/usr/bin/traefik

traefik    Traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
Complete documentation is available at https://traefik.io

Usage: traefik [command] [flags] [arguments]

Use "traefik [command] --help" for help on any command.

Commands:
    healthcheck    Calls Traefik /ping endpoint (disabled by default) to check the health of Traefik.
    version        Shows the current Traefik version.

Flag's usage: traefik [--flag=flag_argument] [-f [flag_argument]]    # set flag_argument to flag(s)
          or: traefik [--flag[=true|false| ]] [-f [true|false| ]]    # set true/false to boolean flag(s)

Flags:
    --accesslog  (Default: "false")
        Access log settings.

    --accesslog.bufferingsize  (Default: "0")
        Number of access log lines to process in a buffered way.

    --accesslog.fields.defaultmode  (Default: "keep")
        Default mode for fields: keep | drop

    --accesslog.fields.headers.defaultmode  (Default: "drop")
        Default mode for fields: keep | drop | redact

    --accesslog.fields.headers.names.<name>  (Default: "")
        Override mode for headers

    --accesslog.fields.names.<name>  (Default: "")
        Override mode for fields

    --accesslog.filepath  (Default: "")
        Access log file path. Stdout is used when omitted or empty.

    --accesslog.filters.minduration  (Default: "0")
        Keep access logs when request took longer than the specified duration.

    --accesslog.filters.retryattempts  (Default: "false")
        Keep access logs when at least one retry happened.

    --accesslog.filters.statuscodes  (Default: "")
        Keep access logs with status codes in the specified range.

    --accesslog.format  (Default: "common")
        Access log format: json | common

    --api  (Default: "false")
        Enable api/dashboard.

    --api.dashboard  (Default: "true")
        Activate dashboard.

    --api.debug  (Default: "false")
        Enable additional endpoints for debugging and profiling.

    --api.disabledashboardad  (Default: "false")
        Disable ad in the dashboard.

    --api.insecure  (Default: "false")
        Activate API directly on the entryPoint named traefik.

    --certificatesresolvers.<name>  (Default: "false")
        Certificates resolvers configuration.

    --certificatesresolvers.<name>.acme.caserver  (Default: "https://acme-v02.api.letsencrypt.org/directory")
        CA server to use.

    --certificatesresolvers.<name>.acme.certificatesduration  (Default: "2160")
        Certificates' duration in hours.

    --certificatesresolvers.<name>.acme.dnschallenge  (Default: "false")
        Activate DNS-01 Challenge.

    --certificatesresolvers.<name>.acme.dnschallenge.delaybeforecheck  (Default: "0")
        Assume DNS propagates after a delay in seconds rather than finding and querying
        nameservers.

    --certificatesresolvers.<name>.acme.dnschallenge.disablepropagationcheck  (Default: "false")
        Disable the DNS propagation checks before notifying ACME that the DNS challenge
        is ready. [not recommended]

    --certificatesresolvers.<name>.acme.dnschallenge.provider  (Default: "")
        Use a DNS-01 based challenge provider rather than HTTPS.

    --certificatesresolvers.<name>.acme.dnschallenge.resolvers  (Default: "")
        Use following DNS servers to resolve the FQDN authority.

    --certificatesresolvers.<name>.acme.eab.hmacencoded  (Default: "")
        Base64 encoded HMAC key from External CA.

    --certificatesresolvers.<name>.acme.eab.kid  (Default: "")
        Key identifier from External CA.

    --certificatesresolvers.<name>.acme.email  (Default: "")
        Email address used for registration.

    --certificatesresolvers.<name>.acme.httpchallenge  (Default: "false")
        Activate HTTP-01 Challenge.

    --certificatesresolvers.<name>.acme.httpchallenge.entrypoint  (Default: "")
        HTTP challenge EntryPoint

    --certificatesresolvers.<name>.acme.keytype  (Default: "RSA4096")
        KeyType used for generating certificate private key. Allow value 'EC256',
        'EC384', 'RSA2048', 'RSA4096', 'RSA8192'.

    --certificatesresolvers.<name>.acme.preferredchain  (Default: "")
        Preferred chain to use.

    --certificatesresolvers.<name>.acme.storage  (Default: "acme.json")
        Storage to use.

    --certificatesresolvers.<name>.acme.tlschallenge  (Default: "true")
        Activate TLS-ALPN-01 Challenge.

    --configfile  (Default: "")
        Configuration file to use. If specified all other flags are ignored.

    --core.stricttlsoptions  (Default: "false")
        Disables the unsafe fallback to the default TLS options for the routers with
        conflicting TLS options.

    --entrypoints.<name>  (Default: "false")
        Entry points definition.

    --entrypoints.<name>.address  (Default: "")
        Entry point address.

    --entrypoints.<name>.allowacmebypass  (Default: "false")
        Enables handling of ACME TLS and HTTP challenges with custom routers.

    --entrypoints.<name>.forwardedheaders.connection  (Default: "")
        List of Connection headers that are allowed to pass through the middleware chain
        before being removed.

    --entrypoints.<name>.forwardedheaders.insecure  (Default: "false")
        Trust all forwarded headers.

    --entrypoints.<name>.forwardedheaders.trustedips  (Default: "")
        Trust only forwarded headers from selected IPs.

    --entrypoints.<name>.http  (Default: "")
        HTTP configuration.

    --entrypoints.<name>.http.aliasheadersstrategy  (Default: "")
        Defines the strategy to handle the requests carrying a header whose name aliases
        another header name (keep, delete, and reject).

    --entrypoints.<name>.http.encodedcharacters.allowencodedbackslash  (Default: "true")
        Defines whether requests with encoded back slash characters in the path are
        allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodedhash  (Default: "true")
        Defines whether requests with encoded hash characters in the path are allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodednullcharacter  (Default: "true")
        Defines whether requests with encoded null characters in the path are allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodedpercent  (Default: "true")
        Defines whether requests with encoded percent characters in the path are
        allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodedquestionmark  (Default: "true")
        Defines whether requests with encoded question mark characters in the path are
        allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodedsemicolon  (Default: "true")
        Defines whether requests with encoded semicolon characters in the path are
        allowed.

    --entrypoints.<name>.http.encodedcharacters.allowencodedslash  (Default: "true")
        Defines whether requests with encoded slash characters in the path are allowed.

    --entrypoints.<name>.http.encodequerysemicolons  (Default: "false")
        Defines whether request query semicolons should be URLEncoded.

    --entrypoints.<name>.http.maxheaderbytes  (Default: "1048576")
        Maximum size of request headers in bytes.

    --entrypoints.<name>.http.maxheadervaluecount  (Default: "32768")
        Maximum number of request header values.

    --entrypoints.<name>.http.middlewares  (Default: "")
        Default middlewares for the routers linked to the entry point.

    --entrypoints.<name>.http.redirections.entrypoint.permanent  (Default: "true")
        Applies a permanent redirection.

    --entrypoints.<name>.http.redirections.entrypoint.priority  (Default: "9223372036854775806")
        Priority of the generated router.

    --entrypoints.<name>.http.redirections.entrypoint.scheme  (Default: "https")
        Scheme used for the redirection.

    --entrypoints.<name>.http.redirections.entrypoint.to  (Default: "")
        Targeted entry point of the redirection.

    --entrypoints.<name>.http.sanitizepath  (Default: "true")
        Defines whether to enable request path sanitization (removal of /./, /../ and
        multiple slash sequences).

    --entrypoints.<name>.http.tls  (Default: "false")
        Default TLS configuration for the routers linked to the entry point.

    --entrypoints.<name>.http.tls.certresolver  (Default: "")
        Default certificate resolver for the routers linked to the entry point.

    --entrypoints.<name>.http.tls.domains  (Default: "")
        Default TLS domains for the routers linked to the entry point.

    --entrypoints.<name>.http.tls.domains[n].main  (Default: "")
        Default subject name.

    --entrypoints.<name>.http.tls.domains[n].sans  (Default: "")
        Subject alternative names.

    --entrypoints.<name>.http.tls.options  (Default: "")
        Default TLS options for the routers linked to the entry point.

    --entrypoints.<name>.http.underscoreheadersstrategy  (Default: "")
        Defines the strategy to handle requests with headers with underscores (keep,
        delete, and reject). (Deprecated: please use aliasHeadersStrategy instead)

    --entrypoints.<name>.http2.maxconcurrentstreams  (Default: "250")
        Specifies the number of concurrent streams per connection that each client is
        allowed to initiate.

    --entrypoints.<name>.http3  (Default: "false")
        HTTP/3 configuration.

    --entrypoints.<name>.http3.advertisedport  (Default: "0")
        UDP port to advertise, on which HTTP/3 is available.

    --entrypoints.<name>.proxyprotocol  (Default: "false")
        Proxy-Protocol configuration.

    --entrypoints.<name>.proxyprotocol.insecure  (Default: "false")
        Trust all.

    --entrypoints.<name>.proxyprotocol.trustedips  (Default: "")
        Trust only selected IPs.

    --entrypoints.<name>.transport.keepalivemaxrequests  (Default: "0")
        Maximum number of requests before closing a keep-alive connection.

    --entrypoints.<name>.transport.keepalivemaxtime  (Default: "0")
        Maximum duration before closing a keep-alive connection.

    --entrypoints.<name>.transport.lifecycle.gracetimeout  (Default: "10")
        Duration to give active requests a chance to finish before Traefik stops.

    --entrypoints.<name>.transport.lifecycle.requestacceptgracetimeout  (Default: "0")
        Duration to keep accepting requests before Traefik initiates the graceful
        shutdown procedure.

    --entrypoints.<name>.transport.respondingtimeouts.idletimeout  (Default: "180")
        IdleTimeout is the maximum amount duration an idle (keep-alive) connection will
        remain idle before closing itself. If zero, no timeout is set.

    --entrypoints.<name>.transport.respondingtimeouts.readtimeout  (Default: "60")
        ReadTimeout is the maximum duration for reading the entire request, including
        the body. If zero, no timeout is set.

    --entrypoints.<name>.transport.respondingtimeouts.writetimeout  (Default: "0")
        WriteTimeout is the maximum duration before timing out writes of the response.
        If zero, no timeout is set.

    --entrypoints.<name>.udp.timeout  (Default: "3")
        Timeout defines how long to wait on an idle session before releasing the related
        resources.

    --experimental.http3  (Default: "false")
        Enable HTTP3.

    --experimental.kubernetesgateway  (Default: "false")
        Allow the Kubernetes gateway api provider usage.

    --experimental.localplugins.<name>  (Default: "false")
        Local plugins configuration.

    --experimental.localplugins.<name>.modulename  (Default: "")
        plugin's module name.

    --experimental.plugins.<name>  (Default: "false")
        Plugins configuration.

    --experimental.plugins.<name>.modulename  (Default: "")
        plugin's module name.

    --experimental.plugins.<name>.version  (Default: "")
        plugin's version.

    --global.checknewversion  (Default: "true")
        Periodically check if a new version has been released.

    --global.sendanonymoususage
        Periodically send anonymous usage statistics. If the option is not specified, it
        will be disabled by default.

    --hostresolver  (Default: "false")
        Enable CNAME Flattening.

    --hostresolver.cnameflattening  (Default: "false")
        A flag to enable/disable CNAME flattening

    --hostresolver.resolvconfig  (Default: "/etc/resolv.conf")
        resolv.conf used for DNS resolving

    --hostresolver.resolvdepth  (Default: "5")
        The maximal depth of DNS recursive resolving

    --log  (Default: "false")
        Traefik log settings.

    --log.filepath  (Default: "")
        Traefik log file path. Stdout is used when omitted or empty.

    --log.format  (Default: "common")
        Traefik log format: json | common

    --log.level  (Default: "ERROR")
        Log level set to traefik logs.

    --metrics.datadog  (Default: "false")
        Datadog metrics exporter type.

    --metrics.datadog.addentrypointslabels  (Default: "true")
        Enable metrics on entry points.

    --metrics.datadog.address  (Default: "localhost:8125")
        Datadog's address.

    --metrics.datadog.addrouterslabels  (Default: "false")
        Enable metrics on routers.

    --metrics.datadog.addserviceslabels  (Default: "true")
        Enable metrics on services.

    --metrics.datadog.prefix  (Default: "traefik")
        Prefix to use for metrics collection.

    --metrics.datadog.pushinterval  (Default: "10")
        Datadog push interval.

    --metrics.influxdb  (Default: "false")
        InfluxDB metrics exporter type.

    --metrics.influxdb.addentrypointslabels  (Default: "true")
        Enable metrics on entry points.

    --metrics.influxdb.additionallabels.<name>  (Default: "")
        Additional labels (influxdb tags) on all metrics

    --metrics.influxdb.address  (Default: "localhost:8089")
        InfluxDB address.

    --metrics.influxdb.addrouterslabels  (Default: "false")
        Enable metrics on routers.

    --metrics.influxdb.addserviceslabels  (Default: "true")
        Enable metrics on services.

    --metrics.influxdb.database  (Default: "")
        InfluxDB database used when protocol is http.

    --metrics.influxdb.password  (Default: "")
        InfluxDB password (only with http).

    --metrics.influxdb.protocol  (Default: "udp")
        InfluxDB address protocol (udp or http).

    --metrics.influxdb.pushinterval  (Default: "10")
        InfluxDB push interval.

    --metrics.influxdb.retentionpolicy  (Default: "")
        InfluxDB retention policy used when protocol is http.

    --metrics.influxdb.username  (Default: "")
        InfluxDB username (only with http).

    --metrics.influxdb2  (Default: "false")
        InfluxDB v2 metrics exporter type.

    --metrics.influxdb2.addentrypointslabels  (Default: "true")
        Enable metrics on entry points.

    --metrics.influxdb2.additionallabels.<name>  (Default: "")
        Additional labels (influxdb tags) on all metrics

    --metrics.influxdb2.address  (Default: "http://localhost:8086")
        InfluxDB v2 address.

    --metrics.influxdb2.addrouterslabels  (Default: "false")
        Enable metrics on routers.

    --metrics.influxdb2.addserviceslabels  (Default: "true")
        Enable metrics on services.

    --metrics.influxdb2.bucket  (Default: "")
        InfluxDB v2 bucket ID.

    --metrics.influxdb2.org  (Default: "")
        InfluxDB v2 org ID.

    --metrics.influxdb2.pushinterval  (Default: "10")
        InfluxDB v2 push interval.

    --metrics.influxdb2.token  (Default: "")
        InfluxDB v2 access token.

    --metrics.prometheus  (Default: "false")
        Prometheus metrics exporter type.

    --metrics.prometheus.addentrypointslabels  (Default: "true")
        Enable metrics on entry points.

    --metrics.prometheus.addrouterslabels  (Default: "false")
        Enable metrics on routers.

    --metrics.prometheus.addserviceslabels  (Default: "true")
        Enable metrics on services.

    --metrics.prometheus.buckets  (Default: "0.100000, 0.300000, 1.200000, 5.000000")
        Buckets for latency metrics.

    --metrics.prometheus.entrypoint  (Default: "traefik")
        EntryPoint

    --metrics.prometheus.headerlabels.<name>  (Default: "")
        Defines the extra labels for the requests_total metrics, and for each of them,
        the request header containing the value for this label.

    --metrics.prometheus.manualrouting  (Default: "false")
        Manual routing

    --metrics.statsd  (Default: "false")
        StatsD metrics exporter type.

    --metrics.statsd.addentrypointslabels  (Default: "true")
        Enable metrics on entry points.

    --metrics.statsd.address  (Default: "localhost:8125")
        StatsD address.

    --metrics.statsd.addrouterslabels  (Default: "false")
        Enable metrics on routers.

    --metrics.statsd.addserviceslabels  (Default: "true")
        Enable metrics on services.

    --metrics.statsd.prefix  (Default: "traefik")
        Prefix to use for metrics collection.

    --metrics.statsd.pushinterval  (Default: "10")
        StatsD push interval.

    --pilot.dashboard  (Default: "false")
        Enable Traefik Pilot in the dashboard. (Deprecated)

    --pilot.token  (Default: "")
        Traefik Pilot token. (Deprecated)

    --ping  (Default: "false")
        Enable ping.

    --ping.entrypoint  (Default: "traefik")
        EntryPoint

    --ping.manualrouting  (Default: "false")
        Manual routing

    --ping.terminatingstatuscode  (Default: "503")
        Terminating status code

    --providers.consul  (Default: "false")
        Enable Consul backend with default settings.

    --providers.consul.endpoints  (Default: "127.0.0.1:8500")
        KV store endpoints.

    --providers.consul.namespace  (Default: "")
        Sets the namespace used to discover the configuration (Consul Enterprise only).

    --providers.consul.namespaces  (Default: "")
        Sets the namespaces used to discover the configuration (Consul Enterprise only).

    --providers.consul.rootkey  (Default: "traefik")
        Root key used for KV store.

    --providers.consul.tls.ca  (Default: "")
        TLS CA

    --providers.consul.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.consul.tls.cert  (Default: "")
        TLS cert

    --providers.consul.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.consul.tls.key  (Default: "")
        TLS key

    --providers.consul.token  (Default: "")
        Per-request ACL token.

    --providers.consulcatalog  (Default: "false")
        Enable ConsulCatalog backend with default settings.

    --providers.consulcatalog.cache  (Default: "false")
        Use local agent caching for catalog reads.

    --providers.consulcatalog.connectaware  (Default: "false")
        Enable Consul Connect support.

    --providers.consulcatalog.connectbydefault  (Default: "false")
        Consider every service as Connect capable by default.

    --providers.consulcatalog.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the container's labels
        to determine whether to create any route for that container.

    --providers.consulcatalog.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.consulcatalog.endpoint.address  (Default: "")
        The address of the Consul server

    --providers.consulcatalog.endpoint.datacenter  (Default: "")
        Data center to use. If not provided, the default agent data center is used

    --providers.consulcatalog.endpoint.endpointwaittime  (Default: "0")
        WaitTime limits how long a Watch will block. If not provided, the agent default
        values will be used

    --providers.consulcatalog.endpoint.httpauth.password  (Default: "")
        Basic Auth password

    --providers.consulcatalog.endpoint.httpauth.username  (Default: "")
        Basic Auth username

    --providers.consulcatalog.endpoint.scheme  (Default: "")
        The URI scheme for the Consul server

    --providers.consulcatalog.endpoint.tls.ca  (Default: "")
        TLS CA

    --providers.consulcatalog.endpoint.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.consulcatalog.endpoint.tls.cert  (Default: "")
        TLS cert

    --providers.consulcatalog.endpoint.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.consulcatalog.endpoint.tls.key  (Default: "")
        TLS key

    --providers.consulcatalog.endpoint.token  (Default: "")
        Token is used to provide a per-request ACL token which overrides the agent's
        default token

    --providers.consulcatalog.exposedbydefault  (Default: "true")
        Expose containers by default.

    --providers.consulcatalog.namespace  (Default: "")
        Sets the namespace used to discover services (Consul Enterprise only).

    --providers.consulcatalog.namespaces  (Default: "")
        Sets the namespaces used to discover services (Consul Enterprise only).

    --providers.consulcatalog.prefix  (Default: "traefik")
        Prefix for consul service tags.

    --providers.consulcatalog.refreshinterval  (Default: "15")
        Interval for check Consul API.

    --providers.consulcatalog.requireconsistent  (Default: "false")
        Forces the read to be fully consistent.

    --providers.consulcatalog.servicename  (Default: "traefik")
        Name of the Traefik service in Consul Catalog (needs to be registered via the
        orchestrator or manually).

    --providers.consulcatalog.stale  (Default: "false")
        Use stale consistency for catalog reads.

    --providers.consulcatalog.watch  (Default: "false")
        Watch Consul API events.

    --providers.docker  (Default: "false")
        Enable Docker backend with default settings.

    --providers.docker.allowemptyservices  (Default: "false")
        Disregards the Docker containers health checks with respect to the creation or
        removal of the corresponding services.

    --providers.docker.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the container's labels
        to determine whether to create any route for that container.

    --providers.docker.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.docker.endpoint  (Default: "unix:///var/run/docker.sock")
        Docker server endpoint. Can be a tcp or a unix socket endpoint.

    --providers.docker.exposedbydefault  (Default: "true")
        Expose containers by default.

    --providers.docker.httpclienttimeout  (Default: "0")
        Client timeout for HTTP connections.

    --providers.docker.network  (Default: "")
        Default Docker network used.

    --providers.docker.swarmmode  (Default: "false")
        Use Docker on Swarm Mode.

    --providers.docker.swarmmoderefreshseconds  (Default: "15")
        Polling interval for swarm mode.

    --providers.docker.tls.ca  (Default: "")
        TLS CA

    --providers.docker.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.docker.tls.cert  (Default: "")
        TLS cert

    --providers.docker.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.docker.tls.key  (Default: "")
        TLS key

    --providers.docker.usebindportip  (Default: "false")
        Use the ip address from the bound port, rather than from the inner network.

    --providers.docker.watch  (Default: "true")
        Watch Docker events.

    --providers.ecs  (Default: "false")
        Enable AWS ECS backend with default settings.

    --providers.ecs.accesskeyid  (Default: "")
        The AWS credentials access key to use for making requests

    --providers.ecs.autodiscoverclusters  (Default: "false")
        Auto discover cluster

    --providers.ecs.clusters  (Default: "default")
        ECS Clusters name

    --providers.ecs.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the container's labels
        to determine whether to create any route for that container.

    --providers.ecs.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.ecs.ecsanywhere  (Default: "false")
        Enable ECS Anywhere support

    --providers.ecs.exposedbydefault  (Default: "true")
        Expose services by default

    --providers.ecs.refreshseconds  (Default: "15")
        Polling interval (in seconds)

    --providers.ecs.region  (Default: "")
        The AWS region to use for requests

    --providers.ecs.secretaccesskey  (Default: "")
        The AWS credentials access key to use for making requests

    --providers.etcd  (Default: "false")
        Enable Etcd backend with default settings.

    --providers.etcd.endpoints  (Default: "127.0.0.1:2379")
        KV store endpoints.

    --providers.etcd.password  (Default: "")
        Password for authentication.

    --providers.etcd.rootkey  (Default: "traefik")
        Root key used for KV store.

    --providers.etcd.tls.ca  (Default: "")
        TLS CA

    --providers.etcd.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.etcd.tls.cert  (Default: "")
        TLS cert

    --providers.etcd.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.etcd.tls.key  (Default: "")
        TLS key

    --providers.etcd.username  (Default: "")
        Username for authentication.

    --providers.file.debugloggeneratedtemplate  (Default: "false")
        Enable debug logging of generated configuration template.

    --providers.file.directory  (Default: "")
        Load dynamic configuration from one or more .yml or .toml files in a directory.

    --providers.file.filename  (Default: "")
        Load dynamic configuration from a file.

    --providers.file.watch  (Default: "true")
        Watch provider.

    --providers.http  (Default: "false")
        Enable HTTP backend with default settings.

    --providers.http.endpoint  (Default: "")
        Load configuration from this endpoint.

    --providers.http.maxresponsebodysize  (Default: "-1")
        Defines the maximum size of the response body in bytes.

    --providers.http.pollinterval  (Default: "5")
        Polling interval for endpoint.

    --providers.http.polltimeout  (Default: "5")
        Polling timeout for endpoint.

    --providers.http.tls.ca  (Default: "")
        TLS CA

    --providers.http.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.http.tls.cert  (Default: "")
        TLS cert

    --providers.http.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.http.tls.key  (Default: "")
        TLS key

    --providers.kubernetescrd  (Default: "false")
        Enable Kubernetes backend with default settings.

    --providers.kubernetescrd.allowcrossnamespace  (Default: "false")
        Allow cross namespace resource reference.

    --providers.kubernetescrd.allowemptyservices  (Default: "false")
        Allow the creation of services without endpoints.

    --providers.kubernetescrd.allowexternalnameservices  (Default: "false")
        Allow ExternalName services.

    --providers.kubernetescrd.certauthfilepath  (Default: "")
        Kubernetes certificate authority file path (not needed for in-cluster client).

    --providers.kubernetescrd.crossprovidernamespaces  (Default: "")
        List of namespaces from which IngressRoute, IngressRouteTCP, IngressRouteUDP,
        and TraefikService are allowed to declare cross-provider references.

    --providers.kubernetescrd.defaulttlsresourcesnamespace  (Default: "")
        Namespace allowed to define the default TLSOption and TLSStore resources. When
        empty, they can be defined in any namespace.

    --providers.kubernetescrd.endpoint  (Default: "")
        Kubernetes server endpoint (required for external cluster client).

    --providers.kubernetescrd.ingressclass  (Default: "")
        Value of kubernetes.io/ingress.class annotation to watch for.

    --providers.kubernetescrd.labelselector  (Default: "")
        Kubernetes label selector to use.

    --providers.kubernetescrd.namespaces  (Default: "")
        Kubernetes namespaces.

    --providers.kubernetescrd.safenaming  (Default: "false")
        Enable collision-safe naming for the Kubernetes CRD provider.

    --providers.kubernetescrd.throttleduration  (Default: "0")
        Ingress refresh throttle duration

    --providers.kubernetescrd.token  (Default: "")
        Kubernetes bearer token (not needed for in-cluster client).

    --providers.kubernetesgateway  (Default: "false")
        Enable Kubernetes gateway api provider with default settings.

    --providers.kubernetesgateway.certauthfilepath  (Default: "")
        Kubernetes certificate authority file path (not needed for in-cluster client).

    --providers.kubernetesgateway.crossprovidernamespaces  (Default: "")
        List of namespaces from which Gateway API routes are allowed to declare
        TraefikService backendRef references.

    --providers.kubernetesgateway.endpoint  (Default: "")
        Kubernetes server endpoint (required for external cluster client).

    --providers.kubernetesgateway.labelselector  (Default: "")
        Kubernetes label selector to select specific GatewayClasses.

    --providers.kubernetesgateway.namespaces  (Default: "")
        Kubernetes namespaces.

    --providers.kubernetesgateway.throttleduration  (Default: "0")
        Kubernetes refresh throttle duration

    --providers.kubernetesgateway.token  (Default: "")
        Kubernetes bearer token (not needed for in-cluster client).

    --providers.kubernetesingress  (Default: "false")
        Enable Kubernetes backend with default settings.

    --providers.kubernetesingress.allowemptyservices  (Default: "false")
        Allow creation of services without endpoints.

    --providers.kubernetesingress.allowexternalnameservices  (Default: "false")
        Allow ExternalName services.

    --providers.kubernetesingress.certauthfilepath  (Default: "")
        Kubernetes certificate authority file path (not needed for in-cluster client).

    --providers.kubernetesingress.crossprovidernamespaces  (Default: "")
        List of namespaces from which Ingresses or Services are allowed to declare
        Middlewares, TLSOptions, or ServersTransport references.

    --providers.kubernetesingress.endpoint  (Default: "")
        Kubernetes server endpoint (required for external cluster client).

    --providers.kubernetesingress.ingressclass  (Default: "")
        Value of kubernetes.io/ingress.class annotation or IngressClass name to watch
        for.

    --providers.kubernetesingress.ingressendpoint.hostname  (Default: "")
        Hostname used for Kubernetes Ingress endpoints.

    --providers.kubernetesingress.ingressendpoint.ip  (Default: "")
        IP used for Kubernetes Ingress endpoints.

    --providers.kubernetesingress.ingressendpoint.publishedservice  (Default: "")
        Published Kubernetes Service to copy status from.

    --providers.kubernetesingress.labelselector  (Default: "")
        Kubernetes Ingress label selector to use.

    --providers.kubernetesingress.namespaces  (Default: "")
        Kubernetes namespaces.

    --providers.kubernetesingress.throttleduration  (Default: "0")
        Ingress refresh throttle duration

    --providers.kubernetesingress.token  (Default: "")
        Kubernetes bearer token (not needed for in-cluster client).

    --providers.marathon  (Default: "false")
        Enable Marathon backend with default settings.

    --providers.marathon.basic.httpbasicauthuser  (Default: "")
        Basic authentication User.

    --providers.marathon.basic.httpbasicpassword  (Default: "")
        Basic authentication Password.

    --providers.marathon.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the application's
        labels to determine whether to create any route for that application.

    --providers.marathon.dcostoken  (Default: "")
        DCOSToken for DCOS environment, This will override the Authorization header.

    --providers.marathon.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.marathon.dialertimeout  (Default: "5")
        Set a dialer timeout for Marathon.

    --providers.marathon.endpoint  (Default: "http://127.0.0.1:8080")
        Marathon server endpoint. You can also specify multiple endpoint for Marathon.

    --providers.marathon.exposedbydefault  (Default: "true")
        Expose Marathon apps by default.

    --providers.marathon.forcetaskhostname  (Default: "false")
        Force to use the task's hostname.

    --providers.marathon.keepalive  (Default: "10")
        Set a TCP Keep Alive time.

    --providers.marathon.respectreadinesschecks  (Default: "false")
        Filter out tasks with non-successful readiness checks during deployments.

    --providers.marathon.responseheadertimeout  (Default: "60")
        Set a response header timeout for Marathon.

    --providers.marathon.tls.ca  (Default: "")
        TLS CA

    --providers.marathon.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.marathon.tls.cert  (Default: "")
        TLS cert

    --providers.marathon.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.marathon.tls.key  (Default: "")
        TLS key

    --providers.marathon.tlshandshaketimeout  (Default: "5")
        Set a TLS handshake timeout for Marathon.

    --providers.marathon.trace  (Default: "false")
        Display additional provider logs.

    --providers.marathon.watch  (Default: "true")
        Watch provider.

    --providers.nomad  (Default: "false")
        Enable Nomad backend with default settings.

    --providers.nomad.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the Nomad service's
        tags to determine whether to create route(s) for that service.

    --providers.nomad.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.nomad.endpoint.address  (Default: "http://127.0.0.1:4646")
        The address of the Nomad server, including scheme and port.

    --providers.nomad.endpoint.endpointwaittime  (Default: "0")
        WaitTime limits how long a Watch will block. If not provided, the agent default
        values will be used

    --providers.nomad.endpoint.region  (Default: "")
        Nomad region to use. If not provided, the local agent region is used.

    --providers.nomad.endpoint.tls.ca  (Default: "")
        TLS CA

    --providers.nomad.endpoint.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.nomad.endpoint.tls.cert  (Default: "")
        TLS cert

    --providers.nomad.endpoint.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.nomad.endpoint.tls.key  (Default: "")
        TLS key

    --providers.nomad.endpoint.token  (Default: "")
        Token is used to provide a per-request ACL token.

    --providers.nomad.exposedbydefault  (Default: "true")
        Expose Nomad services by default.

    --providers.nomad.namespace  (Default: "")
        Sets the Nomad namespace used to discover services.

    --providers.nomad.namespaces  (Default: "")
        Sets the Nomad namespaces used to discover services.

    --providers.nomad.prefix  (Default: "traefik")
        Prefix for nomad service tags.

    --providers.nomad.refreshinterval  (Default: "15")
        Interval for polling Nomad API.

    --providers.nomad.stale  (Default: "false")
        Use stale consistency for catalog reads.

    --providers.plugin.<name>  (Default: "")
        Plugins configuration.

    --providers.providersthrottleduration  (Default: "2")
        Backends throttle duration: minimum duration between 2 events from providers
        before applying a new configuration. It avoids unnecessary reloads if multiples
        events are sent in a short amount of time.

    --providers.rancher  (Default: "false")
        Enable Rancher backend with default settings.

    --providers.rancher.constraints  (Default: "")
        Constraints is an expression that Traefik matches against the container's labels
        to determine whether to create any route for that container.

    --providers.rancher.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
        Default rule.

    --providers.rancher.enableservicehealthfilter  (Default: "true")
        Filter services with unhealthy states and inactive states.

    --providers.rancher.exposedbydefault  (Default: "true")
        Expose containers by default.

    --providers.rancher.intervalpoll  (Default: "false")
        Poll the Rancher metadata service every 'rancher.refreshseconds' (less
        accurate).

    --providers.rancher.prefix  (Default: "latest")
        Prefix used for accessing the Rancher metadata service.

    --providers.rancher.refreshseconds  (Default: "15")
        Defines the polling interval in seconds.

    --providers.rancher.watch  (Default: "true")
        Watch provider.

    --providers.redis  (Default: "false")
        Enable Redis backend with default settings.

    --providers.redis.db  (Default: "0")
        Database to be selected after connecting to the server.

    --providers.redis.endpoints  (Default: "127.0.0.1:6379")
        KV store endpoints.

    --providers.redis.password  (Default: "")
        Password for authentication.

    --providers.redis.rootkey  (Default: "traefik")
        Root key used for KV store.

    --providers.redis.sentinel.latencystrategy  (Default: "false")
        Defines whether to route commands to the closest master or replica nodes
        (mutually exclusive with RandomStrategy and ReplicaStrategy).

    --providers.redis.sentinel.mastername  (Default: "")
        Name of the master.

    --providers.redis.sentinel.password  (Default: "")
        Password for Sentinel authentication.

    --providers.redis.sentinel.randomstrategy  (Default: "false")
        Defines whether to route commands randomly to master or replica nodes (mutually
        exclusive with LatencyStrategy and ReplicaStrategy).

    --providers.redis.sentinel.replicastrategy  (Default: "false")
        Defines whether to route all commands to replica nodes (mutually exclusive with
        LatencyStrategy and RandomStrategy).

    --providers.redis.sentinel.usedisconnectedreplicas  (Default: "false")
        Use replicas disconnected with master when cannot get connected replicas.

    --providers.redis.sentinel.username  (Default: "")
        Username for Sentinel authentication.

    --providers.redis.tls.ca  (Default: "")
        TLS CA

    --providers.redis.tls.caoptional  (Default: "false")
        TLS CA.Optional

    --providers.redis.tls.cert  (Default: "")
        TLS cert

    --providers.redis.tls.insecureskipverify  (Default: "false")
        TLS insecure skip verify

    --providers.redis.tls.key  (Default: "")
        TLS key

    --providers.redis.username  (Default: "")
        Username for authentication.

    --providers.rest  (Default: "false")
        Enable Rest backend with default settings.

    --providers.rest.insecure  (Default: "false")
        Activate REST Provider directly on the entryPoint named traefik.

    --providers.zookeeper  (Default: "false")
        Enable ZooKeeper backend with default settings.

    --providers.zookeeper.endpoints  (Default: "127.0.0.1:2181")
        KV store endpoints.

    --providers.zookeeper.password  (Default: "")
        Password for authentication.

    --providers.zookeeper.rootkey  (Default: "traefik")
        Root key used for KV store.

    --providers.zookeeper.username  (Default: "")
        Username for authentication.

    --serverstransport.forwardingtimeouts.dialtimeout  (Default: "30")
        The amount of time to wait until a connection to a backend server can be
        established. If zero, no timeout exists.

    --serverstransport.forwardingtimeouts.idleconntimeout  (Default: "90")
        The maximum period for which an idle HTTP keep-alive connection will remain open
        before closing itself

    --serverstransport.forwardingtimeouts.responseheadertimeout  (Default: "0")
        The amount of time to wait for a server's response headers after fully writing
        the request (including its body, if any). If zero, no timeout exists.

    --serverstransport.insecureskipverify  (Default: "false")
        Disable SSL certificate verification.

    --serverstransport.maxidleconnsperhost  (Default: "200")
        If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero,
        DefaultMaxIdleConnsPerHost is used

    --serverstransport.rootcas  (Default: "")
        Add cert file for self-signed certificate.

    --tracing  (Default: "false")
        OpenTracing configuration.

    --tracing.datadog  (Default: "false")
        Settings for Datadog.

    --tracing.datadog.bagageprefixheadername  (Default: "")
        Sets the header name prefix used to store baggage items in a map.

    --tracing.datadog.debug  (Default: "false")
        Enables Datadog debug.

    --tracing.datadog.globaltag  (Default: "")
        Sets a key:value tag on all spans.

    --tracing.datadog.globaltags.<name>  (Default: "")
        Sets a list of key:value tags on all spans.

    --tracing.datadog.localagenthostport  (Default: "localhost:8126")
        Sets the Datadog Agent host:port.

    --tracing.datadog.localagentsocket  (Default: "")
        Sets the socket for the Datadog Agent.

    --tracing.datadog.parentidheadername  (Default: "")
        Sets the header name used to store the parent ID.

    --tracing.datadog.prioritysampling  (Default: "false")
        Enables priority sampling. When using distributed tracing, this option must be
        enabled in order to get all the parts of a distributed trace sampled.

    --tracing.datadog.samplingpriorityheadername  (Default: "")
        Sets the header name used to store the sampling priority.

    --tracing.datadog.traceidheadername  (Default: "")
        Sets the header name used to store the trace ID.

    --tracing.elastic  (Default: "false")
        Settings for Elastic.

    --tracing.elastic.secrettoken  (Default: "")
        Sets the token used to connect to Elastic APM Server.

    --tracing.elastic.serverurl  (Default: "")
        Sets the URL of the Elastic APM server.

    --tracing.elastic.serviceenvironment  (Default: "")
        Sets the name of the environment Traefik is deployed in, e.g. 'production' or
        'staging'.

    --tracing.haystack  (Default: "false")
        Settings for Haystack.

    --tracing.haystack.baggageprefixheadername  (Default: "")
        Sets the header name prefix used to store baggage items in a map.

    --tracing.haystack.globaltag  (Default: "")
        Sets a key:value tag on all spans.

    --tracing.haystack.localagenthost  (Default: "127.0.0.1")
        Sets the Haystack Agent host.

    --tracing.haystack.localagentport  (Default: "35000")
        Sets the Haystack Agent port.

    --tracing.haystack.parentidheadername  (Default: "")
        Sets the header name used to store the parent ID.

    --tracing.haystack.spanidheadername  (Default: "")
        Sets the header name used to store the span ID.

    --tracing.haystack.traceidheadername  (Default: "")
        Sets the header name used to store the trace ID.

    --tracing.instana  (Default: "false")
        Settings for Instana.

    --tracing.instana.enableautoprofile  (Default: "false")
        Enables automatic profiling for the Traefik process.

    --tracing.instana.localagenthost  (Default: "")
        Sets the Instana Agent host.

    --tracing.instana.localagentport  (Default: "42699")
        Sets the Instana Agent port.

    --tracing.instana.loglevel  (Default: "info")
        Sets the log level for the Instana tracer. ('error','warn','info','debug')

    --tracing.jaeger  (Default: "false")
        Settings for Jaeger.

    --tracing.jaeger.collector.endpoint  (Default: "")
        Instructs reporter to send spans to jaeger-collector at this URL.

    --tracing.jaeger.collector.password  (Default: "")
        Password for basic http authentication when sending spans to jaeger-collector.

    --tracing.jaeger.collector.user  (Default: "")
        User for basic http authentication when sending spans to jaeger-collector.

    --tracing.jaeger.disableattemptreconnecting  (Default: "true")
        Disables the periodic re-resolution of the agent's hostname and reconnection if
        there was a change.

    --tracing.jaeger.gen128bit  (Default: "false")
        Generates 128 bits span IDs.

    --tracing.jaeger.localagenthostport  (Default: "127.0.0.1:6831")
        Sets the Jaeger Agent host:port.

    --tracing.jaeger.propagation  (Default: "jaeger")
        Sets the propagation format (jaeger/b3).

    --tracing.jaeger.samplingparam  (Default: "1.000000")
        Sets the sampling parameter.

    --tracing.jaeger.samplingserverurl  (Default: "http://localhost:5778/sampling")
        Sets the sampling server URL.

    --tracing.jaeger.samplingtype  (Default: "const")
        Sets the sampling type.

    --tracing.jaeger.tracecontextheadername  (Default: "uber-trace-id")
        Sets the header name used to store the trace ID.

    --tracing.servicename  (Default: "traefik")
        Set the name for this service.

    --tracing.spannamelimit  (Default: "0")
        Set the maximum character limit for Span names (default 0 = no limit).

    --tracing.zipkin  (Default: "false")
        Settings for Zipkin.

    --tracing.zipkin.httpendpoint  (Default: "http://localhost:9411/api/v2/spans")
        Sets the HTTP Endpoint to report traces to.

    --tracing.zipkin.id128bit  (Default: "true")
        Uses 128 bits root span IDs.

    --tracing.zipkin.samespan  (Default: "false")
        Uses SameSpan RPC style traces.

    --tracing.zipkin.samplerate  (Default: "1.000000")
        Sets the rate between 0.0 and 1.0 of requests to trace.