fix: revert deploy script.

fix: deploy script.
Prepare release v2.0.0-alpha5
2025-09-30 17:44:25 +03:00 · 2019-06-17 23:40:05 +02:00 · 2019-06-17 22:14:05 +02:00 · 2019-06-17 19:38:04 +02:00 · 2019-06-17 18:30:05 +02:00 · 2019-06-17 18:14:08 +02:00
1507 changed files with 84003 additions and 304071 deletions
--- a/.github/ISSUE_TEMPLATE.md
+++ b/.github/ISSUE_TEMPLATE.md
@@ -16,6 +16,17 @@ For end-user related support questions, please refer to one of the following:
 If you intend to ask a support question: DO NOT FILE AN ISSUE.
 -->

+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
 ### What did you do?

 <!--
@@ -65,7 +76,7 @@ Add more configuration information here.
 -->


-### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output at DEBUG level (`--log.level=DEBUG` switch)

 ```
 (paste your output here)
--- a/.github/ISSUE_TEMPLATE/Bug_report.md
+++ b/.github/ISSUE_TEMPLATE/Bug_report.md
@@ -20,6 +20,17 @@ For end-user related support questions, please refer to one of the following:

 Bug

+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
 ### What did you do?

 <!--
@@ -70,7 +81,7 @@ Add more configuration information here.
 -->


-### If applicable, please paste the log output in DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output in DEBUG level (`--log.level=DEBUG` switch)

 ```
 (paste your output here)
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@
 /autogen/
 /traefik
 /traefik.toml
+/traefik.yml
 *.log
 *.exe
 cover.out
--- a/.golangci.toml
+++ b/.golangci.toml
@@ -1,8 +1,6 @@
 [run]
  deadline = "10m"
-  skip-files = [
-    "^old/.*",
-  ]
+  skip-files = []

 [linters-settings]

@@ -38,6 +36,8 @@
    "scopelint",
    "gochecknoinits",
    "gochecknoglobals",
+    # uncomment when the CI will be updated
+    # "bodyclose", # Too many false-positive and panics.
  ]

 [issues]
@@ -52,12 +52,6 @@
 [[issues.exclude-rules]]
    path = ".+_test.go"
    linters = ["goconst"]
- [[issues.exclude-rules]]
-    path = "provider/label/internal/.+_test.go"
-    text = "U1000: field `(foo|fuu)` is unused"
- [[issues.exclude-rules]]
-    path = "middlewares/recovery/recovery.go"
-    text = "`logger` can be `github.com/containous/traefik/vendor/github.com/stretchr/testify/assert.TestingT`"
 [[issues.exclude-rules]]
    path = "integration/.+_test.go"
    text = "Error return value of `cmd\\.Process\\.Kill` is not checked"
@@ -68,23 +62,26 @@
    path = "integration/grpc_test.go"
    text = "Error return value of `closer` is not checked"
 [[issues.exclude-rules]]
-    path = "provider/kubernetes/builder_(endpoint|service)_test.go"
+    path = "pkg/h2c/h2c.go"
+    text = "Error return value of `rw.Write` is not checked"
+ [[issues.exclude-rules]]
+    path = "pkg/middlewares/recovery/recovery.go"
+    text = "`logger` can be `github.com/containous/traefik/vendor/github.com/stretchr/testify/assert.TestingT`"
+ [[issues.exclude-rules]]
+    path = "pkg/provider/docker/builder_test.go"
    text = "(U1000: func )?`(.+)` is unused"
 [[issues.exclude-rules]]
-    path = "provider/docker/builder_test.go"
+    path = "pkg/provider/kubernetes/builder_(endpoint|service)_test.go"
    text = "(U1000: func )?`(.+)` is unused"
+ [[issues.exclude-rules]]
+    path = "pkg/config/parser/.+_test.go"
+    text = "U1000: field `(foo|fuu)` is unused"
+ [[issues.exclude-rules]]
+    path = "pkg/server/service/bufferpool.go"
+    text = "SA6002: argument should be pointer-like to avoid allocations"
 [[issues.exclude-rules]]
    path = "cmd/configuration.go"
    text = "string `traefik` has (\\d) occurrences, make it a constant"
- [[issues.exclude-rules]]
-    path = "h2c/h2c.go"
-    text = "Error return value of `rw.Write` is not checked"
- [[issues.exclude-rules]]
-    path = "server/service/bufferpool.go"
-    text = "SA6002: argument should be pointer-like to avoid allocations"
- [[issues.exclude-rules]] # FIXME must be fixed
-    path = "acme/.+.go"
-    text = "(assignment copies lock value to domainsCerts|literal copies lock value from)"
 [[issues.exclude-rules]] # FIXME must be fixed
    path = "cmd/context.go"
    text = "S1000: should use a simple channel send/receive instead of `select` with a single case"
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -51,5 +51,8 @@ archive:
    - LICENSE.md
    - CHANGELOG.md

+checksum:
+  name_template: "{{ .ProjectName }}_v{{ .Version }}_checksums.txt"
+
 release:
  disable: true
--- a/.semaphoreci/job2.sh
+++ b/.semaphoreci/job2.sh
@@ -5,4 +5,4 @@ ci_retry make validate

 if [ -n "$SHOULD_TEST" ]; then ci_retry make test-unit; fi

-if [ -n "$SHOULD_TEST" ]; then make -j${N_MAKE_JOBS} crossbinary-default-parallel; fi
+if [ -n "$SHOULD_TEST" ]; then make -j"${N_MAKE_JOBS}" crossbinary-default-parallel; fi
--- a/.semaphoreci/setup.sh
+++ b/.semaphoreci/setup.sh
@@ -3,9 +3,10 @@ set -e

 export DOCKER_VERSION=17.03.1

+# shellcheck source=/dev/null
 source .semaphoreci/vars

-if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
+if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/"${PULL_REQUEST_NUMBER}".diff | patch --dry-run -p1 -R); fi

 if [ -n "$TEMP_STORAGE" ]; then SHOULD_TEST=$(echo "$TEMP_STORAGE" | grep -Ev '(.md|.yaml|.yml)' || :); fi

--- a/.semaphoreci/vars
+++ b/.semaphoreci/vars
@@ -24,8 +24,8 @@ function ci_retry {
    until [ $n -ge $NRETRY ]
    do
        "$@" && break
-        n=$[$n+1]
-        echo "$@ failed, attempt ${n}/${NRETRY}"
+        n=$((n+1))
+        echo "${*} failed, attempt ${n}/${NRETRY}"
        sleep $NSLEEP
    done

@@ -34,4 +34,3 @@ function ci_retry {
 }

 export -f ci_retry
-
--- a/.travis.yml
+++ b/.travis.yml
@@ -24,11 +24,11 @@ before_deploy:
      sudo -E apt-get -yq update;
      sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*;
      docker version;
-      make image;
+      make build-image;
      if [ "$TRAVIS_TAG" ]; then
        make release-packages;
      fi;
-      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" v1.7.0
+      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" ${STRUCTOR_VERSION}
      structor -o containous -r traefik --dockerfile-url="https://raw.githubusercontent.com/containous/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/containous/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/containous/structor/master/requirements-override.txt" --force-edit-url --exp-branch=master --debug;
    fi

@@ -38,7 +38,6 @@ deploy:
    file: dist/traefik*
    skip_cleanup: true
    file_glob: true
-    draft: true
    on:
      repo: containous/traefik
      tags: true
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,151 @@
 # Change Log

+## [v2.0.0-alpha5](https://github.com/containous/traefik/tree/v2.0.0-alpha5) (2019-06-17)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha4...v2.0.0-alpha5)
+
+**Enhancements:**
+- **[acme]** Remove timeout/interval from the ACME Provider ([#4842](https://github.com/containous/traefik/pull/4842) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[api]** API: expose runtime representation ([#4841](https://github.com/containous/traefik/pull/4841) by [mpl](https://github.com/mpl))
+- **[cli]** New static configuration loading system. ([#4935](https://github.com/containous/traefik/pull/4935) by [ldez](https://github.com/ldez))
+- **[k8s,k8s/crd,tcp]** Add support for TCP (in kubernetes CRD) ([#4885](https://github.com/containous/traefik/pull/4885) by [mpl](https://github.com/mpl))
+- **[server]** Rework loadbalancer support ([#4933](https://github.com/containous/traefik/pull/4933) by [juliens](https://github.com/juliens))
+- **[sticky-session]** HttpOnly and Secure flags on the affinity cookie ([#4947](https://github.com/containous/traefik/pull/4947) by [gheibia](https://github.com/gheibia))
+- **[tls]** Define TLS options on the Router configuration ([#4931](https://github.com/containous/traefik/pull/4931) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tracing]** Added support for Haystack tracing ([#4555](https://github.com/containous/traefik/pull/4555) by [aantono](https://github.com/aantono))
+
+**Bug fixes:**
+- **[logs]** Fix typos in data collection message ([#4891](https://github.com/containous/traefik/pull/4891) by [mpl](https://github.com/mpl))
+- **[middleware]** change doc references to scheme[Rr]edirect -&gt; redirect[Ss]cheme ([#4959](https://github.com/containous/traefik/pull/4959) by [topiaruss](https://github.com/topiaruss))
+- **[rules]** Allow matching with FQDN hosts with trailing periods ([#4763](https://github.com/containous/traefik/pull/4763) by [dtomcej](https://github.com/dtomcej))
+- **[tcp]** Remove first byte wait when tcp catches all ([#4938](https://github.com/containous/traefik/pull/4938) by [juliens](https://github.com/juliens))
+- **[tcp]** Don&#39;t add TCP proxy when error occurs during creation. ([#4858](https://github.com/containous/traefik/pull/4858) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme]** Add note about ACME renewal ([#4860](https://github.com/containous/traefik/pull/4860) by [dtomcej](https://github.com/dtomcej))
+- **[docker]** Remove traefik.port from documentation ([#4886](https://github.com/containous/traefik/pull/4886) by [ldez](https://github.com/ldez))
+- **[docker]** Clarify docs with labels in Swarm Mode ([#4847](https://github.com/containous/traefik/pull/4847) by [mikesir87](https://github.com/mikesir87))
+- **[k8s]** Fix typo in the CRD documentation ([#4902](https://github.com/containous/traefik/pull/4902) by [llussy](https://github.com/llussy))
+- **[middleware,provider]** fix the documentation about middleware labels. ([#4888](https://github.com/containous/traefik/pull/4888) by [ldez](https://github.com/ldez))
+- **[middleware]** Review documentation ([#4798](https://github.com/containous/traefik/pull/4798) by [ldez](https://github.com/ldez))
+- **[middleware]** compress link fixed ([#4817](https://github.com/containous/traefik/pull/4817) by [gato](https://github.com/gato))
+- **[middleware]** Fix strip prefix documentation ([#4829](https://github.com/containous/traefik/pull/4829) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Fix Kubernetes Docs for Middlewares ([#4943](https://github.com/containous/traefik/pull/4943) by [HurricanKai](https://github.com/HurricanKai))
+- **[middleware]** Correct typo in documentation on rate limiting ([#4939](https://github.com/containous/traefik/pull/4939) by [ableuler](https://github.com/ableuler))
+- **[middleware]** docker-compose basic auth needs double dollar signs ([#4831](https://github.com/containous/traefik/pull/4831) by [muhlemmer](https://github.com/muhlemmer))
+- **[middleware]** Adds a reference to the middleware overview. ([#4824](https://github.com/containous/traefik/pull/4824) by [ldez](https://github.com/ldez))
+- **[middleware]** Update headers middleware docs for kubernetes crd ([#4955](https://github.com/containous/traefik/pull/4955) by [orhanhenrik](https://github.com/orhanhenrik))
+- **[rancher]** fix: Rancher documentation. ([#4818](https://github.com/containous/traefik/pull/4818) by [ldez](https://github.com/ldez))
+- **[rancher]** Specify that Rancher provider is for 1.x only ([#4923](https://github.com/containous/traefik/pull/4923) by [bradjones1](https://github.com/bradjones1))
+- **[tls]** fix: typo in routing example. ([#4849](https://github.com/containous/traefik/pull/4849) by [ldez](https://github.com/ldez))
+- Clarification of the correct pronunciation of the word &#34;Traefik&#34; ([#4834](https://github.com/containous/traefik/pull/4834) by [ylamlum-g4m](https://github.com/ylamlum-g4m))
+- Fix typos in documentation ([#4884](https://github.com/containous/traefik/pull/4884) by [michael-k](https://github.com/michael-k))
+- Entry points CLI description. ([#4896](https://github.com/containous/traefik/pull/4896) by [ldez](https://github.com/ldez))
+- Improve the &#34;reading path&#34; for new contributors ([#4908](https://github.com/containous/traefik/pull/4908) by [dduportal](https://github.com/dduportal))
+- Fixed spelling typo ([#4848](https://github.com/containous/traefik/pull/4848) by [mikesir87](https://github.com/mikesir87))
+- Fixed readme misspelling ([#4882](https://github.com/containous/traefik/pull/4882) by [antondalgren](https://github.com/antondalgren))
+- Minor fix in documentation ([#4811](https://github.com/containous/traefik/pull/4811) by [mmatur](https://github.com/mmatur))
+- Add Mathieu Lonjaret to maintainers ([#4950](https://github.com/containous/traefik/pull/4950) by [emilevauge](https://github.com/emilevauge))
+- Fix a typo in documentation ([#4794](https://github.com/containous/traefik/pull/4794) by [groovytron](https://github.com/groovytron))
+
+**Misc:**
+- Cherry pick v1.7 into v2.0 ([#4948](https://github.com/containous/traefik/pull/4948) by [ldez](https://github.com/ldez))
+- Cherry pick v1.7 into v2.0 ([#4823](https://github.com/containous/traefik/pull/4823) by [ldez](https://github.com/ldez))
+
+## [v1.7.12](https://github.com/containous/traefik/tree/v1.7.12) (2019-05-29)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.11...v1.7.12)
+
+**Bug fixes:**
+- **[acme]** Allow SANs for wildcards domain. ([#4821](https://github.com/containous/traefik/pull/4821) by [vizv](https://github.com/vizv))
+- **[acme]** fix: update lego. ([#4910](https://github.com/containous/traefik/pull/4910) by [ldez](https://github.com/ldez))
+- **[api,authentication]** Remove authentication hashes from API ([#4918](https://github.com/containous/traefik/pull/4918) by [ldez](https://github.com/ldez))
+- **[consul]** Enhance KV logs. ([#4877](https://github.com/containous/traefik/pull/4877) by [ldez](https://github.com/ldez))
+- **[k8s]** Fix kubernetes template for backend responseforwarding flushinterval setting ([#4901](https://github.com/containous/traefik/pull/4901) by [ravilr](https://github.com/ravilr))
+- **[metrics]** Upgraded DataDog tracing library to 1.13.0 ([#4878](https://github.com/containous/traefik/pull/4878) by [aantono](https://github.com/aantono))
+- **[server]** Add missing callback on close of hijacked connections ([#4900](https://github.com/containous/traefik/pull/4900) by [ravilr](https://github.com/ravilr))
+
+**Documentation:**
+- **[docker]** Docs: Troubleshooting help for Docker Swarm labels ([#4751](https://github.com/containous/traefik/pull/4751) by [gregberns](https://github.com/gregberns))
+- **[logs]** Adds a log fields documentation. ([#4890](https://github.com/containous/traefik/pull/4890) by [ldez](https://github.com/ldez))
+
+## [v1.7.11](https://github.com/containous/traefik/tree/v1.7.11) (2019-04-26)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.10...v1.7.11)
+
+**Enhancements:**
+- **[k8s,k8s/ingress]** Enhance k8s tests maintainability ([#4696](https://github.com/containous/traefik/pull/4696) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[acme]** fix: update lego. ([#4800](https://github.com/containous/traefik/pull/4800) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Forward all header values from forward auth response ([#4515](https://github.com/containous/traefik/pull/4515) by [ctas582](https://github.com/ctas582))
+- **[cluster]** Remove usage of github.com/satori/go.uuid ([#4722](https://github.com/containous/traefik/pull/4722) by [aaslamin](https://github.com/aaslamin))
+- **[kv]** Enhance KV client error management ([#4819](https://github.com/containous/traefik/pull/4819) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tls]** Improve log message about redundant TLS certificate ([#4765](https://github.com/containous/traefik/pull/4765) by [mpl](https://github.com/mpl))
+- **[tracing]** Update zipkin-go-opentracing. ([#4720](https://github.com/containous/traefik/pull/4720) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme]** Documentation Update: Hosting.de wildcard support tested ([#4747](https://github.com/containous/traefik/pull/4747) by [martinhoefling](https://github.com/martinhoefling))
+- **[acme]** Update Wildcard Domain documentation ([#4682](https://github.com/containous/traefik/pull/4682) by [DWSR](https://github.com/DWSR))
+- **[middleware]** Keep consistent order ([#4690](https://github.com/containous/traefik/pull/4690) by [maxifom](https://github.com/maxifom))
+
+## [v2.0.0-alpha4](https://github.com/containous/traefik/tree/v2.0.0-alpha4) (2019-04-17)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha3...v2.0.0-alpha4)
+
+**Enhancements:**
+- **[logs]** log.loglevel becomes log.level in configuration ([#4775](https://github.com/containous/traefik/pull/4775) by [juliens](https://github.com/juliens))
+- **[marathon,tcp]** Handle TCP in the marathon provider ([#4728](https://github.com/containous/traefik/pull/4728) by [juliens](https://github.com/juliens))
+- **[middleware]** Enable CORS configuration ([#3809](https://github.com/containous/traefik/pull/3809) by [dtomcej](https://github.com/dtomcej))
+- **[rancher]** Add Rancher provider ([#4647](https://github.com/containous/traefik/pull/4647) by [SantoDE](https://github.com/SantoDE))
+- **[tracing]** Update tracing dependencies ([#4721](https://github.com/containous/traefik/pull/4721) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[docker]** Insensitive case for allow-empty value. ([#4745](https://github.com/containous/traefik/pull/4745) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix response modifier initial building ([#4719](https://github.com/containous/traefik/pull/4719) by [mpl](https://github.com/mpl))
+- **[middleware]** Set X-Forwarded-* headers ([#4707](https://github.com/containous/traefik/pull/4707) by [mpl](https://github.com/mpl))
+- **[tcp]** Fix EOF error ([#4733](https://github.com/containous/traefik/pull/4733) by [juliens](https://github.com/juliens))
+
+**Documentation:**
+- **[acme]** Use the same case every where for entryPoints. ([#4764](https://github.com/containous/traefik/pull/4764) by [ldez](https://github.com/ldez))
+- **[docker]** Fix two minor nits in Traefik 2.0 docs ([#4692](https://github.com/containous/traefik/pull/4692) by [cfra](https://github.com/cfra))
+- **[k8s,k8s/crd]** k8s static configuration explanation ([#4767](https://github.com/containous/traefik/pull/4767) by [ldez](https://github.com/ldez))
+- **[marathon]** Enhance Marathon documentation ([#4776](https://github.com/containous/traefik/pull/4776) by [ldez](https://github.com/ldez))
+- **[middleware,k8s,k8s/crd]** Fix typo: middleware -&gt; middlewares. ([#4781](https://github.com/containous/traefik/pull/4781) by [ldez](https://github.com/ldez))
+- **[middleware]** Adds middlewares examples for k8s. ([#4713](https://github.com/containous/traefik/pull/4713) by [ldez](https://github.com/ldez))
+- **[middleware]** Remove invalid commas. ([#4706](https://github.com/containous/traefik/pull/4706) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix doc about removing headers ([#4708](https://github.com/containous/traefik/pull/4708) by [mpl](https://github.com/mpl))
+- **[middleware]** Update the middleware documentation ([#4729](https://github.com/containous/traefik/pull/4729) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tracing]** Fix typo in tracing docs ([#4737](https://github.com/containous/traefik/pull/4737) by [timoschwarzer](https://github.com/timoschwarzer))
+- Improve the Documentation with a Reference Section ([#4714](https://github.com/containous/traefik/pull/4714) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Adds a note in traefik.sample.toml ([#4757](https://github.com/containous/traefik/pull/4757) by [ldez](https://github.com/ldez))
+- Update to v2.0 readme links ([#4700](https://github.com/containous/traefik/pull/4700) by [karnthis](https://github.com/karnthis))
+- Remove dumpcerts.sh ([#4783](https://github.com/containous/traefik/pull/4783) by [ldez](https://github.com/ldez))
+
+**Misc:**
+- Cherry pick v1.7 into v2.0 ([#4787](https://github.com/containous/traefik/pull/4787) by [ldez](https://github.com/ldez))
+- Cherry pick v1.7 into v2.0 ([#4695](https://github.com/containous/traefik/pull/4695) by [jbdoumenjou](https://github.com/jbdoumenjou))
+
+## [v2.0.0-alpha3](https://github.com/containous/traefik/tree/v2.0.0-alpha3) (2019-03-29)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha2...v2.0.0-alpha3)
+
+**Enhancements:**
+- **[acme,k8s,k8s/crd]** Document the TLS with ACME case ([#4654](https://github.com/containous/traefik/pull/4654) by [mpl](https://github.com/mpl))
+- **[docker,tcp]** Add support for TCP labels in Docker provider ([#4621](https://github.com/containous/traefik/pull/4621) by [juliens](https://github.com/juliens))
+- **[provider]** Remove BaseProvider ([#4661](https://github.com/containous/traefik/pull/4661) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[server]** Fix panic while server shutdown ([#4644](https://github.com/containous/traefik/pull/4644) by [juliens](https://github.com/juliens))
+
+**Documentation:**
+- **[acme,k8s,k8s/crd]** Full ACME+CRD example ([#4652](https://github.com/containous/traefik/pull/4652) by [mpl](https://github.com/mpl))
+- **[acme]** Enhance manual dnsChallenge documentation ([#4636](https://github.com/containous/traefik/pull/4636) by [ntaranov](https://github.com/ntaranov))
+- **[docker]** Fix Getting started ([#4646](https://github.com/containous/traefik/pull/4646) by [mmatur](https://github.com/mmatur))
+- **[docker]** docker-compose examples ([#4642](https://github.com/containous/traefik/pull/4642) by [karnthis](https://github.com/karnthis))
+- **[middleware]** Fix typo in forwardAuth middleware documentation ([#4638](https://github.com/containous/traefik/pull/4638) by [AkeemMcLennon](https://github.com/AkeemMcLennon))
+- **[middleware]** Enhance middleware examples. ([#4680](https://github.com/containous/traefik/pull/4680) by [ldez](https://github.com/ldez))
+- Fix typos in docs ([#4662](https://github.com/containous/traefik/pull/4662) by [SeMeKh](https://github.com/SeMeKh))
+- Remove old links in readme ([#4651](https://github.com/containous/traefik/pull/4651) by [ldez](https://github.com/ldez))
+- Fix some minors errors on the documentation ([#4664](https://github.com/containous/traefik/pull/4664) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Fix dead maintainers link on the README.md ([#4639](https://github.com/containous/traefik/pull/4639) by [benjaminch](https://github.com/benjaminch))
+- Update traefik.sample.toml ([#4657](https://github.com/containous/traefik/pull/4657) by [ldez](https://github.com/ldez))
+
 ## [v2.0.0-alpha2](https://github.com/containous/traefik/tree/v2.0.0-alpha2) (2019-03-19)
 [All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha1...v2.0.0-alpha2)

@@ -105,6 +251,23 @@
 - Merge v1.7.0-rc4 into master ([#3867](https://github.com/containous/traefik/pull/3867) by [ldez](https://github.com/ldez))
 - Merge v1.7.0-rc2 into master ([#3634](https://github.com/containous/traefik/pull/3634) by [ldez](https://github.com/ldez))

+## [v1.7.10](https://github.com/containous/traefik/tree/v1.7.10) (2019-03-28)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.9...v1.7.10)
+
+**Bug fixes:**
+- **[acme]** fix: update lego. ([#4670](https://github.com/containous/traefik/pull/4670) by [ldez](https://github.com/ldez))
+- **[acme]** Migrate to go-acme/lego. ([#4577](https://github.com/containous/traefik/pull/4577) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Reorder Auth and TLSClientHeaders middleware ([#4557](https://github.com/containous/traefik/pull/4557) by [tomberek](https://github.com/tomberek))
+- **[k8s/ingress]** Support external name service on global default backend ([#4564](https://github.com/containous/traefik/pull/4564) by [kippandrew](https://github.com/kippandrew))
+- **[k8s/ingress]** Loop through service ports for global backend ([#4486](https://github.com/containous/traefik/pull/4486) by [dtomcej](https://github.com/dtomcej))
+- **[k8s]** Add entrypoints prefix in kubernetes frontend/backend id  ([#4679](https://github.com/containous/traefik/pull/4679) by [juliens](https://github.com/juliens))
+- **[websocket]** Exclude websocket connections from Average Response Time ([#4313](https://github.com/containous/traefik/pull/4313) by [siyu6974](https://github.com/siyu6974))
+- **[middleware]** Added support for configuring trace headers for DataDog tracing ([#4516](https://github.com/containous/traefik/pull/4516) by [aantono](https://github.com/aantono))
+
+**Documentation:**
+- **[acme]** Add _FILE Environment Variable Documentation ([#4643](https://github.com/containous/traefik/pull/4643) by [dargmuesli](https://github.com/dargmuesli))
+- **[docker]** Add TraefikEE as security workaround ([#4606](https://github.com/containous/traefik/pull/4606) by [emilevauge](https://github.com/emilevauge))
+
 ## [v1.7.9](https://github.com/containous/traefik/tree/v1.7.9) (2019-02-11)
 [All Commits](https://github.com/containous/traefik/compare/v1.7.8...v1.7.9)

@@ -130,7 +293,7 @@
 - **[acme]** Updates lego. ([#4376](https://github.com/containous/traefik/pull/4376) by [ldez](https://github.com/ldez))
 - **[docker]** Fixes docker swarm mode refresh second for KV. ([#4420](https://github.com/containous/traefik/pull/4420) by [ldez](https://github.com/ldez))
 - **[ecs]** Generic awsvpc support, not just Fargate ([#4360](https://github.com/containous/traefik/pull/4360) by [maartenvanderhoef](https://github.com/maartenvanderhoef))
- **[ecs]** Cache exising task definitions to avoid rate limiting ([#4177](https://github.com/containous/traefik/pull/4177) by [hwhelan-CB](https://github.com/hwhelan-CB))
+- **[ecs]** Cache existing task definitions to avoid rate limiting ([#4177](https://github.com/containous/traefik/pull/4177) by [hwhelan-CB](https://github.com/hwhelan-CB))
 - **[tls]** Check for dynamic tls updates on configuration preload ([#4022](https://github.com/containous/traefik/pull/4022) by [ffilippopoulos](https://github.com/ffilippopoulos))
 - **[tracing]** Support Datadog tracer priority sampling ([#4359](https://github.com/containous/traefik/pull/4359) by [jcassee](https://github.com/jcassee))
 - Update to Go 1.11.5 [CVE-2019-6486](https://nvd.nist.gov/vuln/detail/CVE-2019-6486)
@@ -255,7 +418,7 @@
 **Bug fixes:**
 - **[acme]** DNS challenge Cloudflare auth zone ([#4042](https://github.com/containous/traefik/pull/4042) by [ldez](https://github.com/ldez))
 - **[acme]** ACME DNS challenges ([#3998](https://github.com/containous/traefik/pull/3998) by [ldez](https://github.com/ldez))
- **[acme]** Don&#39;t initalize ACME provider if storage is empty ([#3988](https://github.com/containous/traefik/pull/3988) by [nmengin](https://github.com/nmengin))
+- **[acme]** Don&#39;t initialize ACME provider if storage is empty ([#3988](https://github.com/containous/traefik/pull/3988) by [nmengin](https://github.com/nmengin))
 - **[acme]** Fix: acme DNS providers ([#4021](https://github.com/containous/traefik/pull/4021) by [ldez](https://github.com/ldez))
 - **[acme]** Prevent some malformed errors in LE. ([#4015](https://github.com/containous/traefik/pull/4015) by [ldez](https://github.com/ldez))
 - **[authentication,consulcatalog,docker,ecs,etcd,kv,marathon,mesos,rancher]** Add the AuthResponseHeaders to the labels ([#3973](https://github.com/containous/traefik/pull/3973) by [Crypto89](https://github.com/Crypto89))
@@ -330,7 +493,7 @@
 - **[healthcheck]** Support all 2xx HTTP status code for health check. ([#3362](https://github.com/containous/traefik/pull/3362) by [ldez](https://github.com/ldez))
 - **[healthcheck]** Add HTTP headers to healthcheck. ([#3047](https://github.com/containous/traefik/pull/3047) by [zetaab](https://github.com/zetaab))
 - **[k8s]** Add more k8s tests ([#3491](https://github.com/containous/traefik/pull/3491) by [dtomcej](https://github.com/dtomcej))
- **[k8s]** Substitude hardcoded &#34;&lt;namespace&gt;/&lt;name&gt;&#34; with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Substitute hardcoded &#34;&lt;namespace&gt;/&lt;name&gt;&#34; with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
 - **[k8s]** Custom frontend name for test helper ([#3444](https://github.com/containous/traefik/pull/3444) by [ldez](https://github.com/ldez))
 - **[k8s]** Add annotation to allow modifiers to be used properly in kubernetes ([#3481](https://github.com/containous/traefik/pull/3481) by [dtomcej](https://github.com/dtomcej))
 - **[k8s]** Create Global Backend Ingress ([#3404](https://github.com/containous/traefik/pull/3404) by [dtomcej](https://github.com/dtomcej))
@@ -627,7 +790,7 @@
 - **[healthcheck]** Support all 2xx HTTP status code for health check. ([#3362](https://github.com/containous/traefik/pull/3362) by [ldez](https://github.com/ldez))
 - **[healthcheck]** Add HTTP headers to healthcheck. ([#3047](https://github.com/containous/traefik/pull/3047) by [zetaab](https://github.com/zetaab))
 - **[k8s]** Add more k8s tests ([#3491](https://github.com/containous/traefik/pull/3491) by [dtomcej](https://github.com/dtomcej))
- **[k8s]** Substitude hardcoded &#34;&lt;namespace&gt;/&lt;name&gt;&#34; with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Substitute hardcoded &#34;&lt;namespace&gt;/&lt;name&gt;&#34; with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
 - **[k8s]** Custom frontend name for test helper ([#3444](https://github.com/containous/traefik/pull/3444) by [ldez](https://github.com/ldez))
 - **[k8s]** Add annotation to allow modifiers to be used properly in kubernetes ([#3481](https://github.com/containous/traefik/pull/3481) by [dtomcej](https://github.com/dtomcej))
 - **[k8s]** Create Global Backend Ingress ([#3404](https://github.com/containous/traefik/pull/3404) by [dtomcej](https://github.com/dtomcej))
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,3 +1,3 @@
 # Contributing

-See https://docs.traefik.io.
+See <https://docs.traefik.io/v2.0/contributing/thank-you/>.
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -9,22 +9,6 @@
  revision = "056a55f54a6cc77b440b31a56a5e7c3982d32811"
  version = "v0.22.0"

-[[projects]]
-  branch = "master"
-  digest = "1:24afd6a7be85997c981693ddcc5f7b37fd3ed5cb119901e14737b9635b944cfb"
-  name = "github.com/ArthurHlt/go-eureka-client"
-  packages = ["eureka"]
-  pruneopts = "NUT"
-  revision = "9d0a49cbd39aa3634ae1977e9f519a262b10adaf"
-
-[[projects]]
-  branch = "master"
-  digest = "1:922aa650254d0678003e182aeb75f6b094a0bfc40a87d198859d511cdafcfa8a"
-  name = "github.com/ArthurHlt/gominlog"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "72eebf980f467d3ab3a8b4ddf660f664911ce519"
-
 [[projects]]
  digest = "1:59f6c2fd10ad014d2907eaa48a19070d5e7af35624328a4fbbf93b7b1c4a19e8"
  name = "github.com/Azure/azure-sdk-for-go"
@@ -71,15 +55,12 @@
  revision = "a368813c5e648fee92e5f6c30e3944ff9d5e8895"

 [[projects]]
-  branch = "master"
-  digest = "1:28e560d27a06cbebacd86531439aafa31c6da990607ca5a085d0005af325697f"
-  name = "github.com/BurntSushi/ty"
-  packages = [
-    ".",
-    "fun",
-  ]
+  digest = "1:be4a03871fbc5250d19bcbc2d2b21c3c58fd97b048de64ec1ff4c8e3890d4f1b"
+  name = "github.com/ExpediaDotCom/haystack-client-go"
+  packages = ["."]
  pruneopts = "NUT"
-  revision = "6add9cd6ad42d389d6ead1dde60b4ad71e46fd74"
+  revision = "e7edbdf53a61a82ed143809088ed582312ff7e36"
+  version = "0.2.3"

 [[projects]]
  digest = "1:ab7fee312bbdc8070d0325d841de8704cc78bf032b076200f1458659b74b8ed6"
@@ -88,6 +69,14 @@
  pruneopts = "NUT"
  revision = "2fd0705ce648e602e6c9c57329a174270a4f6688"

+[[projects]]
+  digest = "1:25870183293a3fb61cc9afd060a61d63a486f091db72af01a8ea3449f5ca530d"
+  name = "github.com/Masterminds/goutils"
+  packages = ["."]
+  pruneopts = "NUT"
+  revision = "41ac8693c5c10a92ea1ff5ac3a7f95646f6123b0"
+  version = "v1.1.0"
+
 [[projects]]
  digest = "1:0ce2a409217f52078c6b8642993deb1025940cded6d5054047c1d5c7379f753c"
  name = "github.com/Masterminds/semver"
@@ -97,11 +86,12 @@
  version = "v1.2.2"

 [[projects]]
-  digest = "1:a49472e7d73071005f436b7da85567220f24bb26fbfccbec45d2cd1359d4c67d"
+  digest = "1:876a1121171c083c4e3a4789683d02a40c0f644c8190da521d15b59799f556d6"
  name = "github.com/Masterminds/sprig"
  packages = ["."]
  pruneopts = "NUT"
-  revision = "e039e20e500c2c025d9145be375e27cf42a94174"
+  revision = "9f8fceff796fb9f4e992cd2bece016be0121ab74"
+  version = "2.19.0"

 [[projects]]
  digest = "1:915c86626dfd65f8105c48b2972d29f34fd77ff16b31157147cb8ebbddeebbe3"
@@ -161,16 +151,9 @@

 [[projects]]
  branch = "master"
-  digest = "1:d4ad87edcd6f6b6cfd1bfe8da6dd090e00901601c9270aa2928842402a361475"
+  digest = "1:d37d0fa13c422a0b85981fe42ff8f176885921294cf0c3ce585c160669cc32bb"
  name = "github.com/abronan/valkeyrie"
-  packages = [
-    ".",
-    "store",
-    "store/boltdb",
-    "store/consul",
-    "store/etcd/v3",
-    "store/zookeeper",
-  ]
+  packages = ["store"]
  pruneopts = "NUT"
  revision = "063d875e3c5fd734fa2aa12fac83829f62acfc70"

@@ -207,20 +190,12 @@
  version = "1.27.7"

 [[projects]]
-  digest = "1:975108e8d4f5dab096fc991326e96a5716ee8d02e5e7386bb4796171afc4ab9a"
-  name = "github.com/aokoli/goutils"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "3391d3790d23d03408670993e957e8f408993c34"
-  version = "v1.0.1"
-
-[[projects]]
-  digest = "1:9752dad5e89cd779096bf2477a4ded16bea7ac62de453c8d6b4bf841d51a8512"
+  digest = "1:b39cf81d5f440b9c0757a25058432d33af867e5201109bf53621356d9dab4b73"
  name = "github.com/apache/thrift"
  packages = ["lib/go/thrift"]
  pruneopts = "NUT"
-  revision = "b2a4d4ae21c789b689dd162deb819665567f481c"
-  version = "0.10.0"
+  revision = "384647d290e2e4a55a14b1b7ef1b7e66293a2c33"
+  version = "v0.12.0"

 [[projects]]
  branch = "master"
@@ -231,7 +206,7 @@
  revision = "48572f11356f1843b694f21a290d4f1006bc5e47"

 [[projects]]
-  digest = "1:bfb036834a43e76abd318f0db39b0bbec6f7865680c1e443475c0297250a89ed"
+  digest = "1:9991a3fc14d9de52a55cdb5a5f1f237140684eab050251ecfaaafa239a8ab5c9"
  name = "github.com/aws/aws-sdk-go"
  packages = [
    "aws",
@@ -254,7 +229,6 @@
    "internal/sdkrand",
    "internal/shareddefaults",
    "private/protocol",
-    "private/protocol/ec2query",
    "private/protocol/json/jsonutil",
    "private/protocol/jsonrpc",
    "private/protocol/query",
@@ -262,11 +236,6 @@
    "private/protocol/rest",
    "private/protocol/restxml",
    "private/protocol/xml/xmlutil",
-    "service/dynamodb",
-    "service/dynamodb/dynamodbattribute",
-    "service/dynamodb/dynamodbiface",
-    "service/ec2",
-    "service/ecs",
    "service/lightsail",
    "service/route53",
    "service/sts",
@@ -323,17 +292,6 @@
  pruneopts = "NUT"
  revision = "d83ebdd94cbdbcd9c6c6a22e1a0cde05e55d9d90"

-[[projects]]
-  digest = "1:3cd675d508d3f9067704d36011c7a262fc0a0bf1ad0361a7d1e60a405d12941e"
-  name = "github.com/containous/flaeg"
-  packages = [
-    ".",
-    "parse",
-  ]
-  pruneopts = "NUT"
-  revision = "c93d194b807ef171c43344d60adad8b58217390a"
-  version = "v1.4.1"
-
 [[projects]]
  branch = "master"
  digest = "1:3a789aa5487458c1fc913b47be763e5906e1524f1143acb8617287866184f9a7"
@@ -342,37 +300,6 @@
  pruneopts = "NUT"
  revision = "c33f32e268983f989290677351b871b65da75ba5"

-[[projects]]
-  digest = "1:a4f16a1b72349621b887bde88f458da518160abcb600eae3d591d8a2afa78bda"
-  name = "github.com/containous/staert"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "7a9987c3a6d46be84e141a5c3191347ec10af17d"
-  version = "v3.1.2"
-
-[[projects]]
-  digest = "1:4e9c9d51ef5c98f2a71d6fa56a22f0bb8a4463656f9591ba24ebff2c21bcbd1f"
-  name = "github.com/coreos/bbolt"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "32c383e75ce054674c53b5a07e55de85332aee14"
-
-[[projects]]
-  digest = "1:f07fcc19d52f5d9f559573c6b625142bc4b018fd275029c020d06d2bad6f6c8c"
-  name = "github.com/coreos/etcd"
-  packages = [
-    "auth/authpb",
-    "clientv3",
-    "clientv3/concurrency",
-    "etcdserver/api/v3rpc/rpctypes",
-    "etcdserver/etcdserverpb",
-    "mvcc/mvccpb",
-    "pkg/types",
-  ]
-  pruneopts = "NUT"
-  revision = "70c8726202dd91e482fb4029fd14af1d4ed1d5af"
-  version = "v3.3.5"
-
 [[projects]]
  digest = "1:fa91847d50d3f656fc2d2d608b9749b97d77528e8988ad8001f957640545e91e"
  name = "github.com/coreos/go-systemd"
@@ -543,15 +470,6 @@
  pruneopts = "NUT"
  revision = "9e638d38cf6977a37a8ea0078f3ee75a7cdb2dd1"

-[[projects]]
-  branch = "master"
-  digest = "1:2de676f0b5c5d051ae4343503760069de753c995a3cb3b01544a4924c65a93aa"
-  name = "github.com/docker/leadership"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "a2e096d9fe0af5b4c37dd37aea719bc9c2e5eec6"
-  source = "github.com/containous/leadership"
-
 [[projects]]
  branch = "master"
  digest = "1:9b26bdc6b9952f728f61f510a48875c38974591c69b0afa77dcfe466c6162e9e"
@@ -635,13 +553,6 @@
  revision = "0a91ac8209d6a805f259ff881d0c2654221d0346"
  version = "v0.14.3"

-[[projects]]
-  digest = "1:b0d5e98ac0f0a509eb320f542e748582d637aae09e74538212e9712d1e71064b"
-  name = "github.com/fatih/color"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "62e9147c64a1ed519147b62a56a14e83e2be02c1"
-
 [[projects]]
  digest = "1:aa3ed0a71c4e66e4ae6486bf97a3f4cab28edc78df2e50c5ad01dc7d91604b88"
  name = "github.com/fatih/structs"
@@ -673,8 +584,7 @@
  revision = "73d445a93680fa1a78ae23a5839bad48f32ba1ee"

 [[projects]]
-  branch = "master"
-  digest = "1:7dcfb91047873eb70b3a20ed5c400c4d05d9c1e73c9dac0e71ec0d44589d208a"
+  digest = "1:d82b2dc81c551e7c15f31523a2cc8ee9121b39cfbf63174d98a0bc8edf2d3c5e"
  name = "github.com/go-acme/lego"
  packages = [
    "acme",
@@ -698,6 +608,7 @@
    "providers/dns/alidns",
    "providers/dns/auroradns",
    "providers/dns/azure",
+    "providers/dns/bindman",
    "providers/dns/bluecat",
    "providers/dns/cloudflare",
    "providers/dns/cloudns",
@@ -712,9 +623,11 @@
    "providers/dns/dnsmadeeasy",
    "providers/dns/dnsmadeeasy/internal",
    "providers/dns/dnspod",
+    "providers/dns/dode",
    "providers/dns/dreamhost",
    "providers/dns/duckdns",
    "providers/dns/dyn",
+    "providers/dns/easydns",
    "providers/dns/exec",
    "providers/dns/exoscale",
    "providers/dns/fastdns",
@@ -727,6 +640,7 @@
    "providers/dns/httpreq",
    "providers/dns/iij",
    "providers/dns/inwx",
+    "providers/dns/joker",
    "providers/dns/lightsail",
    "providers/dns/linode",
    "providers/dns/linodev4",
@@ -758,7 +672,8 @@
    "registration",
  ]
  pruneopts = "NUT"
-  revision = "0c87df143e630a1c50b4c36c8fbdda6cd993ebba"
+  revision = "01903cdfb9869df45cf5274c53226823a2532f2d"
+  version = "v2.6.0"

 [[projects]]
  branch = "fork-containous"
@@ -769,6 +684,14 @@
  revision = "ca0bf163426aa183d03fd4949101785c0347f273"
  source = "github.com/containous/check"

+[[projects]]
+  digest = "1:ea1d5bfdb4ec5c2ee48c97865e6de1a28fa8c4849a3f56b27d521aa619038e06"
+  name = "github.com/go-errors/errors"
+  packages = ["."]
+  pruneopts = "NUT"
+  revision = "a6af135bd4e28680facf08a3d206b454abc877a4"
+  version = "v1.0.1"
+
 [[projects]]
  digest = "1:5e92676b56ce4c69edf9ee1f6343c56f637e30af11b9d8b5edd1b6530f3fbc3d"
  name = "github.com/go-ini/ini"
@@ -821,12 +744,10 @@
  version = "v1.5.4"

 [[projects]]
-  digest = "1:b518b9be1fc76244e246afe09113e3dd6246073b444787d30883877b82a0b90d"
+  digest = "1:6689652ec1f6e30455551da19c707f2bfac75e4df5c7bbe3f0ad7b49b9aa2cfc"
  name = "github.com/gogo/protobuf"
  packages = [
-    "gogoproto",
    "proto",
-    "protoc-gen-gogo/descriptor",
    "sortkeys",
  ]
  pruneopts = "NUT"
@@ -841,7 +762,7 @@
  revision = "44145f04b68cf362d9c4df2182967c2275eaefed"

 [[projects]]
-  digest = "1:03e14cff610a8a58b774e36bd337fa979482be86aab01be81fb8bbd6d0f07fc8"
+  digest = "1:2d0636a8c490d2272dd725db26f74a537111b99b9dbdda0d8b98febe63702aa4"
  name = "github.com/golang/protobuf"
  packages = [
    "proto",
@@ -851,8 +772,8 @@
    "ptypes/timestamp",
  ]
  pruneopts = "NUT"
-  revision = "b4deda0973fb4c70b50d226b1af49f3da59f5265"
-  version = "v1.1.0"
+  revision = "b5d812f8a3706043e23a9cd5babf2e5423744d30"
+  version = "v1.3.1"

 [[projects]]
  branch = "master"
@@ -971,29 +892,6 @@
  pruneopts = "NUT"
  revision = "2bcd89a1743fd4b373f7370ce8ddc14dfbd18229"

-[[projects]]
-  digest = "1:c3f14b698c0f5c5729896489f4b526f519d1d2522e697d63f532901d0e183dff"
-  name = "github.com/hashicorp/consul"
-  packages = ["api"]
-  pruneopts = "NUT"
-  revision = "9a494b5fb9c86180a5702e29c485df1507a47198"
-  version = "v1.0.6"
-
-[[projects]]
-  digest = "1:7b699584752575e81e3f4e8b00cfb3e5d6fa5419d5d212ef925e02c798847464"
-  name = "github.com/hashicorp/go-cleanhttp"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "3573b8b52aa7b37b9358d966a898feb387f62437"
-
-[[projects]]
-  branch = "master"
-  digest = "1:cdb5ce76cd7af19e3d2d5ba9b6458a2ee804f0d376711215dd3df5f51100d423"
-  name = "github.com/hashicorp/go-rootcerts"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "6bb64b370b90e7ef1fa532be9e591a81c3493e00"
-
 [[projects]]
  digest = "1:f7b3db9cb74d13f6a7cf84b3801e68585745eacaf7d40cc10ecc4734c30503d3"
  name = "github.com/hashicorp/go-version"
@@ -1013,18 +911,12 @@
  revision = "0fb14efe8c47ae851c0034ed7a448854d3d34cf3"

 [[projects]]
-  digest = "1:c6552ffc71f7586a9ea624c6b2bdab87a47d9bd52889e3baf5fbf200425a85e2"
-  name = "github.com/hashicorp/serf"
-  packages = ["coordinate"]
-  pruneopts = "NUT"
-  revision = "19f2c401e122352c047a84d6584dd51e2fb8fcc4"
-
-[[projects]]
-  digest = "1:45e66b20393507035c6a7d15bef5ffe8faf5b083621c1284d9824cc052776de5"
+  digest = "1:dc54242755f5b6721dd880843de6e45fe234838ea9149ec8249951880fd5802f"
  name = "github.com/huandu/xstrings"
  packages = ["."]
  pruneopts = "NUT"
-  revision = "3959339b333561bf62a38b424fd41517c2c90f40"
+  revision = "f02667b379e2fb5916c3cda2cf31e0eb885d79f8"
+  version = "v1.2.0"

 [[projects]]
  branch = "master"
@@ -1119,6 +1011,25 @@
  pruneopts = "NUT"
  revision = "b84e30acd515aadc4b783ad4ff83aff3299bdfe0"

+[[projects]]
+  digest = "1:1082aeb059ff66b4fb6da53f9e7591726c6a81901f05ce48a470091784b23914"
+  name = "github.com/labbsr0x/bindman-dns-webhook"
+  packages = [
+    "src/client",
+    "src/types",
+  ]
+  pruneopts = "NUT"
+  revision = "234ca2a50eebc2095f42a884709a6e9013366d86"
+  version = "v1.0.0"
+
+[[projects]]
+  branch = "master"
+  digest = "1:ad2a63b2d6dfe7d66bf14c01f1171a3951abef6e0fb136170359c3f7c4f51615"
+  name = "github.com/labbsr0x/goh"
+  packages = ["gohclient"]
+  pruneopts = "NUT"
+  revision = "60aa50bcbca768de1b8d37d7185daab4cf023ed2"
+
 [[projects]]
  branch = "master"
  digest = "1:5a96e1f04259484b3dd183ca95d1e7bff768b1bab36c530e308a8d56243b50c7"
@@ -1192,20 +1103,6 @@
  pruneopts = "NUT"
  revision = "c1c17f74874f2a5ea48bfb06b5459d4ef2689749"

-[[projects]]
-  digest = "1:4953945f4fdc12cb7aa0263710534fb64b35a85e4047570fdf1cb03284055f0d"
-  name = "github.com/mattn/go-colorable"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "5411d3eea5978e6cdc258b30de592b60df6aba96"
-
-[[projects]]
-  digest = "1:89e4861dccb76fd84b7de2d88791cc8d23e125805397db27195b4dd83c459713"
-  name = "github.com/mattn/go-isatty"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "57fdcb988a5c543893cc61bce354a6e24ab70022"
-
 [[projects]]
  branch = "master"
  digest = "1:5985ef4caf91ece5d54817c11ea25f182697534f8ae6521eadcd628c142ac4b6"
@@ -1214,37 +1111,6 @@
  pruneopts = "NUT"
  revision = "c12348ce28de40eed0136aa2b644d0ee0650e56c"

-[[projects]]
-  digest = "1:337c4007f8ecd8092927c3f9d3c7e391a9e7222aa579dd07a6008379d92d61f6"
-  name = "github.com/mesos/mesos-go"
-  packages = [
-    "detector",
-    "detector/zoo",
-    "mesosproto",
-    "mesosutil",
-    "upid",
-  ]
-  pruneopts = "NUT"
-  revision = "068d5470506e3780189fe607af40892814197c5e"
-
-[[projects]]
-  branch = "master"
-  digest = "1:940a93ac88a908ef0908939181ab048c4172ba7babd32d896ac8b1ef5c1f9036"
-  name = "github.com/mesosphere/mesos-dns"
-  packages = [
-    "detect",
-    "errorutil",
-    "logging",
-    "models",
-    "records",
-    "records/labels",
-    "records/state",
-    "util",
-  ]
-  pruneopts = "NUT"
-  revision = "b47dc4c19f215e98da687b15b4c64e70f629bea5"
-  source = "https://github.com/containous/mesos-dns.git"
-
 [[projects]]
  digest = "1:b83995756f9b1a24c518d40052d80f524f0a9024ee0479d8a8e91ec2548074d1"
  name = "github.com/miekg/dns"
@@ -1340,14 +1206,6 @@
  revision = "d8152159450570012552f924a0ae6ab3d8c617e0"
  version = "v0.6.0"

-[[projects]]
-  branch = "master"
-  digest = "1:95d27e49401b61dd203a4cf8237037bd6cd49599651f855ac1988c4ae27b090e"
-  name = "github.com/ogier/pflag"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "45c278ab3607870051a2ea9040bb85fcb8557481"
-
 [[projects]]
  digest = "1:69e47979091e47a10e5ff0e2776ca71aa3e884238ce446bd71e246878ba0858d"
  name = "github.com/opencontainers/go-digest"
@@ -1395,7 +1253,7 @@
  version = "v1.0.0"

 [[projects]]
-  digest = "1:7da29c22bcc5c2ffb308324377dc00b5084650348c2799e573ed226d8cc9faf0"
+  digest = "1:6846140b3f116579680eefdc17145f2bcf064b68deb9febf86b4419a454049af"
  name = "github.com/opentracing/opentracing-go"
  packages = [
    ".",
@@ -1403,12 +1261,12 @@
    "log",
  ]
  pruneopts = "NUT"
-  revision = "1949ddbfd147afd4d964a9f00b24eb291e0e7c38"
-  version = "v1.0.2"
+  revision = "659c90643e714681897ec2521c60567dd21da733"
+  version = "v1.1.0"

 [[projects]]
-  digest = "1:07c44a0ce6012eafd2f05b715d30852d576aeda7798b8760a2ff51b1e90eb753"
-  name = "github.com/openzipkin/zipkin-go-opentracing"
+  digest = "1:0f4793617dc898d3ee99fe1abab076d3976a9d17d14f8327af2dc3f1ec0fd92c"
+  name = "github.com/openzipkin-contrib/zipkin-go-opentracing"
  packages = [
    ".",
    "flag",
@@ -1418,7 +1276,8 @@
    "wire",
  ]
  pruneopts = "NUT"
-  revision = "1f5c07e90700ae93ddcba0c7af7d9c7201646ccc"
+  revision = "f0f479ad013a498e4cbfb369414e5d3880903779"
+  version = "v0.3.5"

 [[projects]]
  digest = "1:b52f6b7059f06a11ab6ab039714dda0d93878d9227f84c84ca9b6f046bfb5fef"
@@ -1540,20 +1399,13 @@
  pruneopts = "NUT"
  revision = "a1dba9ce8baed984a2495b658c82687f8157b98f"

-[[projects]]
-  digest = "1:f140e414b284a500b812b26bda8b9a5110aa110f0473ec97e79f3245000c730a"
-  name = "github.com/rancher/go-rancher"
-  packages = ["v2"]
-  pruneopts = "NUT"
-  revision = "52e2f489534007ae843065468c5a1920d542afa4"
-
 [[projects]]
  branch = "containous-fork"
-  digest = "1:4e63da6276e18c5e12eadef1ec3cabd437698bef5e60ffdce7a75b492cd1c14e"
+  digest = "1:f103263e55945772fcb058736a03dfc2796c6a14b99b1684b8e88327c0fa0f75"
  name = "github.com/rancher/go-rancher-metadata"
  packages = ["metadata"]
  pruneopts = "NUT"
-  revision = "e937e8308985dfd3bc157cc8a284454f0cbf4fef"
+  revision = "c6a65f8b7a28edc424e85732df4cd1c215843a99"
  source = "github.com/containous/go-rancher-metadata"

 [[projects]]
@@ -1572,24 +1424,18 @@
  revision = "256dc444b735e061061cf46c809487313d5b0065"

 [[projects]]
-  branch = "master"
-  digest = "1:fff470b0a7bbf05cfe8bfc73bfdf4d21eb009ea84e601f3d27781474e5da960f"
+  digest = "1:253f275bd72c42f8d234712d1574c8b222fe9b72838bfaca11b21ace9c0e3d0a"
  name = "github.com/sacloud/libsacloud"
  packages = [
    ".",
    "api",
    "sacloud",
    "sacloud/ostype",
+    "utils/mutexkv",
  ]
  pruneopts = "NUT"
-  revision = "306ea89b6ef19334614f7b0fc5aa19595022bb8c"
-
-[[projects]]
-  digest = "1:142520cf3c9bb85449dd0000f820b8c604531587ee654793c54909be7dabadac"
-  name = "github.com/samuel/go-zookeeper"
-  packages = ["zk"]
-  pruneopts = "NUT"
-  revision = "1d7be4effb13d2d908342d349d71a284a7542693"
+  revision = "41c392dee98a83260abbe0fcd5c13beb7c75d103"
+  version = "v1.21.1"

 [[projects]]
  digest = "1:6bc0652ea6e39e22ccd522458b8bdd8665bf23bdc5a20eec90056e4dc7e273ca"
@@ -1600,12 +1446,12 @@
  version = "v1.2.0"

 [[projects]]
-  digest = "1:01252cd79aac70f16cac02a72a1067dd136e0ad6d5b597d0129cf74c739fd8d1"
+  digest = "1:bb9033d47c116ea3b981ff159bdef73df8351b0b9700da2066339b97211b1bf0"
  name = "github.com/sirupsen/logrus"
  packages = ["."]
  pruneopts = "NUT"
-  revision = "a67f783a3814b8729bd2dac5780b5f78f8dbd64d"
-  version = "v1.1.0"
+  revision = "dae0fa8d5b0c810a8ab733fbd5510c7cae84eca4"
+  version = "v1.4.0"

 [[projects]]
  digest = "1:9d8420bbf131d1618bde6530af37c3799340d3762cc47210c1d9532a4c3a2779"
@@ -1643,13 +1489,6 @@
  pruneopts = "NUT"
  revision = "c4434f09ec131ecf30f986d5dcb1636508bfa49a"

-[[projects]]
-  digest = "1:c269070c7f286c941392076d6c42a4a7a062356f7083a48bd202397e877a965e"
-  name = "github.com/thoas/stats"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "152b5d051953fdb6e45f14b6826962aadc032324"
-
 [[projects]]
  branch = "master"
  digest = "1:99ce99ce6d6d0cbc5f822cda92095906e01d5546d60999ac839ab008938e4e17"
@@ -1682,14 +1521,7 @@
  revision = "1dc93a7db3567a5ccf865106afac88278ba940cf"

 [[projects]]
-  digest = "1:9b2996458a2f7d1f3e0ebf08152acfe8c1106f3fe855d08121c5ee7d801a063f"
-  name = "github.com/tv42/zbase32"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "03389da7e0bf9844767f82690f4d68fc097a1306"
-
-[[projects]]
-  digest = "1:7d3a890e525da3b7014d26dd1d4a0e4d31a479995007cd11989ad31db132e66c"
+  digest = "1:dc5b63bdf6fd3b22c970e06ad4fb686f6d08104f50f414644d5ac5e267a7934a"
  name = "github.com/uber/jaeger-client-go"
  packages = [
    ".",
@@ -1712,16 +1544,18 @@
    "zipkin",
  ]
  pruneopts = "NUT"
-  revision = "1a782e2da844727691fef1757c72eb190c2909f0"
-  version = "v2.15.0"
+  revision = "2f47546e3facd43297739439600bcf43f44cce5d"
+  source = "github.com/jaegertracing/jaeger-client-go"
+  version = "v2.16.0"

 [[projects]]
-  digest = "1:0f09db8429e19d57c8346ad76fbbc679341fa86073d3b8fb5ac919f0357d8f4c"
+  digest = "1:c9d69a04f7fa171f50360bbcc32196b4de8ab8837ef772f6302d0140a1e3e7f6"
  name = "github.com/uber/jaeger-lib"
  packages = ["metrics"]
  pruneopts = "NUT"
-  revision = "ed3a127ec5fef7ae9ea95b01b542c47fbd999ce5"
-  version = "v1.5.0"
+  revision = "0e30338a695636fe5bcf7301e8030ce8dd2a8530"
+  source = "github.com/jaegertracing/jaeger-lib"
+  version = "v2.0.0"

 [[projects]]
  digest = "1:fb6d90081ae53fdb35d0fffa7d82a555df936bbc6db9a93126795655b2317604"
@@ -1738,13 +1572,6 @@
  pruneopts = "NUT"
  revision = "a1cf62cc2159fff407728f118c41aece76c397fa"

-[[projects]]
-  digest = "1:e84e99d5f369afaa9a5c41f55b57fa03047ecd3bac2a65861607882693ceea81"
-  name = "github.com/urfave/negroni"
-  packages = ["."]
-  pruneopts = "NUT"
-  revision = "490e6a555d47ca891a89a150d0c1ef3922dfffe9"
-
 [[projects]]
  digest = "1:a68c3f55d44d225da4f22ffbed2d8572d267cb19aaa1d60537769034ac66bc01"
  name = "github.com/vdemeester/shakers"
@@ -1755,7 +1582,7 @@

 [[projects]]
  branch = "master"
-  digest = "1:c878a802780168c80738d74607d14e7cb8765706990ae1260a3fd271c2c3b133"
+  digest = "1:d7ace03de79a9cec30e7a55cc16160602760470c5fe031b780dc2d84234d7f5a"
  name = "github.com/vulcand/oxy"
  packages = [
    "buffer",
@@ -1768,7 +1595,7 @@
    "utils",
  ]
  pruneopts = "NUT"
-  revision = "c34b0c501e43223bc816ac9b40b0ac29c44c8952"
+  revision = "3d629cff40b7040e0519628e7774ed11a95d9aff"

 [[projects]]
  digest = "1:ca6bac407fedc14fbeeba861dd33a821ba3a1624c10126ec6003b0a28d4139c5"
@@ -1801,6 +1628,42 @@
  pruneopts = "NUT"
  revision = "0c8571ac0ce161a5feb57375a9cdf148c98c0f70"

+[[projects]]
+  digest = "1:aafe0319af5410fb19a23a575ea6ee4b14253e122ef87f936bac65ea1e6b280c"
+  name = "go.opencensus.io"
+  packages = [
+    ".",
+    "internal",
+    "internal/tagencoding",
+    "metric/metricdata",
+    "metric/metricproducer",
+    "plugin/ochttp",
+    "plugin/ochttp/propagation/b3",
+    "resource",
+    "stats",
+    "stats/internal",
+    "stats/view",
+    "tag",
+    "trace",
+    "trace/internal",
+    "trace/propagation",
+    "trace/tracestate",
+  ]
+  pruneopts = "NUT"
+  revision = "df6e2001952312404b06f5f6f03fcb4aec1648e5"
+  version = "v0.21.0"
+
+[[projects]]
+  branch = "master"
+  digest = "1:02fe59517e10f9b400b500af8ac228c74cecb0cba7a5f438d8283edb97e14270"
+  name = "go.uber.org/ratelimit"
+  packages = [
+    ".",
+    "internal/clock",
+  ]
+  pruneopts = "NUT"
+  revision = "c15da02342779cb6dc027fc95ee2277787698f36"
+
 [[projects]]
  branch = "master"
  digest = "1:30c1930f8c9fee79f3af60c8b7cd92edd12a4f22187f5527d53509b1a794f555"
@@ -1862,15 +1725,14 @@
  revision = "ec22f46f877b4505e0117eeaab541714644fdd28"

 [[projects]]
-  branch = "master"
-  digest = "1:4e67fdd7a13cbdb3c0dff0a7505abbdf4f42b12b27da350d66bffdc700db2899"
+  digest = "1:51bfac9fe01b6a949bfed6db70b00bada281f0d64e5296ec644163aa977bfee0"
  name = "golang.org/x/sys"
  packages = [
    "unix",
    "windows",
  ]
  pruneopts = "NUT"
-  revision = "fff93fa7cd278d84afc205751523809c464168ab"
+  revision = "1c9583448a9c3aa0f9a6a5241bf73c0bd8aafded"

 [[projects]]
  digest = "1:ca9ebfc1200ca7423d9778dba9cdd463704753541c99dc4896f15e0b8b2bf1e8"
@@ -1919,16 +1781,21 @@

 [[projects]]
  branch = "master"
-  digest = "1:da32ebe70dd3ec97d2df26281b08b18d05c2f12491ae79f389813f6c8d3006b3"
+  digest = "1:70c173b8ecc111dd01dc07f0ada72c076e4ed91618ee559312ef8adf154cc539"
  name = "google.golang.org/api"
  packages = [
    "dns/v1",
    "gensupport",
    "googleapi",
    "googleapi/internal/uritemplates",
+    "googleapi/transport",
+    "internal",
+    "option",
+    "transport/http",
+    "transport/http/internal/propagation",
  ]
  pruneopts = "NUT"
-  revision = "de943baf05a022a8f921b544b7827bacaba1aed5"
+  revision = "067bed655e9cbc26f4dbac8f8897b30756d90990"

 [[projects]]
  digest = "1:7206d98ec77c90c72ec2c405181a1dcf86965803b6dbc4f98ceab7a5047c37a9"
@@ -1956,23 +1823,31 @@
  revision = "09f6ed296fc66555a25fe4ce95173148778dfa85"

 [[projects]]
-  digest = "1:a893d24a604ae6f45f2d6e00ae9e817476e110e2dd5455152b35bb720ca2f626"
+  digest = "1:ffb498178a6bbe5a877e715cc85a40d5a712883d85f5bf05acf26dbd6c8f71e2"
  name = "google.golang.org/grpc"
  packages = [
    ".",
    "balancer",
    "balancer/base",
    "balancer/roundrobin",
-    "channelz",
+    "binarylog/grpc_binarylog_v1",
    "codes",
    "connectivity",
    "credentials",
+    "credentials/internal",
    "encoding",
    "encoding/proto",
-    "grpclb/grpc_lb_v1/messages",
    "grpclog",
-    "health/grpc_health_v1",
    "internal",
+    "internal/backoff",
+    "internal/balancerload",
+    "internal/binarylog",
+    "internal/channelz",
+    "internal/envconfig",
+    "internal/grpcrand",
+    "internal/grpcsync",
+    "internal/syscall",
+    "internal/transport",
    "keepalive",
    "metadata",
    "naming",
@@ -1983,14 +1858,13 @@
    "stats",
    "status",
    "tap",
-    "transport",
  ]
  pruneopts = "NUT"
-  revision = "41344da2231b913fa3d983840a57a6b1b7b631a1"
-  version = "v1.12.0"
+  revision = "25c4f928eaa6d96443009bd842389fb4fa48664e"
+  version = "v1.20.1"

 [[projects]]
-  digest = "1:b886012746f19e2a7c6c3901ea9f86e8a5e32ff2b4407086f4f3181269976957"
+  digest = "1:b49eceff862a3048ec28dad1fce40bcbdc1703119dbad35d7e5f1beb4f9a4527"
  name = "gopkg.in/DataDog/dd-trace-go.v1"
  packages = [
    "ddtrace",
@@ -1998,10 +1872,11 @@
    "ddtrace/internal",
    "ddtrace/opentracer",
    "ddtrace/tracer",
+    "internal/globalconfig",
  ]
  pruneopts = "NUT"
-  revision = "7fb2bce4b1ed6ab61f7a9e1be30dea56de19db7c"
-  version = "v1.8.0"
+  revision = "c19e9e56d5b5b71b6507ce1b0ec06d85aa3705a1"
+  version = "v1.14.0"

 [[projects]]
  digest = "1:c970218a20933dd0a2eb2006de922217fa9276f57d25009b2a934eb1c50031cc"
@@ -2348,35 +2223,16 @@
  analyzer-name = "dep"
  analyzer-version = 1
  input-imports = [
-    "github.com/ArthurHlt/go-eureka-client/eureka",
    "github.com/BurntSushi/toml",
-    "github.com/BurntSushi/ty/fun",
+    "github.com/ExpediaDotCom/haystack-client-go",
    "github.com/Masterminds/sprig",
    "github.com/NYTimes/gziphandler",
    "github.com/abbot/go-http-auth",
-    "github.com/abronan/valkeyrie",
    "github.com/abronan/valkeyrie/store",
-    "github.com/abronan/valkeyrie/store/boltdb",
-    "github.com/abronan/valkeyrie/store/consul",
-    "github.com/abronan/valkeyrie/store/etcd/v3",
-    "github.com/abronan/valkeyrie/store/zookeeper",
    "github.com/armon/go-proxyproto",
-    "github.com/aws/aws-sdk-go/aws",
-    "github.com/aws/aws-sdk-go/aws/credentials",
-    "github.com/aws/aws-sdk-go/aws/defaults",
-    "github.com/aws/aws-sdk-go/aws/ec2metadata",
-    "github.com/aws/aws-sdk-go/aws/session",
-    "github.com/aws/aws-sdk-go/service/dynamodb",
-    "github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute",
-    "github.com/aws/aws-sdk-go/service/dynamodb/dynamodbiface",
-    "github.com/aws/aws-sdk-go/service/ec2",
-    "github.com/aws/aws-sdk-go/service/ecs",
    "github.com/cenkalti/backoff",
    "github.com/containous/alice",
-    "github.com/containous/flaeg",
-    "github.com/containous/flaeg/parse",
    "github.com/containous/mux",
-    "github.com/containous/staert",
    "github.com/coreos/go-systemd/daemon",
    "github.com/davecgh/go-spew/spew",
    "github.com/docker/docker/api/types",
@@ -2390,7 +2246,6 @@
    "github.com/docker/docker/pkg/namesgenerator",
    "github.com/docker/go-connections/nat",
    "github.com/docker/go-connections/sockets",
-    "github.com/docker/leadership",
    "github.com/eapache/channels",
    "github.com/elazarl/go-bindata-assetfs",
    "github.com/gambol99/go-marathon",
@@ -2414,53 +2269,38 @@
    "github.com/golang/protobuf/proto",
    "github.com/google/go-github/github",
    "github.com/gorilla/websocket",
-    "github.com/hashicorp/consul/api",
    "github.com/hashicorp/go-version",
    "github.com/influxdata/influxdb/client/v2",
    "github.com/instana/go-sensor",
    "github.com/libkermit/compose/check",
    "github.com/libkermit/docker",
    "github.com/libkermit/docker-check",
-    "github.com/mesos/mesos-go/detector",
-    "github.com/mesos/mesos-go/detector/zoo",
-    "github.com/mesos/mesos-go/upid",
-    "github.com/mesosphere/mesos-dns/detect",
-    "github.com/mesosphere/mesos-dns/logging",
-    "github.com/mesosphere/mesos-dns/records",
-    "github.com/mesosphere/mesos-dns/records/state",
-    "github.com/mesosphere/mesos-dns/util",
    "github.com/miekg/dns",
    "github.com/mitchellh/copystructure",
    "github.com/mitchellh/hashstructure",
-    "github.com/mitchellh/mapstructure",
    "github.com/mvdan/xurls",
-    "github.com/ogier/pflag",
    "github.com/opentracing/opentracing-go",
    "github.com/opentracing/opentracing-go/ext",
    "github.com/opentracing/opentracing-go/log",
-    "github.com/openzipkin/zipkin-go-opentracing",
+    "github.com/openzipkin-contrib/zipkin-go-opentracing",
    "github.com/patrickmn/go-cache",
-    "github.com/pkg/errors",
+    "github.com/pmezard/go-difflib/difflib",
    "github.com/prometheus/client_golang/prometheus",
    "github.com/prometheus/client_golang/prometheus/promhttp",
    "github.com/prometheus/client_model/go",
    "github.com/rancher/go-rancher-metadata/metadata",
-    "github.com/rancher/go-rancher/v2",
    "github.com/ryanuber/go-glob",
-    "github.com/satori/go.uuid",
    "github.com/sirupsen/logrus",
    "github.com/stretchr/testify/assert",
    "github.com/stretchr/testify/mock",
    "github.com/stretchr/testify/require",
    "github.com/stvp/go-udp-testing",
-    "github.com/thoas/stats",
    "github.com/uber/jaeger-client-go",
    "github.com/uber/jaeger-client-go/config",
    "github.com/uber/jaeger-client-go/zipkin",
    "github.com/uber/jaeger-lib/metrics",
    "github.com/unrolled/render",
    "github.com/unrolled/secure",
-    "github.com/urfave/negroni",
    "github.com/vdemeester/shakers",
    "github.com/vulcand/oxy/buffer",
    "github.com/vulcand/oxy/cbreaker",
@@ -2479,6 +2319,7 @@
    "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/opentracer",
    "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer",
    "gopkg.in/fsnotify.v1",
+    "gopkg.in/yaml.v2",
    "k8s.io/api/core/v1",
    "k8s.io/api/extensions/v1beta1",
    "k8s.io/apimachinery/pkg/api/errors",
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -36,17 +36,17 @@ required = [
    non-go = false
    unused-packages = false

-[[constraint]]
-  branch = "master"
-  name = "github.com/ArthurHlt/go-eureka-client"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/ArthurHlt/go-eureka-client"

 [[constraint]]
  branch = "master"
  name = "github.com/BurntSushi/toml"

-[[constraint]]
-  branch = "master"
-  name = "github.com/BurntSushi/ty"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/BurntSushi/ty"

 [[constraint]]
  branch = "master"
@@ -61,18 +61,14 @@ required = [
  branch = "master"
  name = "github.com/armon/go-proxyproto"

-[[constraint]]
-  name = "github.com/aws/aws-sdk-go"
-  version = "1.13.11"
+#[[constraint]]
+#  name = "github.com/aws/aws-sdk-go"
+#  version = "1.13.11"

 [[constraint]]
  name = "github.com/cenkalti/backoff"
  version = "2.1.1"

-[[constraint]]
-  name = "github.com/containous/flaeg"
-  version = "1.4.1"
-
 [[constraint]]
  branch = "master"
  name = "github.com/containous/mux"
@@ -81,22 +77,19 @@ required = [
  branch = "containous-fork"
  name = "github.com/containous/alice"

-[[constraint]]
-  name = "github.com/containous/staert"
-  version = "3.1.2"
-
 #[[constraint]]
-#  name = "github.com/containous/traefik-extra-service-fabric"
-#  version = "1.3.0"
+#  name = "github.com/thoas/stats"
+#  # related to https://github.com/thoas/stats/pull/32
+#  revision = "4975baf6a358ed3ddaa42133996e1959f96c9300"

 [[constraint]]
  name = "github.com/coreos/go-systemd"
  version = "14.0.0"

-[[constraint]]
-  branch = "master"
-  name = "github.com/docker/leadership"
-  source = "github.com/containous/leadership"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/docker/leadership"
+#  source = "github.com/containous/leadership"

 [[constraint]]
  name = "github.com/eapache/channels"
@@ -124,9 +117,9 @@ required = [
  branch = "master"
  name = "github.com/gorilla/websocket"

-[[constraint]]
-  name = "github.com/hashicorp/consul"
-  version = "1.0.6"
+#[[constraint]]
+#  name = "github.com/hashicorp/consul"
+#  version = "1.0.6"

 [[constraint]]
  name = "github.com/influxdata/influxdb"
@@ -136,13 +129,13 @@ required = [
 #  branch = "master"
 #  name = "github.com/jjcollinge/servicefabric"

-[[constraint]]
-  branch = "master"
-  name = "github.com/abronan/valkeyrie"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/abronan/valkeyrie"

-[[constraint]]
-  name = "github.com/mesosphere/mesos-dns"
-  source = "https://github.com/containous/mesos-dns.git"
+#[[constraint]]
+#  name = "github.com/mesosphere/mesos-dns"
+#  source = "https://github.com/containous/mesos-dns.git"

 [[constraint]]
  name = "github.com/opentracing/opentracing-go"
@@ -158,8 +151,8 @@ required = [
  name = "github.com/ryanuber/go-glob"

 [[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.1.0"
+  name = "github.com/Masterminds/sprig"
+  version = "2.19.0"

 [[constraint]]
  branch = "master"
@@ -171,11 +164,13 @@ required = [

 [[constraint]]
  name = "github.com/uber/jaeger-client-go"
-  version = "2.15.0"
+  source = "github.com/jaegertracing/jaeger-client-go"
+  version = "2.16.0"

 [[constraint]]
  name = "github.com/uber/jaeger-lib"
-  version = "1.3.0"
+  source = "github.com/jaegertracing/jaeger-lib"
+  version = "2.0.0"

 [[constraint]]
  branch = "v1"
@@ -190,13 +185,20 @@ required = [
  name = "github.com/vulcand/oxy"

 [[constraint]]
-  branch = "master"
  name = "github.com/go-acme/lego"
-#  version = "2.4.0"
+  version = "2.6.0"

 [[constraint]]
  name = "google.golang.org/grpc"
-  version = "1.5.2"
+  version = "1.13.0"
+
+[[override]]
+  name = "golang.org/x/sys"
+  revision = "1c9583448a9c3aa0f9a6a5241bf73c0bd8aafded"
+
+[[constraint]]
+  name = "github.com/golang/protobuf"
+  version = "v1.3.0"

 [[constraint]]
  name = "gopkg.in/fsnotify.v1"
@@ -275,8 +277,12 @@ required = [

 [[constraint]]
  name = "gopkg.in/DataDog/dd-trace-go.v1"
-  version = "1.7.0"
+  version = "1.13.0"

 [[constraint]]
  name = "github.com/instana/go-sensor"
  version = "1.4.12"
+
+[[constraint]]
+  name = "github.com/ExpediaDotCom/haystack-client-go"
+  version = "0.2.3"
--- a/182
+++ b/182
@@ -1,4 +1,22 @@
-.PHONY: all docs docs-serve clear-static
+.PHONY: all docs docs-serve
+
+SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
+
+TAG_NAME := $(shell git tag -l --contains HEAD)
+SHA := $(shell git rev-parse HEAD)
+VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
+VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
+
+BIND_DIR := "dist"
+
+GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
+TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
+
+REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
+TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
+
+INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
+DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)

 TRAEFIK_ENVS := \
 	-e OS_ARCH_ARG \
@@ -11,93 +29,33 @@ TRAEFIK_ENVS := \
 	-e CI \
 	-e CONTAINER=DOCKER		# Indicator for integration tests that we are running inside a container.

-SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
-
-TAG_NAME := $(shell git tag -l --contains HEAD)
-SHA := $(shell git rev-parse HEAD)
-VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
-VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
-
-BIND_DIR := "dist"
 TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/containous/traefik/$(BIND_DIR)"
-
-GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
-TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
-REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
-TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
-INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
-
-DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
 DOCKER_RUN_TRAEFIK := docker run $(INTEGRATION_OPTS) -it $(DOCKER_RUN_OPTS)
 DOCKER_RUN_TRAEFIK_NOTTY := docker run $(INTEGRATION_OPTS) -i $(DOCKER_RUN_OPTS)

-print-%: ; @echo $*=$($*)
+PRE_TARGET ?= build-dev-image

 default: binary

-all: generate-webui build ## validate all checks, build linux binary, run all tests\ncross non-linux binaries
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh
-
-binary: generate-webui build ## build the linux binary
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary
-
-crossbinary-default: generate-webui build
-	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default
-
-crossbinary-default-parallel:
-	$(MAKE) generate-webui
-	$(MAKE) build crossbinary-default
-
-test: build ## run the unit and integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
-
-test-unit: build ## run the unit tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit
-
-test-integration: build ## run the integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary test-integration
-	TEST_HOST=1 ./script/make.sh test-integration
-
-validate: build  ## validate code, vendor
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate validate-lint validate-misspell validate-vendor
-
-build: dist
+## Build Dev Docker image
+build-dev-image: dist
 	docker build $(DOCKER_BUILD_ARGS) -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .

-build-no-cache: dist
+## Build Dev Docker image without cache
+build-dev-image-no-cache: dist
 	docker build --no-cache -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .

-shell: build ## start a shell inside the build env
-	$(DOCKER_RUN_TRAEFIK) /bin/bash
-
-image-dirty: binary ## build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-image: clear-static binary ## clean up static directory and build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-docs:
-	make -C ./docs docs
-
-docs-serve:
-	make -C ./docs docs-serve
-
+## Create the "dist" directory
 dist:
 	mkdir dist

-run-dev:
-	go generate
-	go build ./cmd/traefik
-	./traefik
-
-clear-static:
-	rm -rf static
-
-build-webui:
+## Build WebUI Docker image
+build-webui-image:
 	docker build -t traefik-webui -f webui/Dockerfile webui

-generate-webui: build-webui
+## Generate WebUI
+generate-webui: build-webui-image
 	if [ ! -d "static" ]; then \
 		mkdir -p static; \
 		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui npm run build; \
@@ -105,29 +63,82 @@ generate-webui: build-webui
 		echo 'For more informations show `webui/readme.md`' > $$PWD/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md; \
 	fi

-generate-crd:
-	./script/update-generated-crd-code.sh
+## Build the linux binary
+binary: generate-webui $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate binary

-lint:
-	script/validate-lint
+## Build the binary for the standard plaforms (linux, darwin, windows)
+crossbinary-default: generate-webui build-dev-image
+	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default

-fmt:
-	gofmt -s -l -w $(SRCS)
+## Build the binary for the standard plaforms (linux, darwin, windows) in parallel
+crossbinary-default-parallel:
+	$(MAKE) generate-webui
+	$(MAKE) build-dev-image crossbinary-default

+## Run the unit and integration tests
+test: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
+
+## Run the unit tests
+test-unit: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate test-unit
+
+## Pull all images for integration tests
 pull-images:
 	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml | awk '{print $$2}' | sort | uniq | xargs -P 6 -n 1 docker pull

+## Run the integration tests
+test-integration: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary test-integration
+	TEST_HOST=1 ./script/make.sh test-integration
+
+## Validate code and docs
+validate-files: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell
+	bash $(CURDIR)/script/validate-shell-script.sh
+
+## Validate code, docs, and vendor
+validate: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell validate-vendor
+	bash $(CURDIR)/script/validate-shell-script.sh
+
+## Clean up static directory and build a Docker Traefik image
+build-image: binary
+	rm -rf static
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Build a Docker Traefik image
+build-image-dirty: binary
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Start a shell inside the build env
+shell: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) /bin/bash
+
+## Build documentation site
+docs:
+	make -C ./docs docs
+
+## Serve the documentation site localy
+docs-serve:
+	make -C ./docs docs-serve
+
+## Generate CRD clientset
+generate-crd:
+	./script/update-generated-crd-code.sh
+
+## Download dependencies
 dep-ensure:
 	dep ensure -v
 	./script/prune-dep.sh

+## Clean vendor directory
 dep-prune:
 	./script/prune-dep.sh

-help: ## this help
-	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
-
-release-packages: generate-webui build
+## Create packages for the release
+release-packages: generate-webui build-dev-image
 	rm -rf dist
 	$(DOCKER_RUN_TRAEFIK_NOTTY) goreleaser release --skip-publish
 	$(DOCKER_RUN_TRAEFIK_NOTTY) tar cfz dist/traefik-${VERSION}.src.tar.gz \
@@ -138,3 +149,12 @@ release-packages: generate-webui build
 		--exclude .github \
 		--exclude dist .
 	$(DOCKER_RUN_TRAEFIK_NOTTY) chown -R $(shell id -u):$(shell id -g) dist/
+
+## Format the Code
+fmt:
+	gofmt -s -l -w $(SRCS)
+
+run-dev:
+	go generate
+	go build ./cmd/traefik
+	./traefik
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)


-Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
+Traefik (pronounced _traffic_) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
 Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
 Pointing Traefik at your orchestrator should be the _only_ configuration step you need.

@@ -33,7 +33,7 @@ Pointing Traefik at your orchestrator should be the _only_ configuration step yo

 ---

-:construction: As stated in the [1.7 release note](https://blog.containo.us/traefik-1-7-yet-another-slice-of-awesomeness-2a9c99737889#782d), a significant update is in progress on the [master](https://github.com/containous/traefik/tree/master) branch. This branch will remain in constant evolution and prone to change with little notice, so use it for test purposes only.
+:warning: Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now. If you're testing out v2, please ensure you are using a [v2 configuration](https://docs.traefik.io/v2.0/).

 ## Overview

@@ -86,10 +86,6 @@ _(But if you'd rather configure some of your routes manually, Traefik supports t

 To get your hands on Traefik, you can use the [5-Minute Quickstart](http://docs.traefik.io/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).

-Alternatively, if you don't want to install anything on your computer, you can try Traefik online in this great [Katacoda tutorial](https://www.katacoda.com/courses/traefik/deploy-load-balancer) that shows how to load balance requests between multiple Docker containers. 
-
-If you are looking for a more comprehensive and real use-case example, you can also check [Play-With-Docker](http://training.play-with-docker.com/traefik-load-balancing/) to see how to load balance between multiple nodes.
-
 ## Web UI

 You can access the simple HTML frontend of Traefik.
@@ -102,6 +98,8 @@ You can access the simple HTML frontend of Traefik.
 You can find the complete documentation at [https://docs.traefik.io](https://docs.traefik.io).
 A collection of contributions around Traefik can be found at [https://awesome.traefik.io](https://awesome.traefik.io).

+:warning: If you're testing out v2, please ensure you are using the [v2 documentation](https://docs.traefik.io/v2.0/).
+
 ## Support

 To get community support, you can:
@@ -132,6 +130,8 @@ git clone https://github.com/containous/traefik

 ## Introductory Videos

+:warning: Please be aware that these videos are for v1.X. The old configurations for Traefik v1.X are NOT compatible with Traefik v2. If you're testing out v2, please ensure you are using a [v2 configuration](https://docs.traefik.io/v2.0/).
+
 Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at GopherCon 2017.
 You will learn Traefik basics in less than 10 minutes.

@@ -144,7 +144,7 @@ You will learn fundamental Traefik features and see some demos with Kubernetes.

 ## Maintainers

-[Information about process and maintainers](MAINTAINER.md)
+[Information about process and maintainers](docs/content/contributing/maintainers.md)

 ## Contributing

--- a/build.Dockerfile
+++ b/build.Dockerfile
@@ -1,8 +1,9 @@
 FROM golang:1.12-alpine

 RUN apk --update upgrade \
-&& apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \
-&& rm -rf /var/cache/apk/*
+    && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
+    && update-ca-certificates \
+    && rm -rf /var/cache/apk/*

 # Download golangci-lint and misspell binary to bin folder in $GOPATH
 RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b $GOPATH/bin v1.15.0 \
--- a/cmd/configuration.go
+++ b/cmd/configuration.go
@@ -3,39 +3,27 @@ package cmd
 import (
 	"time"

-	"github.com/containous/flaeg/parse"
 	"github.com/containous/traefik/pkg/config/static"
-	"github.com/containous/traefik/pkg/middlewares/accesslog"
-	"github.com/containous/traefik/pkg/ping"
-	"github.com/containous/traefik/pkg/provider/docker"
-	"github.com/containous/traefik/pkg/provider/file"
-	"github.com/containous/traefik/pkg/provider/kubernetes/ingress"
-	"github.com/containous/traefik/pkg/provider/marathon"
-	"github.com/containous/traefik/pkg/provider/rest"
-	"github.com/containous/traefik/pkg/tracing/datadog"
-	"github.com/containous/traefik/pkg/tracing/instana"
-	"github.com/containous/traefik/pkg/tracing/jaeger"
-	"github.com/containous/traefik/pkg/tracing/zipkin"
 	"github.com/containous/traefik/pkg/types"
-	jaegercli "github.com/uber/jaeger-client-go"
 )

-// TraefikConfiguration holds GlobalConfiguration and other stuff
-type TraefikConfiguration struct {
-	static.Configuration `mapstructure:",squash" export:"true"`
-	ConfigFile           string `short:"c" description:"Configuration file to use (TOML)." export:"true"`
+// TraefikCmdConfiguration wraps the static configuration and extra parameters.
+type TraefikCmdConfiguration struct {
+	static.Configuration `export:"true"`
+	// ConfigFile is the path to the configuration file.
+	ConfigFile string `description:"Configuration file to use. If specified all other flags are ignored." export:"true"`
 }

-// NewTraefikConfiguration creates a TraefikConfiguration with default values
-func NewTraefikConfiguration() *TraefikConfiguration {
-	return &TraefikConfiguration{
+// NewTraefikConfiguration creates a TraefikCmdConfiguration with default values.
+func NewTraefikConfiguration() *TraefikCmdConfiguration {
+	return &TraefikCmdConfiguration{
 		Configuration: static.Configuration{
 			Global: &static.Global{
 				CheckNewVersion: true,
 			},
 			EntryPoints: make(static.EntryPoints),
 			Providers: &static.Providers{
-				ProvidersThrottleDuration: parse.Duration(2 * time.Second),
+				ProvidersThrottleDuration: types.Duration(2 * time.Second),
 			},
 			ServersTransport: &static.ServersTransport{
 				MaxIdleConnsPerHost: 200,
@@ -44,153 +32,3 @@ func NewTraefikConfiguration() *TraefikConfiguration {
 		ConfigFile: "",
 	}
 }
-
-// NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
-func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
-	// default File
-	var defaultFile file.Provider
-	defaultFile.Watch = true
-	defaultFile.Filename = "" // needs equivalent to  viper.ConfigFileUsed()
-
-	// default Ping
-	var defaultPing = ping.Handler{
-		EntryPoint: "traefik",
-	}
-
-	// default TraefikLog
-	defaultTraefikLog := types.TraefikLog{
-		Format:   "common",
-		FilePath: "",
-	}
-
-	// default AccessLog
-	defaultAccessLog := types.AccessLog{
-		Format:   accesslog.CommonFormat,
-		FilePath: "",
-		Filters:  &types.AccessLogFilters{},
-		Fields: &types.AccessLogFields{
-			DefaultMode: types.AccessLogKeep,
-			Headers: &types.FieldHeaders{
-				DefaultMode: types.AccessLogKeep,
-			},
-		},
-	}
-
-	// default Tracing
-	defaultTracing := static.Tracing{
-		Backend:       "jaeger",
-		ServiceName:   "traefik",
-		SpanNameLimit: 0,
-		Jaeger: &jaeger.Config{
-			SamplingServerURL:      "http://localhost:5778/sampling",
-			SamplingType:           "const",
-			SamplingParam:          1.0,
-			LocalAgentHostPort:     "127.0.0.1:6831",
-			Propagation:            "jaeger",
-			Gen128Bit:              false,
-			TraceContextHeaderName: jaegercli.TraceContextHeaderName,
-		},
-		Zipkin: &zipkin.Config{
-			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-			SameSpan:     false,
-			ID128Bit:     true,
-			Debug:        false,
-			SampleRate:   1.0,
-		},
-		DataDog: &datadog.Config{
-			LocalAgentHostPort: "localhost:8126",
-			GlobalTag:          "",
-			Debug:              false,
-			PrioritySampling:   false,
-		},
-		Instana: &instana.Config{
-			LocalAgentHost: "localhost",
-			LocalAgentPort: 42699,
-			LogLevel:       "info",
-		},
-	}
-
-	// default ApiConfiguration
-	defaultAPI := static.API{
-		EntryPoint: "traefik",
-		Dashboard:  true,
-	}
-	defaultAPI.Statistics = &types.Statistics{
-		RecentErrors: 10,
-	}
-
-	// default Metrics
-	defaultMetrics := types.Metrics{
-		Prometheus: &types.Prometheus{
-			Buckets:    types.Buckets{0.1, 0.3, 1.2, 5},
-			EntryPoint: static.DefaultInternalEntryPointName,
-		},
-		Datadog: &types.Datadog{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		StatsD: &types.Statsd{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		InfluxDB: &types.InfluxDB{
-			Address:      "localhost:8089",
-			Protocol:     "udp",
-			PushInterval: "10s",
-		},
-	}
-
-	defaultResolver := types.HostResolverConfig{
-		CnameFlattening: false,
-		ResolvConfig:    "/etc/resolv.conf",
-		ResolvDepth:     5,
-	}
-
-	var defaultDocker docker.Provider
-	defaultDocker.Watch = true
-	defaultDocker.ExposedByDefault = true
-	defaultDocker.Endpoint = "unix:///var/run/docker.sock"
-	defaultDocker.SwarmMode = false
-	defaultDocker.SwarmModeRefreshSeconds = 15
-	defaultDocker.DefaultRule = docker.DefaultTemplateRule
-
-	// default Rest
-	var defaultRest rest.Provider
-	defaultRest.EntryPoint = static.DefaultInternalEntryPointName
-
-	// default Marathon
-	var defaultMarathon marathon.Provider
-	defaultMarathon.Watch = true
-	defaultMarathon.Endpoint = "http://127.0.0.1:8080"
-	defaultMarathon.ExposedByDefault = true
-	defaultMarathon.DialerTimeout = parse.Duration(5 * time.Second)
-	defaultMarathon.ResponseHeaderTimeout = parse.Duration(60 * time.Second)
-	defaultMarathon.TLSHandshakeTimeout = parse.Duration(5 * time.Second)
-	defaultMarathon.KeepAlive = parse.Duration(10 * time.Second)
-	defaultMarathon.DefaultRule = marathon.DefaultTemplateRule
-
-	// default Kubernetes
-	var defaultKubernetes ingress.Provider
-	defaultKubernetes.Watch = true
-
-	defaultProviders := static.Providers{
-		File:       &defaultFile,
-		Docker:     &defaultDocker,
-		Rest:       &defaultRest,
-		Marathon:   &defaultMarathon,
-		Kubernetes: &defaultKubernetes,
-	}
-
-	return &TraefikConfiguration{
-		Configuration: static.Configuration{
-			Providers:    &defaultProviders,
-			Log:          &defaultTraefikLog,
-			AccessLog:    &defaultAccessLog,
-			Ping:         &defaultPing,
-			API:          &defaultAPI,
-			Metrics:      &defaultMetrics,
-			Tracing:      &defaultTracing,
-			HostResolver: &defaultResolver,
-		},
-	}
-}
--- a/cmd/healthcheck/healthcheck.go
+++ b/cmd/healthcheck/healthcheck.go
@@ -7,34 +7,34 @@ import (
 	"os"
 	"time"

-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/cmd"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/config/static"
 )

-// NewCmd builds a new HealthCheck command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "healthcheck",
-		Description:           `Calls traefik /ping to check health (web provider must be enabled)`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run:                   runCmd(traefikConfiguration),
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
+// NewCmd builds a new HealthCheck command.
+func NewCmd(traefikConfiguration *static.Configuration, loaders []cli.ResourceLoader) *cli.Command {
+	return &cli.Command{
+		Name:          "healthcheck",
+		Description:   `Calls Traefik /ping to check the health of Traefik (the API must be enabled).`,
+		Configuration: traefikConfiguration,
+		Run:           runCmd(traefikConfiguration),
+		Resources:     loaders,
 	}
 }

-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		traefikConfiguration.Configuration.SetEffectiveConfiguration(traefikConfiguration.ConfigFile)
+func runCmd(traefikConfiguration *static.Configuration) func(_ []string) error {
+	return func(_ []string) error {
+		traefikConfiguration.SetEffectiveConfiguration("")

-		resp, errPing := Do(traefikConfiguration.Configuration)
+		resp, errPing := Do(*traefikConfiguration)
+		if resp != nil {
+			resp.Body.Close()
+		}
 		if errPing != nil {
 			fmt.Printf("Error calling healthcheck: %s\n", errPing)
 			os.Exit(1)
 		}
+
 		if resp.StatusCode != http.StatusOK {
 			fmt.Printf("Bad healthcheck status: %s\n", resp.Status)
 			os.Exit(1)
@@ -50,6 +50,7 @@ func Do(staticConfiguration static.Configuration) (*http.Response, error) {
 	if staticConfiguration.Ping == nil {
 		return nil, errors.New("please enable `ping` to use health check")
 	}
+
 	pingEntryPoint, ok := staticConfiguration.EntryPoints[staticConfiguration.Ping.EntryPoint]
 	if !ok {
 		return nil, errors.New("missing `ping` entrypoint")
--- a/cmd/storeconfig/storeconfig.go
+++ b/cmd/storeconfig/storeconfig.go
@@ -1,150 +0,0 @@
-package storeconfig
-
-import (
-	"encoding/json"
-	"fmt"
-	stdlog "log"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/cmd"
-)
-
-// NewCmd builds a new StoreConfig command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "storeconfig",
-		Description:           `Stores the static traefik configuration into a Key-value stores. Traefik will not start.`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		HideHelp:              true, // TODO storeconfig
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
-	}
-}
-
-// Run store config in KV
-func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		if kv == nil {
-			return fmt.Errorf("error using command storeconfig, no Key-value store defined")
-		}
-
-		fileConfig := traefikConfiguration.Providers.File
-		if fileConfig != nil {
-			traefikConfiguration.Providers.File = nil
-			if len(fileConfig.Filename) == 0 && len(fileConfig.Directory) == 0 {
-				fileConfig.Filename = traefikConfiguration.ConfigFile
-			}
-		}
-
-		jsonConf, err := json.Marshal(traefikConfiguration.Configuration)
-		if err != nil {
-			return err
-		}
-		stdlog.Printf("Storing configuration: %s\n", jsonConf)
-
-		err = kv.StoreConfig(traefikConfiguration.Configuration)
-		if err != nil {
-			return err
-		}
-
-		if fileConfig != nil {
-			jsonConf, err = json.Marshal(fileConfig)
-			if err != nil {
-				return err
-			}
-
-			stdlog.Printf("Storing file configuration: %s\n", jsonConf)
-			config, err := fileConfig.BuildConfiguration()
-			if err != nil {
-				return err
-			}
-
-			stdlog.Print("Writing config to KV")
-			err = kv.StoreConfig(config)
-			if err != nil {
-				return err
-			}
-		}
-
-		// if traefikConfiguration.Configuration.ACME != nil {
-		// 	account := &acme.Account{}
-		//
-		// 	accountInitialized, err := keyExists(kv, traefikConfiguration.Configuration.ACME.Storage)
-		// 	if err != nil && err != store.ErrKeyNotFound {
-		// 		return err
-		// 	}
-		//
-		// 	// Check to see if ACME account object is already in kv store
-		// 	if traefikConfiguration.Configuration.ACME.OverrideCertificates || !accountInitialized {
-		//
-		// 		// Stores the ACME Account into the KV Store
-		// 		// Certificates in KV Stores will be overridden
-		// 		meta := cluster.NewMetadata(account)
-		// 		err = meta.Marshall()
-		// 		if err != nil {
-		// 			return err
-		// 		}
-		//
-		// 		source := staert.KvSource{
-		// 			Store:  kv,
-		// 			Prefix: traefikConfiguration.Configuration.ACME.Storage,
-		// 		}
-		//
-		// 		err = source.StoreConfig(meta)
-		// 		if err != nil {
-		// 			return err
-		// 		}
-		// 	}
-		// }
-		return nil
-	}
-}
-
-// func keyExists(source *staert.KvSource, key string) (bool, error) {
-// 	list, err := source.List(key, nil)
-// 	if err != nil {
-// 		return false, err
-// 	}
-//
-// 	return len(list) > 0, nil
-// }
-
-// CreateKvSource creates KvSource
-// TLS support is enable for Consul and Etcd backends
-func CreateKvSource(traefikConfiguration *cmd.TraefikConfiguration) (*staert.KvSource, error) {
-	var kv *staert.KvSource
-	// var kvStore store.Store
-	var err error
-
-	// TODO kv store
-	// switch {
-	// case traefikConfiguration.Providers.Consul != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Consul.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Consul.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Etcd != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Etcd.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Etcd.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Zookeeper != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Zookeeper.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Zookeeper.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Boltdb != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Boltdb.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Boltdb.Prefix,
-	// 	}
-	// }
-	return kv, err
-}
--- a/cmd/traefik/traefik.go
+++ b/cmd/traefik/traefik.go
@@ -4,38 +4,30 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	fmtlog "log"
+	stdlog "log"
 	"net/http"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"time"

-	"github.com/cenkalti/backoff"
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
 	"github.com/containous/traefik/autogen/genstatic"
 	"github.com/containous/traefik/cmd"
 	"github.com/containous/traefik/cmd/healthcheck"
-	"github.com/containous/traefik/cmd/storeconfig"
 	cmdVersion "github.com/containous/traefik/cmd/version"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/collector"
 	"github.com/containous/traefik/pkg/config"
 	"github.com/containous/traefik/pkg/config/static"
-	"github.com/containous/traefik/pkg/job"
 	"github.com/containous/traefik/pkg/log"
 	"github.com/containous/traefik/pkg/provider/aggregator"
-	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
 	"github.com/containous/traefik/pkg/safe"
 	"github.com/containous/traefik/pkg/server"
 	"github.com/containous/traefik/pkg/server/router"
 	traefiktls "github.com/containous/traefik/pkg/tls"
-	"github.com/containous/traefik/pkg/types"
 	"github.com/containous/traefik/pkg/version"
 	"github.com/coreos/go-systemd/daemon"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
-	"github.com/ogier/pflag"
 	"github.com/sirupsen/logrus"
 	"github.com/vulcand/oxy/roundrobin"
 )
@@ -48,141 +40,38 @@ func init() {
 	os.Setenv("GODEBUG", goDebug+"tls13=1")
 }

-// sliceOfStrings is the parser for []string
-type sliceOfStrings []string
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (s *sliceOfStrings) String() string {
-	return strings.Join(*s, ",")
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (s *sliceOfStrings) Set(value string) error {
-	parts := strings.Split(value, ",")
-	if len(parts) == 0 {
-		return fmt.Errorf("bad []string format: %s", value)
-	}
-	for _, entrypoint := range parts {
-		*s = append(*s, entrypoint)
-	}
-	return nil
-}
-
-// Get return the []string
-func (s *sliceOfStrings) Get() interface{} {
-	return *s
-}
-
-// SetValue sets the []string with val
-func (s *sliceOfStrings) SetValue(val interface{}) {
-	*s = val.([]string)
-}
-
-// Type is type of the struct
-func (s *sliceOfStrings) Type() string {
-	return "sliceOfStrings"
-}
-
 func main() {
 	// traefik config inits
-	traefikConfiguration := cmd.NewTraefikConfiguration()
-	traefikPointersConfiguration := cmd.NewTraefikDefaultPointersConfiguration()
+	tConfig := cmd.NewTraefikConfiguration()

-	// traefik Command init
-	traefikCmd := &flaeg.Command{
+	loaders := []cli.ResourceLoader{&cli.FileLoader{}, &cli.EnvLoader{}, &cli.FlagLoader{}}
+
+	cmdTraefik := &cli.Command{
 		Name: "traefik",
-		Description: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
+		Description: `Traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
 Complete documentation is available at https://traefik.io`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: func() error {
-			return runCmd(&traefikConfiguration.Configuration, traefikConfiguration.ConfigFile)
+		Configuration: tConfig,
+		Resources:     loaders,
+		Run: func(_ []string) error {
+			return runCmd(&tConfig.Configuration, cli.GetConfigFile(loaders))
 		},
 	}

-	// storeconfig Command init
-	storeConfigCmd := storeconfig.NewCmd(traefikConfiguration, traefikPointersConfiguration)
-
-	// init flaeg source
-	f := flaeg.New(traefikCmd, os.Args[1:])
-	// add custom parsers
-	f.AddParser(reflect.TypeOf(static.EntryPoints{}), &static.EntryPoints{})
-
-	f.AddParser(reflect.SliceOf(reflect.TypeOf("")), &sliceOfStrings{})
-	f.AddParser(reflect.TypeOf(traefiktls.FilesOrContents{}), &traefiktls.FilesOrContents{})
-	f.AddParser(reflect.TypeOf(types.Constraints{}), &types.Constraints{})
-	f.AddParser(reflect.TypeOf(k8s.Namespaces{}), &k8s.Namespaces{})
-	f.AddParser(reflect.TypeOf([]types.Domain{}), &types.Domains{})
-	f.AddParser(reflect.TypeOf(types.DNSResolvers{}), &types.DNSResolvers{})
-	f.AddParser(reflect.TypeOf(types.Buckets{}), &types.Buckets{})
-
-	f.AddParser(reflect.TypeOf(types.StatusCodes{}), &types.StatusCodes{})
-	f.AddParser(reflect.TypeOf(types.FieldNames{}), &types.FieldNames{})
-	f.AddParser(reflect.TypeOf(types.FieldHeaderNames{}), &types.FieldHeaderNames{})
-
-	// add commands
-	f.AddCommand(cmdVersion.NewCmd())
-	f.AddCommand(storeConfigCmd)
-	f.AddCommand(healthcheck.NewCmd(traefikConfiguration, traefikPointersConfiguration))
-
-	usedCmd, err := f.GetCommand()
+	err := cmdTraefik.AddCommand(healthcheck.NewCmd(&tConfig.Configuration, loaders))
 	if err != nil {
-		fmtlog.Println(err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}

-	if _, err := f.Parse(usedCmd); err != nil {
-		if err == pflag.ErrHelp {
-			os.Exit(0)
-		}
-		fmtlog.Printf("Error parsing command: %s\n", err)
-		os.Exit(1)
-	}
-
-	// staert init
-	s := staert.NewStaert(traefikCmd)
-	// init TOML source
-	toml := staert.NewTomlSource("traefik", []string{traefikConfiguration.ConfigFile, "/etc/traefik/", "$HOME/.traefik/", "."})
-
-	// add sources to staert
-	s.AddSource(toml)
-	s.AddSource(f)
-	if _, err := s.LoadConfig(); err != nil {
-		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
-		os.Exit(1)
-	}
-
-	traefikConfiguration.ConfigFile = toml.ConfigFileUsed()
-
-	kv, err := storeconfig.CreateKvSource(traefikConfiguration)
+	err = cmdTraefik.AddCommand(cmdVersion.NewCmd())
 	if err != nil {
-		fmtlog.Printf("Error creating kv store: %s\n", err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}
-	storeConfigCmd.Run = storeconfig.Run(kv, traefikConfiguration)

-	// if a KV Store is enable and no sub-command called in args
-	if kv != nil && usedCmd == traefikCmd {
-		s.AddSource(kv)
-		operation := func() error {
-			_, err := s.LoadConfig()
-			return err
-		}
-		notify := func(err error, time time.Duration) {
-			log.WithoutContext().Errorf("Load config error: %+v, retrying in %s", err, time)
-		}
-		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
-		if err != nil {
-			fmtlog.Printf("Error loading configuration: %s\n", err)
-			os.Exit(1)
-		}
-	}
-
-	if err := s.Run(); err != nil {
-		fmtlog.Printf("Error running traefik: %s\n", err)
+	err = cli.Execute(cmdTraefik)
+	if err != nil {
+		stdlog.Println(err)
 		os.Exit(1)
 	}

@@ -192,10 +81,6 @@ Complete documentation is available at https://traefik.io`,
 func runCmd(staticConfiguration *static.Configuration, configFile string) error {
 	configureLogging(staticConfiguration)

-	if len(configFile) > 0 {
-		log.WithoutContext().Infof("Using TOML configuration file %s", configFile)
-	}
-
 	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment

 	if err := roundrobin.SetDefaultWeight(0); err != nil {
@@ -289,7 +174,11 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error
 		safe.Go(func() {
 			tick := time.Tick(t)
 			for range tick {
-				_, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				resp, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				if resp != nil {
+					resp.Body.Close()
+				}
+
 				if staticConfiguration.Ping == nil || errHealthCheck == nil {
 					if ok, _ := daemon.SdNotify(false, "WATCHDOG=1"); !ok {
 						log.WithoutContext().Error("Fail to tick watchdog")
@@ -309,7 +198,7 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error

 func configureLogging(staticConfiguration *static.Configuration) {
 	// configure default log flags
-	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
+	stdlog.SetFlags(stdlog.Lshortfile | stdlog.LstdFlags)

 	// configure log level
 	// an explicitly defined log level always has precedence. if none is
@@ -317,7 +206,7 @@ func configureLogging(staticConfiguration *static.Configuration) {
 	// otherwise.
 	var levelStr string
 	if staticConfiguration.Log != nil {
-		levelStr = strings.ToLower(staticConfiguration.Log.LogLevel)
+		levelStr = strings.ToLower(staticConfiguration.Log.Level)
 	}
 	if levelStr == "" {
 		levelStr = "error"
@@ -377,7 +266,7 @@ func checkNewVersion() {
 func stats(staticConfiguration *static.Configuration) {
 	if staticConfiguration.Global.SendAnonymousUsage == nil {
 		log.WithoutContext().Error(`
-You haven't specify the sendAnonymousUsage option, it will be enable by default.
+You haven't specified the sendAnonymousUsage option, it will be enabled by default.
 `)
 		sendAnonymousUsage := true
 		staticConfiguration.Global.SendAnonymousUsage = &sendAnonymousUsage
--- a/cmd/version/version.go
+++ b/cmd/version/version.go
@@ -7,7 +7,7 @@ import (
 	"runtime"
 	"text/template"

-	"github.com/containous/flaeg"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/version"
 )

@@ -18,19 +18,17 @@ Built:        {{.BuildTime}}
 OS/Arch:      {{.Os}}/{{.Arch}}`

 // NewCmd builds a new Version command
-func NewCmd() *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "version",
-		Description:           `Print version`,
-		Config:                struct{}{},
-		DefaultPointersConfig: struct{}{},
-		Run: func() error {
+func NewCmd() *cli.Command {
+	return &cli.Command{
+		Name:          "version",
+		Description:   `Shows the current Traefik version.`,
+		Configuration: nil,
+		Run: func(_ []string) error {
 			if err := GetPrint(os.Stdout); err != nil {
 				return err
 			}
 			fmt.Print("\n")
 			return nil
-
 		},
 	}
 }
--- a/contrib/scripts/dumpcerts.sh
+++ b/contrib/scripts/dumpcerts.sh
@@ -1,171 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2017 Brian 'redbeard' Harrington <redbeard@dead-city.org>
-#
-# dumpcerts.sh - A simple utility to explode a Traefik acme.json file into a
-#                directory of certificates and a private key
-#
-# Usage - dumpcerts.sh /etc/traefik/acme.json /etc/ssl/
-#
-# Dependencies -
-#   util-linux
-#   openssl
-#   jq
-# The MIT License (MIT)
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-
-# Exit codes:
-# 1 - A component is missing or could not be read
-# 2 - There was a problem reading acme.json
-# 4 - The destination certificate directory does not exist
-# 8 - Missing private key
-
-set -o errexit
-set -o pipefail
-set -o nounset
-
-USAGE="$(basename "$0") <path to acme> <destination cert directory>"
-
-# Platform variations
-case "$(uname)" in
-	'Linux')
-		# On Linux, -d should always work. --decode does not work with Alpine's busybox-binary
-		CMD_DECODE_BASE64="base64 -d"
-		;;
-	*)
-		# Max OS-X supports --decode and -D, but --decode may be supported by other platforms as well.
-		CMD_DECODE_BASE64="base64 --decode"
-		;;
-esac
-
-# Allow us to exit on a missing jq binary
-exit_jq() {
-	echo "
-You must have the binary 'jq' to use this.
-jq is available at: https://stedolan.github.io/jq/download/
-
-${USAGE}" >&2
-	exit 1
-}
-
-bad_acme() {
-	echo "
-There was a problem parsing your acme.json file.
-
-${USAGE}" >&2
-	exit 2
-}
-
-if [ $# -ne 2 ]; then
-	echo "
-Insufficient number of parameters.
-
-${USAGE}" >&2
-	exit 1
-fi
-
-readonly acmefile="${1}"
-readonly certdir="${2%/}"
-
-if [ ! -r "${acmefile}" ]; then
-	echo "
-There was a problem reading from '${acmefile}'
-We need to read this file to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 2
-fi
-
-
-if [ ! -d "${certdir}" ]; then
-	echo "
-Path ${certdir} does not seem to be a directory
-We need a directory in which to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 4
-fi
-
-jq=$(command -v jq) || exit_jq
-
-priv=$(${jq} -e -r '.Account.PrivateKey' "${acmefile}") || bad_acme
-
-if [ ! -n "${priv}" ]; then
-	echo "
-There didn't seem to be a private key in ${acmefile}.
-Please ensure that there is a key in this file and try again." >&2
-	exit 8
-fi
-
-# If they do not exist, create the needed subdirectories for our assets
-# and place each in a variable for later use, normalizing the path
-mkdir -p "${certdir}"/{certs,private}
-
-pdir="${certdir}/private/"
-cdir="${certdir}/certs/"
-
-# Save the existing umask, change the default mode to 600, then
-# after writing the private key switch it back to the default
-oldumask=$(umask)
-umask 177
-trap 'umask ${oldumask}' EXIT
-
-# traefik stores the private key in stripped base64 format but the certificates
-# bundled as a base64 object without stripping headers.  This normalizes the
-# headers and formatting.
-#
-# In testing this out it was a balance between the following mechanisms:
-# gawk:
-#  echo ${priv} | awk 'BEGIN {print "-----BEGIN RSA PRIVATE KEY-----"}
-#     {gsub(/.{64}/,"&\n")}1
-#     END {print "-----END RSA PRIVATE KEY-----"}' > "${pdir}/letsencrypt.key"
-#
-# openssl:
-# echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-#   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-#
-# and sed:
-# echo "-----BEGIN RSA PRIVATE KEY-----" > "${pdir}/letsencrypt.key"
-# echo ${priv} | sed -E 's/(.{64})/\1\n/g' >> "${pdir}/letsencrypt.key"
-# sed -i '$ d' "${pdir}/letsencrypt.key"
-# echo "-----END RSA PRIVATE KEY-----" >> "${pdir}/letsencrypt.key"
-# openssl rsa -noout -in "${pdir}/letsencrypt.key" -check  # To check if the key is valid
-
-# In the end, openssl was chosen because most users will need this script
-# *because* of openssl combined with the fact that it will refuse to write the
-# key if it does not parse out correctly. The other mechanisms were left as
-# comments so that the user can choose the mechanism most appropriate to them.
-echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-
-# Process the certificates for each of the domains in acme.json
-domains=$(jq -r '.Certificates[].Domain.Main' ${acmefile}) || bad_acme
-for domain in $domains; do
-	# Traefik stores a cert bundle for each domain.  Within this cert
-	# bundle there is both proper the certificate and the Let's Encrypt CA
-	echo "Extracting cert bundle for ${domain}"
-	cert=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-         	select (.Domain.Main == $domain )| .Certificate' ${acmefile}) || bad_acme
-	echo "${cert}" | ${CMD_DECODE_BASE64} > "${cdir}/${domain}.crt"
-
-	echo "Extracting private key for ${domain}"
-	key=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-		select (.Domain.Main == $domain )| .Key' ${acmefile}) || bad_acme
-	echo "${key}" | ${CMD_DECODE_BASE64} > "${pdir}/${domain}.key"
-done
--- a/docs/.markdownlint.json
+++ b/docs/.markdownlint.json
@@ -5,5 +5,6 @@
    "MD013": false,
    "MD026": false,
    "MD033": false,
-    "MD034": false
+    "MD034": false,
+    "MD036": false
 }
--- a/docs/content/assets/img/providers/rancher.png
+++ b/docs/content/assets/img/providers/rancher.png
--- a/docs/content/contributing/building-testing.md
+++ b/docs/content/contributing/building-testing.md
@@ -43,29 +43,42 @@ $ ls dist/
 traefik*
 ```

+The following targets can be executed outside Docker by setting the variable `PRE_TARGET` to an empty string (we don't recommend that):
+
+- `test-unit`
+- `test-integration`
+- `validate`
+- `binary` (the webUI is still generated by using Docker)
+
+ex:
+
+```bash
+PRE_TARGET= make test-unit
+```
+
 ### Method 2: Using `go`

-You need `go` v1.9+.
+You need `go` v1.12+.

 !!! tip "Source Directory"
- 
+
    It is recommended that you clone Traefik into the `~/go/src/github.com/containous/traefik` directory.
    This is the official golang workspace hierarchy that will allow dependencies to be properly resolved.

 !!! note "Environment"

    Set your `GOPATH` and `PATH` variable to be set to `~/go` via:
-    
+
    ```bash
    export GOPATH=~/go
    export PATH=$PATH:$GOPATH/bin
    ```
- 
+
    For convenience, add `GOPATH` and `PATH` to your `.bashrc` or `.bash_profile`
-    
+
    Verify your environment is setup properly by running `$ go env`.
    Depending on your OS and environment, you should see an output similar to:
-    
+
    ```bash
    GOARCH="amd64"
    GOBIN=""
--- a/docs/content/contributing/data-collection.md
+++ b/docs/content/contributing/data-collection.md
@@ -50,8 +50,8 @@ Once a day (the first call begins 10 minutes after the start of Traefik), we col
 ??? example "Original configuration"

    ```toml
-    [entrypoints]
-        [entrypoints.web]
+    [entryPoints]
+        [entryPoints.web]
           address = ":80"
    
    [api]
@@ -80,8 +80,8 @@ Once a day (the first call begins 10 minutes after the start of Traefik), we col
 ??? example "Resulting Obfuscated Configuration"

    ```toml
-    [entrypoints]
-        [entrypoints.web]
+    [entryPoints]
+        [entryPoints.web]
           address = ":80"
    
    [api]
--- a/docs/content/contributing/documentation.md
+++ b/docs/content/contributing/documentation.md
@@ -10,7 +10,7 @@ Let's see how.

 ### General

-This [documentation](http://docs.traefik.io/) is built with [mkdocs](http://mkdocs.org/).
+This [documentation](https://docs.traefik.io/) is built with [mkdocs](https://mkdocs.org/).

 ### Method 1: `Docker` and `make`

--- a/docs/content/contributing/maintainers.md
+++ b/docs/content/contributing/maintainers.md
@@ -16,6 +16,7 @@
 * Gérald Croës [@geraldcroes](https://github.com/geraldcroes)
 * Jean-Baptiste Doumenjou [@jbdoumenjou](https://github.com/jbdoumenjou)
 * Damien Duportal [@dduportal](https://github.com/dduportal)
+* Mathieu Lonjaret [@mpl](https://github.com/mpl)

 ## Contributions Daily Meeting

--- a/docs/content/contributing/submitting-pull-requests.md
+++ b/docs/content/contributing/submitting-pull-requests.md
@@ -42,4 +42,4 @@ Help the readers focus on what matters, and help them understand the structure o

 !!! tip "10 Tips for Better Pull Requests"

-    We enjoyed this article, maybe you will too! [10 tips for better pull requests](http://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).
+    We enjoyed this article, maybe you will too! [10 tips for better pull requests](https://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).
--- a/docs/content/contributing/thank-you.md
+++ b/docs/content/contributing/thank-you.md
@@ -8,3 +8,20 @@ and wouldn't have become what it is today without the help of our [many contribu
 not accounting for people having helped with issues, tests, comments, articles, ... or just enjoying it and letting others know.

 So once again, thank you for your invaluable help on making Traefik such a good product.
+
+!!! question "Where to Go Next?"
+    If you want to:
+
+    - Propose and idea, request a feature a report a bug,
+      read the page [Submitting Issues](./submitting-issues.md).
+    - Discover how to make an efficient contribution,
+      read the page [Submitting Pull Requests](./submitting-pull-requests.md).
+    - Learn how to build and test Traefik,
+      the page [Building and Testing](./building-testing.md) is for you.
+    - Contribute to the documentation,
+      read the related page [Documentation](./documentation.md).
+    - Understand how do we learn about Traefik usage,
+      read the [Data Collection](./data-collection.md) page.
+    - Spread the love about Traefik, please check the [Advocating](./advocating.md) page.
+    - Learn about who are the maintainers and how they work on the project,
+      read the [Maintainers](./maintainers.md) page.
--- a/docs/content/getting-started/concepts.md
+++ b/docs/content/getting-started/concepts.md
@@ -5,7 +5,8 @@ Everything You Need to Know

 ## Edge Router

-Traefik is an _Edge Router_, it means that it's the door to your platform, and that it intercepts and routes every incoming request: it knows all the logic and every rule that determine which services handle which requests (based on the [path](../../routing/routers/#rule), the [host](../../routing/routers/#rule), [headers](../../routing/routers/#rule), [and so on](../../routing/routers/#rule) ...).
+Traefik is an _Edge Router_, it means that it's the door to your platform, and that it intercepts and routes every incoming request:
+it knows all the logic and every rule that determine which services handle which requests (based on the [path](../routing/routers/index.md#rule), the [host](../routing/routers/index.md#rule), [headers](../routing/routers/index.md#rule), [and so on](../routing/routers/index.md#rule) ...).

 ![The Door to Your Infrastructure](../assets/img/traefik-concepts-1.png)

@@ -13,12 +14,12 @@ Traefik is an _Edge Router_, it means that it's the door to your platform, and t

 Where traditionally edge routers (or reverse proxies) need a configuration file that contains every possible route to your services, Traefik gets them from the services themselves.

-Deploying your services, you attach information that tell Traefik the characteristics of the requests the services can handle.
+Deploying your services, you attach information that tells Traefik the characteristics of the requests the services can handle.

 ![Decentralized Configuration](../assets/img/traefik-concepts-2.png)

 It means that when a service is deployed, Traefik detects it immediately and updates the routing rules in real time.
-The opposite is true: when you remove a service from your infrastructure, the route will disapear accordingly.
+The opposite is true: when you remove a service from your infrastructure, the route will disappear accordingly.

 You no longer need to create and synchronize configuration files cluttered with IP addresses or other rules.

--- a/docs/content/getting-started/configuration-overview.md
+++ b/docs/content/getting-started/configuration-overview.md
@@ -1,4 +1,4 @@
-# Configuration Overview
+# Configuration Introduction

 How the Magic Happens
 {: .subtitle }
@@ -15,9 +15,13 @@ Elements in the _static configuration_ set up connections to [providers](../../p
 The _dynamic configuration_ contains everything that defines how the requests are handled by your system.
 This configuration can change and is seamlessly hot-reloaded, without any request interuption or connection loss.    

+!!! warning "Incompatible Configuration"
+    Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now.
+    If you're testing out v2, please ensure you are using a v2 configuration.
+
 ## The Dynamic Configuration 

-Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): wether an orchestrator, a service registry, or a plain old configuration file. Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../providers/overview.md).
+Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): whether an orchestrator, a service registry, or a plain old configuration file. Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../providers/overview.md).

 !!! Note 
   
@@ -29,31 +33,23 @@ Traefik gets its _dynamic configuration_ from [providers](../providers/overview.
 
 ## The Static Configuration

-There are three different locations where you can define static configuration options in Traefik:
+There are three different, mutually exclusive, ways to define static configuration options in Traefik:

- In a key-value store
- In the command-line arguments
 - In a configuration file
+- As environment variables
+- In the command-line arguments

-If you don't provide a value for a given option, default values apply.
+These ways are evaluated in the order listed above.

-!!! important "Precedence Order"
-
-    The following precedence order applies for configuration options: key-value > command-line > configuration file.
+If no value was provided for a given option, a default value applies.
+Moreover, if an option has sub-options, and any of these sub-options is not specified, a default value will apply as well.
    
-    It means that arguments override configuration file, and key-value store overrides arguments.
-    
-!!! important "Default Values"
-
-    Some root options are enablers: they set default values for all their children. 
-    
-    For example, the `--providers.docker` option enables the docker provider.
-    Once positioned, this option sets (and resets) all the default values under the root `providers.docker`.
-    If you define child options using a lesser precedence configuration source, they will be overwritten by the default values.  
+For example, the `--providers.docker` option is enough by itself to enable the docker provider, even though sub-options like `--providers.docker.endpoint` exist.
+Once positioned, this option sets (and resets) all the default values of the sub-options of `--providers.docker`.
    
 ### Configuration File

-At startup, Traefik searches for a file named `traefik.toml` in `/etc/traefik/`, `$HOME/.traefik/`, and `.` (_the working directory_).
+At startup, Traefik searches for a file named `traefik.toml` in `/etc/traefik/`, `$XDG_CONFIG_HOME/`, `$HOME/.config/`, and `.` (_the working directory_).

 You can override this using the `configFile` argument.

@@ -63,16 +59,16 @@ traefik --configFile=foo/bar/myconfigfile.toml

 ### Arguments

-Use `traefik --help` to get the list of the available arguments.
+To get the list of all available arguments:

-### Key-Value Stores
+```bash
+traefik --help

-Traefik supports several Key-value stores:
+# or

- [Consul](https://consul.io)
- [etcd](https://coreos.com/etcd/)
- [ZooKeeper](https://zookeeper.apache.org/)
- [boltdb](https://github.com/boltdb/bolt)
+docker run traefik[:version] --help
+# ex: docker run traefik:2.0 --help
+```

 ## Available Configuration Options

--- a/docs/content/getting-started/quick-start.md
+++ b/docs/content/getting-started/quick-start.md
@@ -5,9 +5,6 @@ A Simple Use Case Using Docker

 ![quickstart-diagram](../assets/img/quickstart-diagram.png)

-!!! tip 
-    To save some time, you can clone [Traefik's repository](https://github.com/containous/traefik).
-
 ## Launch Traefik With the Docker Provider

 Create a `docker-compose.yml` file where you will define a `reverse-proxy` service that uses the official Traefik image:
@@ -17,8 +14,8 @@ version: '3'

 services:
  reverse-proxy:
-    image: traefik # The official Traefik docker image
-    command: --api --docker # Enables the web UI and tells Traefik to listen to docker
+    image: traefik:v2.0 # The official v2.0 Traefik docker image
+    command: --api --providers.docker # Enables the web UI and tells Traefik to listen to docker
    ports:
      - "80:80"     # The HTTP port
      - "8080:8080" # The Web UI (enabled by --api)
@@ -47,7 +44,7 @@ Edit your `docker-compose.yml` file and add the following at the end of your fil
  whoami:
    image: containous/whoami # A container that exposes an API to show its IP address
    labels:
-      - "traefik.router.rule=Host:whoami.docker.localhost"
+      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
 ```

 The above defines `whoami`: a simple web service that outputs information about the machine it is deployed on (its IP address, host, and so on).
@@ -84,7 +81,7 @@ docker-compose up -d --scale whoami=2

 Go back to your browser ([http://localhost:8080/api/rawdata](http://localhost:8080/api/rawdata)) and see that Traefik has automatically detected the new instance of the container.

-Finally, see that Traefik load-balances between the two instances of your services by running twice the following command:
+Finally, see that Traefik load-balances between the two instances of your service by running the following command twice:

 ```shell
 curl -H Host:whoami.docker.localhost http://127.0.0.1
--- a/docs/content/glossary.md
+++ b/docs/content/glossary.md
@@ -9,8 +9,8 @@ Where Every Technical Word finds its Definition`
 - [ ] Routers
 - [ ] Middleware
 - [ ] Service
- [ ] Static Configuration
- [ ] Dynamic Configuration
+- [ ] [Static configuration](getting-started/configuration-overview.md#the-static-configuration)
+- [ ] [Dynamic configuration](getting-started/configuration-overview.md#the-dynamic-configuration)
 - [ ] ACME
 - [ ] TraefikEE
 - [ ] Tracing
--- a/docs/content/https-tls/acme.md
+++ b/docs/content/https-tls/acme.md
@@ -13,11 +13,11 @@ You can configure Traefik to use an ACME provider (like Let's Encrypt) for autom
 ??? example "Enabling ACME"

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
         address = ":80"
    
-      [entrypoints.http-tls]
+      [entryPoints.http-tls]
         address = ":443"
    
    [acme] # every router with TLS enabled will now be able to use ACME for its certificates
@@ -31,11 +31,11 @@ You can configure Traefik to use an ACME provider (like Let's Encrypt) for autom
 ??? example "Configuring Wildcard Certificates"

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"

-      [entrypoints.http-tls]
+      [entryPoints.http-tls]
        address = ":443"

    [acme]
@@ -49,9 +49,22 @@ You can configure Traefik to use an ACME provider (like Let's Encrypt) for autom
        sans = ["mydomain.com"]
    ```

-!!! note "Configuration Reference"
+??? note "Configuration Reference"
+    
+    There are many available options for ACME. For a quick glance at what's possible, browse the configuration reference:
+    
+    ```toml
+    --8<-- "content/https-tls/ref-acme.toml"
+    ```

-    There are many available options for ACME. For a quick glance at what's possible, browse the [configuration reference](../reference/acme.md).
+## Automatic Renewals
+
+Traefik automatically tracks the expiry date of ACME certificates it generates.
+
+If there are less than 30 days remaining before the certificate expires, Traefik will attempt to rewnew it automatically.
+
+!!! note
+    Certificates that are no longer used may still be renewed, as Traefik does not currently check if the certificate is being used before renewing.

 ## The Different ACME Challenges

@@ -110,68 +123,73 @@ Use the `DNS-01` challenge to generate and renew ACME certificates by provisioni
 
 Here is a list of supported `providers`, that can automate the DNS verification,
 along with the required environment variables and their [wildcard & root domain support](#wildcard-domains).
-Do not hesitate to complete it. 
+Do not hesitate to complete it.

-| Provider Name                                               | Provider Code  | Environment Variables                                                                                                                       | Wildcard & Root Domain Support |
-|-------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
-| [ACME DNS](https://github.com/joohoi/acme-dns)              | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                                | Not tested yet                 |
-| [Alibaba Cloud](https://www.vultr.com)                      | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                          | Not tested yet                 |
-| [Auroradns](https://www.pcextreme.com/aurora/dns)           | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                           | Not tested yet                 |
-| [Azure](https://azure.microsoft.com/services/dns/)          | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]`   | Not tested yet                 |
-| [Blue Cat](https://www.bluecatnetworks.com/)                | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                    | Not tested yet                 |
-| [ClouDNS](https://www.cloudns.net/)                         | `cloudns`      | `CLOUDNS_AUTH_ID`, `CLOUDNS_AUTH_PASSWORD`                                                                                                  | YES                            |
-| [Cloudflare](https://www.cloudflare.com)                    | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                               | YES                            |
-| [CloudXNS](https://www.cloudxns.net)                        | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                   | Not tested yet                 |
-| [ConoHa](https://www.conoha.jp)                             | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                            | YES                            |
-| [DigitalOcean](https://www.digitalocean.com)                | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                             | YES                            |
-| [DNSimple](https://dnsimple.com)                            | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                                 | YES                            |
-| [DNS Made Easy](https://dnsmadeeasy.com)                    | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                      | Not tested yet                 |
-| [DNSPod](https://www.dnspod.com/)                           | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                            | Not tested yet                 |
-| [DreamHost](https://www.dreamhost.com/)                     | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                         | YES                            |
-| [Duck DNS](https://www.duckdns.org/)                        | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                             | YES                            |
-| [Dyn](https://dyn.com)                                      | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                        | Not tested yet                 |
-| External Program                                            | `exec`         | `EXEC_PATH`                                                                                                                                 | YES                            |
-| [Exoscale](https://www.exoscale.com)                        | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                              | YES                            |
-| [Fast DNS](https://www.akamai.com/)                         | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                      | YES                            |
-| [Gandi](https://www.gandi.net)                              | `gandi`        | `GANDI_API_KEY`                                                                                                                             | Not tested yet                 |
-| [Gandi v5](http://doc.livedns.gandi.net)                    | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                           | YES                            |
-| [Glesys](https://glesys.com/)                               | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                        | Not tested yet                 |
-| [GoDaddy](https://godaddy.com/domains)                      | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                     | Not tested yet                 |
-| [Google Cloud DNS](https://cloud.google.com/dns/docs/)      | `gcloud`       | `GCE_PROJECT`, Application Default Credentials [^2] [^3], [`GCE_SERVICE_ACCOUNT_FILE`]                                                        | YES                            |
-| [hosting.de](https://www.hosting.de)                        | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                  | Not tested yet                 |
-| HTTP request                                                | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` [^1]                                                              | YES                            |
-| [IIJ](https://www.iij.ad.jp/)                               | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                           | Not tested yet                 |
-| [INWX](https://www.inwx.de/en)                              | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                            | YES                            |
-| [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | Not tested yet                 |
-| [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | Not tested yet                 |
-| [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | Not tested yet                 |
-| manual                                                      | -              | none, but you need to run Traefik interactively, turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                      | YES                            |
-| [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | YES                            |
-| [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | YES                            |
-| [name.com](https://www.name.com/)                           | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                   | Not tested yet                 |
-| [Netcup](https://www.netcup.eu/)                            | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                           | Not tested yet                 |
-| [NIFCloud](https://cloud.nifty.com/service/dns.htm)         | `nifcloud`     | `NIFCLOUD_ACCESS_KEY_ID`, `NIFCLOUD_SECRET_ACCESS_KEY`                                                                                      | Not tested yet                 |
-| [Ns1](https://ns1.com/)                                     | `ns1`          | `NS1_API_KEY`                                                                                                                               | Not tested yet                 |
-| [Open Telekom Cloud](https://cloud.telekom.de)              | `otc`          | `OTC_DOMAIN_NAME`, `OTC_USER_NAME`, `OTC_PASSWORD`, `OTC_PROJECT_NAME`, `OTC_IDENTITY_ENDPOINT`                                             | Not tested yet                 |
-| [OVH](https://www.ovh.com)                                  | `ovh`          | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                                                         | YES                            |
-| [Openstack Designate](https://docs.openstack.org/designate) | `designate`    | `OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_TENANT_NAME`, `OS_REGION_NAME`                                                             | YES                            |
-| [Oracle Cloud](https://cloud.oracle.com/home)               | `oraclecloud`  | `OCI_COMPARTMENT_OCID`, `OCI_PRIVKEY_FILE`, `OCI_PRIVKEY_PASS`, `OCI_PUBKEY_FINGERPRINT`, `OCI_REGION`, `OCI_TENANCY_OCID`, `OCI_USER_OCID` | YES                            |
-| [PowerDNS](https://www.powerdns.com)                        | `pdns`         | `PDNS_API_KEY`, `PDNS_API_URL`                                                                                                              | Not tested yet                 |
-| [Rackspace](https://www.rackspace.com/cloud/dns)            | `rackspace`    | `RACKSPACE_USER`, `RACKSPACE_API_KEY`                                                                                                       | Not tested yet                 |
-| [RFC2136](https://tools.ietf.org/html/rfc2136)              | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                   | Not tested yet                 |
-| [Route 53](https://aws.amazon.com/route53/)                 | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.             | YES                            |
-| [Sakura Cloud](https://cloud.sakura.ad.jp/)                 | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                               | Not tested yet                 |
-| [Selectel](https://selectel.ru/en/)                         | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                        | YES                            |
-| [Stackpath](https://www.stackpath.com/)                     | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                      | Not tested yet                 |
-| [TransIP](https://www.transip.nl/)                          | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                          | YES                            |
-| [VegaDNS](https://github.com/shupp/VegaDNS-API)             | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                                | Not tested yet                 |
-| [Vscale](https://vscale.io/)                                | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                          | YES                            |
-| [VULTR](https://www.vultr.com)                              | `vultr`        | `VULTR_API_KEY`                                                                                                                             | Not tested yet                 |
-| [Zone.ee](https://www.zone.ee)                              | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                         | YES                            |
+Every lego environment variable can be overridden by their respective `_FILE` counterpart, which should have a filepath to a file that contains the secret as its value.
+For example, `CF_API_EMAIL_FILE=/run/secrets/traefik_cf-api-email` could be used to provide a Cloudflare API email address as a Docker secret named `traefik_cf-api-email`.
+
+| Provider Name                                               | Provider Code  | Environment Variables                                                                                                                       |                                                                             |
+|-------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
+| [ACME DNS](https://github.com/joohoi/acme-dns)              | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/acme-dns)     |
+| [Alibaba Cloud](https://www.vultr.com)                      | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/alidns)       |
+| [Auroradns](https://www.pcextreme.com/aurora/dns)           | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/auroradns)    |
+| [Azure](https://azure.microsoft.com/services/dns/)          | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]`   | [Additional configuration](https://go-acme.github.io/lego/dns/azure)        |
+| [Blue Cat](https://www.bluecatnetworks.com/)                | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                    | [Additional configuration](https://go-acme.github.io/lego/dns/bluecat)      |
+| [ClouDNS](https://www.cloudns.net/)                         | `cloudns`      | `CLOUDNS_AUTH_ID`, `CLOUDNS_AUTH_PASSWORD`                                                                                                  | [Additional configuration](https://go-acme.github.io/lego/dns/cloudns)      |
+| [Cloudflare](https://www.cloudflare.com)                    | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                               | [Additional configuration](https://go-acme.github.io/lego/dns/cloudflare)   |
+| [CloudXNS](https://www.cloudxns.net)                        | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/cloudxns)     |
+| [ConoHa](https://www.conoha.jp)                             | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/conoha)       |
+| [DigitalOcean](https://www.digitalocean.com)                | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/digitalocean) |
+| [DNSimple](https://dnsimple.com)                            | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                                 | [Additional configuration](https://go-acme.github.io/lego/dns/dnsimple)     |
+| [DNS Made Easy](https://dnsmadeeasy.com)                    | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/dnsmadeeasy)  |
+| [DNSPod](https://www.dnspod.com/)                           | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/dnspod)       |
+| [Domain Offensive (do.de)](https://www.do.de/)              | `dode`         | `DODE_TOKEN`                                                                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/dode)         |
+| [DreamHost](https://www.dreamhost.com/)                     | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/dreamhost)    |
+| [Duck DNS](https://www.duckdns.org/)                        | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/duckdns)      |
+| [Dyn](https://dyn.com)                                      | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/dyn)          |
+| External Program                                            | `exec`         | `EXEC_PATH`                                                                                                                                 | [Additional configuration](https://go-acme.github.io/lego/dns/exec)         |
+| [Exoscale](https://www.exoscale.com)                        | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/exoscale)     |
+| [Fast DNS](https://www.akamai.com/)                         | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/fastdns)      |
+| [Gandi](https://www.gandi.net)                              | `gandi`        | `GANDI_API_KEY`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/gandi)        |
+| [Gandi v5](http://doc.livedns.gandi.net)                    | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/gandiv5)      |
+| [Glesys](https://glesys.com/)                               | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/glesys)       |
+| [GoDaddy](https://godaddy.com/)                             | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                     | [Additional configuration](https://go-acme.github.io/lego/dns/godaddy)      |
+| [Google Cloud DNS](https://cloud.google.com/dns/docs/)      | `gcloud`       | `GCE_PROJECT`, Application Default Credentials [^2] [^3], [`GCE_SERVICE_ACCOUNT_FILE`]                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/gcloud)       |
+| [hosting.de](https://www.hosting.de)                        | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                  | [Additional configuration](https://go-acme.github.io/lego/dns/hostingde)    |
+| HTTP request                                                | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` [^1]                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/httpreq)      |
+| [IIJ](https://www.iij.ad.jp/)                               | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/iij)          |
+| [INWX](https://www.inwx.de/en)                              | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/inwx)         |
+| [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | [Additional configuration](https://go-acme.github.io/lego/dns/lightsail)    |
+| [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/linode)       |
+| [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/linodev4)     |
+| manual                                                      | -              | none, but you need to run Traefik interactively [^4], turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                 |                                                                                               |
+| [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | [Additional configuration](https://go-acme.github.io/lego/dns/mydnsjp)      |
+| [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/namecheap)    |
+| [name.com](https://www.name.com/)                           | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/namedotcom)   |
+| [Netcup](https://www.netcup.eu/)                            | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/netcup)       |
+| [NIFCloud](https://cloud.nifty.com/service/dns.htm)         | `nifcloud`     | `NIFCLOUD_ACCESS_KEY_ID`, `NIFCLOUD_SECRET_ACCESS_KEY`                                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/nifcloud)     |
+| [Ns1](https://ns1.com/)                                     | `ns1`          | `NS1_API_KEY`                                                                                                                               | [Additional configuration](https://go-acme.github.io/lego/dns/ns1)          |
+| [Open Telekom Cloud](https://cloud.telekom.de)              | `otc`          | `OTC_DOMAIN_NAME`, `OTC_USER_NAME`, `OTC_PASSWORD`, `OTC_PROJECT_NAME`, `OTC_IDENTITY_ENDPOINT`                                             | [Additional configuration](https://go-acme.github.io/lego/dns/otc)          |
+| [OVH](https://www.ovh.com)                                  | `ovh`          | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/ovh)          |
+| [Openstack Designate](https://docs.openstack.org/designate) | `designate`    | `OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_TENANT_NAME`, `OS_REGION_NAME`                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/designate)    |
+| [Oracle Cloud](https://cloud.oracle.com/home)               | `oraclecloud`  | `OCI_COMPARTMENT_OCID`, `OCI_PRIVKEY_FILE`, `OCI_PRIVKEY_PASS`, `OCI_PUBKEY_FINGERPRINT`, `OCI_REGION`, `OCI_TENANCY_OCID`, `OCI_USER_OCID` | [Additional configuration](https://go-acme.github.io/lego/dns/oraclecloud)  |
+| [PowerDNS](https://www.powerdns.com)                        | `pdns`         | `PDNS_API_KEY`, `PDNS_API_URL`                                                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/pdns)         |
+| [Rackspace](https://www.rackspace.com/cloud/dns)            | `rackspace`    | `RACKSPACE_USER`, `RACKSPACE_API_KEY`                                                                                                       | [Additional configuration](https://go-acme.github.io/lego/dns/rackspace)    |
+| [RFC2136](https://tools.ietf.org/html/rfc2136)              | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/rfc2136)      |
+| [Route 53](https://aws.amazon.com/route53/)                 | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.             | [Additional configuration](https://go-acme.github.io/lego/dns/route53)      |
+| [Sakura Cloud](https://cloud.sakura.ad.jp/)                 | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                               | [Additional configuration](https://go-acme.github.io/lego/dns/sakuracloud)  |
+| [Selectel](https://selectel.ru/en/)                         | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/selectel)     |
+| [Stackpath](https://www.stackpath.com/)                     | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/stackpath)    |
+| [TransIP](https://www.transip.nl/)                          | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/transip)      |
+| [VegaDNS](https://github.com/shupp/VegaDNS-API)             | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/vegadns)      |
+| [Vscale](https://vscale.io/)                                | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/vscale)       |
+| [VULTR](https://www.vultr.com)                              | `vultr`        | `VULTR_API_KEY`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/vultr)        |
+| [Zone.ee](https://www.zone.ee)                              | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/zoneee)       |

 [^1]: more information about the HTTP message format can be found [here](https://go-acme.github.io/lego/dns/httpreq/)
 [^2]: [providing_credentials_to_your_application](https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application)
 [^3]: [google/default.go](https://github.com/golang/oauth2/blob/36a7019397c4c86cf59eeab3bc0d188bac444277/google/default.go#L61-L76)
+[^4]: `docker stack` remark: there is no way to support terminal attached to container when deploying with `docker stack`, so you might need to run container with `docker run -it` to generate certificates using `manual` provider.

 !!! note "`delayBeforeCheck`"
    By default, the `provider` verifies the TXT record _before_ letting ACME verify.
@@ -208,9 +226,6 @@ As described in [Let's Encrypt's post](https://community.letsencrypt.org/t/stagi
 !!! note "Double Wildcard Certificates"
    It is not possible to request a double wildcard certificate for a domain (for example `*.*.local.com`).

-Due to an ACME limitation it is not possible to define wildcards in SANs (alternative domains).
-Thus, the wildcard domain has to be defined as a main domain.
-
 Most likely the root domain should receive a certificate too, so it needs to be specified as SAN and 2 `DNS-01` challenges are executed.
 In this case the generated DNS TXT record for both domains is the same.
 Even though this behavior is [DNS RFC](https://community.letsencrypt.org/t/wildcard-issuance-two-txt-records-for-the-same-name/54528/2) compliant,
@@ -321,7 +336,7 @@ storage = "traefik/acme/account"
    Because key-value stores have limited entry size, the certificates list is compressed _before_ it is saved.
    For example, it is possible to store up to _approximately_ 100 ACME certificates in Consul.

-## Fallbacks
+## Fallback

 If Let's Encrypt is not reachable, the following certificates will apply:

--- a/docs/content/https-tls/overview.md
+++ b/docs/content/https-tls/overview.md
@@ -19,7 +19,7 @@ TLS is enabled at the [router](../routing/routers/index.md) level, but some opti

    ```toml
    [tlsOptions]
-      [tlsOptions.default]
+        [tlsOptions.default]
        minVersion = "VersionTLS12"
    ```

--- a/docs/content/https-tls/ref-acme.toml
+++ b/docs/content/https-tls/ref-acme.toml
@@ -0,0 +1,150 @@
+# Enable ACME (Let's Encrypt): automatic SSL.
+[acme]
+
+# Email address used for registration.
+#
+# Required
+#
+email = "test@traefik.io"
+
+# File used for certificates storage.
+#
+# Optional (Deprecated)
+#
+#storageFile = "acme.json"
+
+# File or key used for certificates storage.
+#
+# Required
+#
+storage = "acme.json"
+# or `storage = "traefik/acme/account"` if using KV store.
+
+# Deprecated, replaced by [acme.dnsChallenge].
+#
+# Optional.
+#
+# dnsProvider = "digitalocean"
+
+# Deprecated, replaced by [acme.dnsChallenge.delayBeforeCheck].
+#
+# Optional
+# Default: 0
+#
+# delayDontCheckDNS = 0
+
+# If true, display debug log messages from the acme client library.
+#
+# Optional
+# Default: false
+#
+# acmeLogging = true
+
+# If true, override certificates in key-value store when using storeconfig.
+#
+# Optional
+# Default: false
+#
+# overrideCertificates = true
+
+# Deprecated. Enable on demand certificate generation.
+#
+# Optional
+# Default: false
+#
+# onDemand = true
+
+# Enable certificate generation on frontends host rules.
+#
+# Optional
+# Default: false
+#
+# onHostRule = true
+
+# CA server to use.
+# Uncomment the line to use Let's Encrypt's staging server,
+# leave commented to go to prod.
+#
+# Optional
+# Default: "https://acme-v02.api.letsencrypt.org/directory"
+#
+# caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# KeyType to use.
+#
+# Optional
+# Default: "RSA4096"
+#
+# Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
+#
+# KeyType = "RSA4096"
+
+# Use a TLS-ALPN-01 ACME challenge.
+#
+# Optional (but recommended)
+#
+[acme.tlsChallenge]
+
+# Use a HTTP-01 ACME challenge.
+#
+# Optional
+#
+# [acme.httpChallenge]
+
+  # EntryPoint to use for the HTTP-01 challenges.
+  #
+  # Required
+  #
+  # entryPoint = "http"
+
+# Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
+# Note: mandatory for wildcard certificate generation.
+#
+# Optional
+#
+# [acme.dnsChallenge]
+
+  # DNS provider used.
+  #
+  # Required
+  #
+  # provider = "digitalocean"
+
+  # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
+  # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
+  # Useful if internal networks block external DNS queries.
+  #
+  # Optional
+  # Default: 0
+  #
+  # delayBeforeCheck = 0
+
+  # Use following DNS servers to resolve the FQDN authority.
+  #
+  # Optional
+  # Default: empty
+  #
+  # resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+
+  # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
+  #
+  # NOT RECOMMENDED:
+  # Increase the risk of reaching Let's Encrypt's rate limits.
+  #
+  # Optional
+  # Default: false
+  #
+  # disablePropagationCheck = true
+
+# Domains list.
+# Only domains defined here can generate wildcard certificates.
+# The certificates for these domains are negotiated at traefik startup only.
+#
+# [[acme.domains]]
+#   main = "local1.com"
+#   sans = ["test1.local1.com", "test2.local1.com"]
+# [[acme.domains]]
+#   main = "local2.com"
+# [[acme.domains]]
+#   main = "*.local3.com"
+#   sans = ["local3.com", "test1.test1.local3.com"]
--- a/docs/content/middlewares/addprefix.md
+++ b/docs/content/middlewares/addprefix.md
@@ -9,37 +9,44 @@ The AddPrefix middleware updates the URL Path of the request before forwarding i

 ## Configuration Examples

-??? example "File -- Prefixing with /foo"
+```yaml tab="Docker"
+# Prefixing with /foo
+labels:
+- "traefik.http.middlewares.add-foo.addprefix.prefix=/foo"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.add-foo.AddPrefix]
-         prefix = "/foo"
-    ```
+```yaml tab="Kubernetes"
+# Prefixing with /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: add-foo
+spec:
+  addPrefix:
+    prefix: /foo
+```

-??? example "Docker -- Prefixing with /bar"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.add-foo.addprefix.prefix": "/foo"
+}
+```

-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.add-bar.addprefix.prefix=/bar"
-    ```
+```yaml tab="Rancher"
+# Prefixing with /foo
+labels:
+- "traefik.http.middlewares.add-foo.addprefix.prefix=/foo"
+```

-??? example "Kubernetes -- Prefixing with /bar"
-
-    ```yaml
-    apiVersion: traefik.containo.us/v1alpha1
-    kind: Middleware
-    metadata:
-      name: addprefix
-    spec:
-      addprefix:
-        prefix: /bar
-    ```
+```toml tab="File"
+# Prefixing with /foo
+[http.middlewares]
+  [http.middlewares.add-foo.AddPrefix]
+     prefix = "/foo"
+```

 ## Configuration Options

-### prefix
+### `prefix`

 `prefix` is the string to add before the current path in the requested URL. It should include the leading slash (`/`).
--- a/docs/content/middlewares/basicauth.md
+++ b/docs/content/middlewares/basicauth.md
@@ -9,23 +9,50 @@ The BasicAuth middleware is a quick way to restrict access to your services to k

 ## Configuration Examples

-??? example "File -- Declaring the user list"
+```yaml tab="Docker"
+# Declaring the user list
+#
+# Note: all dollar signs in the hash need to be doubled for escaping.
+# To create user:password pair, it's possible to use this command:
+# echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
+labels:
+  - "traefik.http.middlewares.test-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.basicauth]
-      users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
-      "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
-    ```
+```yaml tab="Kubernetes"
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  basicAuth:
+    users:
+    - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+    - test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
+```

-??? example "Docker -- Using an external file for the authorized users"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.basicauth.users": "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
+}
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.declared-users-only.basicauth.usersFile=path-to-file.ext",
-    ```
+```yaml tab="Rancher"
+# Declaring the user list
+labels:
+  - "traefik.http.middlewares.test-auth.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
+```
+
+```toml tab="File"
+# Declaring the user list
+[http.middlewares]
+  [http.middlewares.test-auth.basicauth]
+  users = [
+    "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
+    "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
+  ]
+```

 ## Configuration Options

@@ -37,7 +64,7 @@ Passwords must be encoded using MD5, SHA1, or BCrypt.
   
    Use `htpasswd` to generate the passwords.

-### users
+### `users`

 The `users` option is an array of authorized users. Each user will be declared using the `name:encoded-password` format.

@@ -45,7 +72,7 @@ The `users` option is an array of authorized users. Each user will be declared u
    
    If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

-### usersFile
+### `usersFile`

 The `usersFile` option is the path to an external file that contains the authorized users for the middleware.

@@ -53,7 +80,7 @@ The file content is a list of `name:encoded-password`.

 ??? example "A file containing test/test and test2/test2"

-    ```
+    ```txt
    test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
    test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
    ```
@@ -62,22 +89,42 @@ The file content is a list of `name:encoded-password`.
    
    If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

-### realm
+### `realm`

 You can customize the realm for the authentication with the `realm` option. The default value is `traefik`. 

-### headerField
+### `headerField`

 You can customize the header field for the authenticated user using the `headerField`option.

-??? example "File -- Passing Authenticated Users to Services Via Headers"
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.my-auth.basicauth.headerField=X-WebAuth-User"
+```

-    ```toml
-      [http.middlewares.my-auth.basicauth]
-        usersFile = "path-to-file.ext"
-        headerField = "X-WebAuth-User" # header for the authenticated user
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: my-auth
+spec:
+  basicAuth:
+    # ...
+    headerField: X-WebAuth-User
+```

-### removeHeader
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.my-auth.basicauth.headerField": "X-WebAuth-User"
+}
+```
+
+```toml tab="File"
+[http.middlewares.my-auth.basicauth]
+  # ...
+  headerField = "X-WebAuth-User"
+```
+
+### `removeHeader`

 Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)
--- a/docs/content/middlewares/buffering.md
+++ b/docs/content/middlewares/buffering.md
@@ -13,46 +13,65 @@ This can help services deal with large data (multipart/form-data for example), a

 ## Configuration Examples

-??? example "File -- Sets the maximum request body to 2Mb"
-    
-    ```toml
-    [http.middlewares]
-      [http.middlewares.2Mb-limit.buffering]
-          maxRequestBodyBytes = 250000
-    ``` 
+```yaml tab="Docker"
+# Sets the maximum request body to 2Mb
+labels:
+- "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=250000"
+```

-??? example "Docker -- Buffers 1Mb of the request in memory, then writes to disk"
+```yaml tab="Kubernetes"
+# Sets the maximum request body to 2Mb
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: limit
+spec:
+  buffering:
+    maxRequestBodyBytes: 250000
+```

-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.1Mb-memory.buffering.memRequestBodyBytes=125000",
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes": "250000"
+}
+```
+
+```yaml tab="Rancher"
+# Sets the maximum request body to 2Mb
+labels:
+- "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=250000"
+```
+
+```toml tab="File"
+# Sets the maximum request body to 2Mb
+[http.middlewares]
+  [http.middlewares.limit.buffering]
+      maxRequestBodyBytes = 250000
+```

 ## Configuration Options

-### maxRequestBodyBytes
+### `maxRequestBodyBytes`

 With the `maxRequestBodyBytes` option, you can configure the maximum allowed body size for the request (in Bytes).

 If the request exceeds the allowed size, the request is not forwarded to the service and the client gets a `413 (Request Entity Too Large) response.

-### memRequestBodyBytes
+### `memRequestBodyBytes`

 You can configure a thresold (in Bytes) from which the request will be buffered on disk instead of in memory with the `memRequestBodyBytes` option. 

-### maxResponseBodyBytes
+### `maxResponseBodyBytes`

 With the `maxReesponseBodyBytes` option, you can configure the maximum allowed response size from the service (in Bytes).

 If the response exceeds the allowed size, it is not forwarded to the client. The client gets a `413 (Request Entity Too Large) response` instead.

-### memResponseBodyBytes
+### `memResponseBodyBytes`

 You can configure a thresold (in Bytes) from which the response will be buffered on disk instead of in memory with the `memResponseBodyBytes` option. 

-### retryExpression
+### `retryExpression`

 You can have the Buffering middleware replay the request with the help of the `retryExpression` option.

--- a/docs/content/middlewares/chain.md
+++ b/docs/content/middlewares/chain.md
@@ -1,6 +1,6 @@
 # Chain

-When One Isn't Enougth
+When One Isn't Enough
 {: .subtitle }

 ![Chain](../assets/img/middleware/chain.png)
@@ -10,31 +10,128 @@ It makes reusing the same groups easier.

 ## Configuration Example

-??? example "A Chain for WhiteList, BasicAuth, and HTTPS"
-    
-    ```toml
-    # ...    
-    [http.routers]
-        [http.routers.router1]
-            service = "service1"
-            middlewares = ["secured"]
-            rule = "Host: mydomain"
-    
-    [http.middlewares]
-        [http.middlewares.secured.Chain]
-            middlewares = ["https-only", "known-ips", "auth-users"]
-            
-        [http.middlewares.auth-users.BasicAuth]
-            users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]
-        [http.middlewares.https-only.SchemeRedirect]
-            scheme = "https"
-        [http.middlewares.known-ips.ipWhiteList]
-            sourceRange = ["192.168.1.7", "x.x.x.x", "x.x.x.x"]
-    
-    [http.services]
-      [http.services.service1]
-        [http.services.service1.LoadBalancer]
-          [[http.services.service1.LoadBalancer.Servers]]
-            URL = "http://127.0.0.1:80"
-            Weight = 1
-    ```
+Example "A Chain for WhiteList, BasicAuth, and HTTPS"
+
+```yaml tab="Docker"
+labels:
+- "traefik.http.routers.router1.service=service1"
+- "traefik.http.routers.router1.middlewares=secured"
+- "traefik.http.routers.router1.rule=Host(`mydomain`)"
+- "traefik.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
+- "traefik.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
+- "traefik.http.middlewares.https-only.redirectscheme.scheme=https"
+- "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange=192.168.1.7,127.0.0.1/32"
+- "http.services.service1.loadbalancer.server.port=80"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+    - match: Host(`mydomain`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+      middlewares:
+        - name: secured
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: secured
+spec:
+  chain:
+    middlewares:
+    - https-only
+    - known-ips
+    - auth-users
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-users
+spec:
+  basicAuth:
+    users:
+    - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: https-only
+spec:
+  redirectScheme:
+    scheme: https
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: known-ips
+spec:
+  ipWhiteList:
+    sourceRange:
+    - 192.168.1.7
+    - 127.0.0.1/32
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.routers.router1.service": "service1",
+  "traefik.http.routers.router1.middlewares": "secured",
+  "traefik.http.routers.router1.rule": "Host(`mydomain`)",
+  "traefik.http.middlewares.secured.chain.middlewares": "https-only,known-ips,auth-users",
+  "traefik.http.middlewares.auth-users.basicauth.users": "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
+  "traefik.http.middlewares.https-only.redirectscheme.scheme": "https",
+  "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange": "192.168.1.7,127.0.0.1/32",
+  "http.services.service1.loadbalancer.server.port": "80"
+}
+```
+
+```yaml tab="Rancher"
+labels:
+- "traefik.http.routers.router1.service=service1"
+- "traefik.http.routers.router1.middlewares=secured"
+- "traefik.http.routers.router1.rule=Host(`mydomain`)"
+- "traefik.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
+- "traefik.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
+- "traefik.http.middlewares.https-only.redirectscheme.scheme=https"
+- "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange=192.168.1.7,127.0.0.1/32"
+- "http.services.service1.loadbalancer.server.port=80"
+```
+
+```toml tab="File"
+# ...    
+[http.routers]
+    [http.routers.router1]
+        service = "service1"
+        middlewares = ["secured"]
+        rule = "Host(`mydomain`)"
+
+[http.middlewares]
+    [http.middlewares.secured.Chain]
+        middlewares = ["https-only", "known-ips", "auth-users"]
+
+    [http.middlewares.auth-users.BasicAuth]
+        users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]
+
+    [http.middlewares.https-only.redirectScheme]
+        scheme = "https"
+
+    [http.middlewares.known-ips.ipWhiteList]
+        sourceRange = ["192.168.1.7", "127.0.0.1/32"]
+
+[http.services]
+  [http.services.service1]
+    [http.services.service1.LoadBalancer]
+      [[http.services.service1.LoadBalancer.Servers]]
+        URL = "http://127.0.0.1:80"
+```
--- a/docs/content/middlewares/circuitbreaker.md
+++ b/docs/content/middlewares/circuitbreaker.md
@@ -23,23 +23,41 @@ To assess if your system is healthy, the circuit breaker constantly monitors the

 ## Configuration Examples

-??? example "Latency Check -- Using Toml"
+```yaml tab="Docker"
+# Latency Check
+labels:
+- "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
+```

-    ```toml
-    [http.middlewares]
-       [http.middlewares.latency-check.circuitbreaker]
-          expression = "LatencyAtQuantileMS(50.0) > 100"
-    ```
+```yaml tab="Kubernetes"
+# Latency Check
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: latency-check
+spec:
+  circuitBreaker:
+    expression: LatencyAtQuantileMS(50.0) > 100
+```

-??? example "Latency Check -- Using Docker Labels"
-   
-    ```yaml
-    # in a docker compose file
-    container-definition:
-         image: image-name
-         labels:
-             - "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.latency-check.circuitbreaker.expression": "LatencyAtQuantileMS(50.0) > 100"
+}
+```
+
+```yaml tab="Rancher"
+# Latency Check
+labels:
+- "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
+```
+
+```toml tab="File"
+# Latency Check
+[http.middlewares]
+   [http.middlewares.latency-check.circuitBreaker]
+      expression = "LatencyAtQuantileMS(50.0) > 100"
+```

 ## Possible States

@@ -57,11 +75,14 @@ At specified intervals (`checkPeriod`), it will evaluate `expression` to decide

 ### Open

-While open, the fallback mechanism takes over the normal service calls for a duration of `FallbackDuration`. After this duration, it will enter the recovering state.
+While open, the fallback mechanism takes over the normal service calls for a duration of `FallbackDuration`.
+After this duration, it will enter the recovering state.

 ### Recovering

-While recovering, the circuit breaker will progressively send requests to your service again (in a linear way, for `RecoveryDuration`). If your service fails during recovery, the circuit breaker becomes open again. If the service operates normally during the whole recovering duration, then the circuit breaker returns to close.
+While recovering, the circuit breaker will progressively send requests to your service again (in a linear way, for `RecoveryDuration`).
+If your service fails during recovery, the circuit breaker becomes open again.
+If the service operates normally during the whole recovering duration, then the circuit breaker returns to close.

 ## Configuration Options

@@ -75,11 +96,11 @@ The `expression` can check three different metrics:
 - The status code ratio (`ResponseCodeRatio`)
 - The latency at quantile, in milliseconds (`LatencyAtQuantileMS`)
   
-#### NetworkErrorRatio
+#### `NetworkErrorRatio`

 If you want the circuit breaker to trigger at a 30% ratio of network errors, the expression will be `NetworkErrorRatio() > 0.30`

-#### ResponseCodeRatio
+#### `ResponseCodeRatio`

 You can trigger the circuit breaker based on the ratio of a given range of status codes.

@@ -94,11 +115,11 @@ The operation that will be computed is sum(`to` -> `from`) / sum (`dividedByFrom

 For example, the expression `ResponseCodeRatio(500, 600, 0, 600) > 0.25` will trigger the circuit breaker if 25% of the requests returned a 5XX status (amongst the request that returned a status code from 0 to 5XX). 

-#### LatencyAtQuantileMS
+#### `LatencyAtQuantileMS`

 You can trigger the circuit breaker when a given proportion of your requests become too slow.

-For example, the expression `LatencyAtQuantileMS(50.0) > 100` will trigger the circuit breaker when the median lantency (quantile 50) reaches 100MS.
+For example, the expression `LatencyAtQuantileMS(50.0) > 100` will trigger the circuit breaker when the median latency (quantile 50) reaches 100MS.

 !!! Note

@@ -111,7 +132,7 @@ You can combine multiple metrics using operators in your expression.
 Supported operators are:

 - AND (`&&`)
- OR (`||)
+- OR (`||`)

 For example, `ResponseCodeRatio(500, 600, 0, 600) > 0.30 || NetworkErrorRatio() > 0.10` triggers the circuit breaker when 30% of the requests return a 5XX status code, or when the ratio of network errors reaches 10%. 

@@ -131,15 +152,15 @@ Here is the list of supported operators:

 The fallback mechanism returns a `HTTP 503 Service Unavailable` to the client (instead of calling the target service). This behavior cannot be configured. 
   
-### CheckPeriod
+### `CheckPeriod`

 The interval used to evaluate `expression` and decide if the state of the circuit breaker must change. By default, `CheckPeriod` is 100Ms. This value cannot be configured.

-### FallbackDuration
+### `FallbackDuration`

 By default, `FallbackDuration` is 10 seconds. This value cannot be configured.

-### RecoveringDuration
+### `RecoveringDuration`

 The duration of the recovering mode (recovering state). 

--- a/docs/content/middlewares/compress.md
+++ b/docs/content/middlewares/compress.md
@@ -9,21 +9,29 @@ The Compress middleware enables the gzip compression.

 ## Configuration Examples

-??? example "File -- enable gzip compression"
+```yaml tab="Docker"
+# Enable gzip compression
+labels:
+- "traefik.http.middlewares.test-compress.compress=true"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-compress.Compress]
-    ```
-    
-??? example "Docker -- enable gzip compression"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-compress.compress": "true"
+}
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-compress.compress=true",
-    ```
+```yaml tab="Rancher"
+# Enable gzip compression
+labels:
+- "traefik.http.middlewares.test-compress.compress=true"
+```
+
+```toml tab="File"
+# Enable gzip compression
+[http.middlewares]
+  [http.middlewares.test-compress.Compress]
+```

 ## Notes

--- a/docs/content/middlewares/digestauth.md
+++ b/docs/content/middlewares/digestauth.md
@@ -9,22 +9,43 @@ The DigestAuth middleware is a quick way to restrict access to your services to

 ## Configuration Examples

-??? example "File -- Declaring the user list"
+```yaml tab="Docker"
+labels:
+- "traefik.http.middlewares.test-auth.digestauth.users=test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.digestauth]
-      users = ["test:traefik:a2688e031edb4be6a3797f3882655c05", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
-    ```
+```yaml tab="Kubernetes"
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  digestAuth:
+    users:
+    - test:traefik:a2688e031edb4be6a3797f3882655c05
+    - test2:traefik:518845800f9e2bfb1f1f740ec24f074e
+```

-??? example "Docker -- Using an external file for the authorized users"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.digestauth.users": "test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+}
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.declared-users-only.digestauth.usersFile=path-to-file.ext",
-    ```
+```yaml tab="Rancher"
+labels:
+- "traefik.http.middlewares.test-auth.digestauth.users=test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+```
+
+```toml tab="File"
+[http.middlewares]
+  [http.middlewares.test-auth.digestAuth]
+    users = [
+      "test:traefik:a2688e031edb4be6a3797f3882655c05",
+      "test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
+    ]
+```

 !!! tip 
   
@@ -32,7 +53,7 @@ The DigestAuth middleware is a quick way to restrict access to your services to

 ## Configuration Options

-### Users
+### `Users`

 The `users` option is an array of authorized users. Each user will be declared using the `name:realm:encoded-password` format.

@@ -40,7 +61,7 @@ The `users` option is an array of authorized users. Each user will be declared u
    
    If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

-### UsersFile
+### `UsersFile`

 The `usersFile` option is the path to an external file that contains the authorized users for the middleware.

@@ -48,7 +69,7 @@ The file content is a list of `name:realm:encoded-password`.

 ??? example "A file containing test/test and test2/test2"

-    ```
+    ```txt
    test:traefik:a2688e031edb4be6a3797f3882655c05
    test2:traefik:518845800f9e2bfb1f1f740ec24f074e
    ```
@@ -57,22 +78,49 @@ The file content is a list of `name:realm:encoded-password`.
    
    If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.

-### Realm
+### `Realm`

 You can customize the realm for the authentication with the `realm` option. The default value is `traefik`. 

-### HeaderField
+### `HeaderField`

 You can customize the header field for the authenticated user using the `headerField`option.

-??? example "File -- Passing Authenticated Users to Services Via Headers"
+Example "File -- Passing Authenticated User to Services Via Headers"

-    ```toml
-      [http.middlewares.my-auth.digestauth]
-        usersFile = "path-to-file.ext"
-        headerField = "X-WebAuth-User" # header for the authenticated user
-    ```
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.my-auth.digestauth.headerField=X-WebAuth-User"
+```

-### RemoveHeader
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: my-auth
+spec:
+  digestAuth:
+    # ...
+    headerField: X-WebAuth-User
+```
+
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.my-auth.digestauth.headerField=X-WebAuth-User"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.my-auth.digestauth.headerField": "X-WebAuth-User"
+}
+```
+
+```toml tab="File"
+[http.middlewares.my-auth.digestAuth]
+  # ...
+  headerField = "X-WebAuth-User"
+```
+
+### `RemoveHeader`

 Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)
--- a/docs/content/middlewares/errorpages.md
+++ b/docs/content/middlewares/errorpages.md
@@ -12,42 +12,61 @@ The ErrorPage middleware returns a custom page in lieu of the default, according

 ## Configuration Examples

-??? example "File -- Custom Error Page for 5XX"
+```yaml tab="Docker"
+# Dynamic Custom Error Page for 5XX Status Code
+labels:
+- "traefik.http.middlewares.test-errorpage.errors.status=500-599"
+- "traefik.http.middlewares.test-errorpage.errors.service=serviceError"
+- "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html"
+```

-    ```toml
-    [http.routers]
-      [http.routers.router1]
-        Service = "my-service"
-        Rule = Host(`my-domain`)
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-errorpage
+spec:
+  errors:
+    status:
+    - 500-599
+    service: serviceError
+    query: /{status}.html
+```

-    [http.middlewares]
-      [http.middlewares.5XX-errors.Errors]
-        status = ["500-599"]
-        service = "error-handler-service"
-        query = "/error.html"
-                
-    [http.services]
-      # ... definition of error-handler-service and my-service
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-errorpage.errors.status": "500-599",
+  "traefik.http.middlewares.test-errorpage.errors.service": "serviceError",
+  "traefik.http.middlewares.test-errorpage.errors.query": "/{status}.html"
+}
+```

-??? example "Docker -- Dynamic Custom Error Page for 5XX Status Code"
+```yaml tab="Rancher"
+# Dynamic Custom Error Page for 5XX Status Code
+labels:
+- "traefik.http.middlewares.test-errorpage.errors.status=500-599"
+- "traefik.http.middlewares.test-errorpage.errors.service=serviceError"
+- "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html"
+```

-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.test-errorpage.errors.status=500-599",
-          - "traefik.http.middlewares.test-errorpage.errors.service=serviceError",
-          - "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html",
-            		
-    ```
-    
-    !!! note 
-        In this example, the error page URL is based on the status code (`query=/{status}.html)`.
+```toml tab="File"
+# Custom Error Page for 5XX
+[http.middlewares]
+  [http.middlewares.test-errorpage.Errors]
+    status = ["500-599"]
+    service = "serviceError"
+    query = "/{status}.html"
+
+[http.services]
+  # ... definition of error-handler-service and my-service
+```
+
+!!! note 
+    In this example, the error page URL is based on the status code (`query=/{status}.html)`.

 ## Configuration Options

-### status
+### `status`

 The `status` that will trigger the error page.

@@ -57,10 +76,10 @@ The status code ranges are inclusive (`500-599` will trigger with every code bet

    You can define either a status code like `500` or ranges with a syntax like `500-599`.

-### service
+### `service`

 The service that will serve the new requested error page.

-### query
+### `query`

 The URL for the error page (hosted by `service`). You can use `{status}` in the query, that will be replaced by the received status code.
--- a/docs/content/middlewares/forwardauth.md
+++ b/docs/content/middlewares/forwardauth.md
@@ -1,6 +1,6 @@
 # ForwardAuth

-Using an External Service to Ccheck for Credentials
+Using an External Service to Check for Credentials
 {: .subtitle }

 ![AuthForward](../assets/img/middleware/authforward.png)
@@ -11,53 +11,93 @@ Otherwise, the response from the authentication server is returned.

 ## Configuration Examples

-??? example "File -- Forward authentication to authserver.com"
+```yaml tab="Docker"
+# Forward authentication to authserver.com
+labels:
+- "traefik.http.middlewares.test-auth.ForwardAuth.Address=https://authserver.com/auth"
+- "traefik.http.middlewares.test-auth.ForwardAuth.AuthResponseHeaders=X-Auth-User, X-Secret"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CA=path/to/local.crt"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CAOptional=true"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Cert=path/to/foo.cert"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.InsecureSkipVerify=true"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Key=path/to/foo.key"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TrustForwardHeader=true"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.forwardauth]
-        address = "https://authserver.com/auth"
-        trustForwardHeader = true
-        authResponseHeaders = ["X-Auth-User", "X-Secret"]
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  forwardAuth:
+    address: https://authserver.com/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+    - X-Auth-User
+    - X-Secret
+    tls:
+      ca: path/to/local.crt
+      caOptional: true
+      cert: path/to/foo.cert
+      key: path/to/foo.key  
+```

-        [http.middlewares.test-auth.forwardauth.tls]
-          ca = "path/to/local.crt"
-          caOptional = true
-          cert = "path/to/foo.cert"
-          key = "path/to/foo.key"      
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.ForwardAuth.Address": "https://authserver.com/auth",
+  "traefik.http.middlewares.test-auth.ForwardAuth.AuthResponseHeaders": "X-Auth-User,X-Secret",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CA": "path/to/local.crt",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CAOptional": "true",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Cert": "path/to/foo.cert",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TLS.InsecureSkipVerify": "true",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Key": "path/to/foo.key",
+  "traefik.http.middlewares.test-auth.ForwardAuth.TrustForwardHeader": "true"
+}
+```

-??? example "Docker -- Forward authentication to authserver.com"
+```yaml tab="Rancher"
+# Forward authentication to authserver.com
+labels:
+- "traefik.http.middlewares.test-auth.ForwardAuth.Address=https://authserver.com/auth"
+- "traefik.http.middlewares.test-auth.ForwardAuth.AuthResponseHeaders=X-Auth-User, X-Secret"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CA=path/to/local.crt"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CAOptional=true"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Cert=path/to/foo.cert"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.InsecureSkipVerify=true"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Key=path/to/foo.key"
+- "traefik.http.middlewares.test-auth.ForwardAuth.TrustForwardHeader=true"
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-auth.ForwardAuth.Address=https://authserver.com/auth"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.AuthResponseHeaders=X-Auth-User, X-Secret"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CA=path/to/local.crt"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CAOptional=true"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Cert=path/to/foo.cert"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.InsecureSkipVerify=true"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Key=path/to/foo.key"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TrustForwardHeader=true"
-              		
-    ```
+```toml tab="File"
+# Forward authentication to authserver.com
+[http.middlewares]
+  [http.middlewares.test-auth.forwardAuth]
+    address = "https://authserver.com/auth"
+    trustForwardHeader = true
+    authResponseHeaders = ["X-Auth-User", "X-Secret"]
+
+    [http.middlewares.test-auth.forwardauth.tls]
+      ca = "path/to/local.crt"
+      caOptional = true
+      cert = "path/to/foo.cert"
+      key = "path/to/foo.key"
+```

 ## Configuration Options

-### address
+### `address`

 The `address` option defines the authentication server address.

-### trustForwardHeader
+### `trustForwardHeader`

 Set the `trustForwardHeader` option to true to trust all the existing X-Forwarded-* headers.

-### authResponseHeaders
+### `authResponseHeaders`

 The `authResponseHeaders` option is the list of the headers to copy from the authentication server to the request.

-### tls
+### `tls`

 The `tls` option is the tls configuration from Traefik to the authentication server.
--- a/docs/content/middlewares/headers.md
+++ b/docs/content/middlewares/headers.md
@@ -13,76 +13,186 @@ The Headers middleware can manage the requests/responses headers.

 Add the `X-Script-Name` header to the proxied request and the `X-Custom-Response-Header` to the response

-??? example "File"
+```yaml tab="Docker"
+labels:
+- "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test"
+- "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        [http.middlewares.testHeader.headers.CustomRequestHeaders]
-            X-Script-Name = "test"
-        [http.middlewares.testHeader.headers.CustomResponseHeaders]
-            X-Custom-Response-Header = "True"
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    customRequestHeaders:
+      X-Script-Name: "test"
+    customResponseHeaders:
+      X-Custom-Response-Header: "True"
+```

-??? example "Docker"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name": "test",
+  "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header": "True"
+}
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test",
-              - "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True",
-    ```
+```yaml tab="Rancher"
+labels:
+- "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test"
+- "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True"
+```
+
+```toml tab="File"
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    [http.middlewares.testHeader.headers.CustomRequestHeaders]
+        X-Script-Name = "test"
+    [http.middlewares.testHeader.headers.CustomResponseHeaders]
+        X-Custom-Response-Header = "True"
+```

 ### Adding and Removing Headers

-`X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` header removed from the request, and the `X-Custom-Response-Header` header removed from the response.
+`X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` header removed from the request,
+and the `X-Custom-Response-Header` header removed from the response.

-??? example "File"
+Please note that is not possible to remove headers through the use of labels (Docker, Rancher, Marathon, ...) for now.

-    ```toml    
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        [http.middlewares.testHeader.headers.CustomRequestHeaders]
-            X-Script-Name = "test"
-        [http.middlewares.testHeader.headers.CustomResponseHeaders]
-            X-Custom-Response-Header = "True"
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    customRequestHeaders:
+      X-Script-Name: "test" # Adds
+      X-Custom-Request-Header: "" # Removes
+    customResponseHeaders:
+      X-Custom-Response-Header: "" # Removes
+```

-??? example "Docker"
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test"
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test",
-              - "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True",
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name": "test",
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    [http.middlewares.testHeader.headers.CustomRequestHeaders]
+        X-Script-Name = "test" # Adds
+        X-Custom-Request-Header = "" # Removes
+    [http.middlewares.testHeader.headers.CustomResponseHeaders]
+        X-Custom-Response-Header = "" # Removes
+```

 ### Using Security Headers

 Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above.
 This functionality allows for some easy security features to quickly be set.

-??? example "File"
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.testHeader.Headers.FrameDeny=true"
+  - "traefik.http.middlewares.testHeader.Headers.SSLRedirect=true"
+```

-    ```toml    
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        FrameDeny = true
-        SSLRedirect = true
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    frameDeny: "true"
+    sslRedirect: "true"
+```

-??? example "Docker"
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testHeader.Headers.FrameDeny=true"
+  - "traefik.http.middlewares.testHeader.Headers.SSLRedirect=true"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testHeader.Headers.FrameDeny": "true",
+  "traefik.http.middlewares.testHeader.Headers.SSLRedirect": "true"
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    FrameDeny = true
+    SSLRedirect = true
+```
+
+### CORS Headers
+
+CORS (Cross-Origin Resource Sharing) headers can be added and configured per frontend in a similar manner to the custom headers above.
+This functionality allows for more advanced security features to quickly be set.
+
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlAllowMethods=GET,OPTIONS,PUT"
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlAllowOrigin=origin-list-or-null"
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlMaxAge=100"
+  - "traefik.http.middlewares.testHeader.Headers.AddVaryHeader=true"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    AccessControlAllowMethods:
+      - "GET"
+      - "OPTIONS"
+      - "PUT"
+    AccessControlAllowOrigin: "origin-list-or-null"
+    AccessControlMaxAge: 100
+    AddVaryHeader: "true"
+```
+
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlAllowMethods=GET,OPTIONS,PUT"
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlAllowOrigin=origin-list-or-null"
+  - "traefik.http.middlewares.testHeader.Headers.AccessControlMaxAge=100"
+  - "traefik.http.middlewares.testHeader.Headers.AddVaryHeader=true"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testHeader.Headers.AccessControlAllowMethods": "GET,OPTIONS,PUT",
+  "traefik.http.middlewares.testHeader.Headers.AccessControlAllowOrigin": "origin-list-or-null",
+  "traefik.http.middlewares.testHeader.Headers.AccessControlMaxAge": "100",
+  "traefik.http.middlewares.testHeader.Headers.AddVaryHeader": "true"
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    AccessControlAllowMethods= ["GET", "OPTIONS", "PUT"]
+    AccessControlAllowOrigin = "origin-list-or-null"
+    AccessControlMaxAge = 100
+    AddVaryHeader = true
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.FrameDeny=true",
-              - "traefik.http.middlewares.testHeader.Headers.SSLRedirect=true",
-    ```
-       
 ## Configuration Options

 ### General
@@ -93,87 +203,123 @@ This functionality allows for some easy security features to quickly be set.
 !!! note
    The detailed documentation for the security headers can be found in [unrolled/secure](https://github.com/unrolled/secure#available-options).

-### customRequestHeaders
+### `customRequestHeaders`

 The `customRequestHeaders` option lists the Header names and values to apply to the request.

-### allowedHosts 
+### `customResponseHeaders`
+
+The `customResponseHeaders` option lists the Header names and values to apply to the response.
+
+### `accessControlAllowCredentials`
+
+The `accessControlAllowCredentials` indicates whether the request can include user credentials.
+
+### `accessControlAllowHeaders`
+
+The `accessControlAllowHeaders` indicates which header field names can be used as part of the request.
+
+### `accessControlAllowMethods`
+
+The  `accessControlAllowMethods` indicates which methods can be used during requests.
+
+### `accessControlAllowOrigin`
+
+The `accessControlAllowOrigin` indicates whether a resource can be shared by returning different values. The three options for this value are:
+
+- `origin-list-or-null`
+- `*`
+- `null`
+
+### `accessControlExposeHeaders`
+
+The `accessControlExposeHeaders` indicates which headers are safe to expose to the api of a CORS API specification.
+
+### `accessControlMaxAge`
+
+The `accessControlMaxAge` indicates how long a preflight request can be cached.
+
+### `addVaryHeader`
+
+The `addVaryHeader` is used in conjunction with `accessControlAllowOrigin` to determine whether the vary header should be added or modified to demonstrate that server responses can differ beased on the value of the origin header.
+
+### `allowedHosts` 

 The `allowedHosts` option lists fully qualified domain names that are allowed.

-### hostsProxyHeaders 
+### `hostsProxyHeaders` 

 The `hostsProxyHeaders` option is a set of header keys that may hold a proxied hostname value for the request.

-### sslRedirect 
+### `sslRedirect` 

 The `sslRedirect` is set to true, then only allow https requests.

-### sslTemporaryRedirect
+### `sslTemporaryRedirect`
                    
 Set the `sslTemporaryRedirect` to `true` to force an SSL redirection using a 302 (instead of a 301).

-### sslHost 
+### `sslHost` 

 The `SSLHost` option is the host name that is used to redirect http requests to https.

-### sslProxyHeaders 
+### `sslProxyHeaders` 

 The `sslProxyHeaders` option is set of header keys with associated values that would indicate a valid https request. Useful when using other proxies with header like: `"X-Forwarded-Proto": "https"`.

-### sslForceHost 
+### `sslForceHost` 

 Set `sslForceHost` to true and set SSLHost to forced requests to use `SSLHost` even the ones that are already using SSL.

-### stsSeconds 
+### `stsSeconds` 

 The `stsSeconds` is the max-age of the Strict-Transport-Security header. If set to 0, would NOT include the header.

-### stsIncludeSubdomains 
+### `stsIncludeSubdomains` 

 The `stsIncludeSubdomains` is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header.

-### stsPreload 
+### `stsPreload` 

 Set `STSPreload` to true to have the `preload` flag appended to the Strict-Transport-Security header.

-### forceSTSHeader
+### `forceSTSHeader`

 Set `ForceSTSHeader` to true, to add the STS header even when the connection is HTTP.

-### frameDeny 
+### `frameDeny` 

 Set `frameDeny` to true to add the `X-Frame-Options` header with the value of `DENY`.
 
-### customFrameOptionsValue 
+### `customFrameOptionsValue` 

 The `customFrameOptionsValue` allows the `X-Frame-Options` header value to be set with a custom value. This overrides the FrameDeny option.

-### contentTypeNosniff
+### `contentTypeNosniff`

 Set `contentTypeNosniff` to true to add the `X-Content-Type-Options` header with the value `nosniff`.

-### browserXssFilter
+### `browserXssFilter`

 Set `BrowserXssFilter` to true to add the `X-XSS-Protection` header with the value `1; mode=block`.

-### customBrowserXSSValue
+### `customBrowserXSSValue`

 The `customBrowserXssValue` option allows the `X-XSS-Protection` header value to be set with a custom value. This overrides the BrowserXssFilter option.

-### contentSecurityPolicy
+### `contentSecurityPolicy`

 The `contentSecurityPolicy` option allows the `Content-Security-Policy` header value to be set with a custom value.

-### publicKey
+### `publicKey`

 The `publicKey` implements HPKP to prevent MITM attacks with forged certificates. 

-### referrerPolicy
+### `referrerPolicy`

 The `referrerPolicy` allows sites to control when browsers will pass the Referer header to other sites.

-### isDevelopment
+### `isDevelopment`

 Set `isDevelopment` to true when developing. The AllowedHosts, SSL, and STS options can cause some unwanted effects. Usually testing happens on http, not https, and on localhost, not your production domain.  
 If you would like your development environment to mimic production with complete Host blocking, SSL redirects, and STS headers, leave this as false.
--- a/docs/content/middlewares/ipwhitelist.md
+++ b/docs/content/middlewares/ipwhitelist.md
@@ -9,38 +9,58 @@ IPWhitelist accepts / refuses requests based on the client IP.

 ## Configuration Examples

-??? example "File -- Accepts request from defined IP"
+```yaml tab="Docker"
+# Accepts request from defined IP
+labels:
+- "traefik.http.middlewares.test-ipwhitelist.IPWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-ipwhitelist.ipWhiteList]
-        sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ipwhitelist
+spec:
+  ipWhiteList:
+    sourceRange:
+    - 127.0.0.1/32
+    - 192.168.1.7
+```

-??? example "Docker -- Accepts request from defined IP"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-ipwhitelist.IPWhiteList.SourceRange": "127.0.0.1/32,192.168.1.7"
+}
+```

-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.Middleware9.IPWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
-    ```
+```yaml tab="Rancher"
+# Accepts request from defined IP
+labels:
+- "traefik.http.middlewares.test-ipwhitelist.IPWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
+```
+
+```toml tab="File"
+# Accepts request from defined IP
+[http.middlewares]
+  [http.middlewares.test-ipwhitelist.ipWhiteList]
+    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
+```

 ## Configuration Options

-### sourceRange
+### `sourceRange`

 The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs).

-### ipStrategy
+### `ipStrategy`

 The `ipStrategy` option defines two parameters that sets how Traefik will determine the client IP: `depth`, and `excludedIPs`.

-#### ipStrategy.depth 
+#### `ipStrategy.depth`

 The `depth` option tells Traefik to use the `X-Forwarded-For` header and take the IP located at the `depth` position (starting from the right).

-!!! note "Examples of Depth & X-Forwaded-For"
+!!! note "Examples of Depth & X-Forwarded-For"

    If `depth` was equal to 2, and the request `X-Forwarded-For` header was `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` then the "real" client IP would be `"10.0.0.1"` (at depth 4) but the IP used for the whitelisting would be `"12.0.0.1"` (`depth=2`).
    
@@ -51,10 +71,45 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
        | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1`     | `"13.0.0.1"` |
        | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3`     | `"11.0.0.1"` |
        | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5`     | `""`         |
-
-??? example "File -- Whitelisting Based on `X-Forwarded-For` with `depth=2`"
-
-    ```toml
+    
+    ```yaml tab="Docker"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    labels:
+        - "traefik.http.middlewares.testIPwhitelist.ipWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
+    ```
+    
+    ```yaml tab="Kubernetes"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: Middleware
+    metadata:
+      name: testIPwhitelist
+    spec:
+      ipWhiteList:
+        SourceRange:
+        - 127.0.0.1/32
+        - 192.168.1.7
+        ipstrategy:
+          depth: 2
+    ```
+    
+    ```yaml tab="Rancher"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    labels:
+        - "traefik.http.middlewares.testIPwhitelist.ipWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
+    ```
+    
+    ```json tab="Marathon"
+    "labels": {
+        "traefik.http.middlewares.testIPwhitelist.ipWhiteList.SourceRange": "127.0.0.1/32, 192.168.1.7",
+        "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth": "2"
+    }
+    ```
+    
+    ```toml tab="File"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
    [http.middlewares]
      [http.middlewares.test-ipwhitelist.ipWhiteList]
        sourceRange = ["127.0.0.1/32", "192.168.1.7"]
@@ -62,26 +117,16 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
            depth = 2
    ```

-??? example "Docker -- Whitelisting Based on `X-Forwarded-For` with `depth=2`"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.testIPwhitelist.ipWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
-                - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
-    ```
-
 !!! note

    - If `depth` is greater than the total number of IPs in `X-Forwarded-For`, then the client IP will be empty.
    - `depth` is ignored if its value is is lesser than or equal to 0.

-#### ipStrategy.excludedIPs
+#### `ipStrategy.excludedIPs`

 `excludedIPs` tells Traefik to scan the `X-Forwarded-For` header and pick the first IP not in the list.

-!!! note "Examples of ExcludedIPs & X-Forwaded-For"
+!!! note "Examples of ExcludedIPs & X-Forwarded-For"

    | `X-Forwarded-For`                       | `excludedIPs`         | clientIP     |
    |-----------------------------------------|-----------------------|--------------|
@@ -94,20 +139,42 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
 !!! important
    If `depth` is specified, `excludedIPs` is ignored.

-??? example "File -- Exclude from `X-Forwarded-For`"
+```yaml tab="Docker"
+# Exclude from `X-Forwarded-For`
+labels:
+    - "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedIPs=127.0.0.1/32, 192.168.1.7"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-ipwhitelist.ipWhiteList]
-        [http.middlewares.test-ipwhitelist.ipWhiteList.ipStrategy]
-          excludedIPs = ["127.0.0.1/32", "192.168.1.7"]
-    ```
+```yaml tab="Kubernetes"
+# Exclude from `X-Forwarded-For`
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ipwhitelist
+spec:
+  ipWhiteList:
+    ipstrategy:
+      excludedIPs:
+      - 127.0.0.1/32
+      - 192.168.1.7
+```

-??? example "Docker -- Exclude from `X-Forwarded-For`"
+```yaml tab="Rancher"
+# Exclude from `X-Forwarded-For`
+labels:
+    - "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedIPs=127.0.0.1/32, 192.168.1.7"
+```

-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.excludedIPs=127.0.0.1/32, 192.168.1.7"
-    ```
+```json tab="Marathon"
+"labels": {
+    "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedIPs": "127.0.0.1/32, 192.168.1.7"
+}
+```
+
+```toml tab="File"
+# Exclude from `X-Forwarded-For`
+[http.middlewares]
+  [http.middlewares.test-ipwhitelist.ipWhiteList]
+    [http.middlewares.test-ipwhitelist.ipWhiteList.ipStrategy]
+      excludedIPs = ["127.0.0.1/32", "192.168.1.7"]
+```
--- a/docs/content/middlewares/maxconnection.md
+++ b/docs/content/middlewares/maxconnection.md
@@ -9,26 +9,44 @@ To proactively prevent services from being overwhelmed with high load, a maximum

 ## Configuration Examples

-??? example "File -- Limiting to 10 simultaneous connections"
+```yaml tab="Docker"
+# Limiting to 10 simultaneous connections
+labels:
+- "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-maxconn.maxconn]
-      amount = 10 
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: addprefix
+spec:
+  addPrefix:
+    prefix: /bar
+```

-??? example "Docker -- Limiting to 10 simultaneous connections"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-maxconn.maxconn.amount": "10"
+}
+```

-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
-    ```
+```yaml tab="Rancher"
+# Limiting to 10 simultaneous connections
+labels:
+- "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
+```
+
+```toml tab="File"
+# Limiting to 10 simultaneous connections
+[http.middlewares]
+  [http.middlewares.test-maxconn.maxconn]
+  amount = 10 
+```

 ## Configuration Options

-### amount
+### `amount`

 The `amount` option defines the maximum amount of allowed simultaneous connections.
 The middleware will return an `HTTP 429 Too Many Requests` if there are already `amount` requests in progress (based on the same `extractorfunc` strategy).
--- a/docs/content/middlewares/overview.md
+++ b/docs/content/middlewares/overview.md
@@ -13,79 +13,86 @@ Pieces of middleware can be combined in chains to fit every scenario.

 ## Configuration Example

-??? example "As Toml Configuration File"
+```yaml tab="Docker"
+# As a Docker Label
+whoami:
+  image: containous/whoami  # A container that exposes an API to show its IP address
+  labels:
+    - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+```

-    ```toml
-    [providers]
-       [providers.file]
-
-    [http.routers]
-      [http.routers.router1]
-        Service = "myService"
-        Middlewares = ["foo-add-prefix"]
-        Rule = "Host: example.com"
-
-    [http.middlewares]
-     [http.middlewares.foo-add-prefix.AddPrefix]
-        prefix = "/foo"
-
-    [http.services]
-     [http.services.service1]
-       [http.services.service1.LoadBalancer]
-
-         [[http.services.service1.LoadBalancer.Servers]]
-           URL = "http://127.0.0.1:80"
-           Weight = 1
-    ```
-
-??? example "As a Docker Label"
-
-    ```yaml
-    # A container that exposes a simple API
-    whoami:
-      image: containous/whoami  # A container that exposes an API to show its IP address
-        labels:
-          - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo",
-    ```
-
-??? example "As a Kubernetes Traefik IngressRoute"
-
-    ```yaml
-    apiVersion: apiextensions.k8s.io/v1beta1
-    kind: CustomResourceDefinition
-    metadata:
-      name: middlewares.traefik.containo.us
-    spec:
-      group: traefik.containo.us
-      version: v1alpha1
-      names:
-        kind: Middleware
-        plural: middlewares
-        singular: middleware
-      scope: Namespaced
-
-    ---
-    apiVersion: traefik.containo.us/v1alpha1
+```yaml tab="Kubernetes"
+# As a Kubernetes Traefik IngressRoute
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
    kind: Middleware
-    metadata:
-      name: stripprefix
-    spec:
-      stripprefix:
-        prefixes:
-          - /stripit
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced

-    ---
-    apiVersion: traefik.containo.us/v1alpha1
-    kind: IngressRoute
-    metadata:
-      name: ingressroute.crd
-    spec:
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: stripprefix
+spec:
+  stripprefix:
+    prefixes:
+      - /stripit
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroute
+spec:
+# more fields...
+  routes:
    # more fields...
-      routes:
-        # more fields...
-        middleware:
-        - name: stripprefix
-    ```
+    middlewares:
+    - name: stripprefix
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.foo-add-prefix.addprefix.prefix": "/foo"
+}
+```
+
+```yaml tab="Rancher"
+# As a Rancher Label
+labels:
+  - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+```
+
+```toml tab="File"
+# As Toml Configuration File
+[providers]
+   [providers.file]
+
+[http.routers]
+  [http.routers.router1]
+    Service = "myService"
+    Middlewares = ["foo-add-prefix"]
+    Rule = "Host(`example.com`)"
+
+[http.middlewares]
+ [http.middlewares.foo-add-prefix.AddPrefix]
+    prefix = "/foo"
+
+[http.services]
+ [http.services.service1]
+   [http.services.service1.LoadBalancer]
+
+     [[http.services.service1.LoadBalancer.Servers]]
+       URL = "http://127.0.0.1:80"
+```

 ## Advanced Configuration

@@ -115,7 +122,7 @@ If you use multiple `providers` and wish to reference a middleware declared in a

        labels:
          # Attach file.add-foo-prefix middleware (declared in file)
-          - "traefik.http.routers.middlewares=file.add-foo-prefix",
+          - "traefik.http.routers.my-container.middlewares=file.add-foo-prefix"
    ```

 ## Available Middlewares
@@ -127,14 +134,14 @@ If you use multiple `providers` and wish to reference a middleware declared in a
 | [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
 | [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
 | [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
-| [Compress](circuitbreaker.md)             | Compress the response                             | Content Modifier            |
+| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
 | [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
 | [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
 | [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
 | [Headers](headers.md)                     | Add / Update headers                              | Security                    |
 | [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
 | [MaxConnection](maxconnection.md)         | Limit the number of simultaneous connections      | Security, Request lifecycle |
-| [PassTLSClientCert](passtlsclientcert.md) | TODO                                              | Security                    |
+| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
 | [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
 | [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
 | [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |
--- a/docs/content/middlewares/passtlsclientcert.md
+++ b/docs/content/middlewares/passtlsclientcert.md
@@ -1,4 +1,4 @@
-# TODO - PassTLSClientCert
+# PassTLSClientCert

 Adding Client Certificates in a Header
 {: .subtitle }
@@ -9,26 +9,143 @@ PassTLSClientCert adds in header the selected data from the passed client tls ce

 ## Configuration Examples

-??? example "File -- Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
+Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+
+```yaml tab="Docker"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+labels:
+- "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem=true"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: addprefix
+spec:
+  passtlsclientcert:
+    pem: true
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem": "true"
+}
+```
+
+```yaml tab="Rancher"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+labels:
+- "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem=true"
+```
+
+```toml tab="File"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+[http.middlewares]
+  [http.middlewares.test-passtlsclientcert.passtlsclientcert]
+    pem = true
+```
+
+??? example "Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
+
+    ```yaml tab="Docker"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    labels:
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
+    ```
    
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-passtlsclientcert.passtlsclientcert]
-        pem = true
+    ```yaml tab="Kubernetes"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: Middleware
+    metadata:
+      name: test-passtlsclientcert
+    spec:
+      passtlsclientcert:
+        info:
+          notAfter: true
+          notBefore: true
+          sans: true
+          subject:
+            country: true
+            province: true
+            locality: true
+            organization: true
+            commonName: true
+            serialNumber: true
+            domainComponent: true
+          issuer:
+            country: true
+            province: true
+            locality: true
+            organization: true
+            commonName: true
+            serialNumber: true
+            domainComponent: true
+    ```
+    
+    ```yaml tab="Rancher"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    labels:
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
+    ```
+        
+    ```json tab="Marathon"
+    "labels": {
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber": "true"
+    }
    ```

-??? example "Docker -- Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.Middleware11.passtlsclientcert.pem=true"
-    ```
-
-??? example "File -- Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header"
-
-    ```toml
+    ```toml tab="File"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
    [http.middlewares]
      [http.middlewares.test-passtlsclientcert.passtlsclientcert]
        [http.middlewares.test-passtlsclientcert.passtlsclientcert.info]
@@ -53,39 +170,14 @@ PassTLSClientCert adds in header the selected data from the passed client tls ce
            domainComponent = true
    ```

-??? example "Docker -- Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
-    ```
-
 ## Configuration Options

 ### General

 PassTLSClientCert can add two headers to the request: 

-* `X-Forwarded-Tls-Client-Cert` that contains the escaped pem.
-* `X-Forwarded-Tls-Client-Cert-Info` that contains all the selected certificate information in an escaped string.
+- `X-Forwarded-Tls-Client-Cert` that contains the escaped pem.
+- `X-Forwarded-Tls-Client-Cert-Info` that contains all the selected certificate information in an escaped string.

 !!! note
    The headers are filled with escaped string so it can be safely placed inside a URL query.
@@ -196,9 +288,10 @@ In the following example, you can see a complete certificate. We will use each p
    -----END CERTIFICATE-----
    ```

-### pem
+### `pem`

 The `pem` option sets the `X-Forwarded-Tls-Client-Cert` header with the escape certificate.
+
 In the example, it is the part between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` delimiters :

 ??? example "The data used by the pem option"
@@ -247,10 +340,16 @@ In the example, it is the part between `-----BEGIN CERTIFICATE-----` and `-----E
    The delimiters and `\n` will be removed.  
    If there are more than one certificate, they are separated by a "`;`".

-### info
+!!! note "`X-Forwarded-Tls-Client-Cert` value could exceed the web server header size limit"
+
+    The header size limit of web servers is commonly between 4kb and 8kb.  
+    You could change the server configuration to allow bigger header or use the `info` option with the needed field(s).
+
+### `info`

 The `info` option select the specific client certificate details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
 The value of the header will be an escaped concatenation of all the selected certificate details.
+
 The following example shows an unescaped result that uses all the available fields: 

 ```text
@@ -261,9 +360,10 @@ Subject="DC=org,DC=cheese,C=FR,C=US,ST=Cheese org state,ST=Cheese com state,L=TO

    If there are more than one certificate, they are separated by a `;`.

-#### info.notafter 
+#### `info.notafter`

 Set the `info.notafter` option to `true` to add the `Not After` information from the `Validity` part.
+
 The data are taken from the following certificate part:      

 ```text
@@ -277,7 +377,7 @@ The escape `notafter` info part will be like:
 NA=1607166616
 ```

-#### info.notbefore
+#### `info.notbefore`

 Set the `info.notafter` option to `true` to add the `Not Before` information from the `Validity` part.

@@ -294,9 +394,10 @@ The escape `notafter` info part will be like:
 NB=1544094616
 ```

-#### info.sans
+#### `info.sans`

 Set the `info.sans` option to `true` to add the `Subject Alternative Name` information from the `Subject Alternative Name` part.
+
 The data are taken from the following certificate part:

 ```text
@@ -314,7 +415,7 @@ SAN=*.cheese.org,*.cheese.net,*.cheese.com,test@cheese.org,test@cheese.net,10.0.

    All the SANs data are separated by a `,`.
    
-#### info.subject
+#### `info.subject`

 The `info.subject` select the specific client certificate subject details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.

@@ -324,7 +425,7 @@ The data are taken from the following certificate part :
 Subject: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=*.cheese.org, CN=*.cheese.com, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Cheese org state, ST=Cheese com state/emailAddress=cert@cheese.org/emailAddress=cert@scheese.com
 ```

-##### info.subject.country
+##### `info.subject.country`

 Set the `info.subject.country` option to true to add the `country` information into the subject.  
 The data are taken from the subject part with the `C` key. 
@@ -334,7 +435,7 @@ The escape country info in the subject part will be like :
 C=FR,C=US
 ```

-##### info.subject.province
+##### `info.subject.province`

 Set the `info.subject.province` option to true to add the `province` information into the subject.
  
@@ -346,7 +447,7 @@ The escape province info in the subject part will be like :
 ST=Cheese org state,ST=Cheese com state
 ```

-##### info.subject.locality
+##### `info.subject.locality`

 Set the `info.subject.locality` option to true to add the `locality` information into the subject.
  
@@ -358,7 +459,7 @@ The escape locality info in the subject part will be like :
 L=TOULOUSE,L=LYON
 ```

-##### info.subject.organization
+##### `info.subject.organization`

 Set the `info.subject.organization` option to true to add the `organization` information into the subject.
  
@@ -370,31 +471,31 @@ The escape organization info in the subject part will be like :
 O=Cheese,O=Cheese 2
 ```

-##### info.subject.commonname
+##### `info.subject.commonname`

 Set the `info.subject.commonname` option to true to add the `commonname` information into the subject.
  
 The data are taken from the subject part with the `CN` key.

-The escape commonname info in the subject part will be like :
+The escape common name info in the subject part will be like :

 ```text
 CN=*.cheese.com
 ```

-##### info.subject.serialnumber
+##### `info.subject.serialnumber`

 Set the `info.subject.serialnumber` option to true to add the `serialnumber` information into the subject.
  
 The data are taken from the subject part with the `SN` key.

-The escape serialnumber info in the subject part will be like :
+The escape serial number info in the subject part will be like :

 ```text
 SN=1234567890
 ```

-##### info.subject.domaincomponent
+##### `info.subject.domaincomponent`

 Set the `info.subject.domaincomponent` option to true to add the `domaincomponent` information into the subject.
  
@@ -406,7 +507,7 @@ The escape domaincomponent info in the subject part will be like :
 DC=org,DC=cheese
 ```

-#### info.issuer
+#### `info.issuer`

 The `info.issuer` select the specific client certificate issuer details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.

@@ -416,7 +517,7 @@ The data are taken from the following certificate part :
 Issuer: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=Simple Signing CA, CN=Simple Signing CA 2, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Signing State, ST=Signing State 2/emailAddress=simple@signing.com/emailAddress=simple2@signing.com
 ```

-##### info.issuer.country
+##### `info.issuer.country`

 Set the `info.issuer.country` option to true to add the `country` information into the issuer.  
 The data are taken from the issuer part with the `C` key. 
@@ -426,7 +527,7 @@ The escape country info in the issuer part will be like :
 C=FR,C=US
 ```

-##### info.issuer.province
+##### `info.issuer.province`

 Set the `info.issuer.province` option to true to add the `province` information into the issuer.
  
@@ -438,7 +539,7 @@ The escape province info in the issuer part will be like :
 ST=Signing State,ST=Signing State 2
 ```

-##### info.issuer.locality
+##### `info.issuer.locality`

 Set the `info.issuer.locality` option to true to add the `locality` information into the issuer.
  
@@ -450,7 +551,7 @@ The escape locality info in the issuer part will be like :
 L=TOULOUSE,L=LYON
 ```

-##### info.issuer.organization
+##### `info.issuer.organization`

 Set the `info.issuer.organization` option to true to add the `organization` information into the issuer.
  
@@ -462,37 +563,37 @@ The escape organization info in the issuer part will be like :
 O=Cheese,O=Cheese 2
 ```

-##### info.issuer.commonname
+##### `info.issuer.commonname`

 Set the `info.issuer.commonname` option to true to add the `commonname` information into the issuer.
  
 The data are taken from the issuer part with the `CN` key.

-The escape commonname info in the issuer part will be like :
+The escape common name info in the issuer part will be like :

 ```text
 CN=Simple Signing CA 2
 ```

-##### info.issuer.serialnumber
+##### `info.issuer.serialnumber`

 Set the `info.issuer.serialnumber` option to true to add the `serialnumber` information into the issuer.
  
 The data are taken from the issuer part with the `SN` key.

-The escape serialnumber info in the issuer part will be like :
+The escape serial number info in the issuer part will be like :

 ```text
 SN=1234567890
 ```

-##### info.issuer.domaincomponent
+##### `info.issuer.domaincomponent`

 Set the `info.issuer.domaincomponent` option to true to add the `domaincomponent` information into the issuer.
  
 The data are taken from the issuer part with the `DC` key.

-The escape domaincomponent info in the issuer part will be like :
+The escape domain component info in the issuer part will be like :

 ```text
 DC=org,DC=cheese
--- a/docs/content/middlewares/ratelimit.md
+++ b/docs/content/middlewares/ratelimit.md
@@ -1,4 +1,4 @@
-# TODO -- RateLimit
+# RateLimit

 Protection from Too Many Calls
 {: .subtitle }
@@ -9,42 +9,87 @@ The RateLimit middleware ensures that services will receive a _fair_ number of r

 ## Configuration Example

-??? example "Limit to 100 requests every 10 seconds (with a possible burst of 200)"
+```yaml tab="Docker"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+labels:
+- "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc=client.ip"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period=10s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average=100"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst=200"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period=3s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average=5"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst=10"
+  		
+```

-    ```toml
-    [http.middlewares]
-        [http.middlewares.fair-ratelimit.ratelimit]
-            extractorfunc = "client.ip"
+```yaml tab="Kubernetes"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ratelimit
+spec:
+  rateLimit:
+    extractorfunc = "client.ip"
+    rate0:
+        period = "10s"
+        average = 100
+        burst = 200
+    rate1:
+        period = "3s"
+        average = 5
+        burst = 10
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc": "client.ip",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period": "10s",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average": "100",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst": "200",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period": "3s",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average": "5",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst": "10"
+}
+```
+
+```yaml tab="Rancher"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+labels:
+- "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc=client.ip"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period=10s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average=100"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst=200"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period=3s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average=5"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst=10"
+  		
+```
+
+```toml tab="File"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+[http.middlewares]
+  [http.middlewares.test-ratelimit.ratelimit]
+    extractorfunc = "client.ip"
    
-              [http.middlewares.fair-ratelimit.ratelimit.rateset1]
-                period = "10s"
-                average = 100
-                burst = 200
-    ```
-
-??? example "Combine multiple limits"
-
-    ```toml
-    [http.middlewares]
-        [http.middlewares.fair-ratelimit.ratelimit]
-            extractorfunc = "client.ip"
+    [http.middlewares.test-ratelimit.ratelimit.rateset.rate0]
+      period = "10s"
+      average = 100
+      burst = 200
    
-              [http.middlewares.fair-ratelimit.ratelimit.rateset1]
-                period = "10s"
-                average = 100
-                burst = 200
-
-              [http.middlewares.fair-ratelimit.ratelimit.rateset2]
-                period = "3s"
-                average = 5
-                burst = 10
-    ```
-    
-    Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds. These can "burst" up to 10 and 200 in each period, respectively. 
+    [http.middlewares.test-ratelimit.ratelimit.rateset.rate1]
+      period = "3s"
+      average = 5
+      burst = 10
+```

 ## Configuration Options

-### extractorfunc
+### `extractorfunc`
 
 The `extractorfunc` option defines the strategy used to categorize requests.

@@ -54,12 +99,12 @@ The possible values are:
 - `client.ip` categorizes requests based on the client ip.
 - `request.header.ANY_HEADER` categorizes requests based on the provided `ANY_HEADER` value.

-### ratelimit (multiple values)
+### `ratelimit`

-You can combine multiple ratelimit. 
-The ratelimit will trigger with the first reached limit.
+You can combine multiple rate limits. 
+The rate limit will trigger with the first reached limit.

-Each ratelimit has 3 options, `period`, `average`, and `burst`.
+Each rate limit has 3 options, `period`, `average`, and `burst`.

 The rate limit will allow an average of `average` requests every `period`, with a maximum of `burst` request on that period.

--- a/docs/content/middlewares/redirectregex.md
+++ b/docs/content/middlewares/redirectregex.md
@@ -1,4 +1,4 @@
-# TODO - RedirectRegex
+# RedirectRegex

 Redirecting the Client to a Different Location
 {: .subtitle }
@@ -9,34 +9,56 @@ RegexRedirect redirect a request from an url to another with regex matching and

 ## Configuration Examples

-??? example "File -- Redirect with domain replacement"
+```yaml tab="Docker"
+# Redirect with domain replacement
+labels:
+- "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
+- "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-redirectregex.redirectregex]
-        regex = "^http://localhost/(.*)"
-        replacement = "http://mydomain/$1"
-    ```
+```yaml tab="Kubernetes"
+# Redirect with domain replacement
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-redirectregex
+spec:
+  redirectRegex:
+    regex: ^http://localhost/(.*)
+    replacement: http://mydomain/$1
+```

-??? example "Docker -- Redirect with domain replacement"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-redirectregex.redirectregex.regex": "^http://localhost/(.*)",
+  "traefik.http.middlewares.test-redirectregex.redirectregex.replacement": "http://mydomain/$1"
+}
+```

-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
-                - "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
-    ```
+```yaml tab="Rancher"
+# Redirect with domain replacement
+labels:
+- "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
+- "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
+```
+
+```toml tab="File"
+# Redirect with domain replacement
+[http.middlewares]
+  [http.middlewares.test-redirectregex.redirectregex]
+    regex = "^http://localhost/(.*)"
+    replacement = "http://mydomain/$1"
+```

 ## Configuration Options

-### permanent
+### `permanent`

 Set the `permanent` option to `true` to apply a permanent redirection.

-### regex
+### `regex`

-The `Regex` option is the regular expression to match and capture elements form the request URL.
+The `Regex` option is the regular expression to match and capture elements from the request URL.

 !!! warning

@@ -46,7 +68,7 @@ The `Regex` option is the regular expression to match and capture elements form

    Regular expressions and replacements can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
    
-### replacement
+### `replacement`

 The `replacement` option defines how to modify the URl to have the new target URL.
 
--- a/docs/content/middlewares/redirectscheme.md
+++ b/docs/content/middlewares/redirectscheme.md
@@ -1,4 +1,4 @@
-# TODO - RedirectScheme
+# RedirectScheme

 Redirecting the Client to a Different Scheme/Port
 {: .subtitle }
@@ -9,33 +9,52 @@ RegexRedirect redirect request from a scheme to another.

 ## Configuration Examples

-??? example "File -- Redirect to https"
+```yaml tab="Docker"
+# Redirect to https
+labels:
+- "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-redirectscheme.redirectscheme]
-        scheme = "https"
-    ```
+```yaml tab="Kubernetes"
+# Redirect to https
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-redirectscheme
+spec:
+  redirectScheme:
+    scheme: https
+```

-??? example "Docker -- Redirect to https"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme": "https"
+}
+```

-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
-    ```
+```yaml tab="Rancher"
+# Redirect to https
+labels:
+- "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
+```
+
+```toml tab="File"
+# Redirect to https
+[http.middlewares]
+  [http.middlewares.test-redirectscheme.redirectscheme]
+    scheme = "https"
+```

 ## Configuration Options

-### permanent
+### `permanent`

 Set the `permanent` option to `true` to apply a permanent redirection.

-### scheme
+### `scheme`

 The `scheme` option defines the scheme of the new url.

-### port
+### `port`

 The `port` option defines the port of the new url.
--- a/docs/content/middlewares/replacepath.md
+++ b/docs/content/middlewares/replacepath.md
@@ -1,4 +1,4 @@
-# TODO -- ReplacePath
+# ReplacePath

 Updating the Path Before Forwarding the Request
 {: .subtitle }
@@ -9,32 +9,51 @@ Replace the path of the request url.

 ## Configuration Examples

-??? example "File -- Replace the path by /foo"
+```yaml tab="Docker"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
+```

-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-replacepath.ReplacePath]
-         path = "/foo"
-    ```
+```yaml tab="Kubernetes"
+# Replace the path by /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-replacepath
+spec:
+  replacePath:
+    path: /foo
+```

-??? example "Docker --Replace the path by /foo"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-replacepath.replacepath.path": "/foo"
+}
+```
+
+```yaml tab="Rancher"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
+```
+
+```toml tab="File"
+# Replace the path by /foo
+[http.middlewares]
+  [http.middlewares.test-replacepath.ReplacePath]
+     path = "/foo"
+```

-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
-    ```
-    
 ## Configuration Options

 ### General

 The ReplacePath middleware will:

-* replace the actual path by the specified one.
-* store the original path in a `X-Replaced-Path` header.
+- replace the actual path by the specified one.
+- store the original path in a `X-Replaced-Path` header.

-### path
+### `path`

 The `path` option defines the path to use as replacement in the request url.
--- a/docs/content/middlewares/replacepathregex.md
+++ b/docs/content/middlewares/replacepathregex.md
@@ -1,4 +1,76 @@
-# TODO -- ReplacePathRegex
+# ReplacePathRegex

 Updating the Path Before Forwarding the Request (Using a Regex)
-{: .subtitle }
+{: .subtitle }
+
+`TODO: add schema`
+
+The ReplaceRegex replace a path from an url to another with regex matching and replacement.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Replace path with regex
+labels:
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex=^/foo/(.*)"
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement=/bar/$1"
+```
+
+```yaml tab="Kubernetes"
+# Replace path with regex
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-replacepathregex
+spec:
+  replacePathRegex:
+    regex: ^/foo/(.*)
+    replacement: /bar/$1
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex": "^/foo/(.*)",
+  "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement": "/bar/$1"
+}
+```
+
+```yaml tab="Rancher"
+# Replace path with regex
+labels:
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex=^/foo/(.*)"
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement=/bar/$1"
+```
+
+```toml tab="File"
+# Redirect with domain replacement
+[http.middlewares]
+  [http.middlewares.test-replacepathregex.replacePathRegex]
+    regex = "^/foo/(.*)"
+    replacement = "/bar/$1"
+```
+
+## Configuration Options
+
+### General
+
+The ReplacePathRegex middleware will:
+
+- replace the matching path by the specified one.
+- store the original path in a `X-Replaced-Path` header.
+
+### `regex`
+
+The `Regex` option is the regular expression to match and capture the path from the request URL.
+
+!!! warning
+
+    Care should be taken when defining replacement expand variables: `$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax.
+
+!!! tip
+
+    Regular expressions and replacements can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
+    
+### `replacement`
+
+The `replacement` option defines how to modify the path to have the new target path.
--- a/docs/content/middlewares/retry.md
+++ b/docs/content/middlewares/retry.md
@@ -1,20 +1,54 @@
-# TODO -- Retry
+# Retry

 Retrying until it Succeeds
 {: .subtitle }

-## Old Content
+`TODO: add schema`

-## Retry Configuration
+Retry to send request on attempt failure.

-```toml
-# Enable retry sending request if network error
-[retry]
+## Configuration Examples

-# Number of attempts
-#
-# Optional
-# Default: (number servers in backend) -1
-#
-# attempts = 3
+```yaml tab="Docker"
+# Retry to send request 4 times
+labels:
+- "traefik.http.middlewares.test-retry.retry.attempts=4"
 ```
+
+```yaml tab="Kubernetes"
+# Retry to send request 4 times
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-retry
+spec:
+  retry:
+    attempts: 4
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-retry.retry.attempts": "4"
+}
+```
+
+```yaml tab="Rancher"
+# Retry to send request 4 times
+labels:
+- "traefik.http.middlewares.test-retry.retry.attempts=4"
+```
+
+```toml tab="File"
+# Retry to send request 4 times
+[http.middlewares]
+  [http.middlewares.test-retry.Retry]
+     attempts = 4
+```
+
+## Configuration Options
+
+### `attempts` 
+
+_mandatory_
+
+The `attempts` option defines how many times to try sending the request.
--- a/docs/content/middlewares/stripprefix.md
+++ b/docs/content/middlewares/stripprefix.md
@@ -1,13 +1,74 @@
-# TODO -- StripPrefix
+# StripPrefix

 Removing Prefixes From the Path Before Forwarding the Request
 {: .subtitle }

-## OldContent
- 
-Use a `*Strip` matcher if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
-For instance, `PathPrefixStrip: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.  
-Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.  
+`TODO: add schema`
+
+Remove the specified prefixes from the URL path.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Strip prefix /foobar and /fiibar
+labels:
+- "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes=/foobar, /fiibar"
+```
+
+```yaml tab="Kubernetes"
+# Strip prefix /foobar and /fiibar
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-stripprefix
+spec:
+  StripPrefix:
+    prefixes:
+    - /foobar
+    - /fiibar
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes": "/foobar, /fiibar"
+}
+```
+
+```yaml tab="Rancher"
+# Strip prefix /foobar and /fiibar
+labels:
+- "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes=/foobar, /fiibar"
+```
+
+```toml tab="File"
+# Strip prefix /foobar and /fiibar
+[http.middlewares]
+  [http.middlewares.test-stripprefix.StripPrefix]
+     prefixes = ["/foobar", "/fiibar"]
+```
+
+## Configuration Options
+
+### General
+
+The StripPrefix middleware will:
+
+- strip the matching path prefix.
+- store the matching path prefix in a `X-Forwarded-Prefix` header.
+
+!!! tip
+    
+    Use a `StripPrefix` middleware if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
+
+### `prefixes`
+
+The `prefixes` option defines the prefixes to strip from the request URL.
+
+For instance, `/products` would match `/products` but also `/products/shoes` and `/products/shirts`.
+
+Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.
+
 If your backend is serving assets (e.g., images or Javascript files), chances are it must return properly constructed relative URLs.  
 Continuing on the example, the backend should return `/products/shoes/image.png` (and not `/images.png` which Traefik would likely not be able to associate with the same backend).  
-The `X-Forwarded-Prefix` header (available since Traefik 1.3) can be queried to build such URLs dynamically.
+
+The `X-Forwarded-Prefix` header can be queried to build such URLs dynamically.
--- a/docs/content/middlewares/stripprefixregex.md
+++ b/docs/content/middlewares/stripprefixregex.md
@@ -1,13 +1,77 @@
-# TODO -- StripPrefix
+# StripPrefix

 Removing Prefixes From the Path Before Forwarding the Request (Using a Regex)
 {: .subtitle }

-## OldContent
+`TODO: add schema`
+
+Remove the matching prefixes from the URL path.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex=^/foo/(.*)",
+```
+
+```yaml tab="Kubernetes"
+# Replace the path by /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-stripprefixregex
+spec:
+  StripPrefixRegex:
+    regex: "^/foo/(.*)"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex": "^/foo/(.*)"
+}
+```
+
+```yaml tab="Rancher"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex=^/foo/(.*)",
+```
+
+```toml tab="File"
+# Replace the path by /foo
+[http.middlewares]
+  [http.middlewares.test-stripprefixregex.StripPrefixRegex]
+     regex: "^/foo/(.*)"
+```
+
+## Configuration Options
+
+### General
+
+The StripPrefixRegex middleware will:
+
+- strip the matching path prefix.
+- store the matching path prefix in a `X-Forwarded-Prefix` header.
+
+!!! tip
+    
+    Use a `StripPrefixRegex` middleware if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
+
+### `regex`
+
+The `regex` option is the regular expression to match the path prefix from the request URL.
+
+!!! tip
+
+    Regular expressions can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
+
+For instance, `/products` would match `/products` but also `/products/shoes` and `/products/shirts`.  

-Use a `*Strip` matcher if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
-For instance, `PathPrefixStrip: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.  
 Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.  
+
 If your backend is serving assets (e.g., images or Javascript files), chances are it must return properly constructed relative URLs.  
+
 Continuing on the example, the backend should return `/products/shoes/image.png` (and not `/images.png` which Traefik would likely not be able to associate with the same backend).  
-The `X-Forwarded-Prefix` header (available since Traefik 1.3) can be queried to build such URLs dynamically.
+
+The `X-Forwarded-Prefix` header can be queried to build such URLs dynamically.
--- a/docs/content/observability/access-logs.md
+++ b/docs/content/observability/access-logs.md
@@ -110,38 +110,38 @@ Each field can be set to:
    
 ??? list "Available Fields"

-    ```ini
-    StartUTC
-    StartLocal
-    Duration
-    FrontendName
-    BackendName
-    BackendURL
-    BackendAddr
-    ClientAddr
-    ClientHost
-    ClientPort
-    ClientUsername
-    RequestAddr
-    RequestHost
-    RequestPort
-    RequestMethod
-    RequestPath
-    RequestProtocol
-    RequestLine
-    RequestContentSize
-    OriginDuration
-    OriginContentSize
-    OriginStatus
-    OriginStatusLine
-    DownstreamStatus
-    DownstreamStatusLine
-    DownstreamContentSize
-    RequestCount
-    GzipRatio
-    Overhead
-    RetryAttempts
-    ```
+    | Field                   | Description                                                                                                                                                         |
+    |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+    | `StartUTC`              | The time at which request processing started.                                                                                                                       |
+    | `StartLocal`            | The local time at which request processing started.                                                                                                                 |
+    | `Duration`              | The total time taken by processing the response, including the origin server's time but not the log writing time.                                                   |
+    | `FrontendName`          | The name of the Traefik frontend.                                                                                                                                   |
+    | `BackendName`           | The name of the Traefik backend.                                                                                                                                    |
+    | `BackendURL`            | The URL of the Traefik backend.                                                                                                                                     |
+    | `BackendAddr`           | The IP:port of the Traefik backend (extracted from `BackendURL`)                                                                                                    |
+    | `ClientAddr`            | The remote address in its original form (usually IP:port).                                                                                                          |
+    | `ClientHost`            | The remote IP address from which the client request was received.                                                                                                   |
+    | `ClientPort`            | The remote TCP port from which the client request was received.                                                                                                     |
+    | `ClientUsername`        | The username provided in the URL, if present.                                                                                                                       |
+    | `RequestAddr`           | The HTTP Host header (usually IP:port). This is treated as not a header by the Go API.                                                                              |
+    | `RequestHost`           | The HTTP Host server name (not including port).                                                                                                                     |
+    | `RequestPort`           | The TCP port from the HTTP Host.                                                                                                                                    |
+    | `RequestMethod`         | The HTTP method.                                                                                                                                                    |
+    | `RequestPath`           | The HTTP request URI, not including the scheme, host or port.                                                                                                       |
+    | `RequestProtocol`       | The version of HTTP requested.                                                                                                                                      |
+    | `RequestLine`           | `RequestMethod` + `RequestPath` + `RequestProtocol`                                                                                                                 |
+    | `RequestContentSize`    | The number of bytes in the request entity (a.k.a. body) sent by the client.                                                                                         |
+    | `OriginDuration`        | The time taken by the origin server ('upstream') to return its response.                                                                                            |
+    | `OriginContentSize`     | The content length specified by the origin server, or 0 if unspecified.                                                                                             |
+    | `OriginStatus`          | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent.     |
+    | `OriginStatusLine`      | `OriginStatus` + Status code explanation                                                                                                                            |
+    | `DownstreamStatus`      | The HTTP status code returned to the client.                                                                                                                        |
+    | `DownstreamStatusLine`  | `DownstreamStatus` + Status code explanation                                                                                                                        |
+    | `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
+    | `RequestCount`          | The number of requests received since the Traefik instance started.                                                                                                 |
+    | `GzipRatio`             | The response body compression ratio achieved.                                                                                                                       |
+    | `Overhead`              | The processing time overhead caused by Traefik.                                                                                                                     |
+    | `RetryAttempts`         | The amount of attempts the request was retried.                                                                                                                     |

 ## Log Rotation

--- a/docs/content/observability/logs.md
+++ b/docs/content/observability/logs.md
@@ -37,9 +37,9 @@ You can configure a file path instead using the `filePath` option.

 By default, the logs use a text format (`common`), but you can also ask for the `json` format in the `format` option.   

-#### logLevel
+#### log level

-By default, the `logLevel` is set to `error`, but you can choose amongst `debug`, `panic`, `fatal`, `error`, `warn`, and `info`. 
+By default, the `level` is set to `error`, but you can choose amongst `debug`, `panic`, `fatal`, `error`, `warn`, and `info`. 

 ## Log Rotation

--- a/docs/content/observability/tracing.md
+++ b/docs/content/observability/tracing.md
@@ -7,7 +7,7 @@ The tracing system allows developers to visualize call flows in their infrastruc

 Traefik uses OpenTracing, an open standard designed for distributed tracing.

-Traefik supports three tracing backends: Jaeger, Zipkin, DataDog, and Instana.
+Traefik supports four tracing backends: Jaeger, Zipkin, DataDog, and Instana.

 ## Configuration Reference

--- a/docs/content/operations/cli.md
+++ b/docs/content/operations/cli.md
@@ -6,48 +6,56 @@ The Traefik Command Line
 ## General

 ```bash
-traefik [command] [--flag=flag_argument]
+traefik [command] [flags] [arguments]
 ```

-Available commands: 
+Use `traefik [command] --help` for help on any command.

- `version` : Print version
- `storeconfig` : Store the static Traefik configuration into a Key-value stores. Please refer to the `Store Traefik configuration`(TODO: add doc and link) section to get documentation on it.
- `healthcheck`: Calls Traefik `/ping` to check health.
+Commands:

-Each command can have additional flags.
+- `healthcheck` Calls Traefik `/ping` to check the health of Traefik (the API must be enabled).
+- `version` Shows the current Traefik version.

-All those flags will be displayed with:
+Flag's usage:

 ```bash
-traefik [command] --help
+# set flag_argument to flag(s)
+traefik [--flag=flag_argument] [-f [flag_argument]]
+
+# set true/false to boolean flag(s)
+traefik [--flag[=true|false| ]] [-f [true|false| ]]
 ```

-Each command is described at the beginning of the help section:
+### healthcheck

-```bash
-traefik --help
+Calls Traefik `/ping` to check the health of Traefik.
+Its exit status is `0` if Traefik is healthy and `1` otherwise.

-# or
-
-docker run traefik[:version] --help
-# ex: docker run traefik:1.5 --help
-```
-
-### Command: healthcheck
-
-Checks the health of Traefik.
-Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy.
-
-This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism.
+This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction
+or any other health check orchestration mechanism.

 !!! note
    The [`ping` endpoint](../ping/) must be enabled to allow the `healthcheck` command to call `/ping`.

-```bash
-traefik healthcheck
-```
+Usage:

 ```bash
+traefik healthcheck [command] [flags] [arguments]
+```
+
+Example:
+
+```bash
+$ traefik healthcheck
 OK: http://:8082/ping
 ```
+
+### version
+
+Shows the current Traefik version.
+
+Usage:
+
+```bash
+traefik version [command] [flags] [arguments]
+```
--- a/docs/content/operations/dashboard.md
+++ b/docs/content/operations/dashboard.md
@@ -5,9 +5,9 @@ See What's Going On

 The dashboard is the central place that shows you the current active routes handled by Traefik. 

-??? note "Dashboard WIP"
-   Currently, the dashboard is in a Work In Progress State while being reconstructed for v2. 
-   Therefore, the dashboard is currently not working.
+!!! warning "Dashboard WIP"
+    Currently, the dashboard is in a Work In Progress State while being reconstructed for v2. 
+    Therefore, the dashboard is currently not working.

 <figure>
   <img src="../../assets/img/dashboard-main.png" alt="Dashboard - Providers" />
--- a/docs/content/operations/ping.md
+++ b/docs/content/operations/ping.md
@@ -5,48 +5,28 @@ Checking the Health of Your Traefik Instances

 ## Configuration Examples

-??? example "Enabling /ping on the http EntryPoint"
+??? example "Enabling /ping"

    ```toml
-    [entrypoints]
-       [entrypoints.web]
-          address = ":80"
-    
    [ping]
-      entryPoint = "http"
-    ```
-
-??? example "Enabling /ping on the https EntryPoint"
-
-    ```toml
-    [entrypoints]
-       [entrypoints.web]
-          address = ":80"
-
-      [entrypoints.web-secure]
-         address = ":443"
-         [entrypoints.web-secure.tls]   
-    
-    [ping]
-      entryPoint = "https"
    ```

 ??? example "Enabling /ping on a dedicated EntryPoint"
    
-    ```toml    
-    [entrypoints]
-      [entrypoints.web]
+    ```toml
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
      
-      [entrypoints.ping]
+      [entryPoints.ping]
        address = ":8082"
    
    [ping]
        entryPoint = "ping"
    ```

-| Path    | Method        | Description                                                                                        |
-|---------|---------------|----------------------------------------------------------------------------------------------------|
+| Path    | Method        | Description                                                                                         |
+|---------|---------------|-----------------------------------------------------------------------------------------------------|
 | `/ping` | `GET`, `HEAD` | A simple endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |

 ## Configuration Options
--- a/docs/content/providers/crd_ingress_route.yml
+++ b/docs/content/providers/crd_ingress_route.yml
@@ -11,3 +11,18 @@ spec:
    plural: ingressroutes
    singular: ingressroute
  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
--- a/docs/content/providers/docker.md
+++ b/docs/content/providers/docker.md
@@ -17,7 +17,7 @@ Attach labels to your containers and let Traefik do the rest!
    Enabling the docker provider

    ```toml
-    [docker]
+    [providers.docker]
    endpoint = "unix:///var/run/docker.sock"
    ```

@@ -29,7 +29,7 @@ Attach labels to your containers and let Traefik do the rest!
      my-container:
        # ...
        labels:
-          - traefik.http.services.my-container.rule=Host(my-domain)
+          - traefik.http.routers.my-container.rule=Host(`my-domain`)
    ```

 ??? example "Configuring Docker Swarm & Deploying / Exposing Services"
@@ -45,7 +45,7 @@ Attach labels to your containers and let Traefik do the rest!
    swarmMode = true
    ```

-    Attaching labels to containers (in your docker compose file)
+    Attach labels to services (not to containers) while in Swarm mode (in your docker compose file)

    ```yaml
    version: "3"
@@ -53,19 +53,19 @@ Attach labels to your containers and let Traefik do the rest!
      my-container:
        deploy:
          labels:
-            - traefik.http.services.my-container.rule=Host(my-domain)
+            - traefik.http.routers.my-container.rule=Host(`my-domain`)
    ```

    !!! important "Labels in Docker Swarm Mode"
-        If you use a compose file with the Swarm mode, labels should be defined in the `deploy` part of your service.
+        While in Swarm Mode, Traefik uses labels found on services, not on individual containers. Therefore, if you use a compose file with Swarm Mode, labels should be defined in the `deploy` part of your service.
        This behavior is only enabled for docker-compose version 3+ ([Compose file reference](https://docs.docker.com/compose/compose-file/#labels-1)).

 ## Provider Configuration Options

 !!! tip "Browse the Reference"
-    If you're in a hurry, maybe you'd rather go through the [Docker Reference](../reference/providers/docker.md).
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/docker.md) configuration references.

-### endpoint
+### `endpoint`

 Traefik requires access to the docker socket to get its dynamic configuration.

@@ -86,7 +86,7 @@ Traefik requires access to the docker socket to get its dynamic configuration.
        - [KubeCon EU 2018 Keynote, Running with Scissors, from Liz Rice](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
        - [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html)
        - [A thread on Stack Overflow about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
-        - [To Dind or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
+        - [To DinD or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)

 ??? tip "Security Compensation"

@@ -124,7 +124,7 @@ Traefik requires access to the docker socket to get its dynamic configuration.
    services:

      traefik:
-         image: traefik
+         image: traefik:v2.0 # The official v2.0 Traefik docker image
         ports:
           - "80:80"
         volumes:
@@ -140,17 +140,21 @@ Traefik requires access to the docker socket to get its dynamic configuration.
          endpoint = "unix:///var/run/docker.sock"
    ```

-### usebindportip (_Optional_, _Default=false_)
+### `usebindportip`
+
+_Optional, Default=false_

 Traefik routes requests to the IP/Port of the matching container.
 When setting `usebindportip=true`, you tell Traefik to use the IP/Port attached to the container's _binding_ instead of its inner network IP/Port.

-When used in conjunction with the `traefik.port` label (that tells Traefik to route requests to a specific port), Traefik tries to find a binding on port `traefik.port`.
-If it can't find such a binding, Traefik falls back on the internal network IP of the container, but still uses the `traefik.port` that is set in the label.
+When used in conjunction with the `traefik.http.services.XXX.loadbalancer.server.port` label (that tells Traefik to route requests to a specific port),
+Traefik tries to find a binding on port `traefik.http.services.XXX.loadbalancer.server.port`.
+If it can't find such a binding, Traefik falls back on the internal network IP of the container,
+but still uses the `traefik.http.services.XXX.loadbalancer.server.port` that is set in the label.

 ??? example "Examples of `usebindportip` in different situations."

-    | traefik.port label | Container's binding                                | Routes to      |
+    | port label         | Container's binding                                | Routes to      |
    |--------------------|----------------------------------------------------|----------------|
    |          -         |           -                                        | IntIP:IntPort  |
    |          -         | ExtPort:IntPort                                    | IntIP:IntPort  |
@@ -163,29 +167,51 @@ If it can't find such a binding, Traefik falls back on the internal network IP o
    !!! note
        In the above table, ExtIp stands for "external IP found in the binding", IntIp stands for "internal network container's IP", ExtPort stands for "external Port found in the binding", and IntPort stands for "internal network container's port."

-### exposedByDefault (_Optional_, _Default=true_)
+### `exposedByDefault`
+
+_Optional, Default=true_

 Expose containers by default through Traefik.
 If set to false, containers that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.

-### network (_Optional_)
+### `network`
+
+_Optional_

 Defines a default docker network to use for connections to all containers.

 This option can be overridden on a container basis with the `traefik.docker.network` label.

-### domain (_Optional_, _Default=docker.localhost_)
+### `defaultRule`

-This is the default base domain used for the router rules.
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_

-This option can be overridden on a container basis with the
-`traefik.domain` label.
+For a given container if no routing rule was defined by a label, it is defined by this defaultRule instead.
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+The container service name can be accessed as the `Name` identifier,
+and the template has access to all the labels defined on this container.

-### swarmMode (_Optional_, _Default=false_)
+```toml tab="File"
+[docker]
+defaultRule = ""
+# ...
+```
+
+```txt tab="CLI"
+--providers.docker
+--providers.docker.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+```
+
+### `swarmMode`
+
+_Optional, Default=false_

 Activates the Swarm Mode.

-### swarmModeRefreshSeconds (_Optional_, _Default=15_)
+### `swarmModeRefreshSeconds`
+
+_Optional, Default=15_

 Defines the polling interval (in seconds) in Swarm Mode.

@@ -195,23 +221,24 @@ Defines the polling interval (in seconds) in Swarm Mode.

 Traefik creates, for each container, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).

-The Service automatically gets a server per instance of the container, and the router gets a default rule attached to it, based on the container name.
+The Service automatically gets a server per instance of the container,
+and the router automatically gets a rule defined by defaultRule (if no rule for it was defined in labels).

 ### Routers

-To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change. For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.
+To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.http.routers.{name-of-your-choice}.` and followed by the option you want to change. For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.

 Every [Router](../routing/routers/index.md) parameter can be updated this way.

 ### Services

-To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change. For example, to change the load balancer method, you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.method=drr`.
+To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change. For example, to change the passhostheader behavior, you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.

 Every [Service](../routing/services/index.md) parameter can be updated this way.

 ### Middleware

-You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`schemeredirect`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.schemeredirect.scheme: https`.
+You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.

 ??? example "Declaring and Referencing a Middleware"

@@ -220,27 +247,50 @@ You can declare pieces of middleware using labels starting with `traefik.http.mi
         my-container:
           # ...
           labels:
-             - traefik.http.middlewares.my-redirect.schemeredirect.scheme=https
-             - traefik.http.routers.middlewares=my-redirect
+             - traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
+             - traefik.http.routers.my-container.middlewares=my-redirect
    ```

 !!! warning "Conflicts in Declaration"

    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.

+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TCP
+
+You can declare TCP Routers and/or Services using labels.
+
+??? example "Declaring TCP Routers and Services"
+
+    ```yaml
+       services:
+         my-container:
+           # ...
+           labels:
+             - traefik.tcp.routers.my-router.rule="HostSNI(`my-host.com`)"
+             - traefik.tcp.routers.my-router.rule.tls="true"
+             - traefik.tcp.services.my-service.loadbalancer.server.port="4123"
+    ```
+
+!!! warning "TCP and HTTP"
+
+    If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined).
+    You can declare both a TCP Router/Service and an HTTP Router/Service for the same container (but you have to do so manually).
+
 ### Specific Options

-#### traefik.enable
+#### `traefik.enable`

 You can tell Traefik to consider (or not) the container by setting `traefik.enable` to true or false.

 This option overrides the value of `exposedByDefault`.

-#### traefik.tags
+#### `traefik.tags`

 Sets the tags for [constraints filtering](./overview.md#constraints-configuration).

-#### traefik.docker.network
+#### `traefik.docker.network`

 Overrides the default docker network to use for connections to the container.

@@ -248,3 +298,10 @@ If a container is linked to several networks, be sure to set the proper network

 !!! warning
    When deploying a stack from a compose file `stack`, the networks defined are prefixed with `stack`.
+
+#### `traefik.docker.lbswarm`
+
+Enables Swarm's inbuilt load balancer (only relevant in Swarm Mode).
+
+If you enable this option, Traefik will use the virtual IP provided by docker swarm instead of the containers IPs.
+Which means that Traefik will not perform any kind of load balancing and will delegate this task to swarm.
--- a/docs/content/providers/file.md
+++ b/docs/content/providers/file.md
@@ -7,8 +7,8 @@ The file provider lets you define the [dynamic configuration](./overview.md) in
 You can write these configuration elements:

 * At the end of the main Traefik configuration file (by default: `traefik.toml`).
-* In [a dedicated file](#filename-optional)
-* In [several dedicated files](#directory-optional)
+* In [a dedicated file](#filename)
+* In [several dedicated files](#directory)

 !!! note
    The file provider is the default format used throughout the documentation to show samples of the configuration for many features. 
@@ -22,13 +22,13 @@ You can write these configuration elements:

    ``` toml
    # Enabling the file provider
-    [providers.files]
+    [providers.file]
    
    [http]
      # Add the router
      [http.routers]
        [http.routers.router0]
-          entrypoints = ["web"]
+          entryPoints = ["web"]
          middlewares = ["my-basic-auth"]
          service = "service-foo"
          rule = "Path(`foo`)"
@@ -44,21 +44,20 @@ You can write these configuration elements:
        [http.services]
          [http.services.service-foo]
            [http.services.service-foo.LoadBalancer]
-              method = "wrr"
              [[http.services.service-foo.LoadBalancer.Servers]]
                url = "http://foo/"
-                weight = 30
              [[http.services.service-foo.LoadBalancer.Servers]]
                url = "http://bar/"
-                weight = 70
    ```

 ## Provider Configuration Options

 !!! tip "Browse the Reference"
-    If you're in a hurry, maybe you'd rather go through the [File Reference](../reference/providers/file.md).
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/file.md) configuration references.
+    
+### `filename`

-### filename (_Optional_)
+_Optional_

 Defines the path of the configuration file.

@@ -68,7 +67,9 @@ Defines the path of the configuration file.
    filename = "rules.toml"
 ```

-### directory (_Optional_)
+### `directory`
+
+_Optional_

 Defines the directory that contains the configuration files.

@@ -78,7 +79,9 @@ Defines the directory that contains the configuration files.
    directory = "/path/to/config"
 ```

-### watch (_Optional_)
+### `watch`
+
+_Optional_

 Set the `watch` option to `true` to allow Traefik to automatically watch for file changes.  
 It works with both the `filename` and the `directory` options.
@@ -145,5 +148,4 @@ Thus, it's possible to define easily lot of routers, services and TLS certificat
      [TLSConfig.TLS{{ $e }}]
      # ...
    {{ end }}
-    
    ```
--- a/docs/content/providers/kubernetes-crd.md
+++ b/docs/content/providers/kubernetes-crd.md
@@ -3,7 +3,9 @@
 The Kubernetes Ingress Controller, The Custom Resource Way.
 {: .subtitle }

-[comment]: # (Link "Kubernetes Ingress controller" to ./kubernetes-ingress.md)
+<!--
+ TODO (Link "Kubernetes Ingress controller" to ./kubernetes-ingress.md)
+ -->

 The Traefik Kubernetes provider used to be a Kubernetes Ingress controller in the strict sense of the term; that is to say,
 it would manage access to a cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
@@ -11,22 +13,148 @@ it would manage access to a cluster services by supporting the [Ingress](https:/
 However, as the community expressed the need to benefit from Traefik features without resorting to (lots of) annotations,
 we ended up writing a [Custom Resource Definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) (alias CRD in the following) for an IngressRoute type, defined below, in order to provide a better way to configure access to a Kubernetes cluster.

-## Traefik IngressRoute definition
+## Provider Configuration
+
+### `endpoint`
+
+_Optional, Default=empty_
+
+The Kubernetes server endpoint as URL.
+
+When deployed into Kubernetes, Traefik will read the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` or `KUBECONFIG` to construct the endpoint.
+
+The access token will be looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+Both are provided mounted automatically when deployed inside Kubernetes.
+
+The endpoint may be specified to override the environment variable values inside a cluster.
+
+When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client.
+In this case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  endpoint = "http://localhost:8080"
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.endpoint="http://localhost:8080"
+```
+
+### `token`
+
+_Optional, Default=empty_
+
+Bearer token used for the Kubernetes client configuration.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  token = "mytoken"
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.token="mytoken"
+```
+
+### `certAuthFilePath`
+
+_Optional, Default=empty_
+
+Path to the certificate authority file.
+Used for the Kubernetes client configuration.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  certAuthFilePath = "/my/ca.crt"
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.certauthfilepath="/my/ca.crt"
+```
+
+### `namespaces`
+
+_Optional, Default: all namespaces (empty array)_
+
+Array of namespaces to watch.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  namespaces = ["default", "production"]
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.namespaces="default,production"
+```
+
+### `labelselector`
+
+_Optional,Default: empty (process all Ingresses)_
+
+By default, Traefik processes all Ingress objects in the configured namespaces.
+A label selector can be defined to filter on specific Ingress objects only.
+
+See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  labelselector = "A and not B"
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.labelselector="A and not B"
+```
+
+### `ingressClass`
+
+_Optional, Default: empty_
+
+Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
+
+If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.
+Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
+
+```toml tab="File"
+[Providers.KubernetesCRD]
+  ingressClass = "traefik-internal"
+  # ...
+```
+
+```txt tab="CLI"
+--providers.kubernetescrd
+--providers.kubernetescrd.ingressclass="traefik-internal"
+```
+
+## Resource Configuration
+
+If you're in a hurry, maybe you'd rather go through the [dynamic](../reference/dynamic-configuration/kubernetes-crd.md) configuration reference.
+
+### Traefik IngressRoute definition

 ```yaml
 --8<-- "content/providers/crd_ingress_route.yml"
 ```

-That `IngressRoute` kind can then be used to define an `IngressRoute` object, such as:
+That `IngressRoute` kind can then be used to define an `IngressRoute` object, such as in:

 ```yaml
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutefoo.crd
+  name: ingressroutefoo

 spec:
-  entrypoints:
+  entryPoints:
    - web
  routes:
  # Match is the rule corresponding to an underlying router.
@@ -42,9 +170,25 @@ spec:
    services:
    - name: whoami
      port: 80
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: ingressroutetcpfoo.crd
+
+spec:
+  entryPoints:
+    - footcp
+  routes:
+  # Match is the rule corresponding to an underlying router.
+  - match: HostSNI(`*`)
+    services:
+    - name: whoamitcp
+      port: 8080
 ```

-## Middleware
+### Middleware

 Additionally, to allow for the use of middlewares in an `IngressRoute`, we defined the CRD below for the `Middleware` kind.

@@ -61,7 +205,7 @@ metadata:
  name: stripprefix

 spec:
-  stripprefix:
+  stripPrefix:
    prefixes:
      - /stripit

@@ -69,10 +213,10 @@ spec:
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutebar.crd
+  name: ingressroutebar

 spec:
-  entrypoints:
+  entryPoints:
    - web
  routes:
  - match: Host(`bar.com`) && PathPrefix(`/stripit`)
@@ -84,7 +228,9 @@ spec:
    - name: stripprefix
 ```

-## TLS
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TLS

 To allow for TLS, we made use of the `Secret` kind, as it was already defined, and it can be directly used in an `IngressRoute`:

@@ -102,7 +248,7 @@ data:
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutetls.crd
+  name: ingressroutetls

 spec:
  entryPoints:
@@ -117,6 +263,6 @@ spec:
    secretName: supersecret
 ```

-## Full reference example
+## Further

-[Traefik IngressRoute Reference](../reference/providers/kubernetescrd.md).
+Also see the [full example](../user-guides/crd-acme/index.md) with Let's Encrypt.
--- a/docs/content/providers/marathon.md
+++ b/docs/content/providers/marathon.md
@@ -0,0 +1,327 @@
+# Traefik & Marathon
+
+Traefik can be configured to use Marathon as a provider.
+{: .subtitle }
+
+See also [Marathon user guide](../user-guides/marathon.md).
+
+## Configuration Examples
+
+??? example "Configuring Marathon & Deploying / Exposing Applications"
+
+    Enabling the marathon provider
+
+    ```toml tab="File"
+    [providers.marathon]
+    endpoint = "http://127.0.0.1:8080"
+    ```
+    
+    ```txt tab="CLI"
+    --providers.marathon
+    --providers.marathon.endpoint="http://127.0.0.1:8080"
+    ```
+
+    Attaching labels to marathon applications
+
+    ```json
+	{
+		"id": "/whoami",
+		"container": {
+			"type": "DOCKER",
+			"docker": {
+				"image": "containous/whoami",
+				"network": "BRIDGE",
+				"portMappings": [
+					{
+						"containerPort": 80,
+						"hostPort": 0,
+						"protocol": "tcp"
+					}
+				]
+			}
+		},
+		"labels": {
+			"traefik.http.Routers.app.Rule": "PathPrefix(`/app`)"
+		}
+	}
+    ```
+
+## Provider Configuration Options
+
+!!! tip "Browse the Reference"
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/marathon.md) configuration references.
+
+### `basic`
+
+_Optional_
+
+Enables Marathon basic authentication.
+
+```toml tab="File"
+[marathon.basic]
+httpBasicAuthUser = "foo"
+httpBasicPassword = "bar"
+```
+
+```txt tab="CLI"
+--providers.marathon
+--providers.marathon.basic.httpbasicauthuser="foo"
+--providers.marathon.basic.httpbasicpassword="bar"
+```
+
+### `dcosToken`
+
+_Optional_
+
+DCOSToken for DCOS environment.
+
+If set, it overrides the Authorization header.
+
+```toml tab="File"
+[marathon]
+dcosToken = "xxxxxx"
+# ...
+```
+
+```txt tab="CLI"
+--providers.marathon
+--providers.marathon.dcosToken="xxxxxx"
+```
+
+### `defaultRule`
+
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
+
+For a given application if no routing rule was defined by a label, it is defined by this defaultRule instead.
+
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+
+The app ID can be accessed as the Name identifier,
+and the template has access to all the labels defined on this Marathon application.
+
+```toml tab="File"
+[marathon]
+defaultRule = ""
+# ...
+```
+
+```txt tab="CLI"
+--providers.marathon
+--providers.marathon.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+```
+
+### `dialerTimeout`
+
+_Optional, Default=5s_
+
+Overrides DialerTimeout.
+
+Amount of time the Marathon provider should wait before timing out,
+when trying to open a TCP connection to a Marathon master.
+
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `endpoint`
+
+_Optional, Default=http://127.0.0.1:8080_
+
+Marathon server endpoint.
+
+You can optionally specify multiple endpoints:
+
+```toml tab="File"
+[marathon]
+endpoint = "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+# ...
+```
+
+```txt tab="CLI"
+--providers.marathon
+--providers.marathon.endpoint="http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+```
+
+### `exposedByDefault`
+
+_Optional, Default=true_
+
+Exposes Marathon applications by default through Traefik.
+
+If set to false, applications that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.
+
+### `filterMarathonConstraints`
+
+_Optional, Default=false_
+
+Enables filtering using Marathon constraints.
+
+If enabled, Traefik will take into account Marathon constraints, as defined in [Marathon constraints](https://mesosphere.github.io/marathon/docs/constraints.html).
+
+Each individual constraint will be treated as a verbatim compounded tag,
+e.g. "rack_id:CLUSTER:rack-1", with all constraint groups concatenated together using ":".
+
+### `forceTaskHostname`
+
+_Optional, Default=false_
+
+By default, a task's IP address (as returned by the Marathon API) is used as backend server if an IP-per-task configuration can be found;
+otherwise, the name of the host running the task is used.
+The latter behavior can be enforced by enabling this switch.
+
+### `keepAlive`
+
+_Optional, Default=10s_
+
+Set the TCP Keep Alive interval for the Marathon HTTP Client.
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `respectReadinessChecks`
+
+_Optional, Default=false_
+
+Applications may define readiness checks which are probed by Marathon during deployments periodically, and these check results are exposed via the API.
+Enabling respectReadinessChecks causes Traefik to filter out tasks whose readiness checks have not succeeded.
+Note that the checks are only valid at deployment times.
+
+See the Marathon guide for details.
+
+### `responseHeaderTimeout`
+
+_Optional, Default=60s_
+
+Overrides ResponseHeaderTimeout.
+Amount of time the Marathon provider should wait before timing out,
+when waiting for the first response header from a Marathon master.
+
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration), or directly as a number of seconds.
+
+### `TLS`
+
+_Optional_
+
+TLS client configuration. [tls/#Config](https://golang.org/pkg/crypto/tls/#Config).
+
+```toml tab="File"
+[marathon.TLS]
+CA = "/etc/ssl/ca.crt"
+Cert = "/etc/ssl/marathon.cert"
+Key = "/etc/ssl/marathon.key"
+insecureSkipVerify = true
+```
+
+```txt tab="CLI"
+--providers.marathon.tls
+--providers.marathon.tls.ca="/etc/ssl/ca.crt"
+--providers.marathon.tls.cert="/etc/ssl/marathon.cert"
+--providers.marathon.tls.key="/etc/ssl/marathon.key"
+--providers.marathon.tls.insecureskipverify=true
+```
+
+### `TLSHandshakeTimeout`
+
+_Optional, Default=5s_
+
+Overrides TLSHandshakeTimeout.
+Amount of time the Marathon provider should wait before timing out,
+when waiting for the TLS handshake to complete.
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `trace`
+
+_Optional, Default=false_
+
+Displays additional provider logs (if available).
+
+### `watch`
+
+_Optional, Default=true_
+
+Enables watching for Marathon changes.
+
+## Routing Configuration Options
+
+### General
+
+Traefik creates, for each Marathon application, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).
+
+The Service automatically gets a server per instance of the application,
+and the router automatically gets a rule defined by defaultRule (if no rule for it was defined in labels).
+
+### Routers
+
+To update the configuration of the Router automatically attached to the application,
+add labels starting with `traefik.HTTP.Routers.{router-name-of-your-choice}.` and followed by the option you want to change.
+For example, to change the routing rule, you could add the label ```traefik.HTTP.Routers.Routername.Rule=Host(`my-domain`)```.
+
+Every [Router](../routing/routers/index.md) parameter can be updated this way.
+
+### Services
+
+To update the configuration of the Service automatically attached to the container,
+add labels starting with `traefik.HTTP.Services.{service-name-of-your-choice}.`, followed by the option you want to change.
+For example, to change the passhostheader behavior, you'd add the label `traefik.HTTP.Services.Servicename.LoadBalancer.PassHostHeader=false`.
+
+Every [Service](../routing/services/index.md) parameter can be updated this way.
+
+### Middleware
+
+You can declare pieces of middleware using labels starting with `traefik.HTTP.Middlewares.{middleware-name-of-your-choice}.`, followed by the middleware type/options.
+For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.HTTP.Middlewares.my-redirect.RedirectScheme.Scheme: https`.
+
+??? example "Declaring and Referencing a Middleware"
+
+    ```json
+	{
+		...
+		"labels": {
+			"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https",
+			"traefik.http.routers.my-container.middlewares": "my-redirect"
+		}
+	}
+    ```
+
+!!! warning "Conflicts in Declaration"
+
+    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TCP
+
+You can declare TCP Routers and/or Services using labels.
+
+??? example "Declaring TCP Routers and Services"
+
+    ```json
+	{
+		...
+		"labels": {
+			"traefik.tcp.routers.my-router.rule": "HostSNI(`my-host.com`)",
+			"traefik.tcp.routers.my-router.tls": "true",
+			"traefik.tcp.services.my-service.loadbalancer.server.port": "4123"
+		}
+	}
+    ```
+
+!!! warning "TCP and HTTP"
+
+    If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (as it would by default if no TCP Router/Service is defined).
+    Both a TCP Router/Service and an HTTP Router/Service can be created for the same application, but it has to be done explicitly in the config.
+
+### Specific Options
+
+#### `traefik.enable`
+
+Setting this option controls whether Traefik exposes the application.
+It overrides the value of `exposedByDefault`.
+
+#### `traefik.tags`
+
+Sets the tags for [constraints filtering](./overview.md#constraints-configuration).
+
+#### `traefik.marathon.ipadressidx`
+
+If a task has several IP addresses, this option specifies which one, in the list of available addresses, to select.
--- a/docs/content/providers/overview.md
+++ b/docs/content/providers/overview.md
@@ -31,15 +31,19 @@ Below is the list of the currently supported providers in Traefik.
 | [Docker](./docker.md)           | Orchestrator | Label              |
 | [File](./file.md)               | Orchestrator | Custom Annotation  |
 | [Kubernetes](kubernetes-crd.md) | Orchestrator | Custom Resource    |
-| Marathon (not yet documented)   | Orchestrator | Label              |
+| [Marathon](marathon.md)         | Orchestrator | Label              |

 !!! note "More Providers"

    The current version of Traefik is in development and doesn't support (yet) every provider. See the previous version (1.7) for more providers.
+
+<!--
+ TODO (document TCP VS HTTP dynamic configuration)
+ -->
    
 ## Constraints Configuration

-If you want to limit the scope of Traefik service discovery, you can set constraints.
+If you want to limit the scope of Traefik's service discovery, you can set constraints.
 Doing so, Traefik will create routes for containers that match these constraints only.

 ??? example "Containers with the api Tag"
--- a/docs/content/providers/rancher.md
+++ b/docs/content/providers/rancher.md
@@ -0,0 +1,195 @@
+# Traefik & Rancher
+
+A Story of Labels, Services & Containers
+{: .subtitle }
+
+![Rancher](../assets/img/providers/rancher.png)
+
+Attach labels to your services and let Traefik do the rest!
+
+!!! important
+    This provider is specific to Rancher 1.x.
+    Rancher 2.x requires Kubernetes and does not have a metadata endpoint of its own for Traefik to query.
+    As such, Rancher 2.x users should utilize the [Kubernetes provider](./kubernetes-crd.md) directly.
+
+## Configuration Examples
+
+??? example "Configuring Rancher & Deploying / Exposing Services"
+
+    Enabling the rancher provider
+
+    ```toml
+    [provider.rancher]
+    ```
+
+    Attaching labels to services
+
+    ```yaml
+    labels:
+      - traefik.http.services.my-service.rule=Host(my-domain)
+    ```
+
+## Provider Configuration Options
+
+!!! tip "Browse the Reference"
+    If you're in a hurry, maybe you'd rather go through the configuration reference:
+    
+    ```toml
+    ################################################################
+    # Rancher Provider
+    ################################################################
+    
+    # Enable Rancher Provider.
+    [rancher]
+    
+    # Expose Rancher services by default in Traefik.
+    #
+    # Optional
+    #
+    ExposedByDefault = "true"
+    
+    # Enable watch Rancher changes.
+    #
+    # Optional
+    #
+    watch = true
+    
+    # Filter services with unhealthy states and inactive states.
+    #
+    # Optional
+    #
+    EnableServiceHealthFilter = true
+    
+    # Defines the polling interval (in seconds).
+    #
+    # Optional
+    #
+    RefreshSeconds = true
+    
+    # Poll the Rancher metadata service for changes every `rancher.refreshSeconds`, which is less accurate
+    #
+    # Optional
+    #
+    IntervalPoll = false
+    
+    # Prefix used for accessing the Rancher metadata service
+    #
+    # Optional
+    #
+    Prefix = 15
+    ```
+
+### `ExposedByDefault`
+
+_Optional, Default=true_
+
+Expose Rancher services by default in Traefik.
+If set to false, services that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.
+
+### `DefaultRule`
+
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
+
+The default host rule for all services.
+
+For a given container if no routing rule was defined by a label, it is defined by this defaultRule instead.
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+The service name can be accessed as the `Name` identifier,
+and the template has access to all the labels defined on this container.
+
+```toml tab="File"
+[rancher]
+defaultRule = ""
+# ...
+```
+
+```txt tab="CLI"
+--providers.rancher
+--providers.rancher.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+```
+
+This option can be overridden on a container basis with the `traefik.http.routers.Router1.rule` label.
+
+### `EnableServiceHealthFilter`
+
+_Optional, Default=true_
+
+Filter services with unhealthy states and inactive states.
+
+### `RefreshSeconds`
+
+_Optional, Default=15_
+
+Defines the polling interval (in seconds).
+
+### `IntervalPoll`
+
+_Optional, Default=false_
+
+Poll the Rancher metadata service for changes every `rancher.refreshSeconds`,
+which is less accurate than the default long polling technique which will provide near instantaneous updates to Traefik.
+
+### `Prefix`
+
+_Optional, Default=/latest_
+
+Prefix used for accessing the Rancher metadata service
+
+### General
+
+Traefik creates, for each rancher service, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).
+
+The Service automatically gets a server per container in this rancher service, and the router gets a default rule attached to it, based on the service name.
+
+### Routers
+
+To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change.
+For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.
+
+Every [Router](../routing/routers/index.md) parameter can be updated this way.
+
+### Services
+
+To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`,
+followed by the option you want to change. For example, to change the passhostheader behavior,
+you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.
+
+Every [Service](../routing/services/index.md) parameter can be updated this way.
+
+### Middleware
+
+You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
+For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+
+??? example "Declaring and Referencing a Middleware"
+    
+    ```yaml
+    # ...
+    labels:
+     - traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
+     - traefik.http.routers.my-container.middlewares=my-redirect
+    ```
+
+!!! warning "Conflicts in Declaration"
+
+    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### Specific Options
+
+#### `traefik.enable`
+
+You can tell Traefik to consider (or not) the container by setting `traefik.enable` to true or false.
+
+This option overrides the value of `exposedByDefault`.
+
+#### `traefik.tags`
+
+Sets the tags for [constraints filtering](./overview.md#constraints-configuration).
+
+#### Port Lookup
+
+Traefik is now capable of detecting the port to use, by following the default rancher flow.
+That means, if you just expose lets say port :1337 on the rancher ui, traefik will pick up this port and use it.
--- a/docs/content/reference/acme.md
+++ b/docs/content/reference/acme.md
@@ -1,166 +0,0 @@
-# ACME - Reference
-
-Every Options for ACME
-{: .subtitle} 
-
-## TOML
-
-```toml
-    # Sample entrypoint configuration when using ACME.
-    [entrypoints]
-      [entrypoints.web]
-      address = ":80"
-      [entrypoints.web-secure]
-      address = ":443"
-        
-    # Enable ACME (Let's Encrypt): automatic SSL.
-    [acme]
-    
-    # Email address used for registration.
-    #
-    # Required
-    #
-    email = "test@traefik.io"
-    
-    # File used for certificates storage.
-    #
-    # Optional (Deprecated)
-    #
-    #storageFile = "acme.json"
-    
-    # File or key used for certificates storage.
-    #
-    # Required
-    #
-    storage = "acme.json"
-    # or `storage = "traefik/acme/account"` if using KV store.
-    
-    # Deprecated, replaced by [acme.dnsChallenge].
-    #
-    # Optional.
-    #
-    # dnsProvider = "digitalocean"
-    
-    # Deprecated, replaced by [acme.dnsChallenge.delayBeforeCheck].
-    #
-    # Optional
-    # Default: 0
-    #
-    # delayDontCheckDNS = 0
-    
-    # If true, display debug log messages from the acme client library.
-    #
-    # Optional
-    # Default: false
-    #
-    # acmeLogging = true
-    
-    # If true, override certificates in key-value store when using storeconfig.
-    #
-    # Optional
-    # Default: false
-    #
-    # overrideCertificates = true
-    
-    # Deprecated. Enable on demand certificate generation.
-    #
-    # Optional
-    # Default: false
-    #
-    # onDemand = true
-    
-    # Enable certificate generation on frontends host rules.
-    #
-    # Optional
-    # Default: false
-    #
-    # onHostRule = true
-    
-    # CA server to use.
-    # Uncomment the line to use Let's Encrypt's staging server,
-    # leave commented to go to prod.
-    #
-    # Optional
-    # Default: "https://acme-v02.api.letsencrypt.org/directory"
-    #
-    # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
-    
-    # KeyType to use.
-    #
-    # Optional
-    # Default: "RSA4096"
-    #
-    # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
-    #
-    # KeyType = "RSA4096"
-    
-    # Use a TLS-ALPN-01 ACME challenge.
-    #
-    # Optional (but recommended)
-    #
-    [acme.tlsChallenge]
-    
-    # Use a HTTP-01 ACME challenge.
-    #
-    # Optional
-    #
-    # [acme.httpChallenge]
-    
-      # EntryPoint to use for the HTTP-01 challenges.
-      #
-      # Required
-      #
-      # entryPoint = "http"
-    
-    # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
-    # Note: mandatory for wildcard certificate generation.
-    #
-    # Optional
-    #
-    # [acme.dnsChallenge]
-    
-      # DNS provider used.
-      #
-      # Required
-      #
-      # provider = "digitalocean"
-    
-      # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
-      # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
-      # Useful if internal networks block external DNS queries.
-      #
-      # Optional
-      # Default: 0
-      #
-      # delayBeforeCheck = 0
-    
-      # Use following DNS servers to resolve the FQDN authority.
-      #
-      # Optional
-      # Default: empty
-      #
-      # resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
-    
-      # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
-      #
-      # NOT RECOMMENDED:
-      # Increase the risk of reaching Let's Encrypt's rate limits.
-      #
-      # Optional
-      # Default: false
-      #
-      # disablePropagationCheck = true
-    
-    # Domains list.
-    # Only domains defined here can generate wildcard certificates.
-    # The certificates for these domains are negotiated at traefik startup only.
-    #
-    # [[acme.domains]]
-    #   main = "local1.com"
-    #   sans = ["test1.local1.com", "test2.local1.com"]
-    # [[acme.domains]]
-    #   main = "local2.com"
-    # [[acme.domains]]
-    #   main = "*.local3.com"
-    #   sans = ["local3.com", "test1.test1.local3.com"]
-```
--- a/docs/content/reference/dynamic-configuration/docker.md
+++ b/docs/content/reference/dynamic-configuration/docker.md
@@ -0,0 +1,8 @@
+# Docker Configuration Reference
+
+Dynamic configuration with Docker Labels
+{: .subtitle }
+
+```yaml
+--8<-- "content/reference/dynamic-configuration/labels.yml"
+```
--- a/docs/content/reference/dynamic-configuration/file.md
+++ b/docs/content/reference/dynamic-configuration/file.md
@@ -0,0 +1,8 @@
+# File Configuration Reference
+
+Dynamic configuration with toml files
+{: .subtitle }
+
+```toml
+--8<-- "content/reference/dynamic-configuration/file.toml"
+```
--- a/docs/content/reference/dynamic-configuration/file.toml
+++ b/docs/content/reference/dynamic-configuration/file.toml
@@ -0,0 +1,261 @@
+[HTTP]
+
+  [HTTP.Routers]
+
+    [HTTP.Routers.Router0]
+      EntryPoints = ["foobar", "foobar"]
+      Middlewares = ["foobar", "foobar"]
+      Service = "foobar"
+      Rule = "foobar"
+      priority = 42
+      [HTTP.Routers.Router0.tls]
+        options = "TLS0"
+
+  [HTTP.Middlewares]
+
+      [HTTP.Middlewares.Middleware0.AddPrefix]
+        Prefix = "foobar"
+
+      [HTTP.Middlewares.Middleware1.StripPrefix]
+        Prefixes = ["foobar", "foobar"]
+
+      [HTTP.Middlewares.Middleware2.StripPrefixRegex]
+        Regex = ["foobar", "foobar"]
+
+      [HTTP.Middlewares.Middleware3.ReplacePath]
+        Path = "foobar"
+
+      [HTTP.Middlewares.Middleware4.ReplacePathRegex]
+        Regex = "foobar"
+        Replacement = "foobar"
+
+      [HTTP.Middlewares.Middleware5.Chain]
+        Middlewares = ["foobar", "foobar"]
+
+      [HTTP.Middlewares.Middleware6.IPWhiteList]
+        SourceRange = ["foobar", "foobar"]
+
+        [HTTP.Middlewares.Middleware7.IPWhiteList.IPStrategy]
+          Depth = 42
+          ExcludedIPs = ["foobar", "foobar"]
+
+      [HTTP.Middlewares.Middleware8.Headers]
+        AccessControlAllowCredentials = true
+        AccessControlAllowHeaders = ["foobar", "foobar"]
+        AccessControlAllowMethods = ["foobar", "foobar"]
+        AccessControlAllowOrigin = "foobar"
+        AccessControlExposeHeaders = ["foobar", "foobar"]
+        AccessControlMaxAge = 42
+        AddVaryHeader = true
+        AllowedHosts = ["foobar", "foobar"]
+        HostsProxyHeaders = ["foobar", "foobar"]
+        SSLRedirect = true
+        SSLTemporaryRedirect = true
+        SSLHost = "foobar"
+        SSLForceHost = true
+        STSSeconds = 42
+        STSIncludeSubdomains = true
+        STSPreload = true
+        ForceSTSHeader = true
+        FrameDeny = true
+        CustomFrameOptionsValue = "foobar"
+        ContentTypeNosniff = true
+        BrowserXSSFilter = true
+        CustomBrowserXSSValue = "foobar"
+        ContentSecurityPolicy = "foobar"
+        PublicKey = "foobar"
+        ReferrerPolicy = "foobar"
+        IsDevelopment = true
+        [HTTP.Middlewares.Middleware8.Headers.CustomRequestHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+        [HTTP.Middlewares.Middleware8.Headers.CustomResponseHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+        [HTTP.Middlewares.Middleware8.Headers.SSLProxyHeaders]
+          name0 = "foobar"
+          name1 = "foobar"
+
+      [HTTP.Middlewares.Middleware9.Errors]
+        Status = ["foobar", "foobar"]
+        Service = "foobar"
+        Query = "foobar"
+
+      [HTTP.Middlewares.Middleware10.RateLimit]
+        ExtractorFunc = "foobar"
+        [HTTP.Middlewares.Middleware10.RateLimit.RateSet]
+          [HTTP.Middlewares.Middleware10.RateLimit.RateSet.Rate0]
+            Period = 42
+            Average = 42
+            Burst = 42
+          [HTTP.Middlewares.Middleware10.RateLimit.RateSet.Rate1]
+            Period = 42
+            Average = 42
+            Burst = 42
+
+      [HTTP.Middlewares.Middleware11.RedirectRegex]
+        Regex = "foobar"
+        Replacement = "foobar"
+        Permanent = true
+
+      [HTTP.Middlewares.Middleware12.RedirectScheme]
+        Scheme = "foobar"
+        Port = "foobar"
+        Permanent = true
+
+      [HTTP.Middlewares.Middleware13.BasicAuth]
+        Users = ["foobar", "foobar"]
+        UsersFile = "foobar"
+        Realm = "foobar"
+        RemoveHeader = true
+        HeaderField = "foobar"
+
+      [HTTP.Middlewares.Middleware14.DigestAuth]
+        Users = ["foobar", "foobar"]
+        UsersFile = "foobar"
+        RemoveHeader = true
+        Realm = "foobar"
+        HeaderField = "foobar"
+
+      [HTTP.Middlewares.Middleware15.ForwardAuth]
+        Address = "foobar"
+        TrustForwardHeader = true
+        AuthResponseHeaders = ["foobar", "foobar"]
+        [HTTP.Middlewares.Middleware15.ForwardAuth.TLS]
+          CA = "foobar"
+          CAOptional = true
+          Cert = "foobar"
+          Key = "foobar"
+          InsecureSkipVerify = true
+
+      [HTTP.Middlewares.Middleware16.MaxConn]
+        Amount = 42
+        ExtractorFunc = "foobar"
+
+      [HTTP.Middlewares.Middleware17.Buffering]
+        MaxRequestBodyBytes = 42
+        MemRequestBodyBytes = 42
+        MaxResponseBodyBytes = 42
+        MemResponseBodyBytes = 42
+        RetryExpression = "foobar"
+
+      [HTTP.Middlewares.Middleware18.CircuitBreaker]
+        Expression = "foobar"
+
+      [HTTP.Middlewares.Middleware19.Compress]
+
+      [HTTP.Middlewares.Middleware20.PassTLSClientCert]
+        PEM = true
+        [HTTP.Middlewares.Middleware20.PassTLSClientCert.Info]
+          NotAfter = true
+          NotBefore = true
+          Sans = true
+          [HTTP.Middlewares.Middleware20.PassTLSClientCert.Info.Subject]
+            Country = true
+            Province = true
+            Locality = true
+            Organization = true
+            CommonName = true
+            SerialNumber = true
+            DomainComponent = true
+          [HTTP.Middlewares.Middleware20.PassTLSClientCert.Info.Issuer]
+            Country = true
+            Province = true
+            Locality = true
+            Organization = true
+            CommonName = true
+            SerialNumber = true
+            DomainComponent = true
+
+      [HTTP.Middlewares.Middleware21.Retry]
+        Attempts = 42
+
+  [HTTP.Services]
+    [HTTP.Services.Service0]
+      [HTTP.Services.Service0.LoadBalancer]
+        PassHostHeader = true
+
+        [[HTTP.Services.Service0.LoadBalancer.Servers]]
+          URL = "foobar"
+
+        [HTTP.Services.Service0.LoadBalancer.Stickiness]
+          CookieName = "foobar"
+
+        [[HTTP.Services.Service0.LoadBalancer.Servers]]
+          URL = "foobar"
+
+        [HTTP.Services.Service0.LoadBalancer.HealthCheck]
+          Scheme = "foobar"
+          Path = "foobar"
+          Port = 42
+          Interval = "foobar"
+          Timeout = "foobar"
+          Hostname = "foobar"
+          [HTTP.Services.Service0.LoadBalancer.HealthCheck.Headers]
+            name0 = "foobar"
+            name1 = "foobar"
+        [HTTP.Services.Service0.LoadBalancer.ResponseForwarding]
+          FlushInterval = "foobar"
+
+[TCP]
+
+  [TCP.Routers]
+
+    [TCP.Routers.TCPRouter0]
+      EntryPoints = ["foobar", "foobar"]
+      Service = "foobar"
+      Rule = "foobar"
+      [TCP.Routers.TCPRouter0.tls]
+        passthrough = true
+        options = "TLS1"
+
+  [TCP.Services]
+
+    [TCP.Services.TCPService0]
+      [TCP.Services.TCPService0.LoadBalancer]
+
+        [[TCP.Services.TCPService0.LoadBalancer.Servers]]
+          Address = "foobar"
+
+        [[TCP.Services.TCPService0.LoadBalancer.Servers]]
+          Address = "foobar"
+
+[[TLS]]
+  Stores = ["foobar", "foobar"]
+  [TLS.Certificate]
+    CertFile = "foobar"
+    KeyFile = "foobar"
+
+[[TLS]]
+  Stores = ["foobar", "foobar"]
+  [TLS.Certificate]
+    CertFile = "foobar"
+    KeyFile = "foobar"
+
+[TLSOptions]
+
+  [TLSOptions.TLS0]
+    MinVersion = "foobar"
+    CipherSuites = ["foobar", "foobar"]
+    SniStrict = true
+    [TLSOptions.TLS0.ClientCA]
+      Files = ["foobar", "foobar"]
+      Optional = true
+  [TLSOptions.TLS1]
+    MinVersion = "foobar"
+    CipherSuites = ["foobar", "foobar"]
+    SniStrict = true
+    [TLSOptions.TLS1.ClientCA]
+      Files = ["foobar", "foobar"]
+      Optional = true
+
+[TLSStores]
+
+  [TLSStores.Store0]
+    [TLSStores.Store0.DefaultCertificate]
+      CertFile = "foobar"
+      KeyFile = "foobar"
+  [TLSStores.Store1]
+    [TLSStores.Store1.DefaultCertificate]
+      CertFile = "foobar"
+      KeyFile = "foobar"
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd.md
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd.md
@@ -0,0 +1,8 @@
+# Kubernetes Configuration Reference
+
+Dynamic configuration with Kubernetes Custom Resource
+{: .subtitle }
+
+```yaml
+--8<-- "content/reference/dynamic-configuration/kubernetes-crd.yml"
+```
--- a/docs/content/reference/dynamic-configuration/kubernetes-crd.yml
+++ b/docs/content/reference/dynamic-configuration/kubernetes-crd.yml
@@ -0,0 +1,106 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutes.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRoute
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroute
+spec:
+  entryPoints:
+    - web
+    - web-secure
+  routes:
+    - match: Host(`foo.com`) && PathPrefix(`/bar`)
+      kind: Rule
+      priority: 12
+      # defining several services is possible and allowed, but for now the servers of
+      # all the services (for a given route) get merged altogether under the same
+      # load-balancing strategy.
+      services:
+        - name: s1
+          port: 80
+          healthCheck:
+            path: /health
+            host: baz.com
+            intervalSeconds: 7
+            timeoutSeconds: 60
+          # strategy defines the load balancing strategy between the servers. It defaults
+          # to Round Robin, and for now only Round Robin is supported anyway.
+          strategy: RoundRobin
+        - name: s2
+          port: 433
+          healthCheck:
+            path: /health
+            host: baz.com
+            intervalSeconds: 7
+            timeoutSeconds: 60
+    - match: PathPrefix(`/misc`)
+      services:
+        - name: s3
+          port: 80
+      middlewares:
+        - name: stripprefix
+        - name: addprefix
+  # use an empty tls object for TLS with Let's Encrypt
+  tls:
+    secretName: supersecret
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: ingressroutetcp.crd
+  namespace: default
+
+spec:
+  entryPoints:
+    - footcp
+  routes:
+    - match: HostSNI(`bar.com`)
+      services:
+        - name: whoamitcp
+          port: 8080
+  tls:
+    secretName: foosecret
+    passthrough: false
--- a/docs/content/reference/dynamic-configuration/labels.yml
+++ b/docs/content/reference/dynamic-configuration/labels.yml
@@ -0,0 +1,154 @@
+labels:
+- "traefik.HTTP.Middlewares.Middleware0.AddPrefix.Prefix=foobar"
+- "traefik.HTTP.Middlewares.Middleware1.BasicAuth.HeaderField=foobar"
+- "traefik.HTTP.Middlewares.Middleware1.BasicAuth.Realm=foobar"
+- "traefik.HTTP.Middlewares.Middleware1.BasicAuth.RemoveHeader=true"
+- "traefik.HTTP.Middlewares.Middleware1.BasicAuth.Users=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware1.BasicAuth.UsersFile=foobar"
+- "traefik.HTTP.Middlewares.Middleware2.Buffering.MaxRequestBodyBytes=42"
+- "traefik.HTTP.Middlewares.Middleware2.Buffering.MaxResponseBodyBytes=42"
+- "traefik.HTTP.Middlewares.Middleware2.Buffering.MemRequestBodyBytes=42"
+- "traefik.HTTP.Middlewares.Middleware2.Buffering.MemResponseBodyBytes=42"
+- "traefik.HTTP.Middlewares.Middleware2.Buffering.RetryExpression=foobar"
+- "traefik.HTTP.Middlewares.Middleware3.Chain.Middlewares=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware4.CircuitBreaker.Expression=foobar"
+- "traefik.HTTP.Middlewares.Middleware5.DigestAuth.HeaderField=foobar"
+- "traefik.HTTP.Middlewares.Middleware5.DigestAuth.Realm=foobar"
+- "traefik.HTTP.Middlewares.Middleware5.DigestAuth.RemoveHeader=true"
+- "traefik.HTTP.Middlewares.Middleware5.DigestAuth.Users=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware5.DigestAuth.UsersFile=foobar"
+- "traefik.HTTP.Middlewares.Middleware6.Errors.Query=foobar"
+- "traefik.HTTP.Middlewares.Middleware6.Errors.Service=foobar"
+- "traefik.HTTP.Middlewares.Middleware6.Errors.Status=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.Address=foobar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.AuthResponseHeaders=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TLS.CA=foobar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TLS.CAOptional=true"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TLS.Cert=foobar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TLS.InsecureSkipVerify=true"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TLS.Key=foobar"
+- "traefik.HTTP.Middlewares.Middleware7.ForwardAuth.TrustForwardHeader=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlAllowCredentials=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlAllowHeaders=X-foobar, X-fiibar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlAllowMethods=GET, PUT"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlAllowOrigin=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlExposeHeaders=X-foobar, X-fiibar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AccessControlMaxAge=200"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AddVaryHeader=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.AllowedHosts=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.BrowserXSSFilter=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.ContentSecurityPolicy=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.ContentTypeNosniff=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomBrowserXSSValue=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomFrameOptionsValue=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomRequestHeaders.name0=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomRequestHeaders.name1=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomResponseHeaders.name0=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.CustomResponseHeaders.name1=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.ForceSTSHeader=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.FrameDeny=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.HostsProxyHeaders=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.IsDevelopment=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.PublicKey=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.ReferrerPolicy=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLForceHost=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLHost=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLProxyHeaders.name0=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLProxyHeaders.name1=foobar"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLRedirect=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.SSLTemporaryRedirect=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.STSIncludeSubdomains=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.STSPreload=true"
+- "traefik.HTTP.Middlewares.Middleware8.Headers.STSSeconds=42"
+- "traefik.HTTP.Middlewares.Middleware9.IPWhiteList.IPStrategy.Depth=42"
+- "traefik.HTTP.Middlewares.Middleware9.IPWhiteList.IPStrategy.ExcludedIPs=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware9.IPWhiteList.SourceRange=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware10.MaxConn.Amount=42"
+- "traefik.HTTP.Middlewares.Middleware10.MaxConn.ExtractorFunc=foobar"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.NotAfter=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.NotBefore=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Sans=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.Country=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.Province=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.Locality=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.Organization=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.CommonName=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.SerialNumber=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Subject.DomainComponent=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.Country=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.Province=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.Locality=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.Organization=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.CommonName=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.SerialNumber=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.Info.Issuer.DomainComponent=true"
+- "traefik.HTTP.Middlewares.Middleware11.PassTLSClientCert.PEM=true"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.ExtractorFunc=foobar"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate0.Average=42"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate0.Burst=42"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate0.Period=42"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate1.Average=42"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate1.Burst=42"
+- "traefik.HTTP.Middlewares.Middleware12.RateLimit.RateSet.Rate1.Period=42"
+- "traefik.HTTP.Middlewares.Middleware13.RedirectRegex.Regex=foobar"
+- "traefik.HTTP.Middlewares.Middleware13.RedirectRegex.Replacement=foobar"
+- "traefik.HTTP.Middlewares.Middleware13.RedirectRegex.Permanent=true"
+- "traefik.HTTP.Middlewares.Middleware13b.RedirectScheme.Scheme=https"
+- "traefik.HTTP.Middlewares.Middleware13b.RedirectScheme.Port=80"
+- "traefik.HTTP.Middlewares.Middleware13b.RedirectScheme.Permanent=true"
+- "traefik.HTTP.Middlewares.Middleware14.ReplacePath.Path=foobar"
+- "traefik.HTTP.Middlewares.Middleware15.ReplacePathRegex.Regex=foobar"
+- "traefik.HTTP.Middlewares.Middleware15.ReplacePathRegex.Replacement=foobar"
+- "traefik.HTTP.Middlewares.Middleware16.Retry.Attempts=42"
+- "traefik.HTTP.Middlewares.Middleware17.StripPrefix.Prefixes=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware18.StripPrefixRegex.Regex=foobar, fiibar"
+- "traefik.HTTP.Middlewares.Middleware19.Compress=true"
+- "traefik.HTTP.Routers.Router0.EntryPoints=foobar, fiibar"
+- "traefik.HTTP.Routers.Router0.Middlewares=foobar, fiibar"
+- "traefik.HTTP.Routers.Router0.Priority=42"
+- "traefik.HTTP.Routers.Router0.Rule=foobar"
+- "traefik.HTTP.Routers.Router0.Service=foobar"
+- "traefik.HTTP.Routers.Router0.TLS=true"
+- "traefik.HTTP.Routers.Router0.TLS.options=foo"
+- "traefik.HTTP.Routers.Router1.EntryPoints=foobar, fiibar"
+- "traefik.HTTP.Routers.Router1.Middlewares=foobar, fiibar"
+- "traefik.HTTP.Routers.Router1.Priority=42"
+- "traefik.HTTP.Routers.Router1.Rule=foobar"
+- "traefik.HTTP.Routers.Router1.Service=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Headers.name0=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Headers.name1=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Hostname=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Interval=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Path=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Port=42"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Scheme=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.HealthCheck.Timeout=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.PassHostHeader=true"
+- "traefik.HTTP.Services.Service0.LoadBalancer.ResponseForwarding.FlushInterval=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.server.Port=8080"
+- "traefik.HTTP.Services.Service0.LoadBalancer.server.Scheme=foobar"
+- "traefik.HTTP.Services.Service0.LoadBalancer.Stickiness.CookieName=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Headers.name0=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Headers.name1=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Hostname=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Interval=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Path=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Port=42"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Scheme=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.HealthCheck.Timeout=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.PassHostHeader=true"
+- "traefik.HTTP.Services.Service1.LoadBalancer.ResponseForwarding.FlushInterval=foobar"
+- "traefik.HTTP.Services.Service1.LoadBalancer.server.Port=8080"
+- "traefik.HTTP.Services.Service1.LoadBalancer.server.Scheme=foobar"
+- "traefik.TCP.Routers.Router0.Rule=foobar"
+- "traefik.TCP.Routers.Router0.EntryPoints=foobar, fiibar"
+- "traefik.TCP.Routers.Router0.Service=foobar"
+- "traefik.TCP.Routers.Router0.TLS.Passthrough=false"
+- "traefik.TCP.Routers.Router0.TLS.options=bar"
+- "traefik.TCP.Routers.Router1.Rule=foobar"
+- "traefik.TCP.Routers.Router1.EntryPoints=foobar, fiibar"
+- "traefik.TCP.Routers.Router1.Service=foobar"
+- "traefik.TCP.Routers.Router1.TLS.Passthrough=false"
+- "traefik.TCP.Routers.Router1.TLS.options=foobar"
+- "traefik.TCP.Services.Service0.LoadBalancer.server.Port=42"
+- "traefik.TCP.Services.Service1.LoadBalancer.server.Port=42"
--- a/docs/content/reference/dynamic-configuration/marathon.md
+++ b/docs/content/reference/dynamic-configuration/marathon.md
@@ -0,0 +1,8 @@
+# Marathon Configuration Reference
+
+Dynamic configuration with Marathon Labels
+{: .subtitle }
+
+```yaml
+--8<-- "content/reference/dynamic-configuration/labels.yml"
+```
--- a/docs/content/reference/entrypoints.md
+++ b/docs/content/reference/entrypoints.md
@@ -1,35 +0,0 @@
-# EntryPoints - Reference
-
-Every Options for EntryPoints
-{: .subtitle} 
-
-## TOML
-
-```toml
-# ...
-
-[entrypoints]
-  [entrypoints.web]
-    address = ":80"
-
-    [entrypoints.web.proxyProtocol]
-      insecure = true
-      trustedIPs = ["10.10.10.1", "10.10.10.2"]
-
-    [entrypoints.web.forwardedHeaders]
-      trustedIPs = ["10.10.10.1", "10.10.10.2"]
-      insecure = false
-
-  [entrypoints.web-secure]
-    # ...
-```
-
-## CLI
-
-```ini
-Name:foo
-Address::80
-ProxyProtocol.TrustedIPs:192.168.0.1
-ProxyProtocol.Insecure:true
-ForwardedHeaders.TrustedIPs:10.0.0.3/24,20.0.0.3/24
-```
--- a/docs/content/reference/logs.md
+++ b/docs/content/reference/logs.md
@@ -1,53 +0,0 @@
-# Logs - Reference
-
-## TOML
-
-```toml
-logLevel = "INFO"
-
-[traefikLog]
-  filePath = "/path/to/traefik.log"
-  format   = "json"
-
-[accessLog]
-  filePath = "/path/to/access.log"
-  format = "json"
-
-  [accessLog.filters]
-    statusCodes = ["200", "300-302"]
-    retryAttempts = true
-    minDuration = "10ms"
-
-  [accessLog.fields]
-    defaultMode = "keep"
-    [accessLog.fields.names]
-      "ClientUsername" = "drop"
-      # ...
-
-    [accessLog.fields.headers]
-      defaultMode = "keep"
-      [accessLog.fields.headers.names]
-        "User-Agent" = "redact"
-        "Authorization" = "drop"
-        "Content-Type" = "keep"
-        # ...
-```
-
-## CLI
-
-For more information about the CLI, see the documentation about [Traefik command](../../operations/cli).
-
-```shell
--logLevel="DEBUG"
--traefikLog.filePath="/path/to/traefik.log"
--traefikLog.format="json"
--accessLog.filePath="/path/to/access.log"
--accessLog.format="json"
--accessLog.filters.statusCodes="200,300-302"
--accessLog.filters.retryAttempts="true"
--accessLog.filters.minDuration="10ms"
--accessLog.fields.defaultMode="keep"
--accessLog.fields.names="Username=drop Hostname=drop"
--accessLog.fields.headers.defaultMode="keep"
--accessLog.fields.headers.names="User-Agent=redact Authorization=drop Content-Type=keep"
-```
--- a/docs/content/reference/providers/docker.md
+++ b/docs/content/reference/providers/docker.md
@@ -1,180 +0,0 @@
-# Docker -- Reference
-
-## Docker
-
-```toml
-################################################################
-# Docker Provider
-################################################################
-
-# Enable Docker Provider.
-[docker]
-
-# Docker server endpoint. Can be a tcp or a unix socket endpoint.
-#
-# Required
-#
-endpoint = "unix:///var/run/docker.sock"
-
-# Default base domain used for the frontend rules.
-# Can be overridden by setting the "traefik.domain" label on a container.
-#
-# Optional
-#
-domain = "docker.localhost"
-
-# Enable watch docker changes.
-#
-# Optional
-#
-watch = true
-
-# Override default configuration template.
-# For advanced users :)
-#
-# Optional
-#
-# filename = "docker.tmpl"
-
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = 2
-
-# Expose containers by default in Traefik.
-# If set to false, containers that don't have `traefik.enable=true` will be ignored.
-#
-# Optional
-# Default: true
-#
-exposedByDefault = true
-
-# Use the IP address from the binded port instead of the inner network one.
-#
-# In case no IP address is attached to the binded port (or in case 
-# there is no bind), the inner network one will be used as a fallback.     
-#
-# Optional
-# Default: false
-#
-usebindportip = true
-
-# Use Swarm Mode services as data provider.
-#
-# Optional
-# Default: false
-#
-swarmMode = false
-
-# Polling interval (in seconds) for Swarm Mode.
-#
-# Optional
-# Default: 15
-#
-swarmModeRefreshSeconds = 15
-
-# Define a default docker network to use for connections to all containers.
-# Can be overridden by the traefik.docker.network label.
-#
-# Optional
-#
-network = "web"
-
-# Enable docker TLS connection.
-#
-# Optional
-#
-#  [docker.tls]
-#  ca = "/etc/ssl/ca.crt"
-#  cert = "/etc/ssl/docker.crt"
-#  key = "/etc/ssl/docker.key"
-#  insecureSkipVerify = true
-```
-
-## Docker Swarm Mode
-
-```toml
-################################################################
-# Docker Swarm Mode Provider
-################################################################
-
-# Enable Docker Provider.
-[docker]
-
-# Docker server endpoint.
-# Can be a tcp or a unix socket endpoint.
-#
-# Required
-# Default: "unix:///var/run/docker.sock"
-#
-# swarm classic (1.12-)
-# endpoint = "tcp://127.0.0.1:2375"
-# docker swarm mode (1.12+)
-endpoint = "tcp://127.0.0.1:2377"
-
-# Default base domain used for the frontend rules.
-# Can be overridden by setting the "traefik.domain" label on a services.
-#
-# Optional
-# Default: ""
-#
-domain = "docker.localhost"
-
-# Enable watch docker changes.
-#
-# Optional
-# Default: true
-#
-watch = true
-
-# Use Docker Swarm Mode as data provider.
-#
-# Optional
-# Default: false
-#
-swarmMode = true
-
-# Define a default docker network to use for connections to all containers.
-# Can be overridden by the traefik.docker.network label.
-#
-# Optional
-#
-network = "web"
-
-# Override default configuration template.
-# For advanced users :)
-#
-# Optional
-#
-# filename = "docker.tmpl"
-
-# Override template version
-# For advanced users :)
-#
-# Optional
-# - "1": previous template version (must be used only with older custom templates, see "filename")
-# - "2": current template version (must be used to force template version when "filename" is used)
-#
-# templateVersion = 2
-
-# Expose services by default in Traefik.
-#
-# Optional
-# Default: true
-#
-exposedByDefault = false
-
-# Enable docker TLS connection.
-#
-# Optional
-#
-#  [docker.tls]
-#  ca = "/etc/ssl/ca.crt"
-#  cert = "/etc/ssl/docker.crt"
-#  key = "/etc/ssl/docker.key"
-#  insecureSkipVerify = true
-```
--- a/docs/content/reference/providers/file.md
+++ b/docs/content/reference/providers/file.md
@@ -1,261 +0,0 @@
-# File -- Reference
-
-## File
-
-```toml
-################################################################
-# File Provider
-################################################################
-
-[providers]
-
-  # Enable File Provider.
-  [providers.file]
-  
-    # Define one separated configuration file.
-    #
-    # Optional
-    #     
-    filename = "my-conf.toml"
-
-    # Define directory that contains a set of configuration files.
-    #
-    # Optional
-    #     
-    directory = "/path/to/config"
-
-    # Enable watch file changes.
-    #
-    # Optional
-    #
-    watch = true
-
-    [http]
-    
-      [http.routers]
-      
-        [http.routers.router0]
-          entrypoints = ["foo", "bar"]
-          middlewares = ["foo", "bar"]
-          service = "service-foo"
-          rule = "Path(`foo`)"
-          priority = 42
-          [http.routers.router0.tls]
-      
-      [http.middlewares]
-      
-          [http.middlewares.my-add-prefix.AddPrefix]
-            prefix = "/foo"
-      
-          [http.middlewares.my-strip-prefix.StripPrefix]
-            prefixes = ["/foo", "/bar"]
-      
-          [http.middlewares.my-strip-prefix-regex.StripPrefixRegex]
-            regex = ["/foo/api/", "/bar/{category}/{id:[0-9]+}/"]
-      
-          [http.middlewares.my-replace-path.ReplacePath]
-            path = "/foo"
-      
-          [http.middlewares.my-replace-path-regex.ReplacePathRegex]
-            regex = "foo/(.*)"
-            replacement = "/foobar/$1"
-      
-          [http.middlewares.my-chain.Chain]
-            middlewares = ["my-add-prefix", "my-basic-auth"]
-      
-          [http.middlewares.Middleware0.IPWhiteList]
-            sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-            [http.middlewares.Middleware0.IPWhiteList.IPStrategy]
-              depth = 2
-              excludedIPs = ["127.0.0.1/16", "192.168.1.7"]
-      
-          [http.middlewares.my-headers.Headers]
-            allowedHosts = ["foobar", "foobar"]
-            hostsProxyHeaders = ["foobar", "foobar"]
-            sslRedirect = true
-            sslTemporaryRedirect = true
-            sslHost = "foobar"
-            sslForceHost = true
-            stsSeconds = 42
-            stsIncludeSubdomains = true
-            stsPreload = true
-            forceSTSHeader = true
-            frameDeny = true
-            customFrameOptionsValue = "foobar"
-            contentTypeNosniff = true
-            browserXSSFilter = true
-            customBrowserXSSValue = "foobar"
-            contentSecurityPolicy = "foobar"
-            publicKey = "foobar"
-            referrerPolicy = "foobar"
-            isDevelopment = true
-            [http.middlewares.my-headers.Headers.CustomRequestHeaders]
-              X-Script-Name = "foo"
-            [http.middlewares.my-headers.Headers.CustomResponseHeaders]
-              X-Custom-Response-Header = "True"
-            [http.middlewares.my-headers.Headers.SSLProxyHeaders]
-              X-Forwarded-Proto = "https"
-          
-          [http.middlewares.my-errors.Errors]
-            status = ["400-404", "500-599"]
-            service = "foo-errors-service"
-            query = "/error.html"
-          
-          [http.middlewares.my-rate-limit.RateLimit]
-            extractorFunc = "client.ip"
-            [http.middlewares.Middleware0.RateLimit.RateSet]
-            
-              [http.middlewares.Middleware0.RateLimit.RateSet.Rate0]
-                period = 10
-                average = 100
-                burst = 200
-          
-          [http.middlewares.my-redirect-regex.RedirectRegex]
-            regex = "^http://localhost/(.*)"
-            replacement = "http://mydomain/$1"
-            permanent = true
-          
-          [http.middlewares.my-redirect-scheme.RedirectScheme]
-            scheme = "https"
-            port = "8443"
-            permanent = true
-          
-          [http.middlewares.my-basic-auth.BasicAuth]
-            users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
-                      "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
-            usersFile = "etc/traefik/.htpasswd"
-            realm = "myRealm"
-            removeHeader = true
-            headerField = "X-WebAuth-User"
-          
-          [http.middlewares.my-digest-auth.DigestAuth]
-            users = ["test:traefik:a2688e031edb4be6a3797f3882655c05", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
-            usersFile = "etc/traefik/.htdigest"
-            removeHeader = true
-            realm = "traefik"
-            headerField = "X-WebAuth-User"
-          
-          [http.middlewares.my-forward-auth.ForwardAuth]
-            address = "https://myauth.server:443"
-            trustForwardHeader = true
-            authResponseHeaders = ["X-Forwarded-Foo", "X-Forwarded-Bar"]
-            [http.middlewares.my-forward-auth.ForwardAuth.TLS]
-              ca = "/etc/traefik/crt/ca.pem"
-              caOptional = true
-              cert = "/etc/traefik/crt/cert.pem"
-              key = "/etc/traefik/crt/cert.key"
-              insecureSkipVerify = true
-          
-          [http.middlewares.my-maxconn.MaxConn]
-            amount = 10
-            extractorFunc = "request.host"
-          
-          [http.middlewares.my-buffering.Buffering]
-            maxRequestBodyBytes = 25000
-            memRequestBodyBytes = 25000
-            maxResponseBodyBytes = 25000
-            memResponseBodyBytes = 25000
-            retryExpression = "foobar"
-          
-          [http.middlewares.my-circuit-breaker.CircuitBreaker]
-            Expression = "LatencyAtQuantileMS(50.0) > 100"
-          
-          [http.middlewares.my-compress.Compress]
-          
-          [http.middlewares.my-pass-tls-client-cert.PassTLSClientCert]
-            pem = true
-            [http.middlewares.Middleware0.PassTLSClientCert.Info]
-              notAfter = true
-              notBefore = true
-              sans = true
-              [http.middlewares.Middleware0.PassTLSClientCert.Info.Subject]
-                country = true
-                province = true
-                locality = true
-                organization = true
-                commonName = true
-                serialNumber = true
-                domainComponent = true
-              [http.middlewares.Middleware0.PassTLSClientCert.Info.Issuer]
-                country = true
-                province = true
-                locality = true
-                organization = true
-                commonName = true
-                serialNumber = true
-                domainComponent = true
-          
-          [http.middlewares.my-retry.Retry]
-            attempts = 4
-    
-      [http.services]
-      
-        [http.services.service0]
-          [http.services.service0.LoadBalancer]
-            method = "wrr"
-            passHostHeader = true
-            [http.services.service0.LoadBalancer.Stickiness]
-              cookieName = "my-stickiness-cookie-name"
-            [[http.services.service0.LoadBalancer.Servers]]
-              url = "http://foo/"
-              weight = 30
-            [[http.services.service0.LoadBalancer.Servers]]
-              url = "http://bar/"
-              weight = 70
-            [http.services.service0.LoadBalancer.HealthCheck]
-              scheme = "https"
-              path = "/health"
-              port = 9443
-              interval = "10s"
-              timeout = "30s"
-              hostname = "foobar"
-              [http.services.service0.LoadBalancer.HealthCheck.Headers]
-                My-Custom-Header = "foobar"
-            [http.services.service0.LoadBalancer.ResponseForwarding]
-              flushInterval = "4s"
-      
-    [tcp]
-    
-      [tcp.routers]
-        [tcp.routers.tcpRouter0]
-          entryPoints = ["foobar", "foobar"]
-          service = "foobar"
-          rule = "foobar"
-          [tcp.routers.tcpRouter0.tlst]
-            passthrough = true
-    
-      [tcp.services]
-        [tcp.services.tcpService0]
-          [tcp.services.tcpService0.tcpLoadBalancer]
-            method = "foobar"
-            [[tcp.services.tcpService0.tcpLoadBalancer.Servers]]
-              address = "foobar"
-              weight = 42
-            [[tcp.services.tcpService0.tcpLoadBalancer.Servers]]
-              address = "foobar"
-              weight = 42
-    
-    [[tls]]
-      Store = ["my-store-foo", "my-store-bar"]
-      [tls.Certificate]
-        certFile = "/etc/traefik/cert.pem"
-        keyFile = "/etc/traefik/cert.key"
-    
-    
-    [tlsconfig]
-      [tlsconfig.TLS0]
-        minVersion = "VersionTLS12"
-        cipherSuites = [ "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_RSA_WITH_AES_256_GCM_SHA384"]
-        [tlsconfig.TLS0.ClientCA]
-          files = ["/etc/traefik/ca-foo.pem", "/etc/traefik/ca-bar.pem"]
-          optional = true
-    
-    [tlsstore]
-      [tlsstore.my-store-foo]
-        sniStrict = true
-        [tlsstore.my-store-foo.DefaultCertificate]
-          certFile = "/etc/traefik/cert.pem"
-          keyFile = "/etc/traefik/cert.key"
-
-```
-
--- a/docs/content/reference/providers/kubernetescrd.md
+++ b/docs/content/reference/providers/kubernetescrd.md
@@ -1,81 +0,0 @@
-# Kubernetes -- Reference
-
-## Kubernetes
-
-```yaml
-################################################################
-# Kubernetes Provider
-################################################################
-
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: ingressroutes.traefik.containo.us
-
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: IngressRoute
-    plural: ingressroutes
-    singular: ingressroute
-  scope: Namespaced
-
---
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: middlewares.traefik.containo.us
-spec:
-  group: traefik.containo.us
-  version: v1alpha1
-  names:
-    kind: Middleware
-    plural: middlewares
-    singular: middleware
-  scope: Namespaced
-
---
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
-metadata:
-  name: ingressroute.crd
-spec:
-  entrypoints:
-    - web
-    - web-secure
-  routes:
-  - match: Host(`foo.com`) && PathPrefix(`/bar`)
-    kind: Rule
-    priority: 12
-    # defining several services is possible and allowed, but for now the servers of
-    # all the services (for a given route) get merged altogether under the same
-    # load-balancing strategy.
-    services:
-    - name: s1
-      port: 80
-      healthcheck:
-        path: /health
-        host: baz.com
-        intervalseconds: 7
-        timeoutseconds: 60
-      # strategy defines the load balancing strategy between the servers. It defaults
-      # to Round Robin, and for now only Round Robin is supported anyway.
-      strategy: RoundRobin
-    - name: s2
-      port: 433
-      healthcheck:
-        path: /health
-        host: baz.com
-        intervalseconds: 7
-        timeoutseconds: 60
-  - match: PathPrefix(`/misc`)
-    services:
-    - name: s3
-      port: 80
-    middleware:
-    - name: stripprefix
-    - name: addprefix
-  tls:
-    secretName: supersecret
-```
--- a/docs/content/reference/static-configuration/cli.md
+++ b/docs/content/reference/static-configuration/cli.md
@@ -0,0 +1,5 @@
+# Static Configuration: CLI
+
+```txt
+--8<-- "content/reference/static-configuration/cli.txt"
+```
--- a/docs/content/reference/static-configuration/cli.txt
+++ b/docs/content/reference/static-configuration/cli.txt
@@ -0,0 +1,635 @@
+--accesslog  (Default: "false")
+    Access log settings.
+
+--accesslog.bufferingsize  (Default: "0")
+    Number of access log lines to process in a buffered way.
+
+--accesslog.fields.defaultmode  (Default: "keep")
+    Default mode for fields: keep | drop
+
+--accesslog.fields.headers.defaultmode  (Default: "keep")
+    Default mode for fields: keep | drop | redact
+
+--accesslog.fields.headers.names.<name>  (Default: "")
+    Override mode for headers
+
+--accesslog.fields.names.<name>  (Default: "")
+    Override mode for fields
+
+--accesslog.filepath  (Default: "")
+    Access log file path. Stdout is used when omitted or empty.
+
+--accesslog.filters.minduration  (Default: "0")
+    Keep access logs when request took longer than the specified duration.
+
+--accesslog.filters.retryattempts  (Default: "false")
+    Keep access logs when at least one retry happened.
+
+--accesslog.filters.statuscodes  (Default: "")
+    Keep access logs with status codes in the specified range.
+
+--accesslog.format  (Default: "common")
+    Access log format: json | common
+
+--acme.acmelogging  (Default: "false")
+    Enable debug logging of ACME actions.
+
+--acme.caserver  (Default: "https://acme-v02.api.letsencrypt.org/directory")
+    CA server to use.
+
+--acme.dnschallenge  (Default: "false")
+    Activate DNS-01 Challenge.
+
+--acme.dnschallenge.delaybeforecheck  (Default: "0")
+    Assume DNS propagates after a delay in seconds rather than finding and querying
+    nameservers.
+
+--acme.dnschallenge.disablepropagationcheck  (Default: "false")
+    Disable the DNS propagation checks before notifying ACME that the DNS challenge
+    is ready. [not recommended]
+
+--acme.dnschallenge.provider  (Default: "")
+    Use a DNS-01 based challenge provider rather than HTTPS.
+
+--acme.dnschallenge.resolvers  (Default: "")
+    Use following DNS servers to resolve the FQDN authority.
+
+--acme.domains  (Default: "")
+    The list of domains for which certificates are generated on startup. Wildcard
+    domains only accepted with DNSChallenge.
+
+--acme.domains[n].main  (Default: "")
+    Default subject name.
+
+--acme.domains[n].sans  (Default: "")
+    Subject alternative names.
+
+--acme.email  (Default: "")
+    Email address used for registration.
+
+--acme.entrypoint  (Default: "")
+    EntryPoint to use.
+
+--acme.httpchallenge  (Default: "false")
+    Activate HTTP-01 Challenge.
+
+--acme.httpchallenge.entrypoint  (Default: "")
+    HTTP challenge EntryPoint
+
+--acme.keytype  (Default: "RSA4096")
+    KeyType used for generating certificate private key. Allow value 'EC256',
+    'EC384', 'RSA2048', 'RSA4096', 'RSA8192'.
+
+--acme.onhostrule  (Default: "false")
+    Enable certificate generation on router Host rules.
+
+--acme.storage  (Default: "acme.json")
+    Storage to use.
+
+--acme.tlschallenge  (Default: "true")
+    Activate TLS-ALPN-01 Challenge.
+
+--api  (Default: "false")
+    Enable api/dashboard.
+
+--api.dashboard  (Default: "true")
+    Activate dashboard.
+
+--api.entrypoint  (Default: "traefik")
+    EntryPoint.
+
+--api.middlewares  (Default: "")
+    Middleware list.
+
+--api.statistics  (Default: "false")
+    Enable more detailed statistics.
+
+--api.statistics.recenterrors  (Default: "10")
+    Number of recent errors logged.
+
+--configfile  (Default: "")
+    Configuration file to use. If specified all other flags are ignored.
+
+--entrypoints.<name>  (Default: "false")
+    Entry points definition.
+
+--entrypoints.<name>.address  (Default: "")
+    Entry point address.
+
+--entrypoints.<name>.forwardedheaders.insecure  (Default: "false")
+    Trust all forwarded headers.
+
+--entrypoints.<name>.forwardedheaders.trustedips  (Default: "")
+    Trust only forwarded headers from selected IPs.
+
+--entrypoints.<name>.proxyprotocol  (Default: "false")
+    Proxy-Protocol configuration.
+
+--entrypoints.<name>.proxyprotocol.insecure  (Default: "false")
+    Trust all.
+
+--entrypoints.<name>.proxyprotocol.trustedips  (Default: "")
+    Trust only selected IPs.
+
+--entrypoints.<name>.transport.lifecycle.gracetimeout  (Default: "10")
+    Duration to give active requests a chance to finish before Traefik stops.
+
+--entrypoints.<name>.transport.lifecycle.requestacceptgracetimeout  (Default: "0")
+    Duration to keep accepting requests before Traefik initiates the graceful
+    shutdown procedure.
+
+--entrypoints.<name>.transport.respondingtimeouts.idletimeout  (Default: "180")
+    IdleTimeout is the maximum amount duration an idle (keep-alive) connection will
+    remain idle before closing itself. If zero, no timeout is set.
+
+--entrypoints.<name>.transport.respondingtimeouts.readtimeout  (Default: "0")
+    ReadTimeout is the maximum duration for reading the entire request, including
+    the body. If zero, no timeout is set.
+
+--entrypoints.<name>.transport.respondingtimeouts.writetimeout  (Default: "0")
+    WriteTimeout is the maximum duration before timing out writes of the response.
+    If zero, no timeout is set.
+
+--global.checknewversion  (Default: "true")
+    Periodically check if a new version has been released.
+
+--global.debug  (Default: "false")
+    Enable debug mode.
+
+--global.sendanonymoususage
+    Periodically send anonymous usage statistics. If the option is not specified, it
+    will be enabled by default.
+
+--hostresolver  (Default: "false")
+    Enable CNAME Flattening.
+
+--hostresolver.cnameflattening  (Default: "false")
+    A flag to enable/disable CNAME flattening
+
+--hostresolver.resolvconfig  (Default: "/etc/resolv.conf")
+    resolv.conf used for DNS resolving
+
+--hostresolver.resolvdepth  (Default: "5")
+    The maximal depth of DNS recursive resolving
+
+--log.filepath  (Default: "")
+    Traefik log file path. Stdout is used when omitted or empty.
+
+--log.format  (Default: "common")
+    Traefik log format: json | common
+
+--log.level  (Default: "ERROR")
+    Log level set to traefik logs.
+
+--metrics.datadog  (Default: "false")
+    DataDog metrics exporter type.
+
+--metrics.datadog.address  (Default: "localhost:8125")
+    DataDog's address.
+
+--metrics.datadog.pushinterval  (Default: "10")
+    DataDog push interval.
+
+--metrics.influxdb  (Default: "false")
+    InfluxDB metrics exporter type.
+
+--metrics.influxdb.address  (Default: "localhost:8089")
+    InfluxDB address.
+
+--metrics.influxdb.database  (Default: "")
+    InfluxDB database used when protocol is http.
+
+--metrics.influxdb.password  (Default: "")
+    InfluxDB password (only with http).
+
+--metrics.influxdb.protocol  (Default: "udp")
+    InfluxDB address protocol (udp or http).
+
+--metrics.influxdb.pushinterval  (Default: "10")
+    InfluxDB push interval.
+
+--metrics.influxdb.retentionpolicy  (Default: "")
+    InfluxDB retention policy used when protocol is http.
+
+--metrics.influxdb.username  (Default: "")
+    InfluxDB username (only with http).
+
+--metrics.prometheus  (Default: "false")
+    Prometheus metrics exporter type.
+
+--metrics.prometheus.buckets  (Default: "0.100000, 0.300000, 1.200000, 5.000000")
+    Buckets for latency metrics.
+
+--metrics.prometheus.entrypoint  (Default: "traefik")
+    EntryPoint.
+
+--metrics.prometheus.middlewares  (Default: "")
+    Middlewares.
+
+--metrics.statsd  (Default: "false")
+    StatsD metrics exporter type.
+
+--metrics.statsd.address  (Default: "localhost:8125")
+    StatsD address.
+
+--metrics.statsd.pushinterval  (Default: "10")
+    StatsD push interval.
+
+--ping  (Default: "false")
+    Enable ping.
+
+--ping.entrypoint  (Default: "traefik")
+    Ping entryPoint.
+
+--ping.middlewares  (Default: "")
+    Middleware list.
+
+--providers.docker  (Default: "false")
+    Enable Docker backend with default settings.
+
+--providers.docker.constraints  (Default: "")
+    Filter services by constraint, matching with Traefik tags.
+
+--providers.docker.constraints[n].key  (Default: "")
+    The provider label that will be matched against. In practice, it is always
+    'tag'.
+
+--providers.docker.constraints[n].mustmatch  (Default: "false")
+    Whether the matching operator is equals or not equals.
+
+--providers.docker.constraints[n].value  (Default: "")
+    The value that will be matched against.
+
+--providers.docker.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
+    Default rule.
+
+--providers.docker.endpoint  (Default: "unix:///var/run/docker.sock")
+    Docker server endpoint. Can be a tcp or a unix socket endpoint.
+
+--providers.docker.exposedbydefault  (Default: "true")
+    Expose containers by default.
+
+--providers.docker.network  (Default: "")
+    Default Docker network used.
+
+--providers.docker.swarmmode  (Default: "false")
+    Use Docker on Swarm Mode.
+
+--providers.docker.swarmmoderefreshseconds  (Default: "15")
+    Polling interval for swarm mode.
+
+--providers.docker.tls.ca  (Default: "")
+    TLS CA
+
+--providers.docker.tls.caoptional  (Default: "false")
+    TLS CA.Optional
+
+--providers.docker.tls.cert  (Default: "")
+    TLS cert
+
+--providers.docker.tls.insecureskipverify  (Default: "false")
+    TLS insecure skip verify
+
+--providers.docker.tls.key  (Default: "")
+    TLS key
+
+--providers.docker.usebindportip  (Default: "false")
+    Use the ip address from the bound port, rather than from the inner network.
+
+--providers.docker.watch  (Default: "true")
+    Watch provider.
+
+--providers.file  (Default: "false")
+    Enable File backend with default settings.
+
+--providers.file.debugloggeneratedtemplate  (Default: "false")
+    Enable debug logging of generated configuration template.
+
+--providers.file.directory  (Default: "")
+    Load configuration from one or more .toml files in a directory.
+
+--providers.file.filename  (Default: "")
+    Override default configuration template. For advanced users :)
+
+--providers.file.watch  (Default: "true")
+    Watch provider.
+
+--providers.kubernetes  (Default: "false")
+    Enable Kubernetes backend with default settings.
+
+--providers.kubernetes.certauthfilepath  (Default: "")
+    Kubernetes certificate authority file path (not needed for in-cluster client).
+
+--providers.kubernetes.disablepasshostheaders  (Default: "false")
+    Kubernetes disable PassHost Headers.
+
+--providers.kubernetes.endpoint  (Default: "")
+    Kubernetes server endpoint (required for external cluster client).
+
+--providers.kubernetes.ingressclass  (Default: "")
+    Value of kubernetes.io/ingress.class annotation to watch for.
+
+--providers.kubernetes.ingressendpoint.hostname  (Default: "")
+    Hostname used for Kubernetes Ingress endpoints.
+
+--providers.kubernetes.ingressendpoint.ip  (Default: "")
+    IP used for Kubernetes Ingress endpoints.
+
+--providers.kubernetes.ingressendpoint.publishedservice  (Default: "")
+    Published Kubernetes Service to copy status from.
+
+--providers.kubernetes.labelselector  (Default: "")
+    Kubernetes Ingress label selector to use.
+
+--providers.kubernetes.namespaces  (Default: "")
+    Kubernetes namespaces.
+
+--providers.kubernetes.token  (Default: "")
+    Kubernetes bearer token (not needed for in-cluster client).
+
+--providers.kubernetescrd  (Default: "false")
+    Enable Kubernetes backend with default settings.
+
+--providers.kubernetescrd.certauthfilepath  (Default: "")
+    Kubernetes certificate authority file path (not needed for in-cluster client).
+
+--providers.kubernetescrd.disablepasshostheaders  (Default: "false")
+    Kubernetes disable PassHost Headers.
+
+--providers.kubernetescrd.endpoint  (Default: "")
+    Kubernetes server endpoint (required for external cluster client).
+
+--providers.kubernetescrd.ingressclass  (Default: "")
+    Value of kubernetes.io/ingress.class annotation to watch for.
+
+--providers.kubernetescrd.labelselector  (Default: "")
+    Kubernetes label selector to use.
+
+--providers.kubernetescrd.namespaces  (Default: "")
+    Kubernetes namespaces.
+
+--providers.kubernetescrd.token  (Default: "")
+    Kubernetes bearer token (not needed for in-cluster client).
+
+--providers.marathon  (Default: "false")
+    Enable Marathon backend with default settings.
+
+--providers.marathon.basic.httpbasicauthuser  (Default: "")
+    Basic authentication User.
+
+--providers.marathon.basic.httpbasicpassword  (Default: "")
+    Basic authentication Password.
+
+--providers.marathon.constraints  (Default: "")
+    Filter services by constraint, matching with Traefik tags.
+
+--providers.marathon.constraints[n].key  (Default: "")
+    The provider label that will be matched against. In practice, it is always
+    'tag'.
+
+--providers.marathon.constraints[n].mustmatch  (Default: "false")
+    Whether the matching operator is equals or not equals.
+
+--providers.marathon.constraints[n].value  (Default: "")
+    The value that will be matched against.
+
+--providers.marathon.dcostoken  (Default: "")
+    DCOSToken for DCOS environment, This will override the Authorization header.
+
+--providers.marathon.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
+    Default rule.
+
+--providers.marathon.dialertimeout  (Default: "5")
+    Set a dialer timeout for Marathon.
+
+--providers.marathon.endpoint  (Default: "http://127.0.0.1:8080")
+    Marathon server endpoint. You can also specify multiple endpoint for Marathon.
+
+--providers.marathon.exposedbydefault  (Default: "true")
+    Expose Marathon apps by default.
+
+--providers.marathon.filtermarathonconstraints  (Default: "false")
+    Enable use of Marathon constraints in constraint filtering.
+
+--providers.marathon.forcetaskhostname  (Default: "false")
+    Force to use the task's hostname.
+
+--providers.marathon.keepalive  (Default: "10")
+    Set a TCP Keep Alive time.
+
+--providers.marathon.respectreadinesschecks  (Default: "false")
+    Filter out tasks with non-successful readiness checks during deployments.
+
+--providers.marathon.responseheadertimeout  (Default: "60")
+    Set a response header timeout for Marathon.
+
+--providers.marathon.tls.ca  (Default: "")
+    TLS CA
+
+--providers.marathon.tls.caoptional  (Default: "false")
+    TLS CA.Optional
+
+--providers.marathon.tls.cert  (Default: "")
+    TLS cert
+
+--providers.marathon.tls.insecureskipverify  (Default: "false")
+    TLS insecure skip verify
+
+--providers.marathon.tls.key  (Default: "")
+    TLS key
+
+--providers.marathon.tlshandshaketimeout  (Default: "5")
+    Set a TLS handshake timeout for Marathon.
+
+--providers.marathon.trace  (Default: "false")
+    Display additional provider logs.
+
+--providers.marathon.watch  (Default: "true")
+    Watch provider.
+
+--providers.providersthrottleduration  (Default: "2")
+    Backends throttle duration: minimum duration between 2 events from providers
+    before applying a new configuration. It avoids unnecessary reloads if multiples
+    events are sent in a short amount of time.
+
+--providers.rancher  (Default: "false")
+    Enable Rancher backend with default settings.
+
+--providers.rancher.constraints  (Default: "")
+    Filter services by constraint, matching with Traefik tags.
+
+--providers.rancher.constraints[n].key  (Default: "")
+    The provider label that will be matched against. In practice, it is always
+    'tag'.
+
+--providers.rancher.constraints[n].mustmatch  (Default: "false")
+    Whether the matching operator is equals or not equals.
+
+--providers.rancher.constraints[n].value  (Default: "")
+    The value that will be matched against.
+
+--providers.rancher.defaultrule  (Default: "Host(`{{ normalize .Name }}`)")
+    Default rule.
+
+--providers.rancher.enableservicehealthfilter  (Default: "true")
+    Filter services with unhealthy states and inactive states.
+
+--providers.rancher.exposedbydefault  (Default: "true")
+    Expose containers by default.
+
+--providers.rancher.intervalpoll  (Default: "false")
+    Poll the Rancher metadata service every 'rancher.refreshseconds' (less
+    accurate).
+
+--providers.rancher.prefix  (Default: "latest")
+    Prefix used for accessing the Rancher metadata service.
+
+--providers.rancher.refreshseconds  (Default: "15")
+    Defines the polling interval in seconds.
+
+--providers.rancher.watch  (Default: "true")
+    Watch provider.
+
+--providers.rest  (Default: "false")
+    Enable Rest backend with default settings.
+
+--providers.rest.entrypoint  (Default: "traefik")
+    EntryPoint.
+
+--serverstransport.forwardingtimeouts.dialtimeout  (Default: "30")
+    The amount of time to wait until a connection to a backend server can be
+    established. If zero, no timeout exists.
+
+--serverstransport.forwardingtimeouts.responseheadertimeout  (Default: "0")
+    The amount of time to wait for a server's response headers after fully writing
+    the request (including its body, if any). If zero, no timeout exists.
+
+--serverstransport.insecureskipverify  (Default: "false")
+    Disable SSL certificate verification.
+
+--serverstransport.maxidleconnsperhost  (Default: "200")
+    If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero,
+    DefaultMaxIdleConnsPerHost is used
+
+--serverstransport.rootcas  (Default: "")
+    Add cert file for self-signed certificate.
+
+--tracing  (Default: "false")
+    OpenTracing configuration.
+
+--tracing.backend  (Default: "jaeger")
+    Selects the tracking backend ('jaeger','zipkin','datadog','instana').
+
+--tracing.datadog  (Default: "false")
+    Settings for DataDog.
+
+--tracing.datadog.bagageprefixheadername  (Default: "")
+    Specifies the header name prefix that will be used to store baggage items in a
+    map.
+
+--tracing.datadog.debug  (Default: "false")
+    Enable DataDog debug.
+
+--tracing.datadog.globaltag  (Default: "")
+    Key:Value tag to be set on all the spans.
+
+--tracing.datadog.localagenthostport  (Default: "localhost:8126")
+    Set datadog-agent's host:port that the reporter will used.
+
+--tracing.datadog.parentidheadername  (Default: "")
+    Specifies the header name that will be used to store the parent ID.
+
+--tracing.datadog.prioritysampling  (Default: "false")
+    Enable priority sampling. When using distributed tracing, this option must be
+    enabled in order to get all the parts of a distributed trace sampled.
+
+--tracing.datadog.samplingpriorityheadername  (Default: "")
+    Specifies the header name that will be used to store the sampling priority.
+
+--tracing.datadog.traceidheadername  (Default: "")
+    Specifies the header name that will be used to store the trace ID.
+
+--tracing.haystack  (Default: "false")
+    Settings for Haystack.
+
+--tracing.haystack.baggageprefixheadername  (Default: "")
+    specifies the header name prefix that will be used to store baggage items in a
+    map.
+
+--tracing.haystack.globaltag  (Default: "")
+    Key:Value tag to be set on all the spans.
+
+--tracing.haystack.localagenthost  (Default: "LocalAgentHost")
+    Set haystack-agent's host that the reporter will used.
+
+--tracing.haystack.localagentport  (Default: "35000")
+    Set haystack-agent's port that the reporter will used.
+
+--tracing.haystack.parentidheadername  (Default: "")
+    Specifies the header name that will be used to store the parent ID.
+
+--tracing.haystack.spanidheadername  (Default: "")
+    Specifies the header name that will be used to store the span ID.
+
+--tracing.haystack.traceidheadername  (Default: "")
+    Specifies the header name that will be used to store the trace ID.
+
+--tracing.instana  (Default: "false")
+    Settings for Instana.
+
+--tracing.instana.localagenthost  (Default: "localhost")
+    Set instana-agent's host that the reporter will used.
+
+--tracing.instana.localagentport  (Default: "42699")
+    Set instana-agent's port that the reporter will used.
+
+--tracing.instana.loglevel  (Default: "info")
+    Set instana-agent's log level. ('error','warn','info','debug')
+
+--tracing.jaeger  (Default: "false")
+    Settings for jaeger.
+
+--tracing.jaeger.gen128bit  (Default: "false")
+    Generate 128 bit span IDs.
+
+--tracing.jaeger.localagenthostport  (Default: "127.0.0.1:6831")
+    Set jaeger-agent's host:port that the reporter will used.
+
+--tracing.jaeger.propagation  (Default: "jaeger")
+    Which propgation format to use (jaeger/b3).
+
+--tracing.jaeger.samplingparam  (Default: "1.000000")
+    Set the sampling parameter.
+
+--tracing.jaeger.samplingserverurl  (Default: "http://localhost:5778/sampling")
+    Set the sampling server url.
+
+--tracing.jaeger.samplingtype  (Default: "const")
+    Set the sampling type.
+
+--tracing.jaeger.tracecontextheadername  (Default: "uber-trace-id")
+    Set the header to use for the trace-id.
+
+--tracing.servicename  (Default: "traefik")
+    Set the name for this service.
+
+--tracing.spannamelimit  (Default: "0")
+    Set the maximum character limit for Span names (default 0 = no limit).
+
+--tracing.zipkin  (Default: "false")
+    Settings for zipkin.
+
+--tracing.zipkin.debug  (Default: "false")
+    Enable Zipkin debug.
+
+--tracing.zipkin.httpendpoint  (Default: "http://localhost:9411/api/v1/spans")
+    HTTP Endpoint to report traces to.
+
+--tracing.zipkin.id128bit  (Default: "true")
+    Use Zipkin 128 bit root span IDs.
+
+--tracing.zipkin.samespan  (Default: "false")
+    Use Zipkin SameSpan RPC style traces.
+
+--tracing.zipkin.samplerate  (Default: "1.000000")
+    The rate between 0.0 and 1.0 of requests to trace.
--- a/docs/content/reference/static-configuration/env.md
+++ b/docs/content/reference/static-configuration/env.md
@@ -0,0 +1,616 @@
+# Static Configuration: Environment variables
+
+`TRAEFIK_ACCESSLOG`:  
+Access log settings. (Default: ```false```)
+
+`TRAEFIK_ACCESSLOG_BUFFERINGSIZE`:  
+Number of access log lines to process in a buffered way. (Default: ```0```)
+
+`TRAEFIK_ACCESSLOG_FIELDS_DEFAULTMODE`:  
+Default mode for fields: keep | drop (Default: ```keep```)
+
+`TRAEFIK_ACCESSLOG_FIELDS_HEADERS_DEFAULTMODE`:  
+Default mode for fields: keep | drop | redact (Default: ```keep```)
+
+`TRAEFIK_ACCESSLOG_FIELDS_HEADERS_NAMES_<NAME>`:  
+Override mode for headers
+
+`TRAEFIK_ACCESSLOG_FIELDS_NAMES_<NAME>`:  
+Override mode for fields
+
+`TRAEFIK_ACCESSLOG_FILEPATH`:  
+Access log file path. Stdout is used when omitted or empty.
+
+`TRAEFIK_ACCESSLOG_FILTERS_MINDURATION`:  
+Keep access logs when request took longer than the specified duration. (Default: ```0```)
+
+`TRAEFIK_ACCESSLOG_FILTERS_RETRYATTEMPTS`:  
+Keep access logs when at least one retry happened. (Default: ```false```)
+
+`TRAEFIK_ACCESSLOG_FILTERS_STATUSCODES`:  
+Keep access logs with status codes in the specified range.
+
+`TRAEFIK_ACCESSLOG_FORMAT`:  
+Access log format: json | common (Default: ```common```)
+
+`TRAEFIK_ACME_ACMELOGGING`:  
+Enable debug logging of ACME actions. (Default: ```false```)
+
+`TRAEFIK_ACME_CASERVER`:  
+CA server to use. (Default: ```https://acme-v02.api.letsencrypt.org/directory```)
+
+`TRAEFIK_ACME_DNSCHALLENGE`:  
+Activate DNS-01 Challenge. (Default: ```false```)
+
+`TRAEFIK_ACME_DNSCHALLENGE_DELAYBEFORECHECK`:  
+Assume DNS propagates after a delay in seconds rather than finding and querying nameservers. (Default: ```0```)
+
+`TRAEFIK_ACME_DNSCHALLENGE_DISABLEPROPAGATIONCHECK`:  
+Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready. [not recommended] (Default: ```false```)
+
+`TRAEFIK_ACME_DNSCHALLENGE_PROVIDER`:  
+Use a DNS-01 based challenge provider rather than HTTPS.
+
+`TRAEFIK_ACME_DNSCHALLENGE_RESOLVERS`:  
+Use following DNS servers to resolve the FQDN authority.
+
+`TRAEFIK_ACME_DOMAINS`:  
+The list of domains for which certificates are generated on startup. Wildcard domains only accepted with DNSChallenge.
+
+`TRAEFIK_ACME_DOMAINS[n]_MAIN`:  
+Default subject name.
+
+`TRAEFIK_ACME_DOMAINS[n]_SANS`:  
+Subject alternative names.
+
+`TRAEFIK_ACME_EMAIL`:  
+Email address used for registration.
+
+`TRAEFIK_ACME_ENTRYPOINT`:  
+EntryPoint to use.
+
+`TRAEFIK_ACME_HTTPCHALLENGE`:  
+Activate HTTP-01 Challenge. (Default: ```false```)
+
+`TRAEFIK_ACME_HTTPCHALLENGE_ENTRYPOINT`:  
+HTTP challenge EntryPoint
+
+`TRAEFIK_ACME_KEYTYPE`:  
+KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. (Default: ```RSA4096```)
+
+`TRAEFIK_ACME_ONHOSTRULE`:  
+Enable certificate generation on router Host rules. (Default: ```false```)
+
+`TRAEFIK_ACME_STORAGE`:  
+Storage to use. (Default: ```acme.json```)
+
+`TRAEFIK_ACME_TLSCHALLENGE`:  
+Activate TLS-ALPN-01 Challenge. (Default: ```true```)
+
+`TRAEFIK_API`:  
+Enable api/dashboard. (Default: ```false```)
+
+`TRAEFIK_API_DASHBOARD`:  
+Activate dashboard. (Default: ```true```)
+
+`TRAEFIK_API_ENTRYPOINT`:  
+EntryPoint. (Default: ```traefik```)
+
+`TRAEFIK_API_MIDDLEWARES`:  
+Middleware list.
+
+`TRAEFIK_API_STATISTICS`:  
+Enable more detailed statistics. (Default: ```false```)
+
+`TRAEFIK_API_STATISTICS_RECENTERRORS`:  
+Number of recent errors logged. (Default: ```10```)
+
+`TRAEFIK_CONFIGFILE`:  
+Configuration file to use. If specified all other flags are ignored. (Default: "")
+
+`TRAEFIK_ENTRYPOINTS_<NAME>`:  
+Entry points definition. (Default: ```false```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_ADDRESS`:  
+Entry point address.
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_FORWARDEDHEADERS_INSECURE`:  
+Trust all forwarded headers. (Default: ```false```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_FORWARDEDHEADERS_TRUSTEDIPS`:  
+Trust only forwarded headers from selected IPs.
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_PROXYPROTOCOL`:  
+Proxy-Protocol configuration. (Default: ```false```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_PROXYPROTOCOL_INSECURE`:  
+Trust all. (Default: ```false```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_PROXYPROTOCOL_TRUSTEDIPS`:  
+Trust only selected IPs.
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_LIFECYCLE_GRACETIMEOUT`:  
+Duration to give active requests a chance to finish before Traefik stops. (Default: ```10```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_LIFECYCLE_REQUESTACCEPTGRACETIMEOUT`:  
+Duration to keep accepting requests before Traefik initiates the graceful shutdown procedure. (Default: ```0```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_IDLETIMEOUT`:  
+IdleTimeout is the maximum amount duration an idle (keep-alive) connection will remain idle before closing itself. If zero, no timeout is set. (Default: ```180```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_READTIMEOUT`:  
+ReadTimeout is the maximum duration for reading the entire request, including the body. If zero, no timeout is set. (Default: ```0```)
+
+`TRAEFIK_ENTRYPOINTS_<NAME>_TRANSPORT_RESPONDINGTIMEOUTS_WRITETIMEOUT`:  
+WriteTimeout is the maximum duration before timing out writes of the response. If zero, no timeout is set. (Default: ```0```)
+
+`TRAEFIK_GLOBAL_CHECKNEWVERSION`:  
+Periodically check if a new version has been released. (Default: ```false```)
+
+`TRAEFIK_GLOBAL_DEBUG`:  
+Enable debug mode. (Default: ```false```)
+
+`TRAEFIK_GLOBAL_SENDANONYMOUSUSAGE`:  
+Periodically send anonymous usage statistics. If the option is not specified, it will be enabled by default.
+
+`TRAEFIK_HOSTRESOLVER`:  
+Enable CNAME Flattening. (Default: ```false```)
+
+`TRAEFIK_HOSTRESOLVER_CNAMEFLATTENING`:  
+A flag to enable/disable CNAME flattening (Default: ```false```)
+
+`TRAEFIK_HOSTRESOLVER_RESOLVCONFIG`:  
+resolv.conf used for DNS resolving (Default: ```/etc/resolv.conf```)
+
+`TRAEFIK_HOSTRESOLVER_RESOLVDEPTH`:  
+The maximal depth of DNS recursive resolving (Default: ```5```)
+
+`TRAEFIK_LOG_FILEPATH`:  
+Traefik log file path. Stdout is used when omitted or empty.
+
+`TRAEFIK_LOG_FORMAT`:  
+Traefik log format: json | common (Default: ```common```)
+
+`TRAEFIK_LOG_LEVEL`:  
+Log level set to traefik logs. (Default: ```ERROR```)
+
+`TRAEFIK_METRICS_DATADOG`:  
+DataDog metrics exporter type. (Default: ```false```)
+
+`TRAEFIK_METRICS_DATADOG_ADDRESS`:  
+DataDog's address. (Default: ```localhost:8125```)
+
+`TRAEFIK_METRICS_DATADOG_PUSHINTERVAL`:  
+DataDog push interval. (Default: ```10```)
+
+`TRAEFIK_METRICS_INFLUXDB`:  
+InfluxDB metrics exporter type. (Default: ```false```)
+
+`TRAEFIK_METRICS_INFLUXDB_ADDRESS`:  
+InfluxDB address. (Default: ```localhost:8089```)
+
+`TRAEFIK_METRICS_INFLUXDB_DATABASE`:  
+InfluxDB database used when protocol is http.
+
+`TRAEFIK_METRICS_INFLUXDB_PASSWORD`:  
+InfluxDB password (only with http).
+
+`TRAEFIK_METRICS_INFLUXDB_PROTOCOL`:  
+InfluxDB address protocol (udp or http). (Default: ```udp```)
+
+`TRAEFIK_METRICS_INFLUXDB_PUSHINTERVAL`:  
+InfluxDB push interval. (Default: ```10```)
+
+`TRAEFIK_METRICS_INFLUXDB_RETENTIONPOLICY`:  
+InfluxDB retention policy used when protocol is http.
+
+`TRAEFIK_METRICS_INFLUXDB_USERNAME`:  
+InfluxDB username (only with http).
+
+`TRAEFIK_METRICS_PROMETHEUS`:  
+Prometheus metrics exporter type. (Default: ```false```)
+
+`TRAEFIK_METRICS_PROMETHEUS_BUCKETS`:  
+Buckets for latency metrics. (Default: ```0.100000, 0.300000, 1.200000, 5.000000```)
+
+`TRAEFIK_METRICS_PROMETHEUS_ENTRYPOINT`:  
+EntryPoint. (Default: ```traefik```)
+
+`TRAEFIK_METRICS_PROMETHEUS_MIDDLEWARES`:  
+Middlewares.
+
+`TRAEFIK_METRICS_STATSD`:  
+StatsD metrics exporter type. (Default: ```false```)
+
+`TRAEFIK_METRICS_STATSD_ADDRESS`:  
+StatsD address. (Default: ```localhost:8125```)
+
+`TRAEFIK_METRICS_STATSD_PUSHINTERVAL`:  
+StatsD push interval. (Default: ```10```)
+
+`TRAEFIK_PING`:  
+Enable ping. (Default: ```false```)
+
+`TRAEFIK_PING_ENTRYPOINT`:  
+Ping entryPoint. (Default: ```traefik```)
+
+`TRAEFIK_PING_MIDDLEWARES`:  
+Middleware list.
+
+`TRAEFIK_PROVIDERS_DOCKER`:  
+Enable Docker backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_CONSTRAINTS`:  
+Filter services by constraint, matching with Traefik tags.
+
+`TRAEFIK_PROVIDERS_DOCKER_CONSTRAINTS[n]_KEY`:  
+The provider label that will be matched against. In practice, it is always 'tag'.
+
+`TRAEFIK_PROVIDERS_DOCKER_CONSTRAINTS[n]_MUSTMATCH`:  
+Whether the matching operator is equals or not equals. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_CONSTRAINTS[n]_VALUE`:  
+The value that will be matched against.
+
+`TRAEFIK_PROVIDERS_DOCKER_DEFAULTRULE`:  
+Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
+
+`TRAEFIK_PROVIDERS_DOCKER_ENDPOINT`:  
+Docker server endpoint. Can be a tcp or a unix socket endpoint. (Default: ```unix:///var/run/docker.sock```)
+
+`TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT`:  
+Expose containers by default. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_DOCKER_NETWORK`:  
+Default Docker network used.
+
+`TRAEFIK_PROVIDERS_DOCKER_SWARMMODE`:  
+Use Docker on Swarm Mode. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_SWARMMODEREFRESHSECONDS`:  
+Polling interval for swarm mode. (Default: ```15```)
+
+`TRAEFIK_PROVIDERS_DOCKER_TLS_CA`:  
+TLS CA
+
+`TRAEFIK_PROVIDERS_DOCKER_TLS_CAOPTIONAL`:  
+TLS CA.Optional (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_TLS_CERT`:  
+TLS cert
+
+`TRAEFIK_PROVIDERS_DOCKER_TLS_INSECURESKIPVERIFY`:  
+TLS insecure skip verify (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_TLS_KEY`:  
+TLS key
+
+`TRAEFIK_PROVIDERS_DOCKER_USEBINDPORTIP`:  
+Use the ip address from the bound port, rather than from the inner network. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_DOCKER_WATCH`:  
+Watch provider. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_FILE`:  
+Enable File backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_FILE_DEBUGLOGGENERATEDTEMPLATE`:  
+Enable debug logging of generated configuration template. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_FILE_DIRECTORY`:  
+Load configuration from one or more .toml files in a directory.
+
+`TRAEFIK_PROVIDERS_FILE_FILENAME`:  
+Override default configuration template. For advanced users :)
+
+`TRAEFIK_PROVIDERS_FILE_WATCH`:  
+Watch provider. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_KUBERNETES`:  
+Enable Kubernetes backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD`:  
+Enable Kubernetes backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_CERTAUTHFILEPATH`:  
+Kubernetes certificate authority file path (not needed for in-cluster client).
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_DISABLEPASSHOSTHEADERS`:  
+Kubernetes disable PassHost Headers. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_ENDPOINT`:  
+Kubernetes server endpoint (required for external cluster client).
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_INGRESSCLASS`:  
+Value of kubernetes.io/ingress.class annotation to watch for.
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_LABELSELECTOR`:  
+Kubernetes label selector to use.
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_NAMESPACES`:  
+Kubernetes namespaces.
+
+`TRAEFIK_PROVIDERS_KUBERNETESCRD_TOKEN`:  
+Kubernetes bearer token (not needed for in-cluster client).
+
+`TRAEFIK_PROVIDERS_KUBERNETES_CERTAUTHFILEPATH`:  
+Kubernetes certificate authority file path (not needed for in-cluster client).
+
+`TRAEFIK_PROVIDERS_KUBERNETES_DISABLEPASSHOSTHEADERS`:  
+Kubernetes disable PassHost Headers. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_KUBERNETES_ENDPOINT`:  
+Kubernetes server endpoint (required for external cluster client).
+
+`TRAEFIK_PROVIDERS_KUBERNETES_INGRESSCLASS`:  
+Value of kubernetes.io/ingress.class annotation to watch for.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_INGRESSENDPOINT_HOSTNAME`:  
+Hostname used for Kubernetes Ingress endpoints.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_INGRESSENDPOINT_IP`:  
+IP used for Kubernetes Ingress endpoints.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_INGRESSENDPOINT_PUBLISHEDSERVICE`:  
+Published Kubernetes Service to copy status from.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_LABELSELECTOR`:  
+Kubernetes Ingress label selector to use.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_NAMESPACES`:  
+Kubernetes namespaces.
+
+`TRAEFIK_PROVIDERS_KUBERNETES_TOKEN`:  
+Kubernetes bearer token (not needed for in-cluster client).
+
+`TRAEFIK_PROVIDERS_MARATHON`:  
+Enable Marathon backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_BASIC_HTTPBASICAUTHUSER`:  
+Basic authentication User.
+
+`TRAEFIK_PROVIDERS_MARATHON_BASIC_HTTPBASICPASSWORD`:  
+Basic authentication Password.
+
+`TRAEFIK_PROVIDERS_MARATHON_CONSTRAINTS`:  
+Filter services by constraint, matching with Traefik tags.
+
+`TRAEFIK_PROVIDERS_MARATHON_CONSTRAINTS[n]_KEY`:  
+The provider label that will be matched against. In practice, it is always 'tag'.
+
+`TRAEFIK_PROVIDERS_MARATHON_CONSTRAINTS[n]_MUSTMATCH`:  
+Whether the matching operator is equals or not equals. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_CONSTRAINTS[n]_VALUE`:  
+The value that will be matched against.
+
+`TRAEFIK_PROVIDERS_MARATHON_DCOSTOKEN`:  
+DCOSToken for DCOS environment, This will override the Authorization header.
+
+`TRAEFIK_PROVIDERS_MARATHON_DEFAULTRULE`:  
+Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
+
+`TRAEFIK_PROVIDERS_MARATHON_DIALERTIMEOUT`:  
+Set a dialer timeout for Marathon. (Default: ```5```)
+
+`TRAEFIK_PROVIDERS_MARATHON_ENDPOINT`:  
+Marathon server endpoint. You can also specify multiple endpoint for Marathon. (Default: ```http://127.0.0.1:8080```)
+
+`TRAEFIK_PROVIDERS_MARATHON_EXPOSEDBYDEFAULT`:  
+Expose Marathon apps by default. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_MARATHON_FILTERMARATHONCONSTRAINTS`:  
+Enable use of Marathon constraints in constraint filtering. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_FORCETASKHOSTNAME`:  
+Force to use the task's hostname. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_KEEPALIVE`:  
+Set a TCP Keep Alive time. (Default: ```10```)
+
+`TRAEFIK_PROVIDERS_MARATHON_RESPECTREADINESSCHECKS`:  
+Filter out tasks with non-successful readiness checks during deployments. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_RESPONSEHEADERTIMEOUT`:  
+Set a response header timeout for Marathon. (Default: ```60```)
+
+`TRAEFIK_PROVIDERS_MARATHON_TLSHANDSHAKETIMEOUT`:  
+Set a TLS handshake timeout for Marathon. (Default: ```5```)
+
+`TRAEFIK_PROVIDERS_MARATHON_TLS_CA`:  
+TLS CA
+
+`TRAEFIK_PROVIDERS_MARATHON_TLS_CAOPTIONAL`:  
+TLS CA.Optional (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_TLS_CERT`:  
+TLS cert
+
+`TRAEFIK_PROVIDERS_MARATHON_TLS_INSECURESKIPVERIFY`:  
+TLS insecure skip verify (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_TLS_KEY`:  
+TLS key
+
+`TRAEFIK_PROVIDERS_MARATHON_TRACE`:  
+Display additional provider logs. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_MARATHON_WATCH`:  
+Watch provider. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_PROVIDERSTHROTTLEDURATION`:  
+Backends throttle duration: minimum duration between 2 events from providers before applying a new configuration. It avoids unnecessary reloads if multiples events are sent in a short amount of time. (Default: ```0```)
+
+`TRAEFIK_PROVIDERS_RANCHER`:  
+Enable Rancher backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_RANCHER_CONSTRAINTS`:  
+Filter services by constraint, matching with Traefik tags.
+
+`TRAEFIK_PROVIDERS_RANCHER_CONSTRAINTS[n]_KEY`:  
+The provider label that will be matched against. In practice, it is always 'tag'.
+
+`TRAEFIK_PROVIDERS_RANCHER_CONSTRAINTS[n]_MUSTMATCH`:  
+Whether the matching operator is equals or not equals. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_RANCHER_CONSTRAINTS[n]_VALUE`:  
+The value that will be matched against.
+
+`TRAEFIK_PROVIDERS_RANCHER_DEFAULTRULE`:  
+Default rule. (Default: ```Host(`{{ normalize .Name }}`)```)
+
+`TRAEFIK_PROVIDERS_RANCHER_ENABLESERVICEHEALTHFILTER`:  
+Filter services with unhealthy states and inactive states. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_RANCHER_EXPOSEDBYDEFAULT`:  
+Expose containers by default. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_RANCHER_INTERVALPOLL`:  
+Poll the Rancher metadata service every 'rancher.refreshseconds' (less accurate). (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_RANCHER_PREFIX`:  
+Prefix used for accessing the Rancher metadata service. (Default: ```latest```)
+
+`TRAEFIK_PROVIDERS_RANCHER_REFRESHSECONDS`:  
+Defines the polling interval in seconds. (Default: ```15```)
+
+`TRAEFIK_PROVIDERS_RANCHER_WATCH`:  
+Watch provider. (Default: ```true```)
+
+`TRAEFIK_PROVIDERS_REST`:  
+Enable Rest backend with default settings. (Default: ```false```)
+
+`TRAEFIK_PROVIDERS_REST_ENTRYPOINT`:  
+EntryPoint. (Default: ```traefik```)
+
+`TRAEFIK_SERVERSTRANSPORT_FORWARDINGTIMEOUTS_DIALTIMEOUT`:  
+The amount of time to wait until a connection to a backend server can be established. If zero, no timeout exists. (Default: ```30```)
+
+`TRAEFIK_SERVERSTRANSPORT_FORWARDINGTIMEOUTS_RESPONSEHEADERTIMEOUT`:  
+The amount of time to wait for a server's response headers after fully writing the request (including its body, if any). If zero, no timeout exists. (Default: ```0```)
+
+`TRAEFIK_SERVERSTRANSPORT_INSECURESKIPVERIFY`:  
+Disable SSL certificate verification. (Default: ```false```)
+
+`TRAEFIK_SERVERSTRANSPORT_MAXIDLECONNSPERHOST`:  
+If non-zero, controls the maximum idle (keep-alive) to keep per-host. If zero, DefaultMaxIdleConnsPerHost is used (Default: ```0```)
+
+`TRAEFIK_SERVERSTRANSPORT_ROOTCAS`:  
+Add cert file for self-signed certificate.
+
+`TRAEFIK_TRACING`:  
+OpenTracing configuration. (Default: ```false```)
+
+`TRAEFIK_TRACING_BACKEND`:  
+Selects the tracking backend ('jaeger','zipkin','datadog','instana'). (Default: ```jaeger```)
+
+`TRAEFIK_TRACING_DATADOG`:  
+Settings for DataDog. (Default: ```false```)
+
+`TRAEFIK_TRACING_DATADOG_BAGAGEPREFIXHEADERNAME`:  
+Specifies the header name prefix that will be used to store baggage items in a map.
+
+`TRAEFIK_TRACING_DATADOG_DEBUG`:  
+Enable DataDog debug. (Default: ```false```)
+
+`TRAEFIK_TRACING_DATADOG_GLOBALTAG`:  
+Key:Value tag to be set on all the spans.
+
+`TRAEFIK_TRACING_DATADOG_LOCALAGENTHOSTPORT`:  
+Set datadog-agent's host:port that the reporter will used. (Default: ```localhost:8126```)
+
+`TRAEFIK_TRACING_DATADOG_PARENTIDHEADERNAME`:  
+Specifies the header name that will be used to store the parent ID.
+
+`TRAEFIK_TRACING_DATADOG_PRIORITYSAMPLING`:  
+Enable priority sampling. When using distributed tracing, this option must be enabled in order to get all the parts of a distributed trace sampled. (Default: ```false```)
+
+`TRAEFIK_TRACING_DATADOG_SAMPLINGPRIORITYHEADERNAME`:  
+Specifies the header name that will be used to store the sampling priority.
+
+`TRAEFIK_TRACING_DATADOG_TRACEIDHEADERNAME`:  
+Specifies the header name that will be used to store the trace ID.
+
+`TRAEFIK_TRACING_HAYSTACK`:  
+Settings for Haystack. (Default: ```false```)
+
+`TRAEFIK_TRACING_HAYSTACK_BAGGAGEPREFIXHEADERNAME`:  
+specifies the header name prefix that will be used to store baggage items in a map.
+
+`TRAEFIK_TRACING_HAYSTACK_GLOBALTAG`:  
+Key:Value tag to be set on all the spans.
+
+`TRAEFIK_TRACING_HAYSTACK_LOCALAGENTHOST`:  
+Set haystack-agent's host that the reporter will used. (Default: ```LocalAgentHost```)
+
+`TRAEFIK_TRACING_HAYSTACK_LOCALAGENTPORT`:  
+Set haystack-agent's port that the reporter will used. (Default: ```35000```)
+
+`TRAEFIK_TRACING_HAYSTACK_PARENTIDHEADERNAME`:  
+Specifies the header name that will be used to store the parent ID.
+
+`TRAEFIK_TRACING_HAYSTACK_SPANIDHEADERNAME`:  
+Specifies the header name that will be used to store the span ID.
+
+`TRAEFIK_TRACING_HAYSTACK_TRACEIDHEADERNAME`:  
+Specifies the header name that will be used to store the trace ID.
+
+`TRAEFIK_TRACING_INSTANA`:  
+Settings for Instana. (Default: ```false```)
+
+`TRAEFIK_TRACING_INSTANA_LOCALAGENTHOST`:  
+Set instana-agent's host that the reporter will used. (Default: ```localhost```)
+
+`TRAEFIK_TRACING_INSTANA_LOCALAGENTPORT`:  
+Set instana-agent's port that the reporter will used. (Default: ```42699```)
+
+`TRAEFIK_TRACING_INSTANA_LOGLEVEL`:  
+Set instana-agent's log level. ('error','warn','info','debug') (Default: ```info```)
+
+`TRAEFIK_TRACING_JAEGER`:  
+Settings for jaeger. (Default: ```false```)
+
+`TRAEFIK_TRACING_JAEGER_GEN128BIT`:  
+Generate 128 bit span IDs. (Default: ```false```)
+
+`TRAEFIK_TRACING_JAEGER_LOCALAGENTHOSTPORT`:  
+Set jaeger-agent's host:port that the reporter will used. (Default: ```127.0.0.1:6831```)
+
+`TRAEFIK_TRACING_JAEGER_PROPAGATION`:  
+Which propgation format to use (jaeger/b3). (Default: ```jaeger```)
+
+`TRAEFIK_TRACING_JAEGER_SAMPLINGPARAM`:  
+Set the sampling parameter. (Default: ```1.000000```)
+
+`TRAEFIK_TRACING_JAEGER_SAMPLINGSERVERURL`:  
+Set the sampling server url. (Default: ```http://localhost:5778/sampling```)
+
+`TRAEFIK_TRACING_JAEGER_SAMPLINGTYPE`:  
+Set the sampling type. (Default: ```const```)
+
+`TRAEFIK_TRACING_JAEGER_TRACECONTEXTHEADERNAME`:  
+Set the header to use for the trace-id. (Default: ```uber-trace-id```)
+
+`TRAEFIK_TRACING_SERVICENAME`:  
+Set the name for this service. (Default: ```traefik```)
+
+`TRAEFIK_TRACING_SPANNAMELIMIT`:  
+Set the maximum character limit for Span names (default 0 = no limit). (Default: ```0```)
+
+`TRAEFIK_TRACING_ZIPKIN`:  
+Settings for zipkin. (Default: ```false```)
+
+`TRAEFIK_TRACING_ZIPKIN_DEBUG`:  
+Enable Zipkin debug. (Default: ```false```)
+
+`TRAEFIK_TRACING_ZIPKIN_HTTPENDPOINT`:  
+HTTP Endpoint to report traces to. (Default: ```http://localhost:9411/api/v1/spans```)
+
+`TRAEFIK_TRACING_ZIPKIN_ID128BIT`:  
+Use Zipkin 128 bit root span IDs. (Default: ```true```)
+
+`TRAEFIK_TRACING_ZIPKIN_SAMESPAN`:  
+Use Zipkin SameSpan RPC style traces. (Default: ```false```)
+
+`TRAEFIK_TRACING_ZIPKIN_SAMPLERATE`:  
+The rate between 0.0 and 1.0 of requests to trace. (Default: ```1.000000```)
--- a/docs/content/reference/static-configuration/file.md
+++ b/docs/content/reference/static-configuration/file.md
@@ -0,0 +1,7 @@
+# Static Configuration: File
+
+## TOML
+
+```toml
+--8<-- "content/reference/static-configuration/file.toml"
+```
--- a/docs/content/reference/static-configuration/file.toml
+++ b/docs/content/reference/static-configuration/file.toml
@@ -0,0 +1,275 @@
+[Global]
+  Debug = true
+  CheckNewVersion = true
+  SendAnonymousUsage = true
+
+[ServersTransport]
+  InsecureSkipVerify = true
+  RootCAs = ["foobar", "foobar"]
+  MaxIdleConnsPerHost = 42
+  [ServersTransport.ForwardingTimeouts]
+    DialTimeout = 42
+    ResponseHeaderTimeout = 42
+
+[EntryPoints]
+
+  [EntryPoints.EntryPoint0]
+    Address = "foobar"
+    [EntryPoints.EntryPoint0.Transport]
+      [EntryPoints.EntryPoint0.Transport.LifeCycle]
+        RequestAcceptGraceTimeout = 42
+        GraceTimeOut = 42
+      [EntryPoints.EntryPoint0.Transport.RespondingTimeouts]
+        ReadTimeout = 42
+        WriteTimeout = 42
+        IdleTimeout = 42
+    [EntryPoints.EntryPoint0.ProxyProtocol]
+      Insecure = true
+      TrustedIPs = ["foobar", "foobar"]
+    [EntryPoints.EntryPoint0.ForwardedHeaders]
+      Insecure = true
+      TrustedIPs = ["foobar", "foobar"]
+
+[Providers]
+  ProvidersThrottleDuration = 42
+
+  [Providers.Docker]
+    Watch = true
+    Endpoint = "foobar"
+    DefaultRule = "foobar"
+    ExposedByDefault = true
+    UseBindPortIP = true
+    SwarmMode = true
+    Network = "foobar"
+    SwarmModeRefreshSeconds = 42
+
+    [[Providers.Docker.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+    [[Providers.Docker.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+    [Providers.Docker.TLS]
+      CA = "foobar"
+      CAOptional = true
+      Cert = "foobar"
+      Key = "foobar"
+      InsecureSkipVerify = true
+
+  [Providers.File]
+    Directory = "foobar"
+    Watch = true
+    Filename = "foobar"
+    DebugLogGeneratedTemplate = true
+    TraefikFile = "foobar"
+
+  [Providers.Marathon]
+    Trace = true
+    Watch = true
+    Endpoint = "foobar"
+    DefaultRule = "foobar"
+    ExposedByDefault = true
+    DCOSToken = "foobar"
+    FilterMarathonConstraints = true
+    DialerTimeout = 42
+    ResponseHeaderTimeout = 42
+    TLSHandshakeTimeout = 42
+    KeepAlive = 42
+    ForceTaskHostname = true
+    RespectReadinessChecks = true
+
+    [[Providers.Marathon.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+    [[Providers.Marathon.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+    [Providers.Marathon.TLS]
+      CA = "foobar"
+      CAOptional = true
+      Cert = "foobar"
+      Key = "foobar"
+      InsecureSkipVerify = true
+    [Providers.Marathon.Basic]
+      HTTPBasicAuthUser = "foobar"
+      HTTPBasicPassword = "foobar"
+
+  [Providers.Kubernetes]
+    Endpoint = "foobar"
+    Token = "foobar"
+    CertAuthFilePath = "foobar"
+    DisablePassHostHeaders = true
+    Namespaces = ["foobar", "foobar"]
+    LabelSelector = "foobar"
+    IngressClass = "foobar"
+    [Providers.Kubernetes.IngressEndpoint]
+      IP = "foobar"
+      Hostname = "foobar"
+      PublishedService = "foobar"
+
+  [Providers.KubernetesCRD]
+    Endpoint = "foobar"
+    Token = "foobar"
+    CertAuthFilePath = "foobar"
+    DisablePassHostHeaders = true
+    Namespaces = ["foobar", "foobar"]
+    LabelSelector = "foobar"
+    IngressClass = "foobar"
+
+  [Providers.Rest]
+    EntryPoint = "foobar"
+
+  [Providers.Rancher]
+    Watch = true
+    DefaultRule = "foobar"
+    ExposedByDefault = true
+    EnableServiceHealthFilter = true
+    RefreshSeconds = 42
+    IntervalPoll = true
+    Prefix = "foobar"
+
+    [[Providers.Rancher.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+    [[Providers.Rancher.Constraints]]
+      Key = "foobar"
+      MustMatch = true
+      Regex = "foobar"
+
+[API]
+  EntryPoint = "foobar"
+  Dashboard = true
+  Middlewares = ["foobar", "foobar"]
+  [API.Statistics]
+    RecentErrors = 42
+
+[Metrics]
+
+  [Metrics.Prometheus]
+    Buckets = [42.0, 42.0]
+    EntryPoint = "foobar"
+    Middlewares = ["foobar", "foobar"]
+
+  [Metrics.Datadog]
+    Address = "foobar"
+    PushInterval = "foobar"
+
+  [Metrics.StatsD]
+    Address = "foobar"
+    PushInterval = "foobar"
+
+  [Metrics.InfluxDB]
+    Address = "foobar"
+    Protocol = "foobar"
+    PushInterval = "foobar"
+    Database = "foobar"
+    RetentionPolicy = "foobar"
+    Username = "foobar"
+    Password = "foobar"
+
+[Ping]
+  EntryPoint = "foobar"
+  Middlewares = ["foobar", "foobar"]
+
+[Log]
+  Level = "foobar"
+  FilePath = "foobar"
+  Format = "foobar"
+
+[AccessLog]
+  FilePath = "foobar"
+  Format = "foobar"
+  BufferingSize = 42
+  [AccessLog.Filters]
+    StatusCodes = ["foobar", "foobar"]
+    RetryAttempts = true
+    MinDuration = 42
+  [AccessLog.Fields]
+    DefaultMode = "foobar"
+    [AccessLog.Fields.Names]
+      name0 = "foobar"
+      name1 = "foobar"
+    [AccessLog.Fields.Headers]
+      DefaultMode = "foobar"
+      [AccessLog.Fields.Headers.Names]
+        name0 = "foobar"
+        name1 = "foobar"
+
+[Tracing]
+  Backend = "foobar"
+  ServiceName = "foobar"
+  SpanNameLimit = 42
+
+  [Tracing.Jaeger]
+    SamplingServerURL = "foobar"
+    SamplingType = "foobar"
+    SamplingParam = 42.0
+    LocalAgentHostPort = "foobar"
+    Gen128Bit = true
+    Propagation = "foobar"
+    TraceContextHeaderName = "foobar"
+
+  [Tracing.Zipkin]
+    HTTPEndpoint = "foobar"
+    SameSpan = true
+    ID128Bit = true
+    Debug = true
+    SampleRate = 42.0
+
+  [Tracing.DataDog]
+    LocalAgentHostPort = "foobar"
+    GlobalTag = "foobar"
+    Debug = true
+    PrioritySampling = true
+    TraceIDHeaderName = "foobar"
+    ParentIDHeaderName = "foobar"
+    SamplingPriorityHeaderName = "foobar"
+    BagagePrefixHeaderName = "foobar"
+
+  [Tracing.Instana]
+    LocalAgentHost = "foobar"
+    LocalAgentPort = 42
+    LogLevel = "foobar"
+
+[HostResolver]
+  CnameFlattening = true
+  ResolvConfig = "foobar"
+  ResolvDepth = 42
+
+[ACME]
+  Email = "foobar"
+  ACMELogging = true
+  CAServer = "foobar"
+  Storage = "foobar"
+  EntryPoint = "foobar"
+  KeyType = "foobar"
+  OnHostRule = true
+
+  [ACME.DNSChallenge]
+    Provider = "foobar"
+    DelayBeforeCheck = 42
+    Resolvers = ["foobar", "foobar"]
+    DisablePropagationCheck = true
+
+  [ACME.HTTPChallenge]
+    EntryPoint = "foobar"
+
+  [ACME.TLSChallenge]
+
+  [[ACME.Domains]]
+    Main = "foobar"
+    SANs = ["foobar", "foobar"]
+
+  [[ACME.Domains]]
+    Main = "foobar"
+    SANs = ["foobar", "foobar"]
--- a/docs/content/reference/static-configuration/overview.md
+++ b/docs/content/reference/static-configuration/overview.md
@@ -0,0 +1,5 @@
+# Static Configuration
+
+- [File](./file.md)
+- [CLI](./cli.md)
+- [Environment Variables](./env.md)
--- a/docs/content/routing/entrypoints.md
+++ b/docs/content/routing/entrypoints.md
@@ -1,11 +1,11 @@
 # EntryPoints

-Opening Connections for Incomming Requests
+Opening Connections for Incoming Requests
 {: .subtitle }

 ![EntryPoints](../assets/img/entrypoints.png)

-Entrypoints are the network entry points into Traefik.
+EntryPoints are the network entry points into Traefik.
 They define the port which will receive the requests (whether HTTP or TCP).

 ## Configuration Examples
@@ -13,8 +13,8 @@ They define the port which will receive the requests (whether HTTP or TCP).
 ??? example "Port 80 only"

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
         address = ":80"
    ```

@@ -23,17 +23,12 @@ They define the port which will receive the requests (whether HTTP or TCP).
 ??? example "Port 80 & 443" 

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
    
-      [entrypoints.web-secure]
+      [entryPoints.web-secure]
        address = ":443"
-        
-        [entrypoints.web-secure.tls]
-          [[entrypoints.web-secure.tls.certificates]]
-            certFile = "tests/traefik.crt"
-            keyFile = "tests/traefik.key"
    ```

    - Two entrypoints are defined: one called `web`, and the other called `web-secure`.
@@ -43,40 +38,44 @@ They define the port which will receive the requests (whether HTTP or TCP).

 ### General

-Entrypoints are part of the [static configuration](../getting-started/configuration-overview.md#the-static-configuration). You can define them using a toml file, CLI arguments, or a key-value store. See the [complete reference](../reference/entrypoints.md) for the list of available options. 
+EntryPoints are part of the [static configuration](../getting-started/configuration-overview.md#the-static-configuration).
+You can define them using a toml file, CLI arguments, or a key-value store.

-??? example "Using the CLI"
+See the complete reference for the list of available options:

-    Here is an example of using the CLI to define `entrypoints`:
-    
-    ```shell
-    --entryPoints='Name:http Address::80'
-    --entryPoints='Name:https Address::443 TLS'
-    ```
-    
-    !!! note
-        The whitespace character (` `) is the option separator, and the comma (`,`) is the value separator for lists.  
-        The option names are case-insensitive.
-    
-    !!! warning "Using Docker Compose Files"
-    
-        The syntax for passing arguments inside a docker compose file is a little different. Here are two examples.
-        
-        ```yaml
-        traefik:
-            image: traefik
-            command:
-                - --defaultentrypoints=powpow
-                - "--entryPoints=Name:powpow Address::42 Compress:true"
-        ```
+```toml tab="File"
+[EntryPoints]

-        or
-        
-        ```yaml
-        traefik:
-            image: traefik
-            command: --defaultentrypoints=powpow --entryPoints='Name:powpow Address::42 Compress:true'
-        ```
+  [EntryPoints.EntryPoint0]
+    Address = ":8888"
+    [EntryPoints.EntryPoint0.Transport]
+      [EntryPoints.EntryPoint0.Transport.LifeCycle]
+        RequestAcceptGraceTimeout = 42
+        GraceTimeOut = 42
+      [EntryPoints.EntryPoint0.Transport.RespondingTimeouts]
+        ReadTimeout = 42
+        WriteTimeout = 42
+        IdleTimeout = 42
+    [EntryPoints.EntryPoint0.ProxyProtocol]
+      Insecure = true
+      TrustedIPs = ["foobar", "foobar"]
+    [EntryPoints.EntryPoint0.ForwardedHeaders]
+      Insecure = true
+      TrustedIPs = ["foobar", "foobar"]
+```
+
+```ini tab="CLI"
+--entryPoints.EntryPoint0.Address=:8888
+--entryPoints.EntryPoint0.Transport.LifeCycle.RequestAcceptGraceTimeout=42
+--entryPoints.EntryPoint0.Transport.LifeCycle.GraceTimeOut=42
+--entryPoints.EntryPoint0.Transport.RespondingTimeouts.ReadTimeout=42
+--entryPoints.EntryPoint0.Transport.RespondingTimeouts.WriteTimeout=42
+--entryPoints.EntryPoint0.Transport.RespondingTimeouts.IdleTimeout=42
+--entryPoints.EntryPoint0.ProxyProtocol.Insecure=true
+--entryPoints.EntryPoint0.ProxyProtocol.TrustedIPs=foobar,foobar
+--entryPoints.EntryPoint0.ForwardedHeaders.Insecure=true
+--entryPoints.EntryPoint0.ForwardedHeaders.TrustedIPs=foobar,foobar
+```

 ## ProxyProtocol

@@ -85,26 +84,27 @@ Traefik supports [ProxyProtocol](https://www.haproxy.org/download/1.8/doc/proxy-
 ??? example "Enabling Proxy Protocol with Trusted IPs" 

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
    
-        [entrypoints.web.proxyProtocol]
+        [entryPoints.web.proxyProtocol]
          trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
    ```
    
    IPs in `trustedIPs` only will lead to remote client address replacement: Declare load-balancer IPs or CIDR range here.
    
-??? example "Insecure Mode -- Testing Environnement Only"
+??? example "Insecure Mode -- Testing Environment Only"

-    In a test environments, you can configure Traefik to trust every incomming connection. Doing so, every remote client address will be replaced (`trustedIPs` won't have any effect)
+    In a test environments, you can configure Traefik to trust every incoming connection.
+    Doing so, every remote client address will be replaced (`trustedIPs` won't have any effect)

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
    
-        [entrypoints.web.proxyProtocol]
+        [entryPoints.web.proxyProtocol]
          insecure = true
    ```
         
@@ -120,21 +120,21 @@ You can configure Traefik to trust the forwarded headers information (`X-Forward
 ??? example "Trusting Forwarded Headers from specific IPs"

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
    
-        [entrypoints.web.forwardedHeaders]
+        [entryPoints.web.forwardedHeaders]
          trustedIPs = ["127.0.0.1/32", "192.168.1.7"]
    ```
    
 ??? example "Insecure Mode -- Always Trusting Forwarded Headers"

    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    [entryPoints]
+      [entryPoints.web]
        address = ":80"
    
-        [entrypoints.web.forwardedHeaders]
+        [entryPoints.web.forwardedHeaders]
           insecure = true
    ```
--- a/docs/content/routing/overview.md
+++ b/docs/content/routing/overview.md
@@ -3,7 +3,7 @@
 What's Happening to the Requests?
 {: .subtitle }

-Let's zoom on Traefik's architecture and talk about the components that enable the routes to be created.
+Let's zoom in on Traefik's architecture and talk about the components that enable the routes to be created.

 First, when you start Traefik, you define [entrypoints](../entrypoints) (in their most basic forms, they are port numbers).
 Then, connected to these entrypoints, [routers](../routers) analyze the incoming requests to see if they match a set of [rules](../routers#rule).
@@ -14,7 +14,7 @@ If they do, the router might transform the request using pieces of [middleware](
 ## Clear Responsibilities

 - [_Providers_](../providers/overview.md) discover the services that live on your infrastructure (their IP, health, ...)
- [_Entrypoints_](./entrypoints.md) listen for incomming traffic (ports, ...)
+- [_Entrypoints_](./entrypoints.md) listen for incoming traffic (ports, ...)
 - [_Routers_](./routers/index.md) analyse the requests (host, path, headers, SSL, ...)
 - [_Services_](./services/index.md) forward the request to your services (load balancing, ...)
 - [_Middlewares_](../middlewares/overview.md) may update the request or make decisions based on the request (authentication, rate limiting, headers, ...)
@@ -25,8 +25,8 @@ Below is an example of a full configuration file for the [file provider](../prov
 In the process, Traefik will make sure that the user is authenticated (using the [BasicAuth middleware](../middlewares/basicauth.md)).

 ```toml
-[entrypoints]
-   [entrypoints.web]
+[entryPoints]
+   [entryPoints.web]
      address = ":8081" # Listen on port 8081 for incoming requests

 [providers]
@@ -62,8 +62,8 @@ In the process, Traefik will make sure that the user is authenticated (using the
    ??? example "Adding a TCP route for TLS requests on whoami.traefik.io"

        ```toml
-        [entrypoints]
-           [entrypoints.web]
+        [entryPoints]
+           [entryPoints.web]
              address = ":8081" # Listen on port 8081 for incoming requests

        [providers]
--- a/docs/content/routing/routers/index.md
+++ b/docs/content/routing/routers/index.md
@@ -15,7 +15,7 @@ In the process, routers may use pieces of [middleware](../../middlewares/overvie
    ```toml
      [http.routers]
        [http.routers.my-router]
-        rule = "Path(/foo)"
+        rule = "Path(`/foo`)"
        service = "service-foo"
    ```

@@ -24,7 +24,7 @@ In the process, routers may use pieces of [middleware](../../middlewares/overvie
    ```toml
      [http.routers]
        [http.routers.my-router]
-        rule = "Path(/foo)"
+        rule = "Path(`/foo`)"
        middlewares = ["authentication"] # declared elsewhere
        service = "service-foo"
    ```
@@ -32,16 +32,16 @@ In the process, routers may use pieces of [middleware](../../middlewares/overvie
 ??? example "Forwarding all (non-tls) requests on port 3306 to a database service"

    ```toml
-      [entrypoints]
-        [entrypoints.mysql-default]
+      [entryPoints]
+        [entryPoints.mysql-default]
          address = ":80"
-        [entrypoints.mysql-default]
+        [entryPoints.mysql-default]
          address = ":3306"
          
      [tcp]
        [tcp.routers]
          [tcp.routers.to-database]
-            entrypoints = ["mysql-default"]
+            entryPoints = ["mysql-default"]
            rule = "HostSNI(`*`)" # Catch every request (only available rule for non-tls routers. See below.)
            service = "database"
    ```
@@ -51,48 +51,48 @@ In the process, routers may use pieces of [middleware](../../middlewares/overvie
 ### EntryPoints

 If not specified, HTTP routers will accept requests from all defined entrypoints.
-If you want to limit the router scope to a set of entrypoint, set the entrypoints option.
+If you want to limit the router scope to a set of entrypoints, set the entrypoints option.

 ??? example "Listens to Every EntryPoint"

    ```toml
-    [entrypoints]
-       [entrypoints.web]
+    [entryPoints]
+       [entryPoints.web]
          # ...
-       [entrypoints.web-secure]
+       [entryPoints.web-secure]
          # ...
-       [entrypoints.other]
+       [entryPoints.other]
          # ...

    [http.routers]
       [http.routers.Router-1]
          # By default, routers listen to every entrypoints
-          rule = "Host(traefik.io)"
+          rule = "Host(`traefik.io`)"
          service = "service-1"
    ```

 ??? example "Listens to Specific EntryPoints"

    ```toml
-    [entrypoints]
-       [entrypoints.web]
+    [entryPoints]
+       [entryPoints.web]
          # ...
-       [entrypoint.web-secure]
+       [entryPoints.web-secure]
          # ...
-       [entrypoint.other]
+       [entryPoints.other]
          # ...

    [http.routers]
       [http.routers.Router-1]
          entryPoints = ["web-secure", "other"] # won't listen to entrypoint web
-          rule = "Host(traefik.io)"
+          rule = "Host(`traefik.io`)"
          service = "service-1"
    ```

 ### Rule

 Rules are a set of matchers that determine if a particular request matches specific criteria.
-If the rule is verified, then the router becomes active and calls middlewares, then forward the request to the service.
+If the rule is verified, the router becomes active, calls middlewares, and then forwards the request to the service.

 ??? example "Host is traefik.io"

@@ -156,7 +156,9 @@ Services are the target for the router.

 ### TLS

-When specifying a TLS section, you tell Traefik that the current router is dedicated to HTTPS requests only (and that the router should ignore HTTP (non tls) requests).
+#### General
+
+ When a TLS section is specified, it instructs Traefik that the current router is dedicated to HTTPS requests only (and that the router should ignore HTTP (non TLS) requests).
 Traefik will terminate the SSL connections (meaning that it will send decrypted data to the services).

 ??? example "Configuring the router to accept HTTPS requests only"
@@ -172,8 +174,7 @@ Traefik will terminate the SSL connections (meaning that it will send decrypted
 !!! note "HTTPS & ACME"

    In the current version, with [ACME](../../https-tls/acme.md) enabled, automatic certificate generation will apply to every router declaring a TLS section.
-    In the near future, options will be available to enable fine-grain control of the TLS parameters.
-
+    
 !!! note "Passthrough"

    On TCP routers, you can configure a passthrough option so that Traefik doesn't terminate the TLS connection.
@@ -186,16 +187,41 @@ Traefik will terminate the SSL connections (meaning that it will send decrypted

        ```toml
        [http.routers]
-           [http.routers.Router-1-https]
+           [http.routers.my-https-router]
              rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
              service = "service-id"
-              [http.routers.Router-1.tls] # will terminate the TLS request
+              [http.routers.my-https-router.tls] # will terminate the TLS request

-           [http.routers.Router-1-http]
+           [http.routers.my-http-router]
              rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
              service = "service-id"
        ```

+#### `Options`
+
+The `Options` field enables fine-grained control of the TLS parameters.  
+It refers to a [tlsOptions](../../https-tls/overview/#configuration-options) and will be applied only if a `Host` rule is defined.
+
+??? example "Configuring the tls options"
+
+    ```toml
+    [http.routers]
+       [http.routers.Router-1]
+          rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
+          service = "service-id"
+          [http.routers.Router-1.tls] # will terminate the TLS request
+            options = "foo"
+    
+    
+    [tlsOptions]
+      [tlsOptions.foo]
+          minVersion = "VersionTLS12"
+          cipherSuites = [
+            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+            "TLS_RSA_WITH_AES_256_GCM_SHA384"
+          ]
+    ```
+
 ## Configuring TCP Routers

 ### General
@@ -211,12 +237,12 @@ If you want to limit the router scope to a set of entrypoints, set the entrypoin
 ??? example "Listens to Every EntryPoint"

    ```toml
-    [entrypoints]
-       [entrypoints.web]
+    [entryPoints]
+       [entryPoints.web]
          # ...
-       [entrypoints.web-secure]
+       [entryPoints.web-secure]
          # ...
-       [entrypoints.other]
+       [entryPoints.other]
          # ...

    [tcp.routers]
@@ -230,12 +256,12 @@ If you want to limit the router scope to a set of entrypoints, set the entrypoin
 ??? example "Listens to Specific EntryPoints"

    ```toml
-    [entrypoints]
-       [entrypoints.web]
+    [entryPoints]
+       [entryPoints.web]
          # ...
-       [entrypoint.web-secure]
+       [entryPoints.web-secure]
          # ...
-       [entrypoint.other]
+       [entryPoints.other]
          # ...

    [tcp.routers]
@@ -248,9 +274,9 @@ If you want to limit the router scope to a set of entrypoints, set the entrypoin

 ### Rule

-| Rule                                                               | Description                                                                                                    |
-|--------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------|
-| ``HostSNI(`domain-1`, ...)``                                          | Check if the Server Name Indication corresponds to the given `domains`.                                               |
+| Rule                         | Description                                                             |
+|------------------------------|-------------------------------------------------------------------------|
+| ``HostSNI(`domain-1`, ...)`` | Check if the Server Name Indication corresponds to the given `domains`. |

 !!! important "HostSNI & TLS"

@@ -269,8 +295,10 @@ Services are the target for the router.

 ### TLS

-When specifying a TLS section, you tell Traefik that the current router is dedicated to TLS requests only (and that the router should ignore non-tls requests).
-By default, Traefik will terminate the SSL connections (meaning that it will send decrypted data to the services), but you can tell Traefik that the request should pass through (keeping the encrypted data) and be forwarded to the service "as is". 
+#### General
+
+ When a TLS section is specified, it instructs Traefik that the current router is dedicated to TLS requests only (and that the router should ignore non-TLS requests).
+ By default, Traefik will terminate the SSL connections (meaning that it will send decrypted data to the services), but Traefik can be configured in order to let the requests pass through (keeping the data encrypted), and be forwarded to the service "as is". 

 ??? example "Configuring TLS Termination"

@@ -296,4 +324,28 @@ By default, Traefik will terminate the SSL connections (meaning that it will sen
 !!! note "TLS & ACME"

    In the current version, with [ACME](../../https-tls/acme.md) enabled, automatic certificate generation will apply to every router declaring a TLS section.
-    In the near future, options will be available to enable fine-grain control of the TLS parameters.
+
+#### `Options`
+
+The `Options` field enables fine-grained control of the TLS parameters.  
+It refers to a [tlsOptions](../../https-tls/overview/#configuration-options) and will be applied only if a `HostSNI` rule is defined.
+
+??? example "Configuring the tls options"
+
+    ```toml
+    [tcp.routers]
+       [tcp.routers.Router-1]
+          rule = "Host(`foo-domain`) && Path(`/foo-path/`)"
+          service = "service-id"
+          [tcp.routers.Router-1.tls] # will terminate the TLS request
+            options = "foo"
+    
+    
+    [tlsOptions]
+      [tlsOptions.foo]
+          minVersion = "VersionTLS12"
+          cipherSuites = [
+            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+            "TLS_RSA_WITH_AES_256_GCM_SHA384"
+          ]
+    ```
--- a/docs/content/routing/services/index.md
+++ b/docs/content/routing/services/index.md
@@ -14,14 +14,11 @@ The `Services` are responsible for configuring how to reach the actual services
    ```toml
    [http.services]
      [http.services.my-service.LoadBalancer]
-         method = "wrr" # Load Balancing based on weights
         
         [[http.services.my-service.LoadBalancer.servers]]
            url = "http://private-ip-server-1/"
-            weight = 30 # 30% of the requests will go to that instance
         [[http.services.my-service.LoadBalancer.servers]]
            url = "http://private-ip-server-2/"
-            weight = 70 # 70% of the requests will go to that instance         
    ```

 ??? example "Declaring a TCP Service with Two Servers -- Using the [File Provider](../../providers/file.md)"
@@ -52,21 +49,17 @@ The load balancers are able to load balance the requests between multiple instan
    ```toml
    [http.services]
      [http.services.my-service.LoadBalancer]
-         method = "wrr" # Load Balancing based on weights
         
         [[http.services.my-service.LoadBalancer.servers]]
            url = "http://private-ip-server-1/"
-            weight = 50 # 50% of the requests will go to that instance
         [[http.services.my-service.LoadBalancer.servers]]
            url = "http://private-ip-server-2/"
-            weight = 50 # 50% of the requests will go to that instance         
    ```

 #### Servers

 Servers declare a single instance of your program.
 The `url` option point to a specific instance. 
-The `weight` option defines the weight of the server for the load balancing algorithm.

 !!! note
    Paths in the servers' `url` have no effet. 
@@ -84,17 +77,13 @@ The `weight` option defines the weight of the server for the load balancing algo

 #### Load-balancing

-Various methods of load balancing are supported:
+For now, only round robin load balancing is supported:

- `wrr`: Weighted Round Robin.
- `drr`: Dynamic Round Robin: increases weights on servers that perform better than others (rolls back to original weights when the server list is updated)
-
-??? example "Load Balancing Using DRR -- Using the [File Provider](../../providers/file.md)"
+??? example "Load Balancing -- Using the [File Provider](../../providers/file.md)"

    ```toml
    [http.services]
      [http.services.my-service.LoadBalancer]
-         method = "drr"
         [[http.services.my-service.LoadBalancer.servers]]
            url = "http://private-ip-server-1/"
         [[http.services.my-service.LoadBalancer.servers]]
@@ -114,12 +103,18 @@ On subsequent requests, the client is forwarded to the same server.
    
    The default cookie name is an abbreviation of a sha1 (ex: `_1d52e`).

+!!! note "Secure & HTTPOnly flags"
+
+    By default, the affinity cookie is created without those flags. One however can change that through configuration. 
+
 ??? example "Adding Stickiness"

    ```toml
    [http.services]
      [http.services.my-service]
        [http.services.my-service.LoadBalancer.stickiness]
+          secureCookie = true
+          httpOnlyCookie = true
    ```

 ??? example "Adding Stickiness with a Custom Cookie Name"
@@ -129,6 +124,8 @@ On subsequent requests, the client is forwarded to the same server.
      [http.services.my-service]
        [http.services.my-service.LoadBalancer.stickiness]
           cookieName = "my_stickiness_cookie_name"
+           secureCookie = true
+           httpOnlyCookie = true
    ```

 #### Health Check
@@ -236,7 +233,3 @@ The `address` option (IP:Port) point to a specific instance.
         [[tcp.services.my-service.LoadBalancer.servers]]
            address = "xx.xx.xx.xx:xx"
    ```
-
-!!! note "Weight"
-    
-    The TCP LoadBalancer is currently a round robin only implementation and doesn't yet support weights.
--- a/docs/content/user-guides/crd-acme/01-crd.yml
+++ b/docs/content/user-guides/crd-acme/01-crd.yml
@@ -0,0 +1,114 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutes.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRoute
+    plural: ingressroutes
+    singular: ingressroute
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: Middleware
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
+
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - traefik.containo.us
+    resources:
+      - middlewares
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - traefik.containo.us
+    resources:
+      - ingressroutes
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - traefik.containo.us
+    resources:
+      - ingressroutetcps
+    verbs:
+      - get
+      - list
+      - watch
+
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-ingress-controller
+subjects:
+  - kind: ServiceAccount
+    name: traefik-ingress-controller
+    namespace: default
--- a/docs/content/user-guides/crd-acme/02-services.yml
+++ b/docs/content/user-guides/crd-acme/02-services.yml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+
+spec:
+  ports:
+    - protocol: TCP
+      name: web
+      port: 8000
+    - protocol: TCP
+      name: admin
+      port: 8080
+    - protocol: TCP
+      name: websecure
+      port: 4443
+  selector:
+    app: traefik
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+
+spec:
+  ports:
+    - protocol: TCP
+      name: web
+      port: 80
+  selector:
+    app: whoami
--- a/docs/content/user-guides/crd-acme/03-deployments.yml
+++ b/docs/content/user-guides/crd-acme/03-deployments.yml
@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: default
+  name: traefik-ingress-controller
+
+---
+kind: Deployment
+apiVersion: extensions/v1beta1
+metadata:
+  namespace: default
+  name: traefik
+  labels:
+    app: traefik
+
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik
+  template:
+    metadata:
+      labels:
+        app: traefik
+    spec:
+      serviceAccountName: traefik-ingress-controller
+      containers:
+        - name: traefik
+          image: traefik:v2.0
+          args:
+            - --api
+            - --accesslog
+            - --entrypoints.web.Address=:8000
+            - --entrypoints.websecure.Address=:4443
+            - --providers.kubernetescrd
+            - --providers.kubernetescrd.trace
+            - --acme
+            - --acme.acmelogging
+            - --acme.tlschallenge
+            - --acme.onhostrule
+            - --acme.email=foo@you.com
+            - --acme.entrypoint=websecure
+            - --acme.storage=acme.json
+            # Please note that this is the staging Let's Encrypt server.
+            # Once you get things working, you should remove that whole line altogether.
+            - --acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
+          ports:
+            - name: web
+              containerPort: 8000
+            - name: websecure
+              containerPort: 4443
+            - name: admin
+              containerPort: 8080
+
+---
+kind: Deployment
+apiVersion: extensions/v1beta1
+metadata:
+  namespace: default
+  name: whoami
+  labels:
+    app: whoami
+
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: containous/whoami
+          ports:
+            - name: web
+              containerPort: 80
--- a/docs/content/user-guides/crd-acme/04-ingressroutes.yml
+++ b/docs/content/user-guides/crd-acme/04-ingressroutes.yml
@@ -0,0 +1,30 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: simpleingressroute
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`your.domain.com`) && PathPrefix(`/notls`)
+    kind: Rule
+    services:
+    - name: whoami
+      port: 80
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroutetls
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`your.domain.com`) && PathPrefix(`/tls`)
+    kind: Rule
+    services:
+    - name: whoami
+      port: 80
+  # Please note the use of an empty TLS object to enable TLS with Let's Encrypt.
+  tls: {}
--- a/docs/content/user-guides/crd-acme/index.md
+++ b/docs/content/user-guides/crd-acme/index.md
@@ -0,0 +1,100 @@
+# Traefik & CRD & Let's Encrypt
+
+Traefik with an IngressRoute Custom Resource Definition for Kubernetes, and TLS Through Let's Encrypt.
+{: .subtitle }
+
+This document is intended to be a fully working example demonstrating how to set up Traefik in [Kubernetes](https://kubernetes.io),
+with the dynamic configuration coming from the [IngressRoute Custom Resource](../../providers/kubernetes-crd.md),
+and TLS setup with [Let's Encrypt](https://letsencrypt.org).
+However, for the sake of simplicity, we're using [k3s](https://github.com/rancher/k3s)  docker image for the Kubernetes cluster setup.
+
+Please note that for this setup, given that we're going to use ACME's TLS-ALPN-01 challenge, the host you'll be running it on must be able to receive connections from the outside on port 443.
+And of course its internet facing IP address must match the domain name you intend to use.
+
+In the following, the Kubernetes resources defined in YAML configuration files can be applied to the setup in two different ways:
+
+- the first, and usual way, is simply with the `kubectl apply` command.
+- the second, which can be used for this tutorial, is to directly place the files in the directory used by the k3s docker image for such inputs (`/var/lib/rancher/k3s/server/manifests`).
+
+## k3s Docker-compose Configuration
+
+Our starting point is the docker-compose configuration file, to start the k3s cluster.
+You can start it with:
+
+```bash
+docker-compose -f k3s.yml up
+```
+
+```yaml
+--8<-- "content/user-guides/crd-acme/k3s.yml"
+```
+
+## Cluster Resources
+
+Let's now have a look (in the order they should be applied, if using `kubectl apply`) at all the required resources for the full setup.
+
+### IngressRoute Definition
+
+First, the definition of the `IngressRoute` and the `Middleware` kinds.
+Also note the RBAC authorization resources; they'll be referenced through the `serviceAccountName` of the deployment, later on.
+
+```yaml
+--8<-- "content/user-guides/crd-acme/01-crd.yml"
+```
+
+### Services
+
+Then, the services. One for Traefik itself, and one for the app it routes for, i.e. in this case our demo HTTP server: [whoami](https://github.com/containous/whoami).
+
+```yaml
+--8<-- "content/user-guides/crd-acme/02-services.yml"
+```
+
+### Deployments
+
+Next, the deployments, i.e. the actual pods behind the services.
+Again, one pod for Traefik, and one for the whoami app.
+
+```yaml
+--8<-- "content/user-guides/crd-acme/03-deployments.yml"
+```
+
+### Port Forwarding
+
+Now, as an exception to what we said above, please note that you should not let the ingressRoute resources below be applied automatically to your cluster.
+The reason is, as soon as the ACME provider of Traefik detects we have TLS routers, it will try to generate the certificates for the corresponding domains.
+And this will not work, because as it is, our Traefik pod is not reachable from the outside, which will make the ACME TLS challenge fail.
+Therefore, for the whole thing to work, we must delay applying the ingressRoute resources until we have port-forwarding set up properly, which is the next step.
+
+```bash
+kubectl port-forward --address 0.0.0.0 service/traefik 8000:8000 8080:8080 443:4443 -n default
+```
+
+Also, and this is out of the scope if this guide, please note that because of the privileged ports limitation on Linux, the above command might fail to listen on port 443.
+In which case you can use tricks such as elevating caps of `kubectl` with `setcaps`, or using `authbind`, or setting up a NAT between your host and the WAN.
+Look it up.
+
+### Traefik Routers
+
+We can now finally apply the actual ingressRoutes, with:
+
+```bash
+kubectl apply -f 04-ingressroutes.yml
+```
+
+```yaml
+--8<-- "content/user-guides/crd-acme/04-ingressroutes.yml"
+```
+
+Give it a few seconds for the ACME TLS challenge to complete, and you should then be able to access your whoami pod (routed through Traefik), from the outside.
+Both with or (just for fun, do not do that in production) without TLS:
+
+```bash
+curl [-k] https://your.domain.com/tls
+```
+
+```bash
+curl [-k] http://your.domain.com:8000/notls
+```
+
+Note that you'll have to use `-k` as long as you're using the staging server of Let's Encrypt, since it is not in the root DNS servers.
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ludovic Fernandez	6069df6cbd	fix: revert deploy script.	2019-06-17 23:40:05 +02:00
Ludovic Fernandez	5e7b6e4860	fix: deploy script.	2019-06-17 22:14:05 +02:00
Ludovic Fernandez	ea6fa6e889	Prepare release v2.0.0-alpha5	2019-06-17 19:38:04 +02:00
Orhan Hirsch	3e914256ce	Update headers middleware docs for kubernetes crd	2019-06-17 18:30:05 +02:00
Jean-Baptiste Doumenjou	85ce16b34f	Define TLS options on the Router configuration Co-authored-by: juliens <julien@containo.us>	2019-06-17 18:14:08 +02:00
Russ Ferriday	d306c8fd50	change doc references to scheme[Rr]edirect -> redirect[Ss]cheme	2019-06-17 18:00:07 +02:00
Ludovic Fernandez	8d7eccad5d	New static configuration loading system. Co-authored-by: Mathieu Lonjaret <mathieu.lonjaret@gmail.com>	2019-06-17 11:48:05 +02:00
Amir Keibi	d18edd6f77	HttpOnly and Secure flags on the affinity cookie	2019-06-13 00:42:06 +02:00
Emile Vauge	cad3704efd	Add Mathieu Lonjaret to maintainers	2019-06-12 23:04:03 +02:00
Andreas Bleuler	9a4b455c3f	Correct typo in documentation on rate limiting	2019-06-12 17:22:07 +02:00
Daniel Tomcej	01c8798e4e	Update docker api version	2019-06-12 02:54:03 +02:00
Ludovic Fernandez	61744fba11	Prepare release v1.7.12	2019-06-12 02:54:03 +02:00
Fernandez Ludovic	0034bef6b9	Update lego.	2019-06-12 02:54:03 +02:00
ravilr	63c3ed3931	Add missing callback on close of hijacked connections	2019-06-12 02:54:03 +02:00
Ludovic Fernandez	8a5db8a3ee	Adds a log fields documentation.	2019-06-12 02:54:03 +02:00
Alex Antonov	adc2b62c22	Upgraded DataDog tracing library to 1.14.0	2019-06-12 02:54:03 +02:00
Wenxuan Zhao	1f2fe08c33	Allow SANs for wildcards domain.	2019-06-12 02:54:03 +02:00
HurricanKai	77b1933833	Fix Kubernetes Docs for Middlewares	2019-06-11 20:42:04 +02:00
mpl	c4df78b4b9	Add support for TCP (in kubernetes CRD) Co-authored-by: Jean-Baptiste Doumenjou <jb.doumenjou@gmail.com>	2019-06-11 15:12:04 +02:00
Julien Salleyron	c1dc783512	Remove first byte wait when tcp catches all	2019-06-07 19:30:07 +02:00
Julien Salleyron	518a37e776	rework loadbalancer support	2019-06-05 22:18:06 +02:00
Brad Jones	b143101f82	Specify that Rancher provider is for 1.x only	2019-06-04 00:46:05 +02:00
Damien Duportal	2be6f4d153	Docs: improve the "reading path" for new contributers	2019-05-27 18:22:04 +02:00
Ludovic Fernandez	ac612734c8	fix the documentation about middleware labels.	2019-05-27 18:10:04 +02:00
Ludovic Fernandez	ffe69c67fc	Entry points CLI description.	2019-05-27 18:02:06 +02:00
llussy	b3057a0ec3	Fix typo in the CRD documentation	2019-05-27 10:24:04 +02:00
mpl	563f059e73	Fix typos in data collection message	2019-05-21 17:12:09 +02:00
Ludovic Fernandez	6bbe7262ef	documentation remove traefik.port.	2019-05-20 11:14:04 +02:00
Anton Dalgren	55a1a81010	Fixed readme misspelling	2019-05-17 13:40:04 +02:00
Michael	97ec764db7	Fix typos in documentation	2019-05-17 13:32:05 +02:00
mpl	f6df556eb0	API: expose runtime representation Co-authored-by: Julien Salleyron <julien.salleyron@gmail.com> Co-authored-by: Jean-Baptiste Doumenjou <jb.doumenjou@gmail.com>	2019-05-16 10:58:06 +02:00
Damien Duportal	5cd9396dae	Fix regression on plumbing scripts for developer usages	2019-05-14 19:58:04 +02:00
Damien Duportal	886a6bdbe0	Add shell script linting with shellcheck for better portability	2019-05-10 17:24:06 +02:00
Ludovic Fernandez	ab60e702d2	Remove old docs folder.	2019-05-10 10:16:05 +02:00
Jean-Baptiste Doumenjou	17141b3589	Remove timeout/interval from the ACME Provider	2019-05-10 09:58:05 +02:00
Daniel Tomcej	8f23243cb8	Add note about ACME renewal	2019-05-09 15:22:05 +02:00
Ludovic Fernandez	c2345c6e9a	Don't add TCP proxy when error occurs during creation.	2019-05-09 14:30:06 +02:00
Michael Irwin	2617de2cdd	Clarify docs with labels in Swarm Mode	2019-05-09 08:32:04 +02:00
Alex Antonov	9cf6827ccc	Added support for Haystack tracing	2019-05-09 00:14:04 +02:00
Ludovic Fernandez	681892148e	fix: typo in routing example.	2019-05-06 18:28:04 +02:00
Michael Irwin	558452a143	Fixed spelling typo	2019-05-06 17:44:04 +02:00
Daniel Tomcej	5a173fa968	Allow matching with FQDN hosts with trailing periods	2019-05-06 17:16:03 +02:00
Damien Duportal	72397ef90c	Fix `make validate` on MacOS outside container	2019-05-06 09:40:03 +02:00
Yousef Lamlum	79ad4b4544	Clarification of the correct pronunciation of the word "Traefik"	2019-05-03 12:14:04 +02:00
Tim Möhlmann	49f3713c4f	docker-compose basic auth needs dubble dollar signs	2019-05-03 10:16:06 +02:00
Ludovic Fernandez	4b5c3ccf58	Adds a reference to the middleware overview.	2019-04-29 19:36:07 +02:00
Michael	21dec70971	Fix strip prefix documentation	2019-04-29 19:00:05 +02:00
Ludovic Fernandez	0f2b774ea1	fix: Rancher documentation.	2019-04-26 11:48:04 +02:00
Ludovic Fernandez	e929caf15a	Prepare release v1.7.11	2019-04-26 11:26:04 +02:00
Fernandez Ludovic	8d848c3d60	fix: update lego.	2019-04-26 11:26:04 +02:00
Marcelo Glezer	b8b0c8f3e5	compress link fixed	2019-04-25 17:54:05 +02:00
Michael	15e78da7eb	Minor fix in documentation	2019-04-24 18:04:08 +02:00
Ludovic Fernandez	d80700810f	Review documentation	2019-04-24 17:44:04 +02:00
Julien M'Poy	c1de6abf23	Fix a typo in documentation	2019-04-23 17:40:04 +02:00
Ludovic Fernandez	01b916eaa0	Prepare release v2.0.0-alpha4.	2019-04-17 12:10:04 +02:00
Ludovic Fernandez	62c03b3318	k8s static configuration explanation	2019-04-17 11:48:05 +02:00
Ludovic Fernandez	65679af61d	Remove dumpcerts.sh	2019-04-17 11:36:04 +02:00
Ludovic Fernandez	821ad31cf6	Enhance Marathon documentation	2019-04-17 10:58:04 +02:00
mpl	ea750ad813	Improve log message about redundant TLS certificate	2019-04-17 10:38:04 +02:00
ctas582	3d7633f4a6	Forward all header values from forward auth response	2019-04-17 10:38:04 +02:00
Martin Hoefling	d356ef1c5b	Documentation Update: Hosting.de wildcard support tested	2019-04-17 10:38:04 +02:00
Brandon McNama	fce762febf	Update Wildcard Domain documentation	2019-04-17 10:38:04 +02:00
Ludovic Fernandez	535280c162	doc: middleware -> middlewares.	2019-04-17 09:34:04 +02:00
Julien Salleyron	bb8a193244	log.loglevel becomes log.level in configuration	2019-04-16 15:30:09 +02:00
Ludovic Fernandez	e6bdfa1d29	Checksum file name.	2019-04-16 14:50:05 +02:00
Julien Salleyron	d1d2611665	Handle TCP in the marathon provider Co-authored-by: Mathieu Lonjaret <mathieu.lonjaret@gmail.com>	2019-04-15 18:22:07 +02:00
Ludovic Fernandez	8389b46b5c	Use the same case every where for entryPoints.	2019-04-15 11:14:05 +02:00
Ludovic Fernandez	b9f826554c	Adds a note in traefik.sample.toml	2019-04-12 19:42:03 +02:00
Ludovic Fernandez	0750235712	fix: configuration for integration tests.	2019-04-09 17:24:05 +02:00
Ludovic Fernandez	ee0e014617	Insensitive case for allow-empty value.	2019-04-09 16:50:06 +02:00
Jean-Baptiste Doumenjou	2e20394af4	Update the middleware documentation	2019-04-08 17:14:08 +02:00
Timo Schwarzer	6ab991ebf4	Fix typo in tracing docs	2019-04-08 17:00:08 +02:00
Julien Salleyron	ef8894ef26	Fix EOF error	2019-04-08 12:24:05 +02:00
Ludovic Fernandez	8b4efa1760	Get Structor version from CI env var.	2019-04-08 08:46:04 +02:00
mpl	b0b8b75258	Fix doc about removing headers	2019-04-05 15:18:04 +02:00
Ludovic Fernandez	2e19e45aa4	Remove github.com/satori/go.uuid.	2019-04-05 12:44:03 +02:00
Manuel Zapf	e1d097ea20	Add Rancher provider again	2019-04-05 12:22:04 +02:00
Ludovic Fernandez	ed12366d52	Update tracing dependencies	2019-04-05 11:58:06 +02:00
Jean-Baptiste Doumenjou	4919b638f9	Improve the Documentation with a Reference Section	2019-04-05 11:32:04 +02:00
mpl	49563e638b	Fix response modifier initial building Co-authored-by: Ludovic Fernandez <ldez@users.noreply.github.com>	2019-04-04 11:50:04 +02:00
Ludovic Fernandez	07d0eb9ae6	Adds middlewares examples for k8s.	2019-04-03 14:32:04 +02:00
mpl	336135c392	Set X-Forwarded-* headers Co-authored-by: Julien Salleyron <julien.salleyron@gmail.com>	2019-04-02 16:56:04 +02:00
Daniel Tomcej	d2b38e6ac4	Enable CORS configuration	2019-04-02 10:40:04 +02:00
Ludovic Fernandez	883f90dded	fix: remove invalid commas.	2019-04-01 17:56:04 +02:00
Erin	58e82743f8	Update to v2.0 readme links	2019-04-01 17:14:03 +02:00
Ludovic Fernandez	51a0994d2d	Update certificates for some Docker images	2019-04-01 16:48:08 +02:00
Ludovic Fernandez	da20db862d	fix: validation system	2019-04-01 15:30:07 +02:00
Ludovic Fernandez	d6c9f51082	Prepare release v1.7.10	2019-03-29 18:46:04 +01:00
Julien Salleyron	08d7bb0d08	Remove thoas/stats fork	2019-03-29 18:46:04 +01:00
Alex Antonov	1bcb3d8cc2	Added support for configuring trace headers for DataDog tracing	2019-03-29 18:46:04 +01:00
Ludovic Fernandez	c17de070fb	fix: update lego.	2019-03-29 18:46:04 +01:00
Jonas Thelemann	b893374dc1	Add _FILE Environment Variable Documentation	2019-03-29 18:46:04 +01:00
Christian Franke	fe532ed4f2	Fix two minor nits in Traefik 2.0 docs	2019-03-29 16:38:04 +01:00
Ludovic Fernandez	6377a19b12	Prepare release v2.0.0-alpha3.	2019-03-29 15:34:04 +01:00
Manuel Zapf	ca7ea68a6a	Adds notes about incompatibility between 1.X and 2.X configurations.	2019-03-29 13:12:05 +01:00
Ludovic Fernandez	a45f285a5c	Enhance middleware examples.	2019-03-29 12:34:05 +01:00
Ludovic Fernandez	fa2c57f7cb	Review Makefile	2019-03-28 11:42:06 +01:00
mpl	0779c6a139	Full ACME+CRD example Co-authored-by: Jean-Baptiste Doumenjou <jb.doumenjou@gmail.com>	2019-03-27 15:16:04 +01:00
Ludovic Fernandez	2916f540c1	Remove BaseProvider	2019-03-27 15:02:06 +01:00
ntaranov	7932e317c8	Clarify that manual dnsChallenge provider works only when run as docker run -it	2019-03-27 12:08:04 +01:00
Jean-Baptiste Doumenjou	fd26cf265d	Fix some minors errors on the documentation	2019-03-26 16:32:06 +01:00
mpl	3e76c25887	Document the TLS with ACME case Co-authored-by: Julien Salleyron <julien.salleyron@gmail.com>	2019-03-26 11:12:04 +01:00
Ludovic Fernandez	a0e2f47679	Update traefik.sample.toml	2019-03-25 17:20:04 +01:00
Mehran Kholdi	d70add10ab	Fix typos in docs	2019-03-25 16:54:03 +01:00
Erin	119d0134e0	Documentation Updates: docker-compose examples	2019-03-22 15:22:08 +01:00
Ludovic Fernandez	2e085fa253	Remove old links in readme	2019-03-22 15:16:06 +01:00
Julien Salleyron	f8f7edd124	Fix panic while server shutdown	2019-03-21 15:54:07 +01:00
Michael	79ecff7b42	Fix Getting started	2019-03-21 15:34:04 +01:00
Julien Salleyron	0f2c4fb5f4	Add support for tcp labels in docker provider	2019-03-21 15:22:06 +01:00
Akeem McLennon	ec1952157b	Fix typo in forwardauth middleware documentation	2019-03-20 16:36:10 +01:00
Benjamin	cd38359458	Fix dead maintainers link on the README.md	2019-03-20 16:30:07 +01:00