Prepare release v2.0.0-alpha3.

Co-authored-by: Jean-Baptiste Doumenjou <jb.doumenjou@gmail.com>

.dockerignore

@@ -1,3 +1,3 @@
 dist/
-vendor/
 !dist/traefik
+site/

.gitattributes

@@ -0,0 +1 @@
+# vendor/github.com/go-acme/lego/providers/dns/cloudxns/cloudxns.go eol=crlf

.github/CODEOWNERS

@@ -0,0 +1,24 @@
+provider/kubernetes/**  @containous/kubernetes
+provider/rancher/**     @containous/rancher
+provider/marathon/**    @containous/marathon
+provider/docker/**      @containous/docker
+
+docs/user-guide/kubernetes.md       @containous/kubernetes
+docs/user-guide/marathon.md         @containous/marathon
+docs/user-guide/swarm.md            @containous/docker
+docs/user-guide/swarm-mode.md       @containous/docker
+
+docs/configuration/backends/docker.md       @containous/docker
+docs/configuration/backends/kubernetes.md   @containous/kubernetes
+docs/configuration/backends/marathon.md     @containous/marathon
+docs/configuration/backends/rancher.md      @containous/rancher
+
+examples/k8s/                   @containous/kubernetes
+examples/compose-k8s.yaml       @containous/kubernetes
+examples/k8s.namespace.yaml     @containous/kubernetes
+examples/compose-rancher.yml    @containous/rancher
+examples/compose-marathon.yml   @containous/marathon
+
+vendor/github.com/gambol99/go-marathon  @containous/marathon
+vendor/github.com/rancher               @containous/rancher
+vendor/k8s.io/                          @containous/kubernetes

.github/CONTRIBUTING.md

@@ -1,78 +0,0 @@
-# Contributing
-
-### Building
-
-You need either [Docker](https://github.com/docker/docker) and `make`, or `go` and `glide` in order to build traefik.
-
-#### Setting up your `go` environment
-
-- You need `go` v1.5
-- You need to set `export GO15VENDOREXPERIMENT=1` environment variable
-- You need `go-bindata` to be able to use `go generate` command (needed to build) : `go get github.com/jteeuwen/go-bindata/...`.
-- If you clone Træfɪk into something like `~/go/src/github.com/traefik`, your `GOPATH` variable will have to be set to `~/go`: export `GOPATH=~/go`.
-
-#### Using `Docker` and `Makefile`
-
-You need to run the `binary` target. This will create binaries for Linux platform in the `dist` folder.
-
-```bash
-$ make binary
-docker build -t "traefik-dev:no-more-godep-ever" -f build.Dockerfile .
-Sending build context to Docker daemon 295.3 MB
-Step 0 : FROM golang:1.5
- ---> 8c6473912976
-Step 1 : RUN go get github.com/Masterminds/glide
-[...]
-docker run --rm  -v "/var/run/docker.sock:/var/run/docker.sock" -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/emile/dev/go/src/github.com/containous/traefik/"dist":/go/src/github.com/containous/traefik/"dist"" "traefik-dev:no-more-godep-ever" ./script/make.sh generate binary
----> Making bundle: generate (in .)
-removed 'gen.go'
-
----> Making bundle: binary (in .)
-
-$ ls dist/
-traefik*
-```
-
-#### Using `glide`
-
-The idea behind `glide` is the following :
-
-- when checkout(ing) a project, **run `glide install`** to install
-  (`go get …`) the dependencies in the `GOPATH`.
-- if you need another dependency, import and use it in
-  the source, and **run `glide get github.com/Masterminds/cookoo`** to save it in
-  `vendor` and add it to your `glide.yaml`.
-
-```bash
-$ glide install
-# generate
-$ go generate
-# Simple go build
-$ go build
-# Using gox to build multiple platform
-$ gox "linux darwin" "386 amd64 arm" \
-    -output="dist/traefik_{{.OS}}-{{.Arch}}"
-# run other commands like tests
-$ go test ./...
-ok      _/home/vincent/src/github/vdemeester/traefik    0.004s
-```
-
-### Tests
-
-You can run unit tests using the `test-unit` target and the
-integration test using the `test-integration` target.
-
-```bash
-$ make test-unit
-docker build -t "traefik-dev:your-feature-branch" -f build.Dockerfile .
-# […]
-docker run --rm -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/vincent/src/github/vdemeester/traefik/dist:/go/src/github.com/containous/traefik/dist" "traefik-dev:your-feature-branch" ./script/make.sh generate test-unit
----> Making bundle: generate (in .)
-removed 'gen.go'
-
----> Making bundle: test-unit (in .)
-+ go test -cover -coverprofile=cover.out .
-ok      github.com/containous/traefik   0.005s  coverage: 4.1% of statements
-
-Test success
-```

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,83 @@
+<!--
+DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
+
+The issue tracker is for reporting bugs and feature requests only.
+For end-user related support questions, please refer to one of the following:
+
+- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
+- the Traefik community Slack channel: https://slack.traefik.io
+
+-->
+
+
+### Do you want to request a *feature* or report a *bug*?
+
+<!--
+If you intend to ask a support question: DO NOT FILE AN ISSUE.
+-->
+
+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
+### What did you do?
+
+<!--
+
+HOW TO WRITE A GOOD ISSUE?
+
+- Respect the issue template as much as possible.
+- The title should be short and descriptive.
+- Explain the conditions which led you to report this issue: the context.
+- The context should lead to something, an idea or a problem that you’re facing.
+- Remain clear and concise.
+- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
+
+-->
+
+### What did you expect to see?
+
+
+
+### What did you see instead?
+
+
+
+### Output of `traefik version`: (_What version of Traefik are you using?_)
+
+<!--
+For the Traefik Docker image:
+    docker run [IMAGE] version
+    ex: docker run traefik version
+
+For the alpine Traefik Docker image:
+    docker run [IMAGE] traefik version
+    ex: docker run traefik traefik version
+-->
+
+```
+(paste your output here)
+```
+
+### What is your environment & configuration (arguments, toml, provider, platform, ...)?
+
+```toml
+# (paste your configuration here)
+```
+<!--
+Add more configuration information here.
+-->
+
+
+### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)
+
+```
+(paste your output here)
+```

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -0,0 +1,88 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
+
+<!--
+DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
+
+The issue tracker is for reporting bugs and feature requests only.
+For end-user related support questions, please refer to one of the following:
+
+- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
+- the Traefik community Slack channel: https://slack.traefik.io
+
+-->
+
+
+### Do you want to request a *feature* or report a *bug*?
+
+Bug
+
+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
+### What did you do?
+
+<!--
+
+HOW TO WRITE A GOOD BUG REPORT?
+
+- Respect the issue template as much as possible.
+- The title should be short and descriptive.
+- Explain the conditions which led you to report this issue: the context.
+- The context should lead to something, an idea or a problem that you’re facing.
+- Remain clear and concise.
+- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
+
+-->
+
+### What did you expect to see?
+
+
+
+### What did you see instead?
+
+
+
+### Output of `traefik version`: (_What version of Traefik are you using?_)
+
+<!--
+For the Traefik Docker image:
+    docker run [IMAGE] version
+    ex: docker run traefik version
+
+For the alpine Traefik Docker image:
+    docker run [IMAGE] traefik version
+    ex: docker run traefik traefik version
+-->
+
+```
+(paste your output here)
+```
+
+### What is your environment & configuration (arguments, toml, provider, platform, ...)?
+
+```toml
+# (paste your configuration here)
+```
+
+<!--
+Add more configuration information here.
+-->
+
+
+### If applicable, please paste the log output in DEBUG level (`--logLevel=DEBUG` switch)
+
+```
+(paste your output here)
+```

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -0,0 +1,36 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+
+---
+
+<!--
+DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
+
+The issue tracker is for reporting bugs and feature requests only.
+For end-user related support questions, please refer to one of the following:
+
+- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
+- the Traefik community Slack channel: https://slack.traefik.io
+
+-->
+
+
+### Do you want to request a *feature* or report a *bug*?
+
+Feature
+
+### What did you expect to see?
+
+<!--
+
+HOW TO WRITE A GOOD ISSUE?
+
+- Respect the issue template as much as possible.
+- The title should be short and descriptive.
+- Explain the conditions which led you to report this issue: the context.
+- The context should lead to something, an idea or a problem that you’re facing.
+- Remain clear and concise.
+- Format your messages to help the reader focus on what matters and understand the structure of your message, use Markdown syntax https://help.github.com/articles/github-flavored-markdown
+
+-->

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+<!--
+PLEASE READ THIS MESSAGE.
+
+HOW TO WRITE A GOOD PULL REQUEST?
+
+- Make it small.
+- Do only one thing.
+- Avoid re-formatting.
+- Make sure the code builds.
+- Make sure all tests pass.
+- Add tests.
+- Write useful descriptions and titles.
+- Address review comments in terms of additional commits.
+- Do not amend/squash existing ones unless the PR is trivial.
+- Read the contributing guide: https://github.com/containous/traefik/blob/master/CONTRIBUTING.md.
+
+-->
+
+### What does this PR do?
+
+<!-- A brief description of the change being made with this pull request. -->
+
+
+### Motivation
+
+<!-- What inspired you to submit this pull request? -->
+
+
+### More
+
+- [ ] Added/updated tests
+- [ ] Added/updated documentation
+
+### Additional Notes
+
+<!-- Anything else we should know when reviewing? -->

.github/PULL_REQUEST_TEMPLATE/mergeback.md

@@ -0,0 +1,7 @@
+### What does this PR do?
+
+Merge v{{.Version}} into master
+
+### Motivation
+
+Be sync.

.github/PULL_REQUEST_TEMPLATE/release.md

@@ -0,0 +1,7 @@
+### What does this PR do?
+
+Prepare release v{{.Version}}.
+
+### Motivation
+
+Create a new release.

.gitignore

@@ -1,12 +1,16 @@
-/dist
-gen.go
-.idea
-.intellij
-log
+.idea/
+.intellij/
 *.iml
-traefik
-traefik.toml
-*.test
-vendor/
-static/
-.vscode/
+.vscode/
+.DS_Store
+/dist
+/webui/.tmp/
+/site/
+/docs/site/
+/static/
+/autogen/
+/traefik
+/traefik.toml
+*.log
+*.exe
+cover.out

.golangci.toml

@@ -0,0 +1,90 @@
+[run]
+  deadline = "10m"
+  skip-files = [
+    "^old/.*",
+  ]
+
+[linters-settings]
+
+  [linters-settings.govet]
+    check-shadowing = false
+
+  [linters-settings.golint]
+    min-confidence = 0.0
+
+  [linters-settings.gocyclo]
+    min-complexity = 14.0
+
+  [linters-settings.maligned]
+    suggest-new = true
+
+  [linters-settings.goconst]
+    min-len = 3.0
+    min-occurrences = 4.0
+
+  [linters-settings.misspell]
+    locale = "US"
+
+[linters]
+  enable-all = true
+  disable = [
+    "gocyclo", # FIXME must be fixed
+    "gosec",
+    "dupl",
+    "maligned",
+    "lll",
+    "unparam",
+    "prealloc",
+    "scopelint",
+    "gochecknoinits",
+    "gochecknoglobals",
+  ]
+
+[issues]
+  exclude-use-default = false
+  max-per-linter = 0
+  max-same-issues = 0
+  exclude = [
+    "SA1019: http.CloseNotifier is deprecated: the CloseNotifier interface predates Go's context package. New code should use Request.Context instead.", # FIXME must be fixed
+    "Error return value of .((os\\.)?std(out|err)\\..*|.*Close|.*Flush|os\\.Remove(All)?|.*printf?|os\\.(Un)?Setenv). is not checked",
+    "should have a package comment, unless it's in another file for this package",
+  ]
+ [[issues.exclude-rules]]
+    path = ".+_test.go"
+    linters = ["goconst"]
+ [[issues.exclude-rules]]
+    path = "provider/label/internal/.+_test.go"
+    text = "U1000: field `(foo|fuu)` is unused"
+ [[issues.exclude-rules]]
+    path = "middlewares/recovery/recovery.go"
+    text = "`logger` can be `github.com/containous/traefik/vendor/github.com/stretchr/testify/assert.TestingT`"
+ [[issues.exclude-rules]]
+    path = "integration/.+_test.go"
+    text = "Error return value of `cmd\\.Process\\.Kill` is not checked"
+ [[issues.exclude-rules]]
+    path = "integration/(consul_catalog_test|constraint_test).go"
+    text = "Error return value of `(s.deregisterService|s.deregisterAgentService)` is not checked"
+ [[issues.exclude-rules]]
+    path = "integration/grpc_test.go"
+    text = "Error return value of `closer` is not checked"
+ [[issues.exclude-rules]]
+    path = "provider/kubernetes/builder_(endpoint|service)_test.go"
+    text = "(U1000: func )?`(.+)` is unused"
+ [[issues.exclude-rules]]
+    path = "provider/docker/builder_test.go"
+    text = "(U1000: func )?`(.+)` is unused"
+ [[issues.exclude-rules]]
+    path = "cmd/configuration.go"
+    text = "string `traefik` has (\\d) occurrences, make it a constant"
+ [[issues.exclude-rules]]
+    path = "h2c/h2c.go"
+    text = "Error return value of `rw.Write` is not checked"
+ [[issues.exclude-rules]]
+    path = "server/service/bufferpool.go"
+    text = "SA6002: argument should be pointer-like to avoid allocations"
+ [[issues.exclude-rules]] # FIXME must be fixed
+    path = "acme/.+.go"
+    text = "(assignment copies lock value to domainsCerts|literal copies lock value from)"
+ [[issues.exclude-rules]] # FIXME must be fixed
+    path = "cmd/context.go"
+    text = "S1000: should use a simple channel send/receive instead of `select` with a single case"

.goreleaser.yml

@@ -0,0 +1,55 @@
+project_name: traefik
+
+before:
+  hooks:
+    - go generate
+
+builds:
+  - binary: traefik
+
+    main: ./cmd/traefik/traefik.go
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -s -w -X github.com/containous/traefik/pkg/version.Version={{.Version}} -X github.com/containous/traefik/pkg/version.Codename={{.Env.CODENAME}}  -X github.com/containous/traefik/pkg/version.BuildDate={{.Date}}
+
+    goos:
+      - linux
+      - darwin
+      - windows
+      - freebsd
+      - openbsd
+    goarch:
+      - amd64
+      - 386
+      - arm
+      - arm64
+      - ppc64le
+    goarm:
+      - 7
+      - 6
+      - 5
+    ignore:
+      - goos: darwin
+        goarch: 386
+      - goos: openbsd
+        goarch: arm
+      - goos: freebsd
+        goarch: arm
+
+changelog:
+  skip: true
+
+archive:
+  name_template: '{{ .ProjectName }}_v{{ .Version }}_{{ .Os }}_{{ .Arch }}{{ if .Arm
+    }}v{{ .Arm }}{{ end }}'
+  format: tar.gz
+  format_overrides:
+    - goos: windows
+      format: zip
+  files:
+    - LICENSE.md
+    - CHANGELOG.md
+
+release:
+  disable: true

.pre-commit-config.yaml

@@ -1,10 +0,0 @@
--   repo: git://github.com/pre-commit/pre-commit-hooks
-    sha: 44e1753f98b0da305332abe26856c3e621c5c439
-    hooks:
-    -   id: detect-private-key
--   repo: git://github.com/containous/pre-commit-hooks
-    sha: 35e641b5107671e94102b0ce909648559e568d61
-    hooks:
-    -   id: goFmt
-    -   id: goLint
-    -   id: goErrcheck

.semaphoreci/cleanup.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -e
+
+sudo rm -rf static

.semaphoreci/golang.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+set -e
+
+curl -O https://dl.google.com/go/go1.12.linux-amd64.tar.gz
+
+tar -xvf go1.12.linux-amd64.tar.gz
+rm -rf go1.12.linux-amd64.tar.gz
+
+sudo mkdir -p /usr/local/golang/1.12/go
+sudo mv go /usr/local/golang/1.12/
+
+sudo rm /usr/local/bin/go
+sudo chmod +x /usr/local/golang/1.12/go/bin/go
+sudo ln -s /usr/local/golang/1.12/go/bin/go /usr/local/bin/go
+
+export GOROOT="/usr/local/golang/1.12/go"
+export GOTOOLDIR="/usr/local/golang/1.12/go/pkg/tool/linux_amd64"
+
+go version

.semaphoreci/job1.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -e
+
+if [ -n "$SHOULD_TEST" ]; then ci_retry make pull-images; fi
+
+if [ -n "$SHOULD_TEST" ]; then ci_retry make test-integration; fi

.semaphoreci/job2.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -e
+
+ci_retry make validate
+
+if [ -n "$SHOULD_TEST" ]; then ci_retry make test-unit; fi
+
+if [ -n "$SHOULD_TEST" ]; then make -j${N_MAKE_JOBS} crossbinary-default-parallel; fi

.semaphoreci/setup.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -e
+
+export DOCKER_VERSION=17.03.1
+
+source .semaphoreci/vars
+
+if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
+
+if [ -n "$TEMP_STORAGE" ]; then SHOULD_TEST=$(echo "$TEMP_STORAGE" | grep -Ev '(.md|.yaml|.yml)' || :); fi
+
+if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq update; fi
+
+if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*; fi
+
+if [ -n "$SHOULD_TEST" ]; then  docker version; fi

.semaphoreci/vars

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -e
+
+export REPO='containous/traefik'
+
+if VERSION=$(git describe --exact-match --abbrev=0 --tags);
+then
+  export VERSION
+else
+  export VERSION=''
+fi
+
+export CODENAME=faisselle
+
+export N_MAKE_JOBS=2
+
+
+function ci_retry {
+
+    local NRETRY=3
+    local NSLEEP=5
+    local n=0
+
+    until [ $n -ge $NRETRY ]
+    do
+        "$@" && break
+        n=$[$n+1]
+        echo "$@ failed, attempt ${n}/${NRETRY}"
+        sleep $NSLEEP
+    done
+
+    [ $n -lt $NRETRY ]
+
+}
+
+export -f ci_retry
+

.travis.yml

@@ -1,31 +1,58 @@
-branches:
-  except:
-    - /^v\d\.\d\.\d.*$/
-    
-env:
-  REPO: $TRAVIS_REPO_SLUG
-  VERSION: v1.0.0-beta.$TRAVIS_BUILD_NUMBER
-
 sudo: required
+dist: trusty
+
+git:
+  depth: false
 
 services:
   - docker
 
-install:
-  - sudo service docker stop
-  - sudo curl https://get.docker.com/builds/Linux/x86_64/docker-1.10.1 -o /usr/bin/docker
-  - sudo chmod +x /usr/bin/docker
-  - sudo service docker start
-
-before_script:
-  - make validate
-  - make binary
+env:
+  global:
+    - REPO: $TRAVIS_REPO_SLUG
+    - VERSION: $TRAVIS_TAG
+    - CODENAME: faisselle
 
 script:
-  - make test-unit
-  - make test-integration
-  - make crossbinary
-  - make image
+- echo "Skipping tests... (Tests are executed on SemaphoreCI)"
+- if [ "$TRAVIS_PULL_REQUEST" != "false" ]; then make docs; fi
 
-after_success:
- - make deploy
+before_deploy:
+  - >
+    if ! [ "$BEFORE_DEPLOY_RUN" ]; then
+      export BEFORE_DEPLOY_RUN=1;
+      sudo -E apt-get -yq update;
+      sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*;
+      docker version;
+      make build-image;
+      if [ "$TRAVIS_TAG" ]; then
+        make release-packages;
+      fi;
+      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" v1.7.0
+      structor -o containous -r traefik --dockerfile-url="https://raw.githubusercontent.com/containous/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/containous/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/containous/structor/master/requirements-override.txt" --force-edit-url --exp-branch=master --debug;
+    fi
+
+deploy:
+  - provider: releases
+    api_key: ${GITHUB_TOKEN}
+    file: dist/traefik*
+    skip_cleanup: true
+    file_glob: true
+    draft: true
+    on:
+      repo: containous/traefik
+      tags: true
+  - provider: script
+    script: sh script/deploy.sh
+    skip_cleanup: true
+    on:
+      repo: containous/traefik
+      tags: true
+  - provider: pages
+    edge: false
+    github_token: ${GITHUB_TOKEN}
+    local_dir: site
+    skip_cleanup: true
+    on:
+      repo: containous/traefik
+      all_branches: true

CODE_OF_CONDUCT.md

@@ -0,0 +1,51 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience,nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. 
+Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. 
+Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@containo.us
+All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. 
+The project team is obligated to maintain confidentiality with regard to the reporter of an incident. 
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+See https://docs.traefik.io.

Dockerfile

@@ -2,4 +2,5 @@ FROM scratch
 COPY script/ca-certificates.crt /etc/ssl/certs/
 COPY dist/traefik /
 EXPOSE 80
+VOLUME ["/tmp"]
 ENTRYPOINT ["/traefik"]

Gopkg.toml

@@ -0,0 +1,282 @@
+# Gopkg.toml example
+#
+# Refer to https://github.com/golang/dep/blob/master/docs/Gopkg.toml.md
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#  name = "github.com/x/y"
+#  version = "2.4.0"
+
+required = [
+  "k8s.io/code-generator/cmd/client-gen",
+  "k8s.io/code-generator/cmd/deepcopy-gen",
+  "k8s.io/code-generator/cmd/defaulter-gen",
+  "k8s.io/code-generator/cmd/lister-gen",
+  "k8s.io/code-generator/cmd/informer-gen",
+]
+
+[prune]
+  non-go = true
+  go-tests = true
+  unused-packages = true
+  [[prune.project]]
+    name = "k8s.io/code-generator"
+    non-go = false
+    unused-packages = false
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/ArthurHlt/go-eureka-client"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/BurntSushi/toml"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/BurntSushi/ty"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/NYTimes/gziphandler"
+
+[[constraint]]
+  branch = "containous-fork"
+  name = "github.com/abbot/go-http-auth"
+  source = "github.com/containous/go-http-auth"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/armon/go-proxyproto"
+
+[[constraint]]
+  name = "github.com/aws/aws-sdk-go"
+  version = "1.13.11"
+
+[[constraint]]
+  name = "github.com/cenkalti/backoff"
+  version = "2.1.1"
+
+[[constraint]]
+  name = "github.com/containous/flaeg"
+  version = "1.4.1"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/containous/mux"
+
+[[constraint]]
+  branch = "containous-fork"
+  name = "github.com/containous/alice"
+
+[[constraint]]
+  name = "github.com/containous/staert"
+  version = "3.1.2"
+
+#[[constraint]]
+#  name = "github.com/containous/traefik-extra-service-fabric"
+#  version = "1.3.0"
+
+[[constraint]]
+  name = "github.com/coreos/go-systemd"
+  version = "14.0.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/docker/leadership"
+  source = "github.com/containous/leadership"
+
+[[constraint]]
+  name = "github.com/eapache/channels"
+  version = "1.1.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/elazarl/go-bindata-assetfs"
+
+[[constraint]]
+  branch = "fork-containous"
+  name = "github.com/go-check/check"
+  source = "github.com/containous/check"
+
+[[override]]
+  branch = "fork-containous"
+  name = "github.com/go-check/check"
+  source = "github.com/containous/check"
+
+[[constraint]]
+  name = "github.com/go-kit/kit"
+  version = "0.7.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/gorilla/websocket"
+
+[[constraint]]
+  name = "github.com/hashicorp/consul"
+  version = "1.0.6"
+
+[[constraint]]
+  name = "github.com/influxdata/influxdb"
+  version = "1.3.7"
+
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/jjcollinge/servicefabric"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/abronan/valkeyrie"
+
+[[constraint]]
+  name = "github.com/mesosphere/mesos-dns"
+  source = "https://github.com/containous/mesos-dns.git"
+
+[[constraint]]
+  name = "github.com/opentracing/opentracing-go"
+  version = "1.0.2"
+
+[[constraint]]
+  branch = "containous-fork"
+  name = "github.com/rancher/go-rancher-metadata"
+  source = "github.com/containous/go-rancher-metadata"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/ryanuber/go-glob"
+
+[[constraint]]
+  name = "github.com/satori/go.uuid"
+  version = "1.1.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/stvp/go-udp-testing"
+
+[[constraint]]
+  name = "github.com/stretchr/testify"
+  version = "1.2.1"
+
+[[constraint]]
+  name = "github.com/uber/jaeger-client-go"
+  version = "2.15.0"
+
+[[constraint]]
+  name = "github.com/uber/jaeger-lib"
+  version = "1.3.0"
+
+[[constraint]]
+  branch = "v1"
+  name = "github.com/unrolled/secure"
+
+[[constraint]]
+  name = "github.com/vdemeester/shakers"
+  version = "0.1.0"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/vulcand/oxy"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/go-acme/lego"
+#  version = "2.4.0"
+
+[[constraint]]
+  name = "google.golang.org/grpc"
+  version = "1.5.2"
+
+[[constraint]]
+  name = "gopkg.in/fsnotify.v1"
+  source = "github.com/fsnotify/fsnotify"
+  version = "1.4.2"
+
+[[constraint]]
+  name = "k8s.io/client-go"
+  version = "8.0.0" # 8.0.0
+
+[[constraint]]
+  name = "k8s.io/code-generator"
+  version = "kubernetes-1.11.7"
+
+[[constraint]]
+  name = "k8s.io/api"
+  version = "kubernetes-1.11.7" # "kubernetes-1.11.7"
+
+[[constraint]]
+  name = "k8s.io/apimachinery"
+  version = "kubernetes-1.11.7" # "kubernetes-1.11.7"
+
+[[override]]
+  name = "github.com/json-iterator/go"
+  version = "1.1.6"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/libkermit/docker"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/libkermit/docker-check"
+
+[[constraint]]
+  branch = "master"
+  name = "github.com/libkermit/compose"
+
+[[constraint]]
+ name = "github.com/docker/docker"
+ revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
+
+[[override]]
+ name = "github.com/docker/docker"
+ revision = "7848b8beb9d38a98a78b75f78e05f8d2255f9dfe"
+
+[[override]]
+ name = "github.com/docker/cli"
+ revision = "6b63d7b96a41055baddc3fa71f381c7f60bd5d8e"
+
+[[override]]
+ name = "github.com/docker/distribution"
+ revision = "edc3ab29cdff8694dd6feb85cfeb4b5f1b38ed9c"
+
+[[override]]
+  branch = "master"
+  name = "github.com/docker/libcompose"
+
+[[override]]
+  name = "github.com/Nvveen/Gotty"
+  revision = "a8b993ba6abdb0e0c12b0125c603323a71c7790c"
+  source = "github.com/ijc25/Gotty"
+
+[[override]]
+  # ALWAYS keep this override
+  name = "github.com/mailgun/timetools"
+  revision = "7e6055773c5137efbeb3bd2410d705fe10ab6bfd"
+
+[[override]]
+  version = "v1.1.1"
+  name = "github.com/miekg/dns"
+
+[[constraint]]
+  name = "github.com/patrickmn/go-cache"
+  version = "2.1.0"
+
+[[constraint]]
+  name = "gopkg.in/DataDog/dd-trace-go.v1"
+  version = "1.7.0"
+
+[[constraint]]
+  name = "github.com/instana/go-sensor"
+  version = "1.4.12"

LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016 Containous SAS, Emile Vauge, emile@vauge.com
+Copyright (c) 2016-2018 Containous SAS
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Makefile

@@ -1,94 +1,154 @@
-.PHONY: all
+.PHONY: all docs docs-serve
+
+SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
+
+TAG_NAME := $(shell git tag -l --contains HEAD)
+SHA := $(shell git rev-parse HEAD)
+VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
+VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
+
+BIND_DIR := "dist"
+
+GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
+TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
+
+REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
+TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
+
+INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
+DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 
 TRAEFIK_ENVS := \
 	-e OS_ARCH_ARG \
 	-e OS_PLATFORM_ARG \
 	-e TESTFLAGS \
 	-e VERBOSE \
-	-e VERSION
+	-e VERSION \
+	-e CODENAME \
+	-e TESTDIRS \
+	-e CI \
+	-e CONTAINER=DOCKER		# Indicator for integration tests that we are running inside a container.
 
-SRCS = $(shell git ls-files '*.go' | grep -v '^external/')
-
-BIND_DIR := "dist"
 TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/containous/traefik/$(BIND_DIR)"
+DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
+DOCKER_RUN_TRAEFIK := docker run $(INTEGRATION_OPTS) -it $(DOCKER_RUN_OPTS)
+DOCKER_RUN_TRAEFIK_NOTTY := docker run $(INTEGRATION_OPTS) -i $(DOCKER_RUN_OPTS)
 
-GIT_BRANCH := $(shell git rev-parse --abbrev-ref HEAD 2>/dev/null)
-TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(GIT_BRANCH))
-REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
-TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
-INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -v "/var/run/docker.sock:/var/run/docker.sock")
-
-DOCKER_RUN_TRAEFIK := docker run $(INTEGRATION_OPTS) -it $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
-
-print-%: ; @echo $*=$($*)
+PRE_TARGET ?= build-dev-image
 
 default: binary
 
-all: generate-webui build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh
+## Build Dev Docker image
+build-dev-image: dist
+	docker build $(DOCKER_BUILD_ARGS) -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
 
-binary: generate-webui build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary
-
-crossbinary: generate-webui build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate crossbinary
-
-test: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
-
-test-unit: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit
-
-test-integration: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-integration
-
-validate: build 
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh  validate-gofmt validate-govet validate-golint 
-
-validate-gofmt: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh validate-gofmt
-
-validate-govet: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh validate-govet
-
-validate-golint: build
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh validate-golint
-
-build: dist
-	docker build -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
-
-build-webui:
-	docker build -t traefik-webui -f webui/Dockerfile webui
-
-build-no-cache: dist
+## Build Dev Docker image without cache
+build-dev-image-no-cache: dist
 	docker build --no-cache -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
 
-shell: build
-	$(DOCKER_RUN_TRAEFIK) /bin/bash
-
-image: build
-	docker build -t $(TRAEFIK_IMAGE) .
-
+## Create the "dist" directory
 dist:
 	mkdir dist
 
-run-dev:
-	go generate
-	go build
-	./traefik
+## Build WebUI Docker image
+build-webui-image:
+	docker build -t traefik-webui -f webui/Dockerfile webui
 
-generate-webui: build-webui
+## Generate WebUI
+generate-webui: build-webui-image
 	if [ ! -d "static" ]; then \
 		mkdir -p static; \
-		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui gulp; \
+		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui npm run build; \
+		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui chown -R $(shell id -u):$(shell id -g) ../static; \
 		echo 'For more informations show `webui/readme.md`' > $$PWD/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md; \
 	fi
 
-lint:
-	script/validate-golint
+## Build the linux binary
+binary: generate-webui $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate binary
 
+## Build the binary for the standard plaforms (linux, darwin, windows)
+crossbinary-default: generate-webui build-dev-image
+	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default
+
+## Build the binary for the standard plaforms (linux, darwin, windows) in parallel
+crossbinary-default-parallel:
+	$(MAKE) generate-webui
+	$(MAKE) build-dev-image crossbinary-default
+
+## Run the unit and integration tests
+test: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
+
+## Run the unit tests
+test-unit: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate test-unit
+
+## Pull all images for integration tests
+pull-images:
+	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml | awk '{print $$2}' | sort | uniq | xargs -P 6 -n 1 docker pull
+
+## Run the integration tests
+test-integration: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary test-integration
+	TEST_HOST=1 ./script/make.sh test-integration
+
+## Validate code, vendor
+validate: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell validate-vendor
+
+## Clean up static directory and build a Docker Traefik image
+build-image: binary
+	rm -rf static
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Build a Docker Traefik image
+build-image-dirty: binary
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Start a shell inside the build env
+shell: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) /bin/bash
+
+## Build documentation site
+docs:
+	make -C ./docs docs
+
+## Serve the documentation site localy
+docs-serve:
+	make -C ./docs docs-serve
+
+## Generate CRD clientset
+generate-crd:
+	./script/update-generated-crd-code.sh
+
+## Download dependencies
+dep-ensure:
+	dep ensure -v
+	./script/prune-dep.sh
+
+## Clean vendor directory
+dep-prune:
+	./script/prune-dep.sh
+
+## Create packages for the release
+release-packages: generate-webui build-dev-image
+	rm -rf dist
+	$(DOCKER_RUN_TRAEFIK_NOTTY) goreleaser release --skip-publish
+	$(DOCKER_RUN_TRAEFIK_NOTTY) tar cfz dist/traefik-${VERSION}.src.tar.gz \
+		--exclude-vcs \
+		--exclude .idea \
+		--exclude .travis \
+		--exclude .semaphoreci \
+		--exclude .github \
+		--exclude dist .
+	$(DOCKER_RUN_TRAEFIK_NOTTY) chown -R $(shell id -u):$(shell id -g) dist/
+
+## Format the Code
 fmt:
 	gofmt -s -l -w $(SRCS)
 
-deploy:
-	./script/deploy.sh
+run-dev:
+	go generate
+	go build ./cmd/traefik
+	./traefik

README.md

@@ -1,114 +1,174 @@
 
 <p align="center">
-<img src="http://traefik.github.io/traefik.logo.svg" alt="Træfɪk" title="Træfɪk" />
+<img src="docs/content/assets/img/traefik.logo.png" alt="Traefik" title="Traefik" />
 </p>
 
-[![Build Status](https://travis-ci.org/containous/traefik.svg?branch=master)](https://travis-ci.org/containous/traefik)
+[![Build Status SemaphoreCI](https://semaphoreci.com/api/v1/containous/traefik/branches/master/shields_badge.svg)](https://semaphoreci.com/containous/traefik)
+[![Docs](https://img.shields.io/badge/docs-current-brightgreen.svg)](https://docs.traefik.io)
+[![Go Report Card](https://goreportcard.com/badge/containous/traefik)](http://goreportcard.com/report/containous/traefik)
+[![](https://images.microbadger.com/badges/image/traefik.svg)](https://microbadger.com/images/traefik)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
-[![Join the chat at https://traefik.herokuapp.com](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://traefik.herokuapp.com)
-[![Twitter](https://img.shields.io/twitter/follow/traefikproxy.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefikproxy)
+[![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
+[![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
 
+Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
+Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
+Pointing Traefik at your orchestrator should be the _only_ configuration step you need.
 
-Træfɪk is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
-It supports several backends ([Docker :whale:](https://www.docker.com/), [Swarm :whale: :whale:](https://docs.docker.com/swarm), [Mesos/Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Zookeeper](https://zookeeper.apache.org), [BoltDB](https://github.com/boltdb/bolt), Rest API, file...) to manage its configuration automatically and dynamically.
+---
 
+. **[Overview](#overview)** .
+**[Features](#features)** .
+**[Supported backends](#supported-backends)** .
+**[Quickstart](#quickstart)** .
+**[Web UI](#web-ui)** .
+**[Documentation](#documentation)** .
+
+. **[Support](#support)** .
+**[Release cycle](#release-cycle)** .
+**[Contributing](#contributing)** .
+**[Maintainers](#maintainers)** .
+**[Credits](#credits)** .
+
+---
+
+:warning: Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now. If you're testing out v2, please ensure you are using a [v2 configuration](https://docs.traefik.io/v2.0/).
+
+## Overview
+
+Imagine that you have deployed a bunch of microservices with the help of an orchestrator (like Swarm or Kubernetes) or a service registry (like etcd or consul).
+Now you want users to access these microservices, and you need a reverse proxy.
+
+Traditional reverse-proxies require that you configure _each_ route that will connect paths and subdomains to _each_ microservice. 
+In an environment where you add, remove, kill, upgrade, or scale your services _many_ times a day, the task of keeping the routes up to date becomes tedious. 
+
+**This is when Traefik can help you!**
+
+Traefik listens to your service registry/orchestrator API and instantly generates the routes so your microservices are connected to the outside world -- without further intervention from your part. 
+
+**Run Traefik and let it do the work for you!** 
+_(But if you'd rather configure some of your routes manually, Traefik supports that too!)_
+
+![Architecture](docs/content/assets/img/traefik-architecture.png)
 
 ## Features
 
-- [It's fast](docs/index.md#benchmarks)
-- No dependency hell, single binary made with go
-- Rest API
-- Multiple backends supported: Docker, Mesos/Marathon, Consul, Etcd, and more to come
-- Watchers for backends, can listen change in backends to apply a new configuration automatically
-- Hot-reloading of configuration. No need to restart the process
-- Graceful shutdown http connections
-- Circuit breakers on backends
-- Round Robin, rebalancer load-balancers
-- Rest Metrics
-- Tiny docker image included [![Image Layers](https://badge.imagelayers.io/containous/traefik:latest.svg)](https://imagelayers.io/?images=containous/traefik:latest)
-- SSL backends support
-- SSL frontend support (with SNI)
-- Clean AngularJS Web UI
-- Websocket support
-- HTTP/2 support
-- Retry request if network error
-- [Let's Encrypt](https://letsencrypt.org) support (Automatic HTTPS)
+- Continuously updates its configuration (No restarts!)
+- Supports multiple load balancing algorithms
+- Provides HTTPS to your microservices by leveraging [Let's Encrypt](https://letsencrypt.org)  (wildcard certificates support)
+- Circuit breakers, retry
+- See the magic through its clean web UI
+- Websocket, HTTP/2, GRPC ready
+- Provides metrics (Rest, Prometheus, Datadog, Statsd, InfluxDB)
+- Keeps access logs (JSON, CLF)
+- Fast
+- Exposes a Rest API
+- Packaged as a single binary file (made with :heart: with go) and available as a [tiny](https://microbadger.com/images/traefik) [official](https://hub.docker.com/r/_/traefik/) docker image
 
-## Demo
 
-Here is a demo of Træfɪk using Docker backend, showing a load-balancing between two servers, hot reloading of configuration, and graceful shutdown.
+## Supported Backends
 
-[![asciicast](https://asciinema.org/a/4tcyde7riou5vxulo6my3mtko.png)](https://asciinema.org/a/4tcyde7riou5vxulo6my3mtko)
+- [Docker](https://docs.traefik.io/configuration/backends/docker) / [Swarm mode](https://docs.traefik.io/configuration/backends/docker#docker-swarm-mode)
+- [Kubernetes](https://docs.traefik.io/configuration/backends/kubernetes)
+- [Mesos](https://docs.traefik.io/configuration/backends/mesos) / [Marathon](https://docs.traefik.io/configuration/backends/marathon)
+- [Rancher](https://docs.traefik.io/configuration/backends/rancher) (API, Metadata)
+- [Azure Service Fabric](https://docs.traefik.io/configuration/backends/servicefabric)
+- [Consul Catalog](https://docs.traefik.io/configuration/backends/consulcatalog)
+- [Consul](https://docs.traefik.io/configuration/backends/consul) / [Etcd](https://docs.traefik.io/configuration/backends/etcd) / [Zookeeper](https://docs.traefik.io/configuration/backends/zookeeper) / [BoltDB](https://docs.traefik.io/configuration/backends/boltdb)
+- [Eureka](https://docs.traefik.io/configuration/backends/eureka)
+- [Amazon ECS](https://docs.traefik.io/configuration/backends/ecs)
+- [Amazon DynamoDB](https://docs.traefik.io/configuration/backends/dynamodb)
+- [File](https://docs.traefik.io/configuration/backends/file)
+- [Rest](https://docs.traefik.io/configuration/backends/rest)
+
+## Quickstart
+
+To get your hands on Traefik, you can use the [5-Minute Quickstart](http://docs.traefik.io/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).
 
 ## Web UI
 
-You can access to a simple HTML frontend of Træfik.
+You can access the simple HTML frontend of Traefik.
 
-![Web UI Providers](docs/img/web.frontend.png)
-![Web UI Health](docs/img/traefik-health.png)
+![Web UI Providers](docs/content/assets/img/dashboard-main.png)
+![Web UI Health](docs/content/assets/img/dashboard-health.png)
 
-## Plumbing
+## Documentation
 
-- [Oxy](https://github.com/vulcand/oxy): an awsome proxy library made by Mailgun guys
-- [Gorilla mux](https://github.com/gorilla/mux): famous request router
-- [Negroni](https://github.com/codegangsta/negroni): web middlewares made simple
-- [Manners](https://github.com/mailgun/manners): graceful shutdown of http.Handler servers
-- [Lego](https://github.com/xenolf/lego): the best [Let's Encrypt](https://letsencrypt.org) library in go
+You can find the complete documentation at [https://docs.traefik.io](https://docs.traefik.io).
+A collection of contributions around Traefik can be found at [https://awesome.traefik.io](https://awesome.traefik.io).
 
-## Quick start
+## Support
 
-- The simple way: grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page and just run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
+To get community support, you can:
+- join the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
+- use [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
+
+If you need commercial support, please contact [Containo.us](https://containo.us) by mail: <mailto:support@containo.us>.
+
+## Download
+
+- Grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
 
 ```shell
-./traefik -c traefik.toml
+./traefik --configFile=traefik.toml
 ```
 
-- Use the tiny Docker image:
+- Or use the official tiny Docker image and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
 
 ```shell
-docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml containous/traefik
+docker run -d -p 8080:8080 -p 80:80 -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik
 ```
 
-- From sources:
+- Or get the sources:
 
 ```shell
 git clone https://github.com/containous/traefik
 ```
 
-## Documentation
+## Introductory Videos
 
-You can find the complete documentation [here](docs/index.md).
+Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at GopherCon 2017.
+You will learn Traefik basics in less than 10 minutes.
+
+[![Traefik GopherCon 2017](https://img.youtube.com/vi/RgudiksfL-k/0.jpg)](https://www.youtube.com/watch?v=RgudiksfL-k)
+
+Here is a talk given by [Ed Robinson](https://github.com/errm) at [ContainerCamp UK](https://container.camp) conference.
+You will learn fundamental Traefik features and see some demos with Kubernetes.
+
+[![Traefik ContainerCamp UK](https://img.youtube.com/vi/aFtpIShV60I/0.jpg)](https://www.youtube.com/watch?v=aFtpIShV60I)
+
+## Maintainers
+
+[Information about process and maintainers](docs/content/contributing/maintainers.md)
 
 ## Contributing
 
-Please refer to [this section](.github/CONTRIBUTING.md).
+If you'd like to contribute to the project, refer to the [contributing documentation](CONTRIBUTING.md).
 
-## Træfɪk here and there
+Please note that this project is released with a [Contributor Code of Conduct](CODE_OF_CONDUCT.md).
+By participating in this project, you agree to abide by its terms.
 
-These projects use Træfɪk internally. If your company uses Træfɪk, we would be glad to get your feedback :) Contact us on [![Join the chat at https://traefik.herokuapp.com](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://traefik.herokuapp.com)
+## Release Cycle
 
-- Project [Mantl](https://mantl.io/) from Cisco
+- We release a new version (e.g. 1.1.0, 1.2.0, 1.3.0) every other month.
+- Release Candidates are available before the release (e.g. 1.1.0-rc1, 1.1.0-rc2, 1.1.0-rc3, 1.1.0-rc4, before 1.1.0)
+- Bug-fixes (e.g. 1.1.1, 1.1.2, 1.2.1, 1.2.3) are released as needed (no additional features are delivered in those versions, bug-fixes only)
 
-![Web UI Providers](docs/img/mantl-logo.png)
-> Mantl is a modern platform for rapidly deploying globally distributed services. A container orchestrator, docker, a network stack, something to pool your logs, something to monitor health, a sprinkle of service discovery and some automation.
+Each version is supported until the next one is released (e.g. 1.1.x will be supported until 1.2.0 is out)
 
-- Project [Apollo](http://capgemini.github.io/devops/apollo/) from Cap Gemini
+We use [Semantic Versioning](http://semver.org/)
 
-![Web UI Providers](docs/img/apollo-logo.png)
-> Apollo is an open source project to aid with building and deploying IAAS and PAAS services. It is particularly geared towards managing containerized applications across multiple hosts, and big data type workloads. Apollo leverages other open source components to provide basic mechanisms for deployment, maintenance, and scaling of infrastructure and applications.
+## Mailing lists
 
-## Partners
+- General announcements, new releases: mail at news+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/news)
+- Security announcements: mail at security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security).
 
-[![Zenika](docs/img/zenika.logo.png)](https://zenika.com)
+## Credits
 
-Zenika is one of the leading providers of professional Open Source services and agile methodologies in
-Europe. We provide consulting, development, training and support for the world’s leading Open Source
-software products.
+Kudos to [Peka](http://peka.byethost11.com/photoblog/) for his awesome work on the logo ![logo](docs/content/assets/img/traefik.icon.png).
 
+Traefik's logo is licensed under the Creative Commons 3.0 Attributions license.
 
-
-[![Asteris](docs/img/asteris.logo.png)](https://aster.is)
-
-Founded in 2014, Asteris creates next-generation infrastructure software for the modern datacenter. Asteris writes software that makes it easy for companies to implement continuous delivery and realtime data pipelines. We support the HashiCorp stack, along with Kubernetes, Apache Mesos, Spark and Kafka. We're core committers on mantl.io, consul-cli and mesos-consul.
-.
+Traefik's logo was inspired by the gopher stickers made by Takuya Ueda (https://twitter.com/tenntenn).
+The original Go gopher was designed by Renee French (http://reneefrench.blogspot.com/).

acme/acme.go

@@ -1,423 +0,0 @@
-package acme
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/tls"
-	"crypto/x509"
-	"encoding/json"
-	"errors"
-	"fmt"
-	log "github.com/Sirupsen/logrus"
-	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
-	"io/ioutil"
-	fmtlog "log"
-	"os"
-	"reflect"
-	"sync"
-	"time"
-)
-
-// Account is used to store lets encrypt registration info
-type Account struct {
-	Email              string
-	Registration       *acme.RegistrationResource
-	PrivateKey         []byte
-	DomainsCertificate DomainsCertificates
-}
-
-// GetEmail returns email
-func (a Account) GetEmail() string {
-	return a.Email
-}
-
-// GetRegistration returns lets encrypt registration resource
-func (a Account) GetRegistration() *acme.RegistrationResource {
-	return a.Registration
-}
-
-// GetPrivateKey returns private key
-func (a Account) GetPrivateKey() crypto.PrivateKey {
-	if privateKey, err := x509.ParsePKCS1PrivateKey(a.PrivateKey); err == nil {
-		return privateKey
-	}
-	log.Errorf("Cannot unmarshall private key %+v", a.PrivateKey)
-	return nil
-}
-
-// Certificate is used to store certificate info
-type Certificate struct {
-	Domain        string
-	CertURL       string
-	CertStableURL string
-	PrivateKey    []byte
-	Certificate   []byte
-}
-
-// DomainsCertificates stores a certificate for multiple domains
-type DomainsCertificates struct {
-	Certs []*DomainsCertificate
-	lock  *sync.RWMutex
-}
-
-func (dc *DomainsCertificates) init() error {
-	if dc.lock == nil {
-		dc.lock = &sync.RWMutex{}
-	}
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-	for _, domainsCertificate := range dc.Certs {
-		tlsCert, err := tls.X509KeyPair(domainsCertificate.Certificate.Certificate, domainsCertificate.Certificate.PrivateKey)
-		if err != nil {
-			return err
-		}
-		domainsCertificate.tlsCert = &tlsCert
-	}
-	return nil
-}
-
-func (dc *DomainsCertificates) renewCertificates(acmeCert *Certificate, domain Domain) error {
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-
-	for _, domainsCertificate := range dc.Certs {
-		if reflect.DeepEqual(domain, domainsCertificate.Domains) {
-			domainsCertificate.Certificate = acmeCert
-			tlsCert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
-			if err != nil {
-				return err
-			}
-			domainsCertificate.tlsCert = &tlsCert
-			return nil
-		}
-	}
-	return errors.New("Certificate to renew not found for domain " + domain.Main)
-}
-
-func (dc *DomainsCertificates) addCertificateForDomains(acmeCert *Certificate, domain Domain) (*DomainsCertificate, error) {
-	dc.lock.Lock()
-	defer dc.lock.Unlock()
-
-	tlsCert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
-	if err != nil {
-		return nil, err
-	}
-	cert := DomainsCertificate{Domains: domain, Certificate: acmeCert, tlsCert: &tlsCert}
-	dc.Certs = append(dc.Certs, &cert)
-	return &cert, nil
-}
-
-func (dc *DomainsCertificates) getCertificateForDomain(domainToFind string) (*DomainsCertificate, bool) {
-	dc.lock.RLock()
-	defer dc.lock.RUnlock()
-	for _, domainsCertificate := range dc.Certs {
-		domains := []string{}
-		domains = append(domains, domainsCertificate.Domains.Main)
-		domains = append(domains, domainsCertificate.Domains.SANs...)
-		for _, domain := range domains {
-			if domain == domainToFind {
-				return domainsCertificate, true
-			}
-		}
-	}
-	return nil, false
-}
-
-func (dc *DomainsCertificates) exists(domainToFind Domain) (*DomainsCertificate, bool) {
-	dc.lock.RLock()
-	defer dc.lock.RUnlock()
-	for _, domainsCertificate := range dc.Certs {
-		if reflect.DeepEqual(domainToFind, domainsCertificate.Domains) {
-			return domainsCertificate, true
-		}
-	}
-	return nil, false
-}
-
-// DomainsCertificate contains a certificate for multiple domains
-type DomainsCertificate struct {
-	Domains     Domain
-	Certificate *Certificate
-	tlsCert     *tls.Certificate
-}
-
-func (dc *DomainsCertificate) needRenew() bool {
-	for _, c := range dc.tlsCert.Certificate {
-		crt, err := x509.ParseCertificate(c)
-		if err != nil {
-			// If there's an error, we assume the cert is broken, and needs update
-			return true
-		}
-		// <= 7 days left, renew certificate
-		if crt.NotAfter.Before(time.Now().Add(time.Duration(24 * 7 * time.Hour))) {
-			return true
-		}
-	}
-
-	return false
-}
-
-// ACME allows to connect to lets encrypt and retrieve certs
-type ACME struct {
-	Email       string
-	Domains     []Domain
-	StorageFile string
-	OnDemand    bool
-	CAServer    string
-	EntryPoint  string
-	storageLock sync.RWMutex
-}
-
-// Domain holds a domain name with SANs
-type Domain struct {
-	Main string
-	SANs []string
-}
-
-// CreateConfig creates a tls.config from using ACME configuration
-func (a *ACME) CreateConfig(tlsConfig *tls.Config, CheckOnDemandDomain func(domain string) bool) error {
-	acme.Logger = fmtlog.New(ioutil.Discard, "", 0)
-
-	if len(a.StorageFile) == 0 {
-		return errors.New("Empty StorageFile, please provide a filenmae for certs storage")
-	}
-
-	log.Debugf("Generating default certificate...")
-	if len(tlsConfig.Certificates) == 0 {
-		// no certificates in TLS config, so we add a default one
-		cert, err := generateDefaultCertificate()
-		if err != nil {
-			return err
-		}
-		tlsConfig.Certificates = append(tlsConfig.Certificates, *cert)
-	}
-	var account *Account
-	var needRegister bool
-
-	// if certificates in storage, load them
-	if fileInfo, err := os.Stat(a.StorageFile); err == nil && fileInfo.Size() != 0 {
-		log.Infof("Loading ACME certificates...")
-		// load account
-		account, err = a.loadAccount(a)
-		if err != nil {
-			return err
-		}
-	} else {
-		log.Infof("Generating ACME Account...")
-		// Create a user. New accounts need an email and private key to start
-		privateKey, err := rsa.GenerateKey(rand.Reader, 4096)
-		if err != nil {
-			return err
-		}
-		account = &Account{
-			Email:      a.Email,
-			PrivateKey: x509.MarshalPKCS1PrivateKey(privateKey),
-		}
-		account.DomainsCertificate = DomainsCertificates{Certs: []*DomainsCertificate{}, lock: &sync.RWMutex{}}
-		needRegister = true
-	}
-
-	client, err := a.buildACMEClient(account)
-	if err != nil {
-		return err
-	}
-	client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
-	wrapperChallengeProvider := newWrapperChallengeProvider()
-	client.SetChallengeProvider(acme.TLSSNI01, wrapperChallengeProvider)
-
-	if needRegister {
-		// New users will need to register; be sure to save it
-		reg, err := client.Register()
-		if err != nil {
-			return err
-		}
-		account.Registration = reg
-	}
-
-	// The client has a URL to the current Let's Encrypt Subscriber
-	// Agreement. The user will need to agree to it.
-	err = client.AgreeToTOS()
-	if err != nil {
-		return err
-	}
-
-	safe.Go(func() {
-		a.retrieveCertificates(client, account)
-	})
-
-	tlsConfig.GetCertificate = func(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-		if challengeCert, ok := wrapperChallengeProvider.getCertificate(clientHello.ServerName); ok {
-			return challengeCert, nil
-		}
-		if domainCert, ok := account.DomainsCertificate.getCertificateForDomain(clientHello.ServerName); ok {
-			return domainCert.tlsCert, nil
-		}
-		if a.OnDemand {
-			if CheckOnDemandDomain != nil && !CheckOnDemandDomain(clientHello.ServerName) {
-				return nil, nil
-			}
-			return a.loadCertificateOnDemand(client, account, clientHello)
-		}
-		return nil, nil
-	}
-
-	ticker := time.NewTicker(24 * time.Hour)
-	safe.Go(func() {
-		for {
-			select {
-			case <-ticker.C:
-
-				if err := a.renewCertificates(client, account); err != nil {
-					log.Errorf("Error renewing ACME certificate %+v: %s", account, err.Error())
-				}
-			}
-		}
-
-	})
-	return nil
-}
-
-func (a *ACME) retrieveCertificates(client *acme.Client, account *Account) {
-	log.Infof("Retrieving ACME certificates...")
-	for _, domain := range a.Domains {
-		// check if cert isn't already loaded
-		if _, exists := account.DomainsCertificate.exists(domain); !exists {
-			domains := []string{}
-			domains = append(domains, domain.Main)
-			domains = append(domains, domain.SANs...)
-			certificateResource, err := a.getDomainsCertificates(client, domains)
-			if err != nil {
-				log.Errorf("Error getting ACME certificate for domain %s: %s", domains, err.Error())
-				continue
-			}
-			_, err = account.DomainsCertificate.addCertificateForDomains(certificateResource, domain)
-			if err != nil {
-				log.Errorf("Error adding ACME certificate for domain %s: %s", domains, err.Error())
-				continue
-			}
-			if err = a.saveAccount(account); err != nil {
-				log.Errorf("Error Saving ACME account %+v: %s", account, err.Error())
-				continue
-			}
-		}
-	}
-	log.Infof("Retrieved ACME certificates")
-}
-
-func (a *ACME) renewCertificates(client *acme.Client, account *Account) error {
-	for _, certificateResource := range account.DomainsCertificate.Certs {
-		if certificateResource.needRenew() {
-			log.Debugf("Renewing certificate %+v", certificateResource.Domains)
-			renewedCert, err := client.RenewCertificate(acme.CertificateResource{
-				Domain:        certificateResource.Certificate.Domain,
-				CertURL:       certificateResource.Certificate.CertURL,
-				CertStableURL: certificateResource.Certificate.CertStableURL,
-				PrivateKey:    certificateResource.Certificate.PrivateKey,
-				Certificate:   certificateResource.Certificate.Certificate,
-			}, false)
-			if err != nil {
-				return err
-			}
-			log.Debugf("Renewed certificate %+v", certificateResource.Domains)
-			renewedACMECert := &Certificate{
-				Domain:        renewedCert.Domain,
-				CertURL:       renewedCert.CertURL,
-				CertStableURL: renewedCert.CertStableURL,
-				PrivateKey:    renewedCert.PrivateKey,
-				Certificate:   renewedCert.Certificate,
-			}
-			err = account.DomainsCertificate.renewCertificates(renewedACMECert, certificateResource.Domains)
-			if err != nil {
-				return err
-			}
-			if err = a.saveAccount(account); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func (a *ACME) buildACMEClient(Account *Account) (*acme.Client, error) {
-	caServer := "https://acme-v01.api.letsencrypt.org/directory"
-	if len(a.CAServer) > 0 {
-		caServer = a.CAServer
-	}
-	client, err := acme.NewClient(caServer, Account, acme.RSA4096)
-	if err != nil {
-		return nil, err
-	}
-
-	return client, nil
-}
-
-func (a *ACME) loadCertificateOnDemand(client *acme.Client, Account *Account, clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	if certificateResource, ok := Account.DomainsCertificate.getCertificateForDomain(clientHello.ServerName); ok {
-		return certificateResource.tlsCert, nil
-	}
-	Certificate, err := a.getDomainsCertificates(client, []string{clientHello.ServerName})
-	if err != nil {
-		return nil, err
-	}
-	log.Debugf("Got certificate on demand for domain %s", clientHello.ServerName)
-	cert, err := Account.DomainsCertificate.addCertificateForDomains(Certificate, Domain{Main: clientHello.ServerName})
-	if err != nil {
-		return nil, err
-	}
-	if err = a.saveAccount(Account); err != nil {
-		return nil, err
-	}
-	return cert.tlsCert, nil
-}
-
-func (a *ACME) loadAccount(acmeConfig *ACME) (*Account, error) {
-	a.storageLock.RLock()
-	defer a.storageLock.RUnlock()
-	Account := Account{
-		DomainsCertificate: DomainsCertificates{},
-	}
-	file, err := ioutil.ReadFile(acmeConfig.StorageFile)
-	if err != nil {
-		return nil, err
-	}
-	if err := json.Unmarshal(file, &Account); err != nil {
-		return nil, err
-	}
-	err = Account.DomainsCertificate.init()
-	if err != nil {
-		return nil, err
-	}
-	log.Infof("Loaded ACME config from storage %s", acmeConfig.StorageFile)
-	return &Account, nil
-}
-
-func (a *ACME) saveAccount(Account *Account) error {
-	a.storageLock.Lock()
-	defer a.storageLock.Unlock()
-	// write account to file
-	data, err := json.MarshalIndent(Account, "", "  ")
-	if err != nil {
-		return err
-	}
-	return ioutil.WriteFile(a.StorageFile, data, 0644)
-}
-
-func (a *ACME) getDomainsCertificates(client *acme.Client, domains []string) (*Certificate, error) {
-	log.Debugf("Loading ACME certificates %s...", domains)
-	bundle := false
-	certificate, failures := client.ObtainCertificate(domains, bundle, nil)
-	if len(failures) > 0 {
-		log.Error(failures)
-		return nil, fmt.Errorf("Cannot obtain certificates %s+v", failures)
-	}
-	log.Debugf("Loaded ACME certificates %s", domains)
-	return &Certificate{
-		Domain:        certificate.Domain,
-		CertURL:       certificate.CertURL,
-		CertStableURL: certificate.CertStableURL,
-		PrivateKey:    certificate.PrivateKey,
-		Certificate:   certificate.Certificate,
-	}, nil
-}

acme/challengeProvider.go

@@ -1,56 +0,0 @@
-package acme
-
-import (
-	"crypto/tls"
-	"sync"
-
-	"crypto/x509"
-	"github.com/xenolf/lego/acme"
-)
-
-type wrapperChallengeProvider struct {
-	challengeCerts map[string]*tls.Certificate
-	lock           sync.RWMutex
-}
-
-func newWrapperChallengeProvider() *wrapperChallengeProvider {
-	return &wrapperChallengeProvider{
-		challengeCerts: map[string]*tls.Certificate{},
-	}
-}
-
-func (c *wrapperChallengeProvider) getCertificate(domain string) (cert *tls.Certificate, exists bool) {
-	c.lock.RLock()
-	defer c.lock.RUnlock()
-	if cert, ok := c.challengeCerts[domain]; ok {
-		return cert, true
-	}
-	return nil, false
-}
-
-func (c *wrapperChallengeProvider) Present(domain, token, keyAuth string) error {
-	cert, err := acme.TLSSNI01ChallengeCert(keyAuth)
-	if err != nil {
-		return err
-	}
-	cert.Leaf, err = x509.ParseCertificate(cert.Certificate[0])
-	if err != nil {
-		return err
-	}
-
-	c.lock.Lock()
-	defer c.lock.Unlock()
-	for i := range cert.Leaf.DNSNames {
-		c.challengeCerts[cert.Leaf.DNSNames[i]] = &cert
-	}
-
-	return nil
-
-}
-
-func (c *wrapperChallengeProvider) CleanUp(domain, token, keyAuth string) error {
-	c.lock.Lock()
-	defer c.lock.Unlock()
-	delete(c.challengeCerts, domain)
-	return nil
-}

adapters.go

@@ -1,34 +0,0 @@
-/*
-Copyright
-*/
-package main
-
-import (
-	"net/http"
-
-	log "github.com/Sirupsen/logrus"
-)
-
-// OxyLogger implements oxy Logger interface with logrus.
-type OxyLogger struct {
-}
-
-// Infof logs specified string as Debug level in logrus.
-func (oxylogger *OxyLogger) Infof(format string, args ...interface{}) {
-	log.Debugf(format, args...)
-}
-
-// Warningf logs specified string as Warning level in logrus.
-func (oxylogger *OxyLogger) Warningf(format string, args ...interface{}) {
-	log.Warningf(format, args...)
-}
-
-// Errorf logs specified string as Error level in logrus.
-func (oxylogger *OxyLogger) Errorf(format string, args ...interface{}) {
-	log.Errorf(format, args...)
-}
-
-func notFoundHandler(w http.ResponseWriter, r *http.Request) {
-	http.NotFound(w, r)
-	//templatesRenderer.HTML(w, http.StatusNotFound, "notFound", nil)
-}

build.Dockerfile

@@ -1,30 +1,34 @@
-FROM golang:1.6.0-alpine
+FROM golang:1.12-alpine
 
-RUN apk update && apk add git bash gcc musl-dev \
-&& go get github.com/Masterminds/glide \
-&& go get github.com/mitchellh/gox \
-&& go get github.com/jteeuwen/go-bindata/... \
-&& go get github.com/golang/lint/golint \
-&& go get github.com/kisielk/errcheck
+RUN apk --update upgrade \
+&& apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \
+&& rm -rf /var/cache/apk/*
+
+# Download golangci-lint and misspell binary to bin folder in $GOPATH
+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b $GOPATH/bin v1.15.0 \
+    && go get github.com/client9/misspell/cmd/misspell
+
+# Download goreleaser binary to bin folder in $GOPATH
+RUN curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh
 
 # Which docker version to test on
-ENV DOCKER_VERSION 1.10.1
+ARG DOCKER_VERSION=17.03.2
+ARG DEP_VERSION=0.5.0
 
-# enable GO15VENDOREXPERIMENT
-ENV GO15VENDOREXPERIMENT 1
+# Download go-bindata binary to bin folder in $GOPATH
+RUN mkdir -p /usr/local/bin \
+    && curl -fsSL -o /usr/local/bin/go-bindata https://github.com/containous/go-bindata/releases/download/v1.0.0/go-bindata \
+    && chmod +x /usr/local/bin/go-bindata
+
+# Download dep binary to bin folder in $GOPATH
+RUN mkdir -p /usr/local/bin \
+    && curl -fsSL -o /usr/local/bin/dep https://github.com/golang/dep/releases/download/v${DEP_VERSION}/dep-linux-amd64 \
+    && chmod +x /usr/local/bin/dep
 
 # Download docker
-RUN set -ex; \
-    curl https://get.docker.com/builds/Linux/x86_64/docker-${DOCKER_VERSION} -o /usr/local/bin/docker-${DOCKER_VERSION}; \
-    chmod +x /usr/local/bin/docker-${DOCKER_VERSION}
-
-# Set the default Docker to be run
-RUN ln -s /usr/local/bin/docker-${DOCKER_VERSION} /usr/local/bin/docker
+RUN mkdir -p /usr/local/bin \
+    && curl -fL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}-ce.tgz \
+    | tar -xzC /usr/local/bin --transform 's#^.+/##x'
 
 WORKDIR /go/src/github.com/containous/traefik
-
-COPY glide.yaml glide.yaml
-COPY glide.lock glide.lock
-RUN glide install
-
 COPY . /go/src/github.com/containous/traefik

circle.yml

@@ -1,36 +0,0 @@
-machine:
-  pre:
-    - sudo docker -d -e lxc -s btrfs -H tcp://0.0.0.0:2375:
-        background: true
-    - curl --retry 15 --retry-delay 3 -v http://172.17.42.1:2375/version
-  environment:
-    REPO: $CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME
-    DOCKER_HOST: tcp://172.17.42.1:2375
-    MAKE_DOCKER_HOST: $DOCKER_HOST
-    VERSION: v1.0.alpha.$CIRCLE_BUILD_NUM
-
-dependencies:
-  pre:
-    - docker version
-    - go get github.com/tcnksm/ghr
-    - make validate
-  override:
-    - make binary
-
-test:
-  override:
-    - make test-unit
-    - make test-integration
-  post:
-    - make crossbinary
-    - make image
-
-deployment:
-  hub:
-    branch: master
-    commands:
-      - ghr -t $GITHUB_TOKEN -u $CIRCLE_PROJECT_USERNAME -r $CIRCLE_PROJECT_REPONAME --prerelease ${VERSION} dist/
-      - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-      - docker push ${REPO,,}:latest
-      - docker tag ${REPO,,}:latest ${REPO,,}:${VERSION}
-      - docker push ${REPO,,}:${VERSION}

cmd.go

@@ -1,219 +0,0 @@
-/*
-Copyright
-*/
-package main
-
-import (
-	"encoding/json"
-	fmtlog "log"
-	"os"
-	"strings"
-	"time"
-
-	log "github.com/Sirupsen/logrus"
-	"github.com/containous/traefik/middlewares"
-	"github.com/containous/traefik/provider"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	"net/http"
-)
-
-var traefikCmd = &cobra.Command{
-	Use:   "traefik",
-	Short: "traefik, a modern reverse proxy",
-	Long: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
-Complete documentation is available at http://traefik.io`,
-	Run: func(cmd *cobra.Command, args []string) {
-		run()
-	},
-}
-var versionCmd = &cobra.Command{
-	Use:   "version",
-	Short: "Print version",
-	Long:  `Print version`,
-	Run: func(cmd *cobra.Command, args []string) {
-		fmtlog.Println(Version + " built on the " + BuildDate)
-		os.Exit(0)
-	},
-}
-
-var arguments = struct {
-	GlobalConfiguration
-	web           bool
-	file          bool
-	docker        bool
-	dockerTLS     bool
-	marathon      bool
-	consul        bool
-	consulTLS     bool
-	consulCatalog bool
-	zookeeper     bool
-	etcd          bool
-	etcdTLS       bool
-	boltdb        bool
-}{
-	GlobalConfiguration{
-		EntryPoints: make(EntryPoints),
-		Docker: &provider.Docker{
-			TLS: &provider.DockerTLS{},
-		},
-		File:     &provider.File{},
-		Web:      &WebProvider{},
-		Marathon: &provider.Marathon{},
-		Consul: &provider.Consul{
-			Kv: provider.Kv{
-				TLS: &provider.KvTLS{},
-			},
-		},
-		ConsulCatalog: &provider.ConsulCatalog{},
-		Zookeeper:     &provider.Zookepper{},
-		Etcd: &provider.Etcd{
-			Kv: provider.Kv{
-				TLS: &provider.KvTLS{},
-			},
-		},
-		Boltdb: &provider.BoltDb{},
-	},
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-	false,
-}
-
-func init() {
-	traefikCmd.AddCommand(versionCmd)
-	traefikCmd.PersistentFlags().StringP("configFile", "c", "", "Configuration file to use (TOML, JSON, YAML, HCL).")
-	traefikCmd.PersistentFlags().StringP("graceTimeOut", "g", "10", "Timeout in seconds. Duration to give active requests a chance to finish during hot-reloads")
-	traefikCmd.PersistentFlags().String("accessLogsFile", "log/access.log", "Access logs file")
-	traefikCmd.PersistentFlags().String("traefikLogsFile", "log/traefik.log", "Traefik logs file")
-	traefikCmd.PersistentFlags().Var(&arguments.EntryPoints, "entryPoints", "Entrypoints definition using format: --entryPoints='Name:http Address::8000 Redirect.EntryPoint:https' --entryPoints='Name:https Address::4442 TLS:tests/traefik.crt,tests/traefik.key'")
-	traefikCmd.PersistentFlags().Var(&arguments.DefaultEntryPoints, "defaultEntryPoints", "Entrypoints to be used by frontends that do not specify any entrypoint")
-	traefikCmd.PersistentFlags().StringP("logLevel", "l", "ERROR", "Log level")
-	traefikCmd.PersistentFlags().DurationVar(&arguments.ProvidersThrottleDuration, "providersThrottleDuration", time.Duration(2*time.Second), "Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time.")
-	traefikCmd.PersistentFlags().Int("maxIdleConnsPerHost", 0, "If non-zero, controls the maximum idle (keep-alive) to keep per-host.  If zero, DefaultMaxIdleConnsPerHost is used")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.web, "web", false, "Enable Web backend")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Web.Address, "web.address", ":8080", "Web administration port")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Web.CertFile, "web.cerFile", "", "SSL certificate")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Web.KeyFile, "web.keyFile", "", "SSL certificate")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Web.ReadOnly, "web.readOnly", false, "Enable read only API")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.file, "file", false, "Enable File backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.File.Watch, "file.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.File.Filename, "file.filename", "", "Override default configuration template. For advanced users :)")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.docker, "docker", false, "Enable Docker backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Docker.Watch, "docker.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.Filename, "docker.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.Endpoint, "docker.endpoint", "unix:///var/run/docker.sock", "Docker server endpoint. Can be a tcp or a unix socket endpoint")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.Domain, "docker.domain", "", "Default domain used")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.dockerTLS, "docker.tls", false, "Enable Docker TLS support")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.TLS.CA, "docker.tls.ca", "", "TLS CA")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.TLS.Cert, "docker.tls.cert", "", "TLS cert")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Docker.TLS.Key, "docker.tls.key", "", "TLS key")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Docker.TLS.InsecureSkipVerify, "docker.tls.insecureSkipVerify", false, "TLS insecure skip verify")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.marathon, "marathon", false, "Enable Marathon backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Marathon.Watch, "marathon.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Marathon.Filename, "marathon.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Marathon.Endpoint, "marathon.endpoint", "http://127.0.0.1:8080", "Marathon server endpoint. You can also specify multiple endpoint for Marathon")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Marathon.Domain, "marathon.domain", "", "Default domain used")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Marathon.ExposedByDefault, "marathon.exposedByDefault", true, "Expose Marathon apps by default")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.consul, "consul", false, "Enable Consul backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Consul.Watch, "consul.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.Filename, "consul.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.Endpoint, "consul.endpoint", "127.0.0.1:8500", "Comma sepparated Consul server endpoints")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.Prefix, "consul.prefix", "/traefik", "Prefix used for KV store")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.consulTLS, "consul.tls", false, "Enable Consul TLS support")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.TLS.CA, "consul.tls.ca", "", "TLS CA")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.TLS.Cert, "consul.tls.cert", "", "TLS cert")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Consul.TLS.Key, "consul.tls.key", "", "TLS key")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Consul.TLS.InsecureSkipVerify, "consul.tls.insecureSkipVerify", false, "TLS insecure skip verify")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.consulCatalog, "consulCatalog", false, "Enable Consul catalog backend")
-	traefikCmd.PersistentFlags().StringVar(&arguments.ConsulCatalog.Domain, "consulCatalog.domain", "", "Default domain used")
-	traefikCmd.PersistentFlags().StringVar(&arguments.ConsulCatalog.Endpoint, "consulCatalog.endpoint", "127.0.0.1:8500", "Consul server endpoint")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.zookeeper, "zookeeper", false, "Enable Zookeeper backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Zookeeper.Watch, "zookeeper.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Zookeeper.Filename, "zookeeper.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Zookeeper.Endpoint, "zookeeper.endpoint", "127.0.0.1:2181", "Comma sepparated Zookeeper server endpoints")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Zookeeper.Prefix, "zookeeper.prefix", "/traefik", "Prefix used for KV store")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.etcd, "etcd", false, "Enable Etcd backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Etcd.Watch, "etcd.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.Filename, "etcd.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.Endpoint, "etcd.endpoint", "127.0.0.1:4001", "Comma sepparated Etcd server endpoints")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.Prefix, "etcd.prefix", "/traefik", "Prefix used for KV store")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.etcdTLS, "etcd.tls", false, "Enable Etcd TLS support")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.TLS.CA, "etcd.tls.ca", "", "TLS CA")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.TLS.Cert, "etcd.tls.cert", "", "TLS cert")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Etcd.TLS.Key, "etcd.tls.key", "", "TLS key")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Etcd.TLS.InsecureSkipVerify, "etcd.tls.insecureSkipVerify", false, "TLS insecure skip verify")
-
-	traefikCmd.PersistentFlags().BoolVar(&arguments.boltdb, "boltdb", false, "Enable Boltdb backend")
-	traefikCmd.PersistentFlags().BoolVar(&arguments.Boltdb.Watch, "boltdb.watch", true, "Watch provider")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Boltdb.Filename, "boltdb.filename", "", "Override default configuration template. For advanced users :)")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Boltdb.Endpoint, "boltdb.endpoint", "127.0.0.1:4001", "Boltdb server endpoint")
-	traefikCmd.PersistentFlags().StringVar(&arguments.Boltdb.Prefix, "boltdb.prefix", "/traefik", "Prefix used for KV store")
-
-	_ = viper.BindPFlag("configFile", traefikCmd.PersistentFlags().Lookup("configFile"))
-	_ = viper.BindPFlag("graceTimeOut", traefikCmd.PersistentFlags().Lookup("graceTimeOut"))
-	_ = viper.BindPFlag("logLevel", traefikCmd.PersistentFlags().Lookup("logLevel"))
-	// TODO: wait for this issue to be corrected: https://github.com/spf13/viper/issues/105
-	_ = viper.BindPFlag("providersThrottleDuration", traefikCmd.PersistentFlags().Lookup("providersThrottleDuration"))
-	_ = viper.BindPFlag("maxIdleConnsPerHost", traefikCmd.PersistentFlags().Lookup("maxIdleConnsPerHost"))
-	viper.SetDefault("providersThrottleDuration", time.Duration(2*time.Second))
-	viper.SetDefault("logLevel", "ERROR")
-	viper.SetDefault("MaxIdleConnsPerHost", 200)
-}
-
-func run() {
-	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
-
-	// load global configuration
-	globalConfiguration := LoadConfiguration()
-
-	http.DefaultTransport.(*http.Transport).MaxIdleConnsPerHost = globalConfiguration.MaxIdleConnsPerHost
-	loggerMiddleware := middlewares.NewLogger(globalConfiguration.AccessLogsFile)
-	defer loggerMiddleware.Close()
-
-	// logging
-	level, err := log.ParseLevel(strings.ToLower(globalConfiguration.LogLevel))
-	if err != nil {
-		log.Fatal("Error getting level", err)
-	}
-	log.SetLevel(level)
-
-	if len(globalConfiguration.TraefikLogsFile) > 0 {
-		fi, err := os.OpenFile(globalConfiguration.TraefikLogsFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0666)
-		defer func() {
-			if err := fi.Close(); err != nil {
-				log.Error("Error closinf file", err)
-			}
-		}()
-		if err != nil {
-			log.Fatal("Error opening file", err)
-		} else {
-			log.SetOutput(fi)
-			log.SetFormatter(&log.TextFormatter{DisableColors: true, FullTimestamp: true, DisableSorting: true})
-		}
-	} else {
-		log.SetFormatter(&log.TextFormatter{FullTimestamp: true, DisableSorting: true})
-	}
-	jsonConf, _ := json.Marshal(globalConfiguration)
-	log.Debugf("Global configuration loaded %s", string(jsonConf))
-	server := NewServer(*globalConfiguration)
-	server.Start()
-	defer server.Close()
-	log.Info("Shutting down")
-}

cmd/configuration.go

@@ -0,0 +1,195 @@
+package cmd
+
+import (
+	"time"
+
+	"github.com/containous/flaeg/parse"
+	"github.com/containous/traefik/pkg/config/static"
+	"github.com/containous/traefik/pkg/middlewares/accesslog"
+	"github.com/containous/traefik/pkg/ping"
+	"github.com/containous/traefik/pkg/provider/docker"
+	"github.com/containous/traefik/pkg/provider/file"
+	"github.com/containous/traefik/pkg/provider/kubernetes/ingress"
+	"github.com/containous/traefik/pkg/provider/marathon"
+	"github.com/containous/traefik/pkg/provider/rest"
+	"github.com/containous/traefik/pkg/tracing/datadog"
+	"github.com/containous/traefik/pkg/tracing/instana"
+	"github.com/containous/traefik/pkg/tracing/jaeger"
+	"github.com/containous/traefik/pkg/tracing/zipkin"
+	"github.com/containous/traefik/pkg/types"
+	jaegercli "github.com/uber/jaeger-client-go"
+)
+
+// TraefikConfiguration holds GlobalConfiguration and other stuff
+type TraefikConfiguration struct {
+	static.Configuration `mapstructure:",squash" export:"true"`
+	ConfigFile           string `short:"c" description:"Configuration file to use (TOML)." export:"true"`
+}
+
+// NewTraefikConfiguration creates a TraefikConfiguration with default values
+func NewTraefikConfiguration() *TraefikConfiguration {
+	return &TraefikConfiguration{
+		Configuration: static.Configuration{
+			Global: &static.Global{
+				CheckNewVersion: true,
+			},
+			EntryPoints: make(static.EntryPoints),
+			Providers: &static.Providers{
+				ProvidersThrottleDuration: parse.Duration(2 * time.Second),
+			},
+			ServersTransport: &static.ServersTransport{
+				MaxIdleConnsPerHost: 200,
+			},
+		},
+		ConfigFile: "",
+	}
+}
+
+// NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
+func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
+	// default File
+	var defaultFile file.Provider
+	defaultFile.Watch = true
+	defaultFile.Filename = "" // needs equivalent to  viper.ConfigFileUsed()
+
+	// default Ping
+	var defaultPing = ping.Handler{
+		EntryPoint: "traefik",
+	}
+
+	// default TraefikLog
+	defaultTraefikLog := types.TraefikLog{
+		Format:   "common",
+		FilePath: "",
+	}
+
+	// default AccessLog
+	defaultAccessLog := types.AccessLog{
+		Format:   accesslog.CommonFormat,
+		FilePath: "",
+		Filters:  &types.AccessLogFilters{},
+		Fields: &types.AccessLogFields{
+			DefaultMode: types.AccessLogKeep,
+			Headers: &types.FieldHeaders{
+				DefaultMode: types.AccessLogKeep,
+			},
+		},
+	}
+
+	// default Tracing
+	defaultTracing := static.Tracing{
+		Backend:       "jaeger",
+		ServiceName:   "traefik",
+		SpanNameLimit: 0,
+		Jaeger: &jaeger.Config{
+			SamplingServerURL:      "http://localhost:5778/sampling",
+			SamplingType:           "const",
+			SamplingParam:          1.0,
+			LocalAgentHostPort:     "127.0.0.1:6831",
+			Propagation:            "jaeger",
+			Gen128Bit:              false,
+			TraceContextHeaderName: jaegercli.TraceContextHeaderName,
+		},
+		Zipkin: &zipkin.Config{
+			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
+			SameSpan:     false,
+			ID128Bit:     true,
+			Debug:        false,
+			SampleRate:   1.0,
+		},
+		DataDog: &datadog.Config{
+			LocalAgentHostPort: "localhost:8126",
+			GlobalTag:          "",
+			Debug:              false,
+			PrioritySampling:   false,
+		},
+		Instana: &instana.Config{
+			LocalAgentHost: "localhost",
+			LocalAgentPort: 42699,
+			LogLevel:       "info",
+		},
+	}
+
+	// default ApiConfiguration
+	defaultAPI := static.API{
+		EntryPoint: "traefik",
+		Dashboard:  true,
+	}
+	defaultAPI.Statistics = &types.Statistics{
+		RecentErrors: 10,
+	}
+
+	// default Metrics
+	defaultMetrics := types.Metrics{
+		Prometheus: &types.Prometheus{
+			Buckets:    types.Buckets{0.1, 0.3, 1.2, 5},
+			EntryPoint: static.DefaultInternalEntryPointName,
+		},
+		Datadog: &types.Datadog{
+			Address:      "localhost:8125",
+			PushInterval: "10s",
+		},
+		StatsD: &types.Statsd{
+			Address:      "localhost:8125",
+			PushInterval: "10s",
+		},
+		InfluxDB: &types.InfluxDB{
+			Address:      "localhost:8089",
+			Protocol:     "udp",
+			PushInterval: "10s",
+		},
+	}
+
+	defaultResolver := types.HostResolverConfig{
+		CnameFlattening: false,
+		ResolvConfig:    "/etc/resolv.conf",
+		ResolvDepth:     5,
+	}
+
+	var defaultDocker docker.Provider
+	defaultDocker.Watch = true
+	defaultDocker.ExposedByDefault = true
+	defaultDocker.Endpoint = "unix:///var/run/docker.sock"
+	defaultDocker.SwarmMode = false
+	defaultDocker.SwarmModeRefreshSeconds = 15
+	defaultDocker.DefaultRule = docker.DefaultTemplateRule
+
+	// default Rest
+	var defaultRest rest.Provider
+	defaultRest.EntryPoint = static.DefaultInternalEntryPointName
+
+	// default Marathon
+	var defaultMarathon marathon.Provider
+	defaultMarathon.Watch = true
+	defaultMarathon.Endpoint = "http://127.0.0.1:8080"
+	defaultMarathon.ExposedByDefault = true
+	defaultMarathon.DialerTimeout = parse.Duration(5 * time.Second)
+	defaultMarathon.ResponseHeaderTimeout = parse.Duration(60 * time.Second)
+	defaultMarathon.TLSHandshakeTimeout = parse.Duration(5 * time.Second)
+	defaultMarathon.KeepAlive = parse.Duration(10 * time.Second)
+	defaultMarathon.DefaultRule = marathon.DefaultTemplateRule
+
+	// default Kubernetes
+	var defaultKubernetes ingress.Provider
+
+	defaultProviders := static.Providers{
+		File:       &defaultFile,
+		Docker:     &defaultDocker,
+		Rest:       &defaultRest,
+		Marathon:   &defaultMarathon,
+		Kubernetes: &defaultKubernetes,
+	}
+
+	return &TraefikConfiguration{
+		Configuration: static.Configuration{
+			Providers:    &defaultProviders,
+			Log:          &defaultTraefikLog,
+			AccessLog:    &defaultAccessLog,
+			Ping:         &defaultPing,
+			API:          &defaultAPI,
+			Metrics:      &defaultMetrics,
+			Tracing:      &defaultTracing,
+			HostResolver: &defaultResolver,
+		},
+	}
+}

cmd/context.go

@@ -0,0 +1,22 @@
+package cmd
+
+import (
+	"context"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+// ContextWithSignal creates a context canceled when SIGINT or SIGTERM are notified
+func ContextWithSignal(ctx context.Context) context.Context {
+	newCtx, cancel := context.WithCancel(ctx)
+	signals := make(chan os.Signal)
+	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		select {
+		case <-signals:
+			cancel()
+		}
+	}()
+	return newCtx
+}

cmd/healthcheck/healthcheck.go

@@ -0,0 +1,73 @@
+package healthcheck
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/containous/flaeg"
+	"github.com/containous/traefik/cmd"
+	"github.com/containous/traefik/pkg/config/static"
+)
+
+// NewCmd builds a new HealthCheck command
+func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
+	return &flaeg.Command{
+		Name:                  "healthcheck",
+		Description:           `Calls traefik /ping to check health (web provider must be enabled)`,
+		Config:                traefikConfiguration,
+		DefaultPointersConfig: traefikPointersConfiguration,
+		Run:                   runCmd(traefikConfiguration),
+		Metadata: map[string]string{
+			"parseAllSources": "true",
+		},
+	}
+}
+
+func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
+	return func() error {
+		traefikConfiguration.Configuration.SetEffectiveConfiguration(traefikConfiguration.ConfigFile)
+
+		resp, errPing := Do(traefikConfiguration.Configuration)
+		if errPing != nil {
+			fmt.Printf("Error calling healthcheck: %s\n", errPing)
+			os.Exit(1)
+		}
+		if resp.StatusCode != http.StatusOK {
+			fmt.Printf("Bad healthcheck status: %s\n", resp.Status)
+			os.Exit(1)
+		}
+		fmt.Printf("OK: %s\n", resp.Request.URL)
+		os.Exit(0)
+		return nil
+	}
+}
+
+// Do try to do a healthcheck
+func Do(staticConfiguration static.Configuration) (*http.Response, error) {
+	if staticConfiguration.Ping == nil {
+		return nil, errors.New("please enable `ping` to use health check")
+	}
+	pingEntryPoint, ok := staticConfiguration.EntryPoints[staticConfiguration.Ping.EntryPoint]
+	if !ok {
+		return nil, errors.New("missing `ping` entrypoint")
+	}
+
+	client := &http.Client{Timeout: 5 * time.Second}
+	protocol := "http"
+
+	// FIXME Handle TLS on ping etc...
+	// if pingEntryPoint.TLS != nil {
+	// 	protocol = "https"
+	// 	tr := &http.Transport{
+	// 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	// 	}
+	// 	client.Transport = tr
+	// }
+
+	path := "/"
+
+	return client.Head(protocol + "://" + pingEntryPoint.Address + path + "ping")
+}

cmd/storeconfig/storeconfig.go

@@ -0,0 +1,150 @@
+package storeconfig
+
+import (
+	"encoding/json"
+	"fmt"
+	stdlog "log"
+
+	"github.com/containous/flaeg"
+	"github.com/containous/staert"
+	"github.com/containous/traefik/cmd"
+)
+
+// NewCmd builds a new StoreConfig command
+func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
+	return &flaeg.Command{
+		Name:                  "storeconfig",
+		Description:           `Stores the static traefik configuration into a Key-value stores. Traefik will not start.`,
+		Config:                traefikConfiguration,
+		DefaultPointersConfig: traefikPointersConfiguration,
+		HideHelp:              true, // TODO storeconfig
+		Metadata: map[string]string{
+			"parseAllSources": "true",
+		},
+	}
+}
+
+// Run store config in KV
+func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) func() error {
+	return func() error {
+		if kv == nil {
+			return fmt.Errorf("error using command storeconfig, no Key-value store defined")
+		}
+
+		fileConfig := traefikConfiguration.Providers.File
+		if fileConfig != nil {
+			traefikConfiguration.Providers.File = nil
+			if len(fileConfig.Filename) == 0 && len(fileConfig.Directory) == 0 {
+				fileConfig.Filename = traefikConfiguration.ConfigFile
+			}
+		}
+
+		jsonConf, err := json.Marshal(traefikConfiguration.Configuration)
+		if err != nil {
+			return err
+		}
+		stdlog.Printf("Storing configuration: %s\n", jsonConf)
+
+		err = kv.StoreConfig(traefikConfiguration.Configuration)
+		if err != nil {
+			return err
+		}
+
+		if fileConfig != nil {
+			jsonConf, err = json.Marshal(fileConfig)
+			if err != nil {
+				return err
+			}
+
+			stdlog.Printf("Storing file configuration: %s\n", jsonConf)
+			config, err := fileConfig.BuildConfiguration()
+			if err != nil {
+				return err
+			}
+
+			stdlog.Print("Writing config to KV")
+			err = kv.StoreConfig(config)
+			if err != nil {
+				return err
+			}
+		}
+
+		// if traefikConfiguration.Configuration.ACME != nil {
+		// 	account := &acme.Account{}
+		//
+		// 	accountInitialized, err := keyExists(kv, traefikConfiguration.Configuration.ACME.Storage)
+		// 	if err != nil && err != store.ErrKeyNotFound {
+		// 		return err
+		// 	}
+		//
+		// 	// Check to see if ACME account object is already in kv store
+		// 	if traefikConfiguration.Configuration.ACME.OverrideCertificates || !accountInitialized {
+		//
+		// 		// Stores the ACME Account into the KV Store
+		// 		// Certificates in KV Stores will be overridden
+		// 		meta := cluster.NewMetadata(account)
+		// 		err = meta.Marshall()
+		// 		if err != nil {
+		// 			return err
+		// 		}
+		//
+		// 		source := staert.KvSource{
+		// 			Store:  kv,
+		// 			Prefix: traefikConfiguration.Configuration.ACME.Storage,
+		// 		}
+		//
+		// 		err = source.StoreConfig(meta)
+		// 		if err != nil {
+		// 			return err
+		// 		}
+		// 	}
+		// }
+		return nil
+	}
+}
+
+// func keyExists(source *staert.KvSource, key string) (bool, error) {
+// 	list, err := source.List(key, nil)
+// 	if err != nil {
+// 		return false, err
+// 	}
+//
+// 	return len(list) > 0, nil
+// }
+
+// CreateKvSource creates KvSource
+// TLS support is enable for Consul and Etcd backends
+func CreateKvSource(traefikConfiguration *cmd.TraefikConfiguration) (*staert.KvSource, error) {
+	var kv *staert.KvSource
+	// var kvStore store.Store
+	var err error
+
+	// TODO kv store
+	// switch {
+	// case traefikConfiguration.Providers.Consul != nil:
+	// 	kvStore, err = traefikConfiguration.Providers.Consul.CreateStore()
+	// 	kv = &staert.KvSource{
+	// 		Store:  kvStore,
+	// 		Prefix: traefikConfiguration.Providers.Consul.Prefix,
+	// 	}
+	// case traefikConfiguration.Providers.Etcd != nil:
+	// 	kvStore, err = traefikConfiguration.Providers.Etcd.CreateStore()
+	// 	kv = &staert.KvSource{
+	// 		Store:  kvStore,
+	// 		Prefix: traefikConfiguration.Providers.Etcd.Prefix,
+	// 	}
+	// case traefikConfiguration.Providers.Zookeeper != nil:
+	// 	kvStore, err = traefikConfiguration.Providers.Zookeeper.CreateStore()
+	// 	kv = &staert.KvSource{
+	// 		Store:  kvStore,
+	// 		Prefix: traefikConfiguration.Providers.Zookeeper.Prefix,
+	// 	}
+	// case traefikConfiguration.Providers.Boltdb != nil:
+	// 	kvStore, err = traefikConfiguration.Providers.Boltdb.CreateStore()
+	// 	kv = &staert.KvSource{
+	// 		Store:  kvStore,
+	// 		Prefix: traefikConfiguration.Providers.Boltdb.Prefix,
+	// 	}
+	// }
+	return kv, err
+}

cmd/traefik/traefik.go

@@ -0,0 +1,412 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	fmtlog "log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/containous/flaeg"
+	"github.com/containous/staert"
+	"github.com/containous/traefik/autogen/genstatic"
+	"github.com/containous/traefik/cmd"
+	"github.com/containous/traefik/cmd/healthcheck"
+	"github.com/containous/traefik/cmd/storeconfig"
+	cmdVersion "github.com/containous/traefik/cmd/version"
+	"github.com/containous/traefik/pkg/collector"
+	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/config/static"
+	"github.com/containous/traefik/pkg/job"
+	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider/aggregator"
+	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
+	"github.com/containous/traefik/pkg/safe"
+	"github.com/containous/traefik/pkg/server"
+	"github.com/containous/traefik/pkg/server/router"
+	traefiktls "github.com/containous/traefik/pkg/tls"
+	"github.com/containous/traefik/pkg/types"
+	"github.com/containous/traefik/pkg/version"
+	"github.com/coreos/go-systemd/daemon"
+	assetfs "github.com/elazarl/go-bindata-assetfs"
+	"github.com/ogier/pflag"
+	"github.com/sirupsen/logrus"
+	"github.com/vulcand/oxy/roundrobin"
+)
+
+func init() {
+	goDebug := os.Getenv("GODEBUG")
+	if len(goDebug) > 0 {
+		goDebug += ","
+	}
+	os.Setenv("GODEBUG", goDebug+"tls13=1")
+}
+
+// sliceOfStrings is the parser for []string
+type sliceOfStrings []string
+
+// String is the method to format the flag's value, part of the flag.Value interface.
+// The String method's output will be used in diagnostics.
+func (s *sliceOfStrings) String() string {
+	return strings.Join(*s, ",")
+}
+
+// Set is the method to set the flag value, part of the flag.Value interface.
+// Set's argument is a string to be parsed to set the flag.
+// It's a comma-separated list, so we split it.
+func (s *sliceOfStrings) Set(value string) error {
+	parts := strings.Split(value, ",")
+	if len(parts) == 0 {
+		return fmt.Errorf("bad []string format: %s", value)
+	}
+	for _, entrypoint := range parts {
+		*s = append(*s, entrypoint)
+	}
+	return nil
+}
+
+// Get return the []string
+func (s *sliceOfStrings) Get() interface{} {
+	return *s
+}
+
+// SetValue sets the []string with val
+func (s *sliceOfStrings) SetValue(val interface{}) {
+	*s = val.([]string)
+}
+
+// Type is type of the struct
+func (s *sliceOfStrings) Type() string {
+	return "sliceOfStrings"
+}
+
+func main() {
+	// traefik config inits
+	traefikConfiguration := cmd.NewTraefikConfiguration()
+	traefikPointersConfiguration := cmd.NewTraefikDefaultPointersConfiguration()
+
+	// traefik Command init
+	traefikCmd := &flaeg.Command{
+		Name: "traefik",
+		Description: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
+Complete documentation is available at https://traefik.io`,
+		Config:                traefikConfiguration,
+		DefaultPointersConfig: traefikPointersConfiguration,
+		Run: func() error {
+			return runCmd(&traefikConfiguration.Configuration, traefikConfiguration.ConfigFile)
+		},
+	}
+
+	// storeconfig Command init
+	storeConfigCmd := storeconfig.NewCmd(traefikConfiguration, traefikPointersConfiguration)
+
+	// init flaeg source
+	f := flaeg.New(traefikCmd, os.Args[1:])
+	// add custom parsers
+	f.AddParser(reflect.TypeOf(static.EntryPoints{}), &static.EntryPoints{})
+
+	f.AddParser(reflect.SliceOf(reflect.TypeOf("")), &sliceOfStrings{})
+	f.AddParser(reflect.TypeOf(traefiktls.FilesOrContents{}), &traefiktls.FilesOrContents{})
+	f.AddParser(reflect.TypeOf(types.Constraints{}), &types.Constraints{})
+	f.AddParser(reflect.TypeOf(k8s.Namespaces{}), &k8s.Namespaces{})
+	f.AddParser(reflect.TypeOf([]types.Domain{}), &types.Domains{})
+	f.AddParser(reflect.TypeOf(types.DNSResolvers{}), &types.DNSResolvers{})
+	f.AddParser(reflect.TypeOf(types.Buckets{}), &types.Buckets{})
+
+	f.AddParser(reflect.TypeOf(types.StatusCodes{}), &types.StatusCodes{})
+	f.AddParser(reflect.TypeOf(types.FieldNames{}), &types.FieldNames{})
+	f.AddParser(reflect.TypeOf(types.FieldHeaderNames{}), &types.FieldHeaderNames{})
+
+	// add commands
+	f.AddCommand(cmdVersion.NewCmd())
+	f.AddCommand(storeConfigCmd)
+	f.AddCommand(healthcheck.NewCmd(traefikConfiguration, traefikPointersConfiguration))
+
+	usedCmd, err := f.GetCommand()
+	if err != nil {
+		fmtlog.Println(err)
+		os.Exit(1)
+	}
+
+	if _, err := f.Parse(usedCmd); err != nil {
+		if err == pflag.ErrHelp {
+			os.Exit(0)
+		}
+		fmtlog.Printf("Error parsing command: %s\n", err)
+		os.Exit(1)
+	}
+
+	// staert init
+	s := staert.NewStaert(traefikCmd)
+	// init TOML source
+	toml := staert.NewTomlSource("traefik", []string{traefikConfiguration.ConfigFile, "/etc/traefik/", "$HOME/.traefik/", "."})
+
+	// add sources to staert
+	s.AddSource(toml)
+	s.AddSource(f)
+	if _, err := s.LoadConfig(); err != nil {
+		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
+		os.Exit(1)
+	}
+
+	traefikConfiguration.ConfigFile = toml.ConfigFileUsed()
+
+	kv, err := storeconfig.CreateKvSource(traefikConfiguration)
+	if err != nil {
+		fmtlog.Printf("Error creating kv store: %s\n", err)
+		os.Exit(1)
+	}
+	storeConfigCmd.Run = storeconfig.Run(kv, traefikConfiguration)
+
+	// if a KV Store is enable and no sub-command called in args
+	if kv != nil && usedCmd == traefikCmd {
+		s.AddSource(kv)
+		operation := func() error {
+			_, err := s.LoadConfig()
+			return err
+		}
+		notify := func(err error, time time.Duration) {
+			log.WithoutContext().Errorf("Load config error: %+v, retrying in %s", err, time)
+		}
+		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
+		if err != nil {
+			fmtlog.Printf("Error loading configuration: %s\n", err)
+			os.Exit(1)
+		}
+	}
+
+	if err := s.Run(); err != nil {
+		fmtlog.Printf("Error running traefik: %s\n", err)
+		os.Exit(1)
+	}
+
+	os.Exit(0)
+}
+
+func runCmd(staticConfiguration *static.Configuration, configFile string) error {
+	configureLogging(staticConfiguration)
+
+	if len(configFile) > 0 {
+		log.WithoutContext().Infof("Using TOML configuration file %s", configFile)
+	}
+
+	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment
+
+	if err := roundrobin.SetDefaultWeight(0); err != nil {
+		log.WithoutContext().Errorf("Could not set roundrobin default weight: %v", err)
+	}
+
+	staticConfiguration.SetEffectiveConfiguration(configFile)
+	staticConfiguration.ValidateConfiguration()
+
+	log.WithoutContext().Infof("Traefik version %s built on %s", version.Version, version.BuildDate)
+
+	jsonConf, err := json.Marshal(staticConfiguration)
+	if err != nil {
+		log.WithoutContext().Errorf("Could not marshal static configuration: %v", err)
+		log.WithoutContext().Debugf("Static configuration loaded [struct] %#v", staticConfiguration)
+	} else {
+		log.WithoutContext().Debugf("Static configuration loaded %s", string(jsonConf))
+	}
+
+	if staticConfiguration.API != nil && staticConfiguration.API.Dashboard {
+		staticConfiguration.API.DashboardAssets = &assetfs.AssetFS{Asset: genstatic.Asset, AssetInfo: genstatic.AssetInfo, AssetDir: genstatic.AssetDir, Prefix: "static"}
+	}
+
+	if staticConfiguration.Global.CheckNewVersion {
+		checkNewVersion()
+	}
+
+	stats(staticConfiguration)
+
+	providerAggregator := aggregator.NewProviderAggregator(*staticConfiguration.Providers)
+
+	acmeProvider, err := staticConfiguration.InitACMEProvider()
+	if err != nil {
+		log.WithoutContext().Errorf("Unable to initialize ACME provider: %v", err)
+	} else if acmeProvider != nil {
+		if err := providerAggregator.AddProvider(acmeProvider); err != nil {
+			log.WithoutContext().Errorf("Unable to add ACME provider to the providers list: %v", err)
+			acmeProvider = nil
+		}
+	}
+
+	serverEntryPointsTCP := make(server.TCPEntryPoints)
+	for entryPointName, config := range staticConfiguration.EntryPoints {
+		ctx := log.With(context.Background(), log.Str(log.EntryPointName, entryPointName))
+		serverEntryPointsTCP[entryPointName], err = server.NewTCPEntryPoint(ctx, config)
+		if err != nil {
+			return fmt.Errorf("error while building entryPoint %s: %v", entryPointName, err)
+		}
+		serverEntryPointsTCP[entryPointName].RouteAppenderFactory = router.NewRouteAppenderFactory(*staticConfiguration, entryPointName, acmeProvider)
+
+	}
+
+	tlsManager := traefiktls.NewManager()
+
+	if acmeProvider != nil {
+		acmeProvider.SetTLSManager(tlsManager)
+		if acmeProvider.TLSChallenge != nil &&
+			acmeProvider.HTTPChallenge == nil &&
+			acmeProvider.DNSChallenge == nil {
+			tlsManager.TLSAlpnGetter = acmeProvider.GetTLSALPNCertificate
+		}
+	}
+
+	svr := server.NewServer(*staticConfiguration, providerAggregator, serverEntryPointsTCP, tlsManager)
+
+	if acmeProvider != nil && acmeProvider.OnHostRule {
+		acmeProvider.SetConfigListenerChan(make(chan config.Configuration))
+		svr.AddListener(acmeProvider.ListenConfiguration)
+	}
+	ctx := cmd.ContextWithSignal(context.Background())
+
+	if staticConfiguration.Ping != nil {
+		staticConfiguration.Ping.WithContext(ctx)
+	}
+
+	svr.Start(ctx)
+	defer svr.Close()
+
+	sent, err := daemon.SdNotify(false, "READY=1")
+	if !sent && err != nil {
+		log.WithoutContext().Errorf("Failed to notify: %v", err)
+	}
+
+	t, err := daemon.SdWatchdogEnabled(false)
+	if err != nil {
+		log.WithoutContext().Errorf("Could not enable Watchdog: %v", err)
+	} else if t != 0 {
+		// Send a ping each half time given
+		t /= 2
+		log.WithoutContext().Infof("Watchdog activated with timer duration %s", t)
+		safe.Go(func() {
+			tick := time.Tick(t)
+			for range tick {
+				_, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				if staticConfiguration.Ping == nil || errHealthCheck == nil {
+					if ok, _ := daemon.SdNotify(false, "WATCHDOG=1"); !ok {
+						log.WithoutContext().Error("Fail to tick watchdog")
+					}
+				} else {
+					log.WithoutContext().Error(errHealthCheck)
+				}
+			}
+		})
+	}
+
+	svr.Wait()
+	log.WithoutContext().Info("Shutting down")
+	logrus.Exit(0)
+	return nil
+}
+
+func configureLogging(staticConfiguration *static.Configuration) {
+	// configure default log flags
+	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
+
+	// configure log level
+	// an explicitly defined log level always has precedence. if none is
+	// given and debug mode is disabled, the default is ERROR, and DEBUG
+	// otherwise.
+	var levelStr string
+	if staticConfiguration.Log != nil {
+		levelStr = strings.ToLower(staticConfiguration.Log.LogLevel)
+	}
+	if levelStr == "" {
+		levelStr = "error"
+		if staticConfiguration.Global.Debug {
+			levelStr = "debug"
+		}
+	}
+	level, err := logrus.ParseLevel(levelStr)
+	if err != nil {
+		log.WithoutContext().Errorf("Error getting level: %v", err)
+	}
+	log.SetLevel(level)
+
+	var logFile string
+	if staticConfiguration.Log != nil && len(staticConfiguration.Log.FilePath) > 0 {
+		logFile = staticConfiguration.Log.FilePath
+	}
+
+	// configure log format
+	var formatter logrus.Formatter
+	if staticConfiguration.Log != nil && staticConfiguration.Log.Format == "json" {
+		formatter = &logrus.JSONFormatter{}
+	} else {
+		disableColors := len(logFile) > 0
+		formatter = &logrus.TextFormatter{DisableColors: disableColors, FullTimestamp: true, DisableSorting: true}
+	}
+	log.SetFormatter(formatter)
+
+	if len(logFile) > 0 {
+		dir := filepath.Dir(logFile)
+
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			log.WithoutContext().Errorf("Failed to create log path %s: %s", dir, err)
+		}
+
+		err = log.OpenFile(logFile)
+		logrus.RegisterExitHandler(func() {
+			if err := log.CloseFile(); err != nil {
+				log.WithoutContext().Errorf("Error while closing log: %v", err)
+			}
+		})
+		if err != nil {
+			log.WithoutContext().Errorf("Error while opening log file %s: %v", logFile, err)
+		}
+	}
+}
+
+func checkNewVersion() {
+	ticker := time.Tick(24 * time.Hour)
+	safe.Go(func() {
+		for time.Sleep(10 * time.Minute); ; <-ticker {
+			version.CheckNewVersion()
+		}
+	})
+}
+
+func stats(staticConfiguration *static.Configuration) {
+	if staticConfiguration.Global.SendAnonymousUsage == nil {
+		log.WithoutContext().Error(`
+You haven't specify the sendAnonymousUsage option, it will be enable by default.
+`)
+		sendAnonymousUsage := true
+		staticConfiguration.Global.SendAnonymousUsage = &sendAnonymousUsage
+	}
+
+	if *staticConfiguration.Global.SendAnonymousUsage {
+		log.WithoutContext().Info(`
+Stats collection is enabled.
+Many thanks for contributing to Traefik's improvement by allowing us to receive anonymous information from your configuration.
+Help us improve Traefik by leaving this feature on :)
+More details on: https://docs.traefik.io/basics/#collected-data
+`)
+		collect(staticConfiguration)
+	} else {
+		log.WithoutContext().Info(`
+Stats collection is disabled.
+Help us improve Traefik by turning this feature on :)
+More details on: https://docs.traefik.io/basics/#collected-data
+`)
+	}
+}
+
+func collect(staticConfiguration *static.Configuration) {
+	ticker := time.Tick(24 * time.Hour)
+	safe.Go(func() {
+		for time.Sleep(10 * time.Minute); ; <-ticker {
+			if err := collector.Collect(staticConfiguration); err != nil {
+				log.WithoutContext().Debug(err)
+			}
+		}
+	})
+}

cmd/version/version.go

@@ -0,0 +1,62 @@
+package version
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"runtime"
+	"text/template"
+
+	"github.com/containous/flaeg"
+	"github.com/containous/traefik/pkg/version"
+)
+
+var versionTemplate = `Version:      {{.Version}}
+Codename:     {{.Codename}}
+Go version:   {{.GoVersion}}
+Built:        {{.BuildTime}}
+OS/Arch:      {{.Os}}/{{.Arch}}`
+
+// NewCmd builds a new Version command
+func NewCmd() *flaeg.Command {
+	return &flaeg.Command{
+		Name:                  "version",
+		Description:           `Print version`,
+		Config:                struct{}{},
+		DefaultPointersConfig: struct{}{},
+		Run: func() error {
+			if err := GetPrint(os.Stdout); err != nil {
+				return err
+			}
+			fmt.Print("\n")
+			return nil
+
+		},
+	}
+}
+
+// GetPrint write Printable version
+func GetPrint(wr io.Writer) error {
+	tmpl, err := template.New("").Parse(versionTemplate)
+	if err != nil {
+		return err
+	}
+
+	v := struct {
+		Version   string
+		Codename  string
+		GoVersion string
+		BuildTime string
+		Os        string
+		Arch      string
+	}{
+		Version:   version.Version,
+		Codename:  version.Codename,
+		GoVersion: runtime.Version(),
+		BuildTime: version.BuildDate,
+		Os:        runtime.GOOS,
+		Arch:      runtime.GOARCH,
+	}
+
+	return tmpl.Execute(wr, v)
+}

configuration.go

@@ -1,298 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	fmtlog "log"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/containous/traefik/acme"
-	"github.com/containous/traefik/provider"
-	"github.com/containous/traefik/types"
-	"github.com/mitchellh/mapstructure"
-	"github.com/spf13/viper"
-)
-
-// GlobalConfiguration holds global configuration (with providers, etc.).
-// It's populated from the traefik configuration file passed as an argument to the binary.
-type GlobalConfiguration struct {
-	GraceTimeOut              int64
-	AccessLogsFile            string
-	TraefikLogsFile           string
-	LogLevel                  string
-	EntryPoints               EntryPoints
-	ACME                      *acme.ACME
-	DefaultEntryPoints        DefaultEntryPoints
-	ProvidersThrottleDuration time.Duration
-	MaxIdleConnsPerHost       int
-	Retry                     *Retry
-	Docker                    *provider.Docker
-	File                      *provider.File
-	Web                       *WebProvider
-	Marathon                  *provider.Marathon
-	Consul                    *provider.Consul
-	ConsulCatalog             *provider.ConsulCatalog
-	Etcd                      *provider.Etcd
-	Zookeeper                 *provider.Zookepper
-	Boltdb                    *provider.BoltDb
-}
-
-// DefaultEntryPoints holds default entry points
-type DefaultEntryPoints []string
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (dep *DefaultEntryPoints) String() string {
-	return fmt.Sprintf("%#v", dep)
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (dep *DefaultEntryPoints) Set(value string) error {
-	entrypoints := strings.Split(value, ",")
-	if len(entrypoints) == 0 {
-		return errors.New("Bad DefaultEntryPoints format: " + value)
-	}
-	for _, entrypoint := range entrypoints {
-		*dep = append(*dep, entrypoint)
-	}
-	return nil
-}
-
-// Type is type of the struct
-func (dep *DefaultEntryPoints) Type() string {
-	return fmt.Sprint("defaultentrypoints²")
-}
-
-// EntryPoints holds entry points configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoints map[string]*EntryPoint
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (ep *EntryPoints) String() string {
-	return ""
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (ep *EntryPoints) Set(value string) error {
-	regex := regexp.MustCompile("(?:Name:(?P<Name>\\S*))\\s*(?:Address:(?P<Address>\\S*))?\\s*(?:TLS:(?P<TLS>\\S*))?\\s*(?:Redirect.EntryPoint:(?P<RedirectEntryPoint>\\S*))?\\s*(?:Redirect.Regex:(?P<RedirectRegex>\\S*))?\\s*(?:Redirect.Replacement:(?P<RedirectReplacement>\\S*))?")
-	match := regex.FindAllStringSubmatch(value, -1)
-	if match == nil {
-		return errors.New("Bad EntryPoints format: " + value)
-	}
-	matchResult := match[0]
-	result := make(map[string]string)
-	for i, name := range regex.SubexpNames() {
-		if i != 0 {
-			result[name] = matchResult[i]
-		}
-	}
-	var tls *TLS
-	if len(result["TLS"]) > 0 {
-		certs := Certificates{}
-		if err := certs.Set(result["TLS"]); err != nil {
-			return err
-		}
-		tls = &TLS{
-			Certificates: certs,
-		}
-	}
-	var redirect *Redirect
-	if len(result["RedirectEntryPoint"]) > 0 || len(result["RedirectRegex"]) > 0 || len(result["RedirectReplacement"]) > 0 {
-		redirect = &Redirect{
-			EntryPoint:  result["RedirectEntryPoint"],
-			Regex:       result["RedirectRegex"],
-			Replacement: result["RedirectReplacement"],
-		}
-	}
-
-	(*ep)[result["Name"]] = &EntryPoint{
-		Address:  result["Address"],
-		TLS:      tls,
-		Redirect: redirect,
-	}
-
-	return nil
-}
-
-// Type is type of the struct
-func (ep *EntryPoints) Type() string {
-	return fmt.Sprint("entrypoints²")
-}
-
-// EntryPoint holds an entry point configuration of the reverse proxy (ip, port, TLS...)
-type EntryPoint struct {
-	Network  string
-	Address  string
-	TLS      *TLS
-	Redirect *Redirect
-}
-
-// Redirect configures a redirection of an entry point to another, or to an URL
-type Redirect struct {
-	EntryPoint  string
-	Regex       string
-	Replacement string
-}
-
-// TLS configures TLS for an entry point
-type TLS struct {
-	Certificates Certificates
-}
-
-// Certificates defines traefik certificates type
-type Certificates []Certificate
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (certs *Certificates) String() string {
-	if len(*certs) == 0 {
-		return ""
-	}
-	return (*certs)[0].CertFile + "," + (*certs)[0].KeyFile
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (certs *Certificates) Set(value string) error {
-	files := strings.Split(value, ",")
-	if len(files) != 2 {
-		return errors.New("Bad certificates format: " + value)
-	}
-	*certs = append(*certs, Certificate{
-		CertFile: files[0],
-		KeyFile:  files[1],
-	})
-	return nil
-}
-
-// Type is type of the struct
-func (certs *Certificates) Type() string {
-	return fmt.Sprint("certificates")
-}
-
-// Certificate holds a SSL cert/key pair
-type Certificate struct {
-	CertFile string
-	KeyFile  string
-}
-
-// Retry contains request retry config
-type Retry struct {
-	Attempts int
-	MaxMem   int64
-}
-
-// NewGlobalConfiguration returns a GlobalConfiguration with default values.
-func NewGlobalConfiguration() *GlobalConfiguration {
-	return new(GlobalConfiguration)
-}
-
-// LoadConfiguration returns a GlobalConfiguration.
-func LoadConfiguration() *GlobalConfiguration {
-	configuration := NewGlobalConfiguration()
-	viper.SetEnvPrefix("traefik")
-	viper.SetConfigType("toml")
-	viper.AutomaticEnv()
-	if len(viper.GetString("configFile")) > 0 {
-		viper.SetConfigFile(viper.GetString("configFile"))
-	} else {
-		viper.SetConfigName("traefik") // name of config file (without extension)
-	}
-	viper.AddConfigPath("/etc/traefik/")   // path to look for the config file in
-	viper.AddConfigPath("$HOME/.traefik/") // call multiple times to add many search paths
-	viper.AddConfigPath(".")               // optionally look for config in the working directory
-	if err := viper.ReadInConfig(); err != nil {
-		fmtlog.Fatalf("Error reading file: %s", err)
-	}
-
-	if len(arguments.EntryPoints) > 0 {
-		viper.Set("entryPoints", arguments.EntryPoints)
-	}
-	if len(arguments.DefaultEntryPoints) > 0 {
-		viper.Set("defaultEntryPoints", arguments.DefaultEntryPoints)
-	}
-	if arguments.web {
-		viper.Set("web", arguments.Web)
-	}
-	if arguments.file {
-		viper.Set("file", arguments.File)
-	}
-	if !arguments.dockerTLS {
-		arguments.Docker.TLS = nil
-	}
-	if arguments.docker {
-		viper.Set("docker", arguments.Docker)
-	}
-	if arguments.marathon {
-		viper.Set("marathon", arguments.Marathon)
-	}
-	if !arguments.consulTLS {
-		arguments.Consul.TLS = nil
-	}
-	if arguments.consul {
-		viper.Set("consul", arguments.Consul)
-	}
-	if arguments.consulCatalog {
-		viper.Set("consulCatalog", arguments.ConsulCatalog)
-	}
-	if arguments.zookeeper {
-		viper.Set("zookeeper", arguments.Zookeeper)
-	}
-	if !arguments.etcdTLS {
-		arguments.Etcd.TLS = nil
-	}
-	if arguments.etcd {
-		viper.Set("etcd", arguments.Etcd)
-	}
-	if arguments.boltdb {
-		viper.Set("boltdb", arguments.Boltdb)
-	}
-	if err := unmarshal(&configuration); err != nil {
-
-		fmtlog.Fatalf("Error reading file: %s", err)
-	}
-
-	if len(configuration.EntryPoints) == 0 {
-		configuration.EntryPoints = make(map[string]*EntryPoint)
-		configuration.EntryPoints["http"] = &EntryPoint{
-			Address: ":80",
-		}
-		configuration.DefaultEntryPoints = []string{"http"}
-	}
-
-	if configuration.File != nil && len(configuration.File.Filename) == 0 {
-		// no filename, setting to global config file
-		configuration.File.Filename = viper.ConfigFileUsed()
-	}
-
-	return configuration
-}
-
-func unmarshal(rawVal interface{}) error {
-	config := &mapstructure.DecoderConfig{
-		DecodeHook:       mapstructure.StringToTimeDurationHookFunc(),
-		Metadata:         nil,
-		Result:           rawVal,
-		WeaklyTypedInput: true,
-	}
-
-	decoder, err := mapstructure.NewDecoder(config)
-	if err != nil {
-		return err
-	}
-
-	err = decoder.Decode(viper.AllSettings())
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-type configs map[string]*types.Configuration

contrib/scripts/dumpcerts.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# Copyright (c) 2017 Brian 'redbeard' Harrington <redbeard@dead-city.org>
+#
+# dumpcerts.sh - A simple utility to explode a Traefik acme.json file into a
+#                directory of certificates and a private key
+#
+# Usage - dumpcerts.sh /etc/traefik/acme.json /etc/ssl/
+#
+# Dependencies -
+#   util-linux
+#   openssl
+#   jq
+# The MIT License (MIT)
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+# Exit codes:
+# 1 - A component is missing or could not be read
+# 2 - There was a problem reading acme.json
+# 4 - The destination certificate directory does not exist
+# 8 - Missing private key
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+USAGE="$(basename "$0") <path to acme> <destination cert directory>"
+
+# Platform variations
+case "$(uname)" in
+	'Linux')
+		# On Linux, -d should always work. --decode does not work with Alpine's busybox-binary
+		CMD_DECODE_BASE64="base64 -d"
+		;;
+	*)
+		# Max OS-X supports --decode and -D, but --decode may be supported by other platforms as well.
+		CMD_DECODE_BASE64="base64 --decode"
+		;;
+esac
+
+# Allow us to exit on a missing jq binary
+exit_jq() {
+	echo "
+You must have the binary 'jq' to use this.
+jq is available at: https://stedolan.github.io/jq/download/
+
+${USAGE}" >&2
+	exit 1
+}
+
+bad_acme() {
+	echo "
+There was a problem parsing your acme.json file.
+
+${USAGE}" >&2
+	exit 2
+}
+
+if [ $# -ne 2 ]; then
+	echo "
+Insufficient number of parameters.
+
+${USAGE}" >&2
+	exit 1
+fi
+
+readonly acmefile="${1}"
+readonly certdir="${2%/}"
+
+if [ ! -r "${acmefile}" ]; then
+	echo "
+There was a problem reading from '${acmefile}'
+We need to read this file to explode the JSON bundle... exiting.
+
+${USAGE}" >&2
+	exit 2
+fi
+
+
+if [ ! -d "${certdir}" ]; then
+	echo "
+Path ${certdir} does not seem to be a directory
+We need a directory in which to explode the JSON bundle... exiting.
+
+${USAGE}" >&2
+	exit 4
+fi
+
+jq=$(command -v jq) || exit_jq
+
+priv=$(${jq} -e -r '.Account.PrivateKey' "${acmefile}") || bad_acme
+
+if [ ! -n "${priv}" ]; then
+	echo "
+There didn't seem to be a private key in ${acmefile}.
+Please ensure that there is a key in this file and try again." >&2
+	exit 8
+fi
+
+# If they do not exist, create the needed subdirectories for our assets
+# and place each in a variable for later use, normalizing the path
+mkdir -p "${certdir}"/{certs,private}
+
+pdir="${certdir}/private/"
+cdir="${certdir}/certs/"
+
+# Save the existing umask, change the default mode to 600, then
+# after writing the private key switch it back to the default
+oldumask=$(umask)
+umask 177
+trap 'umask ${oldumask}' EXIT
+
+# traefik stores the private key in stripped base64 format but the certificates
+# bundled as a base64 object without stripping headers.  This normalizes the
+# headers and formatting.
+#
+# In testing this out it was a balance between the following mechanisms:
+# gawk:
+#  echo ${priv} | awk 'BEGIN {print "-----BEGIN RSA PRIVATE KEY-----"}
+#     {gsub(/.{64}/,"&\n")}1
+#     END {print "-----END RSA PRIVATE KEY-----"}' > "${pdir}/letsencrypt.key"
+#
+# openssl:
+# echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
+#   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
+#
+# and sed:
+# echo "-----BEGIN RSA PRIVATE KEY-----" > "${pdir}/letsencrypt.key"
+# echo ${priv} | sed -E 's/(.{64})/\1\n/g' >> "${pdir}/letsencrypt.key"
+# sed -i '$ d' "${pdir}/letsencrypt.key"
+# echo "-----END RSA PRIVATE KEY-----" >> "${pdir}/letsencrypt.key"
+# openssl rsa -noout -in "${pdir}/letsencrypt.key" -check  # To check if the key is valid
+
+# In the end, openssl was chosen because most users will need this script
+# *because* of openssl combined with the fact that it will refuse to write the
+# key if it does not parse out correctly. The other mechanisms were left as
+# comments so that the user can choose the mechanism most appropriate to them.
+echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
+   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
+
+# Process the certificates for each of the domains in acme.json
+domains=$(jq -r '.Certificates[].Domain.Main' ${acmefile}) || bad_acme
+for domain in $domains; do
+	# Traefik stores a cert bundle for each domain.  Within this cert
+	# bundle there is both proper the certificate and the Let's Encrypt CA
+	echo "Extracting cert bundle for ${domain}"
+	cert=$(jq -e -r --arg domain "$domain" '.Certificates[] |
+         	select (.Domain.Main == $domain )| .Certificate' ${acmefile}) || bad_acme
+	echo "${cert}" | ${CMD_DECODE_BASE64} > "${cdir}/${domain}.crt"
+
+	echo "Extracting private key for ${domain}"
+	key=$(jq -e -r --arg domain "$domain" '.Certificates[] |
+		select (.Domain.Main == $domain )| .Key' ${acmefile}) || bad_acme
+	echo "${key}" | ${CMD_DECODE_BASE64} > "${pdir}/${domain}.key"
+done

contrib/systemd/traefik.service

@@ -1,6 +1,41 @@
 [Unit]
 Description=Traefik
+Documentation=https://docs.traefik.io
+#After=network-online.target
+#AssertFileIsExecutable=/usr/bin/traefik
+#AssertPathExists=/etc/traefik/traefik.toml
 
 [Service]
-ExecStart=/usr/bin/traefik --configFile=/etc/traefik.toml
-Restart=on-failure
+# Run traefik as its own user (create new user with: useradd -r -s /bin/false -U -M traefik)
+#User=traefik
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+# configure service behavior
+Type=notify
+#ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.toml
+Restart=always
+WatchdogSec=1s
+
+# lock down system access
+# prohibit any operating system and configuration modification
+#ProtectSystem=strict
+# create separate, new (and empty) /tmp and /var/tmp filesystems
+#PrivateTmp=true
+# make /home directories inaccessible
+#ProtectHome=true
+# turns off access to physical devices (/dev/...)
+#PrivateDevices=true
+# make kernel settings (procfs and sysfs) read-only
+#ProtectKernelTunables=true
+# make cgroups /sys/fs/cgroup read-only
+#ProtectControlGroups=true
+
+# allow writing of acme.json
+#ReadWritePaths=/etc/traefik/acme.json
+# depending on log and entrypoint configuration, you may need to allow writing to other paths, too
+
+# limit number of processes in this unit
+#LimitNPROC=1
+
+[Install]
+WantedBy=multi-user.target

docs/.dockerignore

@@ -0,0 +1 @@
+site/

docs/.markdownlint.json

@@ -0,0 +1,9 @@
+{
+    "no-hard-tabs": false,
+    "MD007": { "indent": 4 },
+    "MD009": false,
+    "MD013": false,
+    "MD026": false,
+    "MD033": false,
+    "MD034": false
+}

docs/CNAME

@@ -0,0 +1 @@
+docs.traefik.io

docs/Makefile

@@ -0,0 +1,52 @@
+
+#######
+# This Makefile contains all targets related to the documentation
+#######
+
+DOCS_VERIFY_SKIP ?= false
+DOCS_LINT_SKIP ?= false
+
+TRAEFIK_DOCS_BUILD_IMAGE ?= traefik-docs
+TRAEFIK_DOCS_CHECK_IMAGE ?= $(TRAEFIK_DOCS_BUILD_IMAGE)-check
+
+SITE_DIR := $(CURDIR)/site
+
+DOCKER_RUN_DOC_PORT := 8000
+DOCKER_RUN_DOC_MOUNTS := -v $(CURDIR):/mkdocs 
+DOCKER_RUN_DOC_OPTS := --rm $(DOCKER_RUN_DOC_MOUNTS) -p $(DOCKER_RUN_DOC_PORT):8000
+
+# Default: generates the documentation into $(SITE_DIR)
+docs: docs-clean docs-image docs-lint docs-build docs-verify
+
+# Writer Mode: build and serve docs on http://localhost:8000 with livereload
+docs-serve: docs-image
+	docker run  $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOCS_BUILD_IMAGE) mkdocs serve
+
+# Utilities Targets for each step
+docs-image:
+	docker build -t $(TRAEFIK_DOCS_BUILD_IMAGE) -f docs.Dockerfile ./
+
+docs-build: docs-image
+	docker run $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOCS_BUILD_IMAGE) sh -c "mkdocs build \
+		&& chown -R $(shell id -u):$(shell id -g) ./site"
+
+docs-verify: docs-build
+	@if [ "$(DOCS_VERIFY_SKIP)" != "true" ]; then \
+		docker build -t $(TRAEFIK_DOCS_CHECK_IMAGE) -f check.Dockerfile ./; \
+		docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOCS_CHECK_IMAGE) /verify.sh; \
+	else \
+		echo "DOCS_VERIFY_SKIP is true: no verification done."; \
+	fi
+
+docs-lint:
+	@if [ "$(DOCS_LINT_SKIP)" != "true" ]; then \
+		docker build -t $(TRAEFIK_DOCS_CHECK_IMAGE) -f check.Dockerfile ./ && \
+		docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOCS_CHECK_IMAGE) /lint.sh; \
+	else \
+		echo "DOCS_LINT_SKIP is true: no linting done."; \
+	fi
+
+docs-clean:
+	rm -rf $(SITE_DIR)
+
+.PHONY: all docs-verify docs docs-clean docs-build docs-lint

docs/check.Dockerfile

@@ -0,0 +1,43 @@
+
+FROM alpine:3.9 as alpine
+
+# The "build-dependencies" virtual package provides build tools for html-proofer installation.
+# It compile ruby-nokogiri, because alpine native version is always out of date
+# This virtual package is cleaned at the end.
+RUN apk --no-cache --no-progress add \
+    libcurl \
+    ruby \
+    ruby-bigdecimal \
+    ruby-etc \
+    ruby-ffi \
+    ruby-json \
+  && apk add --no-cache --virtual build-dependencies \
+    build-base \
+    libcurl \
+    libxml2-dev \
+    libxslt-dev \
+    ruby-dev \
+  && gem install --no-document html-proofer -v 3.10.2 \
+  && apk del build-dependencies
+
+# After Ruby, some NodeJS YAY!
+RUN apk --no-cache --no-progress add \
+    git \
+    nodejs \
+    npm \
+  && npm install markdownlint@0.12.0 markdownlint-cli@0.13.0 --global
+
+# Finally the shell tools we need for later
+# tini helps to terminate properly all the parallelized tasks when sending CTRL-C
+RUN apk --no-cache --no-progress add \
+    ca-certificates \
+    curl \
+    tini
+
+COPY ./scripts/verify.sh /verify.sh
+COPY ./scripts/lint.sh /lint.sh
+
+WORKDIR /app
+VOLUME ["/tmp","/app"]
+
+ENTRYPOINT ["/sbin/tini","-g","sh"]

docs/content/assets/js/extra.js

@@ -0,0 +1,4 @@
+/* Highlight */
+(function(hljs) {
+    hljs.initHighlightingOnLoad();
+})(hljs);

docs/content/assets/js/hljs/LICENSE

@@ -0,0 +1,24 @@
+Copyright (c) 2006, Ivan Sagalaev
+All rights reserved.
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of highlight.js nor the names of its contributors 
+      may be used to endorse or promote products derived from this software 
+      without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE REGENTS AND CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

docs/content/assets/styles/atom-one-light.css

@@ -0,0 +1,96 @@
+/*
+
+Atom One Light by Daniel Gamage
+Original One Light Syntax theme from https://github.com/atom/one-light-syntax
+
+base:    #fafafa
+mono-1:  #383a42
+mono-2:  #686b77
+mono-3:  #a0a1a7
+hue-1:   #0184bb
+hue-2:   #4078f2
+hue-3:   #a626a4
+hue-4:   #50a14f
+hue-5:   #e45649
+hue-5-2: #c91243
+hue-6:   #986801
+hue-6-2: #c18401
+
+*/
+
+.hljs {
+  display: block;
+  overflow-x: auto;
+  padding: 0.5em;
+  color: #383a42;
+  background: #fafafa;
+}
+
+.hljs-comment,
+.hljs-quote {
+  color: #a0a1a7;
+  font-style: italic;
+}
+
+.hljs-doctag,
+.hljs-keyword,
+.hljs-formula {
+  color: #a626a4;
+}
+
+.hljs-section,
+.hljs-name,
+.hljs-selector-tag,
+.hljs-deletion,
+.hljs-subst {
+  color: #e45649;
+}
+
+.hljs-literal {
+  color: #0184bb;
+}
+
+.hljs-string,
+.hljs-regexp,
+.hljs-addition,
+.hljs-attribute,
+.hljs-meta-string {
+  color: #50a14f;
+}
+
+.hljs-built_in,
+.hljs-class .hljs-title {
+  color: #c18401;
+}
+
+.hljs-attr,
+.hljs-variable,
+.hljs-template-variable,
+.hljs-type,
+.hljs-selector-class,
+.hljs-selector-attr,
+.hljs-selector-pseudo,
+.hljs-number {
+  color: #986801;
+}
+
+.hljs-symbol,
+.hljs-bullet,
+.hljs-link,
+.hljs-meta,
+.hljs-selector-id,
+.hljs-title {
+  color: #4078f2;
+}
+
+.hljs-emphasis {
+  font-style: italic;
+}
+
+.hljs-strong {
+  font-weight: bold;
+}
+
+.hljs-link {
+  text-decoration: underline;
+}

docs/content/assets/styles/extra.css

@@ -0,0 +1,59 @@
+@import url('https://fonts.googleapis.com/css?family=Noto+Sans|Noto+Serif');
+
+.md-logo img {
+    background-color: white;
+    border-radius: 50%;
+    width: 30px;
+    height: 30px;
+}
+
+/* Fix for Chrome */
+.md-typeset__table td code {
+    word-break: unset;
+}
+
+.md-typeset__table tr :nth-child(1) {
+    word-wrap: break-word;
+    max-width: 30em;
+}
+
+body {
+    font-family: 'Noto Sans', sans-serif;
+}
+
+h1 {
+    font-weight: bold !important;
+    color: rgba(0,0,0,.9) !important;
+}
+
+h2 {
+    font-weight: bold !important;
+}
+
+h3 {
+    font-weight: bold !important;
+}
+
+figcaption {
+    text-align: center;
+    font-size: 0.8em;
+    font-style: italic;
+    color: #8D909F;
+}
+
+p.subtitle {
+    color: rgba(0,0,0,.54);
+    padding-top: 0;
+    margin-top: -2em;
+    font-weight: bold;
+    font-size: 1.25em;
+}
+
+.markdown-body .task-list-item {
+    list-style-type: none !important;
+}
+
+.markdown-body .task-list-item input[type="checkbox"] {
+    margin: 0 4px 0.25em -20px;
+    vertical-align: middle;
+}

docs/content/contributing/advocating.md

@@ -0,0 +1,10 @@
+# Advocating
+
+Spread the Love & Tell Us about It
+{: .subtitle }
+
+There are many ways to contribute to the project, and there is one that always spark joy: when we see/read about users talking about how Traefik helps them solve their problems.
+
+If you're talking about Traefik, [let us know](https://blog.containo.us/spread-the-love-ba5a40aa72e7) and we'll promote your enthusiasm!
+
+Also, if you've written about Traefik or shared useful information you'd like to promote, feel free to add links in the [dedicated wiki page on Github](https://github.com/containous/traefik/wiki/Awesome-Traefik).

docs/content/contributing/building-testing.md

@@ -0,0 +1,193 @@
+# Building and Testing
+
+Compile and Test Your Own Traefik!
+{: .subtitle }
+
+So you want to build your own Traefik binary from the sources?
+Let's see how.
+
+## Building
+
+You need either [Docker](https://github.com/docker/docker) and `make` (Method 1), or `go` (Method 2) in order to build Traefik.
+For changes to its dependencies, the `dep` dependency management tool is required.
+
+### Method 1: Using `Docker` and `Makefile`
+
+Run make with the `binary` target.
+This will create binaries for the Linux platform in the `dist` folder.
+
+```bash
+$ make binary
+docker build -t traefik-webui -f webui/Dockerfile webui
+Sending build context to Docker daemon  2.686MB
+Step 1/11 : FROM node:8.15.0
+ ---> 1f6c34f7921c
+[...]
+Successfully built ce4ff439c06a
+Successfully tagged traefik-webui:latest
+[...]
+docker build  -t "traefik-dev:4475--feature-documentation" -f build.Dockerfile .
+Sending build context to Docker daemon    279MB
+Step 1/10 : FROM golang:1.12-alpine
+ ---> f4bfb3d22bda
+[...]
+Successfully built 5c3c1a911277
+Successfully tagged traefik-dev:4475--feature-documentation
+docker run  -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock" -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -e VERBOSE -e VERSION -e CODENAME -e TESTDIRS -e CI -e CONTAINER=DOCKER		 -v "/home/ldez/sources/go/src/github.com/containous/traefik/"dist":/go/src/github.com/containous/traefik/"dist"" "traefik-dev:4475--feature-documentation" ./script/make.sh generate binary
+---> Making bundle: generate (in .)
+removed 'autogen/genstatic/gen.go'
+
+---> Making bundle: binary (in .)
+
+$ ls dist/
+traefik*
+```
+
+The following targets can be executed outside Docker (we don't recommend that):
+
+- `test-unit`
+- `test-integration`
+- `validate`
+- `binary` (the webUI is still generated by using Docker)
+
+ex:
+
+```bash
+PRE_TARGET= make test-unit
+```
+
+### Method 2: Using `go`
+
+You need `go` v1.9+.
+
+!!! tip "Source Directory"
+ 
+    It is recommended that you clone Traefik into the `~/go/src/github.com/containous/traefik` directory.
+    This is the official golang workspace hierarchy that will allow dependencies to be properly resolved.
+
+!!! note "Environment"
+
+    Set your `GOPATH` and `PATH` variable to be set to `~/go` via:
+    
+    ```bash
+    export GOPATH=~/go
+    export PATH=$PATH:$GOPATH/bin
+    ```
+ 
+    For convenience, add `GOPATH` and `PATH` to your `.bashrc` or `.bash_profile`
+    
+    Verify your environment is setup properly by running `$ go env`.
+    Depending on your OS and environment, you should see an output similar to:
+    
+    ```bash
+    GOARCH="amd64"
+    GOBIN=""
+    GOEXE=""
+    GOHOSTARCH="amd64"
+    GOHOSTOS="linux"
+    GOOS="linux"
+    GOPATH="/home/<yourusername>/go"
+    GORACE=""
+    ## ... and the list goes on
+    ```
+
+#### Build Traefik
+
+Once you've set up your go environment and cloned the source repository, you can build Traefik.
+Beforehand, you need to get `go-bindata` (the first time) in order to be able to use the `go generate` command (which is part of the build process).
+
+```bash
+cd ~/go/src/github.com/containous/traefik
+
+# Get go-bindata. (Important: the ellipses are required.)
+go get github.com/containous/go-bindata/...
+
+# Let's build
+
+# generate
+# (required to merge non-code components into the final binary, such as the web dashboard and the provider's templates)
+go generate
+
+# Standard go build
+go build ./cmd/traefik
+```
+
+You will find the Traefik executable (`traefik`) in the `~/go/src/github.com/containous/traefik` directory.
+
+### Updating the templates
+
+If you happen to update the provider's templates (located in `/templates`), you must run `go generate` to update the `autogen` package.
+
+### Setting up dependency management
+
+The [dep](https://github.com/golang/dep) command is not required for building;
+however, it is necessary if you need to update the dependencies (i.e., add, update, or remove third-party packages).
+
+You need [dep](https://github.com/golang/dep) >= 0.5.0.
+
+If you want to add a dependency, use `dep ensure -add` to have [dep](https://github.com/golang/dep) put it into the vendor folder and update the dep manifest/lock files (`Gopkg.toml` and `Gopkg.lock`, respectively).
+
+A following `make dep-prune` run should be triggered to trim down the size of the vendor folder.
+The final result must be committed into VCS.
+
+Here's a full example using dep to add a new dependency:
+
+```bash
+# install the new main dependency github.com/foo/bar and minimize vendor size
+$ dep ensure -add github.com/foo/bar
+# generate (Only required to integrate other components such as web dashboard)
+$ go generate
+# Standard go build
+$ go build ./cmd/traefik
+```
+
+## Testing
+
+### Method 1: `Docker` and `make`
+
+Run unit tests using the `test-unit` target.
+Run integration tests using the `test-integration` target.
+Run all tests (unit and integration) using the `test` target.
+
+```bash
+$ make test-unit
+docker build -t "traefik-dev:your-feature-branch" -f build.Dockerfile .
+# […]
+docker run --rm -it -e OS_ARCH_ARG -e OS_PLATFORM_ARG -e TESTFLAGS -v "/home/user/go/src/github/containous/traefik/dist:/go/src/github.com/containous/traefik/dist" "traefik-dev:your-feature-branch" ./script/make.sh generate test-unit
+---> Making bundle: generate (in .)
+removed 'gen.go'
+
+---> Making bundle: test-unit (in .)
++ go test -cover -coverprofile=cover.out .
+ok      github.com/containous/traefik   0.005s  coverage: 4.1% of statements
+
+Test success
+```
+
+For development purposes, you can specify which tests to run by using (only works the `test-integration` target):
+
+```bash
+# Run every tests in the MyTest suite
+TESTFLAGS="-check.f MyTestSuite" make test-integration
+
+# Run the test "MyTest" in the MyTest suite
+TESTFLAGS="-check.f MyTestSuite.MyTest" make test-integration
+
+# Run every tests starting with "My", in the MyTest suite
+TESTFLAGS="-check.f MyTestSuite.My" make test-integration
+
+# Run every tests ending with "Test", in the MyTest suite
+TESTFLAGS="-check.f MyTestSuite.*Test" make test-integration
+```
+
+More: https://labix.org/gocheck
+
+### Method 2: `go`
+
+Unit tests can be run from the cloned directory using `$ go test ./...` which should return `ok`, similar to:
+
+```test
+ok      _/home/user/go/src/github/containous/traefik    0.004s
+```
+
+Integration tests must be run from the `integration/` directory and require the `-integration` switch: `$ cd integration && go test -integration ./...`.

docs/content/contributing/data-collection.md

@@ -0,0 +1,114 @@
+# Data Collection
+
+Understanding How Traefik is Being Used
+{: .subtitle }
+
+## Configuration Example
+
+Understanding how you use Traefik is very important to us: it helps us improve the solution in many different ways.  
+For this very reason, the sendAnonymousUsage option is mandatory: we want you to take time to consider whether or not you wish to share anonymous data with us so we can benefit from your experience and use cases.
+
+!!! warning
+    During the alpha stage only, leaving this option unset will not prevent Traefik from running but will generate an error log indicating that it enables data collection by default.
+
+??? example "Enabling Data Collection with TOML"
+
+    ```toml
+    [Global]
+        # Send anonymous usage data
+        sendAnonymousUsage = true
+    ```
+
+??? example "Enabling Data Collection with the CLI"
+
+    ```bash
+    ./traefik --sendAnonymousUsage=true
+    ```
+    
+## Collected Data
+
+This feature comes from the public proposal [here](https://github.com/containous/traefik/issues/2369).
+
+In order to help us learn more about how Traefik is being used and improve it, we collect anonymous usage statistics from running instances.
+Those data help us prioritize our developments and focus on what's important for our users (for example, which provider is popular, and which is not).
+
+### What's collected / when ?
+
+Once a day (the first call begins 10 minutes after the start of Traefik), we collect:
+
+- the Traefik version number
+- a hash of the configuration
+- an **anonymized version** of the static configuration (token, user name, password, URL, IP, domain, email, etc, are removed).
+
+!!! note
+    We do not collect the dynamic configuration information (routers & services).
+    We do not collect these data to run advertising programs.
+    We do not sell these data to third-parties.
+
+### Example of Collected Data
+
+??? example "Original configuration"
+
+    ```toml
+    [entrypoints]
+        [entrypoints.web]
+           address = ":80"
+    
+    [api]
+    
+    [Docker]
+      endpoint = "tcp://10.10.10.10:2375"
+      domain = "foo.bir"
+      exposedByDefault = true
+      swarmMode = true
+    
+      [Docker.TLS]
+        ca = "dockerCA"
+        cert = "dockerCert"
+        key = "dockerKey"
+        insecureSkipVerify = true
+    
+    [ECS]
+      domain = "foo.bar"
+      exposedByDefault = true
+      clusters = ["foo-bar"]
+      region = "us-west-2"
+      accessKeyID = "AccessKeyID"
+      secretAccessKey = "SecretAccessKey"
+    ```
+
+??? example "Resulting Obfuscated Configuration"
+
+    ```toml
+    [entrypoints]
+        [entrypoints.web]
+           address = ":80"
+    
+    [api]
+    
+    [Docker]
+      endpoint = "xxxx"
+      domain = "xxxx"
+      exposedByDefault = true
+      swarmMode = true
+    
+      [Docker.TLS]
+        ca = "xxxx"
+        cert = "xxxx"
+        key = "xxxx"
+        insecureSkipVerify = false
+    
+    [ECS]
+      domain = "xxxx"
+      exposedByDefault = true
+      clusters = []
+      region = "us-west-2"
+      accessKeyID = "xxxx"
+      secretAccessKey = "xxxx"
+    ```
+
+## The Code for Data Collection
+
+If you want to dig into more details, here is the source code of the collecting system: [collector.go](https://github.com/containous/traefik/blob/master/pkg/collector/collector.go)
+
+By default we anonymize all configuration fields, except fields tagged with `export=true`.

docs/content/contributing/documentation.md

@@ -0,0 +1,100 @@
+# Documentation
+
+Features Are Better When You Know How to Use Them
+{: .subtitle }
+
+You've found something unclear in the documentation and want to give a try at explaining it better?
+Let's see how.
+
+## Building Documentation
+
+### General
+
+This [documentation](http://docs.traefik.io/) is built with [mkdocs](http://mkdocs.org/).
+
+### Method 1: `Docker` and `make`
+
+You can build the documentation and test it locally (with live reloading), using the `docs` target:
+
+```bash
+$ make docs
+docker build -t traefik-docs -f docs.Dockerfile .
+# […]
+docker run  --rm -v /home/user/go/github/containous/traefik:/mkdocs -p 8000:8000 traefik-docs mkdocs serve
+# […]
+[I 170828 20:47:48 server:283] Serving on http://0.0.0.0:8000
+[I 170828 20:47:48 handlers:60] Start watching changes
+[I 170828 20:47:48 handlers:62] Start detecting changes
+```
+
+!!! tip "Default URL"
+
+    Your local documentation server will run by default on [http://127.0.0.1:8000](http://127.0.0.1:8000).
+
+If you only want to build the documentation without serving it locally, you can use the following command:
+
+```bash
+$ make docs-build
+...
+```
+
+### Method 2: `mkdocs`
+
+First, make sure you have `python` and `pip` installed.
+
+```bash
+$ python --version
+Python 2.7.2
+$ pip --version
+pip 1.5.2
+```
+
+Then, install mkdocs with `pip`.
+
+```bash
+pip install --user -r requirements.txt
+```
+
+To build the documentation locally and serve it locally, run `mkdocs serve` from the root directory.
+This will start a local server.
+
+```bash
+$ mkdocs serve
+INFO    -  Building documentation...
+INFO    -  Cleaning site directory
+[I 160505 22:31:24 server:281] Serving on http://127.0.0.1:8000
+[I 160505 22:31:24 handlers:59] Start watching changes
+[I 160505 22:31:24 handlers:61] Start detecting changes
+```
+
+### Check the Documentation
+
+To check that the documentation meets standard expectations (no dead links, html markup validity, ...), use the `docs-verify` target.
+
+```bash
+$ make docs-verify
+docker build -t traefik-docs-verify ./script/docs-verify-docker-image ## Build Validator image
+...
+docker run --rm -v /home/travis/build/containous/traefik:/app traefik-docs-verify ## Check for dead links and w3c compliance
+=== Checking HTML content...
+Running ["HtmlCheck", "ImageCheck", "ScriptCheck", "LinkCheck"] on /app/site/basics/index.html on *.html...
+```
+
+!!! note "Clean & Verify"
+
+    If you've made changes to the documentation, it's safter to clean it before verifying it. 
+
+    ```bash
+    $ make docs-clean docs-verify
+    ...
+    ```
+
+!!! note "Disabling Documentation Verification"
+
+    Verification can be disabled by setting the environment variable `DOCS_VERIFY_SKIP` to `true`:
+    
+    ```shell
+    DOCS_VERIFY_SKIP=true make docs-verify
+    ...
+    DOCS_LINT_SKIP is true: no linting done.
+    ```

docs/content/contributing/maintainers.md

@@ -0,0 +1,175 @@
+# Maintainers
+
+## The team
+
+* Emile Vauge [@emilevauge](https://github.com/emilevauge)
+* Vincent Demeester [@vdemeester](https://github.com/vdemeester)
+* Ed Robinson [@errm](https://github.com/errm)
+* Daniel Tomcej [@dtomcej](https://github.com/dtomcej)
+* Manuel Zapf [@SantoDE](https://github.com/SantoDE)
+* Timo Reimann [@timoreimann](https://github.com/timoreimann)
+* Ludovic Fernandez [@ldez](https://github.com/ldez)
+* Julien Salleyron [@juliens](https://github.com/juliens)
+* Nicolas Mengin [@nmengin](https://github.com/nmengin)
+* Marco Jantke [@marco-jantke](https://github.com/marco-jantke)
+* Michaël Matur [@mmatur](https://github.com/mmatur)
+* Gérald Croës [@geraldcroes](https://github.com/geraldcroes)
+* Jean-Baptiste Doumenjou [@jbdoumenjou](https://github.com/jbdoumenjou)
+* Damien Duportal [@dduportal](https://github.com/dduportal)
+
+## Contributions Daily Meeting
+
+* 3 Maintainers should attend to a Contributions Daily Meeting where we sort and label new issues ([is:issue label:status/0-needs-triage](https://github.com/containous/traefik/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Astatus%2F0-needs-triage+)), and review every Pull Requests
+* Every pull request should be checked during the Contributions Daily Meeting
+    * Even if it’s already assigned
+    * Even PR labelled with `contributor/waiting-for-corrections` or `contributor/waiting-for-feedback`
+* Issues labeled with `priority/P0` and `priority/P1` should be assigned.
+* Modifying an issue or a pull request (labels, assignees, milestone) is only possible:
+    * During the Contributions Daily Meeting
+    * By an assigned maintainer
+    * In case of emergency, if a change proposal is approved by 2 other maintainers (on Slack, Discord, etc)
+
+## PR review process:
+
+* The status `needs-design-review` is only used in complex/heavy/tricky PRs.
+* From `1` to `2`: 1 comment that says “design LGTM” (by a senior maintainer).
+* From `2` to `3`: 3 LGTM approvals by any maintainer.
+* If needed, a specific maintainer familiar with a particular domain can be requested for the review.
+* If a PR has been implemented in pair programming, one peer's LGTM goes into the review for free
+* Amending someone else's pull request is authorized only in emergency, if a rebase is needed, or if the initial contributor is silent
+
+We use [PRM](https://github.com/ldez/prm) to manage locally pull requests.
+
+## Bots
+
+### [Myrmica Lobicornis](https://github.com/containous/lobicornis/)
+
+Update and Merge Pull Request.
+
+The maintainer giving the final LGTM must add the `status/3-needs-merge` label to trigger the merge bot.
+
+By default, a squash-rebase merge will be carried out.
+To preserve commits, add `bot/merge-method-rebase` before `status/3-needs-merge`.
+
+The status `status/4-merge-in-progress` is only used by the bot.
+
+If the bot is not able to perform the merge, the label `bot/need-human-merge` is added.  
+In such a situation, solve the conflicts/CI/... and then remove the label `bot/need-human-merge`.
+
+To prevent the bot from automatically merging a PR, add the label `bot/no-merge`.
+
+The label `bot/light-review` decreases the number of required LGTM from 3 to 1.
+
+This label is used when:
+
+* Updating the vendors from previously reviewed PRs
+* Merging branches into the master
+* Preparing the release
+
+### [Myrmica Bibikoffi](https://github.com/containous/bibikoffi/)
+
+* closes stale issues [cron]
+    * use some criterion as number of days between creation, last update, labels, ...
+
+### [Myrmica Aloba](https://github.com/containous/aloba)
+
+Manage GitHub labels.
+
+* Add labels on new PR [GitHub WebHook]
+* Add milestone to a new PR based on a branch version (1.4, 1.3, ...) [GitHub WebHook]
+* Add and remove `contributor/waiting-for-corrections` label when a review request changes [GitHub WebHook]
+* Weekly report of PR status on Slack (CaptainPR) [cron]
+
+## Labels
+
+A maintainer that looks at an issue/PR must define its `kind/*`, `area/*`, and `status/*`.
+
+### Status - Workflow
+
+The `status/*` labels represent the desired state in the workflow.
+
+* `status/0-needs-triage`: all the new issues and PRs have this status. _[bot only]_
+* `status/1-needs-design-review`: needs a design review. **(only for PR)**
+* `status/2-needs-review`: needs a code/documentation review. **(only for PR)**
+* `status/3-needs-merge`: ready to merge. **(only for PR)**
+* `status/4-merge-in-progress`: merge is in progress. _[bot only]_
+
+### Contributor
+
+* `contributor/need-more-information`: we need more information from the contributor in order to analyze a problem.
+* `contributor/waiting-for-feedback`: we need the contributor to give us feedback.
+* `contributor/waiting-for-corrections`: we need the contributor to take actions in order to move forward with a PR. **(only for PR)** _[bot, humans]_
+* `contributor/needs-resolve-conflicts`: use it only when there is some conflicts (and an automatic rebase is not possible). **(only for PR)** _[bot, humans]_
+
+### Kind
+
+* `kind/enhancement`: a new or improved feature.
+* `kind/question`: a question. **(only for issue)**
+* `kind/proposal`: a proposal that needs to be discussed.
+    * _Proposal issues_ are design proposals
+    * _Proposal PRs_ are technical prototypes that need to be refined with multiple contributors.
+
+* `kind/bug/possible`: a possible bug that needs analysis before it is confirmed or fixed. **(only for issues)**
+* `kind/bug/confirmed`: a confirmed bug (reproducible). **(only for issues)**
+* `kind/bug/fix`: a bug fix. **(only for PR)**
+
+### Resolution
+
+* `resolution/duplicate`: a duplicate issue/PR.
+* `resolution/declined`: declined (Rule #1 of open-source: no is temporary, yes is forever).
+* `WIP`: Work In Progress. **(only for PR)**
+
+### Platform
+
+* `platform/windows`: Windows related.
+
+### Area
+
+* `area/acme`: ACME related.
+* `area/api`: Traefik API related.
+* `area/authentication`: Authentication related.
+* `area/cluster`: Traefik clustering related.
+* `area/documentation`: Documentation related.
+* `area/infrastructure`: CI or Traefik building scripts related.
+* `area/healthcheck`: Health-check related.
+* `area/logs`: Logs related.
+* `area/middleware`: Middleware related.
+* `area/middleware/metrics`: Metrics related. (Prometheus, StatsD, ...)
+* `area/middleware/tracing`: Tracing related. (Jaeger, Zipkin, ...)
+* `area/oxy`: Oxy related.
+* `area/provider`: related to all providers.
+* `area/provider/boltdb`: Boltd DB related.
+* `area/provider/consul`: Consul related.
+* `area/provider/docker`: Docker and Swarm related.
+* `area/provider/ecs`: ECS related.
+* `area/provider/etcd`: Etcd related.
+* `area/provider/eureka`: Eureka related.
+* `area/provider/file`: file provider related.
+* `area/provider/k8s`: Kubernetes related.
+* `area/provider/kv`: KV related.
+* `area/provider/marathon`: Marathon related.
+* `area/provider/mesos`: Mesos related.
+* `area/provider/rancher`: Rancher related.
+* `area/provider/servicefabric`: Azure service fabric related.
+* `area/provider/zk`: Zoo Keeper related.
+* `area/rules`: Rules related.
+* `area/server`: Server related.
+* `area/sticky-session`: Sticky session related.
+* `area/tls`: TLS related.
+* `area/websocket`: WebSocket related.
+* `area/webui`: Web UI related.
+
+### Issues Priority
+
+* `priority/P0`: needs hot fix.
+* `priority/P1`: need to be fixed in next release.
+* `priority/P2`: need to be fixed in the future.
+* `priority/P3`: maybe.
+
+### PR size
+
+Automatically set by a bot.
+
+* `size/S`: small PR.
+* `size/M`: medium PR.
+* `size/L`: Large PR.

docs/content/contributing/submitting-issues.md

@@ -0,0 +1,45 @@
+# Submitting Issues
+
+Help Us Help You!
+{: .subtitle }
+
+We use the [GitHub issue tracker](https://github.com/containous/traefik/issues) to keep track of issues in Traefik. 
+
+The process of sorting and checking the issues is a daunting task, and requires a lot of work (more than an hour a day ... just for sorting).
+To save us some time and get quicker feedback, be sure to follow the guide lines below.
+
+!!! important "Getting Help Vs Reporting an Issue"
+
+    The issue tracker is not a general support forum, but a place to report bugs and asks for new features.
+    
+    For end-user related support questions, try using first:
+    
+    - the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
+    - [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
+
+## Issue Title
+
+The title must be short and descriptive. (~60 characters)
+
+## Description
+
+Follow the [issue template](https://github.com/containous/traefik/blob/master/.github/ISSUE_TEMPLATE.md) as much as possible.
+
+Explain us in which conditions you encountered the issue, what is your context.
+
+Remain as clear and concise as possible
+
+Take time to polish the format of your message so we'll enjoy reading it and working on it. 
+Help the readers focus on what matters, and help them understand the structure of your message (see the [Github Markdown Syntax](https://help.github.com/articles/github-flavored-markdown)).
+
+## Feature Request
+
+Traefik is an open-source project and aims to be the best edge router possible.
+
+Remember when asking for new features that these must be useful to the majority (and not only useful in edge case scenarios, or hack-like setups).
+
+Do you best to explain what you're looking for, and why it would improve Traefik for everyone. 
+
+## International English
+
+Every maintainer / Traefik user is not a native English speaker, so if you feel sometimes that some messages sound rude, remember that it probably is a language barrier problem from someone willing to help you.

docs/content/contributing/submitting-pull-requests.md

@@ -0,0 +1,45 @@
+# Submitting Pull Requests
+
+A Quick Guide for Efficient Contributions
+{: .subtitle }
+
+So you've decide to improve Traefik? 
+Thank You! 
+Now the last step is to submit your Pull Request in a way that makes sure it gets the attention it deserves.
+
+Let's go though the classic pitfalls to make sure everything is right. 
+
+## Title
+
+The title must be short and descriptive. (~60 characters)
+
+## Description
+
+Follow the [pull request template](https://github.com/containous/traefik/blob/master/.github/PULL_REQUEST_TEMPLATE.md) as much as possible.
+
+Explain the conditions which led you to write this PR: give us context.
+The context should lead to something, an idea or a problem that you’re facing.
+
+Remain clear and concise.
+
+Take time to polish the format of your message so we'll enjoy reading it and working on it.
+Help the readers focus on what matters, and help them understand the structure of your message (see the [Github Markdown Syntax](https://help.github.com/articles/github-flavored-markdown)).
+
+## PR Content
+
+- Make it small.
+- One feature per Pull Request.
+- Write useful descriptions and titles.
+- Avoid re-formatting code that is not on the path of your PR.
+- Make sure the [code builds](building-testing.md).
+- Make sure [all tests pass](building-testing.md).
+- Add tests.
+- Address review comments in terms of additional commits (and don't amend/squash existing ones unless the PR is trivial).
+
+!!! note "third-party dependencies"
+
+    If a PR involves changes to third-party dependencies, the commits pertaining to the vendor folder and the manifest/lock file(s) should be committed separated.
+
+!!! tip "10 Tips for Better Pull Requests"
+
+    We enjoyed this article, maybe you will too! [10 tips for better pull requests](http://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).

docs/content/contributing/thank-you.md

@@ -0,0 +1,10 @@
+# Thank You!
+
+_You_ Made It
+{: .subtitle}
+
+Traefik truly is an [open-source project](https://github.com/containous/traefik/),
+and wouldn't have become what it is today without the help of our [many contributors](https://github.com/containous/traefik/graphs/contributors) (at the time of writing this),
+not accounting for people having helped with issues, tests, comments, articles, ... or just enjoying it and letting others know.
+
+So once again, thank you for your invaluable help on making Traefik such a good product.

docs/content/getting-started/concepts.md

@@ -0,0 +1,35 @@
+# Concepts
+
+Everything You Need to Know
+{: .subtitle }
+
+## Edge Router
+
+Traefik is an _Edge Router_, it means that it's the door to your platform, and that it intercepts and routes every incoming request: it knows all the logic and every rule that determine which services handle which requests (based on the [path](../../routing/routers/#rule), the [host](../../routing/routers/#rule), [headers](../../routing/routers/#rule), [and so on](../../routing/routers/#rule) ...).
+
+![The Door to Your Infrastructure](../assets/img/traefik-concepts-1.png)
+
+## Auto Service Discovery
+
+Where traditionally edge routers (or reverse proxies) need a configuration file that contains every possible route to your services, Traefik gets them from the services themselves.
+
+Deploying your services, you attach information that tell Traefik the characteristics of the requests the services can handle.
+
+![Decentralized Configuration](../assets/img/traefik-concepts-2.png)
+
+It means that when a service is deployed, Traefik detects it immediately and updates the routing rules in real time.
+The opposite is true: when you remove a service from your infrastructure, the route will disapear accordingly.
+
+You no longer need to create and synchronize configuration files cluttered with IP addresses or other rules.
+
+!!! note "Many different rules"
+
+    In the example above, we used the request [path](../routing/routers/index.md#rule) to determine which service was in charge, but of course you can use many other different [rules](../routing/routers/index.md#rule).
+
+!!! note "Updating the requests"
+
+    In the [middleware](../middlewares/overview.md) section, you can learn about how to update the requests before forwarding them to the services.
+
+!!! question "How does Traefik discover the services?"
+
+    Traefik is able to use your cluster API to discover the services and read the attached information. In Traefik, these connectors are called [providers](../providers/overview.md) because they _provide_ the configuration to Traefik. To learn more about them, read the [provider overview](../providers/overview.md) section.

docs/content/getting-started/configuration-overview.md

@@ -0,0 +1,85 @@
+# Configuration Introduction
+
+How the Magic Happens
+{: .subtitle }
+
+![Configuration](../assets/img/static-dynamic-configuration.png)
+
+Configuration in Traefik can refer to two different things:
+   
+- The fully dynamic routing configuration (referred to as the _dynamic configuration_)
+- The startup configuration (referred to as the _static configuration_)
+
+Elements in the _static configuration_ set up connections to [providers](../../providers/overview/) and define the [entrypoints](../../routing/entrypoints/) Traefik will listen to (these elements don't change often).
+
+The _dynamic configuration_ contains everything that defines how the requests are handled by your system.
+This configuration can change and is seamlessly hot-reloaded, without any request interuption or connection loss.    
+
+!!! warning "Incompatible Configuration"
+    Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now.
+    If you're testing out v2, please ensure you are using a v2 configuration.
+
+## The Dynamic Configuration 
+
+Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): wether an orchestrator, a service registry, or a plain old configuration file. Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../providers/overview.md).
+
+!!! Note 
+   
+    In the [Quick Start example](../getting-started/quick-start.md), the dynamic configuration comes from docker in the form of labels attached to your containers.
+    
+!!! Note
+    
+    HTTPS Certificates also belong to the dynamic configuration. You can add / update / remove them without restarting your Traefik instance. 
+ 
+## The Static Configuration
+
+There are three different locations where you can define static configuration options in Traefik:
+
+- In a key-value store
+- In the command-line arguments
+- In a configuration file
+
+If you don't provide a value for a given option, default values apply.
+
+!!! important "Precedence Order"
+
+    The following precedence order applies for configuration options: key-value > command-line > configuration file.
+    
+    It means that arguments override configuration file, and key-value store overrides arguments.
+    
+!!! important "Default Values"
+
+    Some root options are enablers: they set default values for all their children. 
+    
+    For example, the `--providers.docker` option enables the docker provider.
+    Once positioned, this option sets (and resets) all the default values under the root `providers.docker`.
+    If you define child options using a lesser precedence configuration source, they will be overwritten by the default values.  
+    
+### Configuration File
+
+At startup, Traefik searches for a file named `traefik.toml` in `/etc/traefik/`, `$HOME/.traefik/`, and `.` (_the working directory_).
+
+You can override this using the `configFile` argument.
+
+```bash
+traefik --configFile=foo/bar/myconfigfile.toml
+```
+
+### Arguments
+
+Use `traefik --help` to get the list of the available arguments.
+
+### Key-Value Stores
+
+Traefik supports several Key-value stores:
+
+- [Consul](https://consul.io)
+- [etcd](https://coreos.com/etcd/)
+- [ZooKeeper](https://zookeeper.apache.org/)
+- [boltdb](https://github.com/boltdb/bolt)
+
+## Available Configuration Options
+
+All the configuration options are documented in their related section.
+
+You can browse the available features in the menu, the [providers](../providers/overview.md), or the [routing section](../routing/overview.md) to see them in action.

docs/content/getting-started/quick-start.md

@@ -0,0 +1,105 @@
+# Quick Start
+
+A Simple Use Case Using Docker
+{: .subtitle }
+
+![quickstart-diagram](../assets/img/quickstart-diagram.png)
+
+## Launch Traefik With the Docker Provider
+
+Create a `docker-compose.yml` file where you will define a `reverse-proxy` service that uses the official Traefik image:
+
+```yaml
+version: '3'
+
+services:
+  reverse-proxy:
+    image: traefik:v2.0 # The official v2.0 Traefik docker image
+    command: --api --providers.docker # Enables the web UI and tells Traefik to listen to docker
+    ports:
+      - "80:80"     # The HTTP port
+      - "8080:8080" # The Web UI (enabled by --api)
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
+```
+
+**That's it. Now you can launch Traefik!**
+
+Start your `reverse-proxy` with the following command:
+
+```shell
+docker-compose up -d reverse-proxy
+```
+
+You can open a browser and go to [http://localhost:8080/api/rawdata](http://localhost:8080/api/rawdata) to see Traefik's API rawdata (we'll go back there once we have launched a service in step 2).
+
+## Traefik Detects New Services and Creates the Route for You
+
+Now that we have a Traefik instance up and running, we will deploy new services.
+
+Edit your `docker-compose.yml` file and add the following at the end of your file.
+
+```yaml
+# ...
+  whoami:
+    image: containous/whoami # A container that exposes an API to show its IP address
+    labels:
+      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
+```
+
+The above defines `whoami`: a simple web service that outputs information about the machine it is deployed on (its IP address, host, and so on).
+
+Start the `whoami` service with the following command:
+
+```shell
+docker-compose up -d whoami
+```
+
+Go back to your browser ([http://localhost:8080/api/rawdata](http://localhost:8080/api/rawdata)) and see that Traefik has automatically detected the new container and updated its own configuration.
+
+When Traefik detects new services, it creates the corresponding routes so you can call them ... _let's see!_  (Here, we're using curl)
+
+```shell
+curl -H Host:whoami.docker.localhost http://127.0.0.1
+```
+
+_Shows the following output:_
+
+```yaml
+Hostname: a656c8ddca6c
+IP: 172.27.0.3
+#...
+```
+
+## More Instances? Traefik Load Balances Them
+
+Run more instances of your `whoami` service with the following command:
+
+```shell
+docker-compose up -d --scale whoami=2
+```
+
+Go back to your browser ([http://localhost:8080/api/rawdata](http://localhost:8080/api/rawdata)) and see that Traefik has automatically detected the new instance of the container.
+
+Finally, see that Traefik load-balances between the two instances of your services by running twice the following command:
+
+```shell
+curl -H Host:whoami.docker.localhost http://127.0.0.1
+```
+
+The output will show alternatively one of the followings:
+
+```yaml
+Hostname: a656c8ddca6c
+IP: 172.27.0.3
+#...
+```
+
+```yaml
+Hostname: s458f154e1f1
+IP: 172.27.0.4
+# ...
+```
+
+!!! question "Where to Go Next?"
+    Now that you have a basic understanding of how Traefik can automatically create the routes to your services and load balance them, it is time to dive into [the documentation](/) and let Traefik work for you!

docs/content/glossary.md

@@ -0,0 +1,22 @@
+# TODO -- Glossary
+
+Where Every Technical Word finds its Definition`
+{: .subtitle}
+
+- [ ] Provider
+    - [ ] Types of providers (KV, annotation based, label based, configuration based)
+- [ ] Entrypoint
+- [ ] Routers
+- [ ] Middleware
+- [ ] Service
+- [ ] Static Configuration
+- [ ] Dynamic Configuration
+- [ ] ACME
+- [ ] TraefikEE
+- [ ] Tracing
+- [ ] Metrics
+- [ ] Orchestrator
+- [ ] Key Value Store
+- [ ] Logs
+- [ ] Traefiker
+- [ ] Traefik (How to pronounce)

docs/content/https-tls/acme.md

@@ -0,0 +1,334 @@
+# ACME
+
+Automatic HTTPS
+{: .subtitle }
+
+You can configure Traefik to use an ACME provider (like Let's Encrypt) for automatic certificate generation.
+
+!!! warning "Let's Encrypt and Rate Limiting"
+    Note that Let's Encrypt API has [rate limiting](https://letsencrypt.org/docs/rate-limits).
+
+## Configuration Examples
+
+??? example "Enabling ACME"
+
+    ```toml
+    [entrypoints]
+      [entrypoints.web]
+         address = ":80"
+    
+      [entrypoints.http-tls]
+         address = ":443"
+    
+    [acme] # every router with TLS enabled will now be able to use ACME for its certificates
+       email = "your-email@your-domain.org"
+       storage = "acme.json"
+       onHostRule = true # dynamic generation based on the Host() & HostSNI() matchers
+       [acme.httpChallenge]
+          entryPoint = "web" # used during the challenge
+    ```
+
+??? example "Configuring Wildcard Certificates"
+
+    ```toml
+    [entrypoints]
+      [entrypoints.web]
+        address = ":80"
+
+      [entrypoints.http-tls]
+        address = ":443"
+
+    [acme]
+      email = "your-email@your-domain.org"
+      storage = "acme.json"
+      [acme.dnsChallenge]
+        provider = "xxx"
+
+      [[acme.domains]]
+        main = "*.mydomain.com"
+        sans = ["mydomain.com"]
+    ```
+
+!!! note "Configuration Reference"
+
+    There are many available options for ACME. For a quick glance at what's possible, browse the [configuration reference](../reference/acme.md).
+
+## The Different ACME Challenges
+
+### `tlsChallenge`
+
+Use the `TLS-ALPN-01` challenge to generate and renew ACME certificates by provisioning a TLS certificate.
+
+As described on the Let's Encrypt [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72),
+when using the `TLS-ALPN-01` challenge, Traefik must be reachable by Let's Encrypt through port 443.
+
+??? example "Configuring the `tlsChallenge`"
+
+    ```toml
+    [acme]
+       [acme.tlsChallenge]
+    ```
+    
+### `httpChallenge`
+
+Use the `HTTP-01` challenge to generate and renew ACME certificates by provisioning an HTTP resource under a well-known URI.
+
+As described on the Let's Encrypt [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72),
+when using the `HTTP-01` challenge, `acme.httpChallenge.entryPoint` must be reachable by Let's Encrypt through port 80.
+
+??? example "Using an EntryPoint Called http for the `httpChallenge`"
+
+    ```toml
+    [acme]
+       # ...
+       [acme.httpChallenge]
+          entryPoint = "http"
+    ```
+
+!!! note
+    Redirection is fully compatible with the `HTTP-01` challenge.
+
+### `dnsChallenge`
+
+Use the `DNS-01` challenge to generate and renew ACME certificates by provisioning a DNS record.
+
+??? example "Configuring a `dnsChallenge` with the DigitalOcean Provider"
+
+    ```toml
+    [acme]
+       # ...
+       [acme.dnsChallenge]
+          provider = "digitalocean"
+          delayBeforeCheck = 0
+    # ...
+    ```
+
+    !!! important
+        A `provider` is mandatory.
+
+#### `providers`
+ 
+Here is a list of supported `providers`, that can automate the DNS verification,
+along with the required environment variables and their [wildcard & root domain support](#wildcard-domains).
+Do not hesitate to complete it. 
+
+| Provider Name                                               | Provider Code  | Environment Variables                                                                                                                       | Wildcard & Root Domain Support |
+|-------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
+| [ACME DNS](https://github.com/joohoi/acme-dns)              | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                                | Not tested yet                 |
+| [Alibaba Cloud](https://www.vultr.com)                      | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                          | Not tested yet                 |
+| [Auroradns](https://www.pcextreme.com/aurora/dns)           | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                           | Not tested yet                 |
+| [Azure](https://azure.microsoft.com/services/dns/)          | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]`   | Not tested yet                 |
+| [Blue Cat](https://www.bluecatnetworks.com/)                | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                    | Not tested yet                 |
+| [ClouDNS](https://www.cloudns.net/)                         | `cloudns`      | `CLOUDNS_AUTH_ID`, `CLOUDNS_AUTH_PASSWORD`                                                                                                  | YES                            |
+| [Cloudflare](https://www.cloudflare.com)                    | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                               | YES                            |
+| [CloudXNS](https://www.cloudxns.net)                        | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                   | Not tested yet                 |
+| [ConoHa](https://www.conoha.jp)                             | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                            | YES                            |
+| [DigitalOcean](https://www.digitalocean.com)                | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                             | YES                            |
+| [DNSimple](https://dnsimple.com)                            | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                                 | YES                            |
+| [DNS Made Easy](https://dnsmadeeasy.com)                    | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                      | Not tested yet                 |
+| [DNSPod](https://www.dnspod.com/)                           | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                            | Not tested yet                 |
+| [DreamHost](https://www.dreamhost.com/)                     | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                         | YES                            |
+| [Duck DNS](https://www.duckdns.org/)                        | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                             | YES                            |
+| [Dyn](https://dyn.com)                                      | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                        | Not tested yet                 |
+| External Program                                            | `exec`         | `EXEC_PATH`                                                                                                                                 | YES                            |
+| [Exoscale](https://www.exoscale.com)                        | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                              | YES                            |
+| [Fast DNS](https://www.akamai.com/)                         | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                      | YES                            |
+| [Gandi](https://www.gandi.net)                              | `gandi`        | `GANDI_API_KEY`                                                                                                                             | Not tested yet                 |
+| [Gandi v5](http://doc.livedns.gandi.net)                    | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                           | YES                            |
+| [Glesys](https://glesys.com/)                               | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                        | Not tested yet                 |
+| [GoDaddy](https://godaddy.com/domains)                      | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                     | Not tested yet                 |
+| [Google Cloud DNS](https://cloud.google.com/dns/docs/)      | `gcloud`       | `GCE_PROJECT`, Application Default Credentials [^2] [^3], [`GCE_SERVICE_ACCOUNT_FILE`]                                                      | YES                            |
+| [hosting.de](https://www.hosting.de)                        | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                  | Not tested yet                 |
+| HTTP request                                                | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` [^1]                                                             | YES                            |
+| [IIJ](https://www.iij.ad.jp/)                               | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                           | Not tested yet                 |
+| [INWX](https://www.inwx.de/en)                              | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                            | YES                            |
+| [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | Not tested yet                 |
+| [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | Not tested yet                 |
+| [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | Not tested yet                 |
+| manual                                                      | -              | none, but you need to run Traefik interactively [^4], turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                 | YES                            |
+| [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | YES                            |
+| [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | YES                            |
+| [name.com](https://www.name.com/)                           | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                   | Not tested yet                 |
+| [Netcup](https://www.netcup.eu/)                            | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                           | Not tested yet                 |
+| [NIFCloud](https://cloud.nifty.com/service/dns.htm)         | `nifcloud`     | `NIFCLOUD_ACCESS_KEY_ID`, `NIFCLOUD_SECRET_ACCESS_KEY`                                                                                      | Not tested yet                 |
+| [Ns1](https://ns1.com/)                                     | `ns1`          | `NS1_API_KEY`                                                                                                                               | Not tested yet                 |
+| [Open Telekom Cloud](https://cloud.telekom.de)              | `otc`          | `OTC_DOMAIN_NAME`, `OTC_USER_NAME`, `OTC_PASSWORD`, `OTC_PROJECT_NAME`, `OTC_IDENTITY_ENDPOINT`                                             | Not tested yet                 |
+| [OVH](https://www.ovh.com)                                  | `ovh`          | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                                                         | YES                            |
+| [Openstack Designate](https://docs.openstack.org/designate) | `designate`    | `OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_TENANT_NAME`, `OS_REGION_NAME`                                                             | YES                            |
+| [Oracle Cloud](https://cloud.oracle.com/home)               | `oraclecloud`  | `OCI_COMPARTMENT_OCID`, `OCI_PRIVKEY_FILE`, `OCI_PRIVKEY_PASS`, `OCI_PUBKEY_FINGERPRINT`, `OCI_REGION`, `OCI_TENANCY_OCID`, `OCI_USER_OCID` | YES                            |
+| [PowerDNS](https://www.powerdns.com)                        | `pdns`         | `PDNS_API_KEY`, `PDNS_API_URL`                                                                                                              | Not tested yet                 |
+| [Rackspace](https://www.rackspace.com/cloud/dns)            | `rackspace`    | `RACKSPACE_USER`, `RACKSPACE_API_KEY`                                                                                                       | Not tested yet                 |
+| [RFC2136](https://tools.ietf.org/html/rfc2136)              | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                   | Not tested yet                 |
+| [Route 53](https://aws.amazon.com/route53/)                 | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.             | YES                            |
+| [Sakura Cloud](https://cloud.sakura.ad.jp/)                 | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                               | Not tested yet                 |
+| [Selectel](https://selectel.ru/en/)                         | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                        | YES                            |
+| [Stackpath](https://www.stackpath.com/)                     | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                      | Not tested yet                 |
+| [TransIP](https://www.transip.nl/)                          | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                          | YES                            |
+| [VegaDNS](https://github.com/shupp/VegaDNS-API)             | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                                | Not tested yet                 |
+| [Vscale](https://vscale.io/)                                | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                          | YES                            |
+| [VULTR](https://www.vultr.com)                              | `vultr`        | `VULTR_API_KEY`                                                                                                                             | Not tested yet                 |
+| [Zone.ee](https://www.zone.ee)                              | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                         | YES                            |
+
+[^1]: more information about the HTTP message format can be found [here](https://go-acme.github.io/lego/dns/httpreq/)
+[^2]: [providing_credentials_to_your_application](https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application)
+[^3]: [google/default.go](https://github.com/golang/oauth2/blob/36a7019397c4c86cf59eeab3bc0d188bac444277/google/default.go#L61-L76)
+[^4]: `docker stack` remark: there is no way to support terminal attached to container when deploying with `docker stack`, so you might need to run container with `docker run -it` to generate certificates using `manual` provider.
+
+!!! note "`delayBeforeCheck`"
+    By default, the `provider` verifies the TXT record _before_ letting ACME verify.
+    You can delay this operation by specifying a delay (in seconds) with `delayBeforeCheck` (value must be greater than zero).
+    This option is useful when internal networks block external DNS queries.
+
+#### `resolvers`
+
+Use custom DNS servers to resolve the FQDN authority.
+
+```toml
+[acme]
+   # ...
+   [acme.dnsChallenge]
+      # ...
+      resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+```
+
+#### Wildcard Domains
+
+[ACME V2](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579) supports wildcard certificates.
+As described in [Let's Encrypt's post](https://community.letsencrypt.org/t/staging-endpoint-for-acme-v2/49605) wildcard certificates can only be generated through a [`DNS-01` challenge](#dnschallenge).
+
+```toml
+[acme]
+   # ...
+   [[acme.domains]]
+      main = "*.local1.com"
+      sans = ["local1.com"]
+
+# ...
+```
+
+!!! note "Double Wildcard Certificates"
+    It is not possible to request a double wildcard certificate for a domain (for example `*.*.local.com`).
+
+Due to an ACME limitation it is not possible to define wildcards in SANs (alternative domains).
+Thus, the wildcard domain has to be defined as a main domain.
+
+Most likely the root domain should receive a certificate too, so it needs to be specified as SAN and 2 `DNS-01` challenges are executed.
+In this case the generated DNS TXT record for both domains is the same.
+Even though this behavior is [DNS RFC](https://community.letsencrypt.org/t/wildcard-issuance-two-txt-records-for-the-same-name/54528/2) compliant,
+it can lead to problems as all DNS providers keep DNS records cached for a given time (TTL) and this TTL can be greater than the challenge timeout making the `DNS-01` challenge fail.
+
+The Traefik ACME client library [LEGO](https://github.com/go-acme/lego) supports some but not all DNS providers to work around this issue.
+The [Supported `provider` table](#providers) indicates if they allow generating certificates for a wildcard domain and its root domain.
+
+## Known Domains, SANs
+
+You can set SANs (alternative domains) for each main domain.
+Every domain must have A/AAAA records pointing to Traefik.
+Each domain & SAN will lead to a certificate request.
+
+```toml
+[acme]
+   # ...
+   [[acme.domains]]
+      main = "local1.com"
+      sans = ["test1.local1.com", "test2.local1.com"]
+   [[acme.domains]]
+      main = "local2.com"
+   [[acme.domains]]
+      main = "*.local3.com"
+      sans = ["local3.com", "test1.test1.local3.com"]
+# ...
+```
+
+!!! important
+    The certificates for the domains listed in `acme.domains` are negotiated at Traefik startup only.
+
+!!! note
+    Wildcard certificates can only be verified through a `DNS-01` challenge.
+
+## `caServer`
+
+??? example "Using the Let's Encrypt staging server"
+
+    ```toml
+    [acme]
+       # ...
+       caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+       # ...
+    ```
+
+## `onHostRule`
+
+Enable certificate generation on [routers](../routing/routers/index.md) `Host` & `HostSNI` rules.
+
+This will request a certificate from Let's Encrypt for each router with a Host rule.
+
+```toml
+[acme]
+   # ...
+   onHostRule = true
+   # ...
+```
+
+!!! note "Multiple Hosts in a Rule"
+    The rule `Host(test1.traefik.io,test2.traefik.io)` will request a certificate with the main domain `test1.traefik.io` and SAN `test2.traefik.io`.
+
+!!! warning
+    `onHostRule` option can not be used to generate wildcard certificates. Refer to [wildcard generation](#wildcard-domains) for further information.
+
+## `storage`
+
+The `storage` option sets the location where your ACME certificates are saved to.
+
+```toml
+[acme]
+   # ...
+   storage = "acme.json"
+   # ...
+```
+
+The value can refer to two kinds of storage:
+
+- a JSON file
+- a KV store entry
+
+### In a File
+
+ACME certificates can be stored in a JSON file that needs to have a `600` file mode .
+
+In Docker you can mount either the JSON file, or the folder containing it:
+
+```bash
+docker run -v "/my/host/acme.json:acme.json" traefik
+```
+
+```bash
+docker run -v "/my/host/acme:/etc/traefik/acme" traefik
+```
+
+!!! warning
+    For concurrency reason, this file cannot be shared across multiple instances of Traefik. Use a key value store entry instead.
+
+### In a a Key Value Store Entry
+
+ACME certificates can be stored in a key-value store entry.
+
+```toml
+storage = "traefik/acme/account"
+```
+
+!!! note "Storage Size"
+
+    Because key-value stores have limited entry size, the certificates list is compressed _before_ it is saved.
+    For example, it is possible to store up to _approximately_ 100 ACME certificates in Consul.
+
+## Fallbacks
+
+If Let's Encrypt is not reachable, the following certificates will apply:
+
+  1. Previously generated ACME certificates (before downtime)
+  1. Expired ACME certificates
+  1. Provided certificates
+
+!!! note
+    For new (sub)domains which need Let's Encrypt authentication, the default Traefik certificate will be used until Traefik is restarted.