Prepare release v1.7.28

Co-authored-by: jbdoumenjou <jb.doumenjou@gmail.com>

.github/CODEOWNERS

@@ -1,24 +0,0 @@
-provider/kubernetes/**  @containous/kubernetes
-provider/rancher/**     @containous/rancher
-provider/marathon/**    @containous/marathon
-provider/docker/**      @containous/docker
-
-docs/user-guide/kubernetes.md       @containous/kubernetes
-docs/user-guide/marathon.md         @containous/marathon
-docs/user-guide/swarm.md            @containous/docker
-docs/user-guide/swarm-mode.md       @containous/docker
-
-docs/configuration/backends/docker.md       @containous/docker
-docs/configuration/backends/kubernetes.md   @containous/kubernetes
-docs/configuration/backends/marathon.md     @containous/marathon
-docs/configuration/backends/rancher.md      @containous/rancher
-
-examples/k8s/                   @containous/kubernetes
-examples/compose-k8s.yaml       @containous/kubernetes
-examples/k8s.namespace.yaml     @containous/kubernetes
-examples/compose-rancher.yml    @containous/rancher
-examples/compose-marathon.yml   @containous/marathon
-
-vendor/github.com/gambol99/go-marathon  @containous/marathon
-vendor/github.com/rancher               @containous/rancher
-vendor/k8s.io/                          @containous/kubernetes

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,7 @@ HOW TO WRITE A GOOD PULL REQUEST?
 - Write useful descriptions and titles.
 - Address review comments in terms of additional commits.
 - Do not amend/squash existing ones unless the PR is trivial.
-- Read the contributing guide: https://github.com/containous/traefik/blob/master/CONTRIBUTING.md.
+- Read the contributing guide: https://github.com/traefik/traefik/blob/master/CONTRIBUTING.md.
 
 -->
 

.semaphoreci/golang.sh

@@ -2,19 +2,19 @@
 
 set -e
 
-curl -O https://dl.google.com/go/go1.12.linux-amd64.tar.gz
+curl -O https://dl.google.com/go/go1.14.linux-amd64.tar.gz
 
-tar -xvf go1.12.linux-amd64.tar.gz
-rm -rf go1.12.linux-amd64.tar.gz
+tar -xvf go1.14.linux-amd64.tar.gz
+rm -rf go1.14.linux-amd64.tar.gz
 
-sudo mkdir -p /usr/local/golang/1.12/go
-sudo mv go /usr/local/golang/1.12/
+sudo mkdir -p /usr/local/golang/1.14/go
+sudo mv go /usr/local/golang/1.14/
 
 sudo rm /usr/local/bin/go
-sudo chmod +x /usr/local/golang/1.12/go/bin/go
-sudo ln -s /usr/local/golang/1.12/go/bin/go /usr/local/bin/go
+sudo chmod +x /usr/local/golang/1.14/go/bin/go
+sudo ln -s /usr/local/golang/1.14/go/bin/go /usr/local/bin/go
 
-export GOROOT="/usr/local/golang/1.12/go"
-export GOTOOLDIR="/usr/local/golang/1.12/go/pkg/tool/linux_amd64"
+export GOROOT="/usr/local/golang/1.14/go"
+export GOTOOLDIR="/usr/local/golang/1.14/go/pkg/tool/linux_amd64"
 
 go version

.semaphoreci/setup.sh

@@ -5,7 +5,7 @@ export DOCKER_VERSION=18.09.7
 
 source .semaphoreci/vars
 
-if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
+if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/traefik/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
 
 if [ -n "$TEMP_STORAGE" ]; then SHOULD_TEST=$(echo "$TEMP_STORAGE" | grep -Ev '(.md|.yaml|.yml)' || :); fi
 

.semaphoreci/vars

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -e
 
-export REPO='containous/traefik'
+export REPO='traefik/traefik'
 
 if VERSION=$(git describe --exact-match --abbrev=0 --tags);
 then

.travis.yml

@@ -26,13 +26,15 @@ before_deploy:
       sudo -E apt-get -yq update;
       sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*;
       docker version;
+      echo "${DOCKERHUB_PASSWORD}" | docker login -u "${DOCKERHUB_USERNAME}" --password-stdin;
       make image;
       if [ "$TRAVIS_TAG" ]; then
         make -j${N_MAKE_JOBS} crossbinary-parallel;
         tar cfz dist/traefik-${VERSION}.src.tar.gz --exclude-vcs --exclude dist .;
       fi;
-      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" ${STRUCTOR_VERSION}
-      structor -o containous -r traefik --dockerfile-url="https://raw.githubusercontent.com/containous/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/containous/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/containous/structor/master/requirements-override.txt" --exp-branch=master --force-edit-url --debug;
+      curl -sfL https://raw.githubusercontent.com/traefik/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" ${STRUCTOR_VERSION}
+      curl -sSfL https://raw.githubusercontent.com/traefik/mixtus/master/godownloader.sh | sh -s -- -b "${GOPATH}/bin" ${MIXTUS_VERSION}
+      structor -o traefik -r traefik --dockerfile-url="https://raw.githubusercontent.com/traefik/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/traefik/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/traefik/structor/master/requirements-override.txt" --exp-branch=master --force-edit-url --debug;
     fi
 deploy:
   - provider: releases
@@ -41,19 +43,17 @@ deploy:
     skip_cleanup: true
     file_glob: true
     on:
-      repo: containous/traefik
+      repo: traefik/traefik
       tags: true
   - provider: script
     script: sh script/deploy.sh
     skip_cleanup: true
     on:
-      repo: containous/traefik
+      repo: traefik/traefik
       tags: true
-  - provider: pages
-    edge: false
-    github_token: ${GITHUB_TOKEN}
-    local_dir: site
+  - provider: script
+    script: mixtus --dst-doc-path="./traefik" --dst-owner=traefik --dst-repo-name=doc --git-user-email="30906710+traefiker@users.noreply.github.com" --git-user-name=traefiker --src-doc-path="./site" --src-owner=containous --src-repo-name=traefik
     skip_cleanup: true
     on:
-      repo: containous/traefik
+      repo: traefik/traefik
       all_branches: true

CODE_OF_CONDUCT.md

@@ -55,7 +55,7 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at contact@containo.us
+reported by contacting the project team at contact@traefik.io
 All complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is
 obligated to maintain confidentiality with regard to the reporter of an incident.

CONTRIBUTING.md

@@ -13,11 +13,11 @@ You need to run the `binary` target. This will create binaries for Linux platfor
 $ make binary
 docker build -t "traefik-dev:no-more-godep-ever" -f build.Dockerfile .
 Sending build context to Docker daemon 295.3 MB
-Step 0 : FROM golang:1.12-alpine
+Step 0 : FROM golang:1.14-alpine
  ---> 8c6473912976
 Step 1 : RUN go get github.com/golang/dep/cmd/dep
 [...]
-docker run --rm  -v "/var/run/docker.sock:/var/run/docker.sock" -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github.com/containous/traefik/"dist":/go/src/github.com/containous/traefik/"dist"" "traefik-dev:no-more-godep-ever" ./script/make.sh generate binary
+docker run --rm  -v "/var/run/docker.sock:/var/run/docker.sock" -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github.com/traefik/traefik/"dist":/go/src/github.com/traefik/traefik/"dist"" "traefik-dev:no-more-godep-ever" ./script/make.sh generate binary
 ---> Making bundle: generate (in .)
 removed 'gen.go'
 
@@ -32,7 +32,7 @@ traefik*
 ##### Setting up your `go` environment
 
 - You need `go` v1.9+
-- It is recommended you clone Traefik into a directory like `~/go/src/github.com/containous/traefik` (This is the official golang workspace hierarchy, and will allow dependencies to resolve properly)
+- It is recommended you clone Traefik into a directory like `~/go/src/github.com/traefik/traefik` (This is the official golang workspace hierarchy, and will allow dependencies to resolve properly)
 - Set your `GOPATH` and `PATH` variable to be set to `~/go` via:
 
 ```bash
@@ -61,7 +61,7 @@ GORACE=""
 Once your environment is set up and the Traefik repository cloned you can build Traefik. You need get `go-bindata` once to be able to use `go generate` command as part of the build.  The steps to build are:
 
 ```bash
-cd ~/go/src/github.com/containous/traefik
+cd ~/go/src/github.com/traefik/traefik
 
 # Get go-bindata. Please note, the ellipses are required
 go get github.com/containous/go-bindata/...
@@ -77,7 +77,7 @@ go build ./cmd/traefik
 # run other commands like tests
 ```
 
-You will find the Traefik executable in the `~/go/src/github.com/containous/traefik` folder as `traefik`.
+You will find the Traefik executable in the `~/go/src/github.com/traefik/traefik` folder as `traefik`.
 
 ### Updating the templates
 
@@ -117,13 +117,13 @@ integration test using the `test-integration` target.
 $ make test-unit
 docker build -t "traefik-dev:your-feature-branch" -f build.Dockerfile .
 # […]
-docker run --rm -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github/containous/traefik/dist:/go/src/github.com/containous/traefik/dist" "traefik-dev:your-feature-branch" ./script/make.sh generate test-unit
+docker run --rm -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github/traefik/traefik/dist:/go/src/github.com/traefik/traefik/dist" "traefik-dev:your-feature-branch" ./script/make.sh generate test-unit
 ---> Making bundle: generate (in .)
 removed 'gen.go'
 
 ---> Making bundle: test-unit (in .)
 + go test -cover -coverprofile=cover.out .
-ok      github.com/containous/traefik   0.005s  coverage: 4.1% of statements
+ok      github.com/traefik/traefik   0.005s  coverage: 4.1% of statements
 
 Test success
 ```
@@ -151,14 +151,14 @@ More: https://labix.org/gocheck
 Unit tests can be run from the cloned directory by `$ go test ./...` which should return `ok` similar to:
 
 ```
-ok      _/home/user/go/src/github/containous/traefik    0.004s
+ok      _/home/user/go/src/github/traefik/traefik    0.004s
 ```
 
 Integration tests must be run from the `integration/` directory and require the `-integration` switch to be passed like this: `$ cd integration && go test -integration ./...`.
 
 ## Documentation
 
-The [documentation site](https://docs.traefik.io/v1.7/) is built with [mkdocs](https://mkdocs.org/)
+The [documentation site](https://doc.traefik.io/traefik/v1.7/) is built with [mkdocs](https://mkdocs.org/)
 
 ### Building Documentation
 
@@ -170,7 +170,7 @@ You can build the documentation and serve it locally with livereloading, using t
 $ make docs
 docker build -t traefik-docs -f docs.Dockerfile .
 # […]
-docker run  --rm -v /home/user/go/github/containous/traefik:/mkdocs -p 8000:8000 traefik-docs mkdocs serve
+docker run  --rm -v /home/user/go/github/traefik/traefik:/mkdocs -p 8000:8000 traefik-docs mkdocs serve
 # […]
 [I 170828 20:47:48 server:283] Serving on http://0.0.0.0:8000
 [I 170828 20:47:48 handlers:60] Start watching changes
@@ -224,7 +224,7 @@ You can verify that the documentation meets some expectations, as checking for d
 $ make docs-verify
 docker build -t traefik-docs-verify ./script/docs-verify-docker-image ## Build Validator image
 ...
-docker run --rm -v /home/travis/build/containous/traefik:/app traefik-docs-verify ## Check for dead links and w3c compliance
+docker run --rm -v /home/travis/build/traefik/traefik:/app traefik-docs-verify ## Check for dead links and w3c compliance
 === Checking HTML content...
 Running ["HtmlCheck", "ImageCheck", "ScriptCheck", "LinkCheck"] on /app/site/basics/index.html on *.html...
 ```

Gopkg.lock

@@ -410,12 +410,12 @@
   version = "v3.1.2"
 
 [[projects]]
-  digest = "1:02cd7cf98a158c2388f0d26615be0c5d400fc13fad4448f2ecdb61f49b926c74"
+  digest = "1:f9036e25cfbaae520f7500f2eec29b514f9c38f82e067c36cf7255457b37f277"
   name = "github.com/containous/traefik-extra-service-fabric"
   packages = ["."]
   pruneopts = "NUT"
-  revision = "f9f49c0a6d51a8205faf34dd3cb7d628611257e5"
-  version = "v1.5.0"
+  revision = "d16f97f4104db329fdb15177b5d97fb047185625"
+  version = "v1.7.0"
 
 [[projects]]
   digest = "1:4e9c9d51ef5c98f2a71d6fa56a22f0bb8a4463656f9591ba24ebff2c21bcbd1f"
@@ -477,12 +477,11 @@
   version = "v1.1.0"
 
 [[projects]]
-  digest = "1:fa62421bd924623ac10a160686cc55d529f7274b2caedf7d2c607d14bc50c118"
+  digest = "1:295f7aed734ab28daff7c0df7db42bcccf7a043d4e0a5daf5768129346b25f23"
   name = "github.com/decker502/dnspod-go"
   packages = ["."]
   pruneopts = "NUT"
-  revision = "71fbbdbdf1a7eeac949586de15bf96d416d3dd63"
-  version = "v0.2.0"
+  revision = "071171b22a9b65e4f544b61c143befd54a08a64e"
 
 [[projects]]
   digest = "1:7a6852b35eb5bbc184561443762d225116ae630c26a7c4d90546619f1e7d2ad2"
@@ -1289,12 +1288,12 @@
   version = "v1.0.0"
 
 [[projects]]
-  branch = "master"
   digest = "1:ad2a63b2d6dfe7d66bf14c01f1171a3951abef6e0fb136170359c3f7c4f51615"
   name = "github.com/labbsr0x/goh"
   packages = ["gohclient"]
   pruneopts = "NUT"
-  revision = "94bcf1cb07b70b26b72ad54b2b050bcd0a66a9c8"
+  revision = "b1072e96a179ebd4e11c1a64123a43213099be81"
+  version = "v1.0.1"
 
 [[projects]]
   branch = "master"
@@ -1770,6 +1769,13 @@
   pruneopts = "NUT"
   revision = "1d7be4effb13d2d908342d349d71a284a7542693"
 
+[[projects]]
+  digest = "1:9ca27be3cfd8a452f9814926a5842c6917289da8c21174ee0f9c79d84850b2ed"
+  name = "github.com/shopspring/decimal"
+  packages = ["."]
+  pruneopts = "NUT"
+  revision = "f1972eb1d1f519e2e5f4b51f2dea765e8c93a130"
+
 [[projects]]
   digest = "1:01252cd79aac70f16cac02a72a1067dd136e0ad6d5b597d0129cf74c739fd8d1"
   name = "github.com/sirupsen/logrus"
@@ -1908,12 +1914,12 @@
   revision = "50716a0a853771bb36bfce61a45cdefdb98c2e6e"
 
 [[projects]]
-  branch = "v1"
-  digest = "1:60888cead16f066c948c078258b27f2885dce91cb6aadacf545b62a1ae1d08cb"
+  digest = "1:649756d307b6d8ddb369d1cca0465b679aa7d1a956ddfa8eb18f8072a1a2b7a4"
   name = "github.com/unrolled/secure"
   packages = ["."]
   pruneopts = "NUT"
-  revision = "a1cf62cc2159fff407728f118c41aece76c397fa"
+  revision = "996bc0cd7e5be6e6a1c5f34b0259bc47c8bcfbc9"
+  version = "v1.0.5"
 
 [[projects]]
   digest = "1:e84e99d5f369afaa9a5c41f55b57fa03047ecd3bac2a65861607882693ceea81"
@@ -1931,8 +1937,7 @@
   version = "v0.1.0"
 
 [[projects]]
-  branch = "master"
-  digest = "1:86f14aadf288fe3ad8ac060bcb2b5083cec3829dd883803486ec834d031060c9"
+  digest = "1:a31155114d2977ef48d2cca6810c4e055545d676bf13b604c2debd42de44cad0"
   name = "github.com/vulcand/oxy"
   packages = [
     "buffer",
@@ -1945,7 +1950,8 @@
     "utils",
   ]
   pruneopts = "NUT"
-  revision = "0d102f45103cf49a95b5c6e810e092973cbcb68c"
+  revision = "9dbd22c030f2187f590fea61ebe84ab78a8146a2"
+  version = "v1.1.0"
 
 [[projects]]
   digest = "1:ca6bac407fedc14fbeeba861dd33a821ba3a1624c10126ec6003b0a28d4139c5"
@@ -2612,6 +2618,7 @@
     "github.com/rancher/go-rancher-metadata/metadata",
     "github.com/rancher/go-rancher/v2",
     "github.com/ryanuber/go-glob",
+    "github.com/shopspring/decimal",
     "github.com/sirupsen/logrus",
     "github.com/stretchr/testify/assert",
     "github.com/stretchr/testify/mock",

Gopkg.toml

@@ -80,7 +80,7 @@
 
 [[constraint]]
   name = "github.com/containous/traefik-extra-service-fabric"
-  version = "v1.5.0"
+  version = "1.7.0"
 
 [[constraint]]
   name = "github.com/coreos/go-systemd"
@@ -167,15 +167,15 @@
   version = "1.1.0"
 
 [[constraint]]
-  branch = "v1"
   name = "github.com/unrolled/secure"
+  version = "1.0.5"
 
 [[constraint]]
   name = "github.com/vdemeester/shakers"
   version = "0.1.0"
 
 [[constraint]]
-  branch = "master"
+  version = "v1.1.0"
   name = "github.com/vulcand/oxy"
 
 [[constraint]]
@@ -264,3 +264,15 @@
 [[constraint]]
   name = "github.com/google/uuid"
   version = "0.2.0"
+
+[[constraint]]
+  name = "github.com/shopspring/decimal"
+  revision = "f1972eb1d1f519e2e5f4b51f2dea765e8c93a130"
+
+[[override]]
+  name = "contrib.go.opencensus.io/exporter/ocagent"
+  version = "0.4.12"
+
+[[override]]
+  name = "github.com/decker502/dnspod-go"
+  revision = "071171b22a9b65e4f544b61c143befd54a08a64e"

LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2018 Containous SAS
+Copyright (c) 2016-2018 Containous SAS; 2020-2021 Traefik Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

MAINTAINER.md

@@ -27,7 +27,7 @@ We use [PRM](https://github.com/ldez/prm) to manage locally pull requests.
 
 ## Bots
 
-### [Myrmica Lobicornis](https://github.com/containous/lobicornis/)
+### [Myrmica Lobicornis](https://github.com/traefik/lobicornis/)
 
 **Update and Merge Pull Request**
 
@@ -51,13 +51,13 @@ This label is used when:
 - Preparing the release
 
 
-### [Myrmica Bibikoffi](https://github.com/containous/bibikoffi/)
+### [Myrmica Bibikoffi](https://github.com/traefik/bibikoffi/)
 
 * closes stale issues [cron]
     * use some criterion as number of days between creation, last update, labels, ...
 
 
-### [Myrmica Aloba](https://github.com/containous/aloba)
+### [Myrmica Aloba](https://github.com/traefik/aloba)
 
 **Manage GitHub labels**
 

Makefile

@@ -14,12 +14,12 @@ TRAEFIK_ENVS := \
 SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
 
 BIND_DIR := "dist"
-TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/containous/traefik/$(BIND_DIR)"
+TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/traefik/traefik/$(BIND_DIR)"
 
 GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
 TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
 REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
-TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
+TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"traefik/traefik")
 INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
 TRAEFIK_DOC_IMAGE := traefik-docs
 TRAEFIK_DOC_VERIFY_IMAGE := $(TRAEFIK_DOC_IMAGE)-verify

README.md

@@ -4,10 +4,10 @@
 </p>
 
 [![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
-[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io/v1.7)
-[![Go Report Card](https://goreportcard.com/badge/containous/traefik)](http://goreportcard.com/report/containous/traefik)
+[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://doc.traefik.io/traefik/v1.7)
+[![Go Report Card](https://goreportcard.com/badge/traefik/traefik)](http://goreportcard.com/report/traefik/traefik)
 [![](https://images.microbadger.com/badges/image/traefik.svg)](https://microbadger.com/images/traefik)
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/traefik/traefik/blob/master/LICENSE.md)
 [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
@@ -70,22 +70,22 @@ _(But if you'd rather configure some of your routes manually, Traefik supports t
 
 ## Supported Backends
 
-- [Docker](https://docs.traefik.io/v1.7/configuration/backends/docker) / [Swarm mode](https://docs.traefik.io/v1.7/configuration/backends/docker#docker-swarm-mode)
-- [Kubernetes](https://docs.traefik.io/v1.7/configuration/backends/kubernetes)
-- [Mesos](https://docs.traefik.io/v1.7/configuration/backends/mesos) / [Marathon](https://docs.traefik.io/v1.7/configuration/backends/marathon)
-- [Rancher](https://docs.traefik.io/v1.7/configuration/backends/rancher) (API, Metadata)
-- [Azure Service Fabric](https://docs.traefik.io/v1.7/configuration/backends/servicefabric)
-- [Consul Catalog](https://docs.traefik.io/v1.7/configuration/backends/consulcatalog)
-- [Consul](https://docs.traefik.io/v1.7/configuration/backends/consul) / [Etcd](https://docs.traefik.io/v1.7/configuration/backends/etcd) / [Zookeeper](https://docs.traefik.io/v1.7/configuration/backends/zookeeper) / [BoltDB](https://docs.traefik.io/v1.7/configuration/backends/boltdb)
-- [Eureka](https://docs.traefik.io/v1.7/configuration/backends/eureka)
-- [Amazon ECS](https://docs.traefik.io/v1.7/configuration/backends/ecs)
-- [Amazon DynamoDB](https://docs.traefik.io/v1.7/configuration/backends/dynamodb)
-- [File](https://docs.traefik.io/v1.7/configuration/backends/file)
-- [Rest](https://docs.traefik.io/v1.7/configuration/backends/rest)
+- [Docker](https://doc.traefik.io/traefik/v1.7/configuration/backends/docker) / [Swarm mode](https://doc.traefik.io/traefik/v1.7/configuration/backends/docker#docker-swarm-mode)
+- [Kubernetes](https://doc.traefik.io/traefik/v1.7/configuration/backends/kubernetes)
+- [Mesos](https://doc.traefik.io/traefik/v1.7/configuration/backends/mesos) / [Marathon](https://doc.traefik.io/traefik/v1.7/configuration/backends/marathon)
+- [Rancher](https://doc.traefik.io/traefik/v1.7/configuration/backends/rancher) (API, Metadata)
+- [Azure Service Fabric](https://doc.traefik.io/traefik/v1.7/configuration/backends/servicefabric)
+- [Consul Catalog](https://doc.traefik.io/traefik/v1.7/configuration/backends/consulcatalog)
+- [Consul](https://doc.traefik.io/traefik/v1.7/configuration/backends/consul) / [Etcd](https://doc.traefik.io/traefik/v1.7/configuration/backends/etcd) / [Zookeeper](https://doc.traefik.io/traefik/v1.7/configuration/backends/zookeeper) / [BoltDB](https://doc.traefik.io/traefik/v1.7/configuration/backends/boltdb)
+- [Eureka](https://doc.traefik.io/traefik/v1.7/configuration/backends/eureka)
+- [Amazon ECS](https://doc.traefik.io/traefik/v1.7/configuration/backends/ecs)
+- [Amazon DynamoDB](https://doc.traefik.io/traefik/v1.7/configuration/backends/dynamodb)
+- [File](https://doc.traefik.io/traefik/v1.7/configuration/backends/file)
+- [Rest](https://doc.traefik.io/traefik/v1.7/configuration/backends/rest)
 
 ## Quickstart
 
-To get your hands on Traefik, you can use the [5-Minute Quickstart](http://docs.traefik.io/v1.7/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).
+To get your hands on Traefik, you can use the [5-Minute Quickstart](http://doc.traefik.io/traefik/v1.7/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).
 
 Alternatively, if you don't want to install anything on your computer, you can try Traefik online in this great [Katacoda tutorial](https://www.katacoda.com/courses/traefik/deploy-load-balancer) that shows how to load balance requests between multiple Docker containers. 
 
@@ -100,7 +100,7 @@ You can access the simple HTML frontend of Traefik.
 
 ## Documentation
 
-You can find the complete documentation at [https://docs.traefik.io/v1.7](https://docs.traefik.io/v1.7).
+You can find the complete documentation at [https://doc.traefik.io/traefik/v1.7](https://doc.traefik.io/traefik/v1.7).
 A collection of contributions around Traefik can be found at [https://awesome.traefik.io](https://awesome.traefik.io).
 
 ## Support
@@ -109,17 +109,17 @@ To get community support, you can:
 - join the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
 - use [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
 
-If you need commercial support, please contact [Containo.us](https://containo.us) by mail: <mailto:support@containo.us>.
+If you need commercial support, please contact [Traefik.io](https://traefik.io) by mail: <mailto:support@traefik.io>.
 
 ## Download
 
-- Grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/v1.7/traefik.sample.toml):
+- Grab the latest binary from the [releases](https://github.com/traefik/traefik/releases) page and run it with the [sample configuration file](https://raw.githubusercontent.com/traefik/traefik/v1.7/traefik.sample.toml):
 
 ```shell
 ./traefik --configFile=traefik.toml
 ```
 
-- Or use the official tiny Docker image and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/v1.7/traefik.sample.toml):
+- Or use the official tiny Docker image and run it with the [sample configuration file](https://raw.githubusercontent.com/traefik/traefik/v1.7/traefik.sample.toml):
 
 ```shell
 docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik
@@ -128,7 +128,7 @@ docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.to
 - Or get the sources:
 
 ```shell
-git clone https://github.com/containous/traefik
+git clone https://github.com/traefik/traefik
 ```
 
 ## Introductory Videos

acme/account.go

@@ -14,11 +14,11 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containous/traefik/log"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/types"
 	"github.com/go-acme/lego/certcrypto"
 	"github.com/go-acme/lego/registration"
+	"github.com/traefik/traefik/log"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/types"
 )
 
 // Account is used to store lets encrypt registration info
@@ -111,7 +111,12 @@ func (a *Account) GetPrivateKey() crypto.PrivateKey {
 		return privateKey
 	}
 
-	log.Errorf("Cannot unmarshall private key %+v", a.PrivateKey)
+	keySnippet := ""
+	if len(a.PrivateKey) >= 16 {
+		keySnippet = string(a.PrivateKey[:16])
+	}
+
+	log.Errorf("Cannot unmarshall private key beginning with %s", keySnippet)
 	return nil
 }
 

acme/acme.go

@@ -20,12 +20,6 @@ import (
 	"github.com/containous/flaeg"
 	"github.com/containous/mux"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
 	"github.com/eapache/channels"
 	"github.com/go-acme/lego/certificate"
 	"github.com/go-acme/lego/challenge"
@@ -36,6 +30,12 @@ import (
 	"github.com/go-acme/lego/providers/dns"
 	"github.com/go-acme/lego/registration"
 	"github.com/sirupsen/logrus"
+	"github.com/traefik/traefik/cluster"
+	"github.com/traefik/traefik/log"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/types"
+	"github.com/traefik/traefik/version"
 )
 
 var (

acme/acme_test.go

@@ -11,10 +11,10 @@ import (
 	"testing"
 	"time"
 
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/tls/generate"
-	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/tls/generate"
+	"github.com/traefik/traefik/types"
 )
 
 func TestDomainsSet(t *testing.T) {

acme/challenge_http_provider.go

@@ -6,10 +6,10 @@ import (
 	"time"
 
 	"github.com/cenk/backoff"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
 	"github.com/go-acme/lego/challenge"
+	"github.com/traefik/traefik/cluster"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/safe"
 )
 
 var _ challenge.ProviderTimeout = (*challengeHTTPProvider)(nil)

acme/challenge_tls_provider.go

@@ -8,11 +8,11 @@ import (
 	"time"
 
 	"github.com/cenk/backoff"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
 	"github.com/go-acme/lego/challenge"
 	"github.com/go-acme/lego/challenge/tlsalpn01"
+	"github.com/traefik/traefik/cluster"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/safe"
 )
 
 var _ challenge.ProviderTimeout = (*challengeTLSProvider)(nil)

acme/localStore.go

@@ -5,8 +5,8 @@ import (
 	"io/ioutil"
 	"os"
 
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/acme"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/provider/acme"
 )
 
 // LocalStore is a store using a file as storage

anonymize/anonymize_config_test.go

@@ -7,32 +7,32 @@ import (
 	"time"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/middlewares"
-	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/kv"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/safe"
-	traefiktls "github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/thoas/stats"
+	"github.com/traefik/traefik/acme"
+	"github.com/traefik/traefik/api"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/middlewares"
+	"github.com/traefik/traefik/provider"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/provider/boltdb"
+	"github.com/traefik/traefik/provider/consul"
+	"github.com/traefik/traefik/provider/consulcatalog"
+	"github.com/traefik/traefik/provider/docker"
+	"github.com/traefik/traefik/provider/dynamodb"
+	"github.com/traefik/traefik/provider/ecs"
+	"github.com/traefik/traefik/provider/etcd"
+	"github.com/traefik/traefik/provider/eureka"
+	"github.com/traefik/traefik/provider/file"
+	"github.com/traefik/traefik/provider/kubernetes"
+	"github.com/traefik/traefik/provider/kv"
+	"github.com/traefik/traefik/provider/marathon"
+	"github.com/traefik/traefik/provider/mesos"
+	"github.com/traefik/traefik/provider/rancher"
+	"github.com/traefik/traefik/provider/zk"
+	"github.com/traefik/traefik/safe"
+	traefiktls "github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
 )
 
 func TestDo_globalConfiguration(t *testing.T) {

api/dashboard.go

@@ -2,10 +2,11 @@ package api
 
 import (
 	"net/http"
+	"net/url"
 
 	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
+	"github.com/traefik/traefik/log"
 )
 
 // DashboardHandler expose dashboard routes
@@ -23,17 +24,35 @@ func (g DashboardHandler) AddRoutes(router *mux.Router) {
 	// Expose dashboard
 	router.Methods(http.MethodGet).
 		Path("/").
-		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-			http.Redirect(response, request, request.Header.Get("X-Forwarded-Prefix")+"/dashboard/", 302)
+		HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
+			http.Redirect(resp, req, safePrefix(req)+"/dashboard/", 302)
 		})
 
 	router.Methods(http.MethodGet).
 		Path("/dashboard/status").
-		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-			http.Redirect(response, request, "/dashboard/", 302)
+		HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
+			http.Redirect(resp, req, "/dashboard/", 302)
 		})
 
 	router.Methods(http.MethodGet).
 		PathPrefix("/dashboard/").
 		Handler(http.StripPrefix("/dashboard/", http.FileServer(g.Assets)))
 }
+
+func safePrefix(req *http.Request) string {
+	prefix := req.Header.Get("X-Forwarded-Prefix")
+	if prefix == "" {
+		return ""
+	}
+
+	parse, err := url.Parse(prefix)
+	if err != nil {
+		return ""
+	}
+
+	if parse.Host != "" {
+		return ""
+	}
+
+	return parse.Path
+}

api/dashboard_test.go

@@ -0,0 +1,54 @@
+package api
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_safePrefix(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		value    string
+		expected string
+	}{
+		{
+			desc:     "host",
+			value:    "https://example.com",
+			expected: "",
+		},
+		{
+			desc:     "host with path",
+			value:    "https://example.com/foo/bar?test",
+			expected: "",
+		},
+		{
+			desc:     "path",
+			value:    "/foo/bar",
+			expected: "/foo/bar",
+		},
+		{
+			desc:     "path without leading slash",
+			value:    "foo/bar",
+			expected: "foo/bar",
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			req, err := http.NewRequest(http.MethodGet, "http://localhost", nil)
+			require.NoError(t, err)
+
+			req.Header.Set("X-Forwarded-Prefix", test.value)
+
+			prefix := safePrefix(req)
+
+			assert.Equal(t, test.expected, prefix)
+		})
+	}
+}

api/handler.go

@@ -4,13 +4,13 @@ import (
 	"net/http"
 
 	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/middlewares"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	thoas_stats "github.com/thoas/stats"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/middlewares"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/types"
+	"github.com/traefik/traefik/version"
 	"github.com/unrolled/render"
 )
 

autogen/gentemplates/gen.go

@@ -159,6 +159,9 @@ var _templatesConsul_catalogTmpl = []byte(`[backends]
     {{if $loadBalancer.Stickiness }}
     [backends."backend-{{ $backendName }}".loadBalancer.stickiness]
       cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+      secure = {{ $loadBalancer.Stickiness.Secure }}
+      httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+      sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
     {{end}}
   {{end}}
 
@@ -654,6 +657,9 @@ var _templatesDockerTmpl = []byte(`{{$backendServers := .Servers}}
       {{if $loadBalancer.Stickiness }}
       [backends."backend-{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+        secure = {{ $loadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
       {{end}}
   {{end}}
 
@@ -1000,6 +1006,9 @@ var _templatesEcsTmpl = []byte(`[backends]
     {{if $loadBalancer.Stickiness }}
     [backends."backend-{{ $serviceName }}".loadBalancer.stickiness]
       cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+      secure = {{ $loadBalancer.Stickiness.Secure }}
+      httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+      sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
     {{end}}
   {{end}}
 
@@ -1325,6 +1334,9 @@ var _templatesKubernetesTmpl = []byte(`[backends]
       {{if $backend.LoadBalancer.Stickiness }}
       [backends."{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $backend.LoadBalancer.Stickiness.CookieName }}"
+        secure = {{ $backend.LoadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $backend.LoadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $backend.LoadBalancer.Stickiness.SameSite }}"
       {{end}}
 
     {{if $backend.MaxConn }}
@@ -1582,6 +1594,9 @@ var _templatesKvTmpl = []byte(`[backends]
       {{if $loadBalancer.Stickiness }}
       [backends."{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+        secure = {{ $loadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
       {{end}}
   {{end}}
 
@@ -1970,6 +1985,9 @@ var _templatesMarathonTmpl = []byte(`{{ $apps := .Applications }}
       {{if $loadBalancer.Stickiness }}
       [backends."{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+        secure = {{ $loadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
       {{end}}
     {{end}}
 
@@ -2302,6 +2320,9 @@ var _templatesMesosTmpl = []byte(`[backends]
       {{if $loadBalancer.Stickiness }}
       [backends."backend-{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+        secure = {{ $loadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
       {{end}}
   {{end}}
 
@@ -2688,6 +2709,9 @@ var _templatesRancherTmpl = []byte(`{{ $backendServers := .Backends }}
       {{if $loadBalancer.Stickiness }}
       [backends."backend-{{ $backendName }}".loadBalancer.stickiness]
         cookieName = "{{ $loadBalancer.Stickiness.CookieName }}"
+        secure = {{ $loadBalancer.Stickiness.Secure }}
+        httpOnly = {{ $loadBalancer.Stickiness.HTTPOnly }}
+        sameSite = "{{ $loadBalancer.Stickiness.SameSite }}"
       {{end}}
   {{end}}
 

build.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.12-alpine
+FROM golang:1.14-alpine
 
 RUN apk --update upgrade \
     && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
@@ -27,5 +27,5 @@ RUN mkdir -p /usr/local/bin \
     && curl -fL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz \
     | tar -xzC /usr/local/bin --transform 's#^.+/##x'
 
-WORKDIR /go/src/github.com/containous/traefik
-COPY . /go/src/github.com/containous/traefik
+WORKDIR /go/src/github.com/traefik/traefik
+COPY . /go/src/github.com/traefik/traefik

cluster/datastore.go

@@ -10,10 +10,10 @@ import (
 	"github.com/abronan/valkeyrie/store"
 	"github.com/cenk/backoff"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/job"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
 	"github.com/google/uuid"
+	"github.com/traefik/traefik/job"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/safe"
 )
 
 // Metadata stores Object plus metadata

cluster/leadership.go

@@ -7,10 +7,10 @@ import (
 
 	"github.com/cenk/backoff"
 	"github.com/containous/mux"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
 	"github.com/docker/leadership"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/types"
 	"github.com/unrolled/render"
 )
 

cmd/bug/bug.go

@@ -9,13 +9,13 @@ import (
 	"text/template"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/version"
+	"github.com/traefik/traefik/anonymize"
+	"github.com/traefik/traefik/cmd"
+	"github.com/traefik/traefik/cmd/version"
 )
 
 const (
-	bugTracker  = "https://github.com/containous/traefik/issues/new"
+	bugTracker  = "https://github.com/traefik/traefik/issues/new"
 	bugTemplate = `<!--
 DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
 

cmd/bug/bug_test.go

@@ -3,13 +3,13 @@ package bug
 import (
 	"testing"
 
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
+	"github.com/traefik/traefik/anonymize"
+	"github.com/traefik/traefik/cmd"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/provider/file"
+	"github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
 )
 
 func Test_createReport(t *testing.T) {

cmd/configuration.go

@@ -5,31 +5,31 @@ import (
 
 	"github.com/containous/flaeg"
 	servicefabric "github.com/containous/traefik-extra-service-fabric"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/middlewares/accesslog"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/datadog"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/ping"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/rest"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/types"
 	sf "github.com/jjcollinge/servicefabric"
+	"github.com/traefik/traefik/api"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/middlewares/accesslog"
+	"github.com/traefik/traefik/middlewares/tracing"
+	"github.com/traefik/traefik/middlewares/tracing/datadog"
+	"github.com/traefik/traefik/middlewares/tracing/jaeger"
+	"github.com/traefik/traefik/middlewares/tracing/zipkin"
+	"github.com/traefik/traefik/ping"
+	"github.com/traefik/traefik/provider/boltdb"
+	"github.com/traefik/traefik/provider/consul"
+	"github.com/traefik/traefik/provider/consulcatalog"
+	"github.com/traefik/traefik/provider/docker"
+	"github.com/traefik/traefik/provider/dynamodb"
+	"github.com/traefik/traefik/provider/ecs"
+	"github.com/traefik/traefik/provider/etcd"
+	"github.com/traefik/traefik/provider/eureka"
+	"github.com/traefik/traefik/provider/file"
+	"github.com/traefik/traefik/provider/kubernetes"
+	"github.com/traefik/traefik/provider/marathon"
+	"github.com/traefik/traefik/provider/mesos"
+	"github.com/traefik/traefik/provider/rancher"
+	"github.com/traefik/traefik/provider/rest"
+	"github.com/traefik/traefik/provider/zk"
+	"github.com/traefik/traefik/types"
 )
 
 // TraefikConfiguration holds GlobalConfiguration and other stuff

cmd/healthcheck/healthcheck.go

@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/configuration"
+	"github.com/traefik/traefik/cmd"
+	"github.com/traefik/traefik/configuration"
 )
 
 // NewCmd builds a new HealthCheck command

cmd/storeconfig/storeconfig.go

@@ -10,10 +10,10 @@ import (
 	"github.com/abronan/valkeyrie/store"
 	"github.com/containous/flaeg"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/log"
+	"github.com/traefik/traefik/acme"
+	"github.com/traefik/traefik/cluster"
+	"github.com/traefik/traefik/cmd"
+	"github.com/traefik/traefik/log"
 )
 
 // NewCmd builds a new StoreConfig command

cmd/traefik/traefik.go

@@ -14,29 +14,29 @@ import (
 	"github.com/cenk/backoff"
 	"github.com/containous/flaeg"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/autogen/genstatic"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/bug"
-	"github.com/containous/traefik/cmd/healthcheck"
-	"github.com/containous/traefik/cmd/storeconfig"
-	cmdVersion "github.com/containous/traefik/cmd/version"
-	"github.com/containous/traefik/collector"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/configuration/router"
-	"github.com/containous/traefik/job"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/server"
-	"github.com/containous/traefik/server/uuid"
-	traefiktls "github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/containous/traefik/version"
 	"github.com/coreos/go-systemd/daemon"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/ogier/pflag"
 	"github.com/sirupsen/logrus"
+	"github.com/traefik/traefik/autogen/genstatic"
+	"github.com/traefik/traefik/cmd"
+	"github.com/traefik/traefik/cmd/bug"
+	"github.com/traefik/traefik/cmd/healthcheck"
+	"github.com/traefik/traefik/cmd/storeconfig"
+	cmdVersion "github.com/traefik/traefik/cmd/version"
+	"github.com/traefik/traefik/collector"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/configuration/router"
+	"github.com/traefik/traefik/job"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/provider/ecs"
+	"github.com/traefik/traefik/provider/kubernetes"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/server"
+	"github.com/traefik/traefik/server/uuid"
+	traefiktls "github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
+	"github.com/traefik/traefik/version"
 	"github.com/vulcand/oxy/roundrobin"
 )
 
@@ -352,14 +352,14 @@ func stats(globalConfiguration *configuration.GlobalConfiguration) {
 Stats collection is enabled.
 Many thanks for contributing to Traefik's improvement by allowing us to receive anonymous information from your configuration.
 Help us improve Traefik by leaving this feature on :)
-More details on: https://docs.traefik.io/v1.7/basics/#collected-data
+More details on: https://doc.traefik.io/traefik/v1.7/basics/#collected-data
 `)
 		collect(globalConfiguration)
 	} else {
 		log.Info(`
 Stats collection is disabled.
 Help us improve Traefik by turning this feature on :)
-More details on: https://docs.traefik.io/v1.7/basics/#collected-data
+More details on: https://doc.traefik.io/traefik/v1.7/basics/#collected-data
 `)
 	}
 }

cmd/version/version.go

@@ -8,7 +8,7 @@ import (
 	"text/template"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/version"
+	"github.com/traefik/traefik/version"
 )
 
 var versionTemplate = `Version:      {{.Version}}

collector/collector.go

@@ -9,11 +9,11 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/version"
 	"github.com/mitchellh/hashstructure"
+	"github.com/traefik/traefik/anonymize"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/version"
 )
 
 // collectorURL URL where the stats are send

configuration/configuration.go

@@ -7,34 +7,34 @@ import (
 
 	"github.com/containous/flaeg"
 	servicefabric "github.com/containous/traefik-extra-service-fabric"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/datadog"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/ping"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/boltdb"
-	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
-	"github.com/containous/traefik/provider/docker"
-	"github.com/containous/traefik/provider/dynamodb"
-	"github.com/containous/traefik/provider/ecs"
-	"github.com/containous/traefik/provider/etcd"
-	"github.com/containous/traefik/provider/eureka"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/provider/kubernetes"
-	"github.com/containous/traefik/provider/marathon"
-	"github.com/containous/traefik/provider/mesos"
-	"github.com/containous/traefik/provider/rancher"
-	"github.com/containous/traefik/provider/rest"
-	"github.com/containous/traefik/provider/zk"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
 	"github.com/go-acme/lego/challenge/dns01"
 	"github.com/pkg/errors"
+	"github.com/traefik/traefik/acme"
+	"github.com/traefik/traefik/api"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/middlewares/tracing"
+	"github.com/traefik/traefik/middlewares/tracing/datadog"
+	"github.com/traefik/traefik/middlewares/tracing/jaeger"
+	"github.com/traefik/traefik/middlewares/tracing/zipkin"
+	"github.com/traefik/traefik/ping"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/provider/boltdb"
+	"github.com/traefik/traefik/provider/consul"
+	"github.com/traefik/traefik/provider/consulcatalog"
+	"github.com/traefik/traefik/provider/docker"
+	"github.com/traefik/traefik/provider/dynamodb"
+	"github.com/traefik/traefik/provider/ecs"
+	"github.com/traefik/traefik/provider/etcd"
+	"github.com/traefik/traefik/provider/eureka"
+	"github.com/traefik/traefik/provider/file"
+	"github.com/traefik/traefik/provider/kubernetes"
+	"github.com/traefik/traefik/provider/marathon"
+	"github.com/traefik/traefik/provider/mesos"
+	"github.com/traefik/traefik/provider/rancher"
+	"github.com/traefik/traefik/provider/rest"
+	"github.com/traefik/traefik/provider/zk"
+	"github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
 	jaegercli "github.com/uber/jaeger-client-go"
 )
 
@@ -212,12 +212,6 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 			}
 		}
 
-		// Thanks to SSLv3 being enabled by mistake in golang 1.12,
-		// If no minVersion is set, apply TLS1.0 as the minimum.
-		if entryPoint.TLS != nil && len(entryPoint.TLS.MinVersion) == 0 {
-			entryPoint.TLS.MinVersion = "VersionTLS10"
-		}
-
 		if entryPoint.TLS != nil && entryPoint.TLS.DefaultCertificate == nil && len(entryPoint.TLS.Certificates) > 0 {
 			log.Infof("No tls.defaultCertificate given for %s: using the first item in tls.certificates as a fallback.", entryPointName)
 			entryPoint.TLS.DefaultCertificate = &entryPoint.TLS.Certificates[0]

configuration/configuration_test.go

@@ -5,15 +5,15 @@ import (
 	"time"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
-	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/provider/file"
-	"github.com/containous/traefik/tls"
 	"github.com/stretchr/testify/assert"
+	"github.com/traefik/traefik/acme"
+	"github.com/traefik/traefik/middlewares/tracing"
+	"github.com/traefik/traefik/middlewares/tracing/jaeger"
+	"github.com/traefik/traefik/middlewares/tracing/zipkin"
+	"github.com/traefik/traefik/provider"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/provider/file"
+	"github.com/traefik/traefik/tls"
 )
 
 const defaultConfigFile = "traefik.toml"
@@ -312,9 +312,7 @@ func TestSetEffectiveConfigurationTLSMinVersion(t *testing.T) {
 			expected: EntryPoint{
 				Address:          ":443",
 				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				TLS: &tls.TLS{
-					MinVersion: "VersionTLS10",
-				},
+				TLS:              &tls.TLS{},
 			},
 		},
 	}

configuration/entrypoints.go

@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
 )
 
 // EntryPoint holds an entry point configuration of the reverse proxy (ip, port, TLS...)

configuration/entrypoints_test.go

@@ -3,10 +3,10 @@ package configuration
 import (
 	"testing"
 
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/traefik/traefik/tls"
+	"github.com/traefik/traefik/types"
 )
 
 func Test_parseEntryPointsConfiguration(t *testing.T) {

configuration/provider_aggregator.go

@@ -3,10 +3,10 @@ package configuration
 import (
 	"encoding/json"
 
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/provider"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/types"
 )
 
 // ProviderAggregator aggregate providers

configuration/router/internal_router.go

@@ -2,12 +2,12 @@ package router
 
 import (
 	"github.com/containous/mux"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/metrics"
-	"github.com/containous/traefik/middlewares"
-	mauth "github.com/containous/traefik/middlewares/auth"
-	"github.com/containous/traefik/types"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/metrics"
+	"github.com/traefik/traefik/middlewares"
+	mauth "github.com/traefik/traefik/middlewares/auth"
+	"github.com/traefik/traefik/types"
 	"github.com/urfave/negroni"
 )
 

configuration/router/internal_router_test.go

@@ -6,14 +6,14 @@ import (
 	"testing"
 
 	"github.com/containous/mux"
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/api"
-	"github.com/containous/traefik/configuration"
-	"github.com/containous/traefik/ping"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
+	"github.com/traefik/traefik/acme"
+	"github.com/traefik/traefik/api"
+	"github.com/traefik/traefik/configuration"
+	"github.com/traefik/traefik/ping"
+	acmeprovider "github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/safe"
+	"github.com/traefik/traefik/types"
 	"github.com/urfave/negroni"
 )
 

contrib/systemd/traefik.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Traefik
-Documentation=https://docs.traefik.io/v1.7
+Documentation=https://doc.traefik.io/traefik/v1.7
 #After=network-online.target
 #AssertFileIsExecutable=/usr/bin/traefik
 #AssertPathExists=/etc/traefik/traefik.toml

docs/CNAME

@@ -1 +0,0 @@
-docs.traefik.io

docs/basics.md

@@ -72,7 +72,7 @@ And here is another example with client certificate authentication:
 
 - We enable SSL on `https` by giving a certificate and a key.
 - One or several files containing Certificate Authorities in PEM format are added.
-- It is possible to have multiple CA:s in the same file or keep them in separate files.
+- It is possible to have multiple CA's in the same file or keep them in separate files.
 
 ### Frontends
 
@@ -452,6 +452,27 @@ If not, a new backend will be assigned.
     # Default: a sha1 (6 chars)
     #
     #  cookieName = "my_cookie"
+
+    # Customize secure option
+    #
+    # Optional
+    # Default: false
+    #
+    #  secure = true
+
+    # Customize http only option
+    #
+    # Optional
+    # Default: false
+    #
+    #  httpOnly = true
+
+    # Customize same site option.
+    # Can be: "none", "lax", "strict"
+    #
+    # Optional
+    #
+    #  sameSite = "none"
 ```
 
 The deprecated way:
@@ -631,7 +652,7 @@ docker run traefik[:version] --help
 
 ### Command: bug
 
-Here is the easiest way to submit a pre-filled issue on [Traefik GitHub](https://github.com/containous/traefik).
+Here is the easiest way to submit a pre-filled issue on [Traefik GitHub](https://github.com/traefik/traefik).
 
 ```bash
 traefik bug
@@ -660,7 +681,7 @@ OK: http://:8082/ping
 
 **This feature is disabled by default.**
 
-You can read the public proposal on this topic [here](https://github.com/containous/traefik/issues/2369).
+You can read the public proposal on this topic [here](https://github.com/traefik/traefik/issues/2369).
 
 ### Why ?
 
@@ -746,7 +767,7 @@ Once a day (the first call begins 10 minutes after the start of Traefik), we col
 
 ### Show me the code !
 
-If you want to dig into more details, here is the source code of the collecting system: [collector.go](https://github.com/containous/traefik/blob/v1.7/collector/collector.go)
+If you want to dig into more details, here is the source code of the collecting system: [collector.go](https://github.com/traefik/traefik/blob/v1.7/collector/collector.go)
 
 By default we anonymize all configuration fields, except fields tagged with `export=true`.
 

docs/benchmarks.md

@@ -15,7 +15,7 @@ I used 4 VMs for the tests with the following configuration:
 
 1. One VM used to launch the benchmarking tool [wrk](https://github.com/wg/wrk)
 2. One VM for Traefik (v1.0.0-beta.416) / nginx (v1.4.6)
-3. Two VMs for 2 backend servers in go [whoami](https://github.com/containous/whoami/)
+3. Two VMs for 2 backend servers in go [whoami](https://github.com/traefik/whoami/)
 
 Each VM has been tuned using the following limits:
 

docs/configuration/acme.md

@@ -313,7 +313,7 @@ For example, `CF_API_EMAIL_FILE=/run/secrets/traefik_cf-api-email` could be used
 | [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | Not tested yet                 |
 | [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | Not tested yet                 |
 | [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | Not tested yet                 |
-| manual                                                      | -              | none, but you need to run Traefik interactively, turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                      | YES                            |
+| manual                                                      | `manual`       | none, but you need to run Traefik interactively, turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                      | YES                            |
 | [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | YES                            |
 | [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | YES                            |
 | [Namesilo](https://www.namesilo.com/)                       | `namesilo`     | `NAMESILO_API_KEY`                                                                                                                          | YES                            |

docs/configuration/backends/consulcatalog.md

@@ -124,6 +124,9 @@ Additional settings can be defined using Consul Catalog tags.
 | `<prefix>.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm.                                                                                                                                                                          |
 | `<prefix>.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions.                                                                                                                                                                                              |
 | `<prefix>.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions.                                                                                                                                                                            |
+| `<prefix>.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                |
+| `<prefix>.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                             |
+| `<prefix>.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                   |
 | `<prefix>.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions. (DEPRECATED)                                                                                                                                                                                 |
 | `<prefix>.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
 | `<prefix>.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
@@ -224,7 +227,7 @@ If you need to support multiple frontends for a service, for example when having
 | `<prefix>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `<prefix>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `<prefix>.frontend.headers.SSLForceHost=true`             | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `<prefix>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `<prefix>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `<prefix>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `<prefix>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `<prefix>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/backends/docker.md

@@ -217,7 +217,7 @@ More information about Docker's security:
 
 !!! note "Improved Security"
 
-    [TraefikEE](https://containo.us/traefikee) solves this problem by separating the control plane (connected to Docker) and the data plane (handling the requests).
+    [Traefik Enterprise](https://traefik.io/traefik-enterprise/) solves this problem by separating the control plane (connected to Docker) and the data plane (handling the requests).
 
 Another possible workaround is to expose the Docker socket over TCP, instead of the default Unix socket file.
 It allows different implementation levels of the [AAA (Authentication, Authorization, Accounting) concepts](https://en.wikipedia.org/wiki/AAA_(computer_security)), depending on your security assessment:
@@ -236,7 +236,7 @@ It allows different implementation levels of the [AAA (Authentication, Authoriza
 
 Use the following ressources to get started:
 
-- [Traefik issue GH-4174 about security with Docker socket](https://github.com/containous/traefik/issues/4174)
+- [Traefik issue GH-4174 about security with Docker socket](https://github.com/traefik/traefik/issues/4174)
 - [Inspecting Docker Activity with Socat](https://developers.redhat.com/blog/2015/02/25/inspecting-docker-activity-with-socat/)
 - [Letting Traefik run on Worker Nodes](https://blog.mikesir87.io/2018/07/letting-traefik-run-on-worker-nodes/)
 - [Docker Socket Proxy from Tecnativa](https://github.com/Tecnativa/docker-socket-proxy)
@@ -313,6 +313,9 @@ Labels can be used on containers to override default behavior.
 | `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
 | `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                                  |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                   |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                      |
 | `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
 | `traefik.backend.loadbalancer.swarm=true`                               | Uses Swarm's inbuilt load balancer (only relevant under Swarm Mode) [3].                                                                                                                                                         |
 | `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
@@ -412,7 +415,7 @@ It also means that Traefik will manipulate only one backend, not one backend per
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `traefik.frontend.headers.SSLForceHost=true`             | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/backends/ecs.md

@@ -160,6 +160,9 @@ Labels can be used on task containers to override default behaviour:
 | `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
 | `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie manually  name for sticky sessions                                                                                                                                                                            |
+| `traefik.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                   |
 | `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
 | `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
 | `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |

docs/configuration/backends/file.md

@@ -31,6 +31,9 @@ Traefik can be configured with a file.
       method = "drr"
       [backends.backend1.loadBalancer.stickiness]
         cookieName = "foobar"
+        secure = true
+        httpOnly = true
+        sameSite = "foobar"
 
     [backends.backend1.maxConn]
       amount = 10

docs/configuration/backends/kubernetes.md

@@ -341,7 +341,7 @@ The following security annotations are applicable on the Ingress object:
 | `ingress.kubernetes.io/ssl-temporary-redirect: "true"`    | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `ingress.kubernetes.io/ssl-host: HOST`                    | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `ingress.kubernetes.io/ssl-force-host: "true"`            | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `ingress.kubernetes.io/ssl-proxy-headers: EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
+| `ingress.kubernetes.io/ssl-proxy-headers: EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
 
 ### Authentication
 

docs/configuration/backends/marathon.md

@@ -218,6 +218,9 @@ The following labels can be defined on Marathon applications. They adjust the be
 | `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
 | `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                   |
 | `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
 | `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
 | `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
@@ -303,7 +306,7 @@ The following labels can be defined on Marathon applications. They adjust the be
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `traefik.frontend.headers.SSLForceHost=true`             | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/backends/mesos.md

@@ -132,6 +132,9 @@ The following labels can be defined on Mesos tasks. They adjust the behavior for
 | `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
 | `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie manually name for sticky sessions                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                   |
 | `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
 | `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
 | `traefik.frontend.auth.basic=EXPR`                                      | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
@@ -215,7 +218,7 @@ The following labels can be defined on Mesos tasks. They adjust the behavior for
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `traefik.frontend.headers.SSLForceHost=true`             | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/backends/rancher.md

@@ -167,6 +167,9 @@ Labels can be used on task containers to override default behavior:
 | `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
 | `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                                  |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.secure=true`                   | Sets secure cookie option for sticky sessions.                                                                                                                                                                                   |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`                 | Sets http only cookie option for sticky sessions.                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`                 | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                                      |
 | `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
 | `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
 | `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                           |
@@ -250,7 +253,7 @@ Labels can be used on task containers to override default behavior:
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
 | `traefik.frontend.headers.SSLForceHost=true`             | If `SSLForceHost` is `true` and `SSLHost` is set, requests will be forced to use `SSLHost` even the ones that are already using SSL. Default is false.                                              |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/backends/servicefabric.md

@@ -112,6 +112,9 @@ Labels, set through extensions or the property manager, can be used on services
 | `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                        |
 | `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                            |
 | `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                          |
+| `traefik.backend.loadbalancer.stickiness.secure=true`      | Sets secure cookie option for sticky sessions.                                                                                                                                                                            |
+| `traefik.backend.loadbalancer.stickiness.httpOnly=true`    | Sets http only cookie option for sticky sessions                                                                                                                                                                          |
+| `traefik.backend.loadbalancer.stickiness.sameSite=none`    | Sets same site cookie option for sticky sessions. (`none`, `lax`, `strict`)                                                                                                                                               |
 | `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                               |
 | `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
 | `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                     |
@@ -145,7 +148,7 @@ Labels, set through extensions or the property manager, can be used on services
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-Proto:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |

docs/configuration/commons.md

@@ -249,8 +249,14 @@ Multiple sets of rates can be added to each frontend, but the time periods must
 ```
 
 In the above example, frontend1 is configured to limit requests by the client's ip address.  
-An average of 100 requests every 10 seconds is allowed and an average of 5 requests every 3 seconds.  
-These can "burst" up to 200 and 10 in each period respectively. 
+A sustained rate of 100 requests every 10 seconds (10 req/s) is allowed for rateset1, and 5 requests every 3 seconds (~1.67 req/s) for rateset2.  
+In addition, these can "burst" up to 200 and 10 in each period respectively.
+
+Another way to describe the above parameters, is to use the [leaky bucket](https://en.wikipedia.org/wiki/Leaky_bucket) analogy:
+for rateset1, the size of the bucket is 200 drops, and it is leaking at a rate of 10 drop/s.
+If the incoming rate of drops falling into the bucket gets high enough that the bucket gets filled,
+any subsequent drop overflows out of the bucket (i.e. the request is discarded).
+This situation holds until the incoming rate gets low enough again, and remains that way, for the water level in the bucket to go down.
 
 Valid values for `extractorfunc` are:
   * `client.ip`

docs/configuration/entrypoints.md

@@ -239,11 +239,14 @@ TLS Mutual Authentication can be `optional` or not.
 * If `optional = true`, if a certificate is provided, verifies if it is signed by a specified Certificate Authority (CA). Otherwise proceeds without any certificate.
 * If `optional = false`, Traefik will only accept clients that present a certificate signed by a specified Certificate Authority (CA).
 
+!!! warning
+    While the TLS [1.1](https://tools.ietf.org/html/rfc4346#section-7.4.6) and [1.2](https://tools.ietf.org/html/rfc5246#section-7.4.6) RFCs specify that clients should proceed with handshaking by sending an empty list should they have no certs for the CAs specified by the server, not all do so in practice.
+    Use this feature with caution should you require maximum compatibility with a wide variety of client user agents which may not strictly implement these specs.
+
 `ClientCAFiles` can be configured with multiple `CA:s` in the same file or use multiple files containing one or several `CA:s`.
 The `CA:s` has to be in PEM format.
 
-By default, `ClientCAFiles` is not optional, all clients will be required to present a valid cert.
-The requirement will apply to all server certs in the entrypoint.
+By default, `ClientCAFiles` is not optional, all clients will be required to present a valid cert. The requirement will apply to all server certs in the entrypoint.
 
 In the example below both `snitest.com` and `snitest.org` will require client certs
 
@@ -482,6 +485,13 @@ To enable IP white listing at the entry point level.
       # useXForwardedFor = true
 ```
 
+By setting the `useXForwardedFor` option, the `sourceRange` addresses will be matched against the request header `X-Forwarded-For` address list, from left to right.
+
+!!! danger
+    When using Traefik behind another load-balancer, its own internal address will be appended in the `X-Forwarded-For` header.
+    Be sure to carefully configure the `sourceRange` as adding the internal network CIDR,
+    or the load-balancer address directly, will cause all requests coming from it to pass through.
+
 ## ProxyProtocol
 
 To enable [ProxyProtocol](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) support.

docs/configuration/logs.md

@@ -356,7 +356,7 @@ version: '3'
 
 services:
   traefik:
-    image: containous/traefik:[latest stable version]
+    image: traefik/traefik:[latest stable version]
     ports:
       - "80:80"
     environment:

docs/index.md

@@ -4,9 +4,9 @@
 
 [![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
 [![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](/)
-[![Go Report Card](https://goreportcard.com/badge/github.com/containous/traefik)](https://goreportcard.com/report/github.com/containous/traefik)
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
-[![Join the community support forum at https://community.containo.us/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.containo.us/)
+[![Go Report Card](https://goreportcard.com/badge/github.com/traefik/traefik)](https://goreportcard.com/report/github.com/traefik/traefik)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/traefik/traefik/blob/master/LICENSE.md)
+[![Join the community support forum at https://community.traefik.io/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.traefik.io/)
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
 
@@ -66,7 +66,7 @@ _(But if you'd rather configure some of your routes manually, Traefik supports t
 
 In this quickstart, we'll use [Docker compose](https://docs.docker.com/compose) to create our demo infrastructure.
 
-To save some time, you can clone [Traefik's repository](https://github.com/containous/traefik) and use the quickstart files located in the [examples/quickstart](https://github.com/containous/traefik/tree/v1.7/examples/quickstart/) directory.
+To save some time, you can clone [Traefik's repository](https://github.com/traefik/traefik) and use the quickstart files located in the [examples/quickstart](https://github.com/traefik/traefik/tree/v1.7/examples/quickstart/) directory.
 
 ### 1 — Launch Traefik — Tell It to Listen to Docker
 
@@ -109,7 +109,7 @@ Edit your `docker-compose.yml` file and add the following at the end of your fil
 ```yaml
 # ...
   whoami:
-    image: containous/whoami # A container that exposes an API to show its IP address
+    image: traefik/whoami # A container that exposes an API to show its IP address
     labels:
       - "traefik.frontend.rule=Host:whoami.docker.localhost"
 ```
@@ -190,7 +190,7 @@ You will learn fundamental Traefik features and see some demos with Kubernetes.
 
 ### The Official Binary File
 
-You can grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page and just run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/v1.7/traefik.sample.toml):
+You can grab the latest binary from the [releases](https://github.com/traefik/traefik/releases) page and just run it with the [sample configuration file](https://raw.githubusercontent.com/traefik/traefik/v1.7/traefik.sample.toml):
 
 ```shell
 ./traefik -c traefik.toml

docs/theme/partials/integrations/analytics.html

@@ -0,0 +1,7 @@
+<!-- Google Tag Manager -->
+<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+      new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+    j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+    'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+  })(window,document,'script','dataLayer','GTM-NMWC63S');</script>
+<!-- End Google Tag Manager -->

docs/user-guide/cluster-docker-consul.md

@@ -9,7 +9,7 @@ If you want to use Let's Encrypt with Traefik, sharing configuration or TLS cert
 Ok, could we mount a shared volume used by all my instances? Yes, you can, but it will not work.
 When you use Let's Encrypt, you need to store certificates, but not only.
 When Traefik generates a new certificate, it configures a challenge and once Let's Encrypt will verify the ownership of the domain, it will ping back the challenge.
-If the challenge is not known by other Traefik instances, the validation will fail.
+If the challenge is not recognized by other Traefik instances, the validation will fail.
 
 For more information about the challenge: [Automatic Certificate Management Environment (ACME)](https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#http-challenge)
 

docs/user-guide/docker-and-lets-encrypt.md

@@ -235,13 +235,11 @@ Let's take a look at the labels themselves for the `app` service, which is a HTT
 - "traefik.admin.port=9443"
 ```
 
-We use both `container labels` and `service labels`.
+We use both `container labels` and `segment labels`.
 
 #### Container labels
 
-First, we specify the `backend` name which corresponds to the actual service we're routing **to**.
-
-We also tell Traefik to use the `web` network to route HTTP traffic to this container.
+We tell Traefik to use the `web` network to route HTTP traffic to this container.
 With the `traefik.enable` label, we tell Traefik to include this container in its internal configuration.
 
 With the `frontend.rule` label, we tell Traefik that we want to route to this container if the incoming HTTP request contains the `Host` `app.my-awesome-app.org`.
@@ -249,20 +247,20 @@ Essentially, this is the actual rule used for Layer-7 load balancing.
 
 Finally but not unimportantly, we tell Traefik to route **to** port `9000`, since that is the actual TCP/IP port the container actually listens on.
 
-### Service labels
+#### Segment labels
 
-`Service labels` allow managing many routes for the same container.
+`Segment labels` allow managing many routes for the same container.
 
-When both `container labels` and `service labels` are defined, `container labels` are just used as default values for missing `service labels` but no frontend/backend are going to be defined only with these labels.
-Obviously, labels `traefik.frontend.rule` and `traefik.port` described above, will only be used to complete information set in `service labels` during the container frontends/backends creation.
+When both `container labels` and `segment labels` are defined, `container labels` are just used as default values for missing `segment labels` but no frontend/backend are going to be defined only with these labels.
+Obviously, labels `traefik.frontend.rule` and `traefik.port` described above, will only be used to complete information set in `segment labels` during the container frontends/backends creation.
 
-In the example, two service names are defined : `basic` and `admin`.
+In the example, two segment names are defined : `basic` and `admin`.
 They allow creating two frontends and two backends.
 
-- `basic` has only one `service label` : `traefik.basic.protocol`.
+- `basic` has only one `segment label` : `traefik.basic.protocol`.
 Traefik will use values set in `traefik.frontend.rule` and `traefik.port` to create the `basic` frontend and backend.
 The frontend listens to incoming HTTP requests which contain the `Host` `app.my-awesome-app.org` and redirect them in `HTTP` to the port `9000` of the backend.
-- `admin` has all the `services labels` needed to create the `admin` frontend and backend (`traefik.admin.frontend.rule`, `traefik.admin.protocol`, `traefik.admin.port`).
+- `admin` has all the `segment labels` needed to create the `admin` frontend and backend (`traefik.admin.frontend.rule`, `traefik.admin.protocol`, `traefik.admin.port`).
 Traefik will create a frontend to listen to incoming HTTP requests which contain the `Host` `admin-app.my-awesome-app.org` and redirect them in `HTTPS` to the port `9443` of the backend.
 
 #### Gotchas and tips

docs/user-guide/examples.md

@@ -371,7 +371,7 @@ home:
 
 Something more tricky using `regex`.
 
-In this case a slash is added to `siteexample.io/portainer` and redirect to `siteexample.io/portainer/`. For more details: https://github.com/containous/traefik/issues/563
+In this case a slash is added to `siteexample.io/portainer` and redirect to `siteexample.io/portainer/`. For more details: https://github.com/traefik/traefik/issues/563
 
 The double sign `$$` are variables managed by the docker compose file ([documentation](https://docs.docker.com/compose/compose-file/#variable-substitution)). 
 
@@ -408,7 +408,7 @@ portainer:
       - "traefik.frontend.entryPoints=http"
       - "traefik.backend.loadbalancer.swarm=true"
       - "traefik.backend.loadbalancer.method=drr"
-      # https://github.com/containous/traefik/issues/563#issuecomment-421360934
+      # https://github.com/traefik/traefik/issues/563#issuecomment-421360934
       - "traefik.frontend.redirect.regex=^(.*)/portainer$$"
       - "traefik.frontend.redirect.replacement=$$1/portainer/"
       - "traefik.frontend.rule=PathPrefix:/portainer;ReplacePathRegex: ^/portainer/(.*) /$$1"

docs/user-guide/kubernetes.md

@@ -4,16 +4,20 @@ This guide explains how to use Traefik as an Ingress controller for a Kubernetes
 
 If you are not familiar with Ingresses in Kubernetes you might want to read the [Kubernetes user guide](https://kubernetes.io/docs/concepts/services-networking/ingress/)
 
-The config files used in this guide can be found in the [examples directory](https://github.com/containous/traefik/tree/v1.7/examples/k8s)
+The config files used in this guide can be found in the [examples directory](https://github.com/traefik/traefik/tree/v1.7/examples/k8s)
 
 ## Prerequisites
 
 1. A working Kubernetes cluster. If you want to follow along with this guide, you should setup [minikube](https://kubernetes.io/docs/getting-started-guides/minikube/) on your machine, as it is the quickest way to get a local Kubernetes cluster setup for experimentation and development.
 
+2. Setup ingress as an add-on. It can be enabled by the following command:
+
+    `minikube addons enable ingress`
+
 !!! note
     The guide is likely not fully adequate for a production-ready setup.
 
-2. The `kubectl` binary should be [installed on your workstation](https://kubernetes.io/docs/getting-started-guides/minikube/#download-kubectl).
+3. The `kubectl` binary should be [installed on your workstation](https://kubernetes.io/docs/getting-started-guides/minikube/#download-kubectl).
 
 ### Role Based Access Control configuration (Kubernetes 1.6+ only)
 
@@ -53,6 +57,12 @@ rules:
       - get
       - list
       - watch
+  - apiGroups:
+    - extensions
+    resources:
+    - ingresses/status
+    verbs:
+    - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -68,10 +78,10 @@ subjects:
   namespace: kube-system
 ```
 
-[examples/k8s/traefik-rbac.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/traefik-rbac.yaml)
+[examples/k8s/traefik-rbac.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/traefik-rbac.yaml)
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/traefik-rbac.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/traefik-rbac.yaml
 ```
 
 For namespaced restrictions, one RoleBinding is required per watched namespace along with a corresponding configuration of Traefik's `kubernetes.namespaces` parameter.
@@ -98,7 +108,7 @@ metadata:
   namespace: kube-system
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: traefik-ingress-controller
   namespace: kube-system
@@ -148,7 +158,7 @@ spec:
   type: NodePort
 ```
 
-[examples/k8s/traefik-deployment.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/traefik-deployment.yaml)
+[examples/k8s/traefik-deployment.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/traefik-deployment.yaml)
 
 !!! note
     The Service will expose two NodePorts which allow access to the ingress and the web interface.
@@ -164,13 +174,17 @@ metadata:
   namespace: kube-system
 ---
 kind: DaemonSet
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: traefik-ingress-controller
   namespace: kube-system
   labels:
     k8s-app: traefik-ingress-lb
 spec:
+  selector:
+    matchLabels:
+      k8s-app: traefik-ingress-lb
+      name: traefik-ingress-lb
   template:
     metadata:
       labels:
@@ -188,6 +202,7 @@ spec:
           hostPort: 80
         - name: admin
           containerPort: 8080
+          hostPort: 8080
         securityContext:
           capabilities:
             drop:
@@ -216,7 +231,7 @@ spec:
       name: admin
 ```
 
-[examples/k8s/traefik-ds.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/traefik-ds.yaml)
+[examples/k8s/traefik-ds.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/traefik-ds.yaml)
 
 !!! note
     This will create a Daemonset that uses privileged ports 80/8080 on the host. This may not work on all providers, but illustrates the static (non-NodePort) hostPort binding. The `traefik-ingress-service` can still be used inside the cluster to access the DaemonSet pods.
@@ -224,11 +239,11 @@ spec:
 To deploy Traefik to your cluster start by submitting one of the YAML files to the cluster with `kubectl`:
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/traefik-deployment.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/traefik-deployment.yaml
 ```
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/traefik-ds.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/traefik-ds.yaml
 ```
 
 There are some significant differences between using Deployments and DaemonSets:
@@ -320,7 +335,7 @@ For more information, check out [the documentation](https://github.com/kubernete
 
 ## Submitting an Ingress to the Cluster
 
-Lets start by creating a Service and an Ingress that will expose the [Traefik Web UI](https://github.com/containous/traefik#web-ui).
+Lets start by creating a Service and an Ingress that will expose the [Traefik Web UI](https://github.com/traefik/traefik#web-ui).
 
 ```yaml
 apiVersion: v1
@@ -352,13 +367,13 @@ spec:
           servicePort: web
 ```
 
-[examples/k8s/ui.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/ui.yaml)
+[examples/k8s/ui.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/ui.yaml)
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/ui.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/ui.yaml
 ```
 
-Now lets setup an entry in our `/etc/hosts` file to route `traefik-ui.minikube` to our cluster.
+Now let's setup an entry in our `/etc/hosts` file to route `traefik-ui.minikube` to our cluster.
 
 In production you would want to set up real DNS entries.
 You can get the IP address of your minikube instance by running `minikube ip`:
@@ -382,6 +397,23 @@ You can add a TLS entrypoint by adding the following `args` to the container spe
  --entrypoints=Name:https Address::443 TLS
  --entrypoints=Name:http Address::80
 ```
+
+Now let's add the TLS port either to the deployment: 
+
+```
+ports:
+- name: https
+  containerPort: 443
+```
+
+or to the daemon set:
+
+```
+ports:
+- name: https
+  containerPort: 443
+  hostPort: 443
+```
     
 To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource.
 
@@ -503,7 +535,7 @@ First lets start by launching the pods for the cheese websites.
 ```yaml
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: stilton
   labels:
@@ -529,7 +561,7 @@ spec:
         - containerPort: 80
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: cheddar
   labels:
@@ -555,7 +587,7 @@ spec:
         - containerPort: 80
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: wensleydale
   labels:
@@ -581,10 +613,10 @@ spec:
         - containerPort: 80
 ```
 
-[examples/k8s/cheese-deployments.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/cheese-deployments.yaml)
+[examples/k8s/cheese-deployments.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/cheese-deployments.yaml)
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/cheese-deployments.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/cheese-deployments.yaml
 ```
 
 Next we need to setup a Service for each of the cheese pods.
@@ -636,10 +668,10 @@ spec:
 !!! note
     We also set a [circuit breaker expression](/basics/#backends) for one of the backends by setting the `traefik.backend.circuitbreaker` annotation on the service.
 
-[examples/k8s/cheese-services.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/cheese-services.yaml)
+[examples/k8s/cheese-services.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/cheese-services.yaml)
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/cheese-services.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/cheese-services.yaml
 ```
 
 Now we can submit an ingress for the cheese websites.
@@ -676,13 +708,13 @@ spec:
           servicePort: http
 ```
 
-[examples/k8s/cheese-ingress.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/cheese-ingress.yaml)
+[examples/k8s/cheese-ingress.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/cheese-ingress.yaml)
 
 !!! note
     We list each hostname, and add a backend service.
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/cheese-ingress.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/cheese-ingress.yaml
 ```
 
 Now visit the [Traefik dashboard](http://traefik-ui.minikube/) and you should see a frontend for each host.
@@ -731,13 +763,13 @@ spec:
           servicePort: http
 ```
 
-[examples/k8s/cheeses-ingress.yaml](https://github.com/containous/traefik/tree/v1.7/examples/k8s/cheeses-ingress.yaml)
+[examples/k8s/cheeses-ingress.yaml](https://github.com/traefik/traefik/tree/v1.7/examples/k8s/cheeses-ingress.yaml)
 
 !!! note
     We are configuring Traefik to strip the prefix from the url path with the `traefik.frontend.rule.type` annotation so that we can use the containers from the previous example without modification.
 
 ```shell
-kubectl apply -f https://raw.githubusercontent.com/containous/traefik/v1.7/examples/k8s/cheeses-ingress.yaml
+kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v1.7/examples/k8s/cheeses-ingress.yaml
 ```
 
 ```shell

docs/user-guide/kv-config.md

@@ -24,7 +24,7 @@ The Traefik global configuration will be retrieved from a [Consul](https://consu
 
 First we have to launch Consul in a container.
 
-The [docker-compose file](https://docs.docker.com/compose/compose-file/) allows us to launch Consul and four instances of the trivial app [containous/whoami](https://github.com/containous/whoami) :
+The [docker-compose file](https://docs.docker.com/compose/compose-file/) allows us to launch Consul and four instances of the trivial app [traefik/whoami](https://github.com/traefik/whoami) :
 
 ```yaml
 consul:
@@ -42,16 +42,16 @@ consul:
     - "8302/udp"
 
 whoami1:
-  image: containous/whoami
+  image: traefik/whoami
 
 whoami2:
-  image: containous/whoami
+  image: traefik/whoami
 
 whoami3:
-  image: containous/whoami
+  image: traefik/whoami
 
 whoami4:
-  image: containous/whoami
+  image: traefik/whoami
 ```
 
 ### Upload the configuration in the Key-value store

docs/user-guide/marathon.md

@@ -129,7 +129,7 @@ As such, there is no way to handle this situation deterministically.
 
 Finally, Marathon health checks are not mandatory (the default is to use the task state as reported by Mesos), so requiring them for Traefik would raise the entry barrier for Marathon users.
 
-Traefik used to use the health check results as a strict requirement but moved away from it as [users reported the dramatic consequences](https://github.com/containous/traefik/issues/653).
+Traefik used to use the health check results as a strict requirement but moved away from it as [users reported the dramatic consequences](https://github.com/traefik/traefik/issues/653).
 
 #### Draining
 
@@ -141,4 +141,4 @@ However, implementing this fully within Traefik seems like a non-trivial underta
 
 Additionally, the approach is less flexible compared to a custom termination handler since only the latter allows for the implementation of custom termination sequences that go beyond simple request draining (e.g., persisting a snapshot state to disk prior to terminating).
 
-The feature is currently not implemented; a request for draining in general is at [issue 41](https://github.com/containous/traefik/issues/41).
+The feature is currently not implemented; a request for draining in general is at [issue 41](https://github.com/traefik/traefik/issues/41).

docs/user-guide/swarm-mode.md

@@ -107,7 +107,7 @@ Let's explain this command:
 
 ## Deploy your apps
 
-We can now deploy our app on the cluster, here [whoami](https://github.com/containous/whoami), a simple web server in Go.
+We can now deploy our app on the cluster, here [whoami](https://github.com/traefik/whoami), a simple web server in Go.
 We start 2 services, on the `traefik-net` network.
 
 ```shell
@@ -115,14 +115,14 @@ docker-machine ssh manager "docker service create \
 	--name whoami0 \
 	--label traefik.port=80 \
 	--network traefik-net \
-	containous/whoami"
+	traefik/whoami"
 
 docker-machine ssh manager "docker service create \
 	--name whoami1 \
 	--label traefik.port=80 \
 	--network traefik-net \
 	--label traefik.backend.loadbalancer.sticky=true \
-	containous/whoami"
+	traefik/whoami"
 ```
 
 !!! note
@@ -130,7 +130,7 @@ docker-machine ssh manager "docker service create \
     We'll demonstrate that later.
 
 !!! note
-    If using `docker stack deploy`, there is [a specific way that the labels must be defined in the docker-compose file](https://github.com/containous/traefik/issues/994#issuecomment-269095109).
+    If using `docker stack deploy`, there is [a specific way that the labels must be defined in the docker-compose file](https://github.com/traefik/traefik/issues/994#issuecomment-269095109).
 
 Check that everything is scheduled and started:
 
@@ -140,8 +140,8 @@ docker-machine ssh manager "docker service ls"
 ```
 ID            NAME     MODE        REPLICAS  IMAGE                     PORTS
 moq3dq4xqv6t  traefik  replicated  1/1       traefik:latest            *:80->80/tcp,*:8080->8080/tcp
-ysil6oto1wim  whoami0  replicated  1/1       containous/whoami:latest
-z9re2mnl34k4  whoami1  replicated  1/1       containous/whoami:latest
+ysil6oto1wim  whoami0  replicated  1/1       traefik/whoami:latest
+z9re2mnl34k4  whoami1  replicated  1/1       traefik/whoami:latest
 ```
 
 
@@ -243,8 +243,8 @@ docker-machine ssh manager "docker service ls"
 ```
 ID            NAME     MODE        REPLICAS  IMAGE                     PORTS
 moq3dq4xqv6t  traefik  replicated  1/1       traefik:latest            *:80->80/tcp,*:8080->8080/tcp
-ysil6oto1wim  whoami0  replicated  5/5       containous/whoami:latest
-z9re2mnl34k4  whoami1  replicated  5/5       containous/whoami:latest
+ysil6oto1wim  whoami0  replicated  5/5       traefik/whoami:latest
+z9re2mnl34k4  whoami1  replicated  5/5       traefik/whoami:latest
 ```
 
 ## Access to your `whoami0` through Traefik multiple times.

docs/user-guide/swarm.md

@@ -112,12 +112,12 @@ Let's explain this command:
 
 ## Deploy your apps
 
-We can now deploy our app on the cluster, here [whoami](https://github.com/containous/whoami), a simple web server in GO, on the network `my-net`:
+We can now deploy our app on the cluster, here [whoami](https://github.com/traefik/whoami), a simple web server in GO, on the network `my-net`:
 
 ```shell
 eval $(docker-machine env --swarm mhs-demo0)
-docker run -d --name=whoami0 --net=my-net --env="constraint:node==mhs-demo0" containous/whoami
-docker run -d --name=whoami1 --net=my-net --env="constraint:node==mhs-demo1" containous/whoami
+docker run -d --name=whoami0 --net=my-net --env="constraint:node==mhs-demo0" traefik/whoami
+docker run -d --name=whoami1 --net=my-net --env="constraint:node==mhs-demo1" traefik/whoami
 ```
 
 Check that everything is started:
@@ -127,8 +127,8 @@ docker ps
 ```
 ```
 CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                                      NAMES
-ba2c21488299        containous/whoami   "/whoamI"                8 seconds ago       Up 9 seconds        80/tcp                                                     mhs-demo1/whoami1
-8147a7746e7a        containous/whoami   "/whoamI"                19 seconds ago      Up 20 seconds       80/tcp                                                     mhs-demo0/whoami0
+ba2c21488299        traefik/whoami   "/whoamI"                8 seconds ago       Up 9 seconds        80/tcp                                                     mhs-demo1/whoami1
+8147a7746e7a        traefik/whoami   "/whoamI"                19 seconds ago      Up 20 seconds       80/tcp                                                     mhs-demo0/whoami0
 8fbc39271b4c        traefik             "/traefik -l DEBUG -c"   36 seconds ago      Up 37 seconds       192.168.99.101:80->80/tcp, 192.168.99.101:8080->8080/tcp   mhs-demo0/serene_bhabha
 ```
 

examples/acme/docker-compose.yml

@@ -72,7 +72,7 @@ services :
   traefik:
     build:
       context: ../..
-    image: containous/traefik:latest
+    image: traefik/traefik:latest
     command: --configFile=/etc/traefik/conf/acme.toml
     restart: unless-stopped
     extra_hosts:

examples/cluster/docker-compose.yml

@@ -119,7 +119,7 @@ services:
   storeconfig:
     build:
       context: ../..
-    image: containous/traefik
+    image: traefik/traefik
     volumes:
       - "./traefik.toml:/traefik.toml:ro"
     command: storeconfig --debug
@@ -129,7 +129,7 @@ services:
   traefik01:
     build:
       context: ../..
-    image: containous/traefik
+    image: traefik/traefik
     command: ${TRAEFIK_CMD}
     extra_hosts:
       - traefik.boulder.com:172.17.0.1
@@ -152,7 +152,7 @@ services:
   traefik02:
     build:
       context: ../..
-    image: containous/traefik
+    image: traefik/traefik
     command: ${TRAEFIK_CMD}
     extra_hosts:
       - traefik.boulder.com:172.17.0.1

examples/k8s/cheese-deployments.yaml

@@ -1,6 +1,6 @@
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: stilton
   labels:
@@ -33,7 +33,7 @@ spec:
         - containerPort: 80
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: cheddar
   labels:
@@ -66,7 +66,7 @@ spec:
         - containerPort: 80
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: wensleydale
   labels:

examples/k8s/traefik-deployment.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: kube-system
 ---
 kind: Deployment
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: traefik-ingress-controller
   namespace: kube-system

examples/k8s/traefik-ds.yaml

@@ -6,13 +6,17 @@ metadata:
   namespace: kube-system
 ---
 kind: DaemonSet
-apiVersion: extensions/v1beta1
+apiVersion: apps/v1
 metadata:
   name: traefik-ingress-controller
   namespace: kube-system
   labels:
     k8s-app: traefik-ingress-lb
 spec:
+  selector:
+    matchLabels:
+      k8s-app: traefik-ingress-lb
+      name: traefik-ingress-lb
   template:
     metadata:
       labels:

examples/quickstart/README.md

@@ -2,7 +2,7 @@
 
 In this quickstart, we'll use [Docker compose](https://docs.docker.com/compose) to create our demo infrastructure.
 
-To save some time, you can clone [Traefik's repository](https://github.com/containous/traefik) and use the quickstart files located in the [examples/quickstart](https://github.com/containous/traefik/tree/v1.7/examples/quickstart/) directory.
+To save some time, you can clone [Traefik's repository](https://github.com/traefik/traefik) and use the quickstart files located in the [examples/quickstart](https://github.com/traefik/traefik/tree/v1.7/examples/quickstart/) directory.
 
 ### 1 — Launch Traefik — Tell It to Listen to Docker
 
@@ -101,7 +101,7 @@ IP: 172.27.0.4
 
 ### 4 — Enjoy Traefik's Magic
 
-Now that you have a basic understanding of how Traefik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](https://docs.traefik.io/v1.7/) and let Traefik work for you!
-Whatever your infrastructure is, there is probably [an available Traefik backend](https://docs.traefik.io/v1.7/#supported-backends) that will do the job.
+Now that you have a basic understanding of how Traefik can automatically create the routes to your services and load balance them, it might be time to dive into [the documentation](https://doc.traefik.io/traefik/v1.7/) and let Traefik work for you!
+Whatever your infrastructure is, there is probably [an available Traefik backend](https://doc.traefik.io/traefik/v1.7/#supported-backends) that will do the job.
 
-Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Traefik's let's encrypt integration](https://docs.traefik.io/v1.7/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](https://docs.traefik.io/v1.7/user-guide/docker-and-lets-encrypt/).
+Our recommendation would be to see for yourself how simple it is to enable HTTPS with [Traefik's let's encrypt integration](https://doc.traefik.io/traefik/v1.7/user-guide/examples/#lets-encrypt-support) using the dedicated [user guide](https://doc.traefik.io/traefik/v1.7/user-guide/docker-and-lets-encrypt/).

exp.Dockerfile

@@ -12,7 +12,7 @@ RUN yarn install
 RUN npm run build
 
 # BUILD
-FROM golang:1.12-alpine as gobuild
+FROM golang:1.14-alpine as gobuild
 
 RUN apk --update upgrade \
     && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
@@ -23,11 +23,11 @@ RUN mkdir -p /usr/local/bin \
     && curl -fsSL -o /usr/local/bin/go-bindata https://github.com/containous/go-bindata/releases/download/v1.0.0/go-bindata \
     && chmod +x /usr/local/bin/go-bindata
 
-WORKDIR /go/src/github.com/containous/traefik
-COPY . /go/src/github.com/containous/traefik
+WORKDIR /go/src/github.com/traefik/traefik
+COPY . /go/src/github.com/traefik/traefik
 
-RUN rm -rf /go/src/github.com/containous/traefik/static/
-COPY --from=webui /src/static/ /go/src/github.com/containous/traefik/static/
+RUN rm -rf /go/src/github.com/traefik/traefik/static/
+COPY --from=webui /src/static/ /go/src/github.com/traefik/traefik/static/
 
 RUN ./script/make.sh generate binary
 
@@ -36,7 +36,7 @@ FROM scratch
 
 COPY --from=gobuild /usr/share/zoneinfo /usr/share/zoneinfo
 COPY --from=gobuild /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=gobuild /go/src/github.com/containous/traefik/dist/traefik /
+COPY --from=gobuild /go/src/github.com/traefik/traefik/dist/traefik /
 
 EXPOSE 80
 VOLUME ["/tmp"]

h2c/h2c.go

@@ -22,7 +22,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/containous/traefik/log"
+	"github.com/traefik/traefik/log"
 
 	"golang.org/x/net/http/httpguts"
 	"golang.org/x/net/http2"
@@ -57,20 +57,20 @@ func (s Server) Serve(l net.Listener) error {
 			if http2VerboseLogs {
 				log.Debugf("Attempting h2c with prior knowledge.")
 			}
-			conn, err := initH2CWithPriorKnowledge(w)
+			conn, err := initH2CWithPriorKnowledge(w, s.closeHijackedConnQuietly)
 			if err != nil {
 				if http2VerboseLogs {
 					log.Debugf("Error h2c with prior knowledge: %v", err)
 				}
 				return
 			}
-			defer conn.Close()
+			defer s.closeHijackedConnQuietly(conn)
 			h2cSrv := &http2.Server{}
 			h2cSrv.ServeConn(conn, &http2.ServeConnOpts{Handler: originalHandler})
 			return
 		}
-		if conn, err := h2cUpgrade(w, r); err == nil {
-			defer conn.Close()
+		if conn, err := h2cUpgrade(w, r, s.closeHijackedConnQuietly); err == nil {
+			defer s.closeHijackedConnQuietly(conn)
 			h2cSrv := &http2.Server{}
 			h2cSrv.ServeConn(conn, &http2.ServeConnOpts{Handler: originalHandler})
 			return
@@ -80,12 +80,24 @@ func (s Server) Serve(l net.Listener) error {
 	return s.Server.Serve(l)
 }
 
+func (s Server) closeHijackedConnQuietly(conn net.Conn) {
+	connStateKey := conn
+	if rwConn, ok := conn.(*rwConn); ok {
+		connStateKey = rwConn.Conn
+	}
+
+	s.ConnState(connStateKey, http.StateClosed)
+	if err := conn.Close(); err != nil {
+		log.Debugf("Error closing hijacked connection: %v", err)
+	}
+}
+
 // initH2CWithPriorKnowledge implements creating a h2c connection with prior
 // knowledge (Section 3.4) and creates a net.Conn suitable for http2.ServeConn.
 // All we have to do is look for the client preface that is suppose to be part
 // of the body, and reforward the client preface on the net.Conn this function
 // creates.
-func initH2CWithPriorKnowledge(w http.ResponseWriter) (net.Conn, error) {
+func initH2CWithPriorKnowledge(w http.ResponseWriter, onFailureAfterHijack func(conn net.Conn)) (net.Conn, error) {
 	hijacker, ok := w.(http.Hijacker)
 	if !ok {
 		return nil, errors.New("hijack not supported")
@@ -100,6 +112,7 @@ func initH2CWithPriorKnowledge(w http.ResponseWriter) (net.Conn, error) {
 	buf := make([]byte, len(expectedBody))
 	n, err := io.ReadFull(rw, buf)
 	if err != nil {
+		onFailureAfterHijack(conn)
 		return nil, fmt.Errorf("fail to read body: %v", err)
 	}
 
@@ -112,7 +125,7 @@ func initH2CWithPriorKnowledge(w http.ResponseWriter) (net.Conn, error) {
 		return c, nil
 	}
 
-	conn.Close()
+	onFailureAfterHijack(conn)
 	if http2VerboseLogs {
 		log.Printf(
 			"Missing the request body portion of the client preface. Wanted: %v Got: %v",
@@ -139,7 +152,7 @@ func drainClientPreface(r io.Reader) error {
 }
 
 // h2cUpgrade establishes a h2c connection using the HTTP/1 upgrade (Section 3.2).
-func h2cUpgrade(w http.ResponseWriter, r *http.Request) (net.Conn, error) {
+func h2cUpgrade(w http.ResponseWriter, r *http.Request, onFailureAfterHijack func(conn net.Conn)) (net.Conn, error) {
 	if !isH2CUpgrade(r.Header) {
 		return nil, errors.New("non-conforming h2c headers")
 	}
@@ -167,6 +180,7 @@ func h2cUpgrade(w http.ResponseWriter, r *http.Request) (net.Conn, error) {
 	// A conforming client will now send an H2 client preface which need to drain
 	// since we already sent this.
 	if err := drainClientPreface(rw); err != nil {
+		onFailureAfterHijack(conn)
 		return nil, err
 	}
 

healthcheck/healthcheck.go

@@ -10,9 +10,9 @@ import (
 	"sync"
 	"time"
 
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/safe"
 	"github.com/go-kit/kit/metrics"
+	"github.com/traefik/traefik/log"
+	"github.com/traefik/traefik/safe"
 	"github.com/vulcand/oxy/roundrobin"
 )
 

healthcheck/healthcheck_test.go

@@ -9,9 +9,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/containous/traefik/testhelpers"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"github.com/traefik/traefik/testhelpers"
 	"github.com/vulcand/oxy/roundrobin"
 )
 

hostresolver/hostresolver.go

@@ -7,9 +7,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containous/traefik/log"
 	"github.com/miekg/dns"
 	"github.com/patrickmn/go-cache"
+	"github.com/traefik/traefik/log"
 )
 
 type cnameResolv struct {

integration/access_log_test.go

@@ -11,9 +11,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/middlewares/accesslog"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/middlewares/accesslog"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/acme_test.go

@@ -10,12 +10,12 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/testhelpers"
-	"github.com/containous/traefik/types"
 	"github.com/go-check/check"
 	"github.com/miekg/dns"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/provider/acme"
+	"github.com/traefik/traefik/testhelpers"
+	"github.com/traefik/traefik/types"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/basic_test.go

@@ -8,8 +8,8 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/constraint_test.go

@@ -5,9 +5,9 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
 	"github.com/hashicorp/consul/api"
+	"github.com/traefik/traefik/integration/try"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/consul_catalog_test.go

@@ -6,10 +6,10 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/provider/label"
 	"github.com/go-check/check"
 	"github.com/hashicorp/consul/api"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/provider/label"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/consul_test.go

@@ -14,10 +14,10 @@ import (
 	"github.com/abronan/valkeyrie/store"
 	"github.com/abronan/valkeyrie/store/consul"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/types"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/cluster"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/types"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/docker_compose_test.go

@@ -7,10 +7,10 @@ import (
 	"os"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/testhelpers"
-	"github.com/containous/traefik/types"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/testhelpers"
+	"github.com/traefik/traefik/types"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/docker_test.go

@@ -9,12 +9,12 @@ import (
 	"strings"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/provider/label"
 	"github.com/docker/docker/pkg/namesgenerator"
 	"github.com/go-check/check"
 	d "github.com/libkermit/docker"
 	"github.com/libkermit/docker-check"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/provider/label"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/dynamodb_test.go

@@ -10,9 +10,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
-	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/types"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
+	"github.com/traefik/traefik/types"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/error_pages_test.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/etcd3_test.go

@@ -11,8 +11,8 @@ import (
 	"github.com/abronan/valkeyrie"
 	"github.com/abronan/valkeyrie/store"
 	etcdv3 "github.com/abronan/valkeyrie/store/etcd/v3"
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 
 	checker "github.com/vdemeester/shakers"
 )

integration/etcd_test.go

@@ -11,8 +11,8 @@ import (
 	"github.com/abronan/valkeyrie"
 	"github.com/abronan/valkeyrie/store"
 	"github.com/abronan/valkeyrie/store/etcd/v2"
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 
 	checker "github.com/vdemeester/shakers"
 )

integration/eureka_test.go

@@ -8,8 +8,8 @@ import (
 	"text/template"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 
 	checker "github.com/vdemeester/shakers"
 )

integration/fake_dns_server.go

@@ -5,8 +5,8 @@ import (
 	"net"
 	"os"
 
-	"github.com/containous/traefik/log"
 	"github.com/miekg/dns"
+	"github.com/traefik/traefik/log"
 )
 
 type handler struct{}

integration/file_test.go

@@ -4,8 +4,8 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/containous/traefik/integration/try"
 	"github.com/go-check/check"
+	"github.com/traefik/traefik/integration/try"
 	checker "github.com/vdemeester/shakers"
 )
 

integration/fixtures/tlsclientheaders/readme.md

@@ -0,0 +1,6 @@
+```bash
+openssl req -new -newkey rsa:2048 -x509 -days 3650 -nodes -extensions v3_ca -keyout root.key -out root.pem
+openssl genrsa -out server.key 2048
+openssl req -nodes -key server.key -new -out server.csr
+openssl x509 -req -days 3650 -in server.csr -CA root.pem -CAkey root.key -CAcreateserial -out server.pem
+```

integration/fixtures/tlsclientheaders/root.pem

@@ -1,21 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIDhDCCAmygAwIBAgIJAK4Ed0WF/YNQMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
-BAYTAkZSMQ8wDQYDVQQIDAZGUkFOQ0UxETAPBgNVBAcMCFRPVUxPVVNFMRMwEQYD
-VQQKDApjb250YWlub3VzMQ8wDQYDVQQDDAZzZXJ2ZXIwHhcNMTgwMzIxMTMzOTM4
-WhcNMjEwMTA4MTMzOTM4WjBXMQswCQYDVQQGEwJGUjEPMA0GA1UECAwGRlJBTkNF
-MREwDwYDVQQHDAhUT1VMT1VTRTETMBEGA1UECgwKY29udGFpbm91czEPMA0GA1UE
-AwwGc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2DfZMdW1
-QKmdOTPULt6WUMVFU3PUcovq4cVtvNAzAshduC/7nHZx60uFzVKLYnOfZ+5VYfOS
-zfVXPvltmBSWga1Yj6CuzfDZwY1nkcoL+22yBD6x4w2nB7aFaPNgj6M4ALVEZRKX
-lMow+a0c0mOr1kLHm99MT/oabcdI+wbAp8VnLz9DF6SD7iDjIOb4RjvmcyetBzwu
-1rQYti0bFHOnLCxiz0asXly0zspFajWkbGkvBdvEoP2qOHMeTV604PaBwpIMX/ly
-ymGgYUctHeC16ptDRDDj7Spmu7ec2NzjgNW+MOth6EkFlhYgg1OEIXP+IFJ5LbS8
-1t/Y+fDUoc6+IQIDAQABo1MwUTAdBgNVHQ4EFgQUYeZvrzWyLI3TjmTIJYpSTjTb
-/XUwHwYDVR0jBBgwFoAUYeZvrzWyLI3TjmTIJYpSTjTb/XUwDwYDVR0TAQH/BAUw
-AwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAYQL8d/WQxu7rE58GC7le53FNzujMNZ+h
-1kdS35LrTXPv5b6QTi5oUGi5LCesP4HnCpGdMFodyydhY8rhIDZWEFgkJZOLZhdt
-sAyRONdI/Ms/NGQO2oJD+TlV92e4k3ey4WJyXIFHXE2Apb77VlsiHp8pI/iF/R5t
-h4o4OADG7k6Fjf/wx7A18ru2eoH+PcwA8i6sQaQ1qEwxC0b3rh2TwaCpFQVcmMv5
-5jKPRBN0UC0PyHwqFZsSg1folhMAIBAjUsHgA6WleN9zMCyLAIn0LSai1CpFby6o
-d6xu6pp8pwot8YTL0yS5T0X9aNhK2/uDoP50ei6eWI3uuPa8NJxbyA==
+MIIDjTCCAnWgAwIBAgIUFrRUuadNNLpobPP9sEgenQ2MTF0wDQYJKoZIhvcNAQEL
+BQAwVjELMAkGA1UEBhMCRlIxDzANBgNVBAgMBkZyYW5jZTEVMBMGA1UECgwMVHJh
+ZWZpayBMYWJzMRAwDgYDVQQLDAd0cmFlZmlrMQ0wCwYDVQQDDARyb290MB4XDTIx
+MDEwODE3NDMxOVoXDTMxMDEwNjE3NDMxOVowVjELMAkGA1UEBhMCRlIxDzANBgNV
+BAgMBkZyYW5jZTEVMBMGA1UECgwMVHJhZWZpayBMYWJzMRAwDgYDVQQLDAd0cmFl
+ZmlrMQ0wCwYDVQQDDARyb290MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEA53rEBDuojC9xslsS6MP8lJvubNmSOqFsGS58KtuTP8bQcuuFuBJzk4HzXoqE
+k1KQqqeIHZfP11yuto14RGtiRMOSDEfwkNvbcKIqHFyrbaDjjOvkpWVGiVVRycM4
+59UzKMuv6GgkNQHQDqaKhkxt7GrjUJBNDj/Kg9+1jJz0k181Fz4JsNT0KJ3gdSd1
+nMggcx8MBZm9F7jFqxDt0xW41UNDLzDTctCFyHAdWzQvFZV5j8A/VLZyTLCAuVZt
+ljJ4AoO2C02dAxaPxy4gZ6eZYbuS2iHhhGDKwcXwmrwDcwyaWoqy1GKqyV4VhDg+
+Ue6fwUZvjAaob9oWynXMQoik8wIDAQABo1MwUTAdBgNVHQ4EFgQUxauRsdHLfK/X
+hb/uWhrmYEDd9VQwHwYDVR0jBBgwFoAUxauRsdHLfK/Xhb/uWhrmYEDd9VQwDwYD
+VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAmrDLgjgfJnrHKDBMGxcC
+2NhYrqoeJcGdIsW/TwjNaXaJZZpgAjmHObDR1+49UQhylUzB1a8jesSu2R+aBZXb
+/0Y9J19q8jbMKEQABqApvwrHLXe9xUVzRTxK3HPlnzSTinS2Il34jc/o3gaYmWuy
+i7KapY6fhkCivr0zTPXF2l8gLFesuQHkq2cYwZDOwgcaSCVoqeA0ldvo/Pmz2A6L
+3X4rfpXo10Dh9sClbO78eCxQp2RdtPBVPMqMG/2+sPu4qE/TYKttR0GseOMSYEju
+kCxmQBS8agUJEdrdFhsTR6Vq2uUO3Qx1r2Oz4xs/jfG/SjMVxcap38hf/QmEq0KA
+8Q==
 -----END CERTIFICATE-----