GET,service=test count=1) [\d]{19}`,
-		`(traefik\.backend\.requests\.total,code=404,method=GET,service=test count=1) [\d]{19}`,
-		`(traefik\.backend\.request\.duration(?:,backend=test)?,code=200,method=GET,service=test(?:,url=http://127.0.0.1)? p50=10000,p90=10000,p95=10000,p99=10000) [\d]{19}`,
-		`(traefik\.backend\.retries\.total(?:,code=[\d]{3},method=GET)?,service=test count=2) [\d]{19}`,
+		`(traefik\.backend\.requests\.total,backend=test,code=200,method=GET count=1) [\d]{19}`,
+		`(traefik\.backend\.requests\.total,backend=test,code=404,method=GET count=1) [\d]{19}`,
+		`(traefik\.backend\.request\.duration,backend=test,code=200 p50=10000,p90=10000,p95=10000,p99=10000) [\d]{19}`,
+		`(traefik\.backend\.retries\.total(?:,code=[\d]{3},method=GET)?,backend=test count=2) [\d]{19}`,
 		`(traefik\.config\.reload\.total(?:[a-z=0-9A-Z,]+)? count=1) [\d]{19}`,
 		`(traefik\.config\.reload\.total\.failure(?:[a-z=0-9A-Z,]+)? count=1) [\d]{19}`,
 		`(traefik\.backend\.server\.up,backend=test(?:[a-z=0-9A-Z,]+)?,url=http://127.0.0.1 value=1) [\d]{19}`,
 	}

 	msgBackend := udp.ReceiveString(t, func() {
-		influxDBRegistry.BackendReqsCounter().With("service", "test", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet).Add(1)
-		influxDBRegistry.BackendReqsCounter().With("service", "test", "code", strconv.Itoa(http.StatusNotFound), "method", http.MethodGet).Add(1)
-		influxDBRegistry.BackendRetriesCounter().With("service", "test").Add(1)
-		influxDBRegistry.BackendRetriesCounter().With("service", "test").Add(1)
-		influxDBRegistry.BackendReqDurationHistogram().With("service", "test", "code", strconv.Itoa(http.StatusOK)).Observe(10000)
+		influxDBRegistry.BackendReqsCounter().With("backend", "test", "code", strconv.Itoa(http.StatusOK), "method", http.MethodGet).Add(1)
+		influxDBRegistry.BackendReqsCounter().With("backend", "test", "code", strconv.Itoa(http.StatusNotFound), "method", http.MethodGet).Add(1)
+		influxDBRegistry.BackendRetriesCounter().With("backend", "test").Add(1)
+		influxDBRegistry.BackendRetriesCounter().With("backend", "test").Add(1)
+		influxDBRegistry.BackendReqDurationHistogram().With("backend", "test", "code", strconv.Itoa(http.StatusOK)).Observe(10000)
 		influxDBRegistry.ConfigReloadsCounter().Add(1)
 		influxDBRegistry.ConfigReloadsFailureCounter().Add(1)
 		influxDBRegistry.BackendServerUpGauge().With("backend", "test", "url", "http://127.0.0.1").Set(1)
@@ -47,9 +47,9 @@ func TestInfluxDB(t *testing.T) {
 	assertMessage(t, msgBackend, expectedBackend)

 	expectedEntrypoint := []string{
-		`(traefik\.entrypoint\.requests\.total(?:,backend=test,code=[\d]{3})?,entrypoint=test(?:[a-z=0-9A-Z,:/.]+)? count=1) [\d]{19}`,
-		`(traefik\.entrypoint\.request\.duration(?:,backend=test,code=[\d]{3})?,entrypoint=test(?:[a-z=0-9A-Z,:/.]+)? p50=10000,p90=10000,p95=10000,p99=10000) [\d]{19}`,
-		`(traefik\.entrypoint\.connections\.open(?:[a-z=0-9A-Z,]+)?,entrypoint=test,(?:[a-z=0-9A-Z,:.//]+)? value=1) [\d]{19}`,
+		`(traefik\.entrypoint\.requests\.total,entrypoint=test(?:[a-z=0-9A-Z,:/.]+)? count=1) [\d]{19}`,
+		`(traefik\.entrypoint\.request\.duration(?:,code=[\d]{3})?,entrypoint=test(?:[a-z=0-9A-Z,:/.]+)? p50=10000,p90=10000,p95=10000,p99=10000) [\d]{19}`,
+		`(traefik\.entrypoint\.connections\.open,entrypoint=test value=1) [\d]{19}`,
 	}

 	msgEntrypoint := udp.ReceiveString(t, func() {
--- a/metrics/prometheus.go
+++ b/metrics/prometheus.go
@@ -335,6 +335,12 @@ func (g *gauge) With(labelValues ...string) metrics.Gauge {
 	}
 }

+func (g *gauge) Add(delta float64) {
+	collector := g.gv.With(g.labelNamesValues.ToLabels())
+	collector.Add(delta)
+	g.collectors <- newCollector(g.name, g.labelNamesValues, collector)
+}
+
 func (g *gauge) Set(value float64) {
 	collector := g.gv.With(g.labelNamesValues.ToLabels())
 	collector.Set(value)
--- a/middlewares/accesslog/logger.go
+++ b/middlewares/accesslog/logger.go
@@ -267,23 +267,26 @@ func (l *LogHandler) redactHeaders(headers http.Header, fields logrus.Fields, pr
 }

 func (l *LogHandler) keepAccessLog(statusCode, retryAttempts int) bool {
-	switch {
-	case l.config.Filters == nil:
+	if l.config.Filters == nil {
 		// no filters were specified
 		return true
-	case len(l.httpCodeRanges) == 0 && l.config.Filters.RetryAttempts == false:
+	}
+
+	if len(l.httpCodeRanges) == 0 && !l.config.Filters.RetryAttempts {
 		// empty filters were specified, e.g. by passing --accessLog.filters only (without other filter options)
 		return true
-	case l.httpCodeRanges.Contains(statusCode):
-		return true
-	case l.config.Filters.RetryAttempts == true && retryAttempts > 0:
-		return true
-	default:
-		return false
 	}
-}

-//-------------------------------------------------------------------------------------------------
+	if l.httpCodeRanges.Contains(statusCode) {
+		return true
+	}
+
+	if l.config.Filters.RetryAttempts && retryAttempts > 0 {
+		return true
+	}
+
+	return false
+}

 var requestCounter uint64 // Request ID

--- a/middlewares/auth/forward.go
+++ b/middlewares/auth/forward.go
@@ -25,6 +25,7 @@ func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next
 			return http.ErrUseLastResponse
 		},
 	}
+
 	if config.TLS != nil {
 		tlsConfig, err := config.TLS.CreateTLSConfig()
 		if err != nil {
@@ -32,10 +33,12 @@ func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next
 			w.WriteHeader(http.StatusInternalServerError)
 			return
 		}
+
 		httpClient.Transport = &http.Transport{
 			TLSClientConfig: tlsConfig,
 		}
 	}
+
 	forwardReq, err := http.NewRequest(http.MethodGet, config.Address, nil)
 	tracing.LogRequest(tracing.GetSpan(r), forwardReq)
 	if err != nil {
@@ -68,6 +71,8 @@ func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next
 	if forwardResponse.StatusCode < http.StatusOK || forwardResponse.StatusCode >= http.StatusMultipleChoices {
 		log.Debugf("Remote error %s. StatusCode: %d", config.Address, forwardResponse.StatusCode)

+		utils.CopyHeaders(w.Header(), forwardResponse.Header)
+
 		// Grab the location header, if any.
 		redirectURL, err := forwardResponse.Location()

@@ -79,12 +84,7 @@ func Forward(config *types.Forward, w http.ResponseWriter, r *http.Request, next
 			}
 		} else if redirectURL.String() != "" {
 			// Set the location in our response if one was sent back.
-			w.Header().Add("Location", redirectURL.String())
-		}
-
-		// Pass any Set-Cookie headers the forward auth server provides
-		for _, cookie := range forwardResponse.Cookies() {
-			w.Header().Add("Set-Cookie", cookie.String())
+			w.Header().Set("Location", redirectURL.String())
 		}

 		tracing.LogResponseCode(tracing.GetSpan(r), forwardResponse.StatusCode)
--- a/middlewares/auth/forward_test.go
+++ b/middlewares/auth/forward_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/containous/traefik/testhelpers"
 	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/urfave/negroni"
 )

@@ -110,7 +111,6 @@ func TestForwardAuthRedirect(t *testing.T) {
 	assert.Equal(t, http.StatusFound, res.StatusCode, "they should be equal")

 	location, err := res.Location()
-
 	assert.NoError(t, err, "there should be no error")
 	assert.Equal(t, "http://example.com/redirect-test", location.String(), "they should be equal")

@@ -119,10 +119,11 @@ func TestForwardAuthRedirect(t *testing.T) {
 	assert.NotEmpty(t, string(body), "there should be something in the body")
 }

-func TestForwardAuthCookie(t *testing.T) {
+func TestForwardAuthFailResponseHeaders(t *testing.T) {
 	authTs := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		cookie := &http.Cookie{Name: "example", Value: "testing", Path: "/"}
 		http.SetCookie(w, cookie)
+		w.Header().Add("X-Foo", "bar")
 		http.Error(w, "Forbidden", http.StatusForbidden)
 	}))
 	defer authTs.Close()
@@ -142,23 +143,36 @@ func TestForwardAuthCookie(t *testing.T) {
 	ts := httptest.NewServer(n)
 	defer ts.Close()

-	client := &http.Client{}
 	req := testhelpers.MustNewRequest(http.MethodGet, ts.URL, nil)
+	client := &http.Client{}
 	res, err := client.Do(req)
 	assert.NoError(t, err, "there should be no error")
 	assert.Equal(t, http.StatusForbidden, res.StatusCode, "they should be equal")

+	require.Len(t, res.Cookies(), 1)
 	for _, cookie := range res.Cookies() {
 		assert.Equal(t, "testing", cookie.Value, "they should be equal")
 	}

+	expectedHeaders := http.Header{
+		"Content-Length":         []string{"10"},
+		"Content-Type":           []string{"text/plain; charset=utf-8"},
+		"X-Foo":                  []string{"bar"},
+		"Set-Cookie":             []string{"example=testing; Path=/"},
+		"X-Content-Type-Options": []string{"nosniff"},
+	}
+
+	assert.Len(t, res.Header, 6)
+	for key, value := range expectedHeaders {
+		assert.Equal(t, value, res.Header[key])
+	}
+
 	body, err := ioutil.ReadAll(res.Body)
 	assert.NoError(t, err, "there should be no error")
 	assert.Equal(t, "Forbidden\n", string(body), "they should be equal")
 }

 func Test_writeHeader(t *testing.T) {
-
 	testCases := []struct {
 		name               string
 		headers            map[string]string
--- a/middlewares/errorpages/error_pages.go
+++ b/middlewares/errorpages/error_pages.go
@@ -3,15 +3,17 @@ package errorpages
 import (
 	"bufio"
 	"bytes"
+	"errors"
+	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 	"strings"

 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/middlewares"
 	"github.com/containous/traefik/types"
-	"github.com/pkg/errors"
 	"github.com/vulcand/oxy/forward"
 	"github.com/vulcand/oxy/utils"
 )
@@ -75,8 +77,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request, next http.
 	recorder := newResponseRecorder(w)
 	next.ServeHTTP(recorder, req)

-	w.WriteHeader(recorder.GetCode())
-
 	// check the recorder code against the configured http status code ranges
 	for _, block := range h.httpCodeRanges {
 		if recorder.GetCode() >= block[0] && recorder.GetCode() <= block[1] {
@@ -88,20 +88,43 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, req *http.Request, next http.
 				query = strings.Replace(query, "{status}", strconv.Itoa(recorder.GetCode()), -1)
 			}

-			if newReq, err := http.NewRequest(http.MethodGet, h.backendURL+query, nil); err != nil {
+			pageReq, err := newRequest(h.backendURL + query)
+			if err != nil {
+				log.Error(err)
+				w.WriteHeader(recorder.GetCode())
 				w.Write([]byte(http.StatusText(recorder.GetCode())))
-			} else {
-				h.backendHandler.ServeHTTP(w, newReq)
+				return
 			}
+
+			utils.CopyHeaders(pageReq.Header, req.Header)
+			utils.CopyHeaders(w.Header(), recorder.Header())
+			w.WriteHeader(recorder.GetCode())
+			h.backendHandler.ServeHTTP(w, pageReq)
 			return
 		}
 	}

 	// did not catch a configured status code so proceed with the request
 	utils.CopyHeaders(w.Header(), recorder.Header())
+	w.WriteHeader(recorder.GetCode())
 	w.Write(recorder.GetBody().Bytes())
 }

+func newRequest(baseURL string) (*http.Request, error) {
+	u, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("error pages: error when parse URL: %v", err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("error pages: error when create query: %v", err)
+	}
+
+	req.RequestURI = u.RequestURI()
+	return req, nil
+}
+
 type responseRecorder interface {
 	http.ResponseWriter
 	http.Flusher
--- a/middlewares/errorpages/error_pages_test.go
+++ b/middlewares/errorpages/error_pages_test.go
@@ -65,7 +65,7 @@ func TestHandler(t *testing.T) {
 			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503-503"}},
 			backendCode: http.StatusServiceUnavailable,
 			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.URL.RequestURI() == "/"+strconv.Itoa(503) {
+				if r.RequestURI == "/503" {
 					fmt.Fprintln(w, "My 503 page.")
 				} else {
 					fmt.Fprintln(w, "Failed")
@@ -82,7 +82,7 @@ func TestHandler(t *testing.T) {
 			errorPage:   &types.ErrorPage{Backend: "error", Query: "/{status}", Status: []string{"503"}},
 			backendCode: http.StatusServiceUnavailable,
 			backendErrorHandler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.URL.RequestURI() == "/"+strconv.Itoa(503) {
+				if r.RequestURI == "/503" {
 					fmt.Fprintln(w, "My 503 page.")
 				} else {
 					fmt.Fprintln(w, "Failed")
@@ -239,7 +239,7 @@ func TestHandlerOldWay(t *testing.T) {

 func TestHandlerOldWayIntegration(t *testing.T) {
 	errorPagesServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.RequestURI() == "/"+strconv.Itoa(503) {
+		if r.URL.RequestURI() == "/503" {
 			fmt.Fprintln(w, "My 503 page.")
 		} else {
 			fmt.Fprintln(w, "Test Server")
@@ -318,6 +318,7 @@ func TestHandlerOldWayIntegration(t *testing.T) {
 			require.NoError(t, err)

 			handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("X-Foo", "bar")
 				w.WriteHeader(test.backendCode)
 				fmt.Fprintln(w, http.StatusText(test.backendCode))
 			})
@@ -330,6 +331,7 @@ func TestHandlerOldWayIntegration(t *testing.T) {
 			n.ServeHTTP(recorder, req)

 			test.validate(t, recorder)
+			assert.Equal(t, "bar", recorder.Header().Get("X-Foo"), "missing header")
 		})
 	}
 }
--- a/middlewares/ip_whitelister.go
+++ b/middlewares/ip_whitelister.go
@@ -38,21 +38,15 @@ func NewIPWhiteLister(whiteList []string, useXForwardedFor bool) (*IPWhiteLister
 }

 func (wl *IPWhiteLister) handle(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-	allowed, ip, err := wl.whiteLister.IsAuthorized(r)
+	err := wl.whiteLister.IsAuthorized(r)
 	if err != nil {
-		tracing.SetErrorAndDebugLog(r, "request %+v matched none of the white list - rejecting", r)
+		tracing.SetErrorAndDebugLog(r, "request %+v - rejecting: %v", r, err)
 		reject(w)
 		return
 	}

-	if allowed {
-		tracing.SetErrorAndDebugLog(r, "request %+v matched white list %s - passing", r, wl.whiteLister)
-		next.ServeHTTP(w, r)
-		return
-	}
-
-	tracing.SetErrorAndDebugLog(r, "source-IP %s matched none of the white list - rejecting", ip)
-	reject(w)
+	tracing.SetErrorAndDebugLog(r, "request %+v matched white list %s - passing", r, wl.whiteLister)
+	next.ServeHTTP(w, r)
 }

 func (wl *IPWhiteLister) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
@@ -63,5 +57,8 @@ func reject(w http.ResponseWriter) {
 	statusCode := http.StatusForbidden

 	w.WriteHeader(statusCode)
-	w.Write([]byte(http.StatusText(statusCode)))
+	_, err := w.Write([]byte(http.StatusText(statusCode)))
+	if err != nil {
+		log.Error(err)
+	}
 }
--- a/middlewares/ip_whitelister_test.go
+++ b/middlewares/ip_whitelister_test.go
@@ -88,6 +88,13 @@ func TestIPWhiteLister_ServeHTTP(t *testing.T) {
 			xForwardedFor:    []string{"30.30.30.30", "40.40.40.40"},
 			expected:         200,
 		},
+		{
+			desc:             "authorized with only one X-Forwarded-For",
+			whiteList:        []string{"30.30.30.30"},
+			useXForwardedFor: true,
+			xForwardedFor:    []string{"30.30.30.30"},
+			expected:         200,
+		},
 		{
 			desc:             "non authorized with X-Forwarded-For",
 			whiteList:        []string{"30.30.30.30"},
--- a/middlewares/metrics.go
+++ b/middlewares/metrics.go
@@ -41,11 +41,13 @@ func NewBackendMetricsMiddleware(registry metrics.Registry, backendName string)
 }

 type metricsMiddleware struct {
+	// Important: Since this int64 field is using sync/atomic, it has to be at the top of the struct due to a bug on 32-bit platform
+	// See: https://golang.org/pkg/sync/atomic/ for more information
+	openConns            int64
 	reqsCounter          gokitmetrics.Counter
 	reqDurationHistogram gokitmetrics.Histogram
 	openConnsGauge       gokitmetrics.Gauge
 	baseLabels           []string
-	openConns            int64
 }

 func (m *metricsMiddleware) ServeHTTP(rw http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
--- a/middlewares/tracing/jaeger/jaeger.go
+++ b/middlewares/tracing/jaeger/jaeger.go
@@ -48,7 +48,7 @@ func (c *Config) Setup(componentName string) (opentracing.Tracer, io.Closer, err
 		log.Warnf("Could not initialize jaeger tracer: %s", err.Error())
 		return nil, nil, err
 	}
-	log.Debugf("jaeger tracer configured", err)
+	log.Debug("Jaeger tracer configured")

 	return opentracing.GlobalTracer(), closer, nil
 }
--- a/middlewares/tracing/tracing.go
+++ b/middlewares/tracing/tracing.go
@@ -73,7 +73,10 @@ func (t *Tracing) IsEnabled() bool {
 // Close tracer
 func (t *Tracing) Close() {
 	if t.closer != nil {
-		t.closer.Close()
+		err := t.closer.Close()
+		if err != nil {
+			log.Warn(err)
+		}
 	}
 }

@@ -104,10 +107,13 @@ func GetSpan(r *http.Request) opentracing.Span {
 // InjectRequestHeaders used to inject OpenTracing headers into the request
 func InjectRequestHeaders(r *http.Request) {
 	if span := GetSpan(r); span != nil {
-		opentracing.GlobalTracer().Inject(
+		err := opentracing.GlobalTracer().Inject(
 			span.Context(),
 			opentracing.HTTPHeaders,
 			opentracing.HTTPHeadersCarrier(r.Header))
+		if err != nil {
+			log.Error(err)
+		}
 	}
 }

--- a/middlewares/tracing/zipkin/zipkin.go
+++ b/middlewares/tracing/zipkin/zipkin.go
@@ -3,6 +3,7 @@ package zipkin
 import (
 	"io"

+	"github.com/containous/traefik/log"
 	opentracing "github.com/opentracing/opentracing-go"
 	zipkin "github.com/openzipkin/zipkin-go-opentracing"
 )
@@ -39,5 +40,7 @@ func (c *Config) Setup(serviceName string) (opentracing.Tracer, io.Closer, error
 	// Without this, child spans are getting the NOOP tracer
 	opentracing.SetGlobalTracer(tracer)

+	log.Debug("Zipkin tracer configured")
+
 	return tracer, collector, nil
 }
--- a/provider/acme/account.go
+++ b/provider/acme/account.go
@@ -19,7 +19,7 @@ type Account struct {

 const (
 	// RegistrationURLPathV1Regexp is a regexp which match ACME registration URL in the V1 format
-	RegistrationURLPathV1Regexp string = `^.*/acme/reg/\d+$`
+	RegistrationURLPathV1Regexp = `^.*/acme/reg/\d+$`
 )

 // NewAccount creates an account
--- a/provider/acme/local_store.go
+++ b/provider/acme/local_store.go
@@ -52,6 +52,7 @@ func (s *LocalStore) get() (*StoredData, error) {
 					return nil, err
 				}
 			}
+
 			// Check if ACME Account is in ACME V1 format
 			if s.storedData.Account != nil && s.storedData.Account.Registration != nil {
 				isOldRegistration, err := regexp.MatchString(RegistrationURLPathV1Regexp, s.storedData.Account.Registration.URI)
@@ -63,6 +64,21 @@ func (s *LocalStore) get() (*StoredData, error) {
 					s.SaveDataChan <- s.storedData
 				}
 			}
+
+			// Delete all certificates with no value
+			var certificates []*Certificate
+			for _, certificate := range s.storedData.Certificates {
+				if len(certificate.Certificate) == 0 || len(certificate.Key) == 0 {
+					log.Debugf("Delete certificate %v for domains %v which have no value.", certificate, certificate.Domain.ToStrArray())
+					continue
+				}
+				certificates = append(certificates, certificate)
+			}
+
+			if len(certificates) < len(s.storedData.Certificates) {
+				s.storedData.Certificates = certificates
+				s.SaveDataChan <- s.storedData
+			}
 		}
 	}

--- a/provider/acme/provider.go
+++ b/provider/acme/provider.go
@@ -41,7 +41,7 @@ type Configuration struct {
 	Storage       string         `description:"Storage to use."`
 	EntryPoint    string         `description:"EntryPoint to use."`
 	OnHostRule    bool           `description:"Enable certificate generation on frontends Host rules."`
-	OnDemand      bool           `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` //deprecated
+	OnDemand      bool           `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` // Deprecated
 	DNSChallenge  *DNSChallenge  `description:"Activate DNS-01 Challenge"`
 	HTTPChallenge *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
 	Domains       []types.Domain `description:"CN and SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='*.main.net'. No SANs for wildcards domain. Wildcard domains only accepted with DNSChallenge"`
@@ -225,11 +225,17 @@ func (p *Provider) resolveCertificate(domain types.Domain, domainFromConfigurati
 	}

 	bundle := true
+
 	certificate, failures := client.ObtainCertificate(uncheckedDomains, bundle, nil, OSCPMustStaple)
 	if len(failures) > 0 {
 		return nil, fmt.Errorf("cannot obtain certificates %+v", failures)
 	}
-	log.Debugf("Certificates obtained for domain %+v", uncheckedDomains)
+
+	if len(certificate.Certificate) == 0 || len(certificate.PrivateKey) == 0 {
+		return nil, fmt.Errorf("domains %v generate certificate with no value: %v", uncheckedDomains, certificate)
+	}
+	log.Debugf("Certificates obtained for domains %+v", uncheckedDomains)
+
 	if len(uncheckedDomains) > 1 {
 		domain = types.Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
 	} else {
@@ -341,7 +347,6 @@ func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *s
 		safe.Go(func() {
 			if _, err := p.resolveCertificate(domain, true); err != nil {
 				log.Errorf("Unable to obtain ACME certificate for domains %q : %v", strings.Join(domain.ToStrArray(), ","), err)
-			} else {
 			}
 		})
 	}
@@ -395,15 +400,6 @@ func (p *Provider) watchCertificate() {
 	})
 }

-func (p *Provider) deleteCertificateForDomain(domain types.Domain) {
-	for k, cert := range p.certificates {
-		if reflect.DeepEqual(cert.Domain, domain) {
-			p.certificates = append(p.certificates[:k], p.certificates[k+1:]...)
-		}
-	}
-	p.saveCertificates()
-}
-
 func (p *Provider) saveCertificates() {
 	err := p.Store.SaveCertificates(p.certificates)
 	if err != nil {
@@ -446,16 +442,25 @@ func (p *Provider) renewCertificates() {
 				log.Infof("Error renewing certificate from LE : %+v, %v", certificate.Domain, err)
 				continue
 			}
+
 			log.Infof("Renewing certificate from LE : %+v", certificate.Domain)
+
 			renewedCert, err := client.RenewCertificate(acme.CertificateResource{
 				Domain:      certificate.Domain.Main,
 				PrivateKey:  certificate.Key,
 				Certificate: certificate.Certificate,
 			}, true, OSCPMustStaple)
+
 			if err != nil {
 				log.Errorf("Error renewing certificate from LE: %v, %v", certificate.Domain, err)
 				continue
 			}
+
+			if len(renewedCert.Certificate) == 0 || len(renewedCert.PrivateKey) == 0 {
+				log.Errorf("domains %v renew certificate with no value: %v", certificate.Domain.ToStrArray(), certificate)
+				continue
+			}
+
 			p.addCertificateForDomain(certificate.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
 		}
 	}
@@ -473,6 +478,7 @@ func (p *Provider) AddRoutes(router *mux.Router) {
 					log.Debugf("Unable to split host and port: %v. Fallback to request host.", err)
 					domain = req.Host
 				}
+
 				tokenValue := getTokenValue(token, domain, p.Store)
 				if len(tokenValue) > 0 {
 					rw.WriteHeader(http.StatusOK)
--- a/provider/consulcatalog/config.go
+++ b/provider/consulcatalog/config.go
@@ -237,19 +237,6 @@ func hasTag(name string, tags []string) bool {
 	return false
 }

-func hasTagPrefix(name string, tags []string) bool {
-	lowerName := strings.ToLower(name)
-
-	for _, tag := range tags {
-		lowerTag := strings.ToLower(tag)
-
-		if strings.HasPrefix(lowerTag, lowerName) {
-			return true
-		}
-	}
-	return false
-}
-
 func getTag(name string, tags []string, defaultValue string) string {
 	lowerName := strings.ToLower(name)

--- a/provider/consulcatalog/deprecated_config.go
+++ b/provider/consulcatalog/deprecated_config.go
@@ -156,17 +156,6 @@ func (p *Provider) getFuncSliceAttribute(name string) func(tags []string) []stri
 	}
 }

-// Deprecated
-func (p *Provider) getMapAttribute(name string, tags []string) map[string]string {
-	rawValue := getTag(p.getPrefixedName(name), tags, "")
-
-	if len(rawValue) == 0 {
-		return nil
-	}
-
-	return label.ParseMapValue(p.getPrefixedName(name), rawValue)
-}
-
 // Deprecated
 func (p *Provider) getFuncIntAttribute(name string, defaultValue int) func(tags []string) int {
 	return func(tags []string) int {
@@ -180,13 +169,6 @@ func (p *Provider) getFuncBoolAttribute(name string, defaultValue bool) func(tag
 	}
 }

-// Deprecated
-func (p *Provider) getFuncHasAttributePrefix(name string) func(tags []string) bool {
-	return func(tags []string) bool {
-		return p.hasAttributePrefix(name, tags)
-	}
-}
-
 // Deprecated
 func (p *Provider) getInt64Attribute(name string, tags []string, defaultValue int64) int64 {
 	rawValue := getTag(p.getPrefixedName(name), tags, "")
@@ -244,7 +226,3 @@ func (p *Provider) getBoolAttribute(name string, tags []string, defaultValue boo
 	}
 	return value
 }
-
-func (p *Provider) hasAttributePrefix(name string, tags []string) bool {
-	return hasTagPrefix(p.getPrefixedName(name), tags)
-}
--- a/provider/docker/config.go
+++ b/provider/docker/config.go
@@ -67,12 +67,13 @@ func (p *Provider) buildConfigurationV2(containersInspected []dockerData) *types
 			container.SegmentLabels = labels
 			container.SegmentName = segmentName

-			// Frontends
-			if _, exists := serviceNames[container.ServiceName+segmentName]; !exists {
+			serviceNamesKey := getServiceNameKey(container, p.SwarmMode, segmentName)
+
+			if _, exists := serviceNames[serviceNamesKey]; !exists {
 				frontendName := p.getFrontendName(container, idx)
 				frontends[frontendName] = append(frontends[frontendName], container)
-				if len(container.ServiceName+segmentName) > 0 {
-					serviceNames[container.ServiceName+segmentName] = struct{}{}
+				if len(serviceNamesKey) > 0 {
+					serviceNames[serviceNamesKey] = struct{}{}
 				}
 			}

@@ -104,6 +105,16 @@ func (p *Provider) buildConfigurationV2(containersInspected []dockerData) *types
 	return configuration
 }

+func getServiceNameKey(container dockerData, swarmMode bool, segmentName string) string {
+	serviceNameKey := container.ServiceName
+
+	if values, err := label.GetStringMultipleStrict(container.Labels, labelDockerComposeProject, labelDockerComposeService); !swarmMode && err == nil {
+		serviceNameKey = values[labelDockerComposeService] + values[labelDockerComposeProject]
+	}
+
+	return serviceNameKey + segmentName
+}
+
 func (p *Provider) containerFilter(container dockerData) bool {
 	if !label.IsEnabled(container.Labels, p.ExposedByDefault) {
 		log.Debugf("Filtering disabled container %s", container.Name)
@@ -171,19 +182,20 @@ func (p *Provider) getFrontendRule(container dockerData, segmentLabels map[strin
 		return value
 	}

+	domain := label.GetStringValue(segmentLabels, label.TraefikDomain, p.Domain)
+
 	if values, err := label.GetStringMultipleStrict(container.Labels, labelDockerComposeProject, labelDockerComposeService); err == nil {
-		return "Host:" + getSubDomain(values[labelDockerComposeService]+"."+values[labelDockerComposeProject]) + "." + p.Domain
+		return "Host:" + getSubDomain(values[labelDockerComposeService]+"."+values[labelDockerComposeProject]) + "." + domain
 	}

-	if len(p.Domain) > 0 {
-		return "Host:" + getSubDomain(container.ServiceName) + "." + p.Domain
+	if len(domain) > 0 {
+		return "Host:" + getSubDomain(container.ServiceName) + "." + domain
 	}

 	return ""
 }

 func (p Provider) getIPAddress(container dockerData) string {
-
 	if value := label.GetStringValue(container.Labels, labelDockerNetwork, ""); value != "" {
 		networkSettings := container.NetworkSettings
 		if networkSettings.Networks != nil {
@@ -235,6 +247,8 @@ func (p Provider) getIPAddress(container dockerData) string {
 	for _, network := range container.NetworkSettings.Networks {
 		return network.Addr
 	}
+
+	log.Warnf("Unable to find the IP address for the container %q.", container.Name)
 	return ""
 }

@@ -303,12 +317,17 @@ func (p *Provider) getServers(containers []dockerData) map[string]types.Server {
 	var servers map[string]types.Server

 	for i, container := range containers {
+		ip := p.getIPAddress(container)
+		if len(ip) == 0 {
+			log.Warnf("Unable to find the IP address for the container %q: the server is ignored.", container.Name)
+			continue
+		}
+
 		if servers == nil {
 			servers = make(map[string]types.Server)
 		}

 		protocol := label.GetStringValue(container.SegmentLabels, label.TraefikProtocol, label.DefaultProtocol)
-		ip := p.getIPAddress(container)
 		port := getPort(container)

 		serverName := "server-" + container.SegmentName + "-" + container.Name
--- a/provider/docker/config_container_docker_test.go
+++ b/provider/docker/config_container_docker_test.go
@@ -304,12 +304,102 @@ func TestDockerBuildConfiguration(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc: "when docker compose scale with different compose service names",
+			containers: []docker.ContainerJSON{
+				containerJSON(
+					name("test_0"),
+					labels(map[string]string{
+						labelDockerComposeProject: "myProject",
+						labelDockerComposeService: "myService",
+					}),
+					ports(nat.PortMap{
+						"80/tcp": {},
+					}),
+					withNetwork("bridge", ipv4("127.0.0.1")),
+				),
+				containerJSON(
+					name("test_1"),
+					labels(map[string]string{
+						labelDockerComposeProject: "myProject",
+						labelDockerComposeService: "myService",
+					}),
+
+					ports(nat.PortMap{
+						"80/tcp": {},
+					}),
+
+					withNetwork("bridge", ipv4("127.0.0.2")),
+				),
+				containerJSON(
+					name("test_2"),
+					labels(map[string]string{
+						labelDockerComposeProject: "myProject",
+						labelDockerComposeService: "myService2",
+					}),
+
+					ports(nat.PortMap{
+						"80/tcp": {},
+					}),
+
+					withNetwork("bridge", ipv4("127.0.0.3")),
+				),
+			},
+			expectedFrontends: map[string]*types.Frontend{
+				"frontend-Host-myService-myProject-docker-localhost-0": {
+					Backend:        "backend-myService-myProject",
+					PassHostHeader: true,
+					EntryPoints:    []string{},
+					BasicAuth:      []string{},
+					Routes: map[string]types.Route{
+						"route-frontend-Host-myService-myProject-docker-localhost-0": {
+							Rule: "Host:myService.myProject.docker.localhost",
+						},
+					},
+				},
+				"frontend-Host-myService2-myProject-docker-localhost-2": {
+					Backend:        "backend-myService2-myProject",
+					PassHostHeader: true,
+					EntryPoints:    []string{},
+					BasicAuth:      []string{},
+					Routes: map[string]types.Route{
+						"route-frontend-Host-myService2-myProject-docker-localhost-2": {
+							Rule: "Host:myService2.myProject.docker.localhost",
+						},
+					},
+				},
+			},
+			expectedBackends: map[string]*types.Backend{
+				"backend-myService-myProject": {
+					Servers: map[string]types.Server{
+						"server-test-0": {
+							URL:    "http://127.0.0.1:80",
+							Weight: label.DefaultWeight,
+						}, "server-test-1": {
+							URL:    "http://127.0.0.2:80",
+							Weight: label.DefaultWeight,
+						},
+					},
+					CircuitBreaker: nil,
+				},
+				"backend-myService2-myProject": {
+					Servers: map[string]types.Server{
+						"server-test-2": {
+							URL:    "http://127.0.0.3:80",
+							Weight: label.DefaultWeight,
+						},
+					},
+					CircuitBreaker: nil,
+				},
+			},
+		},
 	}

 	for _, test := range testCases {
 		test := test
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
+
 			var dockerDataList []dockerData
 			for _, cont := range test.containers {
 				dData := parseContainer(cont)
@@ -713,15 +803,19 @@ func TestDockerGetFrontendRule(t *testing.T) {
 			expected:  "Host:foo.docker.localhost",
 		},
 		{
-			container: containerJSON(name("bar")),
-			expected:  "Host:bar.docker.localhost",
+			container: containerJSON(name("foo"),
+				labels(map[string]string{
+					label.TraefikDomain: "traefik.localhost",
+				})),
+			expected: "Host:foo.traefik.localhost",
 		},
 		{
 			container: containerJSON(labels(map[string]string{
 				label.TraefikFrontendRule: "Host:foo.bar",
 			})),
 			expected: "Host:foo.bar",
-		}, {
+		},
+		{
 			container: containerJSON(labels(map[string]string{
 				"com.docker.compose.project": "foo",
 				"com.docker.compose.service": "bar",
@@ -926,3 +1020,122 @@ func TestDockerGetPort(t *testing.T) {
 		})
 	}
 }
+
+func TestDockerGetServers(t *testing.T) {
+	p := &Provider{}
+
+	testCases := []struct {
+		desc       string
+		containers []docker.ContainerJSON
+		expected   map[string]types.Server
+	}{
+		{
+			desc:     "no container",
+			expected: nil,
+		},
+		{
+			desc: "with a simple container",
+			containers: []docker.ContainerJSON{
+				containerJSON(
+					name("test1"),
+					withNetwork("testnet", ipv4("10.10.10.10")),
+					ports(nat.PortMap{
+						"80/tcp": {},
+					})),
+			},
+			expected: map[string]types.Server{
+				"server-test1": {
+					URL:    "http://10.10.10.10:80",
+					Weight: 1,
+				},
+			},
+		},
+		{
+			desc: "with several containers",
+			containers: []docker.ContainerJSON{
+				containerJSON(
+					name("test1"),
+					withNetwork("testnet", ipv4("10.10.10.11")),
+					ports(nat.PortMap{
+						"80/tcp": {},
+					})),
+				containerJSON(
+					name("test2"),
+					withNetwork("testnet", ipv4("10.10.10.12")),
+					ports(nat.PortMap{
+						"81/tcp": {},
+					})),
+				containerJSON(
+					name("test3"),
+					withNetwork("testnet", ipv4("10.10.10.13")),
+					ports(nat.PortMap{
+						"82/tcp": {},
+					})),
+			},
+			expected: map[string]types.Server{
+				"server-test1": {
+					URL:    "http://10.10.10.11:80",
+					Weight: 1,
+				},
+				"server-test2": {
+					URL:    "http://10.10.10.12:81",
+					Weight: 1,
+				},
+				"server-test3": {
+					URL:    "http://10.10.10.13:82",
+					Weight: 1,
+				},
+			},
+		},
+		{
+			desc: "ignore one container because no ip address",
+			containers: []docker.ContainerJSON{
+				containerJSON(
+					name("test1"),
+					withNetwork("testnet", ipv4("")),
+					ports(nat.PortMap{
+						"80/tcp": {},
+					})),
+				containerJSON(
+					name("test2"),
+					withNetwork("testnet", ipv4("10.10.10.12")),
+					ports(nat.PortMap{
+						"81/tcp": {},
+					})),
+				containerJSON(
+					name("test3"),
+					withNetwork("testnet", ipv4("10.10.10.13")),
+					ports(nat.PortMap{
+						"82/tcp": {},
+					})),
+			},
+			expected: map[string]types.Server{
+				"server-test2": {
+					URL:    "http://10.10.10.12:81",
+					Weight: 1,
+				},
+				"server-test3": {
+					URL:    "http://10.10.10.13:82",
+					Weight: 1,
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			var dockerDataList []dockerData
+			for _, cont := range test.containers {
+				dData := parseContainer(cont)
+				dockerDataList = append(dockerDataList, dData)
+			}
+
+			servers := p.getServers(dockerDataList)
+
+			assert.Equal(t, test.expected, servers)
+		})
+	}
+}
--- a/provider/docker/config_container_swarm_test.go
+++ b/provider/docker/config_container_swarm_test.go
@@ -554,8 +554,11 @@ func TestSwarmGetFrontendRule(t *testing.T) {
 			networks: map[string]*docker.NetworkResource{},
 		},
 		{
-			service:  swarmService(serviceName("bar")),
-			expected: "Host:bar.docker.localhost",
+			service: swarmService(serviceName("foo"),
+				serviceLabels(map[string]string{
+					label.TraefikDomain: "traefik.localhost",
+				})),
+			expected: "Host:foo.traefik.localhost",
 			networks: map[string]*docker.NetworkResource{},
 		},
 		{
--- a/provider/docker/deprecated_config.go
+++ b/provider/docker/deprecated_config.go
@@ -125,11 +125,14 @@ func (p *Provider) buildConfigurationV1(containersInspected []dockerData) *types
 	servers := map[string][]dockerData{}
 	serviceNames := make(map[string]struct{})
 	for idx, container := range filteredContainers {
-		if _, exists := serviceNames[container.ServiceName]; !exists {
+
+		serviceNamesKey := getServiceNameKey(container, p.SwarmMode, "")
+
+		if _, exists := serviceNames[serviceNamesKey]; !exists {
 			frontendName := p.getFrontendNameV1(container, idx)
 			frontends[frontendName] = append(frontends[frontendName], container)
-			if len(container.ServiceName) > 0 {
-				serviceNames[container.ServiceName] = struct{}{}
+			if len(serviceNamesKey) > 0 {
+				serviceNames[serviceNamesKey] = struct{}{}
 			}
 		}
 		backendName := getBackendNameV1(container)
--- a/provider/docker/deprecated_container.go
+++ b/provider/docker/deprecated_container.go
@@ -27,12 +27,14 @@ func (p Provider) getFrontendRuleV1(container dockerData) string {
 		return value
 	}

+	domain := label.GetStringValue(container.Labels, label.TraefikDomain, p.Domain)
+
 	if values, err := label.GetStringMultipleStrict(container.Labels, labelDockerComposeProject, labelDockerComposeService); err == nil {
-		return "Host:" + getSubDomain(values[labelDockerComposeService]+"."+values[labelDockerComposeProject]) + "." + p.Domain
+		return "Host:" + getSubDomain(values[labelDockerComposeService]+"."+values[labelDockerComposeProject]) + "." + domain
 	}

-	if len(p.Domain) > 0 {
-		return "Host:" + getSubDomain(container.ServiceName) + "." + p.Domain
+	if len(domain) > 0 {
+		return "Host:" + getSubDomain(container.ServiceName) + "." + domain
 	}

 	return ""
--- a/provider/docker/deprecated_container_docker_test.go
+++ b/provider/docker/deprecated_container_docker_test.go
@@ -752,15 +752,19 @@ func TestDockerGetFrontendRuleV1(t *testing.T) {
 			expected:  "Host:foo.docker.localhost",
 		},
 		{
-			container: containerJSON(name("bar")),
-			expected:  "Host:bar.docker.localhost",
+			container: containerJSON(name("foo"),
+				labels(map[string]string{
+					label.TraefikDomain: "traefik.localhost",
+				})),
+			expected: "Host:foo.traefik.localhost",
 		},
 		{
 			container: containerJSON(labels(map[string]string{
 				label.TraefikFrontendRule: "Host:foo.bar",
 			})),
 			expected: "Host:foo.bar",
-		}, {
+		},
+		{
 			container: containerJSON(labels(map[string]string{
 				"com.docker.compose.project": "foo",
 				"com.docker.compose.service": "bar",
--- a/provider/docker/deprecated_container_swarm_test.go
+++ b/provider/docker/deprecated_container_swarm_test.go
@@ -527,8 +527,11 @@ func TestSwarmGetFrontendRuleV1(t *testing.T) {
 			networks: map[string]*docker.NetworkResource{},
 		},
 		{
-			service:  swarmService(serviceName("bar")),
-			expected: "Host:bar.docker.localhost",
+			service: swarmService(serviceName("foo"),
+				serviceLabels(map[string]string{
+					label.TraefikDomain: "traefik.localhost",
+				})),
+			expected: "Host:foo.traefik.localhost",
 			networks: map[string]*docker.NetworkResource{},
 		},
 		{
--- a/provider/docker/deprecated_service.go
+++ b/provider/docker/deprecated_service.go
@@ -136,12 +136,6 @@ func getFuncServiceIntLabelV1(labelSuffix string, defaultValue int) func(contain
 	}
 }

-// Deprecated
-func hasStrictServiceLabelV1(serviceLabels map[string]string, labelSuffix string) bool {
-	value, ok := serviceLabels[labelSuffix]
-	return ok && len(value) > 0
-}
-
 // Deprecated
 func getServiceStringValueV1(container dockerData, serviceLabels map[string]string, labelSuffix string, defaultValue string) string {
 	if value, ok := serviceLabels[labelSuffix]; ok {
@@ -150,23 +144,6 @@ func getServiceStringValueV1(container dockerData, serviceLabels map[string]stri
 	return label.GetStringValue(container.Labels, label.Prefix+labelSuffix, defaultValue)
 }

-// Deprecated
-func getStrictServiceStringValueV1(serviceLabels map[string]string, labelSuffix string, defaultValue string) string {
-	if value, ok := serviceLabels[labelSuffix]; ok {
-		return value
-	}
-	return defaultValue
-}
-
-// Deprecated
-func getServiceMapValueV1(container dockerData, serviceLabels map[string]string, serviceName string, labelSuffix string) map[string]string {
-	if value, ok := serviceLabels[labelSuffix]; ok {
-		lblName := label.GetServiceLabel(labelSuffix, serviceName)
-		return label.ParseMapValue(lblName, value)
-	}
-	return label.GetMapValue(container.Labels, label.Prefix+labelSuffix)
-}
-
 // Deprecated
 func getServiceSliceValueV1(container dockerData, serviceLabels map[string]string, labelSuffix string) []string {
 	if value, ok := serviceLabels[labelSuffix]; ok {
@@ -197,17 +174,6 @@ func getServiceIntLabelV1(container dockerData, serviceName string, labelSuffix
 	return label.GetIntValue(container.Labels, label.Prefix+labelSuffix, defaultValue)
 }

-// Deprecated
-func getServiceInt64ValueV1(container dockerData, serviceLabels map[string]string, labelSuffix string, defaultValue int64) int64 {
-	if rawValue, ok := serviceLabels[labelSuffix]; ok {
-		value, err := strconv.ParseInt(rawValue, 10, 64)
-		if err == nil {
-			return value
-		}
-	}
-	return label.GetInt64Value(container.Labels, label.Prefix+labelSuffix, defaultValue)
-}
-
 // Deprecated
 func getServiceLabelsV1(container dockerData, serviceName string) label.SegmentPropertyValues {
 	return label.ExtractServiceProperties(container.Labels)[serviceName]
--- a/provider/docker/deprecated_service_test.go
+++ b/provider/docker/deprecated_service_test.go
@@ -405,154 +405,6 @@ func TestDockerGetServiceStringValueV1(t *testing.T) {
 	}
 }

-func TestDockerHasStrictServiceLabelV1(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		serviceLabels map[string]string
-		labelSuffix   string
-		expected      bool
-	}{
-		{
-			desc:          "should return false when service don't have label",
-			serviceLabels: map[string]string{},
-			labelSuffix:   "",
-			expected:      false,
-		},
-		{
-			desc: "should return true when service have label",
-			serviceLabels: map[string]string{
-				"foo": "bar",
-			},
-			labelSuffix: "foo",
-			expected:    true,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			actual := hasStrictServiceLabelV1(test.serviceLabels, test.labelSuffix)
-
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}
-
-func TestDockerGetStrictServiceStringValueV1(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		serviceLabels map[string]string
-		labelSuffix   string
-		defaultValue  string
-		expected      string
-	}{
-		{
-			desc: "should return a string when the label exists",
-			serviceLabels: map[string]string{
-				"foo": "bar",
-			},
-			labelSuffix: "foo",
-			expected:    "bar",
-		},
-		{
-			desc: "should return a string when the label exists and value empty",
-			serviceLabels: map[string]string{
-				"foo": "",
-			},
-			labelSuffix:  "foo",
-			defaultValue: "cube",
-			expected:     "",
-		},
-		{
-			desc:          "should return the default value when the label doesn't exist",
-			serviceLabels: map[string]string{},
-			labelSuffix:   "foo",
-			defaultValue:  "cube",
-			expected:      "cube",
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			actual := getStrictServiceStringValueV1(test.serviceLabels, test.labelSuffix, test.defaultValue)
-
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}
-
-func TestDockerGetServiceMapValueV1(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		container     docker.ContainerJSON
-		serviceLabels map[string]string
-		serviceName   string
-		labelSuffix   string
-		expected      map[string]string
-	}{
-		{
-			desc: "should return when no labels",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{})),
-			serviceLabels: map[string]string{},
-			serviceName:   "soo",
-			labelSuffix:   "foo",
-			expected:      nil,
-		},
-		{
-			desc: "should return a map when label exists",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{
-					"traefik.foo": "bir:fii",
-				})),
-			serviceLabels: map[string]string{
-				"foo": "bar:foo",
-			},
-			serviceName: "soo",
-			labelSuffix: "foo",
-			expected: map[string]string{
-				"Bar": "foo",
-			},
-		},
-		{
-			desc: "should return a map when label exists (fallback to container labels)",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{
-					"traefik.foo": "bir:fii",
-				})),
-			serviceLabels: map[string]string{
-				"fo": "bar:foo",
-			},
-			serviceName: "soo",
-			labelSuffix: "foo",
-			expected: map[string]string{
-				"Bir": "fii",
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			dData := parseContainer(test.container)
-
-			actual := getServiceMapValueV1(dData, test.serviceLabels, test.serviceName, test.labelSuffix)
-
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}
-
 func TestDockerGetServiceSliceValueV1(t *testing.T) {
 	testCases := []struct {
 		desc          string
@@ -672,67 +524,6 @@ func TestDockerGetServiceBoolValueV1(t *testing.T) {
 	}
 }

-func TestDockerGetServiceInt64ValueV1(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		container     docker.ContainerJSON
-		serviceLabels map[string]string
-		labelSuffix   string
-		defaultValue  int64
-		expected      int64
-	}{
-		{
-			desc: "should return default value when no label",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{})),
-			serviceLabels: map[string]string{},
-			labelSuffix:   "foo",
-			defaultValue:  666,
-			expected:      666,
-		},
-		{
-			desc: "should return a int64 when label",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{
-					"traefik.foo": "20",
-				})),
-			serviceLabels: map[string]string{
-				"foo": "10",
-			},
-			labelSuffix: "foo",
-			expected:    10,
-		},
-		{
-			desc: "should return a int64 when label (fallback to container labels)",
-			container: containerJSON(
-				name("test1"),
-				labels(map[string]string{
-					"traefik.foo": "20",
-				})),
-			serviceLabels: map[string]string{
-				"fo": "10",
-			},
-			labelSuffix: "foo",
-			expected:    20,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			dData := parseContainer(test.container)
-
-			actual := getServiceInt64ValueV1(dData, test.serviceLabels, test.labelSuffix, test.defaultValue)
-
-			assert.Equal(t, test.expected, actual)
-		})
-	}
-}
-
 func TestDockerCheckPortLabelsV1(t *testing.T) {
 	testCases := []struct {
 		container     docker.ContainerJSON
--- a/provider/ecs/config.go
+++ b/provider/ecs/config.go
@@ -91,7 +91,9 @@ func (p *Provider) filterInstance(i ecsInstance) bool {
 }

 func (p *Provider) getFrontendRule(i ecsInstance) string {
-	defaultRule := "Host:" + strings.ToLower(strings.Replace(i.Name, "_", "-", -1)) + "." + p.Domain
+	domain := label.GetStringValue(i.TraefikLabels, label.TraefikDomain, p.Domain)
+	defaultRule := "Host:" + strings.ToLower(strings.Replace(i.Name, "_", "-", -1)) + "." + domain
+
 	return label.GetStringValue(i.TraefikLabels, label.TraefikFrontendRule, defaultRule)
 }

--- a/provider/marathon/builder_test.go
+++ b/provider/marathon/builder_test.go
@@ -10,6 +10,16 @@ import (

 const testTaskName = "taskID"

+func withAppData(app marathon.Application, segmentName string) appData {
+	segmentProperties := label.ExtractTraefikLabels(stringValueMap(app.Labels))
+	return appData{
+		Application:   app,
+		SegmentLabels: segmentProperties[segmentName],
+		SegmentName:   segmentName,
+		LinkedApps:    nil,
+	}
+}
+
 // Functions related to building applications.

 func withApplications(apps ...marathon.Application) *marathon.Applications {
--- a/provider/marathon/config.go
+++ b/provider/marathon/config.go
@@ -210,10 +210,12 @@ func (p *Provider) getFrontendRule(app appData) string {
 		}
 	}

+	domain := label.GetStringValue(app.SegmentLabels, label.TraefikDomain, p.Domain)
+
 	if len(app.SegmentName) > 0 {
-		return "Host:" + strings.ToLower(provider.Normalize(app.SegmentName)) + "." + p.getSubDomain(app.ID) + "." + p.Domain
+		return "Host:" + strings.ToLower(provider.Normalize(app.SegmentName)) + "." + p.getSubDomain(app.ID) + "." + domain
 	}
-	return "Host:" + p.getSubDomain(app.ID) + "." + p.Domain
+	return "Host:" + p.getSubDomain(app.ID) + "." + domain
 }

 func getPort(task marathon.Task, app appData) string {
@@ -345,6 +347,9 @@ func (p *Provider) getServer(app appData, task marathon.Task) (string, *types.Se

 func (p *Provider) getServerHost(task marathon.Task, app appData) (string, error) {
 	if app.IPAddressPerTask == nil || p.ForceTaskHostname {
+		if len(task.Host) == 0 {
+			return "", fmt.Errorf("host is undefined for task %q app %q", task.ID, app.ID)
+		}
 		return task.Host, nil
 	}

--- a/provider/marathon/config_test.go
+++ b/provider/marathon/config_test.go
@@ -1026,7 +1026,7 @@ func TestGetPort(t *testing.T) {
 		desc        string
 		application marathon.Application
 		task        marathon.Task
-		serviceName string
+		segmentName string
 		expected    string
 	}{
 		{
@@ -1108,23 +1108,23 @@ func TestGetPort(t *testing.T) {
 		},
 		{
 			desc:        "multiple task ports with service index available",
-			application: application(withLabel(label.Prefix+"http.portIndex", "0")),
+			application: application(withSegmentLabel(label.TraefikPortIndex, "0", "http")),
 			task:        task(taskPorts(80, 443)),
-			serviceName: "http",
+			segmentName: "http",
 			expected:    "80",
 		},
 		{
 			desc:        "multiple task ports with service port available",
-			application: application(withLabel(label.Prefix+"https.port", "443")),
+			application: application(withSegmentLabel(label.TraefikPort, "443", "https")),
 			task:        task(taskPorts(80, 443)),
-			serviceName: "https",
+			segmentName: "https",
 			expected:    "443",
 		},
 		{
 			desc:        "multiple task ports with services but default port available",
-			application: application(withLabel(label.Prefix+"http.weight", "100")),
+			application: application(withSegmentLabel(label.TraefikWeight, "100", "http")),
 			task:        task(taskPorts(80, 443)),
-			serviceName: "http",
+			segmentName: "http",
 			expected:    "80",
 		},
 	}
@@ -1134,7 +1134,7 @@ func TestGetPort(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

-			actual := getPortV1(test.task, test.application, test.serviceName)
+			actual := getPort(test.task, withAppData(test.application, test.segmentName))

 			assert.Equal(t, test.expected, actual)
 		})
@@ -1145,7 +1145,7 @@ func TestGetFrontendRule(t *testing.T) {
 	testCases := []struct {
 		desc                    string
 		application             marathon.Application
-		serviceName             string
+		segmentName             string
 		expected                string
 		marathonLBCompatibility bool
 	}{
@@ -1155,6 +1155,15 @@ func TestGetFrontendRule(t *testing.T) {
 			marathonLBCompatibility: true,
 			expected:                "Host:test.marathon.localhost",
 		},
+		{
+			desc: "label domain",
+			application: application(
+				appID("test"),
+				withLabel(label.TraefikDomain, "traefik.localhost"),
+			),
+			marathonLBCompatibility: true,
+			expected:                "Host:test.traefik.localhost",
+		},
 		{
 			desc: "HAProxy vhost available and LB compat disabled",
 			application: application(
@@ -1172,7 +1181,6 @@ func TestGetFrontendRule(t *testing.T) {
 		},
 		{
 			desc: "frontend rule available",
-
 			application: application(
 				withLabel(label.TraefikFrontendRule, "Host:foo.bar"),
 				withLabel("HAPROXY_0_VHOST", "unused"),
@@ -1181,9 +1189,9 @@ func TestGetFrontendRule(t *testing.T) {
 			expected:                "Host:foo.bar",
 		},
 		{
-			desc:                    "service label existing",
+			desc:                    "segment label frontend rule",
 			application:             application(withSegmentLabel(label.TraefikFrontendRule, "Host:foo.bar", "app")),
-			serviceName:             "app",
+			segmentName:             "app",
 			marathonLBCompatibility: true,
 			expected:                "Host:foo.bar",
 		},
@@ -1198,7 +1206,7 @@ func TestGetFrontendRule(t *testing.T) {
 				MarathonLBCompatibility: test.marathonLBCompatibility,
 			}

-			actual := p.getFrontendRuleV1(test.application, test.serviceName)
+			actual := p.getFrontendRule(withAppData(test.application, test.segmentName))

 			assert.Equal(t, test.expected, actual)
 		})
@@ -1209,7 +1217,7 @@ func TestGetBackendName(t *testing.T) {
 	testCases := []struct {
 		desc        string
 		application marathon.Application
-		serviceName string
+		segmentName string
 		expected    string
 	}{
 		{
@@ -1223,9 +1231,9 @@ func TestGetBackendName(t *testing.T) {
 			expected:    "backendbar",
 		},
 		{
-			desc:        "service label existing",
+			desc:        "segment label existing",
 			application: application(withSegmentLabel(label.TraefikBackend, "bar", "app")),
-			serviceName: "app",
+			segmentName: "app",
 			expected:    "backendbar",
 		},
 	}
@@ -1237,7 +1245,7 @@ func TestGetBackendName(t *testing.T) {

 			p := &Provider{}

-			actual := p.getBackendNameV1(test.application, test.serviceName)
+			actual := p.getBackendName(withAppData(test.application, test.segmentName))

 			assert.Equal(t, test.expected, actual)
 		})
@@ -1248,7 +1256,7 @@ func TestGetServers(t *testing.T) {
 	testCases := []struct {
 		desc        string
 		application marathon.Application
-		serviceName string
+		segmentName string
 		expected    map[string]types.Server
 	}{
 		{
@@ -1296,12 +1304,14 @@ func TestGetServers(t *testing.T) {

 	for _, test := range testCases {
 		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
+		if test.desc == "should return nil when all hosts are empty" {
+			t.Run(test.desc, func(t *testing.T) {
+				t.Parallel()

-			actual := p.getServersV1(test.application, test.serviceName)
+				actual := p.getServers(withAppData(test.application, test.segmentName))

-			assert.Equal(t, test.expected, actual)
-		})
+				assert.Equal(t, test.expected, actual)
+			})
+		}
 	}
 }
--- a/provider/marathon/deprecated_config.go
+++ b/provider/marathon/deprecated_config.go
@@ -138,10 +138,11 @@ func (p *Provider) getFrontendRuleV1(application marathon.Application, serviceNa
 		}
 	}

+	domain := label.GetStringValue(labels, label.SuffixDomain, p.Domain)
 	if len(serviceName) > 0 {
-		return "Host:" + strings.ToLower(provider.Normalize(serviceName)) + "." + p.getSubDomain(application.ID) + "." + p.Domain
+		return "Host:" + strings.ToLower(provider.Normalize(serviceName)) + "." + p.getSubDomain(application.ID) + "." + domain
 	}
-	return "Host:" + p.getSubDomain(application.ID) + "." + p.Domain
+	return "Host:" + p.getSubDomain(application.ID) + "." + domain
 }

 // Deprecated
--- a/provider/marathon/deprecated_config_test.go
+++ b/provider/marathon/deprecated_config_test.go
@@ -760,3 +760,67 @@ func TestGetStickyV1(t *testing.T) {
 		})
 	}
 }
+
+func TestGetServersV1(t *testing.T) {
+	testCases := []struct {
+		desc        string
+		application marathon.Application
+		segmentName string
+		expected    map[string]types.Server
+	}{
+		{
+			desc:        "should return nil when no task",
+			application: application(ipAddrPerTask(80)),
+			expected:    nil,
+		},
+		{
+			desc: "should return nil when all hosts are empty",
+			application: application(
+				withTasks(
+					task(ipAddresses("1.1.1.1"), withTaskID("A"), taskPorts(80)),
+					task(ipAddresses("1.1.1.2"), withTaskID("B"), taskPorts(80)),
+					task(ipAddresses("1.1.1.3"), withTaskID("C"), taskPorts(80))),
+			),
+			expected: nil,
+		},
+		{
+			desc: "with 3 tasks",
+			application: application(
+				ipAddrPerTask(80),
+				withTasks(
+					task(ipAddresses("1.1.1.1"), withTaskID("A"), taskPorts(80)),
+					task(ipAddresses("1.1.1.2"), withTaskID("B"), taskPorts(80)),
+					task(ipAddresses("1.1.1.3"), withTaskID("C"), taskPorts(80))),
+			),
+			expected: map[string]types.Server{
+				"server-A": {
+					URL:    "http://1.1.1.1:80",
+					Weight: label.DefaultWeight,
+				},
+				"server-B": {
+					URL:    "http://1.1.1.2:80",
+					Weight: label.DefaultWeight,
+				},
+				"server-C": {
+					URL:    "http://1.1.1.3:80",
+					Weight: label.DefaultWeight,
+				},
+			},
+		},
+	}
+
+	p := &Provider{}
+
+	for _, test := range testCases {
+		test := test
+		if test.desc == "should return nil when all hosts are empty" {
+			t.Run(test.desc, func(t *testing.T) {
+				t.Parallel()
+
+				actual := p.getServersV1(test.application, test.segmentName)
+
+				assert.Equal(t, test.expected, actual)
+			})
+		}
+	}
+}
--- a/provider/mesos/config.go
+++ b/provider/mesos/config.go
@@ -166,7 +166,9 @@ func (p *Provider) getFrontendRule(task taskData) string {
 	if v := label.GetStringValue(task.TraefikLabels, label.TraefikFrontendRule, ""); len(v) > 0 {
 		return v
 	}
-	return "Host:" + strings.ToLower(strings.Replace(p.getSubDomain(task.DiscoveryInfo.Name), "_", "-", -1)) + "." + p.Domain
+
+	domain := label.GetStringValue(task.TraefikLabels, label.TraefikDomain, p.Domain)
+	return "Host:" + strings.ToLower(strings.Replace(p.getSubDomain(task.DiscoveryInfo.Name), "_", "-", -1)) + "." + domain
 }

 func (p *Provider) getServers(tasks []taskData) map[string]types.Server {
--- a/provider/mesos/config_test.go
+++ b/provider/mesos/config_test.go
@@ -652,3 +652,50 @@ func TestGetServers(t *testing.T) {
 		})
 	}
 }
+
+func TestGetFrontendRule(t *testing.T) {
+	p := Provider{
+		Domain: "mesos.localhost",
+	}
+
+	testCases := []struct {
+		desc      string
+		mesosTask taskData
+		expected  string
+	}{
+		{
+			desc: "label missing",
+			mesosTask: aTaskData("test",
+				withInfo("foo"),
+			),
+			expected: "Host:foo.mesos.localhost",
+		},
+		{
+			desc: "label domain",
+			mesosTask: aTaskData("test",
+				withInfo("foo"),
+				withLabel(label.TraefikDomain, "traefik.localhost"),
+			),
+			expected: "Host:foo.traefik.localhost",
+		},
+		{
+			desc: "frontend rule available",
+			mesosTask: aTaskData("test",
+				withInfo("foo"),
+				withLabel(label.TraefikFrontendRule, "Host:foo.bar"),
+			),
+			expected: "Host:foo.bar",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rule := p.getFrontendRule(test.mesosTask)
+
+			assert.Equal(t, test.expected, rule)
+		})
+	}
+}
--- a/provider/mesos/deprecated_config.go
+++ b/provider/mesos/deprecated_config.go
@@ -196,7 +196,9 @@ func (p *Provider) getFrontendRuleV1(task state.Task) string {
 	if v := getStringValueV1(task, label.TraefikFrontendRule, ""); len(v) > 0 {
 		return v
 	}
-	return "Host:" + strings.ToLower(strings.Replace(p.getSubDomain(task.DiscoveryInfo.Name), "_", "-", -1)) + "." + p.Domain
+
+	domain := getStringValueV1(task, label.TraefikDomain, p.Domain)
+	return "Host:" + strings.ToLower(strings.Replace(p.getSubDomain(task.DiscoveryInfo.Name), "_", "-", -1)) + "." + domain
 }

 // Deprecated
--- a/provider/rancher/config.go
+++ b/provider/rancher/config.go
@@ -124,7 +124,9 @@ func (p *Provider) serviceFilter(service rancherData) bool {
 }

 func (p *Provider) getFrontendRule(serviceName string, labels map[string]string) string {
-	defaultRule := "Host:" + strings.ToLower(strings.Replace(serviceName, "/", ".", -1)) + "." + p.Domain
+	domain := label.GetStringValue(labels, label.TraefikDomain, p.Domain)
+	defaultRule := "Host:" + strings.ToLower(strings.Replace(serviceName, "/", ".", -1)) + "." + domain
+
 	return label.GetStringValue(labels, label.TraefikFrontendRule, defaultRule)
 }

@@ -164,6 +166,11 @@ func getServers(service rancherData) map[string]types.Server {
 	var servers map[string]types.Server

 	for index, ip := range service.Containers {
+		if len(ip) == 0 {
+			log.Warnf("Unable to find the IP address for a container in the service %q: this container is ignored.", service.Name)
+			continue
+		}
+
 		if servers == nil {
 			servers = make(map[string]types.Server)
 		}
--- a/provider/rancher/config_test.go
+++ b/provider/rancher/config_test.go
@@ -722,6 +722,16 @@ func TestProviderGetFrontendRule(t *testing.T) {
 			},
 			expected: "Host:foo.rancher.localhost",
 		},
+		{
+			desc: "with domain label",
+			service: rancherData{
+				Name: "test-service",
+				Labels: map[string]string{
+					label.TraefikDomain: "traefik.localhost",
+				},
+			},
+			expected: "Host:test-service.traefik.localhost",
+		},
 		{
 			desc: "host with /",
 			service: rancherData{
@@ -739,26 +749,6 @@ func TestProviderGetFrontendRule(t *testing.T) {
 			},
 			expected: "Host:foo.bar.com",
 		},
-		{
-			desc: "with Path label",
-			service: rancherData{
-				Name: "test-service",
-				Labels: map[string]string{
-					label.TraefikFrontendRule: "Path:/test",
-				},
-			},
-			expected: "Path:/test",
-		},
-		{
-			desc: "with PathPrefix label",
-			service: rancherData{
-				Name: "test-service",
-				Labels: map[string]string{
-					label.TraefikFrontendRule: "PathPrefix:/test2",
-				},
-			},
-			expected: "PathPrefix:/test2",
-		},
 	}

 	for _, test := range testCases {
@@ -842,6 +832,18 @@ func TestGetServers(t *testing.T) {
 			},
 			expected: nil,
 		},
+		{
+			desc: "should return nil when no server IPs",
+			service: rancherData{
+				Labels: map[string]string{
+					label.TraefikWeight: "7",
+				},
+				Containers: []string{""},
+				Health:     "healthy",
+				State:      "active",
+			},
+			expected: nil,
+		},
 		{
 			desc: "should use default weight when invalid weight value",
 			service: rancherData{
--- a/server/header_rewriter.go
+++ b/server/header_rewriter.go
@@ -11,20 +11,20 @@ import (

 // NewHeaderRewriter Create a header rewriter
 func NewHeaderRewriter(trustedIPs []string, insecure bool) (forward.ReqRewriter, error) {
-	IPs, err := whitelist.NewIP(trustedIPs, insecure, true)
+	ips, err := whitelist.NewIP(trustedIPs, insecure, true)
 	if err != nil {
 		return nil, err
 	}

-	h, err := os.Hostname()
+	hostname, err := os.Hostname()
 	if err != nil {
-		h = "localhost"
+		hostname = "localhost"
 	}

 	return &headerRewriter{
-		secureRewriter:   &forward.HeaderRewriter{TrustForwardHeader: true, Hostname: h},
-		insecureRewriter: &forward.HeaderRewriter{TrustForwardHeader: false, Hostname: h},
-		ips:              IPs,
+		secureRewriter:   &forward.HeaderRewriter{TrustForwardHeader: false, Hostname: hostname},
+		insecureRewriter: &forward.HeaderRewriter{TrustForwardHeader: true, Hostname: hostname},
+		ips:              ips,
 		insecure:         insecure,
 	}, nil
 }
@@ -37,16 +37,17 @@ type headerRewriter struct {
 }

 func (h *headerRewriter) Rewrite(req *http.Request) {
-	authorized, _, err := h.ips.IsAuthorized(req)
+	if h.insecure {
+		h.insecureRewriter.Rewrite(req)
+		return
+	}
+
+	err := h.ips.IsAuthorized(req)
 	if err != nil {
 		log.Error(err)
 		h.secureRewriter.Rewrite(req)
 		return
 	}

-	if h.insecure || authorized {
-		h.secureRewriter.Rewrite(req)
-	} else {
-		h.insecureRewriter.Rewrite(req)
-	}
+	h.insecureRewriter.Rewrite(req)
 }
--- a/server/header_rewriter_test.go
+++ b/server/header_rewriter_test.go
@@ -0,0 +1,104 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHeaderRewriter_Rewrite(t *testing.T) {
+	testCases := []struct {
+		desc       string
+		remoteAddr string
+		trustedIPs []string
+		insecure   bool
+		expected   map[string]string
+	}{
+		{
+			desc:       "Secure & authorized",
+			remoteAddr: "10.10.10.10:80",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   false,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "30.30.30.30",
+			},
+		},
+		{
+			desc:       "Secure & unauthorized",
+			remoteAddr: "50.50.50.50:80",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   false,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "",
+			},
+		},
+		{
+			desc:       "Secure & authorized error",
+			remoteAddr: "10.10.10.10",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   false,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "",
+			},
+		},
+		{
+			desc:       "insecure & authorized",
+			remoteAddr: "10.10.10.10:80",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   true,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "30.30.30.30",
+			},
+		},
+		{
+			desc:       "insecure & unauthorized",
+			remoteAddr: "50.50.50.50:80",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   true,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "30.30.30.30",
+			},
+		},
+		{
+			desc:       "insecure & authorized error",
+			remoteAddr: "10.10.10.10",
+			trustedIPs: []string{"10.10.10.10"},
+			insecure:   true,
+			expected: map[string]string{
+				"X-Foo":           "bar",
+				"X-Forwarded-For": "30.30.30.30",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			rewriter, err := NewHeaderRewriter(test.trustedIPs, test.insecure)
+			require.NoError(t, err)
+
+			req := httptest.NewRequest(http.MethodGet, "http://20.20.20.20/foo", nil)
+			require.NoError(t, err)
+			req.RemoteAddr = test.remoteAddr
+
+			req.Header.Set("X-Foo", "bar")
+			req.Header.Set("X-Forwarded-For", "30.30.30.30")
+
+			rewriter.Rewrite(req)
+
+			for key, value := range test.expected {
+				assert.Equal(t, value, req.Header.Get(key))
+			}
+		})
+	}
+}
--- a/server/server.go
+++ b/server/server.go
@@ -808,7 +808,8 @@ func (s *Server) prepareServer(entryPointName string, entryPoint *configuration.
 				if !ok {
 					return false, fmt.Errorf("type error %v", addr)
 				}
-				return IPs.ContainsIP(ip.IP)
+
+				return IPs.ContainsIP(ip.IP), nil
 			},
 		}
 	}
@@ -1096,7 +1097,7 @@ func (s *Server) loadConfig(configurations types.Configurations, globalConfigura
 									errorPageName, frontendName, errorPage.Backend)
 							} else if config.Backends[errorPage.Backend] == nil {
 								log.Errorf("Error when creating error page %q for frontend %q: the backend %q doesn't exist.",
-									errorPageName, errorPage.Backend)
+									errorPageName, frontendName, errorPage.Backend)
 							} else {
 								errorPagesHandler, err := errorpages.NewHandler(errorPage, entryPointName+providerName+errorPage.Backend)
 								if err != nil {
@@ -1174,6 +1175,16 @@ func (s *Server) loadConfig(configurations types.Configurations, globalConfigura
 						}
 					}

+					if headerMiddleware != nil {
+						log.Debugf("Adding header middleware for frontend %s", frontendName)
+						n.Use(s.tracingMiddleware.NewNegroniHandlerWrapper("Header", headerMiddleware, false))
+					}
+
+					if secureMiddleware != nil {
+						log.Debugf("Adding secure middleware for frontend %s", frontendName)
+						n.UseFunc(secureMiddleware.HandlerFuncWithNextForRequestOnly)
+					}
+
 					if len(frontend.BasicAuth) > 0 {
 						users := types.Users{}
 						for _, user := range frontend.BasicAuth {
@@ -1192,16 +1203,6 @@ func (s *Server) loadConfig(configurations types.Configurations, globalConfigura
 						}
 					}

-					if headerMiddleware != nil {
-						log.Debugf("Adding header middleware for frontend %s", frontendName)
-						n.Use(s.tracingMiddleware.NewNegroniHandlerWrapper("Header", headerMiddleware, false))
-					}
-
-					if secureMiddleware != nil {
-						log.Debugf("Adding secure middleware for frontend %s", frontendName)
-						n.UseFunc(secureMiddleware.HandlerFuncWithNextForRequestOnly)
-					}
-
 					if config.Backends[frontend.Backend].Buffering != nil {
 						bufferedLb, err := s.buildBufferingMiddleware(lb, config.Backends[frontend.Backend].Buffering)

--- a/testhelpers/metrics.go
+++ b/testhelpers/metrics.go
@@ -32,7 +32,12 @@ func (g *CollectingGauge) With(labelValues ...string) metrics.Gauge {
 }

 // Set is there to satisfy the metrics.Gauge interface.
-func (g *CollectingGauge) Set(delta float64) {
+func (g *CollectingGauge) Set(value float64) {
+	g.GaugeValue = value
+}
+
+// Add is there to satisfy the metrics.Gauge interface.
+func (g *CollectingGauge) Add(delta float64) {
 	g.GaugeValue = delta
 }

--- a/tls/certificate.go
+++ b/tls/certificate.go
@@ -90,12 +90,15 @@ func (f FileOrContent) Read() ([]byte, error) {
 func (c *Certificates) CreateTLSConfig(entryPointName string) (*tls.Config, error) {
 	config := &tls.Config{}
 	domainsCertificates := make(map[string]map[string]*tls.Certificate)
+
 	if c.isEmpty() {
 		config.Certificates = []tls.Certificate{}
+
 		cert, err := generate.DefaultCertificate()
 		if err != nil {
 			return nil, err
 		}
+
 		config.Certificates = append(config.Certificates, *cert)
 	} else {
 		for _, certificate := range *c {
@@ -104,8 +107,9 @@ func (c *Certificates) CreateTLSConfig(entryPointName string) (*tls.Config, erro
 				log.Errorf("Unable to add a certificate to the entryPoint %q : %v", entryPointName, err)
 				continue
 			}
+
 			for _, certDom := range domainsCertificates {
-				for _, cert := range map[string]*tls.Certificate(certDom) {
+				for _, cert := range certDom {
 					config.Certificates = append(config.Certificates, *cert)
 				}
 			}
--- a/types/logs.go
+++ b/types/logs.go
@@ -28,34 +28,21 @@ type AccessLog struct {
 	Fields   *AccessLogFields  `json:"fields,omitempty" description:"AccessLogFields" export:"true"`
 }

-// StatusCodes holds status codes ranges to filter access log
-type StatusCodes []string
-
 // AccessLogFilters holds filters configuration
 type AccessLogFilters struct {
 	StatusCodes   StatusCodes `json:"statusCodes,omitempty" description:"Keep access logs with status codes in the specified range" export:"true"`
 	RetryAttempts bool        `json:"retryAttempts,omitempty" description:"Keep access logs when at least one retry happened" export:"true"`
 }

-// FieldNames holds maps of fields with specific mode
-type FieldNames map[string]string
-
-// AccessLogFields holds configuration for access log fields
-type AccessLogFields struct {
-	DefaultMode string        `json:"defaultMode,omitempty" description:"Default mode for fields: keep | drop" export:"true"`
-	Names       FieldNames    `json:"names,omitempty" description:"Override mode for fields" export:"true"`
-	Headers     *FieldHeaders `json:"headers,omitempty" description:"Headers to keep, drop or redact" export:"true"`
-}
-
-// FieldHeaderNames holds maps of fields with specific mode
-type FieldHeaderNames map[string]string
-
 // FieldHeaders holds configuration for access log headers
 type FieldHeaders struct {
 	DefaultMode string           `json:"defaultMode,omitempty" description:"Default mode for fields: keep | drop | redact" export:"true"`
 	Names       FieldHeaderNames `json:"names,omitempty" description:"Override mode for headers" export:"true"`
 }

+// StatusCodes holds status codes ranges to filter access log
+type StatusCodes []string
+
 // Set adds strings elem into the the parser
 // it splits str on , and ;
 func (s *StatusCodes) Set(str string) error {
@@ -79,6 +66,9 @@ func (s *StatusCodes) SetValue(val interface{}) {
 	*s = val.(StatusCodes)
 }

+// FieldNames holds maps of fields with specific mode
+type FieldNames map[string]string
+
 // String is the method to format the flag's value, part of the flag.Value interface.
 // The String method's output will be used in diagnostics.
 func (f *FieldNames) String() string {
@@ -111,6 +101,9 @@ func (f *FieldNames) SetValue(val interface{}) {
 	*f = val.(FieldNames)
 }

+// FieldHeaderNames holds maps of fields with specific mode
+type FieldHeaderNames map[string]string
+
 // String is the method to format the flag's value, part of the flag.Value interface.
 // The String method's output will be used in diagnostics.
 func (f *FieldHeaderNames) String() string {
@@ -141,6 +134,13 @@ func (f *FieldHeaderNames) SetValue(val interface{}) {
 	*f = val.(FieldHeaderNames)
 }

+// AccessLogFields holds configuration for access log fields
+type AccessLogFields struct {
+	DefaultMode string        `json:"defaultMode,omitempty" description:"Default mode for fields: keep | drop" export:"true"`
+	Names       FieldNames    `json:"names,omitempty" description:"Override mode for fields" export:"true"`
+	Headers     *FieldHeaders `json:"headers,omitempty" description:"Headers to keep, drop or redact" export:"true"`
+}
+
 // Keep check if the field need to be kept or dropped
 func (f *AccessLogFields) Keep(field string) bool {
 	defaultKeep := true
@@ -154,17 +154,6 @@ func (f *AccessLogFields) Keep(field string) bool {
 	return defaultKeep
 }

-func checkFieldValue(value string, defaultKeep bool) bool {
-	switch value {
-	case AccessLogKeep:
-		return true
-	case AccessLogDrop:
-		return false
-	default:
-		return defaultKeep
-	}
-}
-
 // KeepHeader checks if the headers need to be kept, dropped or redacted and returns the status
 func (f *AccessLogFields) KeepHeader(header string) string {
 	defaultValue := AccessLogKeep
@@ -178,6 +167,17 @@ func (f *AccessLogFields) KeepHeader(header string) string {
 	return defaultValue
 }

+func checkFieldValue(value string, defaultKeep bool) bool {
+	switch value {
+	case AccessLogKeep:
+		return true
+	case AccessLogDrop:
+		return false
+	default:
+		return defaultKeep
+	}
+}
+
 func checkFieldHeaderValue(value string, defaultValue string) string {
 	if value == AccessLogKeep || value == AccessLogDrop || value == AccessLogRedact {
 		return value
--- a/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric.go
+++ b/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric.go
@@ -1,7 +1,10 @@
 package servicefabric

 import (
+	"encoding/json"
+	"errors"
 	"net/http"
+	"strings"
 	"time"

 	"github.com/cenk/backoff"
@@ -18,6 +21,11 @@ var _ provider.Provider = (*Provider)(nil)

 const traefikServiceFabricExtensionKey = "Traefik"

+const (
+	kindStateful  = "Stateful"
+	kindStateless = "Stateless"
+)
+
 // Provider holds for configuration for the provider
 type Provider struct {
 	provider.BaseProvider `mapstructure:",squash"`
@@ -66,7 +74,7 @@ func (p *Provider) updateConfig(configurationChan chan<- types.ConfigMessage, po
 					log.Info("Checking service fabric config")
 				}

-				configuration, err := p.buildConfiguration(sfClient)
+				configuration, err := p.getConfiguration(sfClient)
 				if err != nil {
 					return err
 				}
@@ -90,6 +98,15 @@ func (p *Provider) updateConfig(configurationChan chan<- types.ConfigMessage, po
 	return nil
 }

+func (p *Provider) getConfiguration(sfClient sfClient) (*types.Configuration, error) {
+	services, err := getClusterServices(sfClient)
+	if err != nil {
+		return nil, err
+	}
+
+	return p.buildConfiguration(services)
+}
+
 func getClusterServices(sfClient sfClient) ([]ServiceItemExtended, error) {
 	apps, err := sfClient.GetApplications()
 	if err != nil {
@@ -171,11 +188,6 @@ func getValidInstances(sfClient sfClient, app sf.ApplicationItem, service sf.Ser
 	return validInstances
 }

-func isPrimary(instance replicaInstance) bool {
-	_, data := instance.GetReplicaData()
-	return data.ReplicaRole == "Primary"
-}
-
 func isHealthy(instanceData *sf.ReplicaItemBase) bool {
 	return instanceData != nil && (instanceData.ReplicaStatus == "Ready" && instanceData.HealthState != "Error")
 }
@@ -185,6 +197,54 @@ func hasHTTPEndpoint(instanceData *sf.ReplicaItemBase) bool {
 	return err == nil
 }

+func getReplicaDefaultEndpoint(replicaData *sf.ReplicaItemBase) (string, error) {
+	endpoints, err := decodeEndpointData(replicaData.Address)
+	if err != nil {
+		return "", err
+	}
+
+	var defaultHTTPEndpoint string
+	for _, v := range endpoints {
+		if strings.Contains(v, "http") {
+			defaultHTTPEndpoint = v
+			break
+		}
+	}
+
+	if len(defaultHTTPEndpoint) == 0 {
+		return "", errors.New("no default endpoint found")
+	}
+	return defaultHTTPEndpoint, nil
+}
+
+func decodeEndpointData(endpointData string) (map[string]string, error) {
+	var endpointsMap map[string]map[string]string
+
+	if endpointData == "" {
+		return nil, errors.New("endpoint data is empty")
+	}
+
+	err := json.Unmarshal([]byte(endpointData), &endpointsMap)
+	if err != nil {
+		return nil, err
+	}
+
+	endpoints, endpointsExist := endpointsMap["Endpoints"]
+	if !endpointsExist {
+		return nil, errors.New("endpoint doesn't exist in endpoint data")
+	}
+
+	return endpoints, nil
+}
+
+func isStateful(service ServiceItemExtended) bool {
+	return service.ServiceKind == kindStateful
+}
+
+func isStateless(service ServiceItemExtended) bool {
+	return service.ServiceKind == kindStateless
+}
+
 // Return a set of labels from the Extension and Property manager
 // Allow Extension labels to disable importing labels from the property manager.
 func getLabels(sfClient sfClient, service *sf.ServiceItem, app *sf.ApplicationItem) (map[string]string, error) {
--- a/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric_config.go
+++ b/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric_config.go
@@ -1,9 +1,7 @@
 package servicefabric

 import (
-	"encoding/json"
 	"errors"
-	"math"
 	"strings"
 	"text/template"

@@ -14,12 +12,7 @@ import (
 	sf "github.com/jjcollinge/servicefabric"
 )

-func (p *Provider) buildConfiguration(sfClient sfClient) (*types.Configuration, error) {
-	services, err := getClusterServices(sfClient)
-	if err != nil {
-		return nil, err
-	}
-
+func (p *Provider) buildConfiguration(services []ServiceItemExtended) (*types.Configuration, error) {
 	var sfFuncMap = template.FuncMap{
 		// Services
 		"getServices":                getServices,
@@ -38,7 +31,7 @@ func (p *Provider) buildConfiguration(sfClient sfClient) (*types.Configuration,
 		"filterServicesByLabelValue": filterServicesByLabelValue, // FIXME unused

 		// Backend functions
-		"getWeight":         getFuncServiceIntLabel(label.TraefikWeight, label.DefaultWeightInt),
+		"getWeight":         getFuncServiceIntLabel(label.TraefikWeight, label.DefaultWeight),
 		"getProtocol":       getFuncServiceStringLabel(label.TraefikProtocol, label.DefaultProtocol),
 		"getMaxConn":        getMaxConn,
 		"getHealthCheck":    getHealthCheck,
@@ -46,9 +39,9 @@ func (p *Provider) buildConfiguration(sfClient sfClient) (*types.Configuration,
 		"getLoadBalancer":   getLoadBalancer,

 		// Frontend Functions
-		"getPriority":       getFuncServiceIntLabel(label.TraefikFrontendPriority, label.DefaultFrontendPriorityInt),
-		"getPassHostHeader": getFuncServiceBoolLabel(label.TraefikFrontendPassHostHeader, label.DefaultPassHostHeaderBool),
-		"getPassTLSCert":    getFuncBoolLabel(label.TraefikFrontendPassTLSCert, false),
+		"getPriority":       getFuncServiceIntLabel(label.TraefikFrontendPriority, label.DefaultFrontendPriority),
+		"getPassHostHeader": getFuncServiceBoolLabel(label.TraefikFrontendPassHostHeader, label.DefaultPassHostHeader),
+		"getPassTLSCert":    getFuncBoolLabel(label.TraefikFrontendPassTLSCert, label.DefaultPassTLSCert),
 		"getEntryPoints":    getFuncServiceSliceStringLabel(label.TraefikFrontendEntryPoints),
 		"getBasicAuth":      getFuncServiceSliceStringLabel(label.TraefikFrontendAuthBasic),
 		"getFrontendRules":  getFuncServiceLabelWithPrefix(label.TraefikFrontendRule),
@@ -70,12 +63,9 @@ func (p *Provider) buildConfiguration(sfClient sfClient) (*types.Configuration,
 	return p.GetConfiguration(tmpl, sfFuncMap, templateObjects)
 }

-func isStateful(service ServiceItemExtended) bool {
-	return service.ServiceKind == "Stateful"
-}
-
-func isStateless(service ServiceItemExtended) bool {
-	return service.ServiceKind == "Stateless"
+func isPrimary(instance replicaInstance) bool {
+	_, data := instance.GetReplicaData()
+	return data.ReplicaRole == "Primary"
 }

 func getBackendName(service ServiceItemExtended, partition PartitionItemExtended) string {
@@ -92,26 +82,6 @@ func getDefaultEndpoint(instance replicaInstance) string {
 	return endpoint
 }

-func getReplicaDefaultEndpoint(replicaData *sf.ReplicaItemBase) (string, error) {
-	endpoints, err := decodeEndpointData(replicaData.Address)
-	if err != nil {
-		return "", err
-	}
-
-	var defaultHTTPEndpoint string
-	for _, v := range endpoints {
-		if strings.Contains(v, "http") {
-			defaultHTTPEndpoint = v
-			break
-		}
-	}
-
-	if len(defaultHTTPEndpoint) == 0 {
-		return "", errors.New("no default endpoint found")
-	}
-	return defaultHTTPEndpoint, nil
-}
-
 func getNamedEndpoint(instance replicaInstance, endpointName string) string {
 	id, data := instance.GetReplicaData()
 	endpoint, err := getReplicaNamedEndpoint(data, endpointName)
@@ -175,170 +145,30 @@ func filterServicesByLabelValue(services []ServiceItemExtended, key, expectedVal
 	return srvWithLabel
 }

-func decodeEndpointData(endpointData string) (map[string]string, error) {
-	var endpointsMap map[string]map[string]string
-
-	if endpointData == "" {
-		return nil, errors.New("endpoint data is empty")
-	}
-
-	err := json.Unmarshal([]byte(endpointData), &endpointsMap)
-	if err != nil {
-		return nil, err
-	}
-
-	endpoints, endpointsExist := endpointsMap["Endpoints"]
-	if !endpointsExist {
-		return nil, errors.New("endpoint doesn't exist in endpoint data")
-	}
-
-	return endpoints, nil
-}
-
 func getHeaders(service ServiceItemExtended) *types.Headers {
-	headers := &types.Headers{
-		CustomRequestHeaders:    label.GetMapValue(service.Labels, label.TraefikFrontendRequestHeaders),
-		CustomResponseHeaders:   label.GetMapValue(service.Labels, label.TraefikFrontendResponseHeaders),
-		SSLProxyHeaders:         label.GetMapValue(service.Labels, label.TraefikFrontendSSLProxyHeaders),
-		AllowedHosts:            label.GetSliceStringValue(service.Labels, label.TraefikFrontendAllowedHosts),
-		HostsProxyHeaders:       label.GetSliceStringValue(service.Labels, label.TraefikFrontendHostsProxyHeaders),
-		STSSeconds:              label.GetInt64Value(service.Labels, label.TraefikFrontendSTSSeconds, 0),
-		SSLRedirect:             label.GetBoolValue(service.Labels, label.TraefikFrontendSSLRedirect, false),
-		SSLTemporaryRedirect:    label.GetBoolValue(service.Labels, label.TraefikFrontendSSLTemporaryRedirect, false),
-		STSIncludeSubdomains:    label.GetBoolValue(service.Labels, label.TraefikFrontendSTSIncludeSubdomains, false),
-		STSPreload:              label.GetBoolValue(service.Labels, label.TraefikFrontendSTSPreload, false),
-		ForceSTSHeader:          label.GetBoolValue(service.Labels, label.TraefikFrontendForceSTSHeader, false),
-		FrameDeny:               label.GetBoolValue(service.Labels, label.TraefikFrontendFrameDeny, false),
-		ContentTypeNosniff:      label.GetBoolValue(service.Labels, label.TraefikFrontendContentTypeNosniff, false),
-		BrowserXSSFilter:        label.GetBoolValue(service.Labels, label.TraefikFrontendBrowserXSSFilter, false),
-		IsDevelopment:           label.GetBoolValue(service.Labels, label.TraefikFrontendIsDevelopment, false),
-		SSLHost:                 label.GetStringValue(service.Labels, label.TraefikFrontendSSLHost, ""),
-		CustomFrameOptionsValue: label.GetStringValue(service.Labels, label.TraefikFrontendCustomFrameOptionsValue, ""),
-		ContentSecurityPolicy:   label.GetStringValue(service.Labels, label.TraefikFrontendContentSecurityPolicy, ""),
-		PublicKey:               label.GetStringValue(service.Labels, label.TraefikFrontendPublicKey, ""),
-		ReferrerPolicy:          label.GetStringValue(service.Labels, label.TraefikFrontendReferrerPolicy, ""),
-		CustomBrowserXSSValue:   label.GetStringValue(service.Labels, label.TraefikFrontendCustomBrowserXSSValue, ""),
-	}
-
-	if !headers.HasSecureHeadersDefined() && !headers.HasCustomHeadersDefined() {
-		return nil
-	}
-
-	return headers
+	return label.GetHeaders(service.Labels)
 }

 func getWhiteList(service ServiceItemExtended) *types.WhiteList {
-	if label.Has(service.Labels, label.TraefikFrontendWhitelistSourceRange) {
-		log.Warnf("Deprecated configuration found: %s. Please use %s.", label.TraefikFrontendWhitelistSourceRange, label.TraefikFrontendWhiteListSourceRange)
-	}
-
-	ranges := label.GetSliceStringValue(service.Labels, label.TraefikFrontendWhiteListSourceRange)
-	if len(ranges) > 0 {
-		return &types.WhiteList{
-			SourceRange:      ranges,
-			UseXForwardedFor: label.GetBoolValue(service.Labels, label.TraefikFrontendWhiteListUseXForwardedFor, false),
-		}
-	}
-
-	// TODO: Deprecated
-	values := label.GetSliceStringValue(service.Labels, label.TraefikFrontendWhitelistSourceRange)
-	if len(values) > 0 {
-		return &types.WhiteList{
-			SourceRange:      values,
-			UseXForwardedFor: false,
-		}
-	}
-
-	return nil
+	return label.GetWhiteList(service.Labels)
 }

 func getRedirect(service ServiceItemExtended) *types.Redirect {
-	permanent := label.GetBoolValue(service.Labels, label.TraefikFrontendRedirectPermanent, false)
-
-	if label.Has(service.Labels, label.TraefikFrontendRedirectEntryPoint) {
-		return &types.Redirect{
-			EntryPoint: label.GetStringValue(service.Labels, label.TraefikFrontendRedirectEntryPoint, ""),
-			Permanent:  permanent,
-		}
-	}
-
-	if label.Has(service.Labels, label.TraefikFrontendRedirectRegex) &&
-		label.Has(service.Labels, label.TraefikFrontendRedirectReplacement) {
-		return &types.Redirect{
-			Regex:       label.GetStringValue(service.Labels, label.TraefikFrontendRedirectRegex, ""),
-			Replacement: label.GetStringValue(service.Labels, label.TraefikFrontendRedirectReplacement, ""),
-			Permanent:   permanent,
-		}
-	}
-
-	return nil
+	return label.GetRedirect(service.Labels)
 }

 func getMaxConn(service ServiceItemExtended) *types.MaxConn {
-	amount := label.GetInt64Value(service.Labels, label.TraefikBackendMaxConnAmount, math.MinInt64)
-	extractorFunc := label.GetStringValue(service.Labels, label.TraefikBackendMaxConnExtractorFunc, label.DefaultBackendMaxconnExtractorFunc)
-
-	if amount == math.MinInt64 || len(extractorFunc) == 0 {
-		return nil
-	}
-
-	return &types.MaxConn{
-		Amount:        amount,
-		ExtractorFunc: extractorFunc,
-	}
+	return label.GetMaxConn(service.Labels)
 }

 func getHealthCheck(service ServiceItemExtended) *types.HealthCheck {
-	path := label.GetStringValue(service.Labels, label.TraefikBackendHealthCheckPath, "")
-	if len(path) == 0 {
-		return nil
-	}
-
-	port := label.GetIntValue(service.Labels, label.TraefikBackendHealthCheckPort, label.DefaultBackendHealthCheckPort)
-	interval := label.GetStringValue(service.Labels, label.TraefikBackendHealthCheckInterval, "")
-
-	return &types.HealthCheck{
-		Path:     path,
-		Port:     port,
-		Interval: interval,
-	}
+	return label.GetHealthCheck(service.Labels)
 }

 func getCircuitBreaker(service ServiceItemExtended) *types.CircuitBreaker {
-	circuitBreaker := label.GetStringValue(service.Labels, label.TraefikBackendCircuitBreakerExpression, "")
-	if len(circuitBreaker) == 0 {
-		return nil
-	}
-	return &types.CircuitBreaker{Expression: circuitBreaker}
+	return label.GetCircuitBreaker(service.Labels)
 }

 func getLoadBalancer(service ServiceItemExtended) *types.LoadBalancer {
-	if !label.HasPrefix(service.Labels, label.TraefikBackendLoadBalancer) {
-		return nil
-	}
-
-	method := label.GetStringValue(service.Labels, label.TraefikBackendLoadBalancerMethod, label.DefaultBackendLoadBalancerMethod)
-
-	lb := &types.LoadBalancer{
-		Method: method,
-		Sticky: getSticky(service),
-	}
-
-	if label.GetBoolValue(service.Labels, label.TraefikBackendLoadBalancerStickiness, false) {
-		cookieName := label.GetStringValue(service.Labels, label.TraefikBackendLoadBalancerStickinessCookieName, label.DefaultBackendLoadbalancerStickinessCookieName)
-		lb.Stickiness = &types.Stickiness{CookieName: cookieName}
-	}
-
-	return lb
-}
-
-// TODO: Deprecated
-// replaced by Stickiness
-// Deprecated
-func getSticky(service ServiceItemExtended) bool {
-	if label.Has(service.Labels, label.TraefikBackendLoadBalancerSticky) {
-		log.Warnf("Deprecated configuration found: %s. Please use %s.", label.TraefikBackendLoadBalancerSticky, label.TraefikBackendLoadBalancerStickiness)
-	}
-
-	return label.GetBoolValue(service.Labels, label.TraefikBackendLoadBalancerSticky, false)
+	return label.GetLoadBalancer(service.Labels)
 }
--- a/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric_tmpl.go
+++ b/vendor/github.com/containous/traefik-extra-service-fabric/servicefabric_tmpl.go
@@ -59,7 +59,7 @@ const tmpl = `
        {{range $instance := $partition.Instances}}
          [backends."{{ $service.Name }}".servers."{{ $instance.ID }}"]
            url = "{{ getDefaultEndpoint $instance }}"
-            weight = {{ getLabelValue $service "backend.weight" "1" }}
+            weight = {{ getWeight $service }}
        {{end}}

      {{else if isStateful $service}}
@@ -199,17 +199,18 @@ const tmpl = `
          rule = "{{ $value }}"
      {{end}}

-    {{else if isStateful $service}}
+    {{else if isStateful $service }}

      {{range $partition := $service.Partitions }}
        {{ $partitionId := $partition.PartitionInformation.ID }}

-        {{if hasLabel $service "frontend.rule" }}
-          [frontends."{{ $service.Name }}/{{ $partitionId }}"]
-            backend = "{{ getBackendName $service.Name $partition }}"
+        {{ $rule := getLabelValue $service (print "traefik.frontend.rule.partition." $partitionId) "" }}
+        {{if $rule }}
+        [frontends."{{ $service.Name }}/{{ $partitionId }}"]
+          backend = "{{ getBackendName $service $partition }}"

          [frontends."{{ $service.Name }}/{{ $partitionId }}".routes.default]
-            rule = {{ getLabelValue $service "frontend.rule.partition.$partitionId" "" }}
+            rule = "{{ $rule }}"
        {{end}}
      {{end}}

--- a/vendor/github.com/go-kit/kit/log/doc.go
+++ b/vendor/github.com/go-kit/kit/log/doc.go
@@ -35,14 +35,15 @@
 // idea to log simple values without formatting them. This practice allows
 // the chosen logger to encode values in the most appropriate way.
 //
-// Log Context
+// Contextual Loggers
 //
-// A log context stores keyvals that it includes in all log events. Building
-// appropriate log contexts reduces repetition and aids consistency in the
-// resulting log output. We can use a context to improve the RunTask example.
+// A contextual logger stores keyvals that it includes in all log events.
+// Building appropriate contextual loggers reduces repetition and aids
+// consistency in the resulting log output. With and WithPrefix add context to
+// a logger. We can use With to improve the RunTask example.
 //
 //    func RunTask(task Task, logger log.Logger) string {
-//        logger = log.NewContext(logger).With("taskID", task.ID)
+//        logger = log.With(logger, "taskID", task.ID)
 //        logger.Log("event", "starting task")
 //        ...
 //        taskHelper(task.Cmd, logger)
@@ -51,19 +52,18 @@
 //    }
 //
 // The improved version emits the same log events as the original for the
-// first and last calls to Log. The call to taskHelper highlights that a
-// context may be passed as a logger to other functions. Each log event
-// created by the called function will include the task.ID even though the
-// function does not have access to that value. Using log contexts this way
-// simplifies producing log output that enables tracing the life cycle of
-// individual tasks. (See the Context example for the full code of the
-// above snippet.)
+// first and last calls to Log. Passing the contextual logger to taskHelper
+// enables each log event created by taskHelper to include the task.ID even
+// though taskHelper does not have access to that value. Using contextual
+// loggers this way simplifies producing log output that enables tracing the
+// life cycle of individual tasks. (See the Contextual example for the full
+// code of the above snippet.)
 //
-// Dynamic Context Values
+// Dynamic Contextual Values
 //
-// A Valuer function stored in a log context generates a new value each time
-// the context logs an event. The Valuer example demonstrates how this
-// feature works.
+// A Valuer function stored in a contextual logger generates a new value each
+// time an event is logged. The Valuer example demonstrates how this feature
+// works.
 //
 // Valuers provide the basis for consistently logging timestamps and source
 // code location. The log package defines several valuers for that purpose.
@@ -72,7 +72,7 @@
 // entries contain a timestamp and source location looks like this:
 //
 //    logger := log.NewLogfmtLogger(log.NewSyncWriter(os.Stdout))
-//    logger = log.NewContext(logger).With("ts", log.DefaultTimestampUTC, "caller", log.DefaultCaller)
+//    logger = log.With(logger, "ts", log.DefaultTimestampUTC, "caller", log.DefaultCaller)
 //
 // Concurrent Safety
 //
@@ -90,4 +90,27 @@
 // handled atomically within the wrapped logger, but it typically serializes
 // both the formatting and output logic. Use a SyncLogger if the formatting
 // logger may perform multiple writes per log event.
+//
+// Error Handling
+//
+// This package relies on the practice of wrapping or decorating loggers with
+// other loggers to provide composable pieces of functionality. It also means
+// that Logger.Log must return an error because some
+// implementations—especially those that output log data to an io.Writer—may
+// encounter errors that cannot be handled locally. This in turn means that
+// Loggers that wrap other loggers should return errors from the wrapped
+// logger up the stack.
+//
+// Fortunately, the decorator pattern also provides a way to avoid the
+// necessity to check for errors every time an application calls Logger.Log.
+// An application required to panic whenever its Logger encounters
+// an error could initialize its logger as follows.
+//
+//    fmtlogger := log.NewLogfmtLogger(log.NewSyncWriter(os.Stdout))
+//    logger := log.LoggerFunc(func(keyvals ...interface{}) error {
+//        if err := fmtlogger.Log(keyvals...); err != nil {
+//            panic(err)
+//        }
+//        return nil
+//    })
 package log
--- a/vendor/github.com/go-kit/kit/log/json_logger.go
+++ b/vendor/github.com/go-kit/kit/log/json_logger.go
@@ -44,9 +44,6 @@ func merge(dst map[string]interface{}, k, v interface{}) {
 	default:
 		key = fmt.Sprint(x)
 	}
-	if x, ok := v.(error); ok {
-		v = safeError(x)
-	}

 	// We want json.Marshaler and encoding.TextMarshaller to take priority over
 	// err.Error() and v.String(). But json.Marshall (called later) does that by
--- a/vendor/github.com/go-kit/kit/log/log.go
+++ b/vendor/github.com/go-kit/kit/log/log.go
@@ -6,7 +6,7 @@ import "errors"
 // log event from keyvals, a variadic sequence of alternating keys and values.
 // Implementations must be safe for concurrent use by multiple goroutines. In
 // particular, any implementation of Logger that appends to keyvals or
-// modifies any of its elements must make a copy first.
+// modifies or retains any of its elements must make a copy first.
 type Logger interface {
 	Log(keyvals ...interface{}) error
 }
@@ -15,62 +15,100 @@ type Logger interface {
 // the missing value.
 var ErrMissingValue = errors.New("(MISSING)")

-// NewContext returns a new Context that logs to logger.
-func NewContext(logger Logger) *Context {
-	if c, ok := logger.(*Context); ok {
-		return c
+// With returns a new contextual logger with keyvals prepended to those passed
+// to calls to Log. If logger is also a contextual logger created by With or
+// WithPrefix, keyvals is appended to the existing context.
+//
+// The returned Logger replaces all value elements (odd indexes) containing a
+// Valuer with their generated value for each call to its Log method.
+func With(logger Logger, keyvals ...interface{}) Logger {
+	if len(keyvals) == 0 {
+		return logger
+	}
+	l := newContext(logger)
+	kvs := append(l.keyvals, keyvals...)
+	if len(kvs)%2 != 0 {
+		kvs = append(kvs, ErrMissingValue)
+	}
+	return &context{
+		logger: l.logger,
+		// Limiting the capacity of the stored keyvals ensures that a new
+		// backing array is created if the slice must grow in Log or With.
+		// Using the extra capacity without copying risks a data race that
+		// would violate the Logger interface contract.
+		keyvals:   kvs[:len(kvs):len(kvs)],
+		hasValuer: l.hasValuer || containsValuer(keyvals),
 	}
-	return &Context{logger: logger}
 }

-// Context must always have the same number of stack frames between calls to
+// WithPrefix returns a new contextual logger with keyvals prepended to those
+// passed to calls to Log. If logger is also a contextual logger created by
+// With or WithPrefix, keyvals is prepended to the existing context.
+//
+// The returned Logger replaces all value elements (odd indexes) containing a
+// Valuer with their generated value for each call to its Log method.
+func WithPrefix(logger Logger, keyvals ...interface{}) Logger {
+	if len(keyvals) == 0 {
+		return logger
+	}
+	l := newContext(logger)
+	// Limiting the capacity of the stored keyvals ensures that a new
+	// backing array is created if the slice must grow in Log or With.
+	// Using the extra capacity without copying risks a data race that
+	// would violate the Logger interface contract.
+	n := len(l.keyvals) + len(keyvals)
+	if len(keyvals)%2 != 0 {
+		n++
+	}
+	kvs := make([]interface{}, 0, n)
+	kvs = append(kvs, keyvals...)
+	if len(kvs)%2 != 0 {
+		kvs = append(kvs, ErrMissingValue)
+	}
+	kvs = append(kvs, l.keyvals...)
+	return &context{
+		logger:    l.logger,
+		keyvals:   kvs,
+		hasValuer: l.hasValuer || containsValuer(keyvals),
+	}
+}
+
+// context is the Logger implementation returned by With and WithPrefix. It
+// wraps a Logger and holds keyvals that it includes in all log events. Its
+// Log method calls bindValues to generate values for each Valuer in the
+// context keyvals.
+//
+// A context must always have the same number of stack frames between calls to
 // its Log method and the eventual binding of Valuers to their value. This
 // requirement comes from the functional requirement to allow a context to
-// resolve application call site information for a log.Caller stored in the
+// resolve application call site information for a Caller stored in the
 // context. To do this we must be able to predict the number of logging
 // functions on the stack when bindValues is called.
 //
-// Three implementation details provide the needed stack depth consistency.
-// The first two of these details also result in better amortized performance,
-// and thus make sense even without the requirements regarding stack depth.
-// The third detail, however, is subtle and tied to the implementation of the
-// Go compiler.
+// Two implementation details provide the needed stack depth consistency.
 //
-//    1. NewContext avoids introducing an additional layer when asked to
-//       wrap another Context.
-//    2. With avoids introducing an additional layer by returning a newly
-//       constructed Context with a merged keyvals rather than simply
-//       wrapping the existing Context.
-//    3. All of Context's methods take pointer receivers even though they
-//       do not mutate the Context.
-//
-// Before explaining the last detail, first some background. The Go compiler
-// generates wrapper methods to implement the auto dereferencing behavior when
-// calling a value method through a pointer variable. These wrapper methods
-// are also used when calling a value method through an interface variable
-// because interfaces store a pointer to the underlying concrete value.
-// Calling a pointer receiver through an interface does not require generating
-// an additional function.
-//
-// If Context had value methods then calling Context.Log through a variable
-// with type Logger would have an extra stack frame compared to calling
-// Context.Log through a variable with type Context. Using pointer receivers
-// avoids this problem.
-
-// A Context wraps a Logger and holds keyvals that it includes in all log
-// events. When logging, a Context replaces all value elements (odd indexes)
-// containing a Valuer with their generated value for each call to its Log
-// method.
-type Context struct {
+//    1. newContext avoids introducing an additional layer when asked to
+//       wrap another context.
+//    2. With and WithPrefix avoid introducing an additional layer by
+//       returning a newly constructed context with a merged keyvals rather
+//       than simply wrapping the existing context.
+type context struct {
 	logger    Logger
 	keyvals   []interface{}
 	hasValuer bool
 }

+func newContext(logger Logger) *context {
+	if c, ok := logger.(*context); ok {
+		return c
+	}
+	return &context{logger: logger}
+}
+
 // Log replaces all value elements (odd indexes) containing a Valuer in the
 // stored context with their generated value, appends keyvals, and passes the
 // result to the wrapped Logger.
-func (l *Context) Log(keyvals ...interface{}) error {
+func (l *context) Log(keyvals ...interface{}) error {
 	kvs := append(l.keyvals, keyvals...)
 	if len(kvs)%2 != 0 {
 		kvs = append(kvs, ErrMissingValue)
@@ -86,53 +124,6 @@ func (l *Context) Log(keyvals ...interface{}) error {
 	return l.logger.Log(kvs...)
 }

-// With returns a new Context with keyvals appended to those of the receiver.
-func (l *Context) With(keyvals ...interface{}) *Context {
-	if len(keyvals) == 0 {
-		return l
-	}
-	kvs := append(l.keyvals, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	return &Context{
-		logger: l.logger,
-		// Limiting the capacity of the stored keyvals ensures that a new
-		// backing array is created if the slice must grow in Log or With.
-		// Using the extra capacity without copying risks a data race that
-		// would violate the Logger interface contract.
-		keyvals:   kvs[:len(kvs):len(kvs)],
-		hasValuer: l.hasValuer || containsValuer(keyvals),
-	}
-}
-
-// WithPrefix returns a new Context with keyvals prepended to those of the
-// receiver.
-func (l *Context) WithPrefix(keyvals ...interface{}) *Context {
-	if len(keyvals) == 0 {
-		return l
-	}
-	// Limiting the capacity of the stored keyvals ensures that a new
-	// backing array is created if the slice must grow in Log or With.
-	// Using the extra capacity without copying risks a data race that
-	// would violate the Logger interface contract.
-	n := len(l.keyvals) + len(keyvals)
-	if len(keyvals)%2 != 0 {
-		n++
-	}
-	kvs := make([]interface{}, 0, n)
-	kvs = append(kvs, keyvals...)
-	if len(kvs)%2 != 0 {
-		kvs = append(kvs, ErrMissingValue)
-	}
-	kvs = append(kvs, l.keyvals...)
-	return &Context{
-		logger:    l.logger,
-		keyvals:   kvs,
-		hasValuer: l.hasValuer || containsValuer(keyvals),
-	}
-}
-
 // LoggerFunc is an adapter to allow use of ordinary functions as Loggers. If
 // f is a function with the appropriate signature, LoggerFunc(f) is a Logger
 // object that calls f.
--- a/vendor/github.com/go-kit/kit/log/stdlib.go
+++ b/vendor/github.com/go-kit/kit/log/stdlib.go
@@ -39,7 +39,7 @@ func TimestampKey(key string) StdlibAdapterOption {
 	return func(a *StdlibAdapter) { a.timestampKey = key }
 }

-// FileKey sets the key for the file and line field. By default, it's "file".
+// FileKey sets the key for the file and line field. By default, it's "caller".
 func FileKey(key string) StdlibAdapterOption {
 	return func(a *StdlibAdapter) { a.fileKey = key }
 }
@@ -55,7 +55,7 @@ func NewStdlibAdapter(logger Logger, options ...StdlibAdapterOption) io.Writer {
 	a := StdlibAdapter{
 		Logger:       logger,
 		timestampKey: "ts",
-		fileKey:      "file",
+		fileKey:      "caller",
 		messageKey:   "msg",
 	}
 	for _, option := range options {
--- a/vendor/github.com/go-kit/kit/log/sync.go
+++ b/vendor/github.com/go-kit/kit/log/sync.go
@@ -36,24 +36,59 @@ func (l *SwapLogger) Swap(logger Logger) {
 	l.logger.Store(loggerStruct{logger})
 }

-// SyncWriter synchronizes concurrent writes to an io.Writer.
-type SyncWriter struct {
-	mu sync.Mutex
-	w  io.Writer
+// NewSyncWriter returns a new writer that is safe for concurrent use by
+// multiple goroutines. Writes to the returned writer are passed on to w. If
+// another write is already in progress, the calling goroutine blocks until
+// the writer is available.
+//
+// If w implements the following interface, so does the returned writer.
+//
+//    interface {
+//        Fd() uintptr
+//    }
+func NewSyncWriter(w io.Writer) io.Writer {
+	switch w := w.(type) {
+	case fdWriter:
+		return &fdSyncWriter{fdWriter: w}
+	default:
+		return &syncWriter{Writer: w}
+	}
 }

-// NewSyncWriter returns a new SyncWriter. The returned writer is safe for
-// concurrent use by multiple goroutines.
-func NewSyncWriter(w io.Writer) *SyncWriter {
-	return &SyncWriter{w: w}
+// syncWriter synchronizes concurrent writes to an io.Writer.
+type syncWriter struct {
+	sync.Mutex
+	io.Writer
 }

 // Write writes p to the underlying io.Writer. If another write is already in
-// progress, the calling goroutine blocks until the SyncWriter is available.
-func (w *SyncWriter) Write(p []byte) (n int, err error) {
-	w.mu.Lock()
-	n, err = w.w.Write(p)
-	w.mu.Unlock()
+// progress, the calling goroutine blocks until the syncWriter is available.
+func (w *syncWriter) Write(p []byte) (n int, err error) {
+	w.Lock()
+	n, err = w.Writer.Write(p)
+	w.Unlock()
+	return n, err
+}
+
+// fdWriter is an io.Writer that also has an Fd method. The most common
+// example of an fdWriter is an *os.File.
+type fdWriter interface {
+	io.Writer
+	Fd() uintptr
+}
+
+// fdSyncWriter synchronizes concurrent writes to an fdWriter.
+type fdSyncWriter struct {
+	sync.Mutex
+	fdWriter
+}
+
+// Write writes p to the underlying io.Writer. If another write is already in
+// progress, the calling goroutine blocks until the fdSyncWriter is available.
+func (w *fdSyncWriter) Write(p []byte) (n int, err error) {
+	w.Lock()
+	n, err = w.fdWriter.Write(p)
+	w.Unlock()
 	return n, err
 }

--- a/vendor/github.com/go-kit/kit/log/value.go
+++ b/vendor/github.com/go-kit/kit/log/value.go
@@ -6,9 +6,9 @@ import (
 	"github.com/go-stack/stack"
 )

-// A Valuer generates a log value. When passed to Context.With in a value
-// element (odd indexes), it represents a dynamic value which is re-evaluated
-// with each log event.
+// A Valuer generates a log value. When passed to With or WithPrefix in a
+// value element (odd indexes), it represents a dynamic value which is re-
+// evaluated with each log event.
 type Valuer func() interface{}

 // bindValues replaces all value elements (odd indexes) containing a Valuer
@@ -32,22 +32,51 @@ func containsValuer(keyvals []interface{}) bool {
 	return false
 }

-// Timestamp returns a Valuer that invokes the underlying function when bound,
-// returning a time.Time. Users will probably want to use DefaultTimestamp or
-// DefaultTimestampUTC.
+// Timestamp returns a timestamp Valuer. It invokes the t function to get the
+// time; unless you are doing something tricky, pass time.Now.
+//
+// Most users will want to use DefaultTimestamp or DefaultTimestampUTC, which
+// are TimestampFormats that use the RFC3339Nano format.
 func Timestamp(t func() time.Time) Valuer {
 	return func() interface{} { return t() }
 }

-var (
-	// DefaultTimestamp is a Valuer that returns the current wallclock time,
-	// respecting time zones, when bound.
-	DefaultTimestamp Valuer = func() interface{} { return time.Now().Format(time.RFC3339) }
+// TimestampFormat returns a timestamp Valuer with a custom time format. It
+// invokes the t function to get the time to format; unless you are doing
+// something tricky, pass time.Now. The layout string is passed to
+// Time.Format.
+//
+// Most users will want to use DefaultTimestamp or DefaultTimestampUTC, which
+// are TimestampFormats that use the RFC3339Nano format.
+func TimestampFormat(t func() time.Time, layout string) Valuer {
+	return func() interface{} {
+		return timeFormat{
+			time:   t(),
+			layout: layout,
+		}
+	}
+}

-	// DefaultTimestampUTC is a Valuer that returns the current time in UTC
-	// when bound.
-	DefaultTimestampUTC Valuer = func() interface{} { return time.Now().UTC().Format(time.RFC3339) }
-)
+// A timeFormat represents an instant in time and a layout used when
+// marshaling to a text format.
+type timeFormat struct {
+	time   time.Time
+	layout string
+}
+
+func (tf timeFormat) String() string {
+	return tf.time.Format(tf.layout)
+}
+
+// MarshalText implements encoding.TextMarshaller.
+func (tf timeFormat) MarshalText() (text []byte, err error) {
+	// The following code adapted from the standard library time.Time.Format
+	// method. Using the same undocumented magic constant to extend the size
+	// of the buffer as seen there.
+	b := make([]byte, 0, len(tf.layout)+10)
+	b = tf.time.AppendFormat(b, tf.layout)
+	return b, nil
+}

 // Caller returns a Valuer that returns a file and line from a specified depth
 // in the callstack. Users will probably want to use DefaultCaller.
@@ -56,6 +85,17 @@ func Caller(depth int) Valuer {
 }

 var (
+	// DefaultTimestamp is a Valuer that returns the current wallclock time,
+	// respecting time zones, when bound.
+	DefaultTimestamp = TimestampFormat(time.Now, time.RFC3339Nano)
+
+	// DefaultTimestampUTC is a Valuer that returns the current time in UTC
+	// when bound.
+	DefaultTimestampUTC = TimestampFormat(
+		func() time.Time { return time.Now().UTC() },
+		time.RFC3339Nano,
+	)
+
 	// DefaultCaller is a Valuer that returns the file and line where the Log
 	// method was invoked. It can only be used with log.With.
 	DefaultCaller = Caller(3)
--- a/vendor/github.com/go-kit/kit/metrics/doc.go
+++ b/vendor/github.com/go-kit/kit/metrics/doc.go
@@ -1,23 +1,54 @@
-// Package metrics provides a framework for application instrumentation. All
-// metrics are safe for concurrent use. Considerable design influence has been
-// taken from https://github.com/codahale/metrics and https://prometheus.io.
+// Package metrics provides a framework for application instrumentation. It's
+// primarily designed to help you get started with good and robust
+// instrumentation, and to help you migrate from a less-capable system like
+// Graphite to a more-capable system like Prometheus. If your organization has
+// already standardized on an instrumentation system like Prometheus, and has no
+// plans to change, it may make sense to use that system's instrumentation
+// library directly.
 //
-// This package contains the common interfaces. Your code should take these
-// interfaces as parameters. Implementations are provided for different
-// instrumentation systems in the various subdirectories.
+// This package provides three core metric abstractions (Counter, Gauge, and
+// Histogram) and implementations for almost all common instrumentation
+// backends. Each metric has an observation method (Add, Set, or Observe,
+// respectively) used to record values, and a With method to "scope" the
+// observation by various parameters. For example, you might have a Histogram to
+// record request durations, parameterized by the method that's being called.
+//
+//    var requestDuration metrics.Histogram
+//    // ...
+//    requestDuration.With("method", "MyMethod").Observe(time.Since(begin))
+//
+// This allows a single high-level metrics object (requestDuration) to work with
+// many code paths somewhat dynamically. The concept of With is fully supported
+// in some backends like Prometheus, and not supported in other backends like
+// Graphite. So, With may be a no-op, depending on the concrete implementation
+// you choose. Please check the implementation to know for sure. For
+// implementations that don't provide With, it's necessary to fully parameterize
+// each metric in the metric name, e.g.
+//
+//    // Statsd
+//    c := statsd.NewCounter("request_duration_MyMethod_200")
+//    c.Add(1)
+//
+//    // Prometheus
+//    c := prometheus.NewCounter(stdprometheus.CounterOpts{
+//        Name: "request_duration",
+//        ...
+//    }, []string{"method", "status_code"})
+//    c.With("method", "MyMethod", "status_code", strconv.Itoa(code)).Add(1)
 //
 // Usage
 //
-// Metrics are dependencies and should be passed to the components that need
+// Metrics are dependencies, and should be passed to the components that need
 // them in the same way you'd construct and pass a database handle, or reference
-// to another component. So, create metrics in your func main, using whichever
-// concrete implementation is appropriate for your organization.
+// to another component. Metrics should *not* be created in the global scope.
+// Instead, instantiate metrics in your func main, using whichever concrete
+// implementation is appropriate for your organization.
 //
 //    latency := prometheus.NewSummaryFrom(stdprometheus.SummaryOpts{
 //        Namespace: "myteam",
 //        Subsystem: "foosvc",
 //        Name:      "request_latency_seconds",
-//        Help:      "Incoming request latency in seconds."
+//        Help:      "Incoming request latency in seconds.",
 //    }, []string{"method", "status_code"})
 //
 // Write your components to take the metrics they will use as parameters to
@@ -40,8 +71,14 @@
 //    api := NewAPI(store, logger, latency)
 //    http.ListenAndServe("/", api)
 //
+// Note that metrics are "write-only" interfaces.
+//
 // Implementation details
 //
+// All metrics are safe for concurrent use. Considerable design influence has
+// been taken from https://github.com/codahale/metrics and
+// https://prometheus.io.
+//
 // Each telemetry system has different semantics for label values, push vs.
 // pull, support for histograms, etc. These properties influence the design of
 // their respective packages. This table attempts to summarize the key points of
@@ -54,7 +91,7 @@
 //    expvar      1    atomic                 atomic                 synthetic, batch, in-place expose
 //    influx      n    custom                 custom                 custom
 //    prometheus  n    native                 native                 native
-//    circonus    1    native                 native                 native
 //    pcp         1    native                 native                 native
+//    cloudwatch  n    batch push-aggregate   batch push-aggregate   synthetic, batch, push-aggregate
 //
 package metrics
--- a/vendor/github.com/go-kit/kit/metrics/dogstatsd/dogstatsd.go
+++ b/vendor/github.com/go-kit/kit/metrics/dogstatsd/dogstatsd.go
@@ -14,10 +14,13 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"time"

 	"github.com/go-kit/kit/log"
 	"github.com/go-kit/kit/metrics"
+	"github.com/go-kit/kit/metrics/generic"
 	"github.com/go-kit/kit/metrics/internal/lv"
 	"github.com/go-kit/kit/metrics/internal/ratemap"
 	"github.com/go-kit/kit/util/conn"
@@ -34,53 +37,63 @@ import (
 // To regularly report metrics to an io.Writer, use the WriteLoop helper method.
 // To send to a DogStatsD server, use the SendLoop helper method.
 type Dogstatsd struct {
+	mtx        sync.RWMutex
 	prefix     string
 	rates      *ratemap.RateMap
 	counters   *lv.Space
-	gauges     *lv.Space
+	gauges     map[string]*gaugeNode
 	timings    *lv.Space
 	histograms *lv.Space
 	logger     log.Logger
+	lvs        lv.LabelValues
 }

 // New returns a Dogstatsd object that may be used to create metrics. Prefix is
 // applied to all created metrics. Callers must ensure that regular calls to
 // WriteTo are performed, either manually or with one of the helper methods.
-func New(prefix string, logger log.Logger) *Dogstatsd {
+func New(prefix string, logger log.Logger, lvs ...string) *Dogstatsd {
+	if len(lvs)%2 != 0 {
+		panic("odd number of LabelValues; programmer error!")
+	}
 	return &Dogstatsd{
 		prefix:     prefix,
 		rates:      ratemap.New(),
 		counters:   lv.NewSpace(),
-		gauges:     lv.NewSpace(),
+		gauges:     map[string]*gaugeNode{},
 		timings:    lv.NewSpace(),
 		histograms: lv.NewSpace(),
 		logger:     logger,
+		lvs:        lvs,
 	}
 }

 // NewCounter returns a counter, sending observations to this Dogstatsd object.
 func (d *Dogstatsd) NewCounter(name string, sampleRate float64) *Counter {
-	d.rates.Set(d.prefix+name, sampleRate)
+	d.rates.Set(name, sampleRate)
 	return &Counter{
-		name: d.prefix + name,
+		name: name,
 		obs:  d.counters.Observe,
 	}
 }

 // NewGauge returns a gauge, sending observations to this Dogstatsd object.
 func (d *Dogstatsd) NewGauge(name string) *Gauge {
-	return &Gauge{
-		name: d.prefix + name,
-		obs:  d.gauges.Observe,
+	d.mtx.Lock()
+	n, ok := d.gauges[name]
+	if !ok {
+		n = &gaugeNode{gauge: &Gauge{g: generic.NewGauge(name), ddog: d}}
+		d.gauges[name] = n
 	}
+	d.mtx.Unlock()
+	return n.gauge
 }

 // NewTiming returns a histogram whose observations are interpreted as
 // millisecond durations, and are forwarded to this Dogstatsd object.
 func (d *Dogstatsd) NewTiming(name string, sampleRate float64) *Timing {
-	d.rates.Set(d.prefix+name, sampleRate)
+	d.rates.Set(name, sampleRate)
 	return &Timing{
-		name: d.prefix + name,
+		name: name,
 		obs:  d.timings.Observe,
 	}
 }
@@ -88,9 +101,9 @@ func (d *Dogstatsd) NewTiming(name string, sampleRate float64) *Timing {
 // NewHistogram returns a histogram whose observations are of an unspecified
 // unit, and are forwarded to this Dogstatsd object.
 func (d *Dogstatsd) NewHistogram(name string, sampleRate float64) *Histogram {
-	d.rates.Set(d.prefix+name, sampleRate)
+	d.rates.Set(name, sampleRate)
 	return &Histogram{
-		name: d.prefix + name,
+		name: name,
 		obs:  d.histograms.Observe,
 	}
 }
@@ -124,7 +137,7 @@ func (d *Dogstatsd) WriteTo(w io.Writer) (count int64, err error) {
 	var n int

 	d.counters.Reset().Walk(func(name string, lvs lv.LabelValues, values []float64) bool {
-		n, err = fmt.Fprintf(w, "%s:%f|c%s%s\n", name, sum(values), sampling(d.rates.Get(name)), tagValues(lvs))
+		n, err = fmt.Fprintf(w, "%s%s:%f|c%s%s\n", d.prefix, name, sum(values), sampling(d.rates.Get(name)), d.tagValues(lvs))
 		if err != nil {
 			return false
 		}
@@ -135,22 +148,23 @@ func (d *Dogstatsd) WriteTo(w io.Writer) (count int64, err error) {
 		return count, err
 	}

-	d.gauges.Reset().Walk(func(name string, lvs lv.LabelValues, values []float64) bool {
-		n, err = fmt.Fprintf(w, "%s:%f|g%s\n", name, last(values), tagValues(lvs))
-		if err != nil {
-			return false
-		}
-		count += int64(n)
-		return true
-	})
-	if err != nil {
-		return count, err
+	d.mtx.RLock()
+	for _, root := range d.gauges {
+		root.walk(func(name string, lvs lv.LabelValues, value float64) bool {
+			n, err = fmt.Fprintf(w, "%s%s:%f|g%s\n", d.prefix, name, value, d.tagValues(lvs))
+			if err != nil {
+				return false
+			}
+			count += int64(n)
+			return true
+		})
 	}
+	d.mtx.RUnlock()

 	d.timings.Reset().Walk(func(name string, lvs lv.LabelValues, values []float64) bool {
 		sampleRate := d.rates.Get(name)
 		for _, value := range values {
-			n, err = fmt.Fprintf(w, "%s:%f|ms%s%s\n", name, value, sampling(sampleRate), tagValues(lvs))
+			n, err = fmt.Fprintf(w, "%s%s:%f|ms%s%s\n", d.prefix, name, value, sampling(sampleRate), d.tagValues(lvs))
 			if err != nil {
 				return false
 			}
@@ -165,7 +179,7 @@ func (d *Dogstatsd) WriteTo(w io.Writer) (count int64, err error) {
 	d.histograms.Reset().Walk(func(name string, lvs lv.LabelValues, values []float64) bool {
 		sampleRate := d.rates.Get(name)
 		for _, value := range values {
-			n, err = fmt.Fprintf(w, "%s:%f|h%s%s\n", name, value, sampling(sampleRate), tagValues(lvs))
+			n, err = fmt.Fprintf(w, "%s%s:%f|h%s%s\n", d.prefix, name, value, sampling(sampleRate), d.tagValues(lvs))
 			if err != nil {
 				return false
 			}
@@ -200,14 +214,17 @@ func sampling(r float64) string {
 	return sv
 }

-func tagValues(labelValues []string) string {
-	if len(labelValues) == 0 {
+func (d *Dogstatsd) tagValues(labelValues []string) string {
+	if len(labelValues) == 0 && len(d.lvs) == 0 {
 		return ""
 	}
 	if len(labelValues)%2 != 0 {
 		panic("tagValues received a labelValues with an odd number of strings")
 	}
-	pairs := make([]string, 0, len(labelValues)/2)
+	pairs := make([]string, 0, (len(d.lvs)+len(labelValues))/2)
+	for i := 0; i < len(d.lvs); i += 2 {
+		pairs = append(pairs, d.lvs[i]+":"+d.lvs[i+1])
+	}
 	for i := 0; i < len(labelValues); i += 2 {
 		pairs = append(pairs, labelValues[i]+":"+labelValues[i+1])
 	}
@@ -241,23 +258,31 @@ func (c *Counter) Add(delta float64) {
 // Gauge is a DogStatsD gauge. Observations are forwarded to a Dogstatsd
 // object, and aggregated (the last observation selected) per timeseries.
 type Gauge struct {
-	name string
-	lvs  lv.LabelValues
-	obs  observeFunc
+	g    *generic.Gauge
+	ddog *Dogstatsd
+	set  int32
 }

 // With implements metrics.Gauge.
 func (g *Gauge) With(labelValues ...string) metrics.Gauge {
-	return &Gauge{
-		name: g.name,
-		lvs:  g.lvs.With(labelValues...),
-		obs:  g.obs,
-	}
+	g.ddog.mtx.RLock()
+	node := g.ddog.gauges[g.g.Name]
+	g.ddog.mtx.RUnlock()
+
+	ga := &Gauge{g: g.g.With(labelValues...).(*generic.Gauge), ddog: g.ddog}
+	return node.addGauge(ga, ga.g.LabelValues())
 }

 // Set implements metrics.Gauge.
 func (g *Gauge) Set(value float64) {
-	g.obs(g.name, g.lvs, value)
+	g.g.Set(value)
+	g.touch()
+}
+
+// Add implements metrics.Gauge.
+func (g *Gauge) Add(delta float64) {
+	g.g.Add(delta)
+	g.touch()
 }

 // Timing is a DogStatsD timing, or metrics.Histogram. Observations are
@@ -304,3 +329,61 @@ func (h *Histogram) With(labelValues ...string) metrics.Histogram {
 func (h *Histogram) Observe(value float64) {
 	h.obs(h.name, h.lvs, value)
 }
+
+type pair struct{ label, value string }
+
+type gaugeNode struct {
+	mtx      sync.RWMutex
+	gauge    *Gauge
+	children map[pair]*gaugeNode
+}
+
+func (n *gaugeNode) addGauge(g *Gauge, lvs lv.LabelValues) *Gauge {
+	n.mtx.Lock()
+	defer n.mtx.Unlock()
+	if len(lvs) == 0 {
+		if n.gauge == nil {
+			n.gauge = g
+		}
+		return n.gauge
+	}
+	if len(lvs) < 2 {
+		panic("too few LabelValues; programmer error!")
+	}
+	head, tail := pair{lvs[0], lvs[1]}, lvs[2:]
+	if n.children == nil {
+		n.children = map[pair]*gaugeNode{}
+	}
+	child, ok := n.children[head]
+	if !ok {
+		child = &gaugeNode{}
+		n.children[head] = child
+	}
+	return child.addGauge(g, tail)
+}
+
+func (n *gaugeNode) walk(fn func(string, lv.LabelValues, float64) bool) bool {
+	n.mtx.RLock()
+	defer n.mtx.RUnlock()
+	if n.gauge != nil {
+		value, ok := n.gauge.read()
+		if ok && !fn(n.gauge.g.Name, n.gauge.g.LabelValues(), value) {
+			return false
+		}
+	}
+	for _, child := range n.children {
+		if !child.walk(fn) {
+			return false
+		}
+	}
+	return true
+}
+
+func (g *Gauge) touch() {
+	atomic.StoreInt32(&(g.set), 1)
+}
+
+func (g *Gauge) read() (float64, bool) {
+	set := atomic.SwapInt32(&(g.set), 0)
+	return g.g.Value(), set != 0
+}
--- a/vendor/github.com/go-kit/kit/metrics/generic/generic.go
+++ b/vendor/github.com/go-kit/kit/metrics/generic/generic.go
@@ -33,6 +33,7 @@ func NewCounter(name string) *Counter {
 // With implements Counter.
 func (c *Counter) With(labelValues ...string) metrics.Counter {
 	return &Counter{
+		Name: c.Name,
 		bits: atomic.LoadUint64(&c.bits),
 		lvs:  c.lvs.With(labelValues...),
 	}
@@ -95,6 +96,7 @@ func NewGauge(name string) *Gauge {
 // With implements Gauge.
 func (g *Gauge) With(labelValues ...string) metrics.Gauge {
 	return &Gauge{
+		Name: g.Name,
 		bits: atomic.LoadUint64(&g.bits),
 		lvs:  g.lvs.With(labelValues...),
 	}
@@ -105,6 +107,20 @@ func (g *Gauge) Set(value float64) {
 	atomic.StoreUint64(&g.bits, math.Float64bits(value))
 }

+// Add implements metrics.Gauge.
+func (g *Gauge) Add(delta float64) {
+	for {
+		var (
+			old  = atomic.LoadUint64(&g.bits)
+			newf = math.Float64frombits(old) + delta
+			new  = math.Float64bits(newf)
+		)
+		if atomic.CompareAndSwapUint64(&g.bits, old, new) {
+			break
+		}
+	}
+}
+
 // Value returns the current value of the gauge.
 func (g *Gauge) Value() float64 {
 	return math.Float64frombits(atomic.LoadUint64(&g.bits))
@@ -121,7 +137,7 @@ func (g *Gauge) LabelValues() []string {
 type Histogram struct {
 	Name string
 	lvs  lv.LabelValues
-	h    gohistogram.Histogram
+	h    *safeHistogram
 }

 // NewHistogram returns a numeric histogram based on VividCortex/gohistogram. A
@@ -129,25 +145,30 @@ type Histogram struct {
 func NewHistogram(name string, buckets int) *Histogram {
 	return &Histogram{
 		Name: name,
-		h:    gohistogram.NewHistogram(buckets),
+		h:    &safeHistogram{Histogram: gohistogram.NewHistogram(buckets)},
 	}
 }

 // With implements Histogram.
 func (h *Histogram) With(labelValues ...string) metrics.Histogram {
 	return &Histogram{
-		lvs: h.lvs.With(labelValues...),
-		h:   h.h,
+		Name: h.Name,
+		lvs:  h.lvs.With(labelValues...),
+		h:    h.h,
 	}
 }

 // Observe implements Histogram.
 func (h *Histogram) Observe(value float64) {
+	h.h.Lock()
+	defer h.h.Unlock()
 	h.h.Add(value)
 }

 // Quantile returns the value of the quantile q, 0.0 < q < 1.0.
 func (h *Histogram) Quantile(q float64) float64 {
+	h.h.RLock()
+	defer h.h.RUnlock()
 	return h.h.Quantile(q)
 }

@@ -159,9 +180,17 @@ func (h *Histogram) LabelValues() []string {
 // Print writes a string representation of the histogram to the passed writer.
 // Useful for printing to a terminal.
 func (h *Histogram) Print(w io.Writer) {
+	h.h.RLock()
+	defer h.h.RUnlock()
 	fmt.Fprintf(w, h.h.String())
 }

+// safeHistogram exists as gohistogram.Histogram is not goroutine-safe.
+type safeHistogram struct {
+	sync.RWMutex
+	gohistogram.Histogram
+}
+
 // Bucket is a range in a histogram which aggregates observations.
 type Bucket struct {
 	From, To, Count int64
--- a/vendor/github.com/go-kit/kit/metrics/influx/influx.go
+++ b/vendor/github.com/go-kit/kit/metrics/influx/influx.go
@@ -66,6 +66,7 @@ func (in *Influx) NewGauge(name string) *Gauge {
 	return &Gauge{
 		name: name,
 		obs:  in.gauges.Observe,
+		add:  in.gauges.Add,
 	}
 }

@@ -168,10 +169,14 @@ func mergeTags(tags map[string]string, labelValues []string) map[string]string {
 	if len(labelValues)%2 != 0 {
 		panic("mergeTags received a labelValues with an odd number of strings")
 	}
-	for i := 0; i < len(labelValues); i += 2 {
-		tags[labelValues[i]] = labelValues[i+1]
+	ret := make(map[string]string, len(tags)+len(labelValues)/2)
+	for k, v := range tags {
+		ret[k] = v
 	}
-	return tags
+	for i := 0; i < len(labelValues); i += 2 {
+		ret[labelValues[i]] = labelValues[i+1]
+	}
+	return ret
 }

 func sum(a []float64) float64 {
@@ -216,6 +221,7 @@ type Gauge struct {
 	name string
 	lvs  lv.LabelValues
 	obs  observeFunc
+	add  observeFunc
 }

 // With implements metrics.Gauge.
@@ -224,6 +230,7 @@ func (g *Gauge) With(labelValues ...string) metrics.Gauge {
 		name: g.name,
 		lvs:  g.lvs.With(labelValues...),
 		obs:  g.obs,
+		add:  g.add,
 	}
 }

@@ -232,6 +239,11 @@ func (g *Gauge) Set(value float64) {
 	g.obs(g.name, g.lvs, value)
 }

+// Add implements metrics.Gauge.
+func (g *Gauge) Add(delta float64) {
+	g.add(g.name, g.lvs, delta)
+}
+
 // Histogram is an Influx histrogram. Observations are aggregated into a
 // generic.Histogram and emitted as per-quantile gauges to the Influx server.
 type Histogram struct {
--- a/vendor/github.com/go-kit/kit/metrics/internal/lv/space.go
+++ b/vendor/github.com/go-kit/kit/metrics/internal/lv/space.go
@@ -21,6 +21,13 @@ func (s *Space) Observe(name string, lvs LabelValues, value float64) {
 	s.nodeFor(name).observe(lvs, value)
 }

+// Add locates the time series identified by the name and label values in
+// the vector space, and appends the delta to the last value in the list of
+// observations.
+func (s *Space) Add(name string, lvs LabelValues, delta float64) {
+	s.nodeFor(name).add(lvs, delta)
+}
+
 // Walk traverses the vector space and invokes fn for each non-empty time series
 // which is encountered. Return false to abort the traversal.
 func (s *Space) Walk(fn func(name string, lvs LabelValues, observations []float64) bool) {
@@ -91,6 +98,34 @@ func (n *node) observe(lvs LabelValues, value float64) {
 	child.observe(tail, value)
 }

+func (n *node) add(lvs LabelValues, delta float64) {
+	n.mtx.Lock()
+	defer n.mtx.Unlock()
+	if len(lvs) == 0 {
+		var value float64
+		if len(n.observations) > 0 {
+			value = last(n.observations) + delta
+		} else {
+			value = delta
+		}
+		n.observations = append(n.observations, value)
+		return
+	}
+	if len(lvs) < 2 {
+		panic("too few LabelValues; programmer error!")
+	}
+	head, tail := pair{lvs[0], lvs[1]}, lvs[2:]
+	if n.children == nil {
+		n.children = map[pair]*node{}
+	}
+	child, ok := n.children[head]
+	if !ok {
+		child = &node{}
+		n.children[head] = child
+	}
+	child.add(tail, delta)
+}
+
 func (n *node) walk(lvs LabelValues, fn func(LabelValues, []float64) bool) bool {
 	n.mtx.RLock()
 	defer n.mtx.RUnlock()
@@ -104,3 +139,7 @@ func (n *node) walk(lvs LabelValues, fn func(LabelValues, []float64) bool) bool
 	}
 	return true
 }
+
+func last(a []float64) float64 {
+	return a[len(a)-1]
+}
--- a/vendor/github.com/go-kit/kit/metrics/metrics.go
+++ b/vendor/github.com/go-kit/kit/metrics/metrics.go
@@ -12,6 +12,7 @@ type Counter interface {
 type Gauge interface {
 	With(labelValues ...string) Gauge
 	Set(value float64)
+	Add(delta float64)
 }

 // Histogram describes a metric that takes repeated observations of the same
--- a/vendor/github.com/go-kit/kit/metrics/multi/multi.go
+++ b/vendor/github.com/go-kit/kit/metrics/multi/multi.go
@@ -54,6 +54,13 @@ func (g Gauge) With(labelValues ...string) metrics.Gauge {
 	return next
 }

+// Add implements metrics.Gauge.
+func (g Gauge) Add(delta float64) {
+	for _, gauge := range g {
+		gauge.Add(delta)
+	}
+}
+
 // Histogram collects multiple individual histograms and treats them as a unit.
 type Histogram []metrics.Histogram

--- a/vendor/github.com/go-kit/kit/metrics/statsd/statsd.go
+++ b/vendor/github.com/go-kit/kit/metrics/statsd/statsd.go
@@ -74,6 +74,7 @@ func (s *Statsd) NewGauge(name string) *Gauge {
 	return &Gauge{
 		name: s.prefix + name,
 		obs:  s.gauges.Observe,
+		add:  s.gauges.Add,
 	}
 }

@@ -201,6 +202,7 @@ func (c *Counter) Add(delta float64) {
 type Gauge struct {
 	name string
 	obs  observeFunc
+	add  observeFunc
 }

 // With is a no-op.
@@ -213,6 +215,11 @@ func (g *Gauge) Set(value float64) {
 	g.obs(g.name, lv.LabelValues{}, value)
 }

+// Add implements metrics.Gauge.
+func (g *Gauge) Add(delta float64) {
+	g.add(g.name, lv.LabelValues{}, delta)
+}
+
 // Timing is a StatsD timing, or metrics.Histogram. Observations are
 // forwarded to a Statsd object, and collected (but not aggregated) per
 // timeseries.
--- a/vendor/github.com/go-kit/kit/metrics/timer.go
+++ b/vendor/github.com/go-kit/kit/metrics/timer.go
@@ -7,6 +7,7 @@ import "time"
 type Timer struct {
 	h Histogram
 	t time.Time
+	u time.Duration
 }

 // NewTimer wraps the given histogram and records the current time.
@@ -14,15 +15,22 @@ func NewTimer(h Histogram) *Timer {
 	return &Timer{
 		h: h,
 		t: time.Now(),
+		u: time.Second,
 	}
 }

 // ObserveDuration captures the number of seconds since the timer was
 // constructed, and forwards that observation to the histogram.
 func (t *Timer) ObserveDuration() {
-	d := time.Since(t.t).Seconds()
+	d := float64(time.Since(t.t).Nanoseconds()) / float64(t.u)
 	if d < 0 {
 		d = 0
 	}
 	t.h.Observe(d)
 }
+
+// Unit sets the unit of the float64 emitted by the timer.
+// By default, the timer emits seconds.
+func (t *Timer) Unit(u time.Duration) {
+	t.u = u
+}
--- a/webui/.angular-cli.json
+++ b/webui/.angular-cli.json
@@ -0,0 +1,63 @@
+{
+  "$schema": "./node_modules/@angular/cli/lib/config/schema.json",
+  "project": {
+    "name": "webui"
+  },
+  "apps": [
+    {
+      "root": "src",
+      "outDir": "dist",
+      "assets": [
+        "assets",
+        "favicon.ico"
+      ],
+      "index": "index.html",
+      "main": "main.ts",
+      "polyfills": "polyfills.ts",
+      "test": "test.ts",
+      "tsconfig": "tsconfig.app.json",
+      "testTsconfig": "tsconfig.spec.json",
+      "prefix": "app",
+      "styles": [
+        "styles/app.sass"
+      ],
+      "scripts": [
+        "../node_modules/@fortawesome/fontawesome/index.js",
+        "../node_modules/@fortawesome/fontawesome-free-solid/index.js"
+      ],
+      "environmentSource": "environments/environment.ts",
+      "environments": {
+        "dev": "environments/environment.ts",
+        "prod": "environments/environment.prod.ts"
+      }
+    }
+  ],
+  "e2e": {
+    "protractor": {
+      "config": "./protractor.conf.js"
+    }
+  },
+  "lint": [
+    {
+      "project": "src/tsconfig.app.json",
+      "exclude": "**/node_modules/**"
+    },
+    {
+      "project": "src/tsconfig.spec.json",
+      "exclude": "**/node_modules/**"
+    },
+    {
+      "project": "e2e/tsconfig.e2e.json",
+      "exclude": "**/node_modules/**"
+    }
+  ],
+  "test": {
+    "karma": {
+      "config": "./karma.conf.js"
+    }
+  },
+  "defaults": {
+    "styleExt": "sass",
+    "component": {}
+  }
+}
--- a/webui/.babelrc
+++ b/webui/.babelrc
@@ -1,3 +0,0 @@
-{
-  "presets": ["es2015"]
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
SALLEYRON Julien	c210ab31d9	Prepare release v1.6.0	2018-04-30 23:20:05 +02:00
Timo Reimann	6c1fa91c70	Document custom k8s ingress class usage in guide.	2018-04-30 20:28:03 +02:00
Ludovic Fernandez	04bab185f6	Add redirect section.	2018-04-30 12:28:03 +02:00
Ludovic Fernandez	2213b4cf37	Cleaning labels/annotations documentation.	2018-04-30 12:08:03 +02:00
Alexy Mikhailichenko	1d770e5636	Fix typo and tweak formatting in quickstart	2018-04-30 09:24:04 +02:00
Ludovic Fernandez	b7e15e0a2c	doc: update Traefik images.	2018-04-27 14:54:03 +02:00
Jan Kuri	9c651ae913	New web ui	2018-04-27 13:12:04 +02:00
Michael	e09d5cb4ec	Fix documentation for tracing with Jaeger	2018-04-24 19:22:03 +02:00
NicoMen	cae353b9f6	Add documentation about Templating in backend file	2018-04-24 18:58:03 +02:00
Ludovic Fernandez	edb5b3d711	Fix whitelist and XFF.	2018-04-23 16:20:05 +02:00
Colin Coller	667a0c41ed	Minor improvements to documentation	2018-04-23 15:56:03 +02:00
Ludovic Fernandez	2975acdc82	Forward auth: copy response headers when auth failed.	2018-04-23 15:28:04 +02:00
Ludovic Fernandez	76dcbe3429	Fix error pages redirect and headers.	2018-04-23 11:28:04 +02:00
Ludovic Fernandez	d8e2d464ad	Remove dead code.	2018-04-23 10:54:03 +02:00
Arnas	5f8bcb0c26	Fix typo in documentation	2018-04-23 10:28:04 +02:00
Ludovic Fernandez	7ef8d6fa10	Ignore server for container with empty IP address.	2018-04-22 09:10:03 +02:00
Fernandez Ludovic	5924a40222	Fix Service Fabric docs to use v1.6 labels.	2018-04-19 20:15:20 +02:00
Fernandez Ludovic	95ce4f5c1e	refactor: minor fixes.	2018-04-18 10:48:03 +02:00
Fernandez Ludovic	f258f20b04	doc: add 'traefik.domain'.	2018-04-18 10:48:03 +02:00
Fernandez Ludovic	7e2ad827aa	fix: used 'traefik.domain' in frontend rule.	2018-04-18 10:48:03 +02:00
Michael	3df588047d	Prepare release v1.6.0-rc6	2018-04-17 13:42:03 +02:00
Ludovic Fernandez	ac0e5cbb29	Use shared label system	2018-04-17 11:18:04 +02:00
Michael	5ab584bc6a	Fix panic in atomic on ARM and x86-32 platforms	2018-04-17 10:32:03 +02:00
NicoMen	a2e03e3bd0	Create backup file during migration from ACME V1 to ACME V2	2018-04-16 19:34:04 +02:00
Jean-Baptiste Doumenjou	f0589b310f	Fix multiple frontends with docker-compose --scale	2018-04-16 18:14:04 +02:00
Michael	8519b0d353	Fix nil value when tracing is enabled	2018-04-16 17:42:03 +02:00
Manuel Zapf	0e3d1e1503	fix: redirect to HTTPS first before basic auth if header redirect (secure) is set	2018-04-16 11:06:03 +02:00
Michael	ebd77f314d	Fix duplicated tags in InfluxDB	2018-04-16 10:28:04 +02:00
Ludovic Fernandez	749d833f65	fix: template version documentation.	2018-04-16 00:34:03 +02:00
Cyrille Hemidy	0373cd6f97	Add missing argument in log.	2018-04-13 19:46:03 +02:00
Ludovic Fernandez	1f3fc8a366	fix: backend name for stateful service and more.	2018-04-13 15:44:04 +02:00
Fernandez Ludovic	89c3930b28	Merge branch 'v1.5' into 'v1.6'	2018-04-13 15:02:29 +02:00
Ludovic Fernandez	29e1e9eef2	fix: backend name for stateful service.	2018-04-13 14:38:03 +02:00