fix: mkdocs.yml

.gitattributes

@@ -1,2 +0,0 @@
-vendor/github.com/xenolf/lego/providers/dns/cloudxns/cloudxns.go eol=crlf
-

.github/ISSUE_TEMPLATE.md

@@ -62,7 +62,7 @@ Add more configuration information here.
 -->
 
 
-### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output in debug mode (`--debug` switch)
 
 ```
 (paste your output here)

.github/ISSUE_TEMPLATE/bugs.md

@@ -61,7 +61,7 @@ Add more configuration information here.
 -->
 
 
-### If applicable, please paste the log output in DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output in debug mode (`--debug` switch)
 
 ```
 (paste your output here)

.gometalinter.json

@@ -1,42 +0,0 @@
-{
-  "Vendor": true,
-  "Sort": [
-    "path",
-    "line",
-    "column",
-    "severity",
-    "linter"
-  ],
-  "Test": true,
-  "Cyclo": 15,
-  "Enable": [
-    "gotypex",
-    "nakedret",
-    "vet",
-    "goimports",
-    "golint",
-    "ineffassign",
-    "gotype",
-    "misspell",
-    "structcheck",
-    "gosimple",
-    "unconvert",
-    "varcheck",
-    "errcheck",
-    "unused",
-    "deadcode",
-    "staticcheck"
-  ],
-  "Disable": [
-    "gas",
-    "maligned",
-    "interfacer",
-    "goconst",
-    "gocyclo",
-    "vetshadow"
-  ],
-  "Exclude": [
-    "autogen/.*"
-  ],
-  "Deadline": "5m"
-}

.semaphoreci/vars

@@ -10,7 +10,7 @@ else
   export VERSION=''
 fi
 
-export CODENAME=tetedemoine
+export CODENAME=cancoillotte
 
 export N_MAKE_JOBS=2
 

.travis.yml

@@ -11,7 +11,7 @@ env:
   global:
     - REPO: $TRAVIS_REPO_SLUG
     - VERSION: $TRAVIS_TAG
-    - CODENAME: tetedemoine
+    - CODENAME: cancoillotte
     - N_MAKE_JOBS: 2
 
 script:

CHANGELOG.md

@@ -1,135 +1,5 @@
 # Change Log
 
-## [v1.6.0-rc2](https://github.com/containous/traefik/tree/v1.6.0-rc2) (2018-03-27)
-[All Commits](https://github.com/containous/traefik/compare/v1.6.0-rc1...v1.6.0-rc2)
-
-**Bug fixes:**
-- **[acme]** Fix panic with wrong ACME configuration ([#3084](https://github.com/containous/traefik/pull/3084) by [nmengin](https://github.com/nmengin))
-- **[acme]** Fix wildcard match to ACME domains in cluster mode ([#3080](https://github.com/containous/traefik/pull/3080) by [oldmantaiter](https://github.com/oldmantaiter))
-
-**Documentation:**
-- **[servicefabric]** Update SF white list documentation section. ([#3082](https://github.com/containous/traefik/pull/3082) by [ldez](https://github.com/ldez))
-- Fix basic documentation ([#3086](https://github.com/containous/traefik/pull/3086) by [mmatur](https://github.com/mmatur))
-
-## [v1.6.0-rc1](https://github.com/containous/traefik/tree/v1.6.0-rc1) (2018-03-26)
-[All Commits](https://github.com/containous/traefik/compare/v1.5.0-rc1...v1.6.0-rc1)
-
-**Enhancements:**
-- **[acme]** Bump Lego Version for GoDaddy DNS Provider ([#2482](https://github.com/containous/traefik/pull/2482) by [sjawhar](https://github.com/sjawhar))
-- **[acme]** Simplify storing renewed acme certificate ([#2614](https://github.com/containous/traefik/pull/2614) by [ferhatelmas](https://github.com/ferhatelmas))
-- **[acme]** Delete TLS-SNI-01 challenge from ACME ([#2971](https://github.com/containous/traefik/pull/2971) by [nmengin](https://github.com/nmengin))
-- **[acme]** ACME V2 Integration ([#3063](https://github.com/containous/traefik/pull/3063) by [nmengin](https://github.com/nmengin))
-- **[acme]** Update Lego (Gandi API v5, cloudxns, ...) ([#2844](https://github.com/containous/traefik/pull/2844) by [ldez](https://github.com/ldez))
-- **[acme]** Create ACME Provider ([#2889](https://github.com/containous/traefik/pull/2889) by [nmengin](https://github.com/nmengin))
-- **[api,cluster]** Added cluster/leader endpoint ([#3009](https://github.com/containous/traefik/pull/3009) by [aantono](https://github.com/aantono))
-- **[authentication]** Forward Authentication: add X-Forwarded-Uri ([#2398](https://github.com/containous/traefik/pull/2398) by [sebastianbauer](https://github.com/sebastianbauer))
-- **[boltdb,consul,etcd,kv,zk]** homogenization of templates: KV ([#2661](https://github.com/containous/traefik/pull/2661) by [ldez](https://github.com/ldez))
-- **[boltdb,consul,etcd,kv,zk]** Add all available configuration to KV Backend ([#2652](https://github.com/containous/traefik/pull/2652) by [ldez](https://github.com/ldez))
-- **[boltdb,consul,etcd,kv,zk]** Homogenization of the providers (part 1):  KV ([#2616](https://github.com/containous/traefik/pull/2616) by [ldez](https://github.com/ldez))
-- **[consul,consulcatalog]** Homogenization of templates: Consul Catalog ([#2668](https://github.com/containous/traefik/pull/2668) by [ldez](https://github.com/ldez))
-- **[consul,consulcatalog]** Split consul and consul catalog. ([#2655](https://github.com/containous/traefik/pull/2655) by [ldez](https://github.com/ldez))
-- **[consulcatalog]** Add all available tags to Consul Catalog Backend ([#2646](https://github.com/containous/traefik/pull/2646) by [ldez](https://github.com/ldez))
-- **[consulcatalog]** Check for endpoints while detecting Consul service changes ([#2882](https://github.com/containous/traefik/pull/2882) by [caseycs](https://github.com/caseycs))
-- **[consulcatalog]** TLS Support for ConsulCatalog ([#2900](https://github.com/containous/traefik/pull/2900) by [mmatur](https://github.com/mmatur))
-- **[docker,docker/swarm]** Fix support for macvlan driver in docker provider ([#2827](https://github.com/containous/traefik/pull/2827) by [mmatur](https://github.com/mmatur))
-- **[docker,marathon,rancher]** Segments Labels: Rancher & Marathon ([#3073](https://github.com/containous/traefik/pull/3073) by [ldez](https://github.com/ldez))
-- **[docker]** Custom headers by service labels for docker backends ([#2514](https://github.com/containous/traefik/pull/2514) by [Tiscs](https://github.com/Tiscs))
-- **[docker]** Homogenization of templates: Docker ([#2659](https://github.com/containous/traefik/pull/2659) by [ldez](https://github.com/ldez))
-- **[docker]** Segment labels: Docker ([#3055](https://github.com/containous/traefik/pull/3055) by [ldez](https://github.com/ldez))
-- **[docker]** Add all available labels to Docker Backend ([#2584](https://github.com/containous/traefik/pull/2584) by [ldez](https://github.com/ldez))
-- **[dynamodb,ecs]** Upgrade AWS SKD to version v1.13.1 ([#2908](https://github.com/containous/traefik/pull/2908) by [mmatur](https://github.com/mmatur))
-- **[ecs]** Add all available labels to ECS Backend ([#2605](https://github.com/containous/traefik/pull/2605) by [ldez](https://github.com/ldez))
-- **[ecs]** Homogenization of templates: ECS ([#2663](https://github.com/containous/traefik/pull/2663) by [ldez](https://github.com/ldez))
-- **[eureka]** Replace Delay by RefreshSecond in Eureka ([#2972](https://github.com/containous/traefik/pull/2972) by [ldez](https://github.com/ldez))
-- **[eureka]** Homogenization of templates: Eureka  ([#2846](https://github.com/containous/traefik/pull/2846) by [ldez](https://github.com/ldez))
-- **[file]** Added support for templates to file provider ([#2991](https://github.com/containous/traefik/pull/2991) by [aantono](https://github.com/aantono))
-- **[healthcheck]** Toggle /ping to artificially return unhealthy response on SIGTERM during requestAcceptGraceTimeout interval ([#3062](https://github.com/containous/traefik/pull/3062) by [ravilr](https://github.com/ravilr))
-- **[healthcheck]** Improve logging output for failing healthchecks ([#2443](https://github.com/containous/traefik/pull/2443) by [marco-jantke](https://github.com/marco-jantke))
-- **[k8s,tls]** Add support for fetching k8s Ingress TLS data from secrets ([#2439](https://github.com/containous/traefik/pull/2439) by [gopenguin](https://github.com/gopenguin))
-- **[k8s]** Bump kubernetes/client-go ([#2848](https://github.com/containous/traefik/pull/2848) by [yue9944882](https://github.com/yue9944882))
-- **[k8s]** Allow custom value for kubernetes.io/ingress.class annotation ([#2222](https://github.com/containous/traefik/pull/2222) by [yuvipanda](https://github.com/yuvipanda))
-- **[k8s]** Add app-root annotation support for kubernetes ingress ([#2522](https://github.com/containous/traefik/pull/2522) by [yue9944882](https://github.com/yue9944882))
-- **[k8s]** Builders in k8s tests ([#2513](https://github.com/containous/traefik/pull/2513) by [ldez](https://github.com/ldez))
-- **[k8s]** Add all available annotations to k8s Backend ([#2612](https://github.com/containous/traefik/pull/2612) by [ldez](https://github.com/ldez))
-- **[k8s]** Introduce k8s informer factory ([#2867](https://github.com/containous/traefik/pull/2867) by [yue9944882](https://github.com/yue9944882))
-- **[logs,middleware]** Add access log filter for retry attempts ([#3042](https://github.com/containous/traefik/pull/3042) by [marco-jantke](https://github.com/marco-jantke))
-- **[logs,middleware]** Ultimate Access log filter ([#2988](https://github.com/containous/traefik/pull/2988) by [mmatur](https://github.com/mmatur))
-- **[logs,middleware]** Add username in accesslog ([#2111](https://github.com/containous/traefik/pull/2111) by [bastiaanb](https://github.com/bastiaanb))
-- **[logs]** Allow overriding the log level in debug mode. ([#3050](https://github.com/containous/traefik/pull/3050) by [timoreimann](https://github.com/timoreimann))
-- **[logs]** Display file log when test fails. ([#2801](https://github.com/containous/traefik/pull/2801) by [ldez](https://github.com/ldez))
-- **[marathon]** Remove health check filter from Marathon tasks. ([#2817](https://github.com/containous/traefik/pull/2817) by [timoreimann](https://github.com/timoreimann))
-- **[marathon]** Add all available labels to Marathon Backend ([#2602](https://github.com/containous/traefik/pull/2602) by [ldez](https://github.com/ldez))
-- **[marathon]** homogenization of templates: Marathon ([#2665](https://github.com/containous/traefik/pull/2665) by [ldez](https://github.com/ldez))
-- **[mesos]** Add all available labels to Mesos Backend  ([#2687](https://github.com/containous/traefik/pull/2687) by [ldez](https://github.com/ldez))
-- **[metrics]** Added entrypoint metrics to influxdb ([#2992](https://github.com/containous/traefik/pull/2992) by [adityacs](https://github.com/adityacs))
-- **[metrics]** Extend metrics and rebuild prometheus exporting logic ([#2567](https://github.com/containous/traefik/pull/2567) by [marco-jantke](https://github.com/marco-jantke))
-- **[metrics]** Added missing metrics to registry for DataDog and StatsD ([#2890](https://github.com/containous/traefik/pull/2890) by [aantono](https://github.com/aantono))
-- **[metrics]** Remove unnecessary conversion ([#2850](https://github.com/containous/traefik/pull/2850) by [ferhatelmas](https://github.com/ferhatelmas))
-- **[middleware,consul,consulcatalog,docker,ecs,k8s,marathon,mesos,rancher]** New option in secure middleware ([#2958](https://github.com/containous/traefik/pull/2958) by [mmatur](https://github.com/mmatur))
-- **[middleware,consulcatalog,docker,ecs,k8s,kv,marathon,mesos,rancher]** Ability to use "X-Forwarded-For" as a source of IP for white list. ([#3070](https://github.com/containous/traefik/pull/3070) by [ldez](https://github.com/ldez))
-- **[middleware,docker]** Use pointer of error pages ([#2607](https://github.com/containous/traefik/pull/2607) by [ldez](https://github.com/ldez))
-- **[middleware,provider]** Redirection: permanent move option. ([#2774](https://github.com/containous/traefik/pull/2774) by [ldez](https://github.com/ldez))
-- **[middleware]** Add new options to the CLI entrypoint definition.  ([#2799](https://github.com/containous/traefik/pull/2799) by [ldez](https://github.com/ldez))
-- **[middleware]** Change port of traefik for error pages integration test ([#2907](https://github.com/containous/traefik/pull/2907) by [mmatur](https://github.com/mmatur))
-- **[middleware]** Request buffering middleware ([#2217](https://github.com/containous/traefik/pull/2217) by [harnash](https://github.com/harnash))
-- **[middleware]** Remove unnecessary returns in tracing setup ([#2880](https://github.com/containous/traefik/pull/2880) by [ferhatelmas](https://github.com/ferhatelmas))
-- **[provider]** Homogenization of the providers (part 1) ([#2518](https://github.com/containous/traefik/pull/2518) by [ldez](https://github.com/ldez))
-- **[provider]** No error pages must return nil. ([#2610](https://github.com/containous/traefik/pull/2610) by [ldez](https://github.com/ldez))
-- **[rancher]** Homogenization of templates: Rancher ([#2662](https://github.com/containous/traefik/pull/2662) by [ldez](https://github.com/ldez))
-- **[rancher]** Add all available labels to Rancher Backend ([#2601](https://github.com/containous/traefik/pull/2601) by [ldez](https://github.com/ldez))
-- **[rules]** Externalize Træfik rules in a dedicated package ([#2933](https://github.com/containous/traefik/pull/2933) by [nmengin](https://github.com/nmengin))
-- **[servicefabric]** Update Service Fabric backend. ([#3064](https://github.com/containous/traefik/pull/3064) by [ldez](https://github.com/ldez))
-- **[servicefabric]** Add white list for Service Fabric. ([#3079](https://github.com/containous/traefik/pull/3079) by [ldez](https://github.com/ldez))
-- **[tls]** Use default entryPoints when certificates are added with no entryPoints. ([#2534](https://github.com/containous/traefik/pull/2534) by [nmengin](https://github.com/nmengin))
-- **[tracing]** Handle zipkin collector creation ([#2860](https://github.com/containous/traefik/pull/2860) by [ferhatelmas](https://github.com/ferhatelmas))
-- **[tracing]** Opentracing support ([#2587](https://github.com/containous/traefik/pull/2587) by [mmatur](https://github.com/mmatur))
-- **[webui]** Add status code text to webui bar chart tooltip ([#2639](https://github.com/containous/traefik/pull/2639) by [wader](https://github.com/wader))
-- Separate command from the main package ([#2951](https://github.com/containous/traefik/pull/2951) by [Juliens](https://github.com/Juliens))
-- Use context in Server ([#3007](https://github.com/containous/traefik/pull/3007) by [Juliens](https://github.com/Juliens))
-- Logger and Leaks ([#2847](https://github.com/containous/traefik/pull/2847) by [ldez](https://github.com/ldez))
-
-**Bug fixes:**
-- **[acme]** Check all the C/N and SANs of provided certificates before generating ACME certificates in ACME provider ([#2970](https://github.com/containous/traefik/pull/2970) by [nmengin](https://github.com/nmengin))
-- **[docker,k8s,marathon]** Fix custom headers template ([#2622](https://github.com/containous/traefik/pull/2622) by [ldez](https://github.com/ldez))
-- **[k8s]** Missing annotation prefix support. ([#2915](https://github.com/containous/traefik/pull/2915) by [ldez](https://github.com/ldez))
-- **[k8s]** Remove hardcoded frontend prefix in Kubernetes template ([#2914](https://github.com/containous/traefik/pull/2914) by [psalaberria002](https://github.com/psalaberria002))
-- **[logs,middleware]** Fix bad access log ([#2682](https://github.com/containous/traefik/pull/2682) by [mmatur](https://github.com/mmatur))
-- **[middleware,tracing]** Fix <nil> tracer value in KV ([#2911](https://github.com/containous/traefik/pull/2911) by [mmatur](https://github.com/mmatur))
-- **[middleware]** Use responseModifier to override secure headers ([#2946](https://github.com/containous/traefik/pull/2946) by [mmatur](https://github.com/mmatur))
-- **[middleware]** Correct conditional setting of buffering retry expression. ([#2865](https://github.com/containous/traefik/pull/2865) by [ldez](https://github.com/ldez))
-- **[middleware]** Fix high memory usage in retry middleware ([#2740](https://github.com/containous/traefik/pull/2740) by [marco-jantke](https://github.com/marco-jantke))
-- **[provider]** Add some missing quotes in templates ([#2973](https://github.com/containous/traefik/pull/2973) by [ldez](https://github.com/ldez))
-- **[tracing]** Fix missing configuration for jaeger reporter ([#2720](https://github.com/containous/traefik/pull/2720) by [mmatur](https://github.com/mmatur))
-- **[tracing]** Tracing statusCodeTracker need to implement CloseNotify ([#2733](https://github.com/containous/traefik/pull/2733) by [mmatur](https://github.com/mmatur))
-- **[tracing]** Fix integration tests in tracing ([#2759](https://github.com/containous/traefik/pull/2759) by [mmatur](https://github.com/mmatur))
-- Remove unnecessary mutex usage in health checks ([#2726](https://github.com/containous/traefik/pull/2726) by [marco-jantke](https://github.com/marco-jantke))
-
-**Documentation:**
-- **[docker]** Add default values for some Docker labels ([#2604](https://github.com/containous/traefik/pull/2604) by [ldez](https://github.com/ldez))
-- **[k8s]** Remove web provider in example ([#2807](https://github.com/containous/traefik/pull/2807) by [pigletfly](https://github.com/pigletfly))
-- **[k8s]** Update traefik-ds.yaml with --api command line parameter ([#2803](https://github.com/containous/traefik/pull/2803) by [maniankara](https://github.com/maniankara))
-- **[k8s]** Drop capabilities in Kubernetes DaemonSet example ([#3028](https://github.com/containous/traefik/pull/3028) by [nogoegst](https://github.com/nogoegst))
-- **[k8s]** Docs: Fix typos in k8s user-guide ([#2898](https://github.com/containous/traefik/pull/2898) by [cez81](https://github.com/cez81))
-- **[k8s]** Change boolean annotation values to string ([#2839](https://github.com/containous/traefik/pull/2839) by [hobti01](https://github.com/hobti01))
-- **[provider]** Split security labels and custom labels documentation. ([#2872](https://github.com/containous/traefik/pull/2872) by [ldez](https://github.com/ldez))
-- **[provider]** Remove non-supported label. ([#3065](https://github.com/containous/traefik/pull/3065) by [ldez](https://github.com/ldez))
-- **[provider]** Remove obsolete paragraph about error pages. ([#2608](https://github.com/containous/traefik/pull/2608) by [ldez](https://github.com/ldez))
-- **[servicefabric]** Add SF to supported backends in docs ([#3033](https://github.com/containous/traefik/pull/3033) by [lawrencegripper](https://github.com/lawrencegripper))
-- Fix typo in doc for rate limit label ([#2790](https://github.com/containous/traefik/pull/2790) by [mmatur](https://github.com/mmatur))
-- Add Tracing entry in the documentation. ([#2713](https://github.com/containous/traefik/pull/2713) by [ldez](https://github.com/ldez))
-
-**Misc:**
-- **[boltdb,consul,etcd,kv,zk]** Migrate from libkv to valkeyrie library ([#2743](https://github.com/containous/traefik/pull/2743) by [nmengin](https://github.com/nmengin))
-- Merge v1.5.4 into master  ([#3024](https://github.com/containous/traefik/pull/3024) by [ldez](https://github.com/ldez))
-- Merge v1.5.3 into master ([#2943](https://github.com/containous/traefik/pull/2943) by [ldez](https://github.com/ldez))
-- Merge v1.5.2 into master  ([#2843](https://github.com/containous/traefik/pull/2843) by [ldez](https://github.com/ldez))
-- Merge v1.5.1 into master ([#2781](https://github.com/containous/traefik/pull/2781) by [ldez](https://github.com/ldez))
-- Merge v1.5.0-rc5 into master ([#2708](https://github.com/containous/traefik/pull/2708) by [ldez](https://github.com/ldez))
-- Merge 1.5.0-rc3 into master ([#2600](https://github.com/containous/traefik/pull/2600) by [ldez](https://github.com/ldez))
-- Drop unnecessary type conversions ([#2583](https://github.com/containous/traefik/pull/2583) by [ferhatelmas](https://github.com/ferhatelmas))
-- Merge 1.5.0-rc2 into master ([#2536](https://github.com/containous/traefik/pull/2536) by [ldez](https://github.com/ldez))
-- Code simplification ([#2516](https://github.com/containous/traefik/pull/2516) by [ferhatelmas](https://github.com/ferhatelmas))
-
 ## [v1.5.4](https://github.com/containous/traefik/tree/v1.5.4) (2018-03-15)
 [All Commits](https://github.com/containous/traefik/compare/v1.5.3...v1.5.4)
 

CONTRIBUTING.md

@@ -13,7 +13,7 @@ You need to run the `binary` target. This will create binaries for Linux platfor
 $ make binary
 docker build -t "traefik-dev:no-more-godep-ever" -f build.Dockerfile .
 Sending build context to Docker daemon 295.3 MB
-Step 0 : FROM golang:1.10-alpine
+Step 0 : FROM golang:1.9-alpine
  ---> 8c6473912976
 Step 1 : RUN go get github.com/golang/dep/cmd/dep
 [...]

Gopkg.toml

@@ -19,6 +19,8 @@
 #  name = "github.com/x/y"
 #  version = "2.4.0"
 
+ignored = ["github.com/sirupsen/logrus"]
+
 [[constraint]]
   branch = "master"
   name = "github.com/ArthurHlt/go-eureka-client"
@@ -46,7 +48,7 @@
 
 [[constraint]]
   name = "github.com/aws/aws-sdk-go"
-  version = "1.13.1"
+  version = "1.6.18"
 
 [[constraint]]
   branch = "master"
@@ -62,11 +64,11 @@
 
 [[constraint]]
   name = "github.com/containous/staert"
-  version = "3.1.0"
+  version = "2.1.0"
 
 [[constraint]]
   name = "github.com/containous/traefik-extra-service-fabric"
-  version = "1.1.1"
+  version = "1.0.6"
 
 [[constraint]]
   name = "github.com/coreos/go-systemd"
@@ -77,6 +79,10 @@
   name = "github.com/docker/leadership"
   source = "github.com/containous/leadership"
 
+[[constraint]]
+  name = "github.com/docker/libkv"
+  source = "github.com/abronan/libkv"
+
 [[constraint]]
   name = "github.com/eapache/channels"
   version = "1.1.0"
@@ -86,12 +92,6 @@
   name = "github.com/elazarl/go-bindata-assetfs"
 
 [[constraint]]
-  branch = "fork-containous"
-  name = "github.com/go-check/check"
-  source = "github.com/containous/check"
-
-[[override]]
-  branch = "fork-containous"
   name = "github.com/go-check/check"
   source = "github.com/containous/check"
 
@@ -99,14 +99,6 @@
   name = "github.com/go-kit/kit"
   version = "0.3.0"
 
-[[constraint]]
-  branch = "master"
-  name = "github.com/gorilla/websocket"
-
-[[constraint]]
-  name = "github.com/hashicorp/consul"
-  version = "1.0.6"
-
 [[constraint]]
   name = "github.com/influxdata/influxdb"
   version = "1.3.7"
@@ -116,8 +108,8 @@
   name = "github.com/jjcollinge/servicefabric"
 
 [[constraint]]
-  branch = "master"
-  name = "github.com/abronan/valkeyrie"
+  name = "github.com/mattn/go-shellwords"
+  version = "1.0.3"
 
 [[constraint]]
   name = "github.com/mesosphere/mesos-dns"
@@ -136,13 +128,8 @@
   name = "github.com/mitchellh/mapstructure"
 
 [[constraint]]
-  name = "github.com/opentracing/opentracing-go"
-  version = "1.0.2"
-
-[[constraint]]
-  branch = "containous-fork"
+  branch = "master"
   name = "github.com/rancher/go-rancher-metadata"
-  source = "github.com/containous/go-rancher-metadata"
 
 [[constraint]]
   branch = "master"
@@ -156,33 +143,18 @@
   branch = "master"
   name = "github.com/stvp/go-udp-testing"
 
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.2.1"
-
-[[constraint]]
-  name = "github.com/uber/jaeger-client-go"
-  version = "2.9.0"
-
-[[constraint]]
-  name = "github.com/uber/jaeger-lib"
-  version = "1.1.0"
-
-[[constraint]]
-  branch = "v1"
-  name = "github.com/unrolled/secure"
-
 [[constraint]]
   name = "github.com/vdemeester/shakers"
   version = "0.1.0"
 
 [[constraint]]
-  branch = "master"
+  branch = "containous-fork"
   name = "github.com/vulcand/oxy"
+  source = "https://github.com/containous/oxy.git"
 
 [[constraint]]
-  branch = "acmev2"
   name = "github.com/xenolf/lego"
+  version = "0.4.1"
 
 [[constraint]]
   name = "google.golang.org/grpc"
@@ -195,62 +167,39 @@
 
 [[constraint]]
   name = "k8s.io/client-go"
-  version = "6.0.0"
-
-[[constraint]]
-  name = "k8s.io/api"
-  version = "kubernetes-1.9.0"
-
-[[constraint]]
-  name = "k8s.io/apimachinery"
-  version = "kubernetes-1.9.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/docker"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/docker-check"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/libkermit/compose"
-
-[[constraint]]
- name = "github.com/docker/docker"
- revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
-
-[[override]]
- name = "github.com/docker/docker"
- revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
-
-[[override]]
- name = "github.com/docker/cli"
- revision = "6b63d7b96a41055baddc3fa71f381c7f60bd5d8e"
-
-[[override]]
- name = "github.com/docker/distribution"
- revision = "edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c"
-
-[[override]]
-  branch = "master"
-  name = "github.com/docker/libcompose"
+  version = "2.0.0"
 
 [[override]]
   name = "github.com/Nvveen/Gotty"
-  revision = "a8b993ba6abdb0e0c12b0125c603323a71c7790c"
+  revision = "6018b68f96b839edfbe3fb48668853f5dbad88a3"
   source = "github.com/ijc25/Gotty"
 
 [[override]]
-  # ALWAYS keep this override
+  # always keep this override
   name = "github.com/mailgun/timetools"
   revision = "7e6055773c5137efbeb3bd2410d705fe10ab6bfd"
 
+[[override]]
+  name = "github.com/vulcand/predicate"
+  revision = "19b9dde14240d94c804ae5736ad0e1de10bf8fe6"
+
+[[override]]
+  # remove override on master
+  name = "github.com/coreos/bbolt"
+  revision = "32c383e75ce054674c53b5a07e55de85332aee14"
+
 [[override]]
   branch = "master"
   name = "github.com/miekg/dns"
 
+[[override]]
+  name = "golang.org/x/crypto"
+  revision = "b080dc9a8c480b08e698fb1219160d598526310f"
+
+[[override]]
+  name = "golang.org/x/net"
+  revision = "894f8ed5849b15b810ae41e9590a0d05395bba27"
+
 [prune]
   non-go = true
   go-tests = true

Makefile

@@ -73,7 +73,7 @@ test-integration: build ## run the integration tests
 	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary test-integration
 	TEST_HOST=1 ./script/make.sh test-integration
 
-validate: build  ## validate code, vendor and autogen
+validate: build  ## validate gofmt, golint and go vet
 	$(DOCKER_RUN_TRAEFIK) ./script/make.sh validate-gofmt validate-govet validate-golint validate-misspell validate-vendor validate-autogen
 
 build: dist

README.md

@@ -56,7 +56,7 @@ _(But if you'd rather configure some of your routes manually, Træfik supports t
 
 - Continuously updates its configuration (No restarts!)
 - Supports multiple load balancing algorithms
-- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org)  (wildcard certificates support)
+- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org)
 - Circuit breakers, retry
 - High Availability with cluster mode (beta)
 - See the magic through its clean web UI
@@ -74,7 +74,7 @@ _(But if you'd rather configure some of your routes manually, Træfik supports t
 - [Kubernetes](docs/configuration/backends/kubernetes/)
 - [Mesos](docs/configuration/backends/mesos/) / [Marathon](docs/configuration/backends/marathon/)
 - [Rancher](docs/configuration/backends/rancher/) (API, Metadata)
-- [Service Fabric](docs/configuration/backends/servicefabric/)
+- [Azure Service Fabric](docs/configuration/backends/servicefabric/)
 - [Consul Catalog](docs/configuration/backends/consulcatalog/)
 - [Consul](docs/configuration/backends/consul/) / [Etcd](docs/configuration/backends/etcd/) / [Zookeeper](docs/configuration/backends/zookeeper/) / [BoltDB](docs/configuration/backends/boltdb/)
 - [Eureka](docs/configuration/backends/eureka/)

acme/account.go

@@ -14,8 +14,7 @@ import (
 	"time"
 
 	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/types"
-	acme "github.com/xenolf/lego/acmev2"
+	"github.com/xenolf/lego/acme"
 )
 
 // Account is used to store lets encrypt registration info
@@ -35,7 +34,7 @@ type ChallengeCert struct {
 	certificate *tls.Certificate
 }
 
-// Init account struct
+// Init inits account struct
 func (a *Account) Init() error {
 	err := a.DomainsCertificate.Init()
 	if err != nil {
@@ -50,7 +49,6 @@ func (a *Account) Init() error {
 			}
 			cert.certificate = &certificate
 		}
-
 		if cert.certificate.Leaf == nil {
 			leaf, err := x509.ParseCertificate(cert.certificate.Certificate[0])
 			if err != nil {
@@ -63,19 +61,14 @@ func (a *Account) Init() error {
 }
 
 // NewAccount creates an account
-func NewAccount(email string, certs []*DomainsCertificate) (*Account, error) {
+func NewAccount(email string) (*Account, error) {
 	// Create a user. New accounts need an email and private key to start
 	privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
 	if err != nil {
 		return nil, err
 	}
-
-	domainsCerts := DomainsCertificates{Certs: certs}
-	err = domainsCerts.Init()
-	if err != nil {
-		return nil, err
-	}
-
+	domainsCerts := DomainsCertificates{Certs: []*DomainsCertificate{}}
+	domainsCerts.Init()
 	return &Account{
 		Email:              email,
 		PrivateKey:         x509.MarshalPKCS1PrivateKey(privateKey),
@@ -98,7 +91,6 @@ func (a *Account) GetPrivateKey() crypto.PrivateKey {
 	if privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey); err == nil {
 		return privateKey
 	}
-
 	log.Errorf("Cannot unmarshall private key %+v", a.PrivateKey)
 	return nil
 }
@@ -130,11 +122,9 @@ func (dc *DomainsCertificates) Less(i, j int) bool {
 	if reflect.DeepEqual(dc.Certs[i].Domains, dc.Certs[j].Domains) {
 		return dc.Certs[i].tlsCert.Leaf.NotAfter.After(dc.Certs[j].tlsCert.Leaf.NotAfter)
 	}
-
 	if dc.Certs[i].Domains.Main == dc.Certs[j].Domains.Main {
 		return strings.Join(dc.Certs[i].Domains.SANs, ",") < strings.Join(dc.Certs[j].Domains.SANs, ",")
 	}
-
 	return dc.Certs[i].Domains.Main < dc.Certs[j].Domains.Main
 }
 
@@ -152,34 +142,29 @@ func (dc *DomainsCertificates) removeDuplicates() {
 	}
 }
 
-// Init DomainsCertificates
+// Init inits DomainsCertificates
 func (dc *DomainsCertificates) Init() error {
 	dc.lock.Lock()
 	defer dc.lock.Unlock()
-
 	for _, domainsCertificate := range dc.Certs {
 		tlsCert, err := tls.X509KeyPair(domainsCertificate.Certificate.Certificate, domainsCertificate.Certificate.PrivateKey)
 		if err != nil {
 			return err
 		}
-
 		domainsCertificate.tlsCert = &tlsCert
-
 		if domainsCertificate.tlsCert.Leaf == nil {
 			leaf, err := x509.ParseCertificate(domainsCertificate.tlsCert.Certificate[0])
 			if err != nil {
 				return err
 			}
-
 			domainsCertificate.tlsCert.Leaf = leaf
 		}
 	}
-
 	dc.removeDuplicates()
 	return nil
 }
 
-func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain types.Domain) error {
+func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain Domain) error {
 	dc.lock.Lock()
 	defer dc.lock.Unlock()
 
@@ -189,17 +174,15 @@ func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain t
 			if err != nil {
 				return err
 			}
-
 			domainsCertificate.Certificate = acmeCert
 			domainsCertificate.tlsCert = &tlsCert
 			return nil
 		}
 	}
-
 	return fmt.Errorf("certificate to renew not found for domain %s", domain.Main)
 }
 
-func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, domain types.Domain) (*DomainsCertificate, error) {
+func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, domain Domain) (*DomainsCertificate, error) {
 	dc.lock.Lock()
 	defer dc.lock.Unlock()
 
@@ -207,7 +190,6 @@ func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, d
 	if err != nil {
 		return nil, err
 	}
-
 	cert := DomainsCertificate{Domains: domain, Certificate: acmeCert, tlsCert: &tlsCert}
 	dc.Certs = append(dc.Certs, &cert)
 	return &cert, nil
@@ -216,12 +198,11 @@ func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, d
 func (dc *DomainsCertificates) getCertificateForDomain(domainToFind string) (*DomainsCertificate, bool) {
 	dc.lock.RLock()
 	defer dc.lock.RUnlock()
-
 	for _, domainsCertificate := range dc.Certs {
-		for _, domain := range domainsCertificate.Domains.ToStrArray() {
-			if strings.HasPrefix(domain, "*.") && types.MatchDomain(domainToFind, domain) {
-				return domainsCertificate, true
-			}
+		domains := []string{}
+		domains = append(domains, domainsCertificate.Domains.Main)
+		domains = append(domains, domainsCertificate.Domains.SANs...)
+		for _, domain := range domains {
 			if domain == domainToFind {
 				return domainsCertificate, true
 			}
@@ -230,10 +211,9 @@ func (dc *DomainsCertificates) getCertificateForDomain(domainToFind string) (*Do
 	return nil, false
 }
 
-func (dc *DomainsCertificates) exists(domainToFind types.Domain) (*DomainsCertificate, bool) {
+func (dc *DomainsCertificates) exists(domainToFind Domain) (*DomainsCertificate, bool) {
 	dc.lock.RLock()
 	defer dc.lock.RUnlock()
-
 	for _, domainsCertificate := range dc.Certs {
 		if reflect.DeepEqual(domainToFind, domainsCertificate.Domains) {
 			return domainsCertificate, true
@@ -244,18 +224,16 @@ func (dc *DomainsCertificates) exists(domainToFind types.Domain) (*DomainsCertif
 
 func (dc *DomainsCertificates) toDomainsMap() map[string]*tls.Certificate {
 	domainsCertificatesMap := make(map[string]*tls.Certificate)
-
 	for _, domainCertificate := range dc.Certs {
 		certKey := domainCertificate.Domains.Main
-
 		if domainCertificate.Domains.SANs != nil {
 			sort.Strings(domainCertificate.Domains.SANs)
-
 			for _, dnsName := range domainCertificate.Domains.SANs {
 				if dnsName != domainCertificate.Domains.Main {
 					certKey += fmt.Sprintf(",%s", dnsName)
 				}
 			}
+
 		}
 		domainsCertificatesMap[certKey] = domainCertificate.tlsCert
 	}
@@ -264,7 +242,7 @@ func (dc *DomainsCertificates) toDomainsMap() map[string]*tls.Certificate {
 
 // DomainsCertificate contains a certificate for multiple domains
 type DomainsCertificate struct {
-	Domains     types.Domain
+	Domains     Domain
 	Certificate *Certificate
 	tlsCert     *tls.Certificate
 }
@@ -276,9 +254,8 @@ func (dc *DomainsCertificate) needRenew() bool {
 			// If there's an error, we assume the cert is broken, and needs update
 			return true
 		}
-
 		// <= 30 days left, renew certificate
-		if crt.NotAfter.Before(time.Now().Add(24 * 30 * time.Hour)) {
+		if crt.NotAfter.Before(time.Now().Add(time.Duration(24 * 30 * time.Hour))) {
 			return true
 		}
 	}

acme/acme.go

@@ -10,7 +10,7 @@ import (
 	"net"
 	"net/http"
 	"os"
-	"reflect"
+	"regexp"
 	"strings"
 	"time"
 
@@ -21,12 +21,12 @@ import (
 	"github.com/containous/staert"
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/log"
-	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/safe"
+	traefikTls "github.com/containous/traefik/tls"
 	"github.com/containous/traefik/tls/generate"
 	"github.com/containous/traefik/types"
 	"github.com/eapache/channels"
-	"github.com/xenolf/lego/acmev2"
+	"github.com/xenolf/lego/acme"
 	"github.com/xenolf/lego/providers/dns"
 )
 
@@ -36,24 +36,24 @@ var (
 )
 
 // ACME allows to connect to lets encrypt and retrieve certs
-// Deprecated Please use provider/acme/Provider
 type ACME struct {
-	Email                 string                      `description:"Email address used for registration"`
-	Domains               []types.Domain              `description:"SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='main.net,san1.net,san2.net'"`
-	Storage               string                      `description:"File or key used for certificates storage."`
-	StorageFile           string                      // deprecated
-	OnDemand              bool                        `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` //deprecated
-	OnHostRule            bool                        `description:"Enable certificate generation on frontends Host rules."`
-	CAServer              string                      `description:"CA server to use."`
-	EntryPoint            string                      `description:"Entrypoint to proxy acme challenge to."`
-	DNSChallenge          *acmeprovider.DNSChallenge  `description:"Activate DNS-01 Challenge"`
-	HTTPChallenge         *acmeprovider.HTTPChallenge `description:"Activate HTTP-01 Challenge"`
-	DNSProvider           string                      `description:"Activate DNS-01 Challenge (Deprecated)"`                                                       // deprecated
-	DelayDontCheckDNS     flaeg.Duration              `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."` // deprecated
-	ACMELogging           bool                        `description:"Enable debug logging of ACME actions."`
+	Email                 string         `description:"Email address used for registration"`
+	Domains               []Domain       `description:"SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='main.net,san1.net,san2.net'"`
+	Storage               string         `description:"File or key used for certificates storage."`
+	StorageFile           string         // deprecated
+	OnDemand              bool           `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` //deprecated
+	OnHostRule            bool           `description:"Enable certificate generation on frontends Host rules."`
+	CAServer              string         `description:"CA server to use."`
+	EntryPoint            string         `description:"Entrypoint to proxy acme challenge to."`
+	DNSChallenge          *DNSChallenge  `description:"Activate DNS-01 Challenge"`
+	HTTPChallenge         *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
+	DNSProvider           string         `description:"Use a DNS-01 acme challenge rather than TLS-SNI-01 challenge."`                                // deprecated
+	DelayDontCheckDNS     flaeg.Duration `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."` // deprecated
+	ACMELogging           bool           `description:"Enable debug logging of ACME actions."`
 	client                *acme.Client
 	defaultCertificate    *tls.Certificate
 	store                 cluster.Store
+	challengeTLSProvider  *challengeTLSProvider
 	challengeHTTPProvider *challengeHTTPProvider
 	checkOnDemandDomain   func(domain string) bool
 	jobs                  *channels.InfiniteChannel
@@ -61,6 +61,58 @@ type ACME struct {
 	dynamicCerts          *safe.Safe
 }
 
+// DNSChallenge contains DNS challenge Configuration
+type DNSChallenge struct {
+	Provider         string         `description:"Use a DNS-01 based challenge provider rather than HTTPS."`
+	DelayBeforeCheck flaeg.Duration `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."`
+}
+
+// HTTPChallenge contains HTTP challenge Configuration
+type HTTPChallenge struct {
+	EntryPoint string `description:"HTTP challenge EntryPoint"`
+}
+
+//Domains parse []Domain
+type Domains []Domain
+
+//Set []Domain
+func (ds *Domains) Set(str string) error {
+	fargs := func(c rune) bool {
+		return c == ',' || c == ';'
+	}
+	// get function
+	slice := strings.FieldsFunc(str, fargs)
+	if len(slice) < 1 {
+		return fmt.Errorf("Parse error ACME.Domain. Imposible to parse %s", str)
+	}
+	d := Domain{
+		Main: slice[0],
+		SANs: []string{},
+	}
+	if len(slice) > 1 {
+		d.SANs = slice[1:]
+	}
+	*ds = append(*ds, d)
+	return nil
+}
+
+//Get []Domain
+func (ds *Domains) Get() interface{} { return []Domain(*ds) }
+
+//String returns []Domain in string
+func (ds *Domains) String() string { return fmt.Sprintf("%+v", *ds) }
+
+//SetValue sets []Domain into the parser
+func (ds *Domains) SetValue(val interface{}) {
+	*ds = Domains(val.([]Domain))
+}
+
+// Domain holds a domain name with SANs
+type Domain struct {
+	Main string
+	SANs []string
+}
+
 func (a *ACME) init() error {
 	// FIXME temporary fix, waiting for https://github.com/xenolf/lego/pull/478
 	acme.HTTPClient = http.Client{
@@ -159,6 +211,7 @@ func (a *ACME) CreateClusterConfig(leadership *cluster.Leadership, tlsConfig *tl
 	}
 
 	a.store = datastore
+	a.challengeTLSProvider = &challengeTLSProvider{store: a.store}
 
 	ticker := time.NewTicker(24 * time.Hour)
 	leadership.Pool.AddGoCtx(func(ctx context.Context) {
@@ -184,30 +237,20 @@ func (a *ACME) leadershipListener(elected bool) error {
 		if err != nil {
 			return err
 		}
-
 		transaction, object, err := a.store.Begin()
 		if err != nil {
 			return err
 		}
-
 		account := object.(*Account)
 		account.Init()
-
 		var needRegister bool
 		if account == nil || len(account.Email) == 0 {
-			domainsCerts := DomainsCertificates{Certs: []*DomainsCertificate{}}
-			if account != nil {
-				domainsCerts = account.DomainsCertificate
-			}
-
-			account, err = NewAccount(a.Email, domainsCerts.Certs)
+			account, err = NewAccount(a.Email)
 			if err != nil {
 				return err
 			}
-
 			needRegister = true
 		}
-
 		a.client, err = a.buildACMEClient(account)
 		if err != nil {
 			return err
@@ -215,15 +258,29 @@ func (a *ACME) leadershipListener(elected bool) error {
 		if needRegister {
 			// New users will need to register; be sure to save it
 			log.Debug("Register...")
-
-			reg, err := a.client.Register(true)
+			reg, err := a.client.Register()
 			if err != nil {
 				return err
 			}
-
 			account.Registration = reg
 		}
-
+		// The client has a URL to the current Let's Encrypt Subscriber
+		// Agreement. The user will need to agree to it.
+		log.Debug("AgreeToTOS...")
+		err = a.client.AgreeToTOS()
+		if err != nil {
+			log.Debug(err)
+			// Let's Encrypt Subscriber Agreement renew ?
+			reg, err := a.client.QueryRegistration()
+			if err != nil {
+				return err
+			}
+			account.Registration = reg
+			err = a.client.AgreeToTOS()
+			if err != nil {
+				log.Errorf("Error sending ACME agreement to TOS: %+v: %s", account, err.Error())
+			}
+		}
 		err = transaction.Commit(account)
 		if err != nil {
 			return err
@@ -236,6 +293,104 @@ func (a *ACME) leadershipListener(elected bool) error {
 	return nil
 }
 
+// CreateLocalConfig creates a tls.config using local ACME configuration
+func (a *ACME) CreateLocalConfig(tlsConfig *tls.Config, certs *safe.Safe, checkOnDemandDomain func(domain string) bool) error {
+	defer a.runJobs()
+	err := a.init()
+	if err != nil {
+		return err
+	}
+	if len(a.Storage) == 0 {
+		return errors.New("Empty Store, please provide a filename for certs storage")
+	}
+	a.checkOnDemandDomain = checkOnDemandDomain
+	a.dynamicCerts = certs
+	tlsConfig.Certificates = append(tlsConfig.Certificates, *a.defaultCertificate)
+	tlsConfig.GetCertificate = a.getCertificate
+	a.TLSConfig = tlsConfig
+	localStore := NewLocalStore(a.Storage)
+	a.store = localStore
+	a.challengeTLSProvider = &challengeTLSProvider{store: a.store}
+
+	var needRegister bool
+	var account *Account
+
+	if fileInfo, fileErr := os.Stat(a.Storage); fileErr == nil && fileInfo.Size() != 0 {
+		log.Info("Loading ACME Account...")
+		// load account
+		object, err := localStore.Load()
+		if err != nil {
+			return err
+		}
+		account = object.(*Account)
+	} else {
+		log.Info("Generating ACME Account...")
+		account, err = NewAccount(a.Email)
+		if err != nil {
+			return err
+		}
+		needRegister = true
+	}
+
+	a.client, err = a.buildACMEClient(account)
+	if err != nil {
+		log.Errorf(`Failed to build ACME client: %s
+Let's Encrypt functionality will be limited until Traefik is restarted.`, err)
+		return nil
+	}
+
+	if needRegister {
+		// New users will need to register; be sure to save it
+		log.Info("Register...")
+		reg, err := a.client.Register()
+		if err != nil {
+			log.Errorf(`Failed to register user: %s
+Let's Encrypt functionality will be limited until Traefik is restarted.`, err)
+			return nil
+		}
+		account.Registration = reg
+	}
+
+	// The client has a URL to the current Let's Encrypt Subscriber
+	// Agreement. The user will need to agree to it.
+	log.Debug("AgreeToTOS...")
+	err = a.client.AgreeToTOS()
+	if err != nil {
+		// Let's Encrypt Subscriber Agreement renew ?
+		reg, err := a.client.QueryRegistration()
+		if err != nil {
+			log.Errorf(`Failed to renew subscriber agreement: %s
+Let's Encrypt functionality will be limited until Traefik is restarted.`, err)
+			return nil
+		}
+		account.Registration = reg
+		err = a.client.AgreeToTOS()
+		if err != nil {
+			log.Errorf("Error sending ACME agreement to TOS: %+v: %s", account, err.Error())
+		}
+	}
+	// save account
+	transaction, _, err := a.store.Begin()
+	if err != nil {
+		return err
+	}
+	err = transaction.Commit(account)
+	if err != nil {
+		return err
+	}
+
+	a.retrieveCertificates()
+	a.renewCertificates()
+
+	ticker := time.NewTicker(24 * time.Hour)
+	safe.Go(func() {
+		for range ticker.C {
+			a.renewCertificates()
+		}
+	})
+	return nil
+}
+
 func (a *ACME) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
 	domain := types.CanonicalDomain(clientHello.ServerName)
 	account := a.store.Get().(*Account)
@@ -244,6 +399,10 @@ func (a *ACME) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificat
 		return providedCertificate, nil
 	}
 
+	if challengeCert, ok := a.challengeTLSProvider.getCertificate(domain); ok {
+		log.Debugf("ACME got challenge %s", domain)
+		return challengeCert, nil
+	}
 	if domainCert, ok := account.DomainsCertificate.getCertificateForDomain(domain); ok {
 		log.Debugf("ACME got domain cert %s", domain)
 		return domainCert.tlsCert, nil
@@ -261,50 +420,36 @@ func (a *ACME) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificat
 func (a *ACME) retrieveCertificates() {
 	a.jobs.In() <- func() {
 		log.Info("Retrieving ACME certificates...")
-
-		a.deleteUnnecessaryDomains()
-
-		for i := 0; i < len(a.Domains); i++ {
-			domain := a.Domains[i]
-
+		for _, domain := range a.Domains {
 			// check if cert isn't already loaded
 			account := a.store.Get().(*Account)
 			if _, exists := account.DomainsCertificate.exists(domain); !exists {
-				var domains []string
+				domains := []string{}
 				domains = append(domains, domain.Main)
 				domains = append(domains, domain.SANs...)
-				domains, err := a.getValidDomains(domains, true)
-				if err != nil {
-					log.Errorf("Error validating ACME certificate for domain %q: %s", domains, err)
-					continue
-				}
-
 				certificateResource, err := a.getDomainsCertificates(domains)
 				if err != nil {
-					log.Errorf("Error getting ACME certificate for domain %q: %s", domains, err)
+					log.Errorf("Error getting ACME certificate for domain %s: %s", domains, err.Error())
 					continue
 				}
-
 				transaction, object, err := a.store.Begin()
 				if err != nil {
-					log.Errorf("Error creating ACME store transaction from domain %q: %s", domain, err)
+					log.Errorf("Error creating ACME store transaction from domain %s: %s", domain, err.Error())
 					continue
 				}
-
 				account = object.(*Account)
 				_, err = account.DomainsCertificate.addCertificateForDomains(certificateResource, domain)
 				if err != nil {
-					log.Errorf("Error adding ACME certificate for domain %q: %s", domains, err)
+					log.Errorf("Error adding ACME certificate for domain %s: %s", domains, err.Error())
 					continue
 				}
 
 				if err = transaction.Commit(account); err != nil {
-					log.Errorf("Error Saving ACME account %+v: %s", account, err)
+					log.Errorf("Error Saving ACME account %+v: %s", account, err.Error())
 					continue
 				}
 			}
 		}
-
 		log.Info("Retrieved ACME certificates")
 	}
 }
@@ -322,7 +467,7 @@ func (a *ACME) renewCertificates() {
 					continue
 				}
 				operation := func() error {
-					return a.storeRenewedCertificate(certificateResource, renewedACMECert)
+					return a.storeRenewedCertificate(account, certificateResource, renewedACMECert)
 				}
 				notify := func(err error, time time.Duration) {
 					log.Warnf("Renewed certificate storage error: %v, retrying in %s", err, time)
@@ -360,14 +505,14 @@ func (a *ACME) renewACMECertificate(certificateResource *DomainsCertificate) (*C
 	}, nil
 }
 
-func (a *ACME) storeRenewedCertificate(certificateResource *DomainsCertificate, renewedACMECert *Certificate) error {
+func (a *ACME) storeRenewedCertificate(account *Account, certificateResource *DomainsCertificate, renewedACMECert *Certificate) error {
 	transaction, object, err := a.store.Begin()
 	if err != nil {
 		return fmt.Errorf("error during transaction initialization for renewing certificate: %v", err)
 	}
 
 	log.Infof("Renewing certificate in data store : %+v ", certificateResource.Domains)
-	account := object.(*Account)
+	account = object.(*Account)
 	err = account.DomainsCertificate.renewCertificates(renewedACMECert, certificateResource.Domains)
 	if err != nil {
 		return fmt.Errorf("error renewing certificate in datastore: %v ", err)
@@ -405,7 +550,7 @@ func dnsOverrideDelay(delay flaeg.Duration) error {
 
 func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
 	log.Debug("Building ACME client...")
-	caServer := "https://acme-v02.api.letsencrypt.org/directory"
+	caServer := "https://acme-v01.api.letsencrypt.org/directory"
 	if len(a.CAServer) > 0 {
 		caServer = a.CAServer
 	}
@@ -428,15 +573,15 @@ func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
 			return nil, err
 		}
 
-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01})
+		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSSNI01})
 		err = client.SetChallengeProvider(acme.DNS01, provider)
 	} else if a.HTTPChallenge != nil && len(a.HTTPChallenge.EntryPoint) > 0 {
-		log.Debug("Using HTTP Challenge provider.")
-		client.ExcludeChallenges([]acme.Challenge{acme.DNS01})
+		client.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSSNI01})
 		a.challengeHTTPProvider = &challengeHTTPProvider{store: a.store}
 		err = client.SetChallengeProvider(acme.HTTP01, a.challengeHTTPProvider)
 	} else {
-		return nil, errors.New("ACME challenge not specified, please select HTTP or DNS Challenge")
+		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
+		err = client.SetChallengeProvider(acme.TLSSNI01, a.challengeTLSProvider)
 	}
 
 	if err != nil {
@@ -462,7 +607,7 @@ func (a *ACME) loadCertificateOnDemand(clientHello *tls.ClientHelloInfo) (*tls.C
 		return nil, err
 	}
 	account = object.(*Account)
-	cert, err := account.DomainsCertificate.addCertificateForDomains(certificate, types.Domain{Main: domain})
+	cert, err := account.DomainsCertificate.addCertificateForDomains(certificate, Domain{Main: domain})
 	if err != nil {
 		return nil, err
 	}
@@ -477,12 +622,13 @@ func (a *ACME) LoadCertificateForDomains(domains []string) {
 	a.jobs.In() <- func() {
 		log.Debugf("LoadCertificateForDomains %v...", domains)
 
-		domains, err := a.getValidDomains(domains, false)
-		if err != nil {
-			log.Errorf("Error getting valid domain: %v", err)
+		if len(domains) == 0 {
+			// no domain
 			return
 		}
 
+		domains = fun.Map(types.CanonicalDomain, domains).([]string)
+
 		operation := func() error {
 			if a.client == nil {
 				return errors.New("ACME client still not built")
@@ -494,7 +640,7 @@ func (a *ACME) LoadCertificateForDomains(domains []string) {
 		}
 		ebo := backoff.NewExponentialBackOff()
 		ebo.MaxElapsedTime = 30 * time.Second
-		err = backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
 		if err != nil {
 			log.Errorf("Error getting ACME client: %v", err)
 			return
@@ -518,11 +664,11 @@ func (a *ACME) LoadCertificateForDomains(domains []string) {
 			log.Errorf("Error creating transaction %+v : %v", uncheckedDomains, err)
 			return
 		}
-		var domain types.Domain
+		var domain Domain
 		if len(uncheckedDomains) > 1 {
-			domain = types.Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
+			domain = Domain{Main: uncheckedDomains[0], SANs: uncheckedDomains[1:]}
 		} else {
-			domain = types.Domain{Main: uncheckedDomains[0]}
+			domain = Domain{Main: uncheckedDomains[0]}
 		}
 		account = object.(*Account)
 		_, err = account.DomainsCertificate.addCertificateForDomains(certificate, domain)
@@ -543,7 +689,7 @@ func (a *ACME) getProvidedCertificate(domains string) *tls.Certificate {
 	log.Debugf("Looking for provided certificate to validate %s...", domains)
 	cert := searchProvidedCertificateForDomains(domains, a.TLSConfig.NameToCertificate)
 	if cert == nil && a.dynamicCerts != nil && a.dynamicCerts.Get() != nil {
-		cert = searchProvidedCertificateForDomains(domains, a.dynamicCerts.Get().(map[string]*tls.Certificate))
+		cert = searchProvidedCertificateForDomains(domains, a.dynamicCerts.Get().(*traefikTls.DomainsCertificates).Get().(map[string]*tls.Certificate))
 	}
 	if cert == nil {
 		log.Debugf("No provided certificate found for domains %s, get ACME certificate.", domains)
@@ -554,14 +700,15 @@ func (a *ACME) getProvidedCertificate(domains string) *tls.Certificate {
 func searchProvidedCertificateForDomains(domain string, certs map[string]*tls.Certificate) *tls.Certificate {
 	// Use regex to test for provided certs that might have been added into TLSConfig
 	for certDomains := range certs {
-		domainChecked := false
+		domainCheck := false
 		for _, certDomain := range strings.Split(certDomains, ",") {
-			domainChecked = types.MatchDomain(domain, certDomain)
-			if domainChecked {
+			selector := "^" + strings.Replace(certDomain, "*.", "[^\\.]*\\.?", -1) + "$"
+			domainCheck, _ = regexp.MatchString(selector, domain)
+			if domainCheck {
 				break
 			}
 		}
-		if domainChecked {
+		if domainCheck {
 			log.Debugf("Domain %q checked by provided certificate %q", domain, certDomains)
 			return certs[certDomains]
 		}
@@ -582,7 +729,7 @@ func (a *ACME) getUncheckedDomains(domains []string, account *Account) []string
 
 	// Get dynamic certificates
 	if a.dynamicCerts != nil && a.dynamicCerts.Get() != nil {
-		for domains, certificate := range a.dynamicCerts.Get().(map[string]*tls.Certificate) {
+		for domains, certificate := range a.dynamicCerts.Get().(*traefikTls.DomainsCertificates).Get().(map[string]*tls.Certificate) {
 			allCerts[domains] = certificate
 		}
 	}
@@ -594,25 +741,31 @@ func (a *ACME) getUncheckedDomains(domains []string, account *Account) []string
 		}
 	}
 
-	// Get Configuration Domains
-	for i := 0; i < len(a.Domains); i++ {
-		allCerts[a.Domains[i].Main] = &tls.Certificate{}
-		for _, san := range a.Domains[i].SANs {
-			allCerts[san] = &tls.Certificate{}
-		}
-	}
-
 	return searchUncheckedDomains(domains, allCerts)
 }
 
 func searchUncheckedDomains(domains []string, certs map[string]*tls.Certificate) []string {
-	var uncheckedDomains []string
+	uncheckedDomains := []string{}
 	for _, domainToCheck := range domains {
-		if !isDomainAlreadyChecked(domainToCheck, certs) {
+		domainCheck := false
+		for certDomains := range certs {
+			domainCheck = false
+			for _, certDomain := range strings.Split(certDomains, ",") {
+				// Use regex to test for provided certs that might have been added into TLSConfig
+				selector := "^" + strings.Replace(certDomain, "*.", "[^\\.]*\\.?", -1) + "$"
+				domainCheck, _ = regexp.MatchString(selector, domainToCheck)
+				if domainCheck {
+					break
+				}
+			}
+			if domainCheck {
+				break
+			}
+		}
+		if !domainCheck {
 			uncheckedDomains = append(uncheckedDomains, domainToCheck)
 		}
 	}
-
 	if len(uncheckedDomains) == 0 {
 		log.Debugf("No ACME certificate to generate for domains %q.", domains)
 	} else {
@@ -648,99 +801,3 @@ func (a *ACME) runJobs() {
 		}
 	})
 }
-
-// getValidDomains checks if given domain is allowed to generate a ACME certificate and return it
-func (a *ACME) getValidDomains(domains []string, wildcardAllowed bool) ([]string, error) {
-	if len(domains) == 0 || (len(domains) == 1 && len(domains[0]) == 0) {
-		return nil, errors.New("unable to generate a certificate when no domain is given")
-	}
-
-	if strings.HasPrefix(domains[0], "*") {
-		if !wildcardAllowed {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q from a 'Host' rule", strings.Join(domains, ","))
-		}
-
-		if a.DNSChallenge == nil && len(a.DNSProvider) == 0 {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q : ACME needs a DNSChallenge", strings.Join(domains, ","))
-		}
-
-		if len(domains) > 1 {
-			return nil, fmt.Errorf("unable to generate a wildcard certificate for domain %q : SANs are not allowed", strings.Join(domains, ","))
-		}
-	} else {
-		for _, san := range domains[1:] {
-			if strings.HasPrefix(san, "*") {
-				return nil, fmt.Errorf("unable to generate a certificate in ACME provider for domains %q: SANs can not be a wildcard domain", strings.Join(domains, ","))
-			}
-		}
-	}
-
-	domains = fun.Map(types.CanonicalDomain, domains).([]string)
-	return domains, nil
-}
-
-func isDomainAlreadyChecked(domainToCheck string, existentDomains map[string]*tls.Certificate) bool {
-	for certDomains := range existentDomains {
-		for _, certDomain := range strings.Split(certDomains, ",") {
-			if types.MatchDomain(domainToCheck, certDomain) {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// deleteUnnecessaryDomains deletes from the configuration :
-// - Duplicated domains
-// - Domains which are checked by wildcard domain
-func (a *ACME) deleteUnnecessaryDomains() {
-	var newDomains []types.Domain
-
-	for idxDomainToCheck, domainToCheck := range a.Domains {
-		keepDomain := true
-
-		for idxDomain, domain := range a.Domains {
-			if idxDomainToCheck == idxDomain {
-				continue
-			}
-
-			if reflect.DeepEqual(domain, domainToCheck) {
-				if idxDomainToCheck > idxDomain {
-					log.Warnf("The domain %v is duplicated in the configuration but will be process by ACME only once.", domainToCheck)
-					keepDomain = false
-				}
-				break
-			} else if strings.HasPrefix(domain.Main, "*") && domain.SANs == nil {
-				// Check if domains can be validated by the wildcard domain
-
-				var newDomainsToCheck []string
-
-				// Check if domains can be validated by the wildcard domain
-				domainsMap := make(map[string]*tls.Certificate)
-				domainsMap[domain.Main] = &tls.Certificate{}
-
-				for _, domainProcessed := range domainToCheck.ToStrArray() {
-					if isDomainAlreadyChecked(domainProcessed, domainsMap) {
-						log.Warnf("Domain %q will not be processed by ACME because it is validated by the wildcard %q", domainProcessed, domain.Main)
-						continue
-					}
-					newDomainsToCheck = append(newDomainsToCheck, domainProcessed)
-				}
-
-				// Delete the domain if both Main and SANs can be validated by the wildcard domain
-				// otherwise keep the unchecked values
-				if newDomainsToCheck == nil {
-					keepDomain = false
-					break
-				}
-				domainToCheck.Set(newDomainsToCheck)
-			}
-		}
-
-		if keepDomain {
-			newDomains = append(newDomains, domainToCheck)
-		}
-	}
-
-	a.Domains = newDomains
-}

acme/acme_test.go

@@ -10,122 +10,76 @@ import (
 	"testing"
 	"time"
 
-	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/tls/generate"
-	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
-	"github.com/xenolf/lego/acmev2"
+	"github.com/xenolf/lego/acme"
 )
 
 func TestDomainsSet(t *testing.T) {
-	testCases := []struct {
-		input    string
-		expected types.Domains
-	}{
-		{
-			input:    "",
-			expected: types.Domains{},
-		},
-		{
-			input: "foo1.com",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-			},
-		},
-		{
-			input: "foo2.com,bar.net",
-			expected: types.Domains{
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-			},
-		},
-		{
-			input: "foo3.com,bar1.net,bar2.net,bar3.net",
-			expected: types.Domains{
-				types.Domain{
-					Main: "foo3.com",
-					SANs: []string{"bar1.net", "bar2.net", "bar3.net"},
-				},
-			},
-		},
+	checkMap := map[string]Domains{
+		"":                                   {},
+		"foo.com":                            {Domain{Main: "foo.com", SANs: []string{}}},
+		"foo.com,bar.net":                    {Domain{Main: "foo.com", SANs: []string{"bar.net"}}},
+		"foo.com,bar1.net,bar2.net,bar3.net": {Domain{Main: "foo.com", SANs: []string{"bar1.net", "bar2.net", "bar3.net"}}},
 	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.input, func(t *testing.T) {
-			t.Parallel()
-
-			domains := types.Domains{}
-			domains.Set(test.input)
-			assert.Exactly(t, test.expected, domains)
-		})
+	for in, check := range checkMap {
+		ds := Domains{}
+		ds.Set(in)
+		if !reflect.DeepEqual(check, ds) {
+			t.Errorf("Expected %+v\nGot %+v", check, ds)
+		}
 	}
 }
 
 func TestDomainsSetAppend(t *testing.T) {
-	testCases := []struct {
-		input    string
-		expected types.Domains
-	}{
-		{
-			input:    "",
-			expected: types.Domains{},
-		},
-		{
-			input: "foo1.com",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-			},
-		},
-		{
-			input: "foo2.com,bar.net",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-			},
-		},
-		{
-			input: "foo3.com,bar1.net,bar2.net,bar3.net",
-			expected: types.Domains{
-				types.Domain{Main: "foo1.com"},
-				types.Domain{
-					Main: "foo2.com",
-					SANs: []string{"bar.net"},
-				},
-				types.Domain{
-					Main: "foo3.com",
-					SANs: []string{"bar1.net", "bar2.net", "bar3.net"},
-				},
-			},
-		},
+	inSlice := []string{
+		"",
+		"foo1.com",
+		"foo2.com,bar.net",
+		"foo3.com,bar1.net,bar2.net,bar3.net",
 	}
-
-	// append to
-	domains := types.Domains{}
-	for _, test := range testCases {
-		t.Run(test.input, func(t *testing.T) {
-
-			domains.Set(test.input)
-			assert.Exactly(t, test.expected, domains)
-		})
+	checkSlice := []Domains{
+		{},
+		{
+			Domain{
+				Main: "foo1.com",
+				SANs: []string{}}},
+		{
+			Domain{
+				Main: "foo1.com",
+				SANs: []string{}},
+			Domain{
+				Main: "foo2.com",
+				SANs: []string{"bar.net"}}},
+		{
+			Domain{
+				Main: "foo1.com",
+				SANs: []string{}},
+			Domain{
+				Main: "foo2.com",
+				SANs: []string{"bar.net"}},
+			Domain{Main: "foo3.com",
+				SANs: []string{"bar1.net", "bar2.net", "bar3.net"}}},
+	}
+	ds := Domains{}
+	for i, in := range inSlice {
+		ds.Set(in)
+		if !reflect.DeepEqual(checkSlice[i], ds) {
+			t.Errorf("Expected  %s %+v\nGot %+v", in, checkSlice[i], ds)
+		}
 	}
 }
 
 func TestCertificatesRenew(t *testing.T) {
 	foo1Cert, foo1Key, _ := generate.KeyPair("foo1.com", time.Now())
 	foo2Cert, foo2Key, _ := generate.KeyPair("foo2.com", time.Now())
-
 	domainsCertificates := DomainsCertificates{
 		lock: sync.RWMutex{},
 		Certs: []*DomainsCertificate{
 			{
-				Domains: types.Domain{
-					Main: "foo1.com"},
+				Domains: Domain{
+					Main: "foo1.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo1.com",
 					CertURL:       "url",
@@ -135,8 +89,9 @@ func TestCertificatesRenew(t *testing.T) {
 				},
 			},
 			{
-				Domains: types.Domain{
-					Main: "foo2.com"},
+				Domains: Domain{
+					Main: "foo2.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo2.com",
 					CertURL:       "url",
@@ -147,7 +102,6 @@ func TestCertificatesRenew(t *testing.T) {
 			},
 		},
 	}
-
 	foo1Cert, foo1Key, _ = generate.KeyPair("foo1.com", time.Now())
 	newCertificate := &Certificate{
 		Domain:        "foo1.com",
@@ -157,15 +111,17 @@ func TestCertificatesRenew(t *testing.T) {
 		Certificate:   foo1Cert,
 	}
 
-	err := domainsCertificates.renewCertificates(newCertificate, types.Domain{Main: "foo1.com"})
+	err := domainsCertificates.renewCertificates(
+		newCertificate,
+		Domain{
+			Main: "foo1.com",
+			SANs: []string{}})
 	if err != nil {
 		t.Errorf("Error in renewCertificates :%v", err)
 	}
-
 	if len(domainsCertificates.Certs) != 2 {
 		t.Errorf("Expected domainsCertificates length %d %+v\nGot %+v", 2, domainsCertificates.Certs, len(domainsCertificates.Certs))
 	}
-
 	if !reflect.DeepEqual(domainsCertificates.Certs[0].Certificate, newCertificate) {
 		t.Errorf("Expected new certificate %+v \nGot %+v", newCertificate, domainsCertificates.Certs[0].Certificate)
 	}
@@ -181,8 +137,9 @@ func TestRemoveDuplicates(t *testing.T) {
 		lock: sync.RWMutex{},
 		Certs: []*DomainsCertificate{
 			{
-				Domains: types.Domain{
-					Main: "foo.com"},
+				Domains: Domain{
+					Main: "foo.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo.com",
 					CertURL:       "url",
@@ -192,8 +149,9 @@ func TestRemoveDuplicates(t *testing.T) {
 				},
 			},
 			{
-				Domains: types.Domain{
-					Main: "foo.com"},
+				Domains: Domain{
+					Main: "foo.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo.com",
 					CertURL:       "url",
@@ -203,8 +161,9 @@ func TestRemoveDuplicates(t *testing.T) {
 				},
 			},
 			{
-				Domains: types.Domain{
-					Main: "foo.com"},
+				Domains: Domain{
+					Main: "foo.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo.com",
 					CertURL:       "url",
@@ -214,8 +173,9 @@ func TestRemoveDuplicates(t *testing.T) {
 				},
 			},
 			{
-				Domains: types.Domain{
-					Main: "bar.com"},
+				Domains: Domain{
+					Main: "bar.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "bar.com",
 					CertURL:       "url",
@@ -225,8 +185,9 @@ func TestRemoveDuplicates(t *testing.T) {
 				},
 			},
 			{
-				Domains: types.Domain{
-					Main: "foo.com"},
+				Domains: Domain{
+					Main: "foo.com",
+					SANs: []string{}},
 				Certificate: &Certificate{
 					Domain:        "foo.com",
 					CertURL:       "url",
@@ -299,19 +260,14 @@ llJh9MC0svjevGtNlxJoE3lmEQIhAKXy1wfZ32/XtcrnENPvi6lzxI0T94X7s5pP3aCoPPoJAiEAl
 cijFkALeQp/qyeXdFld2v9gUN3eCgljgcl0QweRoIc=---`)
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte(`{
-  "GPHhmRVEDas": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
-  "keyChange": "https://foo/acme/key-change",
-  "meta": {
-    "termsOfService": "https://boulder:4431/terms/v7"
-  },
-  "newAccount": "https://foo/acme/new-acct",
-  "newNonce": "https://foo/acme/new-nonce",
-  "newOrder": "https://foo/acme/new-order",
-  "revokeCert": "https://foo/acme/revoke-cert"
+"new-authz": "https://foo/acme/new-authz",
+"new-cert": "https://foo/acme/new-cert",
+"new-reg": "https://foo/acme/new-reg",
+"revoke-cert": "https://foo/acme/revoke-cert"
 }`))
 	}))
 	defer ts.Close()
-	a := ACME{DNSChallenge: &acmeprovider.DNSChallenge{Provider: "manual", DelayBeforeCheck: 10}, CAServer: ts.URL}
+	a := ACME{DNSChallenge: &DNSChallenge{Provider: "manual", DelayBeforeCheck: 10}, CAServer: ts.URL}
 
 	client, err := a.buildACMEClient(account)
 	if err != nil {
@@ -341,7 +297,7 @@ func TestAcme_getUncheckedCertificates(t *testing.T) {
 	domainsCertificates := DomainsCertificates{Certs: []*DomainsCertificate{
 		{
 			tlsCert: &tls.Certificate{},
-			Domains: types.Domain{
+			Domains: Domain{
 				Main: "*.acme.wtf",
 				SANs: []string{"trae.acme.io"},
 			},
@@ -366,171 +322,3 @@ func TestAcme_getProvidedCertificate(t *testing.T) {
 	certificate = a.getProvidedCertificate(domain)
 	assert.Nil(t, certificate)
 }
-
-func TestAcme_getValidDomain(t *testing.T) {
-	testCases := []struct {
-		desc            string
-		domains         []string
-		wildcardAllowed bool
-		dnsChallenge    *acmeprovider.DNSChallenge
-		expectedErr     string
-		expectedDomains []string
-	}{
-		{
-			desc:            "valid wildcard",
-			domains:         []string{"*.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "",
-			expectedDomains: []string{"*.traefik.wtf"},
-		},
-		{
-			desc:            "no wildcard",
-			domains:         []string{"traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			expectedErr:     "",
-			wildcardAllowed: true,
-			expectedDomains: []string{"traefik.wtf", "foo.traefik.wtf"},
-		},
-		{
-			desc:            "unauthorized wildcard",
-			domains:         []string{"*.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: false,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.traefik.wtf\" from a 'Host' rule",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "no domain",
-			domains:         []string{},
-			dnsChallenge:    nil,
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a certificate when no domain is given",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "no DNSChallenge",
-			domains:         []string{"*.traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    nil,
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.traefik.wtf,foo.traefik.wtf\" : ACME needs a DNSChallenge",
-			expectedDomains: nil,
-		},
-		{
-			desc:            "unexpected SANs",
-			domains:         []string{"*.traefik.wtf", "foo.traefik.wtf"},
-			dnsChallenge:    &acmeprovider.DNSChallenge{},
-			wildcardAllowed: true,
-			expectedErr:     "unable to generate a wildcard certificate for domain \"*.traefik.wtf,foo.traefik.wtf\" : SANs are not allowed",
-			expectedDomains: nil,
-		},
-	}
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			a := ACME{}
-			if test.dnsChallenge != nil {
-				a.DNSChallenge = test.dnsChallenge
-			}
-			domains, err := a.getValidDomains(test.domains, test.wildcardAllowed)
-
-			if len(test.expectedErr) > 0 {
-				assert.EqualError(t, err, test.expectedErr, "Unexpected error.")
-			} else {
-				assert.Equal(t, len(test.expectedDomains), len(domains), "Unexpected domains.")
-			}
-		})
-	}
-}
-
-func TestAcme_getCertificateForDomain(t *testing.T) {
-	testCases := []struct {
-		desc          string
-		domain        string
-		dc            *DomainsCertificates
-		expected      *DomainsCertificate
-		expectedFound bool
-	}{
-		{
-			desc:   "non-wildcard exact match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected: &DomainsCertificate{
-				Domains: types.Domain{
-					Main: "foo.traefik.wtf",
-				},
-			},
-			expectedFound: true,
-		},
-		{
-			desc:   "non-wildcard no match",
-			domain: "bar.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "foo.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected:      nil,
-			expectedFound: false,
-		},
-		{
-			desc:   "wildcard match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "*.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected: &DomainsCertificate{
-				Domains: types.Domain{
-					Main: "*.traefik.wtf",
-				},
-			},
-			expectedFound: true,
-		},
-		{
-			desc:   "wildcard no match",
-			domain: "foo.traefik.wtf",
-			dc: &DomainsCertificates{
-				Certs: []*DomainsCertificate{
-					{
-						Domains: types.Domain{
-							Main: "*.bar.traefik.wtf",
-						},
-					},
-				},
-			},
-			expected:      nil,
-			expectedFound: false,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.desc, func(t *testing.T) {
-			t.Parallel()
-
-			got, found := test.dc.getCertificateForDomain(test.domain)
-			assert.Equal(t, test.expectedFound, found)
-			assert.Equal(t, test.expected, got)
-		})
-	}
-}

acme/challenge_http_provider.go

@@ -9,7 +9,7 @@ import (
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
-	acme "github.com/xenolf/lego/acmev2"
+	"github.com/xenolf/lego/acme"
 )
 
 var _ acme.ChallengeProviderTimeout = (*challengeHTTPProvider)(nil)

acme/challenge_tls_provider.go

@@ -0,0 +1,150 @@
+package acme
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/pem"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenk/backoff"
+	"github.com/containous/traefik/cluster"
+	"github.com/containous/traefik/log"
+	"github.com/containous/traefik/safe"
+	"github.com/containous/traefik/tls/generate"
+	"github.com/xenolf/lego/acme"
+)
+
+var _ acme.ChallengeProviderTimeout = (*challengeTLSProvider)(nil)
+
+type challengeTLSProvider struct {
+	store cluster.Store
+	lock  sync.RWMutex
+}
+
+func (c *challengeTLSProvider) getCertificate(domain string) (cert *tls.Certificate, exists bool) {
+	log.Debugf("Looking for an existing ACME challenge for %s...", domain)
+	if !strings.HasSuffix(domain, ".acme.invalid") {
+		return nil, false
+	}
+	c.lock.RLock()
+	defer c.lock.RUnlock()
+	account := c.store.Get().(*Account)
+	if account.ChallengeCerts == nil {
+		return nil, false
+	}
+	account.Init()
+	var result *tls.Certificate
+	operation := func() error {
+		for _, cert := range account.ChallengeCerts {
+			for _, dns := range cert.certificate.Leaf.DNSNames {
+				if domain == dns {
+					result = cert.certificate
+					return nil
+				}
+			}
+		}
+		return fmt.Errorf("cannot find challenge cert for domain %s", domain)
+	}
+	notify := func(err error, time time.Duration) {
+		log.Errorf("Error getting cert: %v, retrying in %s", err, time)
+	}
+	ebo := backoff.NewExponentialBackOff()
+	ebo.MaxElapsedTime = 60 * time.Second
+	err := backoff.RetryNotify(safe.OperationWithRecover(operation), ebo, notify)
+	if err != nil {
+		log.Errorf("Error getting cert: %v", err)
+		return nil, false
+	}
+	return result, true
+}
+
+func (c *challengeTLSProvider) Present(domain, token, keyAuth string) error {
+	log.Debugf("Challenge Present %s", domain)
+	cert, _, err := tlsSNI01ChallengeCert(keyAuth)
+	if err != nil {
+		return err
+	}
+
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	transaction, object, err := c.store.Begin()
+	if err != nil {
+		return err
+	}
+	account := object.(*Account)
+	if account.ChallengeCerts == nil {
+		account.ChallengeCerts = map[string]*ChallengeCert{}
+	}
+	account.ChallengeCerts[domain] = &cert
+	return transaction.Commit(account)
+}
+
+func (c *challengeTLSProvider) CleanUp(domain, token, keyAuth string) error {
+	log.Debugf("Challenge CleanUp %s", domain)
+	c.lock.Lock()
+	defer c.lock.Unlock()
+	transaction, object, err := c.store.Begin()
+	if err != nil {
+		return err
+	}
+	account := object.(*Account)
+	delete(account.ChallengeCerts, domain)
+	return transaction.Commit(account)
+}
+
+func (c *challengeTLSProvider) Timeout() (timeout, interval time.Duration) {
+	return 60 * time.Second, 5 * time.Second
+}
+
+// tlsSNI01ChallengeCert returns a certificate and target domain for the `tls-sni-01` challenge
+func tlsSNI01ChallengeCert(keyAuth string) (ChallengeCert, string, error) {
+	// generate a new RSA key for the certificates
+	var tempPrivKey crypto.PrivateKey
+	tempPrivKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return ChallengeCert{}, "", err
+	}
+	rsaPrivKey := tempPrivKey.(*rsa.PrivateKey)
+	rsaPrivPEM := pemEncode(rsaPrivKey)
+
+	zBytes := sha256.Sum256([]byte(keyAuth))
+	z := hex.EncodeToString(zBytes[:sha256.Size])
+	domain := fmt.Sprintf("%s.%s.acme.invalid", z[:32], z[32:])
+	tempCertPEM, err := generate.PemCert(rsaPrivKey, domain, time.Time{})
+	if err != nil {
+		return ChallengeCert{}, "", err
+	}
+
+	certificate, err := tls.X509KeyPair(tempCertPEM, rsaPrivPEM)
+	if err != nil {
+		return ChallengeCert{}, "", err
+	}
+
+	return ChallengeCert{Certificate: tempCertPEM, PrivateKey: rsaPrivPEM, certificate: &certificate}, domain, nil
+}
+
+func pemEncode(data interface{}) []byte {
+	var pemBlock *pem.Block
+	switch key := data.(type) {
+	case *ecdsa.PrivateKey:
+		keyBytes, _ := x509.MarshalECPrivateKey(key)
+		pemBlock = &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyBytes}
+	case *rsa.PrivateKey:
+		pemBlock = &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
+	case *x509.CertificateRequest:
+		pemBlock = &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: key.Raw}
+	case []byte:
+		pemBlock = &pem.Block{Type: "CERTIFICATE", Bytes: []byte(data.([]byte))}
+	}
+
+	return pem.EncodeToMemory(pemBlock)
+}

acme/localStore.go

@@ -2,17 +2,22 @@ package acme
 
 import (
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"os"
-	"regexp"
+	"sync"
 
+	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/acme"
 )
 
+var _ cluster.Store = (*LocalStore)(nil)
+
 // LocalStore is a store using a file as storage
 type LocalStore struct {
-	file string
+	file        string
+	storageLock sync.RWMutex
+	account     *Account
 }
 
 // NewLocalStore create a LocalStore
@@ -22,148 +27,71 @@ func NewLocalStore(file string) *LocalStore {
 	}
 }
 
-// Get loads file into store and returns the Account
-func (s *LocalStore) Get() (*Account, error) {
+// Get atomically a struct from the file storage
+func (s *LocalStore) Get() cluster.Object {
+	s.storageLock.RLock()
+	defer s.storageLock.RUnlock()
+	return s.account
+}
+
+// Load loads file into store
+func (s *LocalStore) Load() (cluster.Object, error) {
+	s.storageLock.Lock()
+	defer s.storageLock.Unlock()
 	account := &Account{}
 
-	hasData, err := checkFile(s.file)
+	err := checkPermissions(s.file)
 	if err != nil {
 		return nil, err
 	}
-
-	if hasData {
-		f, err := os.Open(s.file)
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-
-		file, err := ioutil.ReadAll(f)
-		if err != nil {
-			return nil, err
-		}
-
-		if err := json.Unmarshal(file, &account); err != nil {
-			return nil, err
-		}
-
-		// Check if ACME Account is in ACME V1 format
-		if account != nil && account.Registration != nil {
-			isOldRegistration, err := regexp.MatchString(acme.RegistrationURLPathV1Regexp, account.Registration.URI)
-			if err != nil {
-				return nil, err
-			}
-
-			if isOldRegistration {
-				account.Email = ""
-				account.Registration = nil
-				account.PrivateKey = nil
-			}
-		}
+	f, err := os.Open(s.file)
+	if err != nil {
+		return nil, err
 	}
-
+	defer f.Close()
+	file, err := ioutil.ReadAll(f)
+	if err != nil {
+		return nil, err
+	}
+	if err := json.Unmarshal(file, &account); err != nil {
+		return nil, err
+	}
+	account.Init()
+	s.account = account
+	log.Infof("Loaded ACME config from store %s", s.file)
 	return account, nil
 }
 
-// ConvertToNewFormat converts old acme.json format to the new one and store the result into the file (used for the backward compatibility)
-func ConvertToNewFormat(fileName string) {
-	localStore := acme.NewLocalStore(fileName)
-
-	storeAccount, err := localStore.GetAccount()
-	if err != nil {
-		log.Warnf("Failed to read new account, ACME data conversion is not available : %v", err)
-		return
-	}
-
-	storeCertificates, err := localStore.GetCertificates()
-	if err != nil {
-		log.Warnf("Failed to read new certificates, ACME data conversion is not available : %v", err)
-		return
-	}
-
-	if storeAccount == nil {
-		localStore := NewLocalStore(fileName)
-
-		account, err := localStore.Get()
-		if err != nil {
-			log.Warnf("Failed to read old account, ACME data conversion is not available : %v", err)
-			return
-		}
-
-		// Convert ACME data from old to new format
-		newAccount := &acme.Account{}
-		if account != nil && len(account.Email) > 0 {
-			newAccount = &acme.Account{
-				PrivateKey:   account.PrivateKey,
-				Registration: account.Registration,
-				Email:        account.Email,
-			}
-
-			var newCertificates []*acme.Certificate
-			for _, cert := range account.DomainsCertificate.Certs {
-				newCertificates = append(newCertificates, &acme.Certificate{
-					Certificate: cert.Certificate.Certificate,
-					Key:         cert.Certificate.PrivateKey,
-					Domain:      cert.Domains,
-				})
-			}
-			// If account is in the old format, storeCertificates is nil or empty
-			// and has to be initialized
-			storeCertificates = newCertificates
-		}
-
-		// Store the data in new format into the file even if account is nil
-		// to delete Account in ACME v1 format and keeping the certificates
-		newLocalStore := acme.NewLocalStore(fileName)
-		newLocalStore.SaveDataChan <- &acme.StoredData{Account: newAccount, Certificates: storeCertificates}
-	}
+// Begin creates a transaction with the KV store.
+func (s *LocalStore) Begin() (cluster.Transaction, cluster.Object, error) {
+	s.storageLock.Lock()
+	return &localTransaction{LocalStore: s}, s.account, nil
 }
 
-// FromNewToOldFormat converts new acme.json format to the old one (used for the backward compatibility)
-func FromNewToOldFormat(fileName string) (*Account, error) {
-	localStore := acme.NewLocalStore(fileName)
+var _ cluster.Transaction = (*localTransaction)(nil)
 
-	storeAccount, err := localStore.GetAccount()
-	if err != nil {
-		return nil, err
-	}
-
-	storeCertificates, err := localStore.GetCertificates()
-	if err != nil {
-		return nil, err
-	}
-
-	// Convert ACME Account from new to old format
-	// (Needed by the KV stores)
-	var account *Account
-	if storeAccount != nil {
-		account = &Account{
-			Email:              storeAccount.Email,
-			PrivateKey:         storeAccount.PrivateKey,
-			Registration:       storeAccount.Registration,
-			DomainsCertificate: DomainsCertificates{},
-		}
-	}
-
-	// Convert ACME Certificates from new to old format
-	// (Needed by the KV stores)
-	if len(storeCertificates) > 0 {
-		// Account can be nil if data are migrated from new format
-		// with a ACME V1 Account
-		if account == nil {
-			account = &Account{}
-		}
-		for _, cert := range storeCertificates {
-			_, err := account.DomainsCertificate.addCertificateForDomains(&Certificate{
-				Domain:      cert.Domain.Main,
-				Certificate: cert.Certificate,
-				PrivateKey:  cert.Key,
-			}, cert.Domain)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	return account, nil
+type localTransaction struct {
+	*LocalStore
+	dirty bool
+}
+
+// Commit allows to set an object in the file storage
+func (t *localTransaction) Commit(object cluster.Object) error {
+	t.LocalStore.account = object.(*Account)
+	defer t.storageLock.Unlock()
+	if t.dirty {
+		return fmt.Errorf("transaction already used, please begin a new one")
+	}
+
+	// write account to file
+	data, err := json.MarshalIndent(object, "", "  ")
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(t.file, data, 0600)
+	if err != nil {
+		return err
+	}
+	t.dirty = true
+	return nil
 }

acme/localStore_test.go

@@ -5,27 +5,37 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
-
-	"github.com/stretchr/testify/assert"
 )
 
-func TestGet(t *testing.T) {
+func TestLoad(t *testing.T) {
 	acmeFile := "./acme_example.json"
 
 	folder, prefix := filepath.Split(acmeFile)
 	tmpFile, err := ioutil.TempFile(folder, prefix)
 	defer os.Remove(tmpFile.Name())
 
-	assert.NoError(t, err)
+	if err != nil {
+		t.Error(err)
+	}
 
 	fileContent, err := ioutil.ReadFile(acmeFile)
-	assert.NoError(t, err)
+	if err != nil {
+		t.Error(err)
+	}
 
 	tmpFile.Write(fileContent)
 
 	localStore := NewLocalStore(tmpFile.Name())
-	account, err := localStore.Get()
-	assert.NoError(t, err)
+	obj, err := localStore.Load()
+	if err != nil {
+		t.Error(err)
+	}
+	account, ok := obj.(*Account)
+	if !ok {
+		t.Error("Object is not an ACME Account")
+	}
 
-	assert.Len(t, account.DomainsCertificate.Certs, 1)
+	if len(account.DomainsCertificate.Certs) != 1 {
+		t.Errorf("Must found %d and found %d certificates in Account", 3, len(account.DomainsCertificate.Certs))
+	}
 }

acme/localStore_unix.go

@@ -7,22 +7,19 @@ import (
 	"os"
 )
 
-// Check file permissions and content size
-func checkFile(name string) (bool, error) {
+// Check file permissions
+func checkPermissions(name string) error {
 	f, err := os.Open(name)
 	if err != nil {
-		return false, err
+		return err
 	}
 	defer f.Close()
-
 	fi, err := f.Stat()
 	if err != nil {
-		return false, err
+		return err
 	}
-
 	if fi.Mode().Perm()&0077 != 0 {
-		return false, fmt.Errorf("permissions %o for %s are too open, please use 600", fi.Mode().Perm(), name)
+		return fmt.Errorf("permissions %o for %s are too open, please use 600", fi.Mode().Perm(), name)
 	}
-
-	return fi.Size() > 0, nil
+	return nil
 }

acme/localStore_windows.go

@@ -1,20 +1,6 @@
 package acme
 
-import "os"
-
-// Check file content size
 // Do not check file permissions on Windows right now
-func checkFile(name string) (bool, error) {
-	f, err := os.Open(name)
-	if err != nil {
-		return false, err
-	}
-	defer f.Close()
-
-	fi, err := f.Stat()
-	if err != nil {
-		return false, err
-	}
-
-	return fi.Size() > 0, nil
+func checkPermissions(name string) error {
+	return nil
 }

build.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.10-alpine
+FROM golang:1.9-alpine
 
 RUN apk --update upgrade \
 && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \

cluster/datastore.go

@@ -7,12 +7,12 @@ import (
 	"sync"
 	"time"
 
-	"github.com/abronan/valkeyrie/store"
 	"github.com/cenk/backoff"
 	"github.com/containous/staert"
 	"github.com/containous/traefik/job"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
+	"github.com/docker/libkv/store"
 	"github.com/satori/go.uuid"
 )
 

cluster/leadership.go

@@ -2,22 +2,15 @@ package cluster
 
 import (
 	"context"
-	"net/http"
 	"time"
 
 	"github.com/cenk/backoff"
-	"github.com/containous/mux"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
 	"github.com/containous/traefik/types"
 	"github.com/docker/leadership"
-	"github.com/unrolled/render"
 )
 
-var templatesRenderer = render.New(render.Options{
-	Directory: "nowhere",
-})
-
 // Leadership allows leadership election using a KV store
 type Leadership struct {
 	*safe.Pool
@@ -105,32 +98,7 @@ func (l *Leadership) onElection(elected bool) {
 	}
 }
 
-type leaderResponse struct {
-	Leader bool `json:"leader"`
-}
-
-func (l *Leadership) getLeaderHandler(response http.ResponseWriter, request *http.Request) {
-	leader := &leaderResponse{Leader: l.IsLeader()}
-
-	status := http.StatusOK
-	if !leader.Leader {
-		// Set status to be `429`, as this will typically cause load balancers to stop sending requests to the instance without removing them from rotation.
-		status = http.StatusTooManyRequests
-	}
-
-	err := templatesRenderer.JSON(response, status, leader)
-	if err != nil {
-		log.Error(err)
-	}
-}
-
 // IsLeader returns true if current node is leader
 func (l *Leadership) IsLeader() bool {
 	return l.leader.Get().(bool)
 }
-
-// AddRoutes add dashboard routes on a router
-func (l *Leadership) AddRoutes(router *mux.Router) {
-	// Expose cluster leader
-	router.Methods(http.MethodGet).Path("/api/cluster/leader").HandlerFunc(l.getLeaderHandler)
-}

cmd/context.go

@@ -1,22 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"os"
-	"os/signal"
-	"syscall"
-)
-
-// ContextWithSignal create a context cancelled when SIGINT or SIGTERM are notified
-func ContextWithSignal(ctx context.Context) context.Context {
-	newCtx, cancel := context.WithCancel(ctx)
-	signals := make(chan os.Signal)
-	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
-	go func() {
-		select {
-		case <-signals:
-			cancel()
-		}
-	}()
-	return newCtx
-}

cmd/traefik/anonymize/anonymize_config_test.go

@@ -9,10 +9,8 @@ import (
 	"github.com/containous/traefik/acme"
 	"github.com/containous/traefik/configuration"
 	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/provider/boltdb"
 	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
 	"github.com/containous/traefik/provider/docker"
 	"github.com/containous/traefik/provider/dynamodb"
 	"github.com/containous/traefik/provider/ecs"
@@ -25,7 +23,7 @@ import (
 	"github.com/containous/traefik/provider/mesos"
 	"github.com/containous/traefik/provider/rancher"
 	"github.com/containous/traefik/provider/zk"
-	traefiktls "github.com/containous/traefik/tls"
+	traefikTls "github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 )
 
@@ -45,15 +43,16 @@ func TestDo_globalConfiguration(t *testing.T) {
 	config.LogLevel = "LogLevel"
 	config.EntryPoints = configuration.EntryPoints{
 		"foo": {
+			Network: "foo Network",
 			Address: "foo Address",
-			TLS: &traefiktls.TLS{
+			TLS: &traefikTls.TLS{
 				MinVersion:   "foo MinVersion",
 				CipherSuites: []string{"foo CipherSuites 1", "foo CipherSuites 2", "foo CipherSuites 3"},
-				Certificates: traefiktls.Certificates{
+				Certificates: traefikTls.Certificates{
 					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
 					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
 				},
-				ClientCA: traefiktls.ClientCA{
+				ClientCA: traefikTls.ClientCA{
 					Files:    []string{"foo ClientCAFiles 1", "foo ClientCAFiles 2", "foo ClientCAFiles 3"},
 					Optional: false,
 				},
@@ -90,15 +89,16 @@ func TestDo_globalConfiguration(t *testing.T) {
 			},
 		},
 		"fii": {
+			Network: "fii Network",
 			Address: "fii Address",
-			TLS: &traefiktls.TLS{
+			TLS: &traefikTls.TLS{
 				MinVersion:   "fii MinVersion",
 				CipherSuites: []string{"fii CipherSuites 1", "fii CipherSuites 2", "fii CipherSuites 3"},
-				Certificates: traefiktls.Certificates{
+				Certificates: traefikTls.Certificates{
 					{CertFile: "CertFile 1", KeyFile: "KeyFile 1"},
 					{CertFile: "CertFile 2", KeyFile: "KeyFile 2"},
 				},
-				ClientCA: traefiktls.ClientCA{
+				ClientCA: traefikTls.ClientCA{
 					Files:    []string{"fii ClientCAFiles 1", "fii ClientCAFiles 2", "fii ClientCAFiles 3"},
 					Optional: false,
 				},
@@ -156,7 +156,7 @@ func TestDo_globalConfiguration(t *testing.T) {
 	}
 	config.ACME = &acme.ACME{
 		Email: "acme Email",
-		Domains: []types.Domain{
+		Domains: []acme.Domain{
 			{
 				Main: "Domains Main",
 				SANs: []string{"Domains acme SANs 1", "Domains acme SANs 2", "Domains acme SANs 3"},
@@ -168,7 +168,7 @@ func TestDo_globalConfiguration(t *testing.T) {
 		OnHostRule:        true,
 		CAServer:          "CAServer",
 		EntryPoint:        "EntryPoint",
-		DNSChallenge:      &acmeprovider.DNSChallenge{Provider: "DNSProvider"},
+		DNSChallenge:      &acme.DNSChallenge{Provider: "DNSProvider"},
 		DelayDontCheckDNS: 666,
 		ACMELogging:       true,
 		TLSConfig: &tls.Config{
@@ -181,7 +181,7 @@ func TestDo_globalConfiguration(t *testing.T) {
 	config.MaxIdleConnsPerHost = 666
 	config.IdleTimeout = flaeg.Duration(666 * time.Second)
 	config.InsecureSkipVerify = true
-	config.RootCAs = traefiktls.RootCAs{"RootCAs 1", "RootCAs 2", "RootCAs 3"}
+	config.RootCAs = traefikTls.RootCAs{"RootCAs 1", "RootCAs 2", "RootCAs 3"}
 	config.Retry = &configuration.Retry{
 		Attempts: 666,
 	}
@@ -333,7 +333,7 @@ func TestDo_globalConfiguration(t *testing.T) {
 		},
 		RespectReadinessChecks: true,
 	}
-	config.ConsulCatalog = &consulcatalog.Provider{
+	config.ConsulCatalog = &consul.CatalogProvider{
 		BaseProvider: provider.BaseProvider{
 			Watch:    true,
 			Filename: "ConsulCatalog Filename",
@@ -432,9 +432,8 @@ func TestDo_globalConfiguration(t *testing.T) {
 			Trace: true,
 			DebugLogGeneratedTemplate: true,
 		},
-		Endpoint:       "eureka Endpoint",
-		Delay:          flaeg.Duration(30 * time.Second),
-		RefreshSeconds: flaeg.Duration(30 * time.Second),
+		Endpoint: "eureka Endpoint",
+		Delay:    "eureka Delay",
 	}
 	config.ECS = &ecs.Provider{
 		BaseProvider: provider.BaseProvider{

cmd/traefik/anonymize/anonymize_doOnJSON_test.go

@@ -29,6 +29,7 @@ func Test_doOnJSON(t *testing.T) {
    "Compress": false
   },
   "https": {
+   "Network": "",
    "Address": ":443",
    "TLS": {
     "MinVersion": "",
@@ -118,6 +119,7 @@ func Test_doOnJSON(t *testing.T) {
    "Compress": false
   },
   "https": {
+   "Network": "",
    "Address": ":443",
    "TLS": {
     "MinVersion": "",

cmd/traefik/bug.go

@@ -1,4 +1,4 @@
-package bug
+package main
 
 import (
 	"bytes"
@@ -9,9 +9,7 @@ import (
 	"text/template"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/version"
+	"github.com/containous/traefik/cmd/traefik/anonymize"
 )
 
 const (
@@ -76,7 +74,7 @@ HOW TO WRITE A GOOD ISSUE?
 Add more configuration information here.
 -->
 
-### If applicable, please paste the log output at DEBUG level (` + "`" + `--logLevel=DEBUG` + "`" + ` switch)
+### If applicable, please paste the log output in debug mode (` + "`" + `--debug` + "`" + ` switch)
 
 ` + "```" + `
 (paste your output here)
@@ -85,8 +83,8 @@ Add more configuration information here.
 `
 )
 
-// NewCmd builds a new Bug command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
+// newBugCmd builds a new Bug command
+func newBugCmd(traefikConfiguration *TraefikConfiguration, traefikPointersConfiguration *TraefikConfiguration) *flaeg.Command {
 
 	//version Command init
 	return &flaeg.Command{
@@ -94,30 +92,30 @@ func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfi
 		Description:           `Report an issue on Traefik bugtracker`,
 		Config:                traefikConfiguration,
 		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: runCmd(traefikConfiguration),
+		Run: runBugCmd(traefikConfiguration),
 		Metadata: map[string]string{
 			"parseAllSources": "true",
 		},
 	}
 }
 
-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
+func runBugCmd(traefikConfiguration *TraefikConfiguration) func() error {
 	return func() error {
 
-		body, err := createReport(traefikConfiguration)
+		body, err := createBugReport(traefikConfiguration)
 		if err != nil {
 			return err
 		}
 
-		sendReport(body)
+		sendBugReport(body)
 
 		return nil
 	}
 }
 
-func createReport(traefikConfiguration *cmd.TraefikConfiguration) (string, error) {
-	var versionPrint bytes.Buffer
-	if err := version.GetPrint(&versionPrint); err != nil {
+func createBugReport(traefikConfiguration *TraefikConfiguration) (string, error) {
+	var version bytes.Buffer
+	if err := getVersionPrint(&version); err != nil {
 		return "", err
 	}
 
@@ -135,7 +133,7 @@ func createReport(traefikConfiguration *cmd.TraefikConfiguration) (string, error
 		Version       string
 		Configuration string
 	}{
-		Version:       versionPrint.String(),
+		Version:       version.String(),
 		Configuration: config,
 	}
 
@@ -147,7 +145,7 @@ func createReport(traefikConfiguration *cmd.TraefikConfiguration) (string, error
 	return bug.String(), nil
 }
 
-func sendReport(body string) {
+func sendBugReport(body string) {
 	URL := bugTracker + "?body=" + url.QueryEscape(body)
 	if err := openBrowser(URL); err != nil {
 		fmt.Printf("Please file a new issue at %s using this template:\n\n", bugTracker)

cmd/traefik/bug_test.go

@@ -1,10 +1,9 @@
-package bug
+package main
 
 import (
 	"testing"
 
-	"github.com/containous/traefik/anonymize"
-	"github.com/containous/traefik/cmd"
+	"github.com/containous/traefik/cmd/traefik/anonymize"
 	"github.com/containous/traefik/configuration"
 	"github.com/containous/traefik/provider/file"
 	"github.com/containous/traefik/tls"
@@ -12,8 +11,8 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_createReport(t *testing.T) {
-	traefikConfiguration := &cmd.TraefikConfiguration{
+func Test_createBugReport(t *testing.T) {
+	traefikConfiguration := &TraefikConfiguration{
 		ConfigFile: "FOO",
 		GlobalConfiguration: configuration.GlobalConfiguration{
 			EntryPoints: configuration.EntryPoints{
@@ -38,7 +37,7 @@ func Test_createReport(t *testing.T) {
 		},
 	}
 
-	report, err := createReport(traefikConfiguration)
+	report, err := createBugReport(traefikConfiguration)
 	assert.NoError(t, err, report)
 
 	// exported anonymous configuration
@@ -48,7 +47,7 @@ func Test_createReport(t *testing.T) {
 }
 
 func Test_anonymize_traefikConfiguration(t *testing.T) {
-	traefikConfiguration := &cmd.TraefikConfiguration{
+	traefikConfiguration := &TraefikConfiguration{
 		ConfigFile: "FOO",
 		GlobalConfiguration: configuration.GlobalConfiguration{
 			EntryPoints: configuration.EntryPoints{

cmd/traefik/configuration.go

@@ -1,4 +1,4 @@
-package cmd
+package main
 
 import (
 	"time"
@@ -8,13 +8,9 @@ import (
 	"github.com/containous/traefik/api"
 	"github.com/containous/traefik/configuration"
 	"github.com/containous/traefik/middlewares/accesslog"
-	"github.com/containous/traefik/middlewares/tracing"
-	"github.com/containous/traefik/middlewares/tracing/jaeger"
-	"github.com/containous/traefik/middlewares/tracing/zipkin"
 	"github.com/containous/traefik/ping"
 	"github.com/containous/traefik/provider/boltdb"
 	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
 	"github.com/containous/traefik/provider/docker"
 	"github.com/containous/traefik/provider/dynamodb"
 	"github.com/containous/traefik/provider/ecs"
@@ -39,7 +35,7 @@ type TraefikConfiguration struct {
 
 // NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
 func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
-	// default Docker
+	//default Docker
 	var defaultDocker docker.Provider
 	defaultDocker.Watch = true
 	defaultDocker.ExposedByDefault = true
@@ -49,7 +45,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	// default File
 	var defaultFile file.Provider
 	defaultFile.Watch = true
-	defaultFile.Filename = "" // needs equivalent to  viper.ConfigFileUsed()
+	defaultFile.Filename = "" //needs equivalent to  viper.ConfigFileUsed()
 
 	// default Rest
 	var defaultRest rest.Provider
@@ -99,7 +95,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultConsul.Constraints = types.Constraints{}
 
 	// default CatalogProvider
-	var defaultConsulCatalog consulcatalog.Provider
+	var defaultConsulCatalog consul.CatalogProvider
 	defaultConsulCatalog.Endpoint = "127.0.0.1:8500"
 	defaultConsulCatalog.ExposedByDefault = true
 	defaultConsulCatalog.Constraints = types.Constraints{}
@@ -113,23 +109,25 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultEtcd.Prefix = "/traefik"
 	defaultEtcd.Constraints = types.Constraints{}
 
-	// default Zookeeper
+	//default Zookeeper
 	var defaultZookeeper zk.Provider
 	defaultZookeeper.Watch = true
 	defaultZookeeper.Endpoint = "127.0.0.1:2181"
 	defaultZookeeper.Prefix = "traefik"
 	defaultZookeeper.Constraints = types.Constraints{}
 
-	// default Boltdb
+	//default Boltdb
 	var defaultBoltDb boltdb.Provider
 	defaultBoltDb.Watch = true
 	defaultBoltDb.Endpoint = "127.0.0.1:4001"
 	defaultBoltDb.Prefix = "/traefik"
 	defaultBoltDb.Constraints = types.Constraints{}
 
-	// default Kubernetes
+	//default Kubernetes
 	var defaultKubernetes kubernetes.Provider
 	defaultKubernetes.Watch = true
+	defaultKubernetes.Endpoint = ""
+	defaultKubernetes.LabelSelector = ""
 	defaultKubernetes.Constraints = types.Constraints{}
 
 	// default Mesos
@@ -142,7 +140,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultMesos.ZkDetectionTimeout = 30
 	defaultMesos.StateTimeoutSecond = 30
 
-	// default ECS
+	//default ECS
 	var defaultECS ecs.Provider
 	defaultECS.Watch = true
 	defaultECS.ExposedByDefault = true
@@ -151,7 +149,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultECS.RefreshSeconds = 15
 	defaultECS.Constraints = types.Constraints{}
 
-	// default Rancher
+	//default Rancher
 	var defaultRancher rancher.Provider
 	defaultRancher.Watch = true
 	defaultRancher.ExposedByDefault = true
@@ -166,7 +164,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 
 	// default Eureka
 	var defaultEureka eureka.Provider
-	defaultEureka.RefreshSeconds = flaeg.Duration(30 * time.Second)
+	defaultEureka.Delay = "30s"
 
 	// default ServiceFabric
 	var defaultServiceFabric servicefabric.Provider
@@ -188,13 +186,6 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultAccessLog := types.AccessLog{
 		Format:   accesslog.CommonFormat,
 		FilePath: "",
-		Filters:  &types.AccessLogFilters{},
-		Fields: &types.AccessLogFields{
-			DefaultMode: types.AccessLogKeep,
-			Headers: &types.FieldHeaders{
-				DefaultMode: types.AccessLogKeep,
-			},
-		},
 	}
 
 	// default HealthCheckConfig
@@ -212,24 +203,6 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 		DialTimeout: flaeg.Duration(configuration.DefaultDialTimeout),
 	}
 
-	// default Tracing
-	defaultTracing := tracing.Tracing{
-		Backend:     "jaeger",
-		ServiceName: "traefik",
-		Jaeger: &jaeger.Config{
-			SamplingServerURL:  "http://localhost:5778/sampling",
-			SamplingType:       "const",
-			SamplingParam:      1.0,
-			LocalAgentHostPort: "127.0.0.1:6832",
-		},
-		Zipkin: &zipkin.Config{
-			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-			SameSpan:     false,
-			ID128Bit:     true,
-			Debug:        false,
-		},
-	}
-
 	// default LifeCycle
 	defaultLifeCycle := configuration.LifeCycle{
 		GraceTimeOut: flaeg.Duration(configuration.DefaultGraceTimeout),
@@ -291,7 +264,6 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 		Ping:               &defaultPing,
 		API:                &defaultAPI,
 		Metrics:            &defaultMetrics,
-		Tracing:            &defaultTracing,
 	}
 
 	return &TraefikConfiguration{
@@ -305,6 +277,7 @@ func NewTraefikConfiguration() *TraefikConfiguration {
 		GlobalConfiguration: configuration.GlobalConfiguration{
 			AccessLogsFile:            "",
 			TraefikLogsFile:           "",
+			LogLevel:                  "ERROR",
 			EntryPoints:               map[string]*configuration.EntryPoint{},
 			Constraints:               types.Constraints{},
 			DefaultEntryPoints:        []string{"http"},

cmd/traefik/healthcheck.go

@@ -1,4 +1,4 @@
-package healthcheck
+package main
 
 import (
 	"crypto/tls"
@@ -9,29 +9,27 @@ import (
 	"time"
 
 	"github.com/containous/flaeg"
-	"github.com/containous/traefik/cmd"
 	"github.com/containous/traefik/configuration"
 )
 
-// NewCmd builds a new HealthCheck command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
+func newHealthCheckCmd(traefikConfiguration *TraefikConfiguration, traefikPointersConfiguration *TraefikConfiguration) *flaeg.Command {
 	return &flaeg.Command{
 		Name:                  "healthcheck",
 		Description:           `Calls traefik /ping to check health (web provider must be enabled)`,
 		Config:                traefikConfiguration,
 		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: runCmd(traefikConfiguration),
+		Run: runHealthCheck(traefikConfiguration),
 		Metadata: map[string]string{
 			"parseAllSources": "true",
 		},
 	}
 }
 
-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
+func runHealthCheck(traefikConfiguration *TraefikConfiguration) func() error {
 	return func() error {
 		traefikConfiguration.GlobalConfiguration.SetEffectiveConfiguration(traefikConfiguration.ConfigFile)
 
-		resp, errPing := Do(traefikConfiguration.GlobalConfiguration)
+		resp, errPing := healthCheck(traefikConfiguration.GlobalConfiguration)
 		if errPing != nil {
 			fmt.Printf("Error calling healthcheck: %s\n", errPing)
 			os.Exit(1)
@@ -46,11 +44,11 @@ func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
 	}
 }
 
-// Do try to do a healthcheck
-func Do(globalConfiguration configuration.GlobalConfiguration) (*http.Response, error) {
+func healthCheck(globalConfiguration configuration.GlobalConfiguration) (*http.Response, error) {
 	if globalConfiguration.Ping == nil {
 		return nil, errors.New("please enable `ping` to use health check")
 	}
+
 	pingEntryPoint, ok := globalConfiguration.EntryPoints[globalConfiguration.Ping.EntryPoint]
 	if !ok {
 		return nil, errors.New("missing `ping` entrypoint")

cmd/traefik/storeconfig.go

@@ -1,23 +1,18 @@
-package storeconfig
+package main
 
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	stdlog "log"
-	"os"
 
-	"github.com/abronan/valkeyrie/store"
 	"github.com/containous/flaeg"
 	"github.com/containous/staert"
 	"github.com/containous/traefik/acme"
 	"github.com/containous/traefik/cluster"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/log"
+	"github.com/docker/libkv/store"
 )
 
-// NewCmd builds a new StoreConfig command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
+func newStoreConfigCmd(traefikConfiguration *TraefikConfiguration, traefikPointersConfiguration *TraefikConfiguration) *flaeg.Command {
 	return &flaeg.Command{
 		Name:                  "storeconfig",
 		Description:           `Store the static traefik configuration into a Key-value stores. Traefik will not start.`,
@@ -29,8 +24,7 @@ func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfi
 	}
 }
 
-// Run store config in KV
-func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) func() error {
+func runStoreConfig(kv *staert.KvSource, traefikConfiguration *TraefikConfiguration) func() error {
 	return func() error {
 		if kv == nil {
 			return fmt.Errorf("error using command storeconfig, no Key-value store defined")
@@ -62,7 +56,7 @@ func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) fu
 			}
 
 			stdlog.Printf("Storing file configuration: %s\n", jsonConf)
-			config, err := fileConfig.BuildConfiguration()
+			config, err := fileConfig.LoadConfig()
 			if err != nil {
 				return err
 			}
@@ -73,20 +67,24 @@ func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) fu
 				return err
 			}
 		}
-
 		if traefikConfiguration.GlobalConfiguration.ACME != nil {
-			account := &acme.Account{}
-
-			// Migrate ACME data from file to KV store if needed
+			var object cluster.Object
 			if len(traefikConfiguration.GlobalConfiguration.ACME.StorageFile) > 0 {
-				account, err = migrateACMEData(traefikConfiguration.GlobalConfiguration.ACME.StorageFile)
+				// convert ACME json file to KV store
+				localStore := acme.NewLocalStore(traefikConfiguration.GlobalConfiguration.ACME.StorageFile)
+				object, err = localStore.Load()
 				if err != nil {
 					return err
 				}
+
+			} else {
+				// Create an empty account to create all the keys into the KV store
+				account := &acme.Account{}
+				account.Init()
+				object = account
 			}
 
-			// Store the ACME Account into the KV Store
-			meta := cluster.NewMetadata(account)
+			meta := cluster.NewMetadata(object)
 			err = meta.Marshall()
 			if err != nil {
 				return err
@@ -96,62 +94,23 @@ func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) fu
 				Store:  kv,
 				Prefix: traefikConfiguration.GlobalConfiguration.ACME.Storage,
 			}
-
 			err = source.StoreConfig(meta)
 			if err != nil {
 				return err
 			}
-
 			// Force to delete storagefile
-			return kv.Delete(kv.Prefix + "/acme/storagefile")
+			err = kv.Delete(kv.Prefix + "/acme/storagefile")
+			if err != nil {
+				return err
+			}
 		}
 		return nil
 	}
 }
 
-// migrateACMEData allows migrating data from acme.json file to KV store in function of the file format
-func migrateACMEData(fileName string) (*acme.Account, error) {
-
-	f, err := os.Open(fileName)
-	if err != nil {
-		return nil, err
-	}
-	defer f.Close()
-
-	file, err := ioutil.ReadAll(f)
-	if err != nil {
-		return nil, err
-	}
-
-	// Check if the storage file is not empty before to get data
-	account := &acme.Account{}
-	if len(file) > 0 {
-		accountFromNewFormat, err := acme.FromNewToOldFormat(fileName)
-		if err != nil {
-			return nil, err
-		}
-
-		if accountFromNewFormat == nil {
-			// convert ACME json file to KV store (used for backward compatibility)
-			localStore := acme.NewLocalStore(fileName)
-			account, err = localStore.Get()
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			account = accountFromNewFormat
-		}
-	} else {
-		log.Warnf("No data will be imported from the storageFile %q because it is empty.", fileName)
-	}
-
-	err = account.Init()
-	return account, err
-}
-
-// CreateKvSource creates KvSource
+// createKvSource creates KvSource
 // TLS support is enable for Consul and Etcd backends
-func CreateKvSource(traefikConfiguration *cmd.TraefikConfiguration) (*staert.KvSource, error) {
+func createKvSource(traefikConfiguration *TraefikConfiguration) (*staert.KvSource, error) {
 	var kv *staert.KvSource
 	var kvStore store.Store
 	var err error

cmd/traefik/traefik.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"context"
 	"encoding/json"
 	fmtlog "log"
 	"net/http"
@@ -11,38 +10,32 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Sirupsen/logrus"
 	"github.com/cenk/backoff"
 	"github.com/containous/flaeg"
 	"github.com/containous/staert"
-	"github.com/containous/traefik/cmd"
-	"github.com/containous/traefik/cmd/bug"
-	"github.com/containous/traefik/cmd/healthcheck"
-	"github.com/containous/traefik/cmd/storeconfig"
-	cmdVersion "github.com/containous/traefik/cmd/version"
+	"github.com/containous/traefik/acme"
 	"github.com/containous/traefik/collector"
 	"github.com/containous/traefik/configuration"
 	"github.com/containous/traefik/job"
 	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/provider/ecs"
 	"github.com/containous/traefik/provider/kubernetes"
 	"github.com/containous/traefik/safe"
 	"github.com/containous/traefik/server"
 	"github.com/containous/traefik/server/uuid"
-	traefiktls "github.com/containous/traefik/tls"
+	traefikTls "github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"github.com/containous/traefik/version"
 	"github.com/coreos/go-systemd/daemon"
 	"github.com/ogier/pflag"
-	"github.com/sirupsen/logrus"
 )
 
 func main() {
-	// traefik config inits
-	traefikConfiguration := cmd.NewTraefikConfiguration()
-	traefikPointersConfiguration := cmd.NewTraefikDefaultPointersConfiguration()
-
-	// traefik Command init
+	//traefik config inits
+	traefikConfiguration := NewTraefikConfiguration()
+	traefikPointersConfiguration := NewTraefikDefaultPointersConfiguration()
+	//traefik Command init
 	traefikCmd := &flaeg.Command{
 		Name: "traefik",
 		Description: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
@@ -50,39 +43,36 @@ Complete documentation is available at https://traefik.io`,
 		Config:                traefikConfiguration,
 		DefaultPointersConfig: traefikPointersConfiguration,
 		Run: func() error {
-			runCmd(&traefikConfiguration.GlobalConfiguration, traefikConfiguration.ConfigFile)
+			run(&traefikConfiguration.GlobalConfiguration, traefikConfiguration.ConfigFile)
 			return nil
 		},
 	}
 
-	// storeconfig Command init
-	storeConfigCmd := storeconfig.NewCmd(traefikConfiguration, traefikPointersConfiguration)
+	//storeconfig Command init
+	storeConfigCmd := newStoreConfigCmd(traefikConfiguration, traefikPointersConfiguration)
 
-	// init flaeg source
+	//init flaeg source
 	f := flaeg.New(traefikCmd, os.Args[1:])
-	// add custom parsers
+	//add custom parsers
 	f.AddParser(reflect.TypeOf(configuration.EntryPoints{}), &configuration.EntryPoints{})
 	f.AddParser(reflect.TypeOf(configuration.DefaultEntryPoints{}), &configuration.DefaultEntryPoints{})
-	f.AddParser(reflect.TypeOf(traefiktls.RootCAs{}), &traefiktls.RootCAs{})
+	f.AddParser(reflect.TypeOf(traefikTls.RootCAs{}), &traefikTls.RootCAs{})
 	f.AddParser(reflect.TypeOf(types.Constraints{}), &types.Constraints{})
 	f.AddParser(reflect.TypeOf(kubernetes.Namespaces{}), &kubernetes.Namespaces{})
 	f.AddParser(reflect.TypeOf(ecs.Clusters{}), &ecs.Clusters{})
-	f.AddParser(reflect.TypeOf([]types.Domain{}), &types.Domains{})
+	f.AddParser(reflect.TypeOf([]acme.Domain{}), &acme.Domains{})
 	f.AddParser(reflect.TypeOf(types.Buckets{}), &types.Buckets{})
-	f.AddParser(reflect.TypeOf(types.StatusCodes{}), &types.StatusCodes{})
-	f.AddParser(reflect.TypeOf(types.FieldNames{}), &types.FieldNames{})
-	f.AddParser(reflect.TypeOf(types.FieldHeaderNames{}), &types.FieldHeaderNames{})
 
-	// add commands
-	f.AddCommand(cmdVersion.NewCmd())
-	f.AddCommand(bug.NewCmd(traefikConfiguration, traefikPointersConfiguration))
+	//add commands
+	f.AddCommand(newVersionCmd())
+	f.AddCommand(newBugCmd(traefikConfiguration, traefikPointersConfiguration))
 	f.AddCommand(storeConfigCmd)
-	f.AddCommand(healthcheck.NewCmd(traefikConfiguration, traefikPointersConfiguration))
+	f.AddCommand(newHealthCheckCmd(traefikConfiguration, traefikPointersConfiguration))
 
 	usedCmd, err := f.GetCommand()
 	if err != nil {
 		fmtlog.Println(err)
-		os.Exit(1)
+		os.Exit(-1)
 	}
 
 	if _, err := f.Parse(usedCmd); err != nil {
@@ -90,32 +80,32 @@ Complete documentation is available at https://traefik.io`,
 			os.Exit(0)
 		}
 		fmtlog.Printf("Error parsing command: %s\n", err)
-		os.Exit(1)
+		os.Exit(-1)
 	}
 
-	// staert init
+	//staert init
 	s := staert.NewStaert(traefikCmd)
-	// init TOML source
+	//init toml source
 	toml := staert.NewTomlSource("traefik", []string{traefikConfiguration.ConfigFile, "/etc/traefik/", "$HOME/.traefik/", "."})
 
-	// add sources to staert
+	//add sources to staert
 	s.AddSource(toml)
 	s.AddSource(f)
 	if _, err := s.LoadConfig(); err != nil {
 		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
-		os.Exit(1)
+		os.Exit(-1)
 	}
 
 	traefikConfiguration.ConfigFile = toml.ConfigFileUsed()
 
-	kv, err := storeconfig.CreateKvSource(traefikConfiguration)
+	kv, err := createKvSource(traefikConfiguration)
 	if err != nil {
 		fmtlog.Printf("Error creating kv store: %s\n", err)
-		os.Exit(1)
+		os.Exit(-1)
 	}
-	storeConfigCmd.Run = storeconfig.Run(kv, traefikConfiguration)
+	storeConfigCmd.Run = runStoreConfig(kv, traefikConfiguration)
 
-	// if a KV Store is enable and no sub-command called in args
+	// IF a KV Store is enable and no sub-command called in args
 	if kv != nil && usedCmd == traefikCmd {
 		if traefikConfiguration.Cluster == nil {
 			traefikConfiguration.Cluster = &types.Cluster{Node: uuid.Get()}
@@ -134,19 +124,19 @@ Complete documentation is available at https://traefik.io`,
 		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
 		if err != nil {
 			fmtlog.Printf("Error loading configuration: %s\n", err)
-			os.Exit(1)
+			os.Exit(-1)
 		}
 	}
 
 	if err := s.Run(); err != nil {
 		fmtlog.Printf("Error running traefik: %s\n", err)
-		os.Exit(1)
+		os.Exit(-1)
 	}
 
 	os.Exit(0)
 }
 
-func runCmd(globalConfiguration *configuration.GlobalConfiguration, configFile string) {
+func run(globalConfiguration *configuration.GlobalConfiguration, configFile string) {
 	configureLogging(globalConfiguration)
 
 	if len(configFile) > 0 {
@@ -168,17 +158,8 @@ func runCmd(globalConfiguration *configuration.GlobalConfiguration, configFile s
 	stats(globalConfiguration)
 
 	log.Debugf("Global configuration loaded %s", string(jsonConf))
-	if acme.IsEnabled() {
-		store := acme.NewLocalStore(acme.Get().Storage)
-		acme.Get().Store = &store
-	}
-	svr := server.NewServer(*globalConfiguration, configuration.NewProviderAggregator(globalConfiguration))
-	if acme.IsEnabled() && acme.Get().OnHostRule {
-		acme.Get().SetConfigListenerChan(make(chan types.Configuration))
-		svr.AddListener(acme.Get().ListenConfiguration)
-	}
-	ctx := cmd.ContextWithSignal(context.Background())
-	svr.StartWithContext(ctx)
+	svr := server.NewServer(*globalConfiguration)
+	svr.Start()
 	defer svr.Close()
 
 	sent, err := daemon.SdNotify(false, "READY=1")
@@ -196,7 +177,7 @@ func runCmd(globalConfiguration *configuration.GlobalConfiguration, configFile s
 		safe.Go(func() {
 			tick := time.Tick(t)
 			for range tick {
-				_, errHealthCheck := healthcheck.Do(*globalConfiguration)
+				_, errHealthCheck := healthCheck(*globalConfiguration)
 				if globalConfiguration.Ping == nil || errHealthCheck == nil {
 					if ok, _ := daemon.SdNotify(false, "WATCHDOG=1"); !ok {
 						log.Error("Fail to tick watchdog")
@@ -217,18 +198,12 @@ func configureLogging(globalConfiguration *configuration.GlobalConfiguration) {
 	// configure default log flags
 	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
 
-	// configure log level
-	// an explicitly defined log level always has precedence. if none is
-	// given and debug mode is disabled, the default is ERROR, and DEBUG
-	// otherwise.
-	levelStr := strings.ToLower(globalConfiguration.LogLevel)
-	if levelStr == "" {
-		levelStr = "error"
-		if globalConfiguration.Debug {
-			levelStr = "debug"
-		}
+	if globalConfiguration.Debug {
+		globalConfiguration.LogLevel = "DEBUG"
 	}
-	level, err := logrus.ParseLevel(levelStr)
+
+	// configure log level
+	level, err := logrus.ParseLevel(strings.ToLower(globalConfiguration.LogLevel))
 	if err != nil {
 		log.Error("Error getting level", err)
 	}
@@ -248,7 +223,10 @@ func configureLogging(globalConfiguration *configuration.GlobalConfiguration) {
 	if globalConfiguration.TraefikLog != nil && globalConfiguration.TraefikLog.Format == "json" {
 		formatter = &logrus.JSONFormatter{}
 	} else {
-		disableColors := len(logFile) > 0
+		disableColors := false
+		if len(logFile) > 0 {
+			disableColors = true
+		}
 		formatter = &logrus.TextFormatter{DisableColors: disableColors, FullTimestamp: true, DisableSorting: true}
 	}
 	log.SetFormatter(formatter)
@@ -256,7 +234,8 @@ func configureLogging(globalConfiguration *configuration.GlobalConfiguration) {
 	if len(logFile) > 0 {
 		dir := filepath.Dir(logFile)
 
-		if err := os.MkdirAll(dir, 0755); err != nil {
+		err := os.MkdirAll(dir, 0755)
+		if err != nil {
 			log.Errorf("Failed to create log path %s: %s", dir, err)
 		}
 

cmd/traefik/version.go

@@ -1,4 +1,4 @@
-package version
+package main
 
 import (
 	"fmt"
@@ -17,15 +17,17 @@ Go version:   {{.GoVersion}}
 Built:        {{.BuildTime}}
 OS/Arch:      {{.Os}}/{{.Arch}}`
 
-// NewCmd builds a new Version command
-func NewCmd() *flaeg.Command {
+// newVersionCmd builds a new Version command
+func newVersionCmd() *flaeg.Command {
+
+	//version Command init
 	return &flaeg.Command{
 		Name:                  "version",
 		Description:           `Print version`,
 		Config:                struct{}{},
 		DefaultPointersConfig: struct{}{},
 		Run: func() error {
-			if err := GetPrint(os.Stdout); err != nil {
+			if err := getVersionPrint(os.Stdout); err != nil {
 				return err
 			}
 			fmt.Print("\n")
@@ -35,8 +37,7 @@ func NewCmd() *flaeg.Command {
 	}
 }
 
-// GetPrint write Printable version
-func GetPrint(wr io.Writer) error {
+func getVersionPrint(wr io.Writer) error {
 	tmpl, err := template.New("").Parse(versionTemplate)
 	if err != nil {
 		return err

collector/collector.go

@@ -9,7 +9,7 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/containous/traefik/anonymize"
+	"github.com/containous/traefik/cmd/traefik/anonymize"
 	"github.com/containous/traefik/configuration"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/version"

configuration/configuration.go

@@ -10,12 +10,9 @@ import (
 	"github.com/containous/traefik/acme"
 	"github.com/containous/traefik/api"
 	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/middlewares/tracing"
 	"github.com/containous/traefik/ping"
-	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/provider/boltdb"
 	"github.com/containous/traefik/provider/consul"
-	"github.com/containous/traefik/provider/consulcatalog"
 	"github.com/containous/traefik/provider/docker"
 	"github.com/containous/traefik/provider/dynamodb"
 	"github.com/containous/traefik/provider/ecs"
@@ -62,7 +59,6 @@ type GlobalConfiguration struct {
 	AccessLog                 *types.AccessLog        `description:"Access log settings" export:"true"`
 	TraefikLogsFile           string                  `description:"(Deprecated) Traefik logs file. Stdout is used when omitted or empty" export:"true"` // Deprecated
 	TraefikLog                *types.TraefikLog       `description:"Traefik log settings" export:"true"`
-	Tracing                   *tracing.Tracing        `description:"OpenTracing configuration" export:"true"`
 	LogLevel                  string                  `short:"l" description:"Log level" export:"true"`
 	EntryPoints               EntryPoints             `description:"Entrypoints definition using format: --entryPoints='Name:http Address::8000 Redirect.EntryPoint:https' --entryPoints='Name:https Address::4442 TLS:tests/traefik.crt,tests/traefik.key;prod/traefik.crt,prod/traefik.key'" export:"true"`
 	Cluster                   *types.Cluster          `description:"Enable clustering" export:"true"`
@@ -83,7 +79,7 @@ type GlobalConfiguration struct {
 	File                      *file.Provider          `description:"Enable File backend with default settings" export:"true"`
 	Marathon                  *marathon.Provider      `description:"Enable Marathon backend with default settings" export:"true"`
 	Consul                    *consul.Provider        `description:"Enable Consul backend with default settings" export:"true"`
-	ConsulCatalog             *consulcatalog.Provider `description:"Enable Consul catalog backend with default settings" export:"true"`
+	ConsulCatalog             *consul.CatalogProvider `description:"Enable Consul catalog backend with default settings" export:"true"`
 	Etcd                      *etcd.Provider          `description:"Enable Etcd backend with default settings" export:"true"`
 	Zookeeper                 *zk.Provider            `description:"Enable Zookeeper backend with default settings" export:"true"`
 	Boltdb                    *boltdb.Provider        `description:"Enable Boltdb backend with default settings" export:"true"`
@@ -182,23 +178,12 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 		}
 	}
 
+	// ForwardedHeaders must be remove in the next breaking version
 	for entryPointName := range gc.EntryPoints {
 		entryPoint := gc.EntryPoints[entryPointName]
-		// ForwardedHeaders must be remove in the next breaking version
 		if entryPoint.ForwardedHeaders == nil {
 			entryPoint.ForwardedHeaders = &ForwardedHeaders{Insecure: true}
 		}
-
-		if len(entryPoint.WhitelistSourceRange) > 0 {
-			log.Warnf("Deprecated configuration found: %s. Please use %s.", "whiteListSourceRange", "whiteList.sourceRange")
-
-			if entryPoint.WhiteList == nil {
-				entryPoint.WhiteList = &types.WhiteList{
-					SourceRange: entryPoint.WhitelistSourceRange,
-				}
-				entryPoint.WhitelistSourceRange = nil
-			}
-		}
 	}
 
 	// Make sure LifeCycle isn't nil to spare nil checks elsewhere.
@@ -212,39 +197,7 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 		gc.LifeCycle.GraceTimeOut = gc.GraceTimeOut
 	}
 
-	if gc.Docker != nil {
-		if len(gc.Docker.Filename) != 0 && gc.Docker.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Docker.TemplateVersion = 1
-		} else {
-			gc.Docker.TemplateVersion = 2
-		}
-	}
-
-	if gc.Marathon != nil {
-		if len(gc.Marathon.Filename) != 0 && gc.Marathon.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Marathon.TemplateVersion = 1
-		} else {
-			gc.Marathon.TemplateVersion = 2
-		}
-	}
-
-	if gc.Eureka != nil {
-		if gc.Eureka.Delay != 0 {
-			log.Warn("Delay has been deprecated -- please use RefreshSeconds")
-			gc.Eureka.RefreshSeconds = gc.Eureka.Delay
-		}
-	}
-
 	if gc.Rancher != nil {
-		if len(gc.Rancher.Filename) != 0 && gc.Rancher.TemplateVersion != 2 {
-			log.Warn("Template version 1 is deprecated, please use version 2, see TemplateVersion.")
-			gc.Rancher.TemplateVersion = 1
-		} else {
-			gc.Rancher.TemplateVersion = 2
-		}
-
 		// Ensure backwards compatibility for now
 		if len(gc.Rancher.AccessKey) > 0 ||
 			len(gc.Rancher.Endpoint) > 0 ||
@@ -270,13 +223,17 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 		gc.API.Debug = gc.Debug
 	}
 
+	if gc.Debug {
+		gc.LogLevel = "DEBUG"
+	}
+
 	if gc.Web != nil && (gc.Web.Path == "" || !strings.HasSuffix(gc.Web.Path, "/")) {
 		gc.Web.Path += "/"
 	}
 
 	// Try to fallback to traefik config file in case the file provider is enabled
-	// but has no file name configured and is not in a directory mode.
-	if gc.File != nil && len(gc.File.Filename) == 0 && len(gc.File.Directory) == 0 {
+	// but has no file name configured.
+	if gc.File != nil && len(gc.File.Filename) == 0 {
 		if len(configFile) > 0 {
 			gc.File.Filename = configFile
 		} else {
@@ -284,10 +241,6 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 		}
 	}
 
-	gc.initACMEProvider()
-}
-
-func (gc *GlobalConfiguration) initACMEProvider() {
 	if gc.ACME != nil {
 		// TODO: to remove in the futurs
 		if len(gc.ACME.StorageFile) > 0 && len(gc.ACME.Storage) == 0 {
@@ -297,30 +250,12 @@ func (gc *GlobalConfiguration) initACMEProvider() {
 
 		if len(gc.ACME.DNSProvider) > 0 {
 			log.Warn("ACME.DNSProvider is deprecated, use ACME.DNSChallenge instead")
-			gc.ACME.DNSChallenge = &acmeprovider.DNSChallenge{Provider: gc.ACME.DNSProvider, DelayBeforeCheck: gc.ACME.DelayDontCheckDNS}
+			gc.ACME.DNSChallenge = &acme.DNSChallenge{Provider: gc.ACME.DNSProvider, DelayBeforeCheck: gc.ACME.DelayDontCheckDNS}
 		}
 
 		if gc.ACME.OnDemand {
 			log.Warn("ACME.OnDemand is deprecated")
 		}
-
-		// TODO: Remove when Provider ACME will replace totally ACME
-		// If provider file, use Provider ACME instead of ACME
-		if gc.Cluster == nil {
-			acmeprovider.Get().Configuration = &acmeprovider.Configuration{
-				OnHostRule:    gc.ACME.OnHostRule,
-				OnDemand:      gc.ACME.OnDemand,
-				Email:         gc.ACME.Email,
-				Storage:       gc.ACME.Storage,
-				HTTPChallenge: gc.ACME.HTTPChallenge,
-				DNSChallenge:  gc.ACME.DNSChallenge,
-				Domains:       gc.ACME.Domains,
-				ACMELogging:   gc.ACME.ACMELogging,
-				CAServer:      gc.ACME.CAServer,
-				EntryPoint:    gc.ACME.EntryPoint,
-			}
-			gc.ACME = nil
-		}
 	}
 }
 
@@ -331,15 +266,7 @@ func (gc *GlobalConfiguration) ValidateConfiguration() {
 			log.Fatalf("Unknown entrypoint %q for ACME configuration", gc.ACME.EntryPoint)
 		} else {
 			if gc.EntryPoints[gc.ACME.EntryPoint].TLS == nil {
-				log.Fatalf("Entrypoint %q has no TLS configuration for ACME configuration", gc.ACME.EntryPoint)
-			}
-		}
-	} else if acmeprovider.IsEnabled() {
-		if _, ok := gc.EntryPoints[acmeprovider.Get().EntryPoint]; !ok {
-			log.Fatalf("Unknown entrypoint %q for provider ACME configuration", acmeprovider.Get().EntryPoint)
-		} else {
-			if gc.EntryPoints[acmeprovider.Get().EntryPoint].TLS == nil {
-				log.Fatalf("Entrypoint %q has no TLS configuration for provider ACME configuration", acmeprovider.Get().EntryPoint)
+				log.Fatalf("Entrypoint without TLS %q for ACME configuration", gc.ACME.EntryPoint)
 			}
 		}
 	}
@@ -370,12 +297,12 @@ func (dep *DefaultEntryPoints) Set(value string) error {
 
 // Get return the EntryPoints map
 func (dep *DefaultEntryPoints) Get() interface{} {
-	return *dep
+	return DefaultEntryPoints(*dep)
 }
 
 // SetValue sets the EntryPoints map with val
 func (dep *DefaultEntryPoints) SetValue(val interface{}) {
-	*dep = val.(DefaultEntryPoints)
+	*dep = DefaultEntryPoints(val.(DefaultEntryPoints))
 }
 
 // Type is type of the struct
@@ -383,6 +310,157 @@ func (dep *DefaultEntryPoints) Type() string {
 	return "defaultentrypoints"
 }
 
+// EntryPoints holds entry points configuration of the reverse proxy (ip, port, TLS...)
+type EntryPoints map[string]*EntryPoint
+
+// String is the method to format the flag's value, part of the flag.Value interface.
+// The String method's output will be used in diagnostics.
+func (ep *EntryPoints) String() string {
+	return fmt.Sprintf("%+v", *ep)
+}
+
+// Set is the method to set the flag value, part of the flag.Value interface.
+// Set's argument is a string to be parsed to set the flag.
+// It's a comma-separated list, so we split it.
+func (ep *EntryPoints) Set(value string) error {
+	result := parseEntryPointsConfiguration(value)
+
+	var configTLS *tls.TLS
+	if len(result["tls"]) > 0 {
+		certs := tls.Certificates{}
+		if err := certs.Set(result["tls"]); err != nil {
+			return err
+		}
+		configTLS = &tls.TLS{
+			Certificates: certs,
+		}
+	} else if len(result["tls_acme"]) > 0 {
+		configTLS = &tls.TLS{
+			Certificates: tls.Certificates{},
+		}
+	}
+	if len(result["ca"]) > 0 {
+		files := strings.Split(result["ca"], ",")
+		optional := toBool(result, "ca_optional")
+		configTLS.ClientCA = tls.ClientCA{
+			Files:    files,
+			Optional: optional,
+		}
+	}
+	var redirect *types.Redirect
+	if len(result["redirect_entrypoint"]) > 0 || len(result["redirect_regex"]) > 0 || len(result["redirect_replacement"]) > 0 {
+		redirect = &types.Redirect{
+			EntryPoint:  result["redirect_entrypoint"],
+			Regex:       result["redirect_regex"],
+			Replacement: result["redirect_replacement"],
+		}
+	}
+
+	whiteListSourceRange := []string{}
+	if len(result["whitelistsourcerange"]) > 0 {
+		whiteListSourceRange = strings.Split(result["whitelistsourcerange"], ",")
+	}
+
+	compress := toBool(result, "compress")
+
+	var proxyProtocol *ProxyProtocol
+	ppTrustedIPs := result["proxyprotocol_trustedips"]
+	if len(result["proxyprotocol_insecure"]) > 0 || len(ppTrustedIPs) > 0 {
+		proxyProtocol = &ProxyProtocol{
+			Insecure: toBool(result, "proxyprotocol_insecure"),
+		}
+		if len(ppTrustedIPs) > 0 {
+			proxyProtocol.TrustedIPs = strings.Split(ppTrustedIPs, ",")
+		}
+	}
+
+	// TODO must be changed to false by default in the next breaking version.
+	forwardedHeaders := &ForwardedHeaders{Insecure: true}
+	if _, ok := result["forwardedheaders_insecure"]; ok {
+		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
+	}
+
+	fhTrustedIPs := result["forwardedheaders_trustedips"]
+	if len(fhTrustedIPs) > 0 {
+		// TODO must be removed in the next breaking version.
+		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
+		forwardedHeaders.TrustedIPs = strings.Split(fhTrustedIPs, ",")
+	}
+
+	if proxyProtocol != nil && proxyProtocol.Insecure {
+		log.Warn("ProxyProtocol.Insecure:true is dangerous. Please use 'ProxyProtocol.TrustedIPs:IPs' and remove 'ProxyProtocol.Insecure:true'")
+	}
+
+	(*ep)[result["name"]] = &EntryPoint{
+		Address:              result["address"],
+		TLS:                  configTLS,
+		Redirect:             redirect,
+		Compress:             compress,
+		WhitelistSourceRange: whiteListSourceRange,
+		ProxyProtocol:        proxyProtocol,
+		ForwardedHeaders:     forwardedHeaders,
+	}
+
+	return nil
+}
+
+func parseEntryPointsConfiguration(raw string) map[string]string {
+	sections := strings.Fields(raw)
+
+	config := make(map[string]string)
+	for _, part := range sections {
+		field := strings.SplitN(part, ":", 2)
+		name := strings.ToLower(strings.Replace(field[0], ".", "_", -1))
+		if len(field) > 1 {
+			config[name] = field[1]
+		} else {
+			if strings.EqualFold(name, "TLS") {
+				config["tls_acme"] = "TLS"
+			} else {
+				config[name] = ""
+			}
+		}
+	}
+	return config
+}
+
+func toBool(conf map[string]string, key string) bool {
+	if val, ok := conf[key]; ok {
+		return strings.EqualFold(val, "true") ||
+			strings.EqualFold(val, "enable") ||
+			strings.EqualFold(val, "on")
+	}
+	return false
+}
+
+// Get return the EntryPoints map
+func (ep *EntryPoints) Get() interface{} {
+	return EntryPoints(*ep)
+}
+
+// SetValue sets the EntryPoints map with val
+func (ep *EntryPoints) SetValue(val interface{}) {
+	*ep = EntryPoints(val.(EntryPoints))
+}
+
+// Type is type of the struct
+func (ep *EntryPoints) Type() string {
+	return "entrypoints"
+}
+
+// EntryPoint holds an entry point configuration of the reverse proxy (ip, port, TLS...)
+type EntryPoint struct {
+	Network              string
+	Address              string
+	TLS                  *tls.TLS        `export:"true"`
+	Redirect             *types.Redirect `export:"true"`
+	Auth                 *types.Auth     `export:"true"`
+	WhitelistSourceRange []string
+	Compress             bool              `export:"true"`
+	ProxyProtocol        *ProxyProtocol    `export:"true"`
+	ForwardedHeaders     *ForwardedHeaders `export:"true"`
+}
+
 // Retry contains request retry config
 type Retry struct {
 	Attempts int `description:"Number of attempts" export:"true"`
@@ -406,6 +484,18 @@ type ForwardingTimeouts struct {
 	ResponseHeaderTimeout flaeg.Duration `description:"The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists" export:"true"`
 }
 
+// ProxyProtocol contains Proxy-Protocol configuration
+type ProxyProtocol struct {
+	Insecure   bool
+	TrustedIPs []string
+}
+
+// ForwardedHeaders Trust client forwarding headers
+type ForwardedHeaders struct {
+	Insecure   bool
+	TrustedIPs []string
+}
+
 // LifeCycle contains configurations relevant to the lifecycle (such as the
 // shutdown phase) of Traefik.
 type LifeCycle struct {

configuration/configuration_test.go

@@ -7,10 +7,305 @@ import (
 	"github.com/containous/flaeg"
 	"github.com/containous/traefik/provider"
 	"github.com/containous/traefik/provider/file"
+	"github.com/containous/traefik/tls"
+	"github.com/containous/traefik/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 const defaultConfigFile = "traefik.toml"
 
+func Test_parseEntryPointsConfiguration(t *testing.T) {
+	testCases := []struct {
+		name           string
+		value          string
+		expectedResult map[string]string
+	}{
+		{
+			name:  "all parameters",
+			value: "Name:foo TLS:goo TLS CA:car Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:WhiteListSourceRange ProxyProtocol.TrustedIPs:192.168.0.1 ProxyProtocol.Insecure:false Address::8000",
+			expectedResult: map[string]string{
+				"name":                     "foo",
+				"address":                  ":8000",
+				"ca":                       "car",
+				"tls":                      "goo",
+				"tls_acme":                 "TLS",
+				"redirect_entrypoint":      "RedirectEntryPoint",
+				"redirect_regex":           "RedirectRegex",
+				"redirect_replacement":     "RedirectReplacement",
+				"whitelistsourcerange":     "WhiteListSourceRange",
+				"proxyprotocol_trustedips": "192.168.0.1",
+				"proxyprotocol_insecure":   "false",
+				"compress":                 "true",
+			},
+		},
+		{
+			name:  "compress on",
+			value: "name:foo Compress:on",
+			expectedResult: map[string]string{
+				"name":     "foo",
+				"compress": "on",
+			},
+		},
+		{
+			name:  "TLS",
+			value: "Name:foo TLS:goo TLS",
+			expectedResult: map[string]string{
+				"name":     "foo",
+				"tls":      "goo",
+				"tls_acme": "TLS",
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			conf := parseEntryPointsConfiguration(test.value)
+
+			assert.Len(t, conf, len(test.expectedResult))
+			assert.Equal(t, test.expectedResult, conf)
+		})
+	}
+}
+
+func Test_toBool(t *testing.T) {
+	testCases := []struct {
+		name         string
+		value        string
+		key          string
+		expectedBool bool
+	}{
+		{
+			name:         "on",
+			value:        "on",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "true",
+			value:        "true",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "enable",
+			value:        "enable",
+			key:          "foo",
+			expectedBool: true,
+		},
+		{
+			name:         "arbitrary string",
+			value:        "bar",
+			key:          "foo",
+			expectedBool: false,
+		},
+		{
+			name:         "no existing entry",
+			value:        "bar",
+			key:          "fii",
+			expectedBool: false,
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			conf := map[string]string{
+				"foo": test.value,
+			}
+
+			result := toBool(conf, test.key)
+
+			assert.Equal(t, test.expectedBool, result)
+		})
+	}
+}
+
+func TestEntryPoints_Set(t *testing.T) {
+	testCases := []struct {
+		name                   string
+		expression             string
+		expectedEntryPointName string
+		expectedEntryPoint     *EntryPoint
+	}{
+		{
+			name:                   "all parameters camelcase",
+			expression:             "Name:foo Address::8000 TLS:goo,gii TLS CA:car CA.Optional:false Redirect.EntryPoint:RedirectEntryPoint Redirect.Regex:RedirectRegex Redirect.Replacement:RedirectReplacement Compress:true WhiteListSourceRange:Range ProxyProtocol.TrustedIPs:192.168.0.1 ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Address: ":8000",
+				Redirect: &types.Redirect{
+					EntryPoint:  "RedirectEntryPoint",
+					Regex:       "RedirectRegex",
+					Replacement: "RedirectReplacement",
+				},
+				Compress: true,
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"192.168.0.1"},
+				},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+				WhitelistSourceRange: []string{"Range"},
+				TLS: &tls.TLS{
+					ClientCA: tls.ClientCA{
+						Files:    []string{"car"},
+						Optional: false,
+					},
+					Certificates: tls.Certificates{
+						{
+							CertFile: tls.FileOrContent("goo"),
+							KeyFile:  tls.FileOrContent("gii"),
+						},
+					},
+				},
+			},
+		},
+		{
+			name:                   "all parameters lowercase",
+			expression:             "name:foo address::8000 tls:goo,gii tls ca:car ca.optional:true redirect.entryPoint:RedirectEntryPoint redirect.regex:RedirectRegex redirect.replacement:RedirectReplacement compress:true whiteListSourceRange:Range proxyProtocol.trustedIPs:192.168.0.1 forwardedHeaders.trustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Address: ":8000",
+				Redirect: &types.Redirect{
+					EntryPoint:  "RedirectEntryPoint",
+					Regex:       "RedirectRegex",
+					Replacement: "RedirectReplacement",
+				},
+				Compress: true,
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"192.168.0.1"},
+				},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+				WhitelistSourceRange: []string{"Range"},
+				TLS: &tls.TLS{
+					ClientCA: tls.ClientCA{
+						Files:    []string{"car"},
+						Optional: true,
+					},
+					Certificates: tls.Certificates{
+						{
+							CertFile: tls.FileOrContent("goo"),
+							KeyFile:  tls.FileOrContent("gii"),
+						},
+					},
+				},
+			},
+		},
+		{
+			name:                   "default",
+			expression:             "Name:foo",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders insecure true",
+			expression:             "Name:foo ForwardedHeaders.Insecure:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders insecure false",
+			expression:             "Name:foo ForwardedHeaders.Insecure:false",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: false},
+			},
+		},
+		{
+			name:                   "ForwardedHeaders TrustedIPs",
+			expression:             "Name:foo ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders: &ForwardedHeaders{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+			},
+		},
+		{
+			name:                   "ProxyProtocol insecure true",
+			expression:             "Name:foo ProxyProtocol.Insecure:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol:        &ProxyProtocol{Insecure: true},
+			},
+		},
+		{
+			name:                   "ProxyProtocol insecure false",
+			expression:             "Name:foo ProxyProtocol.Insecure:false",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol:        &ProxyProtocol{},
+			},
+		},
+		{
+			name:                   "ProxyProtocol TrustedIPs",
+			expression:             "Name:foo ProxyProtocol.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+				ProxyProtocol: &ProxyProtocol{
+					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
+				},
+			},
+		},
+		{
+			name:                   "compress on",
+			expression:             "Name:foo Compress:on",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Compress:             true,
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+		{
+			name:                   "compress true",
+			expression:             "Name:foo Compress:true",
+			expectedEntryPointName: "foo",
+			expectedEntryPoint: &EntryPoint{
+				Compress:             true,
+				WhitelistSourceRange: []string{},
+				ForwardedHeaders:     &ForwardedHeaders{Insecure: true},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			eps := EntryPoints{}
+			err := eps.Set(test.expression)
+			require.NoError(t, err)
+
+			ep := eps[test.expectedEntryPointName]
+			assert.EqualValues(t, test.expectedEntryPoint, ep)
+		})
+	}
+}
+
 func TestSetEffectiveConfigurationGraceTimeout(t *testing.T) {
 	tests := []struct {
 		desc                  string
@@ -77,11 +372,6 @@ func TestSetEffectiveConfigurationFileProviderFilename(t *testing.T) {
 			fileProvider:             &file.Provider{BaseProvider: provider.BaseProvider{Filename: "other.toml"}},
 			wantFileProviderFilename: "other.toml",
 		},
-		{
-			desc:                     "directory for file provider given",
-			fileProvider:             &file.Provider{Directory: "/"},
-			wantFileProviderFilename: "",
-		},
 	}
 
 	for _, test := range tests {

configuration/entrypoints.go

@@ -1,266 +0,0 @@
-package configuration
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-)
-
-// EntryPoint holds an entry point configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoint struct {
-	Address              string
-	TLS                  *tls.TLS          `export:"true"`
-	Redirect             *types.Redirect   `export:"true"`
-	Auth                 *types.Auth       `export:"true"`
-	WhitelistSourceRange []string          // Deprecated
-	WhiteList            *types.WhiteList  `export:"true"`
-	Compress             bool              `export:"true"`
-	ProxyProtocol        *ProxyProtocol    `export:"true"`
-	ForwardedHeaders     *ForwardedHeaders `export:"true"`
-}
-
-// ProxyProtocol contains Proxy-Protocol configuration
-type ProxyProtocol struct {
-	Insecure   bool `export:"true"`
-	TrustedIPs []string
-}
-
-// ForwardedHeaders Trust client forwarding headers
-type ForwardedHeaders struct {
-	Insecure   bool `export:"true"`
-	TrustedIPs []string
-}
-
-// EntryPoints holds entry points configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoints map[string]*EntryPoint
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (ep EntryPoints) String() string {
-	return fmt.Sprintf("%+v", map[string]*EntryPoint(ep))
-}
-
-// Get return the EntryPoints map
-func (ep *EntryPoints) Get() interface{} {
-	return *ep
-}
-
-// SetValue sets the EntryPoints map with val
-func (ep *EntryPoints) SetValue(val interface{}) {
-	*ep = val.(EntryPoints)
-}
-
-// Type is type of the struct
-func (ep *EntryPoints) Type() string {
-	return "entrypoints"
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (ep *EntryPoints) Set(value string) error {
-	result := parseEntryPointsConfiguration(value)
-
-	var whiteListSourceRange []string
-	if len(result["whitelistsourcerange"]) > 0 {
-		whiteListSourceRange = strings.Split(result["whitelistsourcerange"], ",")
-	}
-
-	compress := toBool(result, "compress")
-
-	configTLS, err := makeEntryPointTLS(result)
-	if err != nil {
-		return err
-	}
-
-	(*ep)[result["name"]] = &EntryPoint{
-		Address:              result["address"],
-		TLS:                  configTLS,
-		Auth:                 makeEntryPointAuth(result),
-		Redirect:             makeEntryPointRedirect(result),
-		Compress:             compress,
-		WhitelistSourceRange: whiteListSourceRange,
-		WhiteList:            makeWhiteList(result),
-		ProxyProtocol:        makeEntryPointProxyProtocol(result),
-		ForwardedHeaders:     makeEntryPointForwardedHeaders(result),
-	}
-
-	return nil
-}
-
-func makeWhiteList(result map[string]string) *types.WhiteList {
-	var wl *types.WhiteList
-	if rawRange, ok := result["whitelist_sourcerange"]; ok {
-		wl = &types.WhiteList{
-			SourceRange:      strings.Split(rawRange, ","),
-			UseXForwardedFor: toBool(result, "whitelist_usexforwardedfor"),
-		}
-	}
-	return wl
-}
-
-func makeEntryPointAuth(result map[string]string) *types.Auth {
-	var basic *types.Basic
-	if v, ok := result["auth_basic_users"]; ok {
-		basic = &types.Basic{
-			Users: strings.Split(v, ","),
-		}
-	}
-
-	var digest *types.Digest
-	if v, ok := result["auth_digest_users"]; ok {
-		digest = &types.Digest{
-			Users: strings.Split(v, ","),
-		}
-	}
-
-	var forward *types.Forward
-	if address, ok := result["auth_forward_address"]; ok {
-		var clientTLS *types.ClientTLS
-
-		cert := result["auth_forward_tls_cert"]
-		key := result["auth_forward_tls_key"]
-		insecureSkipVerify := toBool(result, "auth_forward_tls_insecureskipverify")
-
-		if len(cert) > 0 && len(key) > 0 || insecureSkipVerify {
-			clientTLS = &types.ClientTLS{
-				CA:                 result["auth_forward_tls_ca"],
-				CAOptional:         toBool(result, "auth_forward_tls_caoptional"),
-				Cert:               cert,
-				Key:                key,
-				InsecureSkipVerify: insecureSkipVerify,
-			}
-		}
-
-		forward = &types.Forward{
-			Address:            address,
-			TLS:                clientTLS,
-			TrustForwardHeader: toBool(result, "auth_forward_trustforwardheader"),
-		}
-	}
-
-	var auth *types.Auth
-	if basic != nil || digest != nil || forward != nil {
-		auth = &types.Auth{
-			Basic:       basic,
-			Digest:      digest,
-			Forward:     forward,
-			HeaderField: result["auth_headerfield"],
-		}
-	}
-
-	return auth
-}
-
-func makeEntryPointProxyProtocol(result map[string]string) *ProxyProtocol {
-	var proxyProtocol *ProxyProtocol
-
-	ppTrustedIPs := result["proxyprotocol_trustedips"]
-	if len(result["proxyprotocol_insecure"]) > 0 || len(ppTrustedIPs) > 0 {
-		proxyProtocol = &ProxyProtocol{
-			Insecure: toBool(result, "proxyprotocol_insecure"),
-		}
-		if len(ppTrustedIPs) > 0 {
-			proxyProtocol.TrustedIPs = strings.Split(ppTrustedIPs, ",")
-		}
-	}
-
-	if proxyProtocol != nil && proxyProtocol.Insecure {
-		log.Warn("ProxyProtocol.Insecure:true is dangerous. Please use 'ProxyProtocol.TrustedIPs:IPs' and remove 'ProxyProtocol.Insecure:true'")
-	}
-
-	return proxyProtocol
-}
-
-func makeEntryPointForwardedHeaders(result map[string]string) *ForwardedHeaders {
-	// TODO must be changed to false by default in the next breaking version.
-	forwardedHeaders := &ForwardedHeaders{Insecure: true}
-	if _, ok := result["forwardedheaders_insecure"]; ok {
-		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
-	}
-
-	fhTrustedIPs := result["forwardedheaders_trustedips"]
-	if len(fhTrustedIPs) > 0 {
-		// TODO must be removed in the next breaking version.
-		forwardedHeaders.Insecure = toBool(result, "forwardedheaders_insecure")
-		forwardedHeaders.TrustedIPs = strings.Split(fhTrustedIPs, ",")
-	}
-
-	return forwardedHeaders
-}
-
-func makeEntryPointRedirect(result map[string]string) *types.Redirect {
-	var redirect *types.Redirect
-
-	if len(result["redirect_entrypoint"]) > 0 || len(result["redirect_regex"]) > 0 || len(result["redirect_replacement"]) > 0 {
-		redirect = &types.Redirect{
-			EntryPoint:  result["redirect_entrypoint"],
-			Regex:       result["redirect_regex"],
-			Replacement: result["redirect_replacement"],
-			Permanent:   toBool(result, "redirect_permanent"),
-		}
-	}
-
-	return redirect
-}
-
-func makeEntryPointTLS(result map[string]string) (*tls.TLS, error) {
-	var configTLS *tls.TLS
-
-	if len(result["tls"]) > 0 {
-		certs := tls.Certificates{}
-		if err := certs.Set(result["tls"]); err != nil {
-			return nil, err
-		}
-		configTLS = &tls.TLS{
-			Certificates: certs,
-		}
-	} else if len(result["tls_acme"]) > 0 {
-		configTLS = &tls.TLS{
-			Certificates: tls.Certificates{},
-		}
-	}
-
-	if len(result["ca"]) > 0 {
-		files := strings.Split(result["ca"], ",")
-		optional := toBool(result, "ca_optional")
-		configTLS.ClientCA = tls.ClientCA{
-			Files:    files,
-			Optional: optional,
-		}
-	}
-
-	return configTLS, nil
-}
-
-func parseEntryPointsConfiguration(raw string) map[string]string {
-	sections := strings.Fields(raw)
-
-	config := make(map[string]string)
-	for _, part := range sections {
-		field := strings.SplitN(part, ":", 2)
-		name := strings.ToLower(strings.Replace(field[0], ".", "_", -1))
-		if len(field) > 1 {
-			config[name] = field[1]
-		} else {
-			if strings.EqualFold(name, "TLS") {
-				config["tls_acme"] = "TLS"
-			} else {
-				config[name] = ""
-			}
-		}
-	}
-	return config
-}
-
-func toBool(conf map[string]string, key string) bool {
-	if val, ok := conf[key]; ok {
-		return strings.EqualFold(val, "true") ||
-			strings.EqualFold(val, "enable") ||
-			strings.EqualFold(val, "on")
-	}
-	return false
-}

configuration/entrypoints_test.go

@@ -1,459 +0,0 @@
-package configuration
-
-import (
-	"testing"
-
-	"github.com/containous/traefik/tls"
-	"github.com/containous/traefik/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func Test_parseEntryPointsConfiguration(t *testing.T) {
-	testCases := []struct {
-		name           string
-		value          string
-		expectedResult map[string]string
-	}{
-		{
-			name: "all parameters",
-			value: "Name:foo " +
-				"Address::8000 " +
-				"TLS:goo,gii " +
-				"TLS " +
-				"CA:car " +
-				"CA.Optional:true " +
-				"Redirect.EntryPoint:https " +
-				"Redirect.Regex:http://localhost/(.*) " +
-				"Redirect.Replacement:http://mydomain/$1 " +
-				"Redirect.Permanent:true " +
-				"Compress:true " +
-				"ProxyProtocol.TrustedIPs:192.168.0.1 " +
-				"ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"Auth.HeaderField:X-WebAuth-User " +
-				"Auth.Forward.Address:https://authserver.com/auth " +
-				"Auth.Forward.TrustForwardHeader:true " +
-				"Auth.Forward.TLS.CA:path/to/local.crt " +
-				"Auth.Forward.TLS.CAOptional:true " +
-				"Auth.Forward.TLS.Cert:path/to/foo.cert " +
-				"Auth.Forward.TLS.Key:path/to/foo.key " +
-				"Auth.Forward.TLS.InsecureSkipVerify:true " +
-				"WhiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.sourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.useXForwardedFor:true ",
-			expectedResult: map[string]string{
-				"address":                             ":8000",
-				"auth_basic_users":                    "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-				"auth_digest_users":                   "test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-				"auth_forward_address":                "https://authserver.com/auth",
-				"auth_forward_tls_ca":                 "path/to/local.crt",
-				"auth_forward_tls_caoptional":         "true",
-				"auth_forward_tls_cert":               "path/to/foo.cert",
-				"auth_forward_tls_insecureskipverify": "true",
-				"auth_forward_tls_key":                "path/to/foo.key",
-				"auth_forward_trustforwardheader":     "true",
-				"auth_headerfield":                    "X-WebAuth-User",
-				"ca":                                  "car",
-				"ca_optional":                         "true",
-				"compress":                            "true",
-				"forwardedheaders_trustedips":         "10.0.0.3/24,20.0.0.3/24",
-				"name": "foo",
-				"proxyprotocol_trustedips": "192.168.0.1",
-				"redirect_entrypoint":      "https",
-				"redirect_permanent":       "true",
-				"redirect_regex":           "http://localhost/(.*)",
-				"redirect_replacement":     "http://mydomain/$1",
-				"tls":                        "goo,gii",
-				"tls_acme":                   "TLS",
-				"whitelistsourcerange":       "10.42.0.0/16,152.89.1.33/32,afed:be44::/16",
-				"whitelist_sourcerange":      "10.42.0.0/16,152.89.1.33/32,afed:be44::/16",
-				"whitelist_usexforwardedfor": "true",
-			},
-		},
-		{
-			name:  "compress on",
-			value: "name:foo Compress:on",
-			expectedResult: map[string]string{
-				"name":     "foo",
-				"compress": "on",
-			},
-		},
-		{
-			name:  "TLS",
-			value: "Name:foo TLS:goo TLS",
-			expectedResult: map[string]string{
-				"name":     "foo",
-				"tls":      "goo",
-				"tls_acme": "TLS",
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			conf := parseEntryPointsConfiguration(test.value)
-
-			assert.Len(t, conf, len(test.expectedResult))
-			assert.Equal(t, test.expectedResult, conf)
-		})
-	}
-}
-
-func Test_toBool(t *testing.T) {
-	testCases := []struct {
-		name         string
-		value        string
-		key          string
-		expectedBool bool
-	}{
-		{
-			name:         "on",
-			value:        "on",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "true",
-			value:        "true",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "enable",
-			value:        "enable",
-			key:          "foo",
-			expectedBool: true,
-		},
-		{
-			name:         "arbitrary string",
-			value:        "bar",
-			key:          "foo",
-			expectedBool: false,
-		},
-		{
-			name:         "no existing entry",
-			value:        "bar",
-			key:          "fii",
-			expectedBool: false,
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			conf := map[string]string{
-				"foo": test.value,
-			}
-
-			result := toBool(conf, test.key)
-
-			assert.Equal(t, test.expectedBool, result)
-		})
-	}
-}
-
-func TestEntryPoints_Set(t *testing.T) {
-	testCases := []struct {
-		name                   string
-		expression             string
-		expectedEntryPointName string
-		expectedEntryPoint     *EntryPoint
-	}{
-		{
-			name: "all parameters camelcase",
-			expression: "Name:foo " +
-				"Address::8000 " +
-				"TLS:goo,gii " +
-				"TLS " +
-				"CA:car " +
-				"CA.Optional:true " +
-				"Redirect.EntryPoint:https " +
-				"Redirect.Regex:http://localhost/(.*) " +
-				"Redirect.Replacement:http://mydomain/$1 " +
-				"Redirect.Permanent:true " +
-				"Compress:true " +
-				"ProxyProtocol.TrustedIPs:192.168.0.1 " +
-				"ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"Auth.HeaderField:X-WebAuth-User " +
-				"Auth.Forward.Address:https://authserver.com/auth " +
-				"Auth.Forward.TrustForwardHeader:true " +
-				"Auth.Forward.TLS.CA:path/to/local.crt " +
-				"Auth.Forward.TLS.CAOptional:true " +
-				"Auth.Forward.TLS.Cert:path/to/foo.cert " +
-				"Auth.Forward.TLS.Key:path/to/foo.key " +
-				"Auth.Forward.TLS.InsecureSkipVerify:true " +
-				"WhiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.sourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"whiteList.useXForwardedFor:true ",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Address: ":8000",
-				TLS: &tls.TLS{
-					Certificates: tls.Certificates{
-						{
-							CertFile: tls.FileOrContent("goo"),
-							KeyFile:  tls.FileOrContent("gii"),
-						},
-					},
-					ClientCA: tls.ClientCA{
-						Files:    []string{"car"},
-						Optional: true,
-					},
-				},
-				Redirect: &types.Redirect{
-					EntryPoint:  "https",
-					Regex:       "http://localhost/(.*)",
-					Replacement: "http://mydomain/$1",
-					Permanent:   true,
-				},
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						Users: types.Users{
-							"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
-							"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-						},
-					},
-					Digest: &types.Digest{
-						Users: types.Users{
-							"test:traefik:a2688e031edb4be6a3797f3882655c05",
-							"test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-						},
-					},
-					Forward: &types.Forward{
-						Address: "https://authserver.com/auth",
-						TLS: &types.ClientTLS{
-							CA:                 "path/to/local.crt",
-							CAOptional:         true,
-							Cert:               "path/to/foo.cert",
-							Key:                "path/to/foo.key",
-							InsecureSkipVerify: true,
-						},
-						TrustForwardHeader: true,
-					},
-					HeaderField: "X-WebAuth-User",
-				},
-				WhitelistSourceRange: []string{
-					"10.42.0.0/16",
-					"152.89.1.33/32",
-					"afed:be44::/16",
-				},
-				WhiteList: &types.WhiteList{
-					SourceRange: []string{
-						"10.42.0.0/16",
-						"152.89.1.33/32",
-						"afed:be44::/16",
-					},
-					UseXForwardedFor: true,
-				},
-				Compress: true,
-				ProxyProtocol: &ProxyProtocol{
-					Insecure:   false,
-					TrustedIPs: []string{"192.168.0.1"},
-				},
-				ForwardedHeaders: &ForwardedHeaders{
-					Insecure: false,
-					TrustedIPs: []string{
-						"10.0.0.3/24",
-						"20.0.0.3/24",
-					},
-				},
-			},
-		},
-		{
-			name: "all parameters lowercase",
-			expression: "Name:foo " +
-				"address::8000 " +
-				"tls:goo,gii " +
-				"tls " +
-				"ca:car " +
-				"ca.Optional:true " +
-				"redirect.entryPoint:https " +
-				"redirect.regex:http://localhost/(.*) " +
-				"redirect.replacement:http://mydomain/$1 " +
-				"redirect.permanent:true " +
-				"compress:true " +
-				"whiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16 " +
-				"proxyProtocol.TrustedIPs:192.168.0.1 " +
-				"forwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24 " +
-				"auth.basic.users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0 " +
-				"auth.digest.users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e " +
-				"auth.headerField:X-WebAuth-User " +
-				"auth.forward.address:https://authserver.com/auth " +
-				"auth.forward.trustForwardHeader:true " +
-				"auth.forward.tls.ca:path/to/local.crt " +
-				"auth.forward.tls.caOptional:true " +
-				"auth.forward.tls.cert:path/to/foo.cert " +
-				"auth.forward.tls.key:path/to/foo.key " +
-				"auth.forward.tls.insecureSkipVerify:true ",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Address: ":8000",
-				TLS: &tls.TLS{
-					Certificates: tls.Certificates{
-						{
-							CertFile: tls.FileOrContent("goo"),
-							KeyFile:  tls.FileOrContent("gii"),
-						},
-					},
-					ClientCA: tls.ClientCA{
-						Files:    []string{"car"},
-						Optional: true,
-					},
-				},
-				Redirect: &types.Redirect{
-					EntryPoint:  "https",
-					Regex:       "http://localhost/(.*)",
-					Replacement: "http://mydomain/$1",
-					Permanent:   true,
-				},
-				Auth: &types.Auth{
-					Basic: &types.Basic{
-						Users: types.Users{
-							"test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
-							"test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
-						},
-					},
-					Digest: &types.Digest{
-						Users: types.Users{
-							"test:traefik:a2688e031edb4be6a3797f3882655c05",
-							"test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
-						},
-					},
-					Forward: &types.Forward{
-						Address: "https://authserver.com/auth",
-						TLS: &types.ClientTLS{
-							CA:                 "path/to/local.crt",
-							CAOptional:         true,
-							Cert:               "path/to/foo.cert",
-							Key:                "path/to/foo.key",
-							InsecureSkipVerify: true,
-						},
-						TrustForwardHeader: true,
-					},
-					HeaderField: "X-WebAuth-User",
-				},
-				WhitelistSourceRange: []string{
-					"10.42.0.0/16",
-					"152.89.1.33/32",
-					"afed:be44::/16",
-				},
-				Compress: true,
-				ProxyProtocol: &ProxyProtocol{
-					Insecure:   false,
-					TrustedIPs: []string{"192.168.0.1"},
-				},
-				ForwardedHeaders: &ForwardedHeaders{
-					Insecure: false,
-					TrustedIPs: []string{
-						"10.0.0.3/24",
-						"20.0.0.3/24",
-					},
-				},
-			},
-		},
-		{
-			name:                   "default",
-			expression:             "Name:foo",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders insecure true",
-			expression:             "Name:foo ForwardedHeaders.Insecure:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders insecure false",
-			expression:             "Name:foo ForwardedHeaders.Insecure:false",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: false},
-			},
-		},
-		{
-			name:                   "ForwardedHeaders TrustedIPs",
-			expression:             "Name:foo ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{
-					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
-				},
-			},
-		},
-		{
-			name:                   "ProxyProtocol insecure true",
-			expression:             "Name:foo ProxyProtocol.Insecure:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol:    &ProxyProtocol{Insecure: true},
-			},
-		},
-		{
-			name:                   "ProxyProtocol insecure false",
-			expression:             "Name:foo ProxyProtocol.Insecure:false",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol:    &ProxyProtocol{},
-			},
-		},
-		{
-			name:                   "ProxyProtocol TrustedIPs",
-			expression:             "Name:foo ProxyProtocol.TrustedIPs:10.0.0.3/24,20.0.0.3/24",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-				ProxyProtocol: &ProxyProtocol{
-					TrustedIPs: []string{"10.0.0.3/24", "20.0.0.3/24"},
-				},
-			},
-		},
-		{
-			name:                   "compress on",
-			expression:             "Name:foo Compress:on",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Compress:         true,
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-		{
-			name:                   "compress true",
-			expression:             "Name:foo Compress:true",
-			expectedEntryPointName: "foo",
-			expectedEntryPoint: &EntryPoint{
-				Compress:         true,
-				ForwardedHeaders: &ForwardedHeaders{Insecure: true},
-			},
-		},
-	}
-
-	for _, test := range testCases {
-		test := test
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			eps := EntryPoints{}
-			err := eps.Set(test.expression)
-			require.NoError(t, err)
-
-			ep := eps[test.expectedEntryPointName]
-			assert.EqualValues(t, test.expectedEntryPoint, ep)
-		})
-	}
-}

configuration/provider_aggregator.go

@@ -1,97 +0,0 @@
-package configuration
-
-import (
-	"encoding/json"
-	"reflect"
-
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/log"
-	"github.com/containous/traefik/provider"
-	acmeprovider "github.com/containous/traefik/provider/acme"
-	"github.com/containous/traefik/safe"
-	"github.com/containous/traefik/types"
-)
-
-type providerAggregator struct {
-	providers []provider.Provider
-}
-
-// NewProviderAggregator return an aggregate of all the providers configured in GlobalConfiguration
-func NewProviderAggregator(gc *GlobalConfiguration) provider.Provider {
-	provider := providerAggregator{}
-	if gc.Docker != nil {
-		provider.providers = append(provider.providers, gc.Docker)
-	}
-	if gc.Marathon != nil {
-		provider.providers = append(provider.providers, gc.Marathon)
-	}
-	if gc.File != nil {
-		provider.providers = append(provider.providers, gc.File)
-	}
-	if gc.Rest != nil {
-		provider.providers = append(provider.providers, gc.Rest)
-	}
-	if gc.Consul != nil {
-		provider.providers = append(provider.providers, gc.Consul)
-	}
-	if gc.ConsulCatalog != nil {
-		provider.providers = append(provider.providers, gc.ConsulCatalog)
-	}
-	if gc.Etcd != nil {
-		provider.providers = append(provider.providers, gc.Etcd)
-	}
-	if gc.Zookeeper != nil {
-		provider.providers = append(provider.providers, gc.Zookeeper)
-	}
-	if gc.Boltdb != nil {
-		provider.providers = append(provider.providers, gc.Boltdb)
-	}
-	if gc.Kubernetes != nil {
-		provider.providers = append(provider.providers, gc.Kubernetes)
-	}
-	if gc.Mesos != nil {
-		provider.providers = append(provider.providers, gc.Mesos)
-	}
-	if gc.Eureka != nil {
-		provider.providers = append(provider.providers, gc.Eureka)
-	}
-	if gc.ECS != nil {
-		provider.providers = append(provider.providers, gc.ECS)
-	}
-	if gc.Rancher != nil {
-		provider.providers = append(provider.providers, gc.Rancher)
-	}
-	if gc.DynamoDB != nil {
-		provider.providers = append(provider.providers, gc.DynamoDB)
-	}
-	if gc.ServiceFabric != nil {
-		provider.providers = append(provider.providers, gc.ServiceFabric)
-	}
-	if acmeprovider.IsEnabled() {
-		provider.providers = append(provider.providers, acmeprovider.Get())
-		acme.ConvertToNewFormat(acmeprovider.Get().Storage)
-	}
-	if len(provider.providers) == 1 {
-		return provider.providers[0]
-	}
-	return provider
-}
-
-func (p providerAggregator) Provide(configurationChan chan<- types.ConfigMessage, pool *safe.Pool, constraints types.Constraints) error {
-	for _, p := range p.providers {
-		providerType := reflect.TypeOf(p)
-		jsonConf, err := json.Marshal(p)
-		if err != nil {
-			log.Debugf("Unable to marshal provider conf %v with error: %v", providerType, err)
-		}
-		log.Infof("Starting provider %v %s", providerType, jsonConf)
-		currentProvider := p
-		safe.Go(func() {
-			err := currentProvider.Provide(configurationChan, pool, constraints)
-			if err != nil {
-				log.Errorf("Error starting provider %v: %s", providerType, err)
-			}
-		})
-	}
-	return nil
-}

contrib/scripts/dumpcerts.sh

@@ -66,7 +66,7 @@ ${USAGE}" >&2
 
 bad_acme() {
 	echo "
-There was a problem parsing your acme.json file. $1
+There was a problem parsing your acme.json file.
 
 ${USAGE}" >&2
 	exit 2
@@ -104,7 +104,7 @@ fi
 
 jq=$(command -v jq) || exit_jq
 
-priv=$(${jq} -e -r '.Account.PrivateKey' "${acmefile}") || bad_acme
+priv=$(${jq} -e -r '.PrivateKey' "${acmefile}") || bad_acme
 
 if [ ! -n "${priv}" ]; then
 	echo "
@@ -155,16 +155,16 @@ echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----
    | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
 
 # Process the certificates for each of the domains in acme.json
-for domain in $(jq -r '.Certificates[].Domain.Main' ${acmefile}); do
+for domain in $(jq -r '.DomainsCertificate.Certs[].Certificate.Domain' ${acmefile}); do
 	# Traefik stores a cert bundle for each domain.  Within this cert
 	# bundle there is both proper the certificate and the Let's Encrypt CA
 	echo "Extracting cert bundle for ${domain}"
-	cert=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-         	select (.Domain.Main == $domain )| .Certificate' ${acmefile}) || bad_acme
+	cert=$(jq -e -r --arg domain "$domain" '.DomainsCertificate.Certs[].Certificate |
+         	select (.Domain == $domain )| .Certificate' ${acmefile}) || bad_acme
 	echo "${cert}" | ${CMD_DECODE_BASE64} > "${cdir}/${domain}.crt"
 
 	echo "Extracting private key for ${domain}"
-	key=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-		select (.Domain.Main == $domain )| .Key' ${acmefile}) || bad_acme
+	key=$(jq -e -r --arg domain "$domain" '.DomainsCertificate.Certs[].Certificate |
+		select (.Domain == $domain )| .PrivateKey' ${acmefile}) || bad_acme
 	echo "${key}" | ${CMD_DECODE_BASE64} > "${pdir}/${domain}.key"
 done

docs.Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine
+FROM alpine:3.14
 
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/.local/bin
 

docs/basics.md

@@ -62,12 +62,13 @@ And here is another example with client certificate authentication:
   [entryPoints.https]
   address = ":443"
   [entryPoints.https.tls]
-    [entryPoints.https.tls.ClientCA]
-    files = ["tests/clientca1.crt", "tests/clientca2.crt"]
-    optional = false
-    [[entryPoints.https.tls.certificates]]
-    certFile = "tests/traefik.crt"
-    keyFile = "tests/traefik.key"
+    [entryPoints.https.tls]
+      [entryPoints.https.tls.ClientCA]
+      files = ["tests/clientca1.crt", "tests/clientca2.crt"]
+      optional = false
+      [[entryPoints.https.tls.certificates]]
+      certFile = "tests/traefik.crt"
+      keyFile = "tests/traefik.key"
 ```
 
 - We enable SSL on `https` by giving a certificate and a key.
@@ -482,7 +483,7 @@ Each item takes precedence over the item below it:
 
 It means that arguments override configuration file, and key-value store overrides arguments.
 
-!!! note
+!!! note 
     the provider-enabling argument parameters (e.g., `--docker`) set all default values for the specific provider.  
     It must not be used if a configuration source with less precedence wants to set a non-default provider value.
 

docs/configuration/acme.md

@@ -38,20 +38,23 @@ storage = "acme.json"
 # or `storage = "traefik/acme/account"` if using KV store.
 
 # Entrypoint to proxy acme apply certificates to.
+# WARNING, if the TLS-SNI-01 challenge is used, it must point to an entrypoint on port 443
 #
 # Required
 #
 entryPoint = "https"
 
-# Deprecated, replaced by [acme.dnsChallenge].
+# Use a DNS-01 acme challenge rather than TLS-SNI-01 challenge
 #
-# Optional.
+# Optional (Deprecated, replaced by [acme.dnsChallenge])
 #
 # dnsProvider = "digitalocean"
 
-# Deprecated, replaced by [acme.dnsChallenge.delayBeforeCheck].
+# By default, the dnsProvider will verify the TXT DNS challenge record before letting ACME verify.
+# If delayDontCheckDNS is greater than zero, avoid this & instead just wait so many seconds.
+# Useful if internal networks block external DNS queries.
 #
-# Optional
+# Optional (Deprecated, replaced by [acme.dnsChallenge])
 # Default: 0
 #
 # delayDontCheckDNS = 0
@@ -82,12 +85,11 @@ entryPoint = "https"
 # - Leave comment to go to prod.
 #
 # Optional
-# Default: "https://acme-v02.api.letsencrypt.org/directory"
+# Default: "https://acme-v01.api.letsencrypt.org/directory"
 #
-# caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+# caServer = "https://acme-staging.api.letsencrypt.org/directory"
 
 # Domains list.
-# Only domains defined here can generate wildcard certificates.
 #
 # [[acme.domains]]
 #   main = "local1.com"
@@ -100,20 +102,19 @@ entryPoint = "https"
 # [[acme.domains]]
 #   main = "local4.com"
 
-# Use a HTTP-01 acme challenge.
+# Use a HTTP-01 acme challenge rather than TLS-SNI-01 challenge
 #
 # Optional but recommend
 #
 [acme.httpChallenge]
 
-  # EntryPoint to use for the HTTP-01 challenges.
+  # EntryPoint to use for the challenges.
   #
   # Required
   #
   entryPoint = "http"
 
-# Use a DNS-01/DNS-02 acme challenge rather than HTTP-01 challenge.
-# Note : Mandatory for wildcard certificates generation.
+# Use a DNS-01 acme challenge rather than TLS-SNI-01 challenge
 #
 # Optional
 #
@@ -136,12 +137,13 @@ entryPoint = "https"
 ```
 
 !!! note
-    If `HTTP-01` challenge is used, `acme.httpChallenge.entryPoint` has to be defined and reachable by Let's Encrypt through the port 80.
-    These are Let's Encrypt limitations as described on the [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72).
+    Even if `TLS-SNI-01` challenge is [disabled](https://community.letsencrypt.org/t/2018-01-11-update-regarding-acme-tls-sni-and-shared-hosting-infrastructure/50188) for the moment, it stays the _by default_ ACME Challenge in Træfik.
+    If `TLS-SNI-01` challenge is not re-enabled in the future, it we will be removed from Træfik.
 
 !!! note
-    Wildcard certificates can be generated only if `acme.dnsChallenge`
-option is enable.
+    If `TLS-SNI-01` challenge is used, `acme.entryPoint` has to be reachable by Let's Encrypt through the port 443.
+    If `HTTP-01` challenge is used, `acme.httpChallenge.entryPoint` has to be defined and reachable by Let's Encrypt through the port 80.
+    These are Let's Encrypt limitations as described on the [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72).
 
 ### Let's Encrypt downtime
 
@@ -221,7 +223,7 @@ Because KV stores (like Consul) have limited entries size, the certificates list
 !!! note
     It's possible to store up to approximately 100 ACME certificates in Consul.
 
-### `httpChallenge`
+### `acme.httpChallenge`
 
 Use `HTTP-01` challenge to generate/renew ACME certificates.
 
@@ -262,9 +264,9 @@ defaultEntryPoints = ["http", "https"]
     `acme.httpChallenge.entryPoint` has to be reachable by Let's Encrypt through the port 80.
     It's a Let's Encrypt limitation as described on the [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72).
 
-### `dnsChallenge`
+### `acme.dnsChallenge`
 
-Use `DNS-01/DNS-02` challenge to generate/renew ACME certificates.
+Use `DNS-01` challenge to generate/renew ACME certificates.
 
 ```toml
 [acme]
@@ -275,9 +277,6 @@ Use `DNS-01/DNS-02` challenge to generate/renew ACME certificates.
 # ...
 ```
 
-!!! note
-    ACME wildcard certificates can only be generated thanks to a `DNS-02` challenge.
-
 #### `provider`
 
 Select the provider that matches the DNS domain that will host the challenge TXT record, and provide environment variables to enable setting it:
@@ -287,7 +286,6 @@ Select the provider that matches the DNS domain that will host the challenge TXT
 | [Auroradns](https://www.pcextreme.com/aurora/dns)      | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                         |
 | [Azure](https://azure.microsoft.com/services/dns/)     | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`              |
 | [Cloudflare](https://www.cloudflare.com)               | `cloudflare`   | `CLOUDFLARE_EMAIL`, `CLOUDFLARE_API_KEY` - The Cloudflare `Global API Key` needs to be used and not the `Origin CA Key`   |
-| [CloudXNS](https://www.cloudxns.net)                   | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                 |
 | [DigitalOcean](https://www.digitalocean.com)           | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                           |
 | [DNSimple](https://dnsimple.com)                       | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                               |
 | [DNS Made Easy](https://dnsmadeeasy.com)               | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                    |
@@ -295,7 +293,6 @@ Select the provider that matches the DNS domain that will host the challenge TXT
 | [Dyn](https://dyn.com)                                 | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                      |
 | [Exoscale](https://www.exoscale.ch)                    | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                            |
 | [Gandi](https://www.gandi.net)                         | `gandi`        | `GANDI_API_KEY`                                                                                                           |
-| [Gandi V5](http://doc.livedns.gandi.net)               | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                         |
 | [GoDaddy](https://godaddy.com/domains)                 | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                   |
 | [Google Cloud DNS](https://cloud.google.com/dns/docs/) | `gcloud`       | `GCE_PROJECT`, `GCE_SERVICE_ACCOUNT_FILE`                                                                                 |
 | [Linode](https://www.linode.com)                       | `linode`       | `LINODE_API_KEY`                                                                                                          |
@@ -357,16 +354,12 @@ This will request a certificate from Let's Encrypt for each frontend with a Host
 
 For example, a rule `Host:test1.traefik.io,test2.traefik.io` will request a certificate with main domain `test1.traefik.io` and SAN `test2.traefik.io`.
 
-!!! warning
-    `onHostRule` option can not be used to generate wildcard certificates.
-    Refer to [the wildcard generation section](/configuration/acme/#wildcard-domain) for more information.
-
 ### `caServer`
 
 ```toml
 [acme]
 # ...
-caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+caServer = "https://acme-staging.api.letsencrypt.org/directory"
 # ...
 ```
 
@@ -375,7 +368,7 @@ CA server to use.
 - Uncomment the line to run on the staging Let's Encrypt server.
 - Leave comment to go to prod.
 
-### `domains`
+### `acme.domains`
 
 ```toml
 [acme]
@@ -389,22 +382,10 @@ CA server to use.
 [[acme.domains]]
   main = "local3.com"
 [[acme.domains]]
-  main = "*.local4.com"
+  main = "local4.com"
 # ...
 ```
 
-#### Wildcard domains
-
-Wildcard domain has to be defined as a main domain **with no SANs** (alternative domains).
-All domains must have A/AAAA records pointing to Træfik.
-
-!!! warning
-    Note that Let's Encrypt has [rate limiting](https://letsencrypt.org/docs/rate-limits).
-
-Each domain & SANs will lead to a certificate request.
-
-#### Others domains
-
 You can provide SANs (alternative domains) to each main domain.
 All domains must have A/AAAA records pointing to Træfik.
 
@@ -416,47 +397,9 @@ Each domain & SANs will lead to a certificate request.
 ### `dnsProvider` (Deprecated)
 
 !!! danger "DEPRECATED"
-    This option is deprecated, use [dnsChallenge.provider](/configuration/acme/#dnschallenge) instead.
+    This option is deprecated, use [dnsChallenge.provider](/configuration/acme/#acmednschallenge) instead.
 
 ### `delayDontCheckDNS` (Deprecated)
 
 !!! danger "DEPRECATED"
-    This option is deprecated, use [dnsChallenge.delayBeforeCheck](/configuration/acme/#dnschallenge) instead.
-
-## Wildcard certificates
-
-[ACME V2](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579) allows wildcard certificate support.
-However, this feature needs a specific configuration.
-
-### DNS-02 Challenge
-
-As described in [Let's Encrypt post](https://community.letsencrypt.org/t/staging-endpoint-for-acme-v2/49605), wildcard certificates can only be generated through a `DNS-02`Challenge.
-This challenge is linked to the Træfik option `acme.dnsChallenge`.
-
-```toml
-[acme]
-# ...
-[acme.dnsChallenge]
-  provider = "digitalocean"
-  delayBeforeCheck = 0
-# ...
-```
-
-For more information about this option, please refer to the [dnsChallenge section](/configuration/acme/#dnschallenge).
-
-### Wildcard domain
-
-Wildcard domains can currently be provided only by to the `acme.domains` option.
-Theses domains can not have SANs.
-
-```toml
-[acme]
-# ...
-[[acme.domains]]
-  main = "*local1.com"
-[[acme.domains]]
-  main = "*.local2.com"
-# ...
-```
-
-For more information about this option, please refer to the [domains section](/configuration/acme/#domains).
+    This option is deprecated, use [dnsChallenge.delayBeforeCheck](/configuration/acme/#acmednschallenge) instead.

docs/configuration/api.md

@@ -43,7 +43,6 @@ For more customization, see [entry points](/configuration/entrypoints/) document
 | Path                                                            | Method           | Description                               |
 |-----------------------------------------------------------------|------------------|-------------------------------------------|
 | `/`                                                             |     `GET`        | Provides a simple HTML frontend of Træfik |
-| `/cluster/leader`                                               |     `GET`        | JSON leader true/false response           |
 | `/health`                                                       |     `GET`        | JSON health metrics                       |
 | `/api`                                                          |     `GET`        | Configuration for all providers           |
 | `/api/providers`                                                |     `GET`        | Providers                                 |
@@ -223,25 +222,6 @@ curl -s "http://localhost:8080/api" | jq .
 }
 ```
 
-### Cluster Leadership
-
-```shell
-curl -s "http://localhost:8080/cluster/leader" | jq .
-```
-```shell
-< HTTP/1.1 200 OK
-< Content-Type: application/json; charset=UTF-8
-< Date: xxx
-< Content-Length: 15
-```
-If the given node is not a cluster leader, an HTTP status of `429-Too-Many-Requests` will be returned.
-```json
-{
-  // current leadership status of the queried node
-  "leader": true
-}
-```
-
 ### Health
 
 ```shell

docs/configuration/backends/consul.md

@@ -1,4 +1,4 @@
-# Consul Key-Value Backend
+# Consul Key-Value backend
 
 Træfik can be configured to use Consul as a backend configuration.
 

docs/configuration/backends/consulcatalog.md

@@ -48,121 +48,46 @@ prefix = "traefik"
 # Default: "Host:{{.ServiceName}}.{{.Domain}}"
 #
 #frontEndRule = "Host:{{.ServiceName}}.{{.Domain}}"
-
-# Enable Consul catalog TLS connection.
-#
-# Optional
-#
-#    [consulCatalog.tls]
-#    ca = "/etc/ssl/ca.crt"
-#    cert = "/etc/ssl/consul.crt"
-#    key = "/etc/ssl/consul.key"
-#    insecureskipverify = true
 ```
 
 This backend will create routes matching on hostname based on the service name used in Consul.
 
 To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
 
-## Tags
+### Tags
 
 Additional settings can be defined using Consul Catalog tags.
 
-!!! note
-    The default prefix is `traefik`.
-
-| Label                                                       | Description                                                                                                                                                                                                            |
-|-------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `<prefix>.enable=false`                                     | Disable this container in Træfik.                                                                                                                                                                                      |
-| `<prefix>.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
-| `<prefix>.protocol=https`                                   | Override the default `http` protocol.                                                                                                                                                                                  |
-| `<prefix>.weight=10`                                        | Assign this weight to the container.                                                                                                                                                                                   |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memRequestBodyBytes=0`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memResponseBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.retryExpression=EXPR`            | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `<prefix>.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend. ex: `NetworkErrorRatio() > 0.`                                                                                                           |
-| `<prefix>.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                  |
-| `<prefix>.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                    |
-| `<prefix>.backend.healthcheck.interval=1s`                  | Define the health check interval.                                                                                                                                                                                      |
-| `<prefix>.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm.                                                                                                                                                                    |
-| `<prefix>.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions.                                                                                                                                                                                        |
-| `<prefix>.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions.                                                                                                                                                                      |
-| `<prefix>.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions. (DEPRECATED)                                                                                                                                                                           |
-| `<prefix>.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                |
-| `<prefix>.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                  |
-| `<prefix>.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                       |
-| `<prefix>.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                             |
-| `<prefix>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `<prefix>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `<prefix>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `<prefix>.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                           |
-| `<prefix>.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                        |
-| `<prefix>.frontend.priority=10`                             | Override default frontend priority.                                                                                                                                                                                    |
-| `<prefix>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `<prefix>.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS).                                                                                                                                                 |
-| `<prefix>.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                |
-| `<prefix>.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                      |
-| `<prefix>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                             |
-| `<prefix>.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{{.ServiceName}}.{{.Domain}}`.                                                                                                                                      |
-| `<prefix>.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `<prefix>.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                 |
-
-### Custom Headers
-
-!!! note
-    The default prefix is `traefik`.
-
-| Label                                                  | Description                                                                                                                                                                         |
-|--------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `<prefix>.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `<prefix>.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-### Security Headers
-
-!!! note
-    The default prefix is `traefik`.
-
-| Label                                                     | Description                                                                                                                                                                                         |
-|-----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `<prefix>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `<prefix>.frontend.headers.hostsProxyHeaders=EXPR`        | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `<prefix>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `<prefix>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `<prefix>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `<prefix>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `<prefix>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `<prefix>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `<prefix>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `<prefix>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `<prefix>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `<prefix>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `<prefix>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `<prefix>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `<prefix>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `<prefix>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `<prefix>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `<prefix>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `<prefix>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Tag                                                       | Description                                                                                                                                                                        |
+|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.enable=false`                                    | Disable this container in Træfik                                                                                                                                                   |
+| `traefik.protocol=https`                                  | Override the default `http` protocol                                                                                                                                               |
+| `traefik.backend.weight=10`                               | Assign this weight to the container                                                                                                                                                |
+| `traefik.backend.circuitbreaker=EXPR`                     | Create a [circuit breaker](/basics/#backends) to be used against the backend, ex: `NetworkErrorRatio() > 0.`                                                                       |
+| `traefik.backend.maxconn.amount=10`                       | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                               |
+| `traefik.backend.maxconn.extractorfunc=client.ip`         | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
+| `traefik.frontend.rule=Host:test.traefik.io`              | Override the default frontend rule (Default: `Host:{{.ServiceName}}.{{.Domain}}`).                                                                                                 |
+| `traefik.frontend.passHostHeader=true`                    | Forward client `Host` header to the backend.                                                                                                                                       |
+| `traefik.frontend.priority=10`                            | Override default frontend priority                                                                                                                                                 |
+| `traefik.frontend.entryPoints=http,https`                 | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                                                                                           |
+| `traefik.frontend.auth.basic=EXPR`                        | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                   |
+| `traefik.backend.loadbalancer=drr`                        | override the default `wrr` load balancer algorithm                                                                                                                                 |
+| `traefik.backend.loadbalancer.stickiness=true`            | enable backend sticky sessions                                                                                                                                                     |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                                                                                                                   |
+| `traefik.backend.loadbalancer.sticky=true`                | enable backend sticky sessions (DEPRECATED)                                                                                                                                        |
 
 ### Examples
 
 If you want that Træfik uses Consul tags correctly you need to defined them like that:
-
-```js
+```json
 traefik.enable=true
 traefik.tags=api
 traefik.tags=external
 ```
 
 If the prefix defined in Træfik configuration is `bla`, tags need to be defined like that:
-
-```js
+```json
 bla.enable=true
 bla.tags=api
 bla.tags=external
-```
+```

docs/configuration/backends/docker.md

@@ -39,15 +39,6 @@ watch = true
 #
 # filename = "docker.tmpl"
 
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = "2"
-
 # Expose containers by default in Traefik.
 # If set to false, containers that don't have `traefik.enable=true` will be ignored.
 #
@@ -132,15 +123,6 @@ swarmmode = true
 #
 # filename = "docker.tmpl"
 
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = "2"
-
 # Expose services by default in Traefik.
 #
 # Optional
@@ -161,9 +143,9 @@ exposedbydefault = false
 
 To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
 
-## Labels: overriding default behavior
+## Labels: overriding default behaviour
 
-### Using Docker with Swarm Mode
+#### Using Docker with Swarm Mode
 
 If you use a compose file with the Swarm mode, labels should be defined in the `deploy` part of your service.
 This behavior is only enabled for docker-compose version 3+ ([Compose file reference](https://docs.docker.com/compose/compose-file/#labels-1)).
@@ -177,9 +159,9 @@ services:
         traefik.docker.network: traefik
 ```
 
-### Using Docker Compose
+#### Using Docker Compose
 
-If you are intending to use only Docker Compose commands (e.g. `docker-compose up --scale whoami=2 -d`), labels should be under your service, otherwise they will be ignored.
+If you are intending to use only Docker Compose commands (e.g. `docker-compose up --scale whoami=2 -d`), labels should be under your service, otherwise they will be ignored. 
 
 ```yaml
 version: "3"
@@ -191,74 +173,51 @@ services:
 
 ### On Containers
 
-Labels can be used on containers to override default behavior.
+Labels can be used on containers to override default behaviour.
 
-| Label                                                      | Description                                                                                                                                                                                                               |
-|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.docker.network`                                   | Set the docker network to use for connections to this container. [1]                                                                                                                                                      |
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                          |
-| `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                    |
-| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                      |
-| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                       |
-| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                          |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.memRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.memResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.retryExpression=EXPR`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                              |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                     |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                       |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval.                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                        |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                          |
-| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                               |
-| `traefik.backend.loadbalancer.swarm=true`                  | Use Swarm's inbuilt load balancer (only relevant under Swarm Mode).                                                                                                                                                       |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                     |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                          |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                |
-| `traefik.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                              |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                           |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                        |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                     |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                   |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                         |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                                |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                               |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                    |
+| Label                                                      | Description                                                                                                                                                                                                         |
+|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                    |
+| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                                                                |
+| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect.                                  |
+| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                  |
+| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                      |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                    |
+| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                         |
+| `traefik.backend.loadbalancer.swarm=true`                  | Use Swarm's inbuilt load balancer (only relevant under Swarm Mode).                                                                                                                                                 |
+| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                        |
+| `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                              |
+| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                |
+| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                 |
+| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                    |
+| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                         |
+| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                        |
+| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                  |
+| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`                                                                                                                             |
+| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                    |
+| `traefik.frontend.whitelistSourceRange:RANGE`              | List of IP-Ranges which are allowed to access. An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.docker.network`                                   | Set the docker network to use for connections to this container. [1]                                                                                                                                                |
+| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                               |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend. Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend. Must be set with `traefik.frontend.redirect.regex`.                                                                                                                      |
 
 [1] `traefik.docker.network`:
 If a container is linked to several networks, be sure to set the proper network name (you can check with `docker inspect <container_id>`) otherwise it will randomly pick one (depending on how docker is returning them).
 For instance when deploying docker `stack` from compose files, the compose defined networks will be prefixed with the `stack` name.
 Or if your service references external network use it's name instead.
 
-#### Custom Headers
-
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
 #### Security Headers
 
 | Label                                                    | Description                                                                                                                                                                                         |
 |----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                             |
+| `traefik.frontend.headers.customRequestHeaders=EXPR `    | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                    |
+| `traefik.frontend.headers.customResponseHeaders=EXPR`    | Appends the headers to each response returned by the container, before forwarding the response to the client. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                           |
+| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                      |
 | `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
 | `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
 | `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
+| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                         |
 | `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
 | `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
 | `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
@@ -267,81 +226,36 @@ Or if your service references external network use it's name instead.
 | `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
 | `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
 | `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
 | `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
 | `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
 | `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
 | `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 
-### On containers with Multiple Ports (segment labels)
+### On Service
 
-Segment labels are used to define routes to a container exposing multiple ports.
-A segment is a group of labels that apply to a port exposed by a container.
-You can define as many segments as ports exposed in a container.
-
-Segment labels override the default behavior.
+Services labels can be used for overriding default behaviour
 
 | Label                                                                     | Description                                                                                      |
 |---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the segment labels could be used. |
-| `traefik.<segment_name>.protocol`                                         | Overrides `traefik.protocol`.                                                                    |
-| `traefik.<segment_name>.weight`                                           | Assign this segment weight. Overrides `traefik.weight`.                                          |
-| `traefik.<segment_name>.frontend.auth.basic`                              | Sets a Basic Auth for that frontend                                                              |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this segment frontend to `BACKEND`. Default is to assign to the segment backend.          |
-| `traefik.<segment_name>.frontend.entryPoints`                             | Overrides `traefik.frontend.entrypoints`                                                         |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.passHostHeader`                          | Overrides `traefik.frontend.passHostHeader`.                                                     |
-| `traefik.<segment_name>.frontend.passTLSCert`                             | Overrides `traefik.frontend.passTLSCert`.                                                        |
-| `traefik.<segment_name>.frontend.priority`                                | Overrides `traefik.frontend.priority`.                                                           |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                     |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                               |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                       |
-| `traefik.<segment_name>.frontend.rule`                                    | Overrides `traefik.frontend.rule`.                                                               |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                              |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Overrides `traefik.frontend.whiteList.useXForwardedFor`.                                         |
+| `traefik.<service-name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the service labels could be used. |
+| `traefik.<service-name>.protocol`                                         | Overrides `traefik.protocol`.                                                                    |
+| `traefik.<service-name>.weight`                                           | Assign this service weight. Overrides `traefik.weight`.                                          |
+| `traefik.<service-name>.frontend.backend=BACKEND`                         | Assign this service frontend to `BACKEND`. Default is to assign to the service backend.          |
+| `traefik.<service-name>.frontend.entryPoints`                             | Overrides `traefik.frontend.entrypoints`                                                         |
+| `traefik.<service-name>.frontend.auth.basic`                              | Sets a Basic Auth for that frontend                                                              |
+| `traefik.<service-name>.frontend.passHostHeader`                          | Overrides `traefik.frontend.passHostHeader`.                                                     |
+| `traefik.<service-name>.frontend.priority`                                | Overrides `traefik.frontend.priority`.                                                           |
+| `traefik.<service-name>.frontend.rule`                                    | Overrides `traefik.frontend.rule`.                                                               |
+| `traefik.<service-name>.frontend.redirect`                                | Overrides `traefik.frontend.redirect`.                                                           |
+| `traefik.<service-name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                |
+| `traefik.<service-name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                     |
+| `traefik.<service-name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                               |
 
-#### Custom Headers
-
-| Label                                                                | Description                                                                                                                                                                         |
-|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-#### Security Headers
-
-| Label                                                                   | Description                                                                                                                                                                                         |
-|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 
 !!! note
-    If a label is defined both as a `container label` and a `segment label` (for example `traefik.<segment_name>.port=PORT` and `traefik.port=PORT` ), the `segment label` is used to defined the `<segment_name>` property (`port` in the example).
+    If a label is defined both as a `container label` and a `service label` (for example `traefik.<service-name>.port=PORT` and `traefik.port=PORT` ), the `service label` is used to defined the `<service-name>` property (`port` in the example).
 
-    It's possible to mix `container labels` and `segment labels`, in this case `container labels` are used as default value for missing `segment labels` but no frontends are going to be created with the `container labels`.
+    It's possible to mix `container labels` and `service labels`, in this case `container labels` are used as default value for missing `service labels` but no frontends are going to be created with the `container labels`.
 
     More details in this [example](/user-guide/docker-and-lets-encrypt/#labels).
 

docs/configuration/backends/ecs.md

@@ -124,75 +124,20 @@ Træfik needs the following policy to read ECS information:
 
 Labels can be used on task containers to override default behaviour:
 
-| Label                                                      | Description                                                                                                                                                                                                            |
-|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
-| `traefik.port=80`                                          | Override the default `port` value. Overrides `NetworkBindings` from Docker Container                                                                                                                                   |
-| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                   |
-| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                    |
-| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                       |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.retryExpression=EXPR`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                           |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                  |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                    |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval. (Default: 30s)                                                                                                                                                                       |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                     |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                       |
-| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                            |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                  |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                       |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                             |
-| `traefik.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                           |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                        |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                     |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                  |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                      |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                             |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{instance_name}.{domain}`.                                                                                                                                          |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                 |
-
-### Custom Headers
-
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-### Security Headers
-
-| Label                                                    | Description                                                                                                                                                                                         |
-|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Label                                                     | Description                                                                              |
+|-----------------------------------------------------------|------------------------------------------------------------------------------------------|
+| `traefik.protocol=https`                                  | override the default `http` protocol                                                     |
+| `traefik.weight=10`                                       | assign this weight to the container                                                      |
+| `traefik.enable=false`                                    | disable this container in Træfik                                                         |
+| `traefik.port=80`                                         | override the default `port` value. Overrides `NetworkBindings` from Docker Container     |
+| `traefik.backend.loadbalancer.method=drr`                 | override the default `wrr` load balancer algorithm                                       |
+| `traefik.backend.loadbalancer.stickiness=true`            | enable backend sticky sessions                                                           |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                         |
+| `traefik.backend.loadbalancer.sticky=true`                | enable backend sticky sessions (DEPRECATED)                                              |
+| `traefik.backend.healthcheck.path=/health`                | enable health checks for the backend, hitting the container at `path`                    |
+| `traefik.backend.healthcheck.interval=1s`                 | configure the health check interval                                                      |
+| `traefik.frontend.rule=Host:test.traefik.io`              | override the default frontend rule (Default: `Host:{containerName}.{domain}`).           |
+| `traefik.frontend.passHostHeader=true`                    | forward client `Host` header to the backend.                                             |
+| `traefik.frontend.priority=10`                            | override default frontend priority                                                       |
+| `traefik.frontend.entryPoints=http,https`                 | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`. |
+| `traefik.frontend.auth.basic=EXPR`                        | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`         |

docs/configuration/backends/eureka.md

@@ -21,7 +21,7 @@ endpoint = "http://my.eureka.server/eureka"
 # Optional
 # Default: 30s
 #
-refreshSeconds = "1m"
+delay = "1m"
 
 # Override default configuration template.
 # For advanced users :)

docs/configuration/backends/file.md

@@ -54,10 +54,7 @@ Træfik can be configured with a file.
       "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
       "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
     ]
-
-    [frontends.frontend1.whiteList]
-      sourceRange = ["10.42.0.0/16", "152.89.1.33/32", "afed:be44::/16"]
-      useXForwardedFor = true
+    whitelistSourceRange = ["10.42.0.0/16", "152.89.1.33/32", "afed:be44::/16"]
 
     [frontends.frontend1.routes]
       [frontends.frontend1.routes.route0]
@@ -124,7 +121,6 @@ Træfik can be configured with a file.
       entryPoint = "https"
       regex = "^http://localhost/(.*)"
       replacement = "http://mydomain/$1"
-      permanent = true
 
   [frontends.frontend2]
     # ...
@@ -191,10 +187,7 @@ defaultEntryPoints = ["http", "https"]
 ```
 
 !!! note
-    If `tls.entryPoints` is not defined, the certificate is attached to all the `defaultEntryPoints` with a TLS configuration.
-
-!!! note
-    Adding certificates directly to the entryPoint is still maintained but certificates declared in this way cannot be managed dynamically.
+    adding certificates directly to the entrypoint is still maintained but certificates declared in this way cannot be managed dynamically.
     It's recommended to use the file provider to declare certificates.
 
 ### Rules in a Separate File

docs/configuration/backends/kubernetes.md

@@ -50,17 +50,6 @@ See also [Kubernetes user guide](/user-guide/kubernetes).
 #
 # labelselector = "A and not B"
 
-# Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
-# If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.
-# Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
-#
-# Note : `ingressClass` option must begin with the "traefik" prefix.
-#
-# Optional
-# Default: empty
-#
-# ingressClass = "traefik-internal"
-
 # Disable PassHost Headers.
 #
 # Optional
@@ -115,137 +104,84 @@ If the service port defined in the ingress spec is 443, then the backend communi
     Please note that by enabling TLS communication between traefik and your pods, you will have to have trusted certificates that have the proper trust chain and IP subject name. 
     If this is not an option, you may need to skip TLS certificate verification.
     See the [InsecureSkipVerify](/configuration/commons/#main-section) setting for more details.
-
+    
 ## Annotations
 
 ### General annotations
 
 The following general annotations are applicable on the Ingress object:
 
-| Annotation                                                                      | Description                                                                                                                                     |
-|---------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.ingress.kubernetes.io/buffering: <YML>`                                | (3) See [buffering](/configuration/commons/#buffering) section.                                                                                 |
-| `traefik.ingress.kubernetes.io/error-pages: <YML>`                              | (1) See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                               |
-| `traefik.ingress.kubernetes.io/frontend-entry-points: http,https`               | Override the default frontend endpoints.                                                                                                        |
-| `traefik.ingress.kubernetes.io/pass-tls-cert: "true"`                           | Override the default frontend PassTLSCert value. Default: `false`.                                                                              |
-| `traefik.ingress.kubernetes.io/preserve-host: "true"`                           | Forward client `Host` header to the backend.                                                                                                    |
-| `traefik.ingress.kubernetes.io/priority: "3"`                                   | Override the default frontend rule priority.                                                                                                    |
-| `traefik.ingress.kubernetes.io/rate-limit: <YML>`                               | (2) See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                         |
-| `traefik.ingress.kubernetes.io/redirect-entry-point: https`                     | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS).                                                                          |
-| `traefik.ingress.kubernetes.io/redirect-permanent: "true"`                      | Return 301 instead of 302.                                                                                                                      |
-| `traefik.ingress.kubernetes.io/redirect-regex: ^http://localhost/(.*)`          | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-replacement`.                               |
-| `traefik.ingress.kubernetes.io/redirect-replacement: http://mydomain/$1`        | Redirect to another URL for that frontend. Must be set with `traefik.ingress.kubernetes.io/redirect-regex`.                                     |
-| `traefik.ingress.kubernetes.io/rewrite-target: /users`                          | Replaces each matched Ingress path with the specified one, and adds the old path to the `X-Replaced-Path` header.                               |
-| `traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip`                      | Override the default frontend rule type. Default: `PathPrefix`.                                                                                 |
-| `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access. all source IPs are permitted if the list is empty or a single range is ill-formatted. |
-| `traefik.ingress.kubernetes.io/app-root: "/index.html"`                         | Redirects all requests for `/` to the defined path. (4)                                                                                         |
-
-<1> `traefik.ingress.kubernetes.io/error-pages` example:
-
-```yaml
-foo:
-  status:
-  - "404"
-  backend: bar
-  query: /bar
-fii:
-  status:
-  - "503"
-  - "500"
-  backend: bar
-  query: /bir
-```
-
-<2> `traefik.ingress.kubernetes.io/rate-limit` example:
-
-```yaml
-extractorfunc: client.ip
-rateset:
-  bar:
-    period: 3s
-    average: 6
-    burst: 9
-  foo:
-    period: 6s
-    average: 12
-    burst: 18
-```
-
-<3> `traefik.ingress.kubernetes.io/buffering` example:
-
-```yaml
-maxrequestbodybytes: 10485760
-memrequestbodybytes: 2097153
-maxresponsebodybytes: 10485761
-memresponsebodybytes: 2097152
-retryexpression: IsNetworkError() && Attempts() <= 2
-```
-
-<4> `traefik.ingress.kubernetes.io/app-root`:
-Non-root paths will not be affected by this annotation and handled normally.
-This annotation may not be combined with the `ReplacePath` rule type or any other annotation leveraging that rule type.
-Trying to do so leads to an error and the corresponding Ingress object being ignored.
+- `traefik.frontend.rule.type: PathPrefixStrip`
+    Override the default frontend rule type. Default: `PathPrefix`.
+- `traefik.frontend.priority: "3"`
+    Override the default frontend rule priority.
+- `traefik.frontend.redirect.entryPoint: https`:
+    Enables Redirect to another entryPoint for that frontend (e.g. HTTPS).
+- `traefik.frontend.redirect.regex: ^http://localhost/(.*)`:
+    Redirect to another URL for that frontend. Must be set with `traefik.frontend.redirect.replacement`.
+- `traefik.frontend.redirect.replacement: http://mydomain/$1`:
+    Redirect to another URL for that frontend. Must be set with `traefik.frontend.redirect.regex`.
+- `traefik.frontend.entryPoints: http,https`
+    Override the default frontend endpoints.
+- `traefik.frontend.passTLSCert: true`
+    Override the default frontend PassTLSCert value. Default: `false`.
+- `ingress.kubernetes.io/rewrite-target: /users`
+    Replaces each matched Ingress path with the specified one, and adds the old path to the `X-Replaced-Path` header.
+- `ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"`
+    A comma-separated list of IP ranges permitted for access. all source IPs are permitted if the list is empty or a single range is ill-formatted.
 
 !!! note
-    Please note that `traefik.ingress.kubernetes.io/redirect-regex` and `traefik.ingress.kubernetes.io/redirect-replacement` do not have to be set if `traefik.ingress.kubernetes.io/redirect-entry-point` is defined for the redirection (they will not be used in this case).
+    Please note that `traefik.frontend.redirect.regex` and `traefik.frontend.redirect.replacement` do not have to be set if `traefik.frontend.redirect.entryPoint` is defined for the redirection (they will not be used in this case).
 
 The following annotations are applicable on the Service object associated with a particular Ingress object:
 
-| Annotation                                                               | Description                                                                                                                                                                           |
-|--------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.backend.loadbalancer.sticky: "true"`                            | Enable backend sticky sessions (DEPRECATED).                                                                                                                                          |
-| `traefik.ingress.kubernetes.io/affinity: "true"`                         | Enable backend sticky sessions.                                                                                                                                                       |
-| `traefik.ingress.kubernetes.io/circuit-breaker-expression: <expression>` | Set the circuit breaker expression for the backend.                                                                                                                                   |
-| `traefik.ingress.kubernetes.io/load-balancer-method: drr`                | Override the default `wrr` load balancer algorithm.                                                                                                                                   |
-| `traefik.ingress.kubernetes.io/max-conn-amount: 10`                      | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                               |
-| `traefik.ingress.kubernetes.io/max-conn-extractor-func: client.ip`       | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect. |
-| `traefik.ingress.kubernetes.io/session-cookie-name: <NAME>`              | Manually set the cookie name for sticky sessions.                                                                                                                                     |
+- `traefik.backend.loadbalancer.method=drr`
+    Override the default `wrr` load balancer algorithm.
+- `traefik.backend.loadbalancer.stickiness=true`
+    Enable backend sticky sessions.
+- `traefik.backend.loadbalancer.stickiness.cookieName=NAME`
+    Manually set the cookie name for sticky sessions.
+- `traefik.backend.loadbalancer.sticky=true`
+    Enable backend sticky sessions (DEPRECATED).
+- `traefik.backend.circuitbreaker: <expression>`
+    Set the circuit breaker expression for the backend.
 
-!!! note
-    `traefik.ingress.kubernetes.io/` and `ingress.kubernetes.io/` are supported prefixes.
-
-### Custom Headers Annotations
-
-|                        Annotation                     |                                                                                             Description                                                                          |
-| ------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `ingress.kubernetes.io/custom-request-headers: EXPR`  | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `ingress.kubernetes.io/custom-response-headers: EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-### Security Headers Annotations
+### Security annotations
 
 The following security annotations are applicable on the Ingress object:
 
-|                        Annotation                         |                                                                                             Description                                                                                             |
-| ----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `ingress.kubernetes.io/allowed-hosts: EXPR`               | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                             |
-| `ingress.kubernetes.io/proxy-headers: EXPR`               | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                      |
-| `ingress.kubernetes.io/ssl-redirect: "true"`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `ingress.kubernetes.io/ssl-temporary-redirect: "true"`    | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `ingress.kubernetes.io/ssl-host: HOST`                    | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `ingress.kubernetes.io/ssl-proxy-headers: EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
-| `ingress.kubernetes.io/hsts-max-age: "315360000"`         | Sets the max-age of the HSTS header.                                                                                                                                                                |
-| `ingress.kubernetes.io/hsts-include-subdomains: "true"`   | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
-| `ingress.kubernetes.io/hsts-preload: "true"`              | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
-| `ingress.kubernetes.io/force-hsts: "false"`               | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `ingress.kubernetes.io/frame-deny: "false"`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `ingress.kubernetes.io/content-type-nosniff: "true"`      | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `ingress.kubernetes.io/browser-xss-filter: "true"`        | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `ingress.kubernetes.io/custom-browser-xss-value: VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `ingress.kubernetes.io/content-security-policy: VALUE`    | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `ingress.kubernetes.io/public-key: VALUE`                 | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `ingress.kubernetes.io/referrer-policy: VALUE`            | Adds referrer policy  header.                                                                                                                                                                       |
-| `ingress.kubernetes.io/is-development: "false"`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+|                        Annotation                        |                                                                                             Description                                                                                             |
+| -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ingress.kubernetes.io/allowed-hosts:EXPR`               | Provides a list of allowed hosts that requests will be processed. Format: `Host1,Host2`                                                                                                             |
+| `ingress.kubernetes.io/custom-request-headers:EXPR`      | Provides the container with custom request headers that will be appended to each request forwarded to the container. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                    |
+| `ingress.kubernetes.io/custom-response-headers:EXPR`     | Appends the headers to each response returned by the container, before forwarding the response to the client. Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                           |
+| `ingress.kubernetes.io/proxy-headers:EXPR`               | Provides a list of headers that the proxied hostname may be stored. Format:  `HEADER1,HEADER2`                                                                                                      |
+| `ingress.kubernetes.io/ssl-redirect:true`                | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
+| `ingress.kubernetes.io/ssl-temporary-redirect:true`      | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
+| `ingress.kubernetes.io/ssl-host:HOST`                    | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
+| `ingress.kubernetes.io/ssl-proxy-headers:EXPR`           | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`). Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                          |
+| `ingress.kubernetes.io/hsts-max-age:315360000`           | Sets the max-age of the HSTS header.                                                                                                                                                                |
+| `ingress.kubernetes.io/hsts-include-subdomains:true`      | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
+| `ingress.kubernetes.io/hsts-preload:true`                | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
+| `ingress.kubernetes.io/force-hsts:false`                 | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
+| `ingress.kubernetes.io/frame-deny:false`                 | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
+| `ingress.kubernetes.io/custom-frame-options-value:VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
+| `ingress.kubernetes.io/content-type-nosniff:true`        | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
+| `ingress.kubernetes.io/browser-xss-filter:true`          | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
+| `ingress.kubernetes.io/content-security-policy:VALUE`    | Adds CSP Header with the custom value.                                                                                                                                                              |
+| `ingress.kubernetes.io/public-key:VALUE`                 | Adds pinned HTST public key header.                                                                                                                                                                 |
+| `ingress.kubernetes.io/referrer-policy:VALUE`            | Adds referrer policy  header.                                                                                                                                                                       |
+| `ingress.kubernetes.io/is-development:false`             | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 
 ### Authentication
 
 Is possible to add additional authentication annotations to the Ingress object.
 The source of the authentication is a Secret object that contains the credentials.
 
-| Annotation                                    | Description                                                                                                 |
-|-----------------------------------------------|-------------------------------------------------------------------------------------------------------------|
-| `ingress.kubernetes.io/auth-type: basic`      | Contains the authentication type. The only permitted type is `basic`.                                       |
-| `ingress.kubernetes.io/auth-secret: mysecret` | Name of Secret containing the username and password with access to the paths defined in the Ingress object. |
+- `ingress.kubernetes.io/auth-type`: `basic`
+    Contains the authentication type. The only permitted type is `basic`.
+- `ingress.kubernetes.io/auth-secret`: `mysecret`
+    Contains the username and password with access to the paths defined in the Ingress object.
 
 The secret must be created in the same namespace as the Ingress object.
 

docs/configuration/backends/marathon.md

@@ -3,7 +3,7 @@
 Træfik can be configured to use Marathon as a backend configuration.
 
 See also [Marathon user guide](/user-guide/marathon).
-
+ 
 
 ## Configuration
 
@@ -45,15 +45,6 @@ domain = "marathon.localhost"
 #
 # filename = "marathon.tmpl"
 
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = "2"
-
 # Expose Marathon apps by default in Traefik.
 #
 # Optional
@@ -79,7 +70,7 @@ domain = "marathon.localhost"
 
 # Enable filtering using Marathon constraints..
 # If enabled, Traefik will read Marathon constraints, as defined in https://mesosphere.github.io/marathon/docs/constraints.html
-# Each individual constraint will be treated as a verbatim compounded tag.
+# Each individual constraint will be treated as a verbatim compounded tag. 
 # i.e. "rack_id:CLUSTER:rack-1", with all constraint groups concatenated together using ":"
 #
 # Optional
@@ -159,154 +150,52 @@ domain = "marathon.localhost"
 
 To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
 
-## Labels: overriding default behavior
+## Labels: overriding default behaviour
 
-Marathon labels may be used to dynamically change the routing and forwarding behavior.
+Marathon labels may be used to dynamically change the routing and forwarding behaviour.
 
 They may be specified on one of two levels: Application or service.
 
 ### Application Level
 
-The following labels can be defined on Marathon applications. They adjust the behavior for the entire application.
+The following labels can be defined on Marathon applications. They adjust the behaviour for the entire application.
 
-| Label                                                      | Description                                                                                                                                                                                                            |
-|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
-| `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
-| `traefik.portIndex=1`                                      | Register port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                           |
-| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                   |
-| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                    |
-| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                       |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.retryExpression=EXPR`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                           |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                  |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                    |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval. (Default: 30s)                                                                                                                                                                       |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                     |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                       |
-| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                            |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                  |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                       |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                             |
-| `traefik.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                           |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                        |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                     |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                  |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                      |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                             |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{sub_domain}.{domain}`.                                                                                                                                             |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                 |
+| Label                                                                 | Description                                                                                                                                                                        |
+|-----------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.backend=foo`                                                 | assign the application to `foo` backend                                                                                                                                            |
+| `traefik.backend.maxconn.amount=10`                                   | set a maximum number of connections to the backend. Must be used in conjunction with the below label to take effect.                                                               |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                     | set the function to be used against the request to determine what to limit maximum connections to the backend by. Must be used in conjunction with the above label to take effect. |
+| `traefik.backend.loadbalancer.method=drr`                             | override the default `wrr` load balancer algorithm                                                                                                                                 |
+| `traefik.backend.loadbalancer.sticky=true`                            | enable backend sticky sessions (DEPRECATED)                                                                                                                                        |
+| `traefik.backend.loadbalancer.stickiness=true`                        | enable backend sticky sessions                                                                                                                                                     |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`             | Manually set the cookie name for sticky sessions                                                                                                                                   |
+| `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                       |
+| `traefik.backend.healthcheck.path=/health`                            | set the Traefik health check path [default: no health checks]                                                                                                                      |
+| `traefik.backend.healthcheck.interval=5s`                             | sets a custom health check interval in Go-parseable (`time.ParseDuration`) format [default: 30s]                                                                                   |
+| `traefik.portIndex=1`                                                 | register port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                       |
+| `traefik.port=80`                                                     | register the explicit application port value. Cannot be used alongside `traefik.portIndex`.                                                                                        |
+| `traefik.protocol=https`                                              | override the default `http` protocol                                                                                                                                               |
+| `traefik.weight=10`                                                   | assign this weight to the application                                                                                                                                              |
+| `traefik.enable=false`                                                | disable this application in Træfik                                                                                                                                                 |
+| `traefik.frontend.rule=Host:test.traefik.io`                          | override the default frontend rule (Default: `Host:{containerName}.{domain}`).                                                                                                     |
+| `traefik.frontend.passHostHeader=true`                                | forward client `Host` header to the backend.                                                                                                                                       |
+| `traefik.frontend.priority=10`                                        | override default frontend priority                                                                                                                                                 |
+| `traefik.frontend.entryPoints=http,https`                             | assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                                                                                           |
+| `traefik.frontend.auth.basic=EXPR`                                    | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`.                                                                                                  |
 
-#### Custom Headers
+### Service Level
 
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-|
+For applications that expose multiple ports, specific labels can be used to extract one frontend/backend configuration pair per port. Each such pair is called a _service_. The (freely choosable) name of the service is an integral part of the service label name.
 
-#### Security Headers
-
-| Label                                                    | Description                                                                                                                                                                                         |
-|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
-
-### Applications with Multiple Ports (segment labels)
-
-Segment labels are used to define routes to an application exposing multiple ports.
-A segment is a group of labels that apply to a port exposed by an application.
-You can define as many segments as ports exposed in an application.
-
-Segment labels override the default behavior.
-
-| Label                                                                     | Description                                                                                          |
-|---------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.portIndex=1`                                      | Create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. |
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the service labels could be used.     |
-| `traefik.<segment_name>.protocol=http`                                    | Overrides `traefik.protocol`.                                                                        |
-| `traefik.<segment_name>.weight=10`                                        | Assign this service weight. Overrides `traefik.weight`.                                              |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                         | Sets a Basic Auth for that frontend                                                                  |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this service frontend to `BACKEND`. Default is to assign to the service backend.              |
-| `traefik.<segment_name>.frontend.entryPoints=https`                       | Overrides `traefik.frontend.entrypoints`                                                             |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                        |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                     | Overrides `traefik.frontend.passHostHeader`.                                                         |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                        | Overrides `traefik.frontend.passTLSCert`.                                                            |
-| `traefik.<segment_name>.frontend.priority=10`                             | Overrides `traefik.frontend.priority`.                                                               |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                  |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                    |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                         |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                                   |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                           |
-| `traefik.<segment_name>.frontend.rule=EXP`                                | Overrides `traefik.frontend.rule`. Default: `{service_name}.{sub_domain}.{domain}`                   |
-| `traefik.<segment_name>.frontend.whitelistSourceRange=RANGE`              | Overrides `traefik.frontend.whitelistSourceRange`.                                                   |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                                  |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                               |
-
-#### Custom Headers
-
-| Label                                                                | Description                                                                                                                                                                         |
-|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-#### Security Headers
-
-| Label                                                                   | Description                                                                                                                                                                                         |
-|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Label                                                  | Description                                                                                          |
+|--------------------------------------------------------|------------------------------------------------------------------------------------------------------|
+| `traefik.<service-name>.port=443`                      | create a service binding with frontend/backend using this port. Overrides `traefik.port`.            |
+| `traefik.<service-name>.portIndex=1`                   | create a service binding with frontend/backend using this port index. Overrides `traefik.portIndex`. |
+| `traefik.<service-name>.protocol=https`                | assign `https` protocol. Overrides `traefik.protocol`.                                               |
+| `traefik.<service-name>.weight=10`                     | assign this service weight. Overrides `traefik.weight`.                                              |
+| `traefik.<service-name>.frontend.backend=fooBackend`   | assign this service frontend to `foobackend`. Default is to assign to the service backend.           |
+| `traefik.<service-name>.frontend.entryPoints=http`     | assign this service entrypoints. Overrides `traefik.frontend.entrypoints`.                           |
+| `traefik.<service-name>.frontend.auth.basic=test:EXPR` | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                     |
+| `traefik.<service-name>.frontend.passHostHeader=true`  | Forward client `Host` header to the backend. Overrides `traefik.frontend.passHostHeader`.            |
+| `traefik.<service-name>.frontend.priority=10`          | assign the service frontend priority. Overrides `traefik.frontend.priority`.                         |
+| `traefik.<service-name>.frontend.rule=Path:/foo`       | assign the service frontend rule. Overrides `traefik.frontend.rule`.                                 |

docs/configuration/backends/mesos.md

@@ -69,7 +69,7 @@ domain = "mesos.localhost"
 #
 # RefreshSeconds = 30
 
-# IP sources (e.g. host, docker, mesos, netinfo).
+# IP sources (e.g. host, docker, mesos, rkt).
 #
 # Optional
 #
@@ -91,80 +91,3 @@ domain = "mesos.localhost"
 #
 # groupsAsSubDomains = true
 ```
-
-## Labels: overriding default behaviour
-
-The following labels can be defined on Mesos tasks. They adjust the behaviour for the entire application.
-
-| Label                                                      | Description                                                                                                                                                                                                            |
-|------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                       |
-| `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                 |
-| `traefik.portIndex=1`                                      | Register port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                           |
-| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                   |
-| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                    |
-| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                       |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.memResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.buffering.retryExpression=EXPR`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                            |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                           |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                  |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                    |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval. (Default: 30s)                                                                                                                                                                       |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                     |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                       |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                  |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                       |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                             |
-| `traefik.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                          |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                           |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                        |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                     |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                    |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                  |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                      |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                             |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{discovery_name}.{domain}`.                                                                                                                                         |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                 |
-
-### Custom Headers
-
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-### Security Headers
-
-| Label                                                    | Description                                                                                                                                                                                         |
-|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |

docs/configuration/backends/rancher.md

@@ -46,22 +46,6 @@ exposedByDefault = false
 # Default: false
 #
 enableServiceHealthFilter = true
-
-# Override default configuration template.
-# For advanced users :)
-#
-# Optional
-#
-# filename = "rancher.tmpl"
-
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = "2"
 ```
 
 To enable constraints see [backend-specific constraints section](/configuration/commons/#backend-specific).
@@ -132,146 +116,25 @@ secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
     io.rancher.container.create_agent: true
     ```
 
-## Labels: overriding default behavior
+## Labels: overriding default behaviour
 
-### On Containers
+Labels can be used on task containers to override default behaviour:
 
-Labels can be used on task containers to override default behavior:
-
-| Label                                                      | Description                                                                                                                                                                                                               |
-|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                          |
-| `traefik.port=80`                                          | Register this port. Useful when the container exposes multiples ports.                                                                                                                                                    |
-| `traefik.protocol=https`                                   | Override the default `http` protocol                                                                                                                                                                                      |
-| `traefik.weight=10`                                        | Assign this weight to the container                                                                                                                                                                                       |
-| `traefik.backend=foo`                                      | Give the name `foo` to the generated backend for this container.                                                                                                                                                          |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.memRequestBodyBytes=0`          | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.memResponseBodyBytes=0`         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.buffering.retryExpression=EXPR`           | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                               |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                              |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                     |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                       |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval.                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                        |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                          |
-| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                               |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                     |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                          |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                |
-| `traefik.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                             |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                              |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                           |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                        |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                       |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                     |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                   |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                         |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                                |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Default: `Host:{service_name}.{stack_name}.{domain}`.                                                                                                                                 |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                    |
-
-#### Custom Headers
-
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-#### Security Headers
-
-| Label                                                    | Description                                                                                                                                                                                         |
-|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR`        | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
-
-### On containers with Multiple Ports (segment labels)
-
-Segment labels are used to define routes to a container exposing multiple ports.
-A segment is a group of labels that apply to a port exposed by a container.
-You can define as many segments as ports exposed in a container.
-
-Segment labels override the default behavior.
-
-| Label                                                                     | Description                                                                                      |
-|---------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------|
-| `traefik.<segment_name>.port=PORT`                                        | Overrides `traefik.port`. If several ports need to be exposed, the segment labels could be used. |
-| `traefik.<segment_name>.protocol`                                         | Overrides `traefik.protocol`.                                                                    |
-| `traefik.<segment_name>.weight`                                           | Assign this segment weight. Overrides `traefik.weight`.                                          |
-| `traefik.<segment_name>.frontend.auth.basic`                              | Sets a Basic Auth for that frontend                                                              |
-| `traefik.<segment_name>.frontend.backend=BACKEND`                         | Assign this segment frontend to `BACKEND`. Default is to assign to the segment backend.          |
-| `traefik.<segment_name>.frontend.entryPoints`                             | Overrides `traefik.frontend.entrypoints`                                                         |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`              | See [custom error pages](/configuration/commons/#custom-error-pages) section.                    |
-| `traefik.<segment_name>.frontend.passHostHeader`                          | Overrides `traefik.frontend.passHostHeader`.                                                     |
-| `traefik.<segment_name>.frontend.passTLSCert`                             | Overrides `traefik.frontend.passTLSCert`.                                                        |
-| `traefik.<segment_name>.frontend.priority`                                | Overrides `traefik.frontend.priority`.                                                           |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`             | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`       | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`      | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`        | See [rate limiting](/configuration/commons/#rate-limiting) section.                              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`               | Overrides `traefik.frontend.redirect.entryPoint`.                                                |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`   | Overrides `traefik.frontend.redirect.regex`.                                                     |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1` | Overrides `traefik.frontend.redirect.replacement`.                                               |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                       |
-| `traefik.<segment_name>.frontend.rule`                                    | Overrides `traefik.frontend.rule`.                                                               |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`             | Overrides `traefik.frontend.whiteList.sourceRange`.                                              |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`         | Overrides `traefik.frontend.whiteList.useXForwardedFor`.                                         |
-
-#### Custom Headers
-
-| Label                                                                | Description                                                     |
-|----------------------------------------------------------------------|-----------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | overrides `traefik.frontend.headers.customRequestHeaders=EXPR ` |
-| `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | overrides `traefik.frontend.headers.customResponseHeaders=EXPR` |
-
-#### Security Headers
-
-| Label                                                                   | Description                                                        |
-|-------------------------------------------------------------------------|--------------------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.allowedHosts=EXPR`             | overrides `traefik.frontend.headers.allowedHosts=EXPR`             |
-| `traefik.<segment_name>.frontend.headers.hostsProxyHeaders=EXPR`        | overrides `traefik.frontend.headers.hostsProxyHeaders=EXPR`        |
-| `traefik.<segment_name>.frontend.headers.SSLRedirect=true`              | overrides `traefik.frontend.headers.SSLRedirect=true`              |
-| `traefik.<segment_name>.frontend.headers.SSLTemporaryRedirect=true`     | overrides `traefik.frontend.headers.SSLTemporaryRedirect=true`     |
-| `traefik.<segment_name>.frontend.headers.SSLHost=HOST`                  | overrides `traefik.frontend.headers.SSLHost=HOST`                  |
-| `traefik.<segment_name>.frontend.headers.SSLProxyHeaders=EXPR`          | overrides `traefik.frontend.headers.SSLProxyHeaders=EXPR`          |
-| `traefik.<segment_name>.frontend.headers.STSSeconds=315360000`          | overrides `traefik.frontend.headers.STSSeconds=315360000`          |
-| `traefik.<segment_name>.frontend.headers.STSIncludeSubdomains=true`     | overrides `traefik.frontend.headers.STSIncludeSubdomains=true`     |
-| `traefik.<segment_name>.frontend.headers.STSPreload=true`               | overrides `traefik.frontend.headers.STSPreload=true`               |
-| `traefik.<segment_name>.frontend.headers.forceSTSHeader=false`          | overrides `traefik.frontend.headers.forceSTSHeader=false`          |
-| `traefik.<segment_name>.frontend.headers.frameDeny=false`               | overrides `traefik.frontend.headers.frameDeny=false`               |
-| `traefik.<segment_name>.frontend.headers.customFrameOptionsValue=VALUE` | overrides `traefik.frontend.headers.customFrameOptionsValue=VALUE` |
-| `traefik.<segment_name>.frontend.headers.contentTypeNosniff=true`       | overrides `traefik.frontend.headers.contentTypeNosniff=true`       |
-| `traefik.<segment_name>.frontend.headers.browserXSSFilter=true`         | overrides `traefik.frontend.headers.browserXSSFilter=true`         |
-| `traefik.<segment_name>.frontend.headers.customBrowserXSSValue=VALUE`   | overrides `traefik.frontend.headers.customBrowserXSSValue=VALUE`   |
-| `traefik.<segment_name>.frontend.headers.contentSecurityPolicy=VALUE`   | overrides `traefik.frontend.headers.contentSecurityPolicy=VALUE`   |
-| `traefik.<segment_name>.frontend.headers.publicKey=VALUE`               | overrides `traefik.frontend.headers.publicKey=VALUE`               |
-| `traefik.<segment_name>.frontend.headers.referrerPolicy=VALUE`          | overrides `traefik.frontend.headers.referrerPolicy=VALUE`          |
-| `traefik.<segment_name>.frontend.headers.isDevelopment=false`           | overrides `traefik.frontend.headers.isDevelopment=false`           |
+| Label                                                                 | Description                                                                                             |
+|-----------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
+| `traefik.protocol=https`                                              | Override the default `http` protocol                                                                    |
+| `traefik.weight=10`                                                   | Assign this weight to the container                                                                     |
+| `traefik.enable=false`                                                | Disable this container in Træfik                                                                        |
+| `traefik.frontend.rule=Host:test.traefik.io`                          | Override the default frontend rule (Default: `Host:{containerName}.{domain}`).                          |
+| `traefik.frontend.passHostHeader=true`                                | Forward client `Host` header to the backend.                                                            |
+| `traefik.frontend.priority=10`                                        | Override default frontend priority                                                                      |
+| `traefik.frontend.entryPoints=http,https`                             | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`.                |
+| `traefik.frontend.auth.basic=EXPR`                                    | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`.                       |
+| `traefik.frontend.redirect.entryPoint=https`                          | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                   |
+| `traefik.frontend.redirect.regex: ^http://localhost/(.*)`             | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`. |
+| `traefik.frontend.redirect.replacement: http://mydomain/$1`           | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.       |
+| `traefik.backend.circuitbreaker.expression=NetworkErrorRatio() > 0.5` | Create a [circuit breaker](/basics/#backends) to be used against the backend                            |
+| `traefik.backend.loadbalancer.method=drr`                             | Override the default `wrr` load balancer algorithm                                                      |
+| `traefik.backend.loadbalancer.stickiness=true`                        | Enable backend sticky sessions                                                                          |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`             | Manually set the cookie name for sticky sessions                                                        |
+| `traefik.backend.loadbalancer.sticky=true`                            | Enable backend sticky sessions (DEPRECATED)                                                             |

docs/configuration/backends/servicefabric.md

@@ -1,33 +1,33 @@
-# Service Fabric Backend
+# Azure Service Fabric Backend
 
-Træfik can be configured to use Service Fabric as a backend configuration.
+Træfik can be configured to use Azure Service Fabric as a backend configuration.
 
 See [this repository for an example deployment package and further documentation.](https://aka.ms/traefikonsf)
 
-## Service Fabric
+## Azure Service Fabric
 
 ```toml
 ################################################################
-# Service Fabric provider
+# Azure Service Fabric provider
 ################################################################
 
-# Enable Service Fabric configuration backend
+# Enable Azure Service Fabric configuration backend
 [serviceFabric]
 
-# Service Fabric Management Endpoint
+# Azure Service Fabric Management Endpoint
 #
 # Required
 #
 clusterManagementUrl = "https://localhost:19080"
 
-# Service Fabric Management Endpoint API Version
+# Azure Service Fabric Management Endpoint API Version
 #
 # Required
 # Default: "3.0"
 #
 apiVersion = "3.0"
 
-# Service Fabric Polling Interval (in seconds)
+# Azure Service Fabric Polling Interval (in seconds)
 #
 # Required
 # Default: 10
@@ -69,10 +69,10 @@ Here is an example of an extension setting Træfik labels:
 </StatelessServiceType>
 ```
 
-#### Property Manager
+#### Property Manager 
 
 Set Labels with the property manager API to overwrite and add labels, while your service is running.
-Here is an example of adding a frontend rule using the property manager API.
+Here is an example of adding a frontend rule using the property manager API. 
 
 ```shell
 curl -X PUT \
@@ -92,64 +92,23 @@ curl -X PUT \
 
 ## Available Labels
 
-Labels, set through extensions or the property manager, can be used on services to override default behavior.
+Labels, set through extensions or the property manager, can be used on services to override default behaviour.
 
-| Label                                                      | Description                                                                                                                                                                                                               |
-|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.enable=false`                                     | Disable this container in Træfik                                                                                                                                                                                          |
-| `traefik.backend.circuitbreaker.expression=EXPR`           | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                              |
-| `traefik.backend.group.name`                               | Group all services with the same name into a single backend in Træfik                                                                                                                                                     |
-| `traefik.backend.group.weight`                             | Set the weighting of the current services nodes in the backend group                                                                                                                                                      |
-| `traefik.backend.healthcheck.path=/health`                 | Enable health check for the backend, hitting the container at `path`.                                                                                                                                                     |
-| `traefik.backend.healthcheck.port=8080`                    | Allow to use a different port for the health check.                                                                                                                                                                       |
-| `traefik.backend.healthcheck.interval=1s`                  | Define the health check interval.                                                                                                                                                                                         |
-| `traefik.backend.loadbalancer.method=drr`                  | Override the default `wrr` load balancer algorithm                                                                                                                                                                        |
-| `traefik.backend.loadbalancer.stickiness=true`             | Enable backend sticky sessions                                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`  | Manually set the cookie name for sticky sessions                                                                                                                                                                          |
-| `traefik.backend.loadbalancer.sticky=true`                 | Enable backend sticky sessions (DEPRECATED)                                                                                                                                                                               |
-| `traefik.backend.maxconn.amount=10`                        | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
-| `traefik.backend.maxconn.extractorfunc=client.ip`          | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                     |
-| `traefik.backend.weight=10`                                | Assign this weight to the container                                                                                                                                                                                       |
-| `traefik.frontend.auth.basic=EXPR`                         | Sets basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                          |
-| `traefik.frontend.entryPoints=http,https`                  | Assign this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                |
-| `traefik.frontend.passHostHeader=true`                     | Forward client `Host` header to the backend.                                                                                                                                                                              |
-| `traefik.frontend.passTLSCert=true`                        | Forward TLS Client certificates to the backend.                                                                                                                                                                           |
-| `traefik.frontend.priority=10`                             | Override default frontend priority                                                                                                                                                                                        |
-| `traefik.frontend.redirect.entryPoint=https`               | Enables Redirect to another entryPoint for that frontend (e.g. HTTPS)                                                                                                                                                     |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`   | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                   |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1` | Redirect to another URL for that frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                         |
-| `traefik.frontend.redirect.permanent=true`                 | Return 301 instead of 302.                                                                                                                                                                                                |
-| `traefik.frontend.rule=EXPR`                               | Override the default frontend rule. Defaults to SF address.                                                                                                                                                               |
-| `traefik.frontend.whiteList.sourceRange=RANGE`             | List of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`         | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                    |
-
-### Custom Headers
-
-| Label                                                 | Description                                                                                                                                                                         |
-|-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
-| `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |
-
-### Security Headers
-
-| Label                                                    | Description                                                                                                                                                                                         |
-|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.allowedHosts=EXPR`             | Provides a list of allowed hosts that requests will be processed.<br>Format: `Host1,Host2`                                                                                                          |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
-| `traefik.frontend.headers.SSLRedirect=true`              | Forces the frontend to redirect to SSL if a non-SSL request is sent.                                                                                                                                |
-| `traefik.frontend.headers.SSLTemporaryRedirect=true`     | Forces the frontend to redirect to SSL if a non-SSL request is sent, but by sending a 302 instead of a 301.                                                                                         |
-| `traefik.frontend.headers.SSLHost=HOST`                  | This setting configures the hostname that redirects will be based on. Default is "", which is the same host as the request.                                                                         |
-| `traefik.frontend.headers.SSLProxyHeaders=EXPR`          | Header combinations that would signify a proper SSL Request (Such as `X-Forwarded-For:https`).<br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                      |
-| `traefik.frontend.headers.STSSeconds=315360000`          | Sets the max-age of the STS header.                                                                                                                                                                 |
-| `traefik.frontend.headers.STSIncludeSubdomains=true`     | Adds the `IncludeSubdomains` section of the STS  header.                                                                                                                                            |
-| `traefik.frontend.headers.STSPreload=true`               | Adds the preload flag to the STS  header.                                                                                                                                                           |
-| `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
-| `traefik.frontend.headers.contentTypeNosniff=true`       | Adds the `X-Content-Type-Options` header with the value `nosniff`.                                                                                                                                  |
-| `traefik.frontend.headers.browserXSSFilter=true`         | Adds the X-XSS-Protection header with the value `1; mode=block`.                                                                                                                                    |
-| `traefik.frontend.headers.customBrowserXSSValue=VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
-| `traefik.frontend.headers.contentSecurityPolicy=VALUE`   | Adds CSP Header with the custom value.                                                                                                                                                              |
-| `traefik.frontend.headers.publicKey=VALUE`               | Adds pinned HTST public key header.                                                                                                                                                                 |
-| `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
-| `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
+| Label                                                     | Description                                                                                                                                                                                                            |
+|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.backend.maxconn.amount=10`                       | Set a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                   |
+| `traefik.backend.maxconn.extractorfunc=client.ip`         | Set the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                  |
+| `traefik.backend.loadbalancer.method=drr`                 | Override the default `wrr` load balancer algorithm                                                                                                                                                                     |
+| `traefik.backend.loadbalancer.stickiness=true`            | Enable backend sticky sessions                                                                                                                                                                                         |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME` | Manually set the cookie name for sticky sessions                                                                                                                                                                       |
+| `traefik.backend.circuitbreaker.expression=EXPR`          | Create a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                           |
+| `traefik.backend.weight=10`                               | Assign this weight to the container                                                                                                                                                                                    |
+| `traefik.expose=true`                                     | Expose this service using træfik                                                                                                                                                                                      |
+| `traefik.frontend.rule=EXPR`                              | Override the default frontend rule. Defaults to SF address.                                                                                                                                                            |
+| `traefik.frontend.passHostHeader=true`                    | Forward client `Host` header to the backend.                                                                                                                                                                           |
+| `traefik.frontend.priority=10`                            | Override default frontend priority                                                                                                                                                                                     |
+| `traefik.frontend.entryPoints=http,https`                 | Assign this frontend to entry points `http` and `https`. Overrides `defaultEntryPoints`                                                                                                                                |
+| `traefik.frontend.auth.basic=EXPR`                        | Set basic authentication for that frontend in CSV format: `User:Hash,User:Hash`                                                                                                                                       |
+| `traefik.frontend.whitelistSourceRange:RANGE`             | List of IP-Ranges which are allowed to access. An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.backend.group.name`                              | Group all services with the same name into a single backend in Træfik                                                                                                                                                |
+| `traefik.backend.group.weight`                            | Set the weighting of the current services nodes in the backend group                                                                                                                                                  |

docs/configuration/commons.md

@@ -19,7 +19,7 @@
 # Enable debug mode.
 # This will install HTTP handlers to expose Go expvars under /debug/vars and
 # pprof profiling data under /debug/pprof.
-# The log level will be set to DEBUG unless `logLevel` is specified.
+# Additionally, the log level will be set to DEBUG.
 #
 # Optional
 # Default: false
@@ -154,6 +154,89 @@ constraints = ["tag==api", "tag!=v*-beta"]
 ```
 
 
+## Logs Definition
+
+### Traefik logs
+
+```toml
+# Traefik logs file
+# If not defined, logs to stdout
+#
+# DEPRECATED - see [traefikLog] lower down
+# In case both traefikLogsFile and traefikLog.filePath are specified, the latter will take precedence.
+# Optional
+#
+traefikLogsFile = "log/traefik.log"
+
+# Log level
+#
+# Optional
+# Default: "ERROR"
+#
+# Accepted values, in order of severity: "DEBUG", "INFO", "WARN", "ERROR", "FATAL", "PANIC"
+# Messages at and above the selected level will be logged.
+#
+logLevel = "ERROR"
+```
+
+## Traefik Logs
+
+By default the Traefik log is written to stdout in text format.
+
+To write the logs into a logfile specify the `filePath`.
+```toml
+[traefikLog]
+  filePath = "/path/to/traefik.log"
+```
+
+To write JSON format logs, specify `json` as the format:
+```toml
+[traefikLog]
+  filePath = "/path/to/traefik.log"
+  format   = "json"
+```
+
+### Access Logs
+
+Access logs are written when `[accessLog]` is defined.
+By default it will write to stdout and produce logs in the textual Common Log Format (CLF), extended with additional fields.
+
+To enable access logs using the default settings just add the `[accessLog]` entry.
+```toml
+[accessLog]
+```
+
+To write the logs into a logfile specify the `filePath`.
+```toml
+[accessLog]
+filePath = "/path/to/access.log"
+```
+
+To write JSON format logs, specify `json` as the format:
+```toml
+[accessLog]
+filePath = "/path/to/access.log"
+format = "json"
+```
+
+Deprecated way (before 1.4):
+```toml
+# Access logs file
+#
+# DEPRECATED - see [accessLog] lower down
+#
+accessLogsFile = "log/access.log"
+```
+
+### Log Rotation
+
+Traefik will close and reopen its log files, assuming they're configured, on receipt of a USR1 signal.
+This allows the logs to be rotated and processed by an external program, such as `logrotate`.
+
+!!! note
+    This does not work on Windows due to the lack of USR signals.
+
+
 ## Custom Error pages
 
 Custom error pages can be returned, in lieu of the default, according to frontend-configured ranges of HTTP Status codes.
@@ -190,6 +273,9 @@ Instead, the query parameter can also be set to some generic error page like so:
 Now the `500s.html` error page is returned for the configured code range.
 The configured status code ranges are inclusive; that is, in the above example, the `500s.html` page will be returned for status codes `500` through, and including, `599`.
 
+Custom error pages are easiest to implement using the file provider.
+For dynamic providers, the corresponding template file needs to be customized accordingly and referenced in the Traefik configuration.
+
 
 ## Rate limiting
 
@@ -216,26 +302,6 @@ In the above example, frontend1 is configured to limit requests by the client's
 An average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.  
 These can "burst" up to 10 and 200 in each period respectively.
 
-## Buffering
-
-In some cases request/buffering can be enabled for a specific backend.
-By enabling this, Træfik will read the entire request into memory (possibly buffering large requests into disk) and will reject requests that are over a specified limit.
-This may help services deal with large data (multipart/form-data for example) more efficiently and should minimise time spent when sending data to a backend server.
-
-For more information please check [oxy/buffer](http://godoc.org/github.com/vulcand/oxy/buffer) documentation.
-
-Example configuration:
-
-```toml
-[backends]
-  [backends.backend1]
-    [backends.backend1.buffering]
-      maxRequestBodyBytes = 10485760  
-      memRequestBodyBytes = 2097152  
-      maxResponseBodyBytes = 10485760
-      memResponseBodyBytes = 2097152
-      retryExpression = "IsNetworkError() && Attempts() <= 2"
-```
 
 ## Retry Configuration
 

docs/configuration/entrypoints.md

@@ -8,12 +8,9 @@
 [entryPoints]
   [entryPoints.http]
     address = ":80"
+    whitelistSourceRange = ["10.42.0.0/16", "152.89.1.33/32", "afed:be44::/16"]
     compress = true
 
-    [entryPoints.http.whitelist]
-      sourceRange = ["10.42.0.0/16", "152.89.1.33/32", "afed:be44::/16"]
-      useXForwardedFor = true
-
     [entryPoints.http.tls]
       minVersion = "VersionTLS12"
       cipherSuites = [
@@ -35,7 +32,6 @@
       entryPoint = "https"
       regex = "^http://localhost/(.*)"
       replacement = "http://mydomain/$1"
-      permanent = true
 
     [entryPoints.http.auth]
       headerField = "X-WebAuth-User"
@@ -113,23 +109,11 @@ CA.Optional:true
 Redirect.EntryPoint:https
 Redirect.Regex:http://localhost/(.*)
 Redirect.Replacement:http://mydomain/$1
-Redirect.Permanent:true
 Compress:true
-WhiteList.SourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16
-WhiteList.UseXForwardedFor:true
+WhiteListSourceRange:10.42.0.0/16,152.89.1.33/32,afed:be44::/16
 ProxyProtocol.TrustedIPs:192.168.0.1
 ProxyProtocol.Insecure:tue
 ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24
-Auth.Basic.Users:test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
-Auth.Digest.Users:test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e
-Auth.HeaderField:X-WebAuth-User
-Auth.Forward.Address:https://authserver.com/auth
-Auth.Forward.TrustForwardHeader:true
-Auth.Forward.TLS.CA:path/to/local.crt
-Auth.Forward.TLS.CAOptional:true
-Auth.Forward.TLS.Cert:path/to/foo.cert
-Auth.Forward.TLS.Key:path/to/foo.key
-Auth.Forward.TLS.InsecureSkipVerify:true
 ```
 
 ## Basic
@@ -356,18 +340,15 @@ Responses are compressed when:
 * And the `Accept-Encoding` request header contains `gzip`
 * And the response is not already compressed, i.e. the `Content-Encoding` response header is not already set.
 
-## White Listing
+## Whitelisting
 
-To enable IP white listing at the entry point level.
+To enable IP whitelisting at the entrypoint level.
 
 ```toml
 [entryPoints]
   [entryPoints.http]
-    address = ":80"
-
-    [entryPoints.http.whiteList]
-      sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-      # useXForwardedFor = true
+  address = ":80"
+  whiteListSourceRange = ["127.0.0.1/32", "192.168.1.7"]
 ```
 
 ## ProxyProtocol

docs/configuration/logs.md

@@ -1,252 +0,0 @@
-# Logs Definition
-
-## Reference
-
-### TOML
-
-```toml
-logLevel = "INFO"
-
-[traefikLog]
-  filePath = "/path/to/traefik.log"
-  format   = "json"
-
-[accessLog]
-  filePath = "/path/to/access.log"
-  format = "json"
-
-  [accessLog.filters]
-    statusCodes = ["200", "300-302"]
-    retryAttempts = true
-
-  [accessLog.fields]
-    defaultMode = "keep"
-    [accessLog.fields.names]
-      "ClientUsername" = "drop"
-      # ...
-
-    [accessLog.fields.headers]
-      defaultMode = "keep"
-      [accessLog.fields.headers.names]
-        "User-Agent" = "redact"
-        "Authorization" = "drop"
-        "Content-Type" = "keep"
-        # ...
-```
-
-### CLI
-
-For more information about the CLI, see the documentation about [Traefik command](/basics/#traefik).
-
-```shell
---logLevel="DEBUG"
---traefikLog.filePath="/path/to/traefik.log"
---traefikLog.format="json"
---accessLog.filePath="/path/to/access.log"
---accessLog.format="json"
---accessLog.filters.statusCodes="200,300-302"
---accessLog.filters.retryAttempts="true"
---accessLog.fields.defaultMode="keep"
---accessLog.fields.names="Username=drop Hostname=drop"
---accessLog.fields.headers.defaultMode="keep"
---accessLog.fields.headers.names="User-Agent=redact Authorization=drop Content-Type=keep"
-```
-
-
-## Traefik Logs
-
-By default the Traefik log is written to stdout in text format.
-
-To write the logs into a log file specify the `filePath`:
-```toml
-[traefikLog]
-  filePath = "/path/to/traefik.log"
-```
-
-To write JSON format logs, specify `json` as the format:
-```toml
-[traefikLog]
-  filePath = "/path/to/traefik.log"
-  format   = "json"
-```
-
-
-Deprecated way (before 1.4):
-
-!!! danger "DEPRECATED"
-    `traefikLogsFile` is deprecated, use [traefikLog](/configuration/logs/#traefik-logs) instead.
-
-```toml
-# Traefik logs file
-# If not defined, logs to stdout
-#
-# DEPRECATED - see [traefikLog] lower down
-# In case both traefikLogsFile and traefikLog.filePath are specified, the latter will take precedence.
-# Optional
-#
-traefikLogsFile = "log/traefik.log"
-```
-
-To customize the log level:
-```toml
-# Log level
-#
-# Optional
-# Default: "ERROR"
-#
-# Accepted values, in order of severity: "DEBUG", "INFO", "WARN", "ERROR", "FATAL", "PANIC"
-# Messages at and above the selected level will be logged.
-#
-logLevel = "ERROR"
-```
-
-
-## Access Logs
-
-Access logs are written when `[accessLog]` is defined.
-By default it will write to stdout and produce logs in the textual Common Log Format (CLF), extended with additional fields.
-
-To enable access logs using the default settings just add the `[accessLog]` entry:
-```toml
-[accessLog]
-```
-
-To write the logs into a log file specify the `filePath`:
-```toml
-[accessLog]
-filePath = "/path/to/access.log"
-```
-
-To write JSON format logs, specify `json` as the format:
-```toml
-[accessLog]
-filePath = "/path/to/access.log"
-format = "json"
-```
-
-To filter logs you can specify a set of filters which are logically "OR-connected". Thus, specifying multiple filters will keep more access logs than specifying only one:
-```toml
-[accessLog]
-filePath = "/path/to/access.log"
-format = "json"
-
-  [accessLog.filters]
-
-  # statusCodes keep access logs with status codes in the specified range
-  #
-  # Optional
-  # Default: []
-  #
-  statusCodes = ["200", "300-302"]
-
-  # retryAttempts keep access logs when at least one retry happened
-  #
-  # Optional
-  # Default: false
-  #
-  retryAttempts = true
-```
-
-To customize logs format:
-```toml
-[accessLog]
-filePath = "/path/to/access.log"
-format = "json"
-
-  [accessLog.filters]
-
-  # statusCodes keep only access logs with status codes in the specified range
-  #
-  # Optional
-  # Default: []
-  #
-  statusCodes = ["200", "300-302"]
-
-  [accessLog.fields]
-
-  # defaultMode
-  #
-  # Optional
-  # Default: "keep"
-  #
-  # Accepted values "keep", "drop"
-  #
-  defaultMode = "keep"
-
-  # Fields map which is used to override fields defaultMode
-  [accessLog.fields.names]
-    "ClientUsername" = "drop"
-    # ...
-
-  [accessLog.fields.headers]
-    # defaultMode
-    #
-    # Optional
-    # Default: "keep"
-    #
-    # Accepted values "keep", "drop", "redact"
-    #
-    defaultMode = "keep"
-    # Fields map which is used to override headers defaultMode
-    [accessLog.fields.headers.names]
-      "User-Agent" = "redact"
-      "Authorization" = "drop"
-      "Content-Type" = "keep"
-      # ...
-```
-
-#### List of all available fields
-
-```ini
-StartUTC
-StartLocal
-Duration
-FrontendName
-BackendName
-BackendURL
-BackendAddr
-ClientAddr
-ClientHost
-ClientPort
-ClientUsername
-RequestAddr
-RequestHost
-RequestPort
-RequestMethod
-RequestPath
-RequestProtocol
-RequestLine
-RequestContentSize
-OriginDuration
-OriginContentSize
-OriginStatus
-OriginStatusLine
-DownstreamStatus
-DownstreamStatusLine
-DownstreamContentSize
-RequestCount
-GzipRatio
-Overhead
-RetryAttempts
-```
-
-Deprecated way (before 1.4):
-
-!!! danger "DEPRECATED"
-    `accessLogsFile` is deprecated, use [accessLog](/configuration/logs/#access-logs) instead.
-
-```toml
-# Access logs file
-#
-# DEPRECATED - see [accessLog]
-#
-accessLogsFile = "log/access.log"
-```
-
-## Log Rotation
-
-Traefik will close and reopen its log files, assuming they're configured, on receipt of a USR1 signal.
-This allows the logs to be rotated and processed by an external program, such as `logrotate`.
-
-!!! note
-    This does not work on Windows due to the lack of USR signals.

docs/configuration/ping.md

@@ -85,7 +85,3 @@ Note the dedicated port `:8082` for `/ping`.
 
 In the above example, it is _very_ important to create a named dedicated entry point, and do **not** include it in `defaultEntryPoints`.
 Otherwise, you are likely to expose _all_ services via this entry point.
-
-### Using ping for external Load-balancer rotation health check
-
-If you are running traefik behind a external Load-balancer, and want to configure rotation health check on the Load-balancer to take a traefik instance out of rotation gracefully, you can configure [lifecycle.requestAcceptGraceTimeout](/configuration/commons.md#life-cycle) and the ping endpoint will return `503` response on traefik server termination, so that the Load-balancer can take the terminating traefik instance out of rotation, before it stops responding.

docs/configuration/tracing.md

@@ -1,97 +0,0 @@
-# Tracing
-
-Tracing system allows developers to visualize call flows in there infrastructures.
-
-We use [OpenTracing](http://opentracing.io). It is an open standard designed for distributed tracing.
-
-Træfik supports two backends: Jaeger and Zipkin.
-
-## Jaeger
-
-```toml
-# Tracing definition
-[tracing]
-  # Backend name used to send tracing data
-  #
-  # Default: "jaeger"
-  #
-  Backend = "jaeger"
-
-  # Service name used in Jaeger backend
-  #
-  # Default: "traefik"
-  #
-  ServiceName = "traefik"
-
-  [tracing.jaeger]
-    # SamplingServerURL is the address of jaeger-agent's HTTP sampling server
-    #
-    # Default: "http://localhost:5778/sampling"
-    #
-    SamplingServerURL = "http://localhost:5778/sampling"
-
-    # Sampling Type specifies the type of the sampler: const, probabilistic, rateLimiting
-    #
-    # Default: "const"
-    #
-    SamplingType = "const"
-
-    # SamplingParam Param is a value passed to the sampler.
-    # Valid values for Param field are:
-    #   - for "const" sampler, 0 or 1 for always false/true respectively
-    #   - for "probabilistic" sampler, a probability between 0 and 1
-    #   - for "rateLimiting" sampler, the number of spans per second
-    #
-    # Default: 1.0
-    #
-    SamplingParam = 1.0
-
-    # LocalAgentHostPort instructs reporter to send spans to jaeger-agent at this address
-    #
-    # Default: "127.0.0.1:6832"
-    #
-    LocalAgentHostPort = "127.0.0.1:6832"
-```
-
-## Zipkin
-
-```toml
-# Tracing definition
-[tracing]
-  # Backend name used to send tracing data
-  #
-  # Default: "jaeger"
-  #
-  Backend = "zipkin"
-
-  # Service name used in Zipkin backend
-  #
-  # Default: "traefik"
-  #
-  ServiceName = "traefik"
-
-  [tracing.zipkin]
-    # Zipking HTTP endpoint used to send data
-    #
-    # Default: "http://localhost:9411/api/v1/spans"
-    #
-    HTTPEndpoint = "http://localhost:9411/api/v1/spans"
-
-    # Enable Zipkin debug
-    #
-    # Default: false
-    #
-    Debug = false
-
-    # Use ZipKin SameSpan RPC style traces
-    #
-    # Default: false
-    #
-    SameSpan = false
-
-    # Use ZipKin 128 bit root span IDs
-    #
-    # Default: true
-    #
-    ID128Bit = true
-```

docs/index.md

@@ -34,7 +34,7 @@ _(But if you'd rather configure some of your routes manually, Træfik supports t
 
 - Continuously updates its configuration (No restarts!)
 - Supports multiple load balancing algorithms
-- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org) (wildcard certificates support)
+- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org)
 - Circuit breakers, retry
 - High Availability with cluster mode (beta)
 - See the magic through its clean web UI
@@ -52,7 +52,7 @@ _(But if you'd rather configure some of your routes manually, Træfik supports t
 - [Kubernetes](/configuration/backends/kubernetes/)
 - [Mesos](/configuration/backends/mesos/) / [Marathon](/configuration/backends/marathon/)
 - [Rancher](/configuration/backends/rancher/) (API, Metadata)
-- [Service Fabric](/configuration/backends/servicefabric/)
+- [Azure Service Fabric](/configuration/backends/servicefabric/)
 - [Consul Catalog](/configuration/backends/consulcatalog/)
 - [Consul](/configuration/backends/consul/) / [Etcd](/configuration/backends/etcd/) / [Zookeeper](/configuration/backends/zookeeper/) / [BoltDB](/configuration/backends/boltdb/)
 - [Eureka](/configuration/backends/eureka/)

docs/user-guide/cluster-docker-consul.md

@@ -11,7 +11,7 @@ When you use Let's Encrypt, you need to store certificates, but not only.
 When Træfik generates a new certificate, it configures a challenge and once Let's Encrypt will verify the ownership of the domain, it will ping back the challenge.
 If the challenge is not knowing by other Træfik instances, the validation will fail.
 
-For more information about challenge: [Automatic Certificate Management Environment (ACME)](https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#http-challenge)
+For more information about challenge: [Automatic Certificate Management Environment (ACME)](https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#tls-with-server-name-indication-tls-sni)
 
 ## Prerequisites
 

docs/user-guide/docker-and-lets-encrypt.md

@@ -50,7 +50,7 @@ version: '2'
 
 services:
   traefik:
-    image: traefik:1.3.5
+    image: traefik:1.5.4
     restart: always
     ports:
       - 80:80

docs/user-guide/examples.md

@@ -55,6 +55,10 @@ defaultEntryPoints = ["http", "https"]
 
 ## Let's Encrypt support
 
+!!! note
+    Even if `TLS-SNI-01` challenge is [disabled](https://community.letsencrypt.org/t/2018-01-11-update-regarding-acme-tls-sni-and-shared-hosting-infrastructure/50188), for the moment, it stays the _by default_ ACME Challenge in Træfik but all the examples use the `HTTP-01` challenge (except DNS challenge examples).
+    If `TLS-SNI-01` challenge is not re-enabled in the future, it we will be removed from Træfik.
+
 ### Basic example with HTTP challenge
 
 ```toml
@@ -186,45 +190,10 @@ entryPoint = "https"
 ```
 
 DNS challenge needs environment variables to be executed.
-These variables have to be set on the machine/container that host Træfik.
+These variables have to be set on the machine/container which host Træfik.
 
 These variables are described [in this section](/configuration/acme/#provider).
 
-### DNS challenge with wildcard domains
-
-```toml
-[entryPoints]
-  [entryPoints.https]
-  address = ":443"
-    [entryPoints.https.tls]
-
-[acme]
-email = "test@traefik.io"
-storage = "acme.json"
-caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
-entryPoint = "https"
-  [acme.dnsChallenge]
-  provider = "digitalocean" # DNS Provider name (cloudflare, OVH, gandi...)
-  delayBeforeCheck = 0
-
-[[acme.domains]]
-  main = "*.local1.com"
-[[acme.domains]]
-  main = "local2.com"
-  sans = ["test1.local2.com", "test2x.local2.com"]
-[[acme.domains]]
-  main = "*.local3.com"
-[[acme.domains]]
-  main = "*.local4.com"
-```
-
-DNS challenge needs environment variables to be executed.
-These variables have to be set on the machine/container that host Træfik.
-
-These variables are described [in this section](/configuration/acme/#provider).
-
-More information about wildcard certificates are available [in this section](/configuration/acme/#wildcard-domain).
-
 ### OnHostRule option and provided certificates (with HTTP challenge)
 
 ```toml

docs/user-guide/kubernetes.md

@@ -81,7 +81,7 @@ For namespaced restrictions, one RoleBinding is required per watched namespace a
 It is possible to use Træfik with a [Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) or a [DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) object,
  whereas both options have their own pros and cons:
 
-- The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DaemonSet.
+- The scalability is much better when using a Deployment, because you will have a Single-Pod-per-Node model when using the DeaemonSet.
 - It is possible to exclusively run a Service on a dedicated set of machines using taints and tolerations with a DaemonSet.
 - On the other hand the DaemonSet allows you to access any Node directly on Port 80 and 443, where you have to setup a [Service](https://kubernetes.io/docs/concepts/services-networking/service/) object with a Deployment.
 
@@ -121,7 +121,6 @@ spec:
         args:
         - --api
         - --kubernetes
-        - --logLevel=INFO
 ---
 kind: Service
 apiVersion: v1
@@ -183,11 +182,7 @@ spec:
         - name: admin
           containerPort: 8080
         securityContext:
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
+          privileged: true
         args:
         - --api
         - --kubernetes
@@ -249,7 +244,7 @@ traefik-ingress-controller-678226159-eqseo   1/1       Running   0          7m
 ```
 
 You should see that after submitting the Deployment or DaemonSet to Kubernetes it has launched a Pod, and it is now running.
-_It might take a few moments for Kubernetes to pull the Træfik image and start the container._
+_It might take a few moments for kubernetes to pull the Træfik image and start the container._
 
 !!! note
     You could also check the deployment with the Kubernetes dashboard, run
@@ -284,7 +279,7 @@ All further examples below assume a DaemonSet installation. Deployment users wil
 ## Deploy Træfik using Helm Chart
 
 !!! note
-    The Helm Chart is maintained by the community, not the Træfik project maintainers.
+    The Helm Chart is maintained by the community, not the Traefik project maintainers.
 
 Instead of installing Træfik via Kubernetes object directly, you can also use the Træfik Helm chart.
 
@@ -347,54 +342,9 @@ echo "$(minikube ip) traefik-ui.minikube" | sudo tee -a /etc/hosts
 
 We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube) in the browser and view the Træfik web UI.
 
-### Add a TLS Certificate to the Ingress
-
-!!! note
-    For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point. For more details see [here](/configuration/entrypoints/).
-
-To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource.
-
-```yaml
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: traefik-web-ui
-  namespace: kube-system
-  annotations:
-    kubernetes.io/ingress.class: traefik
-spec:
-  rules:
-  - host: traefik-ui.minikube
-    http:
-      paths:
-      - backend:
-          serviceName: traefik-web-ui
-          servicePort: 80
-  tls:
-    secretName: traefik-ui-tls-cert
-```
-
-In addition to the modified ingress you need to provide the TLS certificate via a Kubernetes secret in the same namespace as the ingress. The following two commands will generate a new certificate and create a secret containing the key and cert files.
-
-```shell
-openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout tls.key -out tls.crt -subj "/CN=traefik-ui.minikube"
-kubectl -n kube-system create secret tls traefik-ui-tls-cert --key=tls.key --cert=tls.crt
-```
-
-If there are any errors while loading the TLS section of an ingress, the whole ingress will be skipped.
-
-!!! note
-    The secret must have two entries named `tls.key`and `tls.crt`. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) for more details.
-
-!!! note
-    The TLS certificates will be added to all entrypoints defined by the ingress annotation `traefik.frontend.entryPoints`. If no such annotation is provided, the TLS certificates will be added to all TLS-enabled `defaultEntryPoints`.
-
-!!! note
-    The field `hosts` in the TLS configuration is ignored. Instead, the domains provided by the certificate are used for this purpose. It is recommended to not use wildcard certificates as they will match globally.
-
 ## Basic Authentication
 
-It's possible to protect access to Træfik through basic authentication. (See the [Kubernetes Ingress](/configuration/backends/kubernetes) configuration page for syntactical details and restrictions.)
+It's possible to protect access to Traefik through basic authentication. (See the [Kubernetes Ingress](/configuration/backends/kubernetes) configuration page for syntactical details and restrictions.)
 
 ### Creating the Secret
 
@@ -847,7 +797,7 @@ The examples shown deliberately do not specify any [resource limitations](https:
 
 In a production environment, however, it is important to set proper bounds, especially with regards to CPU:
 
-- too strict and Træfik will be throttled while serving requests (as Kubernetes imposes hard quotas)
-- too loose and Træfik may waste resources not available for other containers
+- too strict and Traefik will be throttled while serving requests (as Kubernetes imposes hard quotas)
+- too loose and Traefik may waste resources not available for other containers
 
 When in doubt, you should measure your resource needs, and adjust requests and limits accordingly.

docs/user-guide/kv-config.md

@@ -275,12 +275,12 @@ Here is the toml configuration we would like to store in the store :
   rule = "Path:/test"
 
 [[tls]]
+entryPoints = ["https"]
   [tls.certificate]
     certFile = "path/to/your.cert"
     keyFile = "path/to/your.key"
-
 [[tls]]
-  entryPoints = ["https","other-https"]
+entryPoints = ["https","other-https"]
   [tls.certificate]
     certFile = """-----BEGIN CERTIFICATE-----
                       <cert file content>
@@ -337,12 +337,10 @@ And there, the same dynamic configuration in a KV Store (using `prefix = "traefi
 
 | Key                                   | Value              |
 |---------------------------------------|--------------------|
+| `/traefik/tls/1/entrypoints`          | `https`            |
 | `/traefik/tls/1/certificate/certfile` | `path/to/your.cert`|
 | `/traefik/tls/1/certificate/keyfile`  | `path/to/your.key` |
 
-!!! note
-    As `/traefik/tls/1/entrypoints` is not defined, the certificate will be attached to all `defaulEntryPoints` with a TLS configuration (in the example, the entryPoint `https`)
-
 - certificate 2
 
 | Key                                   | Value                 |

docs/user-guide/marathon.md

@@ -130,6 +130,7 @@ As such, there is no way to handle this situation deterministically.
 Finally, Marathon health checks are not mandatory (the default is to use the task state as reported by Mesos), so requiring them for Traefik would raise the entry barrier for Marathon users.
 
 Traefik used to use the health check results as a strict requirement but moved away from it as [users reported the dramatic consequences](https://github.com/containous/traefik/issues/653).
+If health check results are known to exist, however, they will be used to signal task availability.
 
 #### Draining
 

examples/acme/Docker_Acme.md

@@ -11,7 +11,7 @@ The provided Boulder stack is based on the environment used during integration t
 
 ## Directory content
 
-* **docker-compose.yml** : Docker-Compose file which contains the description of Traefik and all the boulder stack containers to get,
+* **compose-acme.yml** : Docker-Compose file which contains the description of Traefik and all the boulder stack containers to get,
 * **acme.toml** : Traefik configuration file used by the Traefik container described above,
 * **manage_acme_docker_environment.sh**  Shell script which does all needed checks and manages the docker-compose environment.
 
@@ -25,7 +25,6 @@ To work fine, boulder needs a domain name, with a related IP and storage file. T
 
 The script **manage_acme_docker_environment.sh** requires one argument. This argument can have 3 values :
 
-* **--start** : Launch a new Docker environment Boulder + Traefik.
+* **--start** : Check environment and launch a new Docker environment.
 * **--stop** : Stop and delete the current Docker environment.
-* **--restart--** : Concatenate **--stop** and **--start** actions.
-* **--dev** : Launch a new Boulder Docker environment.
+* **--restart--** : Concatenate **--stop** and **--start** actions.

examples/acme/acme.toml

@@ -17,7 +17,7 @@ storage = "/etc/traefik/conf/acme.json"
 entryPoint = "https"
 onDemand = false
 OnHostRule = true
-caServer = "http://traefik.boulder.com:4001/directory"
+caServer = "http://traefik.localhost.com:4000/directory"
   [acme.httpChallenge]
   entryPoint="http"
 

examples/acme/compose-acme.yml

@@ -0,0 +1,92 @@
+version: "2"
+
+# IP_HOST : Docker host IP (not 127.0.0.1)
+
+services :
+  boulder:
+      image: containous/boulder:release
+      environment:
+          FAKE_DNS: $IP_HOST
+          PKCS11_PROXY_SOCKET: tcp://boulder-hsm:5657
+      extra_hosts:
+        - le.wtf:127.0.0.1
+        - boulder:127.0.0.1
+      ports:
+        - 4000:4000 # ACME
+        - 4002:4002 # OCSP
+        - 4003:4003 # OCSP
+        - 4500:4500 # ct-test-srv
+        - 8000:8000 # debug ports
+        - 8001:8001
+        - 8002:8002
+        - 8003:8003
+        - 8004:8004
+        - 8055:8055 # dns-test-srv updates
+        - 9380:9380 # mail-test-srv
+        - 9381:9381 # mail-test-srv
+      restart: unless-stopped
+      depends_on:
+        - bhsm
+        - bmysql
+        - brabbitmq
+      volumes:
+        - "./rate-limit-policies.yml:/go/src/github.com/letsencrypt/boulder/test/rate-limit-policies.yml:ro"
+
+  bhsm:
+      image: letsencrypt/boulder-tools:2016-11-02
+      hostname: boulder-hsm
+      networks:
+          default:
+              aliases:
+                - boulder-hsm
+      environment:
+          PKCS11_DAEMON_SOCKET: tcp://0.0.0.0:5657
+      command: /usr/local/bin/pkcs11-daemon /usr/lib/softhsm/libsofthsm.so
+      expose:
+        - 5657
+  bmysql:
+      image: mariadb:10.1
+      hostname: boulder-mysql
+      networks:
+          default:
+              aliases:
+                - boulder-mysql
+      environment:
+          MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
+
+  brabbitmq:
+      image: rabbitmq:3-alpine
+      hostname: boulder-rabbitmq
+      networks:
+          default:
+              aliases:
+                - boulder-rabbitmq
+      environment:
+          RABBITMQ_NODE_IP_ADDRESS: "0.0.0.0"
+
+  traefik:
+      build:
+        context: ../..
+      image: containous/traefik:latest
+      command: --configFile=/etc/traefik/conf/acme.toml
+      restart: unless-stopped
+      extra_hosts:
+        - traefik.localhost.com:$IP_HOST
+      volumes:
+        - "./acme.toml:/etc/traefik/conf/acme.toml:ro"
+        - "/var/run/docker.sock:/var/run/docker.sock:ro"
+        - "./acme.json:/etc/traefik/conf/acme.json:rw"
+      ports:
+        - "80:80"
+        - "443:443"
+        - "5001:443" # Needed for SNI challenge
+        - "5002:80" # Needed for HTTP challenge
+      expose:
+        - "8080"
+      labels:
+        - "traefik.port=8080"
+        - "traefik.backend=traefikception"
+        - "traefik.frontend.rule=Host:traefik.localhost.com"
+        - "traefik.enable=true"
+      depends_on:
+        - boulder

examples/acme/docker-compose.yml

@@ -1,97 +0,0 @@
-version: "2"
-
-services :
-
-  boulder:
-    # To minimize fetching this should be the same version used below
-    image: containous/boulder:containous-acmev2
-    environment:
-      FAKE_DNS: 172.17.0.1
-      PKCS11_PROXY_SOCKET: tcp://boulder-hsm:5657
-    restart: unless-stopped
-    extra_hosts:
-      - le.wtf:127.0.0.1
-      - boulder:127.0.0.1
-    ports:
-      - 4000:4000 # ACME
-      - 4001:4001 # ACMEv2
-      - 4002:4002 # OCSP
-      - 4003:4003 # OCSP
-      - 4430:4430 # ACME via HTTPS
-      - 4431:4431 # ACMEv2 via HTTPS
-      - 4500:4500 # ct-test-srv
-      - 6000:6000 # gsb-test-srv
-      - 8000:8000 # debug ports
-      - 8001:8001
-      - 8002:8002
-      - 8003:8003
-      - 8004:8004
-      - 8005:8005
-      - 8006:8006
-      - 8008:8008
-      - 8009:8009
-      - 8010:8010
-      - 8055:8055 # dns-test-srv updates
-      - 9380:9380 # mail-test-srv
-      - 9381:9381 # mail-test-srv
-    depends_on:
-      - bhsm
-      - bmysql
-    networks:
-      - default
-
-  bhsm:
-    # To minimize fetching this should be the same version used above
-    image: letsencrypt/boulder-tools:2018-03-07
-    hostname: boulder-hsm
-    environment:
-      PKCS11_DAEMON_SOCKET: tcp://0.0.0.0:5657
-    command: /usr/local/bin/pkcs11-daemon /usr/lib/softhsm/libsofthsm2.so
-    expose:
-      - 5657
-    networks:
-      default:
-        aliases:
-          - boulder-hsm
-
-  bmysql:
-    image: mariadb:10.1
-    hostname: boulder-mysql
-    environment:
-      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
-    command: mysqld --bind-address=0.0.0.0
-    logging:
-        driver: none
-    networks:
-      default:
-        aliases:
-          - boulder-mysql
-
-  ## TRAEFIK part ##
-
-  traefik:
-    build:
-      context: ../..
-    image: containous/traefik:latest
-    command: --configFile=/etc/traefik/conf/acme.toml
-    restart: unless-stopped
-    extra_hosts:
-      - traefik.boulder.com:172.17.0.1
-    volumes:
-      - "./acme.toml:/etc/traefik/conf/acme.toml:ro"
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./acme.json:/etc/traefik/conf/acme.json:rw"
-    ports:
-      - "80:80"
-      - "443:443"
-      - "5001:443" # Needed for SNI challenge
-      - "5002:80" # Needed for HTTP challenge
-    expose:
-      - "8080"
-    labels:
-      - "traefik.port=8080"
-      - "traefik.backend=traefikception"
-      - "traefik.frontend.rule=Host:traefik.localhost.com"
-      - "traefik.enable=true"
-    depends_on:
-      - boulder

examples/acme/manage_acme_docker_environment.sh

@@ -3,7 +3,7 @@
 # Initialize variables
 readonly traefik_url="traefik.localhost.com"
 readonly basedir=$(dirname $0)
-readonly doc_file=$basedir"/docker-compose.yml"
+readonly doc_file=$basedir"/compose-acme.yml"
 
 # Stop and remove Docker environment
 down_environment() {
@@ -22,6 +22,21 @@ up_environment() {
 
 # Init the environment : get IP address and create needed files
 init_environment() {
+    for netw in $(ip addr show | grep -v "LOOPBACK" | grep -v docker | grep -oE "^[0-9]{1}: .*:" | cut -d ':' -f2); do
+        ip_addr=$(ip addr show $netw | grep -E "inet " | grep -Eo "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" | head -n 1)
+        [[ ! -z $ip_addr ]] && break
+    done
+
+    [[ -z $ip_addr ]] && \
+        echo "[ERROR] Impossible to find an IP address for the Docker host" && exit 31
+
+    # The $traefik_url entry must exist into /etc/hosts file
+    # It has to refer to the $ip_addr IP address
+        [[ $(cat /etc/hosts | grep $traefik_url | grep -vE "^#" | grep -oE "([0-9]+(\.)?){4}") != $ip_addr ]] && \
+            echo "[ERROR] Domain ${traefik_url} has to refer to ${ip_addr} into /etc/hosts file." && exit 32
+    # Export IP_HOST to use it in the DOcker COmpose file
+    export IP_HOST=$ip_addr
+
     echo "CREATE empty acme.json file"
     rm -f $basedir/acme.json && \
     touch $basedir/acme.json && \
@@ -29,14 +44,14 @@ init_environment() {
 }
 
 # Start all the environement
-start_boulder() {
+start() {
     init_environment
     echo "Start boulder environment"
-    up_environment bmysql bhsm boulder
+    up_environment bmysql brabbitmq bhsm boulder
     waiting_counter=12
     # Not start Traefik if boulder is not started
     echo "WAIT for boulder..."
-    while [[ -z $(curl -s http://127.0.0.1:4000/directory) ]]; do
+    while [[ -z $(curl -s http://$traefik_url:4000/directory) ]]; do
         sleep 5
         let waiting_counter-=1
         if [[ $waiting_counter -eq 0 ]]; then
@@ -45,6 +60,8 @@ start_boulder() {
             exit 41
         fi
     done
+    echo "START Traefik container"
+    up_environment traefik
 }
 
 # Script usage
@@ -61,14 +78,9 @@ main() {
     [[ $# -ne 1 ]] && show_usage && exit 1
 
     case $1 in
-        "--dev")
-            start_boulder
-            ;;
         "--start")
             # Start boulder environment
-            start_boulder
-            echo "START Traefik container"
-            up_environment traefik
+            start
             echo "ENVIRONMENT SUCCESSFULLY STARTED"
             ;;
         "--stop")
@@ -77,10 +89,8 @@ main() {
             ;;
         "--restart")
             down_environment
-            start_boulder
-            echo "START Traefik container"
-            up_environment traefik
-            echo "ENVIRONMENT SUCCESSFULLY RESTARTED"
+            start
+            echo "ENVIRONMENT SUCCESSFULLY STARTED"
             ;;
         *)
             show_usage && exit 2

examples/acme/rate-limit-policies.yml

@@ -0,0 +1,42 @@
+totalCertificates:
+  window: 1h
+  threshold: 100000
+certificatesPerName:
+  window: 1h
+  threshold: 100000
+  overrides:
+    ratelimit.me: 1
+    lim.it: 0
+    # Hostnames used by the letsencrypt client integration test.
+    le.wtf: 10000
+    le1.wtf: 10000
+    le2.wtf: 10000
+    le3.wtf: 10000
+    nginx.wtf: 10000
+    good-caa-reserved.com: 10000
+    bad-caa-reserved.com: 10000
+    ecdsa.le.wtf: 10000
+    must-staple.le.wtf: 10000
+  registrationOverrides:
+    101: 1000
+registrationsPerIP:
+  window: 1h
+  threshold: 100000
+  overrides:
+    127.0.0.1: 1000000
+pendingAuthorizationsPerAccount:
+  window: 1h
+  threshold: 100000
+certificatesPerFQDNSet:
+  window: 1h
+  threshold: 100000
+  overrides:
+    le.wtf: 10000
+    le1.wtf: 10000
+    le2.wtf: 10000
+    le3.wtf: 10000
+    le.wtf,le1.wtf: 10000
+    good-caa-reserved.com: 10000
+    nginx.wtf: 10000
+    ecdsa.le.wtf: 10000
+    must-staple.le.wtf: 10000

examples/cluster/docker-compose.yml

@@ -7,195 +7,195 @@ services:
   # CONSUL
 
   consul:
-    image: progrium/consul
-    command: -server -bootstrap -log-level debug -ui-dir /ui
-    ports:
-      - "8400:8400"
-      - "8500:8500"
-      - "8600:53/udp"
-    expose:
-      - "8300"
-      - "8301"
-      - "8301/udp"
-      - "8302"
-      - "8302/udp"
-    networks:
-      net:
-        ipv4_address: 10.0.1.2
+      image: progrium/consul
+      command: -server -bootstrap -log-level debug -ui-dir /ui
+      ports:
+        - "8400:8400"
+        - "8500:8500"
+        - "8600:53/udp"
+      expose:
+        - "8300"
+        - "8301"
+        - "8301/udp"
+        - "8302"
+        - "8302/udp"
+      networks:
+        net:
+          ipv4_address: 10.0.1.2
 
   # ETCD V3
 
   etcd3:
-    image: quay.io/coreos/etcd:v3.2.9
-    command: /usr/local/bin/etcd --data-dir=/etcd-data --name node1 --initial-advertise-peer-urls http://10.0.1.12:2380 --listen-peer-urls http://10.0.1.12:2380 --advertise-client-urls http://10.0.1.12:2379,http://10.0.1.12:4001 --listen-client-urls http://10.0.1.12:2379,http://10.0.1.12:4001  --initial-cluster node1=http://10.0.1.12:2380 --debug
-    ports:
-      - "4001:4001"
-      - "2380:2380"
-      - "2379:2379"
-    networks:
-      net:
-        ipv4_address: 10.0.1.12
+      image: quay.io/coreos/etcd:v3.2.9
+      command: /usr/local/bin/etcd --data-dir=/etcd-data --name node1 --initial-advertise-peer-urls http://10.0.1.12:2380 --listen-peer-urls http://10.0.1.12:2380 --advertise-client-urls http://10.0.1.12:2379,http://10.0.1.12:4001 --listen-client-urls http://10.0.1.12:2379,http://10.0.1.12:4001  --initial-cluster node1=http://10.0.1.12:2380 --debug
+      ports:
+        - "4001:4001"
+        - "2380:2380"
+        - "2379:2379"
+      networks:
+        net:
+          ipv4_address: 10.0.1.12
 
   etcdctl-ping:
-    image: tenstartups/etcdctl
-    command: --endpoints=[10.0.1.12:2379] get "traefik/acme/storage"
-    environment:
-        ETCDCTL_DIAL_: "TIMEOUT 10s"
-        ETCDCTL_API : "3"
-    networks:
+      image: tenstartups/etcdctl
+      command: --endpoints=[10.0.1.12:2379] get "traefik/acme/storage"
+      environment:
+          ETCDCTL_DIAL_: "TIMEOUT 10s"
+          ETCDCTL_API : "3"
+      networks:
         - net
 
   ## BOULDER part ##
 
   boulder:
-    # To minimize fetching this should be the same version used below
-    image: containous/boulder:containous-acmev2
-    environment:
-      FAKE_DNS: 172.17.0.1
-      PKCS11_PROXY_SOCKET: tcp://boulder-hsm:5657
-    restart: unless-stopped
-    extra_hosts:
-      - le.wtf:127.0.0.1
-      - boulder:127.0.0.1
-    ports:
-      - 4000:4000 # ACME
-      - 4001:4001 # ACMEv2
-      - 4002:4002 # OCSP
-      - 4003:4003 # OCSP
-      - 4430:4430 # ACME via HTTPS
-      - 4431:4431 # ACMEv2 via HTTPS
-      - 4500:4500 # ct-test-srv
-      - 6000:6000 # gsb-test-srv
-      - 8000:8000 # debug ports
-      - 8001:8001
-      - 8002:8002
-      - 8003:8003
-      - 8004:8004
-      - 8005:8005
-      - 8006:8006
-      - 8008:8008
-      - 8009:8009
-      - 8010:8010
-      - 8055:8055 # dns-test-srv updates
-      - 9380:9380 # mail-test-srv
-      - 9381:9381 # mail-test-srv
-    depends_on:
-      - bhsm
-      - bmysql
-    networks:
-      net:
-        ipv4_address: 10.0.1.3
+      image: containous/boulder:release
+      environment:
+          FAKE_DNS: 172.17.0.1
+          PKCS11_PROXY_SOCKET: tcp://boulder-hsm:5657
+      extra_hosts:
+        - le.wtf:127.0.0.1
+        - boulder:127.0.0.1
+      ports:
+        - 4000:4000 # ACME
+        - 4002:4002 # OCSP
+        - 4003:4003 # OCSP
+        - 4500:4500 # ct-test-srv
+        - 8000:8000 # debug ports
+        - 8001:8001
+        - 8002:8002
+        - 8003:8003
+        - 8004:8004
+        - 8055:8055 # dns-test-srv updates
+        - 9380:9380 # mail-test-srv
+        - 9381:9381 # mail-test-srv
+      restart: unless-stopped
+      depends_on:
+        - bhsm
+        - bmysql
+        - brabbitmq
+      volumes:
+        - "./rate-limit-policies.yml:/go/src/github.com/letsencrypt/boulder/test/rate-limit-policies.yml:ro"
+      networks:
+        net:
+          ipv4_address: 10.0.1.3
 
   bhsm:
-      # To minimize fetching this should be the same version used above
-    image: letsencrypt/boulder-tools:2018-03-07
-    hostname: boulder-hsm
-    environment:
-      PKCS11_DAEMON_SOCKET: tcp://0.0.0.0:5657
-    command: /usr/local/bin/pkcs11-daemon /usr/lib/softhsm/libsofthsm2.so
-    expose:
-      - 5657
-    networks:
-      net:
-        ipv4_address: 10.0.1.4
-        aliases:
-          - boulder-hsm
+      image: letsencrypt/boulder-tools:2016-11-02
+      hostname: boulder-hsm
+      environment:
+          PKCS11_DAEMON_SOCKET: tcp://0.0.0.0:5657
+      command: /usr/local/bin/pkcs11-daemon /usr/lib/softhsm/libsofthsm.so
+      expose:
+        - 5657
+      networks:
+        net:
+          ipv4_address: 10.0.1.4
+          aliases:
+            - boulder-hsm
   bmysql:
-    image: mariadb:10.1
-    hostname: boulder-mysql
-    environment:
-      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
-    command: mysqld --bind-address=0.0.0.0
-    logging:
-        driver: none
-    networks:
-      net:
-        ipv4_address: 10.0.1.5
-        aliases:
-          - boulder-mysql
+      image: mariadb:10.1
+      hostname: boulder-mysql
+      environment:
+          MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
+      networks:
+        net:
+          ipv4_address: 10.0.1.5
+          aliases:
+            - boulder-mysql
+
+  brabbitmq:
+      image: rabbitmq:3-alpine
+      hostname: boulder-rabbitmq
+      environment:
+          RABBITMQ_NODE_IP_ADDRESS: "0.0.0.0"
+      networks:
+        net:
+          ipv4_address: 10.0.1.6
+          aliases:
+            - boulder-rabbitmq
 
   ## TRAEFIK part ##
 
-  storeconfig:
-    build:
-      context: ../..
-    image: containous/traefik
-    volumes:
-      - "./traefik.toml:/traefik.toml:ro"
-    command: storeconfig --debug
-    networks:
-      - net
+  traefik-storeconfig:
+      build:
+        context: ../..
+      image: containous/traefik
+      volumes:
+        - "./traefik.toml:/traefik.toml:ro"
+      command: storeconfig --debug
+      networks:
+        - net
 
   traefik01:
-    build:
-      context: ../..
-    image: containous/traefik
-    command: ${TRAEFIK_CMD}
-    extra_hosts:
-      - traefik.boulder.com:172.17.0.1
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-    expose:
-      - "443"
-      - "5001"
-      - "5002"
-    ports:
-      - "80:80"
-      - "8080:8080"
-      - "443:443"
-      - "5001:443" # Needed for SNI challenge
-      - "5002:80" # Needed for HTTP challenge
-    networks:
-      net:
-        ipv4_address: 10.0.1.8
+      build:
+        context: ../..
+      image: containous/traefik
+      command: ${TRAEFIK_CMD}
+      extra_hosts:
+        - traefik.boulder.com:172.17.0.1
+      volumes:
+        - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      expose:
+        - "443"
+        - "5001"
+        - "5002"
+      ports:
+        - "80:80"
+        - "8080:8080"
+        - "443:443"
+        - "5001:443" # Needed for SNI challenge
+        - "5002:80" # Needed for HTTP challenge
+      networks:
+        net:
+          ipv4_address: 10.0.1.8
 
   traefik02:
-    build:
-      context: ../..
-    image: containous/traefik
-    command: ${TRAEFIK_CMD}
-    extra_hosts:
-      - traefik.boulder.com:172.17.0.1
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock:ro"
-    expose:
-      - "443"
-      - "5001"
-      - "5002"
-    ports:
-      - "88:80"
-      - "8888:8080"
-      - "8443:443"
-    depends_on:
-      - traefik01
-    networks:
-      net:
-        ipv4_address: 10.0.1.9
+      build:
+        context: ../..
+      image: containous/traefik
+      command: ${TRAEFIK_CMD}
+      extra_hosts:
+        - traefik.boulder.com:172.17.0.1
+      volumes:
+        - "/var/run/docker.sock:/var/run/docker.sock:ro"
+      expose:
+        - "443"
+        - "5001"
+        - "5002"
+      ports:
+        - "88:80"
+        - "8888:8080"
+        - "8443:443"
+      depends_on:
+        - traefik01
+      networks:
+        net:
+          ipv4_address: 10.0.1.9
 
   whoami01:
-    image: emilevauge/whoami
-    expose:
-      - "80"
-    labels:
-      - "traefik.port=80"
-      - "traefik.backend=wam01"
-      - "traefik.frontend.rule=Host:who01.localhost.com"
-      - "traefik.enable=true"
-    networks:
-      net:
-        ipv4_address: 10.0.1.10
+      image: emilevauge/whoami
+      expose:
+        - "80"
+      labels:
+        - "traefik.port=80"
+        - "traefik.backend=wam01"
+        - "traefik.frontend.rule=Host:who01.localhost.com"
+        - "traefik.enable=true"
+      networks:
+        net:
+          ipv4_address: 10.0.1.10
 
   whoami02:
-    image: emilevauge/whoami
-    expose:
-      - "80"
-    labels:
-      - "traefik.port=80"
-      - "traefik.backend=wam02"
-      - "traefik.frontend.rule=Host:who02.localhost.com"
-      - "traefik.enable=true"
-    networks:
-      - net
+      image: emilevauge/whoami
+      expose:
+        - "80"
+      labels:
+        - "traefik.port=80"
+        - "traefik.backend=wam02"
+        - "traefik.frontend.rule=Host:who02.localhost.com"
+        - "traefik.enable=true"
+      networks:
+        - net
 
 networks:
   net:

examples/cluster/manage_cluster_docker_environment.sh

@@ -74,10 +74,10 @@ start_storeconfig_consul() {
         endpoint = "10.0.1.2:8500"
         watch = true
         prefix = "traefik"' >> $basedir/traefik.toml
-    up_environment storeconfig
+    up_environment traefik-storeconfig
     rm -f $basedir/traefik.toml
     waiting_counter=5
-    delete_services storeconfig
+    delete_services traefik-storeconfig
 
 }
 
@@ -90,7 +90,7 @@ start_storeconfig_etcd3() {
         watch = true
         prefix = "/traefik"
         useAPIV3 = true' >> $basedir/traefik.toml
-    up_environment storeconfig
+    up_environment traefik-storeconfig
     rm -f $basedir/traefik.toml
     waiting_counter=5
     # Don't start Traefik store config if ETCD3 is not started
@@ -99,7 +99,7 @@ start_storeconfig_etcd3() {
         sleep 5
         let waiting_counter-=1
     done
-    delete_services storeconfig etcdctl-ping
+    delete_services traefik-storeconfig etcdctl-ping
 }
 
 start_traefik() {
@@ -136,11 +136,11 @@ start_traefik() {
 # Start boulder services
 start_boulder() {
     echo "Start boulder environment"
-    up_environment bmysql bhsm boulder
+    up_environment bmysql brabbitmq bhsm boulder
     waiting_counter=12
     # Not start Traefik if boulder is not started
     echo "WAIT for boulder..."
-    while [[ -z $(curl -s http://10.0.1.3:4001/directory) ]]; do
+    while [[ -z $(curl -s http://10.0.1.3:4000/directory) ]]; do
         sleep 5
         let waiting_counter-=1
         if [[ $waiting_counter -eq 0 ]]; then

examples/cluster/rate-limit-policies.yml

@@ -0,0 +1,42 @@
+totalCertificates:
+  window: 1h
+  threshold: 100000
+certificatesPerName:
+  window: 1h
+  threshold: 100000
+  overrides:
+    ratelimit.me: 1
+    lim.it: 0
+    # Hostnames used by the letsencrypt client integration test.
+    le.wtf: 10000
+    le1.wtf: 10000
+    le2.wtf: 10000
+    le3.wtf: 10000
+    nginx.wtf: 10000
+    good-caa-reserved.com: 10000
+    bad-caa-reserved.com: 10000
+    ecdsa.le.wtf: 10000
+    must-staple.le.wtf: 10000
+  registrationOverrides:
+    101: 1000
+registrationsPerIP:
+  window: 1h
+  threshold: 100000
+  overrides:
+    127.0.0.1: 1000000
+pendingAuthorizationsPerAccount:
+  window: 1h
+  threshold: 100000
+certificatesPerFQDNSet:
+  window: 1h
+  threshold: 100000
+  overrides:
+    le.wtf: 10000
+    le1.wtf: 10000
+    le2.wtf: 10000
+    le3.wtf: 10000
+    le.wtf,le1.wtf: 10000
+    good-caa-reserved.com: 10000
+    nginx.wtf: 10000
+    ecdsa.le.wtf: 10000
+    must-staple.le.wtf: 10000

examples/cluster/traefik.toml.tmpl

@@ -14,7 +14,7 @@ email = "test@traefik.io"
 storage = "traefik/acme/account"
 entryPoint = "https"
 OnHostRule = true
-caServer = "http://traefik.boulder.com:4001/directory"
+caServer = "http://traefik.boulder.com:4000/directory"
 [acme.httpChallenge]
 entryPoint="http"
 

examples/k8s/traefik-ds.yaml

@@ -32,11 +32,7 @@ spec:
         - name: admin
           containerPort: 8080
         securityContext:
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
+          privileged: true
         args:
         - --api
         - --kubernetes

healthcheck/healthcheck.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
-	"github.com/go-kit/kit/metrics"
 	"github.com/vulcand/oxy/roundrobin"
 )
 
@@ -20,9 +19,9 @@ var singleton *HealthCheck
 var once sync.Once
 
 // GetHealthCheck returns the health check which is guaranteed to be a singleton.
-func GetHealthCheck(metrics metricsRegistry) *HealthCheck {
+func GetHealthCheck() *HealthCheck {
 	once.Do(func() {
-		singleton = newHealthCheck(metrics)
+		singleton = newHealthCheck()
 	})
 	return singleton
 }
@@ -43,15 +42,14 @@ func (opt Options) String() string {
 // BackendHealthCheck HealthCheck configuration for a backend
 type BackendHealthCheck struct {
 	Options
-	name           string
 	disabledURLs   []*url.URL
 	requestTimeout time.Duration
 }
 
 //HealthCheck struct
 type HealthCheck struct {
+	mutex    sync.Mutex
 	Backends map[string]*BackendHealthCheck
-	metrics  metricsRegistry
 	cancel   context.CancelFunc
 }
 
@@ -62,90 +60,77 @@ type LoadBalancer interface {
 	Servers() []*url.URL
 }
 
-func newHealthCheck(metrics metricsRegistry) *HealthCheck {
+func newHealthCheck() *HealthCheck {
 	return &HealthCheck{
 		Backends: make(map[string]*BackendHealthCheck),
-		metrics:  metrics,
 	}
 }
 
-// metricsRegistry is a local interface in the healthcheck package, exposing only the required metrics
-// necessary for the healthcheck package. This makes it easier for the tests.
-type metricsRegistry interface {
-	BackendServerUpGauge() metrics.Gauge
-}
-
 // NewBackendHealthCheck Instantiate a new BackendHealthCheck
-func NewBackendHealthCheck(options Options, backendName string) *BackendHealthCheck {
+func NewBackendHealthCheck(options Options) *BackendHealthCheck {
 	return &BackendHealthCheck{
 		Options:        options,
-		name:           backendName,
 		requestTimeout: 5 * time.Second,
 	}
 }
 
 //SetBackendsConfiguration set backends configuration
 func (hc *HealthCheck) SetBackendsConfiguration(parentCtx context.Context, backends map[string]*BackendHealthCheck) {
+	hc.mutex.Lock()
 	hc.Backends = backends
 	if hc.cancel != nil {
 		hc.cancel()
 	}
 	ctx, cancel := context.WithCancel(parentCtx)
 	hc.cancel = cancel
+	hc.mutex.Unlock()
 
-	for _, backend := range backends {
+	for backendID, backend := range backends {
+		currentBackendID := backendID
 		currentBackend := backend
 		safe.Go(func() {
-			hc.execute(ctx, currentBackend)
+			hc.execute(ctx, currentBackendID, currentBackend)
 		})
 	}
 }
 
-func (hc *HealthCheck) execute(ctx context.Context, backend *BackendHealthCheck) {
-	log.Debugf("Initial health check for backend: %q", backend.name)
-	hc.checkBackend(backend)
+func (hc *HealthCheck) execute(ctx context.Context, backendID string, backend *BackendHealthCheck) {
+	log.Debugf("Initial healthcheck for currentBackend %s ", backendID)
+	checkBackend(backend)
 	ticker := time.NewTicker(backend.Interval)
 	defer ticker.Stop()
 	for {
 		select {
 		case <-ctx.Done():
-			log.Debug("Stopping current health check goroutines of backend: %s", backend.name)
+			log.Debug("Stopping all current Healthcheck goroutines")
 			return
 		case <-ticker.C:
-			log.Debugf("Refreshing health check for backend: %s", backend.name)
-			hc.checkBackend(backend)
+			log.Debugf("Refreshing healthcheck for currentBackend %s ", backendID)
+			checkBackend(backend)
 		}
 	}
 }
 
-func (hc *HealthCheck) checkBackend(backend *BackendHealthCheck) {
-	enabledURLs := backend.LB.Servers()
+func checkBackend(currentBackend *BackendHealthCheck) {
+	enabledURLs := currentBackend.LB.Servers()
 	var newDisabledURLs []*url.URL
-	for _, url := range backend.disabledURLs {
-		serverUpMetricValue := float64(0)
-		if err := checkHealth(url, backend); err == nil {
-			log.Warnf("Health check up: Returning to server list. Backend: %q URL: %q", backend.name, url.String())
-			backend.LB.UpsertServer(url, roundrobin.Weight(1))
-			serverUpMetricValue = 1
+	for _, url := range currentBackend.disabledURLs {
+		if checkHealth(url, currentBackend) {
+			log.Debugf("HealthCheck is up [%s]: Upsert in server list", url.String())
+			currentBackend.LB.UpsertServer(url, roundrobin.Weight(1))
 		} else {
-			log.Warnf("Health check still failing. Backend: %q URL: %q Reason: %s", backend.name, url.String(), err)
+			log.Warnf("HealthCheck is still failing [%s]", url.String())
 			newDisabledURLs = append(newDisabledURLs, url)
 		}
-		labelValues := []string{"backend", backend.name, "url", url.String()}
-		hc.metrics.BackendServerUpGauge().With(labelValues...).Set(serverUpMetricValue)
 	}
-	backend.disabledURLs = newDisabledURLs
+	currentBackend.disabledURLs = newDisabledURLs
 
 	for _, url := range enabledURLs {
-		serverUpMetricValue := float64(1)
-		if err := checkHealth(url, backend); err != nil {
-			log.Warnf("Health check failed: Remove from server list. Backend: %q URL: %q Reason: %s", backend.name, url.String(), err)
-			backend.LB.RemoveServer(url)
-			backend.disabledURLs = append(backend.disabledURLs, url)
-			serverUpMetricValue = 0
+		if !checkHealth(url, currentBackend) {
+			log.Warnf("HealthCheck has failed [%s]: Remove from server list", url.String())
+			currentBackend.LB.RemoveServer(url)
+			currentBackend.disabledURLs = append(currentBackend.disabledURLs, url)
 		}
-		labelValues := []string{"backend", backend.name, "url", url.String()}
-		hc.metrics.BackendServerUpGauge().With(labelValues...).Set(serverUpMetricValue)
 	}
 }
 
@@ -163,28 +148,21 @@ func (backend *BackendHealthCheck) newRequest(serverURL *url.URL) (*http.Request
 	return http.NewRequest(http.MethodGet, u.String(), nil)
 }
 
-// checkHealth returns a nil error in case it was successful and otherwise
-// a non-nil error with a meaningful description why the health check failed.
-func checkHealth(serverURL *url.URL, backend *BackendHealthCheck) error {
+func checkHealth(serverURL *url.URL, backend *BackendHealthCheck) bool {
 	client := http.Client{
 		Timeout:   backend.requestTimeout,
 		Transport: backend.Options.Transport,
 	}
 	req, err := backend.newRequest(serverURL)
 	if err != nil {
-		return fmt.Errorf("failed to create HTTP request: %s", err)
+		log.Errorf("Failed to create HTTP request [%s] for healthcheck: %s", serverURL, err)
+		return false
 	}
 
 	resp, err := client.Do(req)
+
 	if err == nil {
 		defer resp.Body.Close()
 	}
-
-	switch {
-	case err != nil:
-		return fmt.Errorf("HTTP request failed: %s", err)
-	case resp.StatusCode != http.StatusOK:
-		return fmt.Errorf("received non-200 status code: %v", resp.StatusCode)
-	}
-	return nil
+	return err == nil && resp.StatusCode == http.StatusOK
 }

healthcheck/healthcheck_test.go

@@ -27,7 +27,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 		healthSequence         []bool
 		wantNumRemovedServers  int
 		wantNumUpsertedServers int
-		wantGaugeValue         float64
 	}{
 		{
 			desc:                   "healthy server staying healthy",
@@ -35,7 +34,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			healthSequence:         []bool{true},
 			wantNumRemovedServers:  0,
 			wantNumUpsertedServers: 0,
-			wantGaugeValue:         1,
 		},
 		{
 			desc:                   "healthy server becoming sick",
@@ -43,7 +41,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			healthSequence:         []bool{false},
 			wantNumRemovedServers:  1,
 			wantNumUpsertedServers: 0,
-			wantGaugeValue:         0,
 		},
 		{
 			desc:                   "sick server becoming healthy",
@@ -51,7 +48,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			healthSequence:         []bool{true},
 			wantNumRemovedServers:  0,
 			wantNumUpsertedServers: 1,
-			wantGaugeValue:         1,
 		},
 		{
 			desc:                   "sick server staying sick",
@@ -59,7 +55,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			healthSequence:         []bool{false},
 			wantNumRemovedServers:  0,
 			wantNumUpsertedServers: 0,
-			wantGaugeValue:         0,
 		},
 		{
 			desc:                   "healthy server toggling to sick and back to healthy",
@@ -67,7 +62,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			healthSequence:         []bool{false, true},
 			wantNumRemovedServers:  1,
 			wantNumUpsertedServers: 1,
-			wantGaugeValue:         1,
 		},
 	}
 
@@ -87,7 +81,7 @@ func TestSetBackendsConfiguration(t *testing.T) {
 				Path:     "/path",
 				Interval: healthCheckInterval,
 				LB:       lb,
-			}, "backendName")
+			})
 			serverURL := testhelpers.MustParseURL(ts.URL)
 			if test.startHealthy {
 				lb.servers = append(lb.servers, serverURL)
@@ -95,15 +89,13 @@ func TestSetBackendsConfiguration(t *testing.T) {
 				backend.disabledURLs = append(backend.disabledURLs, serverURL)
 			}
 
-			collectingMetrics := testhelpers.NewCollectingHealthCheckMetrics()
 			check := HealthCheck{
 				Backends: make(map[string]*BackendHealthCheck),
-				metrics:  collectingMetrics,
 			}
 			wg := sync.WaitGroup{}
 			wg.Add(1)
 			go func() {
-				check.execute(ctx, backend)
+				check.execute(ctx, "id", backend)
 				wg.Done()
 			}()
 
@@ -126,10 +118,6 @@ func TestSetBackendsConfiguration(t *testing.T) {
 			if lb.numUpsertedServers != test.wantNumUpsertedServers {
 				t.Errorf("got %d upserted servers, wanted %d", lb.numUpsertedServers, test.wantNumUpsertedServers)
 			}
-
-			if collectingMetrics.Gauge.GaugeValue != test.wantGaugeValue {
-				t.Errorf("got %v ServerUp Gauge, want %v", collectingMetrics.Gauge.GaugeValue, test.wantGaugeValue)
-			}
 		})
 	}
 }
@@ -180,7 +168,7 @@ func TestNewRequest(t *testing.T) {
 				Options{
 					Path: test.path,
 					Port: test.port,
-				}, "backendName")
+				})
 
 			u := &url.URL{
 				Scheme: "http",

integration/access_log_test.go

@@ -1,19 +1,18 @@
 package integration
 
 import (
-	"crypto/md5"
-	"crypto/rand"
 	"fmt"
-	"io"
 	"io/ioutil"
+	"net"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"strings"
 	"time"
 
 	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/middlewares/accesslog"
 	"github.com/go-check/check"
+	"github.com/mattn/go-shellwords"
 	checker "github.com/vdemeester/shakers"
 )
 
@@ -25,634 +24,57 @@ const (
 // AccessLogSuite
 type AccessLogSuite struct{ BaseSuite }
 
-type accessLogValue struct {
-	formatOnly   bool
-	code         string
-	user         string
-	frontendName string
-	backendName  string
-}
-
-func (s *AccessLogSuite) SetUpSuite(c *check.C) {
-	s.createComposeProject(c, "access_log")
-	s.composeProject.Start(c)
-
-	s.composeProject.Container(c, "server0")
-	s.composeProject.Container(c, "server1")
-	s.composeProject.Container(c, "server2")
-	s.composeProject.Container(c, "server3")
-}
-
-func (s *AccessLogSuite) TearDownTest(c *check.C) {
-	displayTraefikLogFile(c, traefikTestLogFile)
-	os.Remove(traefikTestAccessLogFile)
-}
-
 func (s *AccessLogSuite) TestAccessLog(c *check.C) {
 	// Ensure working directory is clean
-	ensureWorkingDirectoryIsClean()
+	os.Remove(traefikTestAccessLogFile)
+	os.Remove(traefikTestLogFile)
 
 	// Start Traefik
 	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
 	defer display(c)
-
 	err := cmd.Start()
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
 
-	waitForTraefik(c, "server1")
+	defer os.Remove(traefikTestAccessLogFile)
+	defer os.Remove(traefikTestLogFile)
 
-	checkStatsForLogFile(c)
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Make some requests
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "frontend1.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "frontend2.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogOutput(c)
-
-	c.Assert(count, checker.GreaterOrEqualThan, 3)
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogAuthFrontend(c *check.C) {
-	// Ensure working directory is clean
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "401",
-			user:         "-",
-			frontendName: "Auth for frontend-Host-frontend-auth-docker-local",
-			backendName:  "-",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "authFrontend")
-
-	waitForTraefik(c, "authFrontend")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test auth frontend
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8006/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "frontend.auth.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusUnauthorized), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogAuthEntrypoint(c *check.C) {
-	// Ensure working directory is clean
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "401",
-			user:         "-",
-			frontendName: "Auth for entrypoint",
-			backendName:  "-",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "authEntrypoint")
-
-	waitForTraefik(c, "authEntrypoint")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test auth entrypoint
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8004/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "entrypoint.auth.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusUnauthorized), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogAuthEntrypointSuccess(c *check.C) {
-	// Ensure working directory is clean
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "200",
-			user:         "test",
-			frontendName: "Host-entrypoint-auth-docker",
-			backendName:  "http://172.17.0",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "authEntrypoint")
-
-	waitForTraefik(c, "authEntrypoint")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test auth entrypoint
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8004/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "entrypoint.auth.docker.local"
-	req.SetBasicAuth("test", "test")
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogDigestAuthEntrypoint(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "401",
-			user:         "-",
-			frontendName: "Auth for entrypoint",
-			backendName:  "-",
-		},
-		{
-			formatOnly:   false,
-			code:         "200",
-			user:         "test",
-			frontendName: "Host-entrypoint-digest-auth-docker",
-			backendName:  "http://172.17.0",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "digestAuthEntrypoint")
-
-	waitForTraefik(c, "digestAuthEntrypoint")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test auth entrypoint
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8008/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "entrypoint.digest.auth.docker.local"
-
-	resp, err := try.ResponseUntilStatusCode(req, 500*time.Millisecond, http.StatusUnauthorized)
-	c.Assert(err, checker.IsNil)
-
-	digestParts := digestParts(resp)
-	digestParts["uri"] = "/"
-	digestParts["method"] = http.MethodGet
-	digestParts["username"] = "test"
-	digestParts["password"] = "test"
-
-	req.Header.Set("Authorization", getDigestAuthorization(digestParts))
-	req.Header.Set("Content-Type", "application/json")
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-// Thanks to mvndaai for digest authentication
-// https://stackoverflow.com/questions/39474284/how-do-you-do-a-http-post-with-digest-authentication-in-golang/39481441#39481441
-func digestParts(resp *http.Response) map[string]string {
-	result := map[string]string{}
-	if len(resp.Header["Www-Authenticate"]) > 0 {
-		wantedHeaders := []string{"nonce", "realm", "qop", "opaque"}
-		responseHeaders := strings.Split(resp.Header["Www-Authenticate"][0], ",")
-		for _, r := range responseHeaders {
-			for _, w := range wantedHeaders {
-				if strings.Contains(r, w) {
-					result[w] = strings.Split(r, `"`)[1]
-				}
-			}
+	err = try.Do(1*time.Second, func() error {
+		if _, err := os.Stat(traefikTestLogFile); err != nil {
+			return fmt.Errorf("could not get stats for log file: %s", err)
 		}
-	}
-	return result
-}
-
-func getMD5(data string) string {
-	digest := md5.New()
-	digest.Write([]byte(data))
-	return fmt.Sprintf("%x", digest.Sum(nil))
-}
-
-func getCnonce() string {
-	b := make([]byte, 8)
-	io.ReadFull(rand.Reader, b)
-	return fmt.Sprintf("%x", b)[:16]
-}
-
-func getDigestAuthorization(digestParts map[string]string) string {
-	d := digestParts
-	ha1 := getMD5(d["username"] + ":" + d["realm"] + ":" + d["password"])
-	ha2 := getMD5(d["method"] + ":" + d["uri"])
-	nonceCount := "00000001"
-	cnonce := getCnonce()
-	response := getMD5(fmt.Sprintf("%s:%s:%s:%s:%s:%s", ha1, d["nonce"], nonceCount, cnonce, d["qop"], ha2))
-	authorization := fmt.Sprintf(`Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=%s, qop=%s, response="%s", opaque="%s", algorithm="MD5"`,
-		d["username"], d["realm"], d["nonce"], d["uri"], cnonce, nonceCount, d["qop"], response, d["opaque"])
-	return authorization
-}
-
-func (s *AccessLogSuite) TestAccessLogEntrypointRedirect(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "302",
-			user:         "-",
-			frontendName: "entrypoint redirect for frontend-",
-			backendName:  "-",
-		},
-		{
-			formatOnly: true,
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
+		return nil
+	})
 	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "entrypointRedirect")
-
-	waitForTraefik(c, "entrypointRedirect")
 
 	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test entrypoint redirect
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8001/test", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = ""
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogFrontendRedirect(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "302",
-			user:         "-",
-			frontendName: "frontend redirect for frontend-Path-",
-			backendName:  "-",
-		},
-		{
-			formatOnly: true,
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "frontendRedirect")
-
-	waitForTraefik(c, "frontendRedirect")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test frontend redirect
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8005/test", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = ""
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogRateLimit(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly: true,
-		},
-		{
-			formatOnly: true,
-		},
-		{
-			formatOnly:   false,
-			code:         "429",
-			user:         "-",
-			frontendName: "rate limit for frontend-Host-ratelimit",
-			backendName:  "/",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "rateLimit")
-
-	waitForTraefik(c, "rateLimit")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test rate limit
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8007/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "ratelimit.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusOK), try.HasBody())
-	c.Assert(err, checker.IsNil)
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusTooManyRequests), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogBackendNotFound(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "404",
-			user:         "-",
-			frontendName: "backend not found",
-			backendName:  "/",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	waitForTraefik(c, "server1")
-
-	checkStatsForLogFile(c)
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test rate limit
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "backendnotfound.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusNotFound), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogEntrypointWhitelist(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "403",
-			user:         "-",
-			frontendName: "ipwhitelister for entrypoint httpWhitelistReject",
-			backendName:  "-",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "entrypointWhitelist")
-
-	waitForTraefik(c, "entrypointWhitelist")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test rate limit
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8002/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "entrypoint.whitelist.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusForbidden), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func (s *AccessLogSuite) TestAccessLogFrontendWhitelist(c *check.C) {
-	ensureWorkingDirectoryIsClean()
-
-	expected := []accessLogValue{
-		{
-			formatOnly:   false,
-			code:         "403",
-			user:         "-",
-			frontendName: "ipwhitelister for frontend-Host-frontend-whitelist",
-			backendName:  "-",
-		},
-	}
-
-	// Start Traefik
-	cmd, display := s.traefikCmd(withConfigFile("fixtures/access_log_config.toml"))
-	defer display(c)
-
-	err := cmd.Start()
-	c.Assert(err, checker.IsNil)
-	defer cmd.Process.Kill()
-
-	checkStatsForLogFile(c)
-
-	s.composeProject.Container(c, "frontendWhitelist")
-
-	waitForTraefik(c, "frontendWhitelist")
-
-	// Verify Traefik started OK
-	checkTraefikStarted(c)
-
-	// Test rate limit
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/", nil)
-	c.Assert(err, checker.IsNil)
-	req.Host = "frontend.whitelist.docker.local"
-
-	err = try.Request(req, 500*time.Millisecond, try.StatusCodeIs(http.StatusForbidden), try.HasBody())
-	c.Assert(err, checker.IsNil)
-
-	// Verify access.log output as expected
-	count := checkAccessLogExactValuesOutput(c, expected)
-
-	c.Assert(count, checker.GreaterOrEqualThan, len(expected))
-
-	// Verify no other Traefik problems
-	checkNoOtherTraefikProblems(c)
-}
-
-func checkNoOtherTraefikProblems(c *check.C) {
 	traefikLog, err := ioutil.ReadFile(traefikTestLogFile)
 	c.Assert(err, checker.IsNil)
 	if len(traefikLog) > 0 {
 		fmt.Printf("%s\n", string(traefikLog))
 		c.Assert(traefikLog, checker.HasLen, 0)
 	}
-}
 
-func checkAccessLogOutput(c *check.C) int {
-	lines := extractLines(c)
+	// Start test servers
+	ts1 := startAccessLogServer(8081)
+	defer ts1.Close()
+	ts2 := startAccessLogServer(8082)
+	defer ts2.Close()
+	ts3 := startAccessLogServer(8083)
+	defer ts3.Close()
+
+	// Make some requests
+	err = try.GetRequest("http://127.0.0.1:8000/test1", 500*time.Millisecond)
+	c.Assert(err, checker.IsNil)
+	err = try.GetRequest("http://127.0.0.1:8000/test2", 500*time.Millisecond)
+	c.Assert(err, checker.IsNil)
+	err = try.GetRequest("http://127.0.0.1:8000/test2", 500*time.Millisecond)
+	c.Assert(err, checker.IsNil)
+
+	// Verify access.log output as expected
+	accessLog, err := ioutil.ReadFile(traefikTestAccessLogFile)
+	c.Assert(err, checker.IsNil)
+	lines := strings.Split(string(accessLog), "\n")
 	count := 0
 	for i, line := range lines {
 		if len(line) > 0 {
@@ -660,109 +82,40 @@ func checkAccessLogOutput(c *check.C) int {
 			CheckAccessLogFormat(c, line, i)
 		}
 	}
-	return count
-}
+	c.Assert(count, checker.GreaterOrEqualThan, 3)
 
-func checkAccessLogExactValuesOutput(c *check.C, values []accessLogValue) int {
-	lines := extractLines(c)
-	count := 0
-	for i, line := range lines {
-		fmt.Printf(line)
-		fmt.Println()
-		if len(line) > 0 {
-			count++
-			if values[i].formatOnly {
-				CheckAccessLogFormat(c, line, i)
-			} else {
-				checkAccessLogExactValues(c, line, i, values[i])
-			}
-		}
-	}
-	return count
-}
-
-func extractLines(c *check.C) []string {
-	accessLog, err := ioutil.ReadFile(traefikTestAccessLogFile)
-	c.Assert(err, checker.IsNil)
-	lines := strings.Split(string(accessLog), "\n")
-	return lines
-}
-
-func checkStatsForLogFile(c *check.C) {
-	err := try.Do(1*time.Second, func() error {
-		if _, errStat := os.Stat(traefikTestLogFile); errStat != nil {
-			return fmt.Errorf("could not get stats for log file: %s", errStat)
-		}
-		return nil
-	})
-	c.Assert(err, checker.IsNil)
-}
-
-func ensureWorkingDirectoryIsClean() {
-	os.Remove(traefikTestAccessLogFile)
-	os.Remove(traefikTestLogFile)
-}
-
-func checkTraefikStarted(c *check.C) []byte {
-	traefikLog, err := ioutil.ReadFile(traefikTestLogFile)
+	// Verify no other Traefik problems
+	traefikLog, err = ioutil.ReadFile(traefikTestLogFile)
 	c.Assert(err, checker.IsNil)
 	if len(traefikLog) > 0 {
 		fmt.Printf("%s\n", string(traefikLog))
 		c.Assert(traefikLog, checker.HasLen, 0)
 	}
-	return traefikLog
 }
 
 func CheckAccessLogFormat(c *check.C, line string, i int) {
-	results, err := accesslog.ParseAccessLog(line)
+	tokens, err := shellwords.Parse(line)
 	c.Assert(err, checker.IsNil)
-	c.Assert(results, checker.HasLen, 14)
-	c.Assert(results[accesslog.OriginStatus], checker.Matches, `^(-|\d{3})$`)
-	c.Assert(results[accesslog.RequestCount], checker.Equals, fmt.Sprintf("%d", i+1))
-	c.Assert(results[accesslog.FrontendName], checker.HasPrefix, "\"Host-")
-	c.Assert(results[accesslog.BackendURL], checker.HasPrefix, "\"http://")
-	c.Assert(results[accesslog.Duration], checker.Matches, `^\d+ms$`)
+	c.Assert(tokens, checker.HasLen, 14)
+	c.Assert(tokens[6], checker.Matches, `^(-|\d{3})$`)
+	c.Assert(tokens[10], checker.Equals, fmt.Sprintf("%d", i+1))
+	c.Assert(tokens[11], checker.HasPrefix, "frontend")
+	c.Assert(tokens[12], checker.HasPrefix, "http://127.0.0.1:808")
+	c.Assert(tokens[13], checker.Matches, `^\d+ms$`)
 }
 
-func checkAccessLogExactValues(c *check.C, line string, i int, v accessLogValue) {
-	results, err := accesslog.ParseAccessLog(line)
-	c.Assert(err, checker.IsNil)
-	c.Assert(results, checker.HasLen, 14)
-	if len(v.user) > 0 {
-		c.Assert(results[accesslog.ClientUsername], checker.Equals, v.user)
-	}
-	c.Assert(results[accesslog.OriginStatus], checker.Equals, v.code)
-	c.Assert(results[accesslog.RequestCount], checker.Equals, fmt.Sprintf("%d", i+1))
-	c.Assert(results[accesslog.FrontendName], checker.Matches, `^"?`+v.frontendName+`.*$`)
-	c.Assert(results[accesslog.BackendURL], checker.Matches, `^"?`+v.backendName+`.*$`)
-	c.Assert(results[accesslog.Duration], checker.Matches, `^\d+ms$`)
-}
-
-func waitForTraefik(c *check.C, containerName string) {
-	// Wait for Traefik to turn ready.
-	req, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8080/api", nil)
-	c.Assert(err, checker.IsNil)
-
-	err = try.Request(req, 2*time.Second, try.StatusCodeIs(http.StatusOK), try.BodyContains(containerName))
-	c.Assert(err, checker.IsNil)
-}
-
-func displayTraefikLogFile(c *check.C, path string) {
-	if c.Failed() {
-		if _, err := os.Stat(path); !os.IsNotExist(err) {
-			content, errRead := ioutil.ReadFile(path)
-			fmt.Printf("%s: Traefik logs: \n", c.TestName())
-			if errRead == nil {
-				fmt.Println(content)
-			} else {
-				fmt.Println(errRead)
-			}
-		} else {
-			fmt.Printf("%s: No Traefik logs.\n", c.TestName())
-		}
-		errRemove := os.Remove(path)
-		if errRemove != nil {
-			fmt.Println(errRemove)
+func startAccessLogServer(port int) (ts *httptest.Server) {
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, "Received query %s!\n", r.URL.Path[1:])
+	})
+	if listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port)); err != nil {
+		panic(err)
+	} else {
+		ts = &httptest.Server{
+			Listener: listener,
+			Config:   &http.Server{Handler: handler},
 		}
+		ts.Start()
 	}
+	return
 }

integration/acme_test.go

@@ -32,9 +32,6 @@ const (
 
 	// Wildcard domain to check
 	wildcardDomain = "*.acme.wtf"
-
-	// Traefik default certificate
-	traefikDefaultDomain = "TRAEFIK DEFAULT CERT"
 )
 
 func (s *AcmeSuite) SetUpSuite(c *check.C) {
@@ -44,7 +41,7 @@ func (s *AcmeSuite) SetUpSuite(c *check.C) {
 	s.boulderIP = s.composeProject.Container(c, "boulder").NetworkSettings.IPAddress
 
 	// wait for boulder
-	err := try.GetRequest("http://"+s.boulderIP+":4001/directory", 120*time.Second, try.StatusCodeIs(http.StatusOK))
+	err := try.GetRequest("http://"+s.boulderIP+":4000/directory", 120*time.Second, try.StatusCodeIs(http.StatusOK))
 	c.Assert(err, checker.IsNil)
 }
 
@@ -55,46 +52,26 @@ func (s *AcmeSuite) TearDownSuite(c *check.C) {
 	}
 }
 
-// Test ACME provider with certificate at start
-func (s *AcmeSuite) TestACMEProviderAtStart(c *check.C) {
+// Test OnDemand option with none provided certificate
+func (s *AcmeSuite) TestOnDemandRetrieveAcmeCertificate(c *check.C) {
 	testCase := AcmeTestCase{
-		traefikConfFilePath: "fixtures/provideracme/acme.toml",
-		onDemand:            false,
+		traefikConfFilePath: "fixtures/acme/acme.toml",
+		onDemand:            true,
 		domainToCheck:       acmeDomain}
 
 	s.retrieveAcmeCertificate(c, testCase)
 }
 
-// Test ACME provider with certificate at start
-func (s *AcmeSuite) TestACMEProviderAtStartInSAN(c *check.C) {
+// Test OnHostRule option with none provided certificate
+func (s *AcmeSuite) TestOnHostRuleRetrieveAcmeCertificate(c *check.C) {
 	testCase := AcmeTestCase{
-		traefikConfFilePath: "fixtures/provideracme/acme_insan.toml",
-		onDemand:            false,
-		domainToCheck:       "acme.wtf"}
-
-	s.retrieveAcmeCertificate(c, testCase)
-}
-
-// Test ACME provider with certificate at start
-func (s *AcmeSuite) TestACMEProviderOnHost(c *check.C) {
-	testCase := AcmeTestCase{
-		traefikConfFilePath: "fixtures/provideracme/acme_onhost.toml",
+		traefikConfFilePath: "fixtures/acme/acme.toml",
 		onDemand:            false,
 		domainToCheck:       acmeDomain}
 
 	s.retrieveAcmeCertificate(c, testCase)
 }
 
-// Test ACME provider with certificate at start and no ACME challenge
-func (s *AcmeSuite) TestACMEProviderOnHostWithNoACMEChallenge(c *check.C) {
-	testCase := AcmeTestCase{
-		traefikConfFilePath: "fixtures/acme/no_challenge_acme.toml",
-		onDemand:            false,
-		domainToCheck:       traefikDefaultDomain}
-
-	s.retrieveAcmeCertificate(c, testCase)
-}
-
 // Test OnDemand option with none provided certificate and challenge HTTP-01
 func (s *AcmeSuite) TestOnDemandRetrieveAcmeCertificateHTTP01(c *check.C) {
 	testCase := AcmeTestCase{
@@ -206,8 +183,8 @@ func (s *AcmeSuite) retrieveAcmeCertificate(c *check.C, testCase AcmeTestCase) {
 
 	// wait for traefik (generating acme account take some seconds)
 	err = try.Do(90*time.Second, func() error {
-		_, errGet := client.Get("https://127.0.0.1:5001")
-		return errGet
+		_, err := client.Get("https://127.0.0.1:5001")
+		return err
 	})
 	c.Assert(err, checker.IsNil)
 
@@ -239,7 +216,7 @@ func (s *AcmeSuite) retrieveAcmeCertificate(c *check.C, testCase AcmeTestCase) {
 
 		cn := resp.TLS.PeerCertificates[0].Subject.CommonName
 		if cn != testCase.domainToCheck {
-			return fmt.Errorf("domain %s found instead of %s", cn, testCase.domainToCheck)
+			return fmt.Errorf("domain %s found in place of %s", cn, testCase.domainToCheck)
 		}
 
 		return nil

integration/basic_test.go

@@ -68,7 +68,7 @@ func (s *SimpleSuite) TestDefaultEntryPoints(c *check.C) {
 	defer cmd.Process.Kill()
 
 	err = try.Do(500*time.Millisecond, func() error {
-		expected := `\"DefaultEntryPoints\":[\"http\"]`
+		expected := "\"DefaultEntryPoints\":[\"http\"]"
 		actual := output.String()
 
 		if !strings.Contains(actual, expected) {
@@ -128,10 +128,6 @@ func (s *SimpleSuite) TestRequestAcceptGraceTimeout(c *check.C) {
 	err = try.GetRequest("http://127.0.0.1:8000/service", 3*time.Second, try.StatusCodeIs(http.StatusOK))
 	c.Assert(err, checker.IsNil)
 
-	// Check that /ping endpoint is responding with 200.
-	err = try.GetRequest("http://127.0.0.1:8001/ping", 3*time.Second, try.StatusCodeIs(http.StatusOK))
-	c.Assert(err, checker.IsNil)
-
 	// Send SIGTERM to Traefik.
 	proc, err := os.FindProcess(cmd.Process.Pid)
 	c.Assert(err, checker.IsNil)
@@ -147,12 +143,6 @@ func (s *SimpleSuite) TestRequestAcceptGraceTimeout(c *check.C) {
 	defer resp.Body.Close()
 	c.Assert(resp.StatusCode, checker.Equals, http.StatusOK)
 
-	// ping endpoint should now return a Service Unavailable.
-	resp, err = http.Get("http://127.0.0.1:8001/ping")
-	c.Assert(err, checker.IsNil)
-	defer resp.Body.Close()
-	c.Assert(resp.StatusCode, checker.Equals, http.StatusServiceUnavailable)
-
 	// Expect Traefik to shut down gracefully once the request accepting grace
 	// period has elapsed.
 	waitErr := make(chan error)

integration/constraint_test.go

@@ -36,10 +36,10 @@ func (s *ConstraintSuite) SetUpSuite(c *check.C) {
 
 	// Wait for consul to elect itself leader
 	err = try.Do(3*time.Second, func() error {
-		leader, errLeader := consulClient.Status().Leader()
+		leader, err := consulClient.Status().Leader()
 
-		if errLeader != nil || len(leader) == 0 {
-			return fmt.Errorf("leader not found. %v", errLeader)
+		if err != nil || len(leader) == 0 {
+			return fmt.Errorf("Leader not found. %v", err)
 		}
 
 		return nil

integration/consul_catalog_test.go

@@ -250,9 +250,9 @@ func (s *ConsulCatalogSuite) TestExposedByDefaultTrueSimpleServiceMultipleNode(c
 	err = try.Request(req, 5*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
 	c.Assert(err, checker.IsNil)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress, whoami2.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1", "whoami2"))
 	c.Assert(err, checker.IsNil)
+
 }
 
 func (s *ConsulCatalogSuite) TestRefreshConfigWithMultipleNodeWithoutHealthCheck(c *check.C) {
@@ -285,30 +285,27 @@ func (s *ConsulCatalogSuite) TestRefreshConfigWithMultipleNodeWithoutHealthCheck
 	err = try.Request(req, 5*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
 	c.Assert(err, checker.IsNil)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.IsNil)
 
 	err = s.registerService("test", whoami2.NetworkSettings.IPAddress, 80, []string{"name=whoami2"})
 	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress, whoami2.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1", "whoami2"))
 	c.Assert(err, checker.IsNil)
 
 	s.deregisterService("test", whoami2.NetworkSettings.IPAddress)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.IsNil)
 
 	err = s.registerService("test", whoami2.NetworkSettings.IPAddress, 80, []string{"name=whoami2"})
 	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
 	defer s.deregisterService("test", whoami2.NetworkSettings.IPAddress)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress, whoami2.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1", "whoami2"))
 	c.Assert(err, checker.IsNil)
+
 }
 
 func (s *ConsulCatalogSuite) TestBasicAuthSimpleService(c *check.C) {
@@ -366,8 +363,7 @@ func (s *ConsulCatalogSuite) TestRefreshConfigTagChange(c *check.C) {
 	c.Assert(err, checker.IsNil, check.Commentf("Error registering service"))
 	defer s.deregisterService("test", whoami.NetworkSettings.IPAddress)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 5*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 5*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.NotNil)
 
 	err = s.registerService("test", whoami.NetworkSettings.IPAddress, 80, []string{"name=whoami1", "traefik.enable=true", "traefik.backend.circuitbreaker=ResponseCodeRatio(500, 600, 0, 600) > 0.5"})
@@ -380,8 +376,7 @@ func (s *ConsulCatalogSuite) TestRefreshConfigTagChange(c *check.C) {
 	err = try.Request(req, 20*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())
 	c.Assert(err, checker.IsNil)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second,
-		try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.IsNil)
 }
 
@@ -449,7 +444,7 @@ func (s *ConsulCatalogSuite) TestRefreshConfigPortChange(c *check.C) {
 	err = try.Request(req, 20*time.Second, try.StatusCodeIs(http.StatusBadGateway))
 	c.Assert(err, checker.IsNil)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 5*time.Second, try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 5*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.IsNil)
 
 	err = s.registerService("test", whoami.NetworkSettings.IPAddress, 80, []string{"name=whoami1", "traefik.enable=true"})
@@ -457,7 +452,7 @@ func (s *ConsulCatalogSuite) TestRefreshConfigPortChange(c *check.C) {
 
 	defer s.deregisterService("test", whoami.NetworkSettings.IPAddress)
 
-	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains(whoami.NetworkSettings.IPAddress))
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers/consul_catalog/backends", 60*time.Second, try.BodyContains("whoami1"))
 	c.Assert(err, checker.IsNil)
 
 	err = try.Request(req, 20*time.Second, try.StatusCodeIs(http.StatusOK), try.HasBody())

integration/consul_test.go

@@ -10,13 +10,13 @@ import (
 	"sync"
 	"time"
 
-	"github.com/abronan/valkeyrie"
-	"github.com/abronan/valkeyrie/store"
-	"github.com/abronan/valkeyrie/store/consul"
 	"github.com/containous/staert"
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/integration/try"
 	"github.com/containous/traefik/types"
+	"github.com/docker/libkv"
+	"github.com/docker/libkv/store"
+	"github.com/docker/libkv/store/consul"
 	"github.com/go-check/check"
 	checker "github.com/vdemeester/shakers"
 )
@@ -32,7 +32,7 @@ func (s *ConsulSuite) setupConsul(c *check.C) {
 	s.composeProject.Start(c)
 
 	consul.Register()
-	kv, err := valkeyrie.NewStore(
+	kv, err := libkv.NewStore(
 		store.CONSUL,
 		[]string{s.composeProject.Container(c, "consul").NetworkSettings.IPAddress + ":8500"},
 		&store.Config{
@@ -63,7 +63,7 @@ func (s *ConsulSuite) setupConsulTLS(c *check.C) {
 	TLSConfig, err := clientTLS.CreateTLSConfig()
 	c.Assert(err, checker.IsNil)
 
-	kv, err := valkeyrie.NewStore(
+	kv, err := libkv.NewStore(
 		store.CONSUL,
 		[]string{s.composeProject.Container(c, "consul").NetworkSettings.IPAddress + ":8585"},
 		&store.Config{
@@ -289,6 +289,41 @@ func (s *ConsulSuite) TestGlobalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)
 }
 
+func (s *ConsulSuite) skipTestGlobalConfigurationWithClientTLS(c *check.C) {
+	c.Skip("wait for relative path issue in the composefile")
+	s.setupConsulTLS(c)
+	consulHost := s.composeProject.Container(c, "consul").NetworkSettings.IPAddress
+
+	err := s.kv.Put("traefik/api/entrypoint", []byte("api"), nil)
+	c.Assert(err, checker.IsNil)
+
+	err = s.kv.Put("traefik/entrypoints/api/address", []byte(":8081"), nil)
+	c.Assert(err, checker.IsNil)
+
+	// wait for consul
+	err = try.Do(60*time.Second, try.KVExists(s.kv, "traefik/web/address"))
+	c.Assert(err, checker.IsNil)
+
+	// start traefik
+	cmd, display := s.traefikCmd(
+		withConfigFile("fixtures/simple_web.toml"),
+		"--consul",
+		"--consul.endpoint="+consulHost+":8585",
+		"--consul.tls.ca=resources/tls/ca.cert",
+		"--consul.tls.cert=resources/tls/consul.cert",
+		"--consul.tls.key=resources/tls/consul.key",
+		"--consul.tls.insecureskipverify")
+	defer display(c)
+
+	err = cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for traefik
+	err = try.GetRequest("http://127.0.0.1:8081/api/providers", 60*time.Second)
+	c.Assert(err, checker.IsNil)
+}
+
 func (s *ConsulSuite) TestCommandStoreConfig(c *check.C) {
 	s.setupConsul(c)
 	consulHost := s.composeProject.Container(c, "consul").NetworkSettings.IPAddress
@@ -623,7 +658,6 @@ func (s *ConsulSuite) TestSNIDynamicTlsConfig(c *check.C) {
 	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
 	req.Header.Set("Accept", "*/*")
 	resp, err = client.Do(req)
-	c.Assert(err, checker.IsNil)
 	cn = resp.TLS.PeerCertificates[0].Subject.CommonName
 	c.Assert(cn, checker.Equals, "snitest.org")
 }

integration/docker_compose_test.go

@@ -0,0 +1,78 @@
+package integration
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/containous/traefik/integration/try"
+	"github.com/containous/traefik/testhelpers"
+	"github.com/containous/traefik/types"
+	"github.com/go-check/check"
+	checker "github.com/vdemeester/shakers"
+)
+
+const (
+	composeProject = "minimal"
+)
+
+// Docker test suites
+type DockerComposeSuite struct {
+	BaseSuite
+}
+
+func (s *DockerComposeSuite) SetUpSuite(c *check.C) {
+	s.createComposeProject(c, composeProject)
+	s.composeProject.Start(c)
+}
+
+func (s *DockerComposeSuite) TearDownSuite(c *check.C) {
+	// shutdown and delete compose project
+	if s.composeProject != nil {
+		s.composeProject.Stop(c)
+	}
+}
+
+func (s *DockerComposeSuite) TestComposeScale(c *check.C) {
+	var serviceCount = 2
+	var composeService = "whoami1"
+
+	s.composeProject.Scale(c, composeService, serviceCount)
+
+	file := s.adaptFileForHost(c, "fixtures/docker/simple.toml")
+	defer os.Remove(file)
+
+	cmd, display := s.traefikCmd(withConfigFile(file))
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	req := testhelpers.MustNewRequest(http.MethodGet, "http://127.0.0.1:8000/whoami", nil)
+	req.Host = "my.super.host"
+
+	_, err = try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	c.Assert(err, checker.IsNil)
+
+	resp, err := http.Get("http://127.0.0.1:8080/api/providers/docker")
+	c.Assert(err, checker.IsNil)
+
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	c.Assert(err, checker.IsNil)
+
+	var provider types.Configuration
+	c.Assert(json.Unmarshal(body, &provider), checker.IsNil)
+
+	// check that we have only one backend with n servers
+	c.Assert(provider.Backends, checker.HasLen, 1)
+
+	myBackend := provider.Backends["backend-"+composeService+"-integrationtest"+composeProject]
+	c.Assert(myBackend, checker.NotNil)
+	c.Assert(myBackend.Servers, checker.HasLen, serviceCount)
+
+	// check that we have only one frontend
+	c.Assert(provider.Frontends, checker.HasLen, 1)
+}

integration/docker_test.go

@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/containous/traefik/integration/try"
-	"github.com/containous/traefik/provider/label"
+	"github.com/containous/traefik/types"
 	"github.com/docker/docker/pkg/namesgenerator"
 	"github.com/go-check/check"
 	d "github.com/libkermit/docker"
@@ -138,13 +138,13 @@ func (s *DockerSuite) TestDockerContainersWithLabels(c *check.C) {
 	defer os.Remove(file)
 	// Start a container with some labels
 	labels := map[string]string{
-		label.TraefikFrontendRule: "Host:my.super.host",
+		types.LabelFrontendRule: "Host:my.super.host",
 	}
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")
 
 	// Start another container by replacing a '.' by a '-'
 	labels = map[string]string{
-		label.TraefikFrontendRule: "Host:my-super.host",
+		types.LabelFrontendRule: "Host:my-super.host",
 	}
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blablabla")
 	// Start traefik
@@ -159,7 +159,7 @@ func (s *DockerSuite) TestDockerContainersWithLabels(c *check.C) {
 	req.Host = "my-super.host"
 
 	// FIXME Need to wait than 500 milliseconds more (for swarm or traefik to boot up ?)
-	_, err = try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	resp, err := try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
 	c.Assert(err, checker.IsNil)
 
 	req, err = http.NewRequest(http.MethodGet, "http://127.0.0.1:8000/version", nil)
@@ -167,7 +167,7 @@ func (s *DockerSuite) TestDockerContainersWithLabels(c *check.C) {
 	req.Host = "my.super.host"
 
 	// FIXME Need to wait than 500 milliseconds more (for swarm or traefik to boot up ?)
-	resp, err := try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
+	resp, err = try.ResponseUntilStatusCode(req, 1500*time.Millisecond, http.StatusOK)
 	c.Assert(err, checker.IsNil)
 
 	body, err := ioutil.ReadAll(resp.Body)
@@ -184,7 +184,7 @@ func (s *DockerSuite) TestDockerContainersWithOneMissingLabels(c *check.C) {
 	defer os.Remove(file)
 	// Start a container with some labels
 	labels := map[string]string{
-		"traefik.frontend.value": "my.super.host",
+		types.LabelTraefikFrontendValue: "my.super.host",
 	}
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")
 
@@ -213,9 +213,9 @@ func (s *DockerSuite) TestDockerContainersWithServiceLabels(c *check.C) {
 	defer os.Remove(file)
 	// Start a container with some labels
 	labels := map[string]string{
-		label.Prefix + "servicename.frontend.rule": "Host:my.super.host",
-		label.TraefikFrontendRule:                  "Host:my.wrong.host",
-		label.TraefikPort:                          "2375",
+		types.LabelPrefix + "servicename.frontend.rule": "Host:my.super.host",
+		types.LabelFrontendRule:                         "Host:my.wrong.host",
+		types.LabelPort:                                 "2375",
 	}
 	s.startContainerWithLabels(c, "swarm:1.0.0", labels, "manage", "token://blabla")
 
@@ -248,8 +248,8 @@ func (s *DockerSuite) TestRestartDockerContainers(c *check.C) {
 	defer os.Remove(file)
 	// Start a container with some labels
 	labels := map[string]string{
-		label.Prefix + "frontend.rule": "Host:my.super.host",
-		label.TraefikPort:              "2375",
+		types.LabelPrefix + "frontend.rule": "Host:my.super.host",
+		types.LabelPort:                     "2375",
 	}
 	s.startContainerWithNameAndLabels(c, "powpow", "swarm:1.0.0", labels, "manage", "token://blabla")
 

integration/error_pages_test.go

@@ -39,7 +39,7 @@ func (s *ErrorPagesSuite) TestSimpleConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
 
-	frontendReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8080", nil)
+	frontendReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:80", nil)
 	c.Assert(err, checker.IsNil)
 	frontendReq.Host = "test.local"
 
@@ -62,7 +62,7 @@ func (s *ErrorPagesSuite) TestErrorPage(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	defer cmd.Process.Kill()
 
-	frontendReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:8080", nil)
+	frontendReq, err := http.NewRequest(http.MethodGet, "http://127.0.0.1:80", nil)
 	c.Assert(err, checker.IsNil)
 	frontendReq.Host = "test.local"
 

integration/etcd3_test.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/abronan/valkeyrie"
-	"github.com/abronan/valkeyrie/store"
-	"github.com/abronan/valkeyrie/store/etcd/v3"
 	"github.com/containous/traefik/integration/try"
+	"github.com/docker/libkv"
+	"github.com/docker/libkv/store"
+	"github.com/docker/libkv/store/etcd/v3"
 	"github.com/go-check/check"
 
 	checker "github.com/vdemeester/shakers"
@@ -19,14 +19,14 @@ import (
 
 const (
 	// Services IP addresses fixed in the configuration
-	ipEtcd     = "172.18.0.2"
-	ipWhoami01 = "172.18.0.3"
-	ipWhoami02 = "172.18.0.4"
-	ipWhoami03 = "172.18.0.5"
-	ipWhoami04 = "172.18.0.6"
+	ipEtcd     string = "172.18.0.2"
+	ipWhoami01 string = "172.18.0.3"
+	ipWhoami02 string = "172.18.0.4"
+	ipWhoami03 string = "172.18.0.5"
+	ipWhoami04 string = "172.18.0.6"
 
-	traefikEtcdURL    = "http://127.0.0.1:8000/"
-	traefikWebEtcdURL = "http://127.0.0.1:8081/"
+	traefikEtcdURL    string = "http://127.0.0.1:8000/"
+	traefikWebEtcdURL string = "http://127.0.0.1:8081/"
 )
 
 // Etcd test suites (using libcompose)
@@ -41,7 +41,7 @@ func (s *Etcd3Suite) SetUpTest(c *check.C) {
 
 	etcdv3.Register()
 	url := ipEtcd + ":2379"
-	kv, err := valkeyrie.NewStore(
+	kv, err := libkv.NewStore(
 		store.ETCDV3,
 		[]string{url},
 		&store.Config{
@@ -289,7 +289,7 @@ func (s *Etcd3Suite) TestGlobalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)
 }
 
-func (s *Etcd3Suite) TestCertificatesContentWithSNIConfigHandshake(c *check.C) {
+func (s *Etcd3Suite) TestCertificatesContentstWithSNIConfigHandshake(c *check.C) {
 	// start traefik
 	cmd, display := s.traefikCmd(
 		withConfigFile("fixtures/simple_web.toml"),

integration/etcd_test.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/abronan/valkeyrie"
-	"github.com/abronan/valkeyrie/store"
-	"github.com/abronan/valkeyrie/store/etcd/v2"
 	"github.com/containous/traefik/integration/try"
+	"github.com/docker/libkv"
+	"github.com/docker/libkv/store"
+	"github.com/docker/libkv/store/etcd/v2"
 	"github.com/go-check/check"
 
 	checker "github.com/vdemeester/shakers"
@@ -29,7 +29,7 @@ func (s *EtcdSuite) SetUpTest(c *check.C) {
 
 	etcd.Register()
 	url := s.composeProject.Container(c, "etcd").NetworkSettings.IPAddress + ":2379"
-	kv, err := valkeyrie.NewStore(
+	kv, err := libkv.NewStore(
 		store.ETCD,
 		[]string{url},
 		&store.Config{
@@ -291,7 +291,7 @@ func (s *EtcdSuite) TestGlobalConfiguration(c *check.C) {
 	c.Assert(err, checker.IsNil)
 }
 
-func (s *EtcdSuite) TestCertificatesContentWithSNIConfigHandshake(c *check.C) {
+func (s *EtcdSuite) TestCertificatesContentstWithSNIConfigHandshake(c *check.C) {
 	etcdHost := s.composeProject.Container(c, "etcd").NetworkSettings.IPAddress
 	// start Træfik
 	cmd, display := s.traefikCmd(
@@ -589,7 +589,6 @@ func (s *EtcdSuite) TestSNIDynamicTlsConfig(c *check.C) {
 	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
 	req.Header.Set("Accept", "*/*")
 	resp, err = client.Do(req)
-	c.Assert(err, checker.IsNil)
 	cn = resp.TLS.PeerCertificates[0].Subject.CommonName
 	c.Assert(cn, checker.Equals, "snitest.org")
 }

integration/fixtures/access_log_config.toml

@@ -1,41 +1,50 @@
+################################################################
+# Global configuration
+################################################################
+traefikLogsFile = "traefik.log"
+accessLogsFile = "access.log"
 logLevel = "ERROR"
 defaultEntryPoints = ["http"]
-checkNewVersion = false
-
-[traefikLog]
-  filePath = "traefik.log"
-
-[accessLog]
-  filePath = "access.log"
-
 [entryPoints]
   [entryPoints.http]
-    address = ":8000"
-  [entryPoints.httpRedirect]
-    address = ":8001"
-    [entryPoints.httpRedirect.redirect]
-      entryPoint = "http"
-  [entryPoints.httpWhitelistReject]
-    address = ":8002"
-    whiteListSourceRange = ["8.8.8.8/32"]
-  [entryPoints.httpAuth]
-    address = ":8004"
-    [entryPoints.httpAuth.auth.basic]
-        users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
-  [entryPoints.frontendRedirect]
-    address = ":8005"
-  [entryPoints.httpFrontendAuth]
-    address = ":8006"
-  [entryPoints.httpRateLimit]
-    address = ":8007"
-  [entryPoints.digestAuth]
-    address = ":8008"
-    [entryPoints.digestAuth.auth.digest]
-      users = ["test:traefik:a2688e031edb4be6a3797f3882655c05", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
+  address = ":8000"
+  [entryPoints.api]
+  address = ":7888"
 
+checkNewVersion = false
+
+################################################################
+# Api configuration
+################################################################
 [api]
+entryPoint = "api"
 
-[docker]
-  exposedByDefault = false
-  domain = "docker.local"
-  watch = true
+################################################################
+# File configuration backend
+################################################################
+[file]
+
+################################################################
+# rules
+################################################################
+ [backends]
+   [backends.backend1]
+     [backends.backend1.servers.server1]
+       url = "http://127.0.0.1:8081"
+   [backends.backend2]
+     [backends.backend2.LoadBalancer]
+       method = "drr"
+     [backends.backend2.servers.server1]
+       url = "http://127.0.0.1:8082"
+     [backends.backend2.servers.server2]
+       url = "http://127.0.0.1:8083"
+  [frontends]
+   [frontends.frontend1]
+   backend = "backend1"
+     [frontends.frontend1.routes.test_1]
+     rule = "Path: /test1"
+   [frontends.frontend2]
+   backend = "backend2"
+   passHostHeader = true
+     [frontends.frontend2.routes.test_2]
+     rule = "Path: /test2"

integration/fixtures/acme/acme.toml

@@ -2,11 +2,9 @@ logLevel = "DEBUG"
 
 defaultEntryPoints = ["http", "https"]
 
-[api]
-
 [entryPoints]
   [entryPoints.http]
-  address = ":8081"
+  address = ":8080"
   [entryPoints.https]
   address = ":5001"
     [entryPoints.https.tls]
@@ -16,9 +14,9 @@ defaultEntryPoints = ["http", "https"]
 email = "test@traefik.io"
 storage = "/dev/null"
 entryPoint = "https"
-OnHostRule = true
-caServer = "http://{{.BoulderHost}}:4001/directory"
-# No challenge defined
+onDemand = {{.OnDemand}}
+OnHostRule = {{.OnHostRule}}
+caServer = "http://{{.BoulderHost}}:4000/directory"
 
 [file]
 

integration/fixtures/acme/acme_http01.toml

@@ -16,7 +16,7 @@ storage = "/dev/null"
 entryPoint = "https"
 onDemand = {{.OnDemand}}
 OnHostRule = {{.OnHostRule}}
-caServer = "http://{{.BoulderHost}}:4001/directory"
+caServer = "http://{{.BoulderHost}}:4000/directory"
   [acme.httpchallenge]
   entrypoint="http"
 

integration/fixtures/acme/acme_http01_web.toml

@@ -9,19 +9,20 @@ defaultEntryPoints = ["http", "https"]
   address = ":5001"
     [entryPoints.https.tls]
 
+
+[web]
+path="/traefik"
+
 [acme]
 email = "test@traefik.io"
 storage = "/dev/null"
 entryPoint = "https"
 onDemand = {{.OnDemand}}
 OnHostRule = {{.OnHostRule}}
-caServer = "http://{{.BoulderHost}}:4001/directory"
+caServer = "http://{{.BoulderHost}}:4000/directory"
   [acme.httpchallenge]
   entrypoint="http"
 
-[web]
-path="/traefik"
-
 [file]
 
 [backends]
@@ -29,8 +30,9 @@ path="/traefik"
     [backends.backend.servers.server1]
     url = "http://127.0.0.1:9010"
 
+
 [frontends]
   [frontends.frontend]
   backend = "backend"
     [frontends.frontend.routes.test]
-    rule = "Host:traefik.acme.wtf"
+    rule = "Host:traefik.acme.wtf"

integration/fixtures/acme/acme_provided.toml

@@ -4,7 +4,7 @@ defaultEntryPoints = ["http", "https"]
 
 [entryPoints]
   [entryPoints.http]
-  address = ":5002"
+  address = ":8080"
   [entryPoints.https]
   address = ":5001"
     [entryPoints.https.tls]
@@ -18,9 +18,7 @@ storage = "/dev/null"
 entryPoint = "https"
 onDemand = {{.OnDemand}}
 OnHostRule = {{.OnHostRule}}
-caServer = "http://{{.BoulderHost}}:4001/directory"
-[acme.httpChallenge]
-entryPoint="http"
+caServer = "http://{{.BoulderHost}}:4000/directory"
 
 [file]