Prepare release v2.0.0-beta1

Co-authored-by: Mathieu Lonjaret <mathieu.lonjaret@gmail.com>

.github/ISSUE_TEMPLATE.md

@@ -4,8 +4,7 @@ DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
 The issue tracker is for reporting bugs and feature requests only.
 For end-user related support questions, please refer to one of the following:
 
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
+- the Traefik community forum: https://community.containo.us/
 
 -->
 
@@ -16,6 +15,17 @@ For end-user related support questions, please refer to one of the following:
 If you intend to ask a support question: DO NOT FILE AN ISSUE.
 -->
 
+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
 ### What did you do?
 
 <!--
@@ -65,7 +75,7 @@ Add more configuration information here.
 -->
 
 
-### If applicable, please paste the log output at DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output at DEBUG level (`--log.level=DEBUG` switch)
 
 ```
 (paste your output here)

.github/ISSUE_TEMPLATE/Bug_report.md

@@ -10,8 +10,7 @@ DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
 The issue tracker is for reporting bugs and feature requests only.
 For end-user related support questions, please refer to one of the following:
 
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
+- the Traefik community forum: https://community.containo.us/
 
 -->
 
@@ -20,6 +19,17 @@ For end-user related support questions, please refer to one of the following:
 
 Bug
 
+### Did you try using a 1.7.x configuration for the version 2.0?
+
+- [ ] Yes
+- [ ] No
+
+<!--
+
+If you just checked the "Yes" box, be aware that this is probably not a bug. The configurations between 1.X and 2.X are NOT compatible. Please have a look here https://docs.traefik.io/v2.0/getting-started/configuration-overview/.
+
+-->
+
 ### What did you do?
 
 <!--
@@ -70,7 +80,7 @@ Add more configuration information here.
 -->
 
 
-### If applicable, please paste the log output in DEBUG level (`--logLevel=DEBUG` switch)
+### If applicable, please paste the log output in DEBUG level (`--log.level=DEBUG` switch)
 
 ```
 (paste your output here)

.github/ISSUE_TEMPLATE/Feature_request.md

@@ -10,8 +10,7 @@ DO NOT FILE ISSUES FOR GENERAL SUPPORT QUESTIONS.
 The issue tracker is for reporting bugs and feature requests only.
 For end-user related support questions, please refer to one of the following:
 
-- Stack Overflow (using the "traefik" tag): https://stackoverflow.com/questions/tagged/traefik
-- the Traefik community Slack channel: https://slack.traefik.io
+- the Traefik community forum: https://community.containo.us/
 
 -->
 

.gitignore

@@ -11,6 +11,7 @@
 /autogen/
 /traefik
 /traefik.toml
+/traefik.yml
 *.log
 *.exe
 cover.out

.golangci.toml

@@ -1,8 +1,6 @@
 [run]
   deadline = "10m"
-  skip-files = [
-    "^old/.*",
-  ]
+  skip-files = []
 
 [linters-settings]
 
@@ -38,6 +36,7 @@
     "scopelint",
     "gochecknoinits",
     "gochecknoglobals",
+    "bodyclose", # Too many false-positive and panics.
   ]
 
 [issues]
@@ -52,12 +51,6 @@
  [[issues.exclude-rules]]
     path = ".+_test.go"
     linters = ["goconst"]
- [[issues.exclude-rules]]
-    path = "provider/label/internal/.+_test.go"
-    text = "U1000: field `(foo|fuu)` is unused"
- [[issues.exclude-rules]]
-    path = "middlewares/recovery/recovery.go"
-    text = "`logger` can be `github.com/containous/traefik/vendor/github.com/stretchr/testify/assert.TestingT`"
  [[issues.exclude-rules]]
     path = "integration/.+_test.go"
     text = "Error return value of `cmd\\.Process\\.Kill` is not checked"
@@ -68,23 +61,26 @@
     path = "integration/grpc_test.go"
     text = "Error return value of `closer` is not checked"
  [[issues.exclude-rules]]
-    path = "provider/kubernetes/builder_(endpoint|service)_test.go"
+    path = "pkg/h2c/h2c.go"
+    text = "Error return value of `rw.Write` is not checked"
+ [[issues.exclude-rules]]
+    path = "pkg/middlewares/recovery/recovery.go"
+    text = "`logger` can be `github.com/containous/traefik/vendor/github.com/stretchr/testify/assert.TestingT`"
+ [[issues.exclude-rules]]
+    path = "pkg/provider/docker/builder_test.go"
     text = "(U1000: func )?`(.+)` is unused"
  [[issues.exclude-rules]]
-    path = "provider/docker/builder_test.go"
+    path = "pkg/provider/kubernetes/builder_(endpoint|service)_test.go"
     text = "(U1000: func )?`(.+)` is unused"
+ [[issues.exclude-rules]]
+    path = "pkg/config/parser/.+_test.go"
+    text = "U1000: field `(foo|fuu)` is unused"
+ [[issues.exclude-rules]]
+    path = "pkg/server/service/bufferpool.go"
+    text = "SA6002: argument should be pointer-like to avoid allocations"
  [[issues.exclude-rules]]
     path = "cmd/configuration.go"
     text = "string `traefik` has (\\d) occurrences, make it a constant"
- [[issues.exclude-rules]]
-    path = "h2c/h2c.go"
-    text = "Error return value of `rw.Write` is not checked"
- [[issues.exclude-rules]]
-    path = "server/service/bufferpool.go"
-    text = "SA6002: argument should be pointer-like to avoid allocations"
- [[issues.exclude-rules]] # FIXME must be fixed
-    path = "acme/.+.go"
-    text = "(assignment copies lock value to domainsCerts|literal copies lock value from)"
  [[issues.exclude-rules]] # FIXME must be fixed
     path = "cmd/context.go"
     text = "S1000: should use a simple channel send/receive instead of `select` with a single case"

.goreleaser.yml

@@ -51,5 +51,8 @@ archive:
     - LICENSE.md
     - CHANGELOG.md
 
+checksum:
+  name_template: "{{ .ProjectName }}_v{{ .Version }}_checksums.txt"
+
 release:
   disable: true

.semaphoreci/job2.sh

@@ -5,4 +5,4 @@ ci_retry make validate
 
 if [ -n "$SHOULD_TEST" ]; then ci_retry make test-unit; fi
 
-if [ -n "$SHOULD_TEST" ]; then make -j${N_MAKE_JOBS} crossbinary-default-parallel; fi
+if [ -n "$SHOULD_TEST" ]; then make -j"${N_MAKE_JOBS}" crossbinary-default-parallel; fi

.semaphoreci/setup.sh

@@ -1,16 +1,22 @@
 #!/usr/bin/env bash
 set -e
 
-export DOCKER_VERSION=17.03.1
-
+for s in apache2 cassandra elasticsearch memcached mysql mongod postgresql sphinxsearch rethinkdb rabbitmq-server redis-server; do sudo service $s stop; done
+sudo swapoff -a
+sudo dd if=/dev/zero of=/swapfile bs=1M count=3072
+sudo mkswap /swapfile
+sudo swapon /swapfile
+sudo rm -rf /home/runner/.rbenv
+#export DOCKER_VERSION=18.06.3
 source .semaphoreci/vars
-
-if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R); fi
-
+if [ -z "${PULL_REQUEST_NUMBER}" ]; then SHOULD_TEST="-*-"; else TEMP_STORAGE=$(curl --silent https://patch-diff.githubusercontent.com/raw/containous/traefik/pull/${PULL_REQUEST_NUMBER}.diff | patch --dry-run -p1 -R || true); fi
+echo ${SHOULD_TEST}
 if [ -n "$TEMP_STORAGE" ]; then SHOULD_TEST=$(echo "$TEMP_STORAGE" | grep -Ev '(.md|.yaml|.yml)' || :); fi
-
-if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq update; fi
-
-if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*; fi
-
-if [ -n "$SHOULD_TEST" ]; then  docker version; fi
+echo ${TEMP_STORAGE}
+echo ${SHOULD_TEST}
+#if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq update; fi
+#if [ -n "$SHOULD_TEST" ]; then sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*; fi
+if [ -n "$SHOULD_TEST" ]; then   docker version; fi
+if [ -f "./.semaphoreci/golang.sh" ]; then ./.semaphoreci/golang.sh; fi
+if [ -f "./.semaphoreci/golang.sh" ]; then export GOROOT="/usr/local/golang/1.12/go"; fi
+if [ -f "./.semaphoreci/golang.sh" ]; then export GOTOOLDIR="/usr/local/golang/1.12/go/pkg/tool/linux_amd64"; fi

.semaphoreci/vars

@@ -24,8 +24,8 @@ function ci_retry {
     until [ $n -ge $NRETRY ]
     do
         "$@" && break
-        n=$[$n+1]
-        echo "$@ failed, attempt ${n}/${NRETRY}"
+        n=$((n+1))
+        echo "${*} failed, attempt ${n}/${NRETRY}"
         sleep $NSLEEP
     done
 
@@ -34,4 +34,3 @@ function ci_retry {
 }
 
 export -f ci_retry
-

.travis.yml

@@ -24,11 +24,11 @@ before_deploy:
       sudo -E apt-get -yq update;
       sudo -E apt-get -yq --no-install-suggests --no-install-recommends --force-yes install docker-ce=${DOCKER_VERSION}*;
       docker version;
-      make image;
+      make build-image;
       if [ "$TRAVIS_TAG" ]; then
         make release-packages;
       fi;
-      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" v1.7.0
+      curl -sfL https://raw.githubusercontent.com/containous/structor/master/godownloader.sh | bash -s -- -b "${GOPATH}/bin" ${STRUCTOR_VERSION}
       structor -o containous -r traefik --dockerfile-url="https://raw.githubusercontent.com/containous/traefik/v1.7/docs.Dockerfile" --menu.js-url="https://raw.githubusercontent.com/containous/structor/master/traefik-menu.js.gotmpl" --rqts-url="https://raw.githubusercontent.com/containous/structor/master/requirements-override.txt" --force-edit-url --exp-branch=master --debug;
     fi
 
@@ -38,7 +38,6 @@ deploy:
     file: dist/traefik*
     skip_cleanup: true
     file_glob: true
-    draft: true
     on:
       repo: containous/traefik
       tags: true

CHANGELOG.md

@@ -1,5 +1,245 @@
 # Change Log
 
+## [v2.0.0-beta1](https://github.com/containous/traefik/tree/v2.0.0-beta1) (2019-07-19)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha8...v2.0.0-beta1)
+
+**Enhancements:**
+- **[acme]** Certificate resolvers. ([#5116](https://github.com/containous/traefik/pull/5116) by [ldez](https://github.com/ldez))
+- **[api,provider]** Enhance REST provider ([#5072](https://github.com/containous/traefik/pull/5072) by [dtomcej](https://github.com/dtomcej))
+- **[api]** Deal with multiple errors and their criticality ([#5070](https://github.com/containous/traefik/pull/5070) by [mpl](https://github.com/mpl))
+- **[api]** API: remove configuration of Entrypoint and Middlewares ([#5119](https://github.com/containous/traefik/pull/5119) by [mpl](https://github.com/mpl))
+- **[api]** Improve API endpoints ([#5080](https://github.com/containous/traefik/pull/5080) by [ldez](https://github.com/ldez))
+- **[api]** Manage status for TCP element in the endpoint overview. ([#5108](https://github.com/containous/traefik/pull/5108) by [ldez](https://github.com/ldez))
+- **[file]** Restrict traefik.toml to static configuration. ([#5090](https://github.com/containous/traefik/pull/5090) by [ldez](https://github.com/ldez))
+- **[k8s,k8s/crd]** Add scheme to IngressRoute. ([#5062](https://github.com/containous/traefik/pull/5062) by [ldez](https://github.com/ldez))
+- **[k8s,k8s/ingress]** Renamed `kubernetes` provider in `kubernetesIngress` provider ([#5068](https://github.com/containous/traefik/pull/5068) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[logs]** Improve error on router without service. ([#5126](https://github.com/containous/traefik/pull/5126) by [ldez](https://github.com/ldez))
+- **[metrics]** Add Metrics ([#5111](https://github.com/containous/traefik/pull/5111) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Disable RateLimit temporarily ([#5123](https://github.com/containous/traefik/pull/5123) by [juliens](https://github.com/juliens))
+- **[tls]** TLSOptions: handle conflict: same host name, different TLS options ([#5056](https://github.com/containous/traefik/pull/5056) by [mpl](https://github.com/mpl))
+- **[tls]** Expand Client Auth Type configuration ([#5078](https://github.com/containous/traefik/pull/5078) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tracing]** Add Jaeger collector endpoint ([#5082](https://github.com/containous/traefik/pull/5082) by [rmfitzpatrick](https://github.com/rmfitzpatrick))
+- **[webui]** refactor(webui): use @vue/cli to bootstrap new ui ([#5091](https://github.com/containous/traefik/pull/5091) by [Slashgear](https://github.com/Slashgear))
+- **[webui]** feat(webui/dashboard): init new dashboard ([#5105](https://github.com/containous/traefik/pull/5105) by [Slashgear](https://github.com/Slashgear))
+- Move dynamic config into a dedicated package. ([#5075](https://github.com/containous/traefik/pull/5075) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[file]** fix: TLS configuration from directory. ([#5118](https://github.com/containous/traefik/pull/5118) by [ldez](https://github.com/ldez))
+- **[middleware]** Remove X-Forwarded-(Uri, Method, Tls-Client-Cert and Tls-Client-Cert-Info) from untrusted IP ([#5012](https://github.com/containous/traefik/pull/5012) by [stffabi](https://github.com/stffabi))
+- **[middleware]** Properly add response headers for CORS ([#4857](https://github.com/containous/traefik/pull/4857) by [dtomcej](https://github.com/dtomcej))
+
+**Documentation:**
+- **[acme]** Lets encrypt documentation typo ([#5127](https://github.com/containous/traefik/pull/5127) by [juliens](https://github.com/juliens))
+- **[docker,marathon]** Update Dynamic Configuration Reference for both Docker and Marathon ([#5100](https://github.com/containous/traefik/pull/5100) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[k8s,k8s/ingress]** Add documentation about Kubernetes Ingress provider ([#5112](https://github.com/containous/traefik/pull/5112) by [mpl](https://github.com/mpl))
+- **[k8s/crd]** user guide: fix a mistake in the deployment definition ([#5096](https://github.com/containous/traefik/pull/5096) by [ldez](https://github.com/ldez))
+- **[middleware]** Fixed a typo in label. ([#5128](https://github.com/containous/traefik/pull/5128) by [jamct](https://github.com/jamct))
+- **[provider]** Improve providers documentation. ([#5050](https://github.com/containous/traefik/pull/5050) by [ldez](https://github.com/ldez))
+- **[tracing]** Improve tracing documentation ([#5102](https://github.com/containous/traefik/pull/5102) by [mmatur](https://github.com/mmatur))
+- Add a basic Traefik install guide ([#5117](https://github.com/containous/traefik/pull/5117) by [jbdoumenjou](https://github.com/jbdoumenjou))
+
+**Misc:**
+- Cherry pick v1.7 into v2.0 ([#5115](https://github.com/containous/traefik/pull/5115) by [jbdoumenjou](https://github.com/jbdoumenjou))
+
+## [v2.0.0-alpha8](https://github.com/containous/traefik/tree/v2.0.0-alpha8) (2019-07-01)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha7...v2.0.0-alpha8)
+
+**Enhancements:**
+- **[api]** Adding content-header to api endpoints ([#5019](https://github.com/containous/traefik/pull/5019) by [dalanmiller](https://github.com/dalanmiller))
+- **[file]** Support YAML for the dynamic configuration. ([#5024](https://github.com/containous/traefik/pull/5024) by [ldez](https://github.com/ldez))
+- **[logs]** Drop headers by default in access logs. ([#5034](https://github.com/containous/traefik/pull/5034) by [ldez](https://github.com/ldez))
+- **[middleware,k8s/crd]** Handle cross-provider middleware in kubernetes CRD ([#5009](https://github.com/containous/traefik/pull/5009) by [mpl](https://github.com/mpl))
+- **[server]** Use h2c from x/net to handle h2c requests ([#5045](https://github.com/containous/traefik/pull/5045) by [juliens](https://github.com/juliens))
+- **[server]** Make HTTP Keep-Alive timeout configurable for backend connections ([#4983](https://github.com/containous/traefik/pull/4983) by [mszabo-wikia](https://github.com/mszabo-wikia))
+- **[tls]** Define a TLS section to group TLS, TLSOptions, and TLSStores. ([#5031](https://github.com/containous/traefik/pull/5031) by [ldez](https://github.com/ldez))
+- **[tracing]** Improve tracing ([#5010](https://github.com/containous/traefik/pull/5010) by [mmatur](https://github.com/mmatur))
+
+**Bug fixes:**
+- **[cli]** Change the loading resource order ([#5007](https://github.com/containous/traefik/pull/5007) by [ldez](https://github.com/ldez))
+- **[logs]** fix: error log message. ([#5020](https://github.com/containous/traefik/pull/5020) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme]** doc/crd-acme: specify required kubectl version ([#5015](https://github.com/containous/traefik/pull/5015) by [mpl](https://github.com/mpl))
+- **[middleware]** Improve middleware documentation. ([#5003](https://github.com/containous/traefik/pull/5003) by [ldez](https://github.com/ldez))
+- **[server]** Add gRPC user guide ([#5042](https://github.com/containous/traefik/pull/5042) by [ldez](https://github.com/ldez))
+- Use the same case everywhere ([#5043](https://github.com/containous/traefik/pull/5043) by [ldez](https://github.com/ldez))
+
+## [v2.0.0-alpha7](https://github.com/containous/traefik/tree/v2.0.0-alpha7) (2019-06-21)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha6...v2.0.0-alpha7)
+
+**Enhancements:**
+- **[api]** API: new contract ([#4964](https://github.com/containous/traefik/pull/4964) by [mpl](https://github.com/mpl))
+- **[k8s,k8s/crd,tls]** Define TLS options on the Router configuration for Kubernetes ([#4973](https://github.com/containous/traefik/pull/4973) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[middleware,provider]** Change the provider separator from . to @ ([#4982](https://github.com/containous/traefik/pull/4982) by [ldez](https://github.com/ldez))
+- **[provider]** Use name@provider instead of provider@name. ([#4990](https://github.com/containous/traefik/pull/4990) by [ldez](https://github.com/ldez))
+- **[provider]** New constraints management. ([#4965](https://github.com/containous/traefik/pull/4965) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[cli]** Fix some CLI bugs ([#4989](https://github.com/containous/traefik/pull/4989) by [ldez](https://github.com/ldez))
+- **[cli]** Filter env vars configuration ([#4985](https://github.com/containous/traefik/pull/4985) by [ldez](https://github.com/ldez))
+- **[cli]** Return an error when help is called on a non existing command. ([#4977](https://github.com/containous/traefik/pull/4977) by [ldez](https://github.com/ldez))
+- **[tls]** Fix panic in TLS stores handling ([#4997](https://github.com/containous/traefik/pull/4997) by [juliens](https://github.com/juliens))
+
+**Documentation:**
+- **[acme,tls]** docs: rewrite of the HTTPS and TLS section ([#4980](https://github.com/containous/traefik/pull/4980) by [mpl](https://github.com/mpl))
+- Improve various parts of the documentation. ([#4996](https://github.com/containous/traefik/pull/4996) by [ldez](https://github.com/ldez))
+
+## [v2.0.0-alpha6](https://github.com/containous/traefik/tree/v2.0.0-alpha6) (2019-06-18)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha5...v2.0.0-alpha6)
+
+**Bug fixes:**
+- **[cli]** Don't allow non flag arguments by default. ([#4970](https://github.com/containous/traefik/pull/4970) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[middleware,k8s/crd]** doc: fix middleware names for CRD. ([#4966](https://github.com/containous/traefik/pull/4966) by [ldez](https://github.com/ldez))
+- **[middleware]** Kubernetes CRD documentation fixes ([#4971](https://github.com/containous/traefik/pull/4971) by [orhanhenrik](https://github.com/orhanhenrik))
+
+## [v2.0.0-alpha5](https://github.com/containous/traefik/tree/v2.0.0-alpha5) (2019-06-17)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha4...v2.0.0-alpha5)
+
+**Enhancements:**
+- **[acme]** Remove timeout/interval from the ACME Provider ([#4842](https://github.com/containous/traefik/pull/4842) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[api]** API: expose runtime representation ([#4841](https://github.com/containous/traefik/pull/4841) by [mpl](https://github.com/mpl))
+- **[cli]** New static configuration loading system. ([#4935](https://github.com/containous/traefik/pull/4935) by [ldez](https://github.com/ldez))
+- **[k8s,k8s/crd,tcp]** Add support for TCP (in kubernetes CRD) ([#4885](https://github.com/containous/traefik/pull/4885) by [mpl](https://github.com/mpl))
+- **[server]** Rework loadbalancer support ([#4933](https://github.com/containous/traefik/pull/4933) by [juliens](https://github.com/juliens))
+- **[sticky-session]** HttpOnly and Secure flags on the affinity cookie ([#4947](https://github.com/containous/traefik/pull/4947) by [gheibia](https://github.com/gheibia))
+- **[tls]** Define TLS options on the Router configuration ([#4931](https://github.com/containous/traefik/pull/4931) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tracing]** Added support for Haystack tracing ([#4555](https://github.com/containous/traefik/pull/4555) by [aantono](https://github.com/aantono))
+
+**Bug fixes:**
+- **[logs]** Fix typos in data collection message ([#4891](https://github.com/containous/traefik/pull/4891) by [mpl](https://github.com/mpl))
+- **[middleware]** change doc references to scheme[Rr]edirect -> redirect[Ss]cheme ([#4959](https://github.com/containous/traefik/pull/4959) by [topiaruss](https://github.com/topiaruss))
+- **[rules]** Allow matching with FQDN hosts with trailing periods ([#4763](https://github.com/containous/traefik/pull/4763) by [dtomcej](https://github.com/dtomcej))
+- **[tcp]** Remove first byte wait when tcp catches all ([#4938](https://github.com/containous/traefik/pull/4938) by [juliens](https://github.com/juliens))
+- **[tcp]** Don't add TCP proxy when error occurs during creation. ([#4858](https://github.com/containous/traefik/pull/4858) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme]** Add note about ACME renewal ([#4860](https://github.com/containous/traefik/pull/4860) by [dtomcej](https://github.com/dtomcej))
+- **[docker]** Remove traefik.port from documentation ([#4886](https://github.com/containous/traefik/pull/4886) by [ldez](https://github.com/ldez))
+- **[docker]** Clarify docs with labels in Swarm Mode ([#4847](https://github.com/containous/traefik/pull/4847) by [mikesir87](https://github.com/mikesir87))
+- **[k8s]** Fix typo in the CRD documentation ([#4902](https://github.com/containous/traefik/pull/4902) by [llussy](https://github.com/llussy))
+- **[middleware,provider]** fix the documentation about middleware labels. ([#4888](https://github.com/containous/traefik/pull/4888) by [ldez](https://github.com/ldez))
+- **[middleware]** Review documentation ([#4798](https://github.com/containous/traefik/pull/4798) by [ldez](https://github.com/ldez))
+- **[middleware]** compress link fixed ([#4817](https://github.com/containous/traefik/pull/4817) by [gato](https://github.com/gato))
+- **[middleware]** Fix strip prefix documentation ([#4829](https://github.com/containous/traefik/pull/4829) by [mmatur](https://github.com/mmatur))
+- **[middleware]** Fix Kubernetes Docs for Middlewares ([#4943](https://github.com/containous/traefik/pull/4943) by [HurricanKai](https://github.com/HurricanKai))
+- **[middleware]** Correct typo in documentation on rate limiting ([#4939](https://github.com/containous/traefik/pull/4939) by [ableuler](https://github.com/ableuler))
+- **[middleware]** docker-compose basic auth needs double dollar signs ([#4831](https://github.com/containous/traefik/pull/4831) by [muhlemmer](https://github.com/muhlemmer))
+- **[middleware]** Adds a reference to the middleware overview. ([#4824](https://github.com/containous/traefik/pull/4824) by [ldez](https://github.com/ldez))
+- **[middleware]** Update headers middleware docs for kubernetes crd ([#4955](https://github.com/containous/traefik/pull/4955) by [orhanhenrik](https://github.com/orhanhenrik))
+- **[rancher]** fix: Rancher documentation. ([#4818](https://github.com/containous/traefik/pull/4818) by [ldez](https://github.com/ldez))
+- **[rancher]** Specify that Rancher provider is for 1.x only ([#4923](https://github.com/containous/traefik/pull/4923) by [bradjones1](https://github.com/bradjones1))
+- **[tls]** fix: typo in routing example. ([#4849](https://github.com/containous/traefik/pull/4849) by [ldez](https://github.com/ldez))
+- Clarification of the correct pronunciation of the word "Traefik" ([#4834](https://github.com/containous/traefik/pull/4834) by [ylamlum-g4m](https://github.com/ylamlum-g4m))
+- Fix typos in documentation ([#4884](https://github.com/containous/traefik/pull/4884) by [michael-k](https://github.com/michael-k))
+- Entry points CLI description. ([#4896](https://github.com/containous/traefik/pull/4896) by [ldez](https://github.com/ldez))
+- Improve the "reading path" for new contributors ([#4908](https://github.com/containous/traefik/pull/4908) by [dduportal](https://github.com/dduportal))
+- Fixed spelling typo ([#4848](https://github.com/containous/traefik/pull/4848) by [mikesir87](https://github.com/mikesir87))
+- Fixed readme misspelling ([#4882](https://github.com/containous/traefik/pull/4882) by [antondalgren](https://github.com/antondalgren))
+- Minor fix in documentation ([#4811](https://github.com/containous/traefik/pull/4811) by [mmatur](https://github.com/mmatur))
+- Add Mathieu Lonjaret to maintainers ([#4950](https://github.com/containous/traefik/pull/4950) by [emilevauge](https://github.com/emilevauge))
+- Fix a typo in documentation ([#4794](https://github.com/containous/traefik/pull/4794) by [groovytron](https://github.com/groovytron))
+
+**Misc:**
+- Cherry pick v1.7 into v2.0 ([#4948](https://github.com/containous/traefik/pull/4948) by [ldez](https://github.com/ldez))
+- Cherry pick v1.7 into v2.0 ([#4823](https://github.com/containous/traefik/pull/4823) by [ldez](https://github.com/ldez))
+
+## [v1.7.12](https://github.com/containous/traefik/tree/v1.7.12) (2019-05-29)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.11...v1.7.12)
+
+**Bug fixes:**
+- **[acme]** Allow SANs for wildcards domain. ([#4821](https://github.com/containous/traefik/pull/4821) by [vizv](https://github.com/vizv))
+- **[acme]** fix: update lego. ([#4910](https://github.com/containous/traefik/pull/4910) by [ldez](https://github.com/ldez))
+- **[api,authentication]** Remove authentication hashes from API ([#4918](https://github.com/containous/traefik/pull/4918) by [ldez](https://github.com/ldez))
+- **[consul]** Enhance KV logs. ([#4877](https://github.com/containous/traefik/pull/4877) by [ldez](https://github.com/ldez))
+- **[k8s]** Fix kubernetes template for backend responseforwarding flushinterval setting ([#4901](https://github.com/containous/traefik/pull/4901) by [ravilr](https://github.com/ravilr))
+- **[metrics]** Upgraded DataDog tracing library to 1.13.0 ([#4878](https://github.com/containous/traefik/pull/4878) by [aantono](https://github.com/aantono))
+- **[server]** Add missing callback on close of hijacked connections ([#4900](https://github.com/containous/traefik/pull/4900) by [ravilr](https://github.com/ravilr))
+
+**Documentation:**
+- **[docker]** Docs: Troubleshooting help for Docker Swarm labels ([#4751](https://github.com/containous/traefik/pull/4751) by [gregberns](https://github.com/gregberns))
+- **[logs]** Adds a log fields documentation. ([#4890](https://github.com/containous/traefik/pull/4890) by [ldez](https://github.com/ldez))
+
+## [v1.7.11](https://github.com/containous/traefik/tree/v1.7.11) (2019-04-26)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.10...v1.7.11)
+
+**Enhancements:**
+- **[k8s,k8s/ingress]** Enhance k8s tests maintainability ([#4696](https://github.com/containous/traefik/pull/4696) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[acme]** fix: update lego. ([#4800](https://github.com/containous/traefik/pull/4800) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Forward all header values from forward auth response ([#4515](https://github.com/containous/traefik/pull/4515) by [ctas582](https://github.com/ctas582))
+- **[cluster]** Remove usage of github.com/satori/go.uuid ([#4722](https://github.com/containous/traefik/pull/4722) by [aaslamin](https://github.com/aaslamin))
+- **[kv]** Enhance KV client error management ([#4819](https://github.com/containous/traefik/pull/4819) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tls]** Improve log message about redundant TLS certificate ([#4765](https://github.com/containous/traefik/pull/4765) by [mpl](https://github.com/mpl))
+- **[tracing]** Update zipkin-go-opentracing. ([#4720](https://github.com/containous/traefik/pull/4720) by [ldez](https://github.com/ldez))
+
+**Documentation:**
+- **[acme]** Documentation Update: Hosting.de wildcard support tested ([#4747](https://github.com/containous/traefik/pull/4747) by [martinhoefling](https://github.com/martinhoefling))
+- **[acme]** Update Wildcard Domain documentation ([#4682](https://github.com/containous/traefik/pull/4682) by [DWSR](https://github.com/DWSR))
+- **[middleware]** Keep consistent order ([#4690](https://github.com/containous/traefik/pull/4690) by [maxifom](https://github.com/maxifom))
+
+## [v2.0.0-alpha4](https://github.com/containous/traefik/tree/v2.0.0-alpha4) (2019-04-17)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha3...v2.0.0-alpha4)
+
+**Enhancements:**
+- **[logs]** log.loglevel becomes log.level in configuration ([#4775](https://github.com/containous/traefik/pull/4775) by [juliens](https://github.com/juliens))
+- **[marathon,tcp]** Handle TCP in the marathon provider ([#4728](https://github.com/containous/traefik/pull/4728) by [juliens](https://github.com/juliens))
+- **[middleware]** Enable CORS configuration ([#3809](https://github.com/containous/traefik/pull/3809) by [dtomcej](https://github.com/dtomcej))
+- **[rancher]** Add Rancher provider ([#4647](https://github.com/containous/traefik/pull/4647) by [SantoDE](https://github.com/SantoDE))
+- **[tracing]** Update tracing dependencies ([#4721](https://github.com/containous/traefik/pull/4721) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[docker]** Insensitive case for allow-empty value. ([#4745](https://github.com/containous/traefik/pull/4745) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix response modifier initial building ([#4719](https://github.com/containous/traefik/pull/4719) by [mpl](https://github.com/mpl))
+- **[middleware]** Set X-Forwarded-* headers ([#4707](https://github.com/containous/traefik/pull/4707) by [mpl](https://github.com/mpl))
+- **[tcp]** Fix EOF error ([#4733](https://github.com/containous/traefik/pull/4733) by [juliens](https://github.com/juliens))
+
+**Documentation:**
+- **[acme]** Use the same case every where for entryPoints. ([#4764](https://github.com/containous/traefik/pull/4764) by [ldez](https://github.com/ldez))
+- **[docker]** Fix two minor nits in Traefik 2.0 docs ([#4692](https://github.com/containous/traefik/pull/4692) by [cfra](https://github.com/cfra))
+- **[k8s,k8s/crd]** k8s static configuration explanation ([#4767](https://github.com/containous/traefik/pull/4767) by [ldez](https://github.com/ldez))
+- **[marathon]** Enhance Marathon documentation ([#4776](https://github.com/containous/traefik/pull/4776) by [ldez](https://github.com/ldez))
+- **[middleware,k8s,k8s/crd]** Fix typo: middleware -> middlewares. ([#4781](https://github.com/containous/traefik/pull/4781) by [ldez](https://github.com/ldez))
+- **[middleware]** Adds middlewares examples for k8s. ([#4713](https://github.com/containous/traefik/pull/4713) by [ldez](https://github.com/ldez))
+- **[middleware]** Remove invalid commas. ([#4706](https://github.com/containous/traefik/pull/4706) by [ldez](https://github.com/ldez))
+- **[middleware]** Fix doc about removing headers ([#4708](https://github.com/containous/traefik/pull/4708) by [mpl](https://github.com/mpl))
+- **[middleware]** Update the middleware documentation ([#4729](https://github.com/containous/traefik/pull/4729) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[tracing]** Fix typo in tracing docs ([#4737](https://github.com/containous/traefik/pull/4737) by [timoschwarzer](https://github.com/timoschwarzer))
+- Improve the Documentation with a Reference Section ([#4714](https://github.com/containous/traefik/pull/4714) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Adds a note in traefik.sample.toml ([#4757](https://github.com/containous/traefik/pull/4757) by [ldez](https://github.com/ldez))
+- Update to v2.0 readme links ([#4700](https://github.com/containous/traefik/pull/4700) by [karnthis](https://github.com/karnthis))
+- Remove dumpcerts.sh ([#4783](https://github.com/containous/traefik/pull/4783) by [ldez](https://github.com/ldez))
+
+**Misc:**
+- Cherry pick v1.7 into v2.0 ([#4787](https://github.com/containous/traefik/pull/4787) by [ldez](https://github.com/ldez))
+- Cherry pick v1.7 into v2.0 ([#4695](https://github.com/containous/traefik/pull/4695) by [jbdoumenjou](https://github.com/jbdoumenjou))
+
+## [v2.0.0-alpha3](https://github.com/containous/traefik/tree/v2.0.0-alpha3) (2019-03-29)
+[All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha2...v2.0.0-alpha3)
+
+**Enhancements:**
+- **[acme,k8s,k8s/crd]** Document the TLS with ACME case ([#4654](https://github.com/containous/traefik/pull/4654) by [mpl](https://github.com/mpl))
+- **[docker,tcp]** Add support for TCP labels in Docker provider ([#4621](https://github.com/containous/traefik/pull/4621) by [juliens](https://github.com/juliens))
+- **[provider]** Remove BaseProvider ([#4661](https://github.com/containous/traefik/pull/4661) by [ldez](https://github.com/ldez))
+
+**Bug fixes:**
+- **[server]** Fix panic while server shutdown ([#4644](https://github.com/containous/traefik/pull/4644) by [juliens](https://github.com/juliens))
+
+**Documentation:**
+- **[acme,k8s,k8s/crd]** Full ACME+CRD example ([#4652](https://github.com/containous/traefik/pull/4652) by [mpl](https://github.com/mpl))
+- **[acme]** Enhance manual dnsChallenge documentation ([#4636](https://github.com/containous/traefik/pull/4636) by [ntaranov](https://github.com/ntaranov))
+- **[docker]** Fix Getting started ([#4646](https://github.com/containous/traefik/pull/4646) by [mmatur](https://github.com/mmatur))
+- **[docker]** docker-compose examples ([#4642](https://github.com/containous/traefik/pull/4642) by [karnthis](https://github.com/karnthis))
+- **[middleware]** Fix typo in forwardAuth middleware documentation ([#4638](https://github.com/containous/traefik/pull/4638) by [AkeemMcLennon](https://github.com/AkeemMcLennon))
+- **[middleware]** Enhance middleware examples. ([#4680](https://github.com/containous/traefik/pull/4680) by [ldez](https://github.com/ldez))
+- Fix typos in docs ([#4662](https://github.com/containous/traefik/pull/4662) by [SeMeKh](https://github.com/SeMeKh))
+- Remove old links in readme ([#4651](https://github.com/containous/traefik/pull/4651) by [ldez](https://github.com/ldez))
+- Fix some minors errors on the documentation ([#4664](https://github.com/containous/traefik/pull/4664) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- Fix dead maintainers link on the README.md ([#4639](https://github.com/containous/traefik/pull/4639) by [benjaminch](https://github.com/benjaminch))
+- Update traefik.sample.toml ([#4657](https://github.com/containous/traefik/pull/4657) by [ldez](https://github.com/ldez))
+
 ## [v2.0.0-alpha2](https://github.com/containous/traefik/tree/v2.0.0-alpha2) (2019-03-19)
 [All Commits](https://github.com/containous/traefik/compare/v2.0.0-alpha1...v2.0.0-alpha2)
 
@@ -105,6 +345,23 @@
 - Merge v1.7.0-rc4 into master ([#3867](https://github.com/containous/traefik/pull/3867) by [ldez](https://github.com/ldez))
 - Merge v1.7.0-rc2 into master ([#3634](https://github.com/containous/traefik/pull/3634) by [ldez](https://github.com/ldez))
 
+## [v1.7.10](https://github.com/containous/traefik/tree/v1.7.10) (2019-03-28)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.9...v1.7.10)
+
+**Bug fixes:**
+- **[acme]** fix: update lego. ([#4670](https://github.com/containous/traefik/pull/4670) by [ldez](https://github.com/ldez))
+- **[acme]** Migrate to go-acme/lego. ([#4577](https://github.com/containous/traefik/pull/4577) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Reorder Auth and TLSClientHeaders middleware ([#4557](https://github.com/containous/traefik/pull/4557) by [tomberek](https://github.com/tomberek))
+- **[k8s/ingress]** Support external name service on global default backend ([#4564](https://github.com/containous/traefik/pull/4564) by [kippandrew](https://github.com/kippandrew))
+- **[k8s/ingress]** Loop through service ports for global backend ([#4486](https://github.com/containous/traefik/pull/4486) by [dtomcej](https://github.com/dtomcej))
+- **[k8s]** Add entrypoints prefix in kubernetes frontend/backend id  ([#4679](https://github.com/containous/traefik/pull/4679) by [juliens](https://github.com/juliens))
+- **[websocket]** Exclude websocket connections from Average Response Time ([#4313](https://github.com/containous/traefik/pull/4313) by [siyu6974](https://github.com/siyu6974))
+- **[middleware]** Added support for configuring trace headers for DataDog tracing ([#4516](https://github.com/containous/traefik/pull/4516) by [aantono](https://github.com/aantono))
+
+**Documentation:**
+- **[acme]** Add _FILE Environment Variable Documentation ([#4643](https://github.com/containous/traefik/pull/4643) by [dargmuesli](https://github.com/dargmuesli))
+- **[docker]** Add TraefikEE as security workaround ([#4606](https://github.com/containous/traefik/pull/4606) by [emilevauge](https://github.com/emilevauge))
+
 ## [v1.7.9](https://github.com/containous/traefik/tree/v1.7.9) (2019-02-11)
 [All Commits](https://github.com/containous/traefik/compare/v1.7.8...v1.7.9)
 
@@ -130,7 +387,7 @@
 - **[acme]** Updates lego. ([#4376](https://github.com/containous/traefik/pull/4376) by [ldez](https://github.com/ldez))
 - **[docker]** Fixes docker swarm mode refresh second for KV. ([#4420](https://github.com/containous/traefik/pull/4420) by [ldez](https://github.com/ldez))
 - **[ecs]** Generic awsvpc support, not just Fargate ([#4360](https://github.com/containous/traefik/pull/4360) by [maartenvanderhoef](https://github.com/maartenvanderhoef))
-- **[ecs]** Cache exising task definitions to avoid rate limiting ([#4177](https://github.com/containous/traefik/pull/4177) by [hwhelan-CB](https://github.com/hwhelan-CB))
+- **[ecs]** Cache existing task definitions to avoid rate limiting ([#4177](https://github.com/containous/traefik/pull/4177) by [hwhelan-CB](https://github.com/hwhelan-CB))
 - **[tls]** Check for dynamic tls updates on configuration preload ([#4022](https://github.com/containous/traefik/pull/4022) by [ffilippopoulos](https://github.com/ffilippopoulos))
 - **[tracing]** Support Datadog tracer priority sampling ([#4359](https://github.com/containous/traefik/pull/4359) by [jcassee](https://github.com/jcassee))
 - Update to Go 1.11.5 [CVE-2019-6486](https://nvd.nist.gov/vuln/detail/CVE-2019-6486)
@@ -255,7 +512,7 @@
 **Bug fixes:**
 - **[acme]** DNS challenge Cloudflare auth zone ([#4042](https://github.com/containous/traefik/pull/4042) by [ldez](https://github.com/ldez))
 - **[acme]** ACME DNS challenges ([#3998](https://github.com/containous/traefik/pull/3998) by [ldez](https://github.com/ldez))
-- **[acme]** Don't initalize ACME provider if storage is empty ([#3988](https://github.com/containous/traefik/pull/3988) by [nmengin](https://github.com/nmengin))
+- **[acme]** Don't initialize ACME provider if storage is empty ([#3988](https://github.com/containous/traefik/pull/3988) by [nmengin](https://github.com/nmengin))
 - **[acme]** Fix: acme DNS providers ([#4021](https://github.com/containous/traefik/pull/4021) by [ldez](https://github.com/ldez))
 - **[acme]** Prevent some malformed errors in LE. ([#4015](https://github.com/containous/traefik/pull/4015) by [ldez](https://github.com/ldez))
 - **[authentication,consulcatalog,docker,ecs,etcd,kv,marathon,mesos,rancher]** Add the AuthResponseHeaders to the labels ([#3973](https://github.com/containous/traefik/pull/3973) by [Crypto89](https://github.com/Crypto89))
@@ -330,7 +587,7 @@
 - **[healthcheck]** Support all 2xx HTTP status code for health check. ([#3362](https://github.com/containous/traefik/pull/3362) by [ldez](https://github.com/ldez))
 - **[healthcheck]** Add HTTP headers to healthcheck. ([#3047](https://github.com/containous/traefik/pull/3047) by [zetaab](https://github.com/zetaab))
 - **[k8s]** Add more k8s tests ([#3491](https://github.com/containous/traefik/pull/3491) by [dtomcej](https://github.com/dtomcej))
-- **[k8s]** Substitude hardcoded "<namespace>/<name>" with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Substitute hardcoded "<namespace>/<name>" with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
 - **[k8s]** Custom frontend name for test helper ([#3444](https://github.com/containous/traefik/pull/3444) by [ldez](https://github.com/ldez))
 - **[k8s]** Add annotation to allow modifiers to be used properly in kubernetes ([#3481](https://github.com/containous/traefik/pull/3481) by [dtomcej](https://github.com/dtomcej))
 - **[k8s]** Create Global Backend Ingress ([#3404](https://github.com/containous/traefik/pull/3404) by [dtomcej](https://github.com/dtomcej))
@@ -627,7 +884,7 @@
 - **[healthcheck]** Support all 2xx HTTP status code for health check. ([#3362](https://github.com/containous/traefik/pull/3362) by [ldez](https://github.com/ldez))
 - **[healthcheck]** Add HTTP headers to healthcheck. ([#3047](https://github.com/containous/traefik/pull/3047) by [zetaab](https://github.com/zetaab))
 - **[k8s]** Add more k8s tests ([#3491](https://github.com/containous/traefik/pull/3491) by [dtomcej](https://github.com/dtomcej))
-- **[k8s]** Substitude hardcoded "<namespace>/<name>" with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
+- **[k8s]** Substitute hardcoded "<namespace>/<name>" with k8s ListerGetter ([#3470](https://github.com/containous/traefik/pull/3470) by [yue9944882](https://github.com/yue9944882))
 - **[k8s]** Custom frontend name for test helper ([#3444](https://github.com/containous/traefik/pull/3444) by [ldez](https://github.com/ldez))
 - **[k8s]** Add annotation to allow modifiers to be used properly in kubernetes ([#3481](https://github.com/containous/traefik/pull/3481) by [dtomcej](https://github.com/dtomcej))
 - **[k8s]** Create Global Backend Ingress ([#3404](https://github.com/containous/traefik/pull/3404) by [dtomcej](https://github.com/dtomcej))

CONTRIBUTING.md

@@ -1,3 +1,3 @@
 # Contributing
 
-See https://docs.traefik.io.
+See <https://docs.traefik.io/v2.0/contributing/thank-you/>.

Gopkg.toml

@@ -36,17 +36,17 @@ required = [
     non-go = false
     unused-packages = false
 
-[[constraint]]
-  branch = "master"
-  name = "github.com/ArthurHlt/go-eureka-client"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/ArthurHlt/go-eureka-client"
 
 [[constraint]]
   branch = "master"
   name = "github.com/BurntSushi/toml"
 
-[[constraint]]
-  branch = "master"
-  name = "github.com/BurntSushi/ty"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/BurntSushi/ty"
 
 [[constraint]]
   branch = "master"
@@ -61,18 +61,14 @@ required = [
   branch = "master"
   name = "github.com/armon/go-proxyproto"
 
-[[constraint]]
-  name = "github.com/aws/aws-sdk-go"
-  version = "1.13.11"
+#[[constraint]]
+#  name = "github.com/aws/aws-sdk-go"
+#  version = "1.13.11"
 
 [[constraint]]
   name = "github.com/cenkalti/backoff"
   version = "2.1.1"
 
-[[constraint]]
-  name = "github.com/containous/flaeg"
-  version = "1.4.1"
-
 [[constraint]]
   branch = "master"
   name = "github.com/containous/mux"
@@ -81,22 +77,19 @@ required = [
   branch = "containous-fork"
   name = "github.com/containous/alice"
 
-[[constraint]]
-  name = "github.com/containous/staert"
-  version = "3.1.2"
-
 #[[constraint]]
-#  name = "github.com/containous/traefik-extra-service-fabric"
-#  version = "1.3.0"
+#  name = "github.com/thoas/stats"
+#  # related to https://github.com/thoas/stats/pull/32
+#  revision = "4975baf6a358ed3ddaa42133996e1959f96c9300"
 
 [[constraint]]
   name = "github.com/coreos/go-systemd"
   version = "14.0.0"
 
-[[constraint]]
-  branch = "master"
-  name = "github.com/docker/leadership"
-  source = "github.com/containous/leadership"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/docker/leadership"
+#  source = "github.com/containous/leadership"
 
 [[constraint]]
   name = "github.com/eapache/channels"
@@ -118,31 +111,31 @@ required = [
 
 [[constraint]]
   name = "github.com/go-kit/kit"
-  version = "0.7.0"
+  version = "v0.9.0"
+
+[[constraint]]
+  name = "github.com/prometheus/client_golang"
+  version = "v1.0.0"
 
 [[constraint]]
   branch = "master"
   name = "github.com/gorilla/websocket"
 
-[[constraint]]
-  name = "github.com/hashicorp/consul"
-  version = "1.0.6"
-
-[[constraint]]
-  name = "github.com/influxdata/influxdb"
-  version = "1.3.7"
+#[[constraint]]
+#  name = "github.com/hashicorp/consul"
+#  version = "1.0.6"
 
 #[[constraint]]
 #  branch = "master"
 #  name = "github.com/jjcollinge/servicefabric"
 
-[[constraint]]
-  branch = "master"
-  name = "github.com/abronan/valkeyrie"
+#[[constraint]]
+#  branch = "master"
+#  name = "github.com/abronan/valkeyrie"
 
-[[constraint]]
-  name = "github.com/mesosphere/mesos-dns"
-  source = "https://github.com/containous/mesos-dns.git"
+#[[constraint]]
+#  name = "github.com/mesosphere/mesos-dns"
+#  source = "https://github.com/containous/mesos-dns.git"
 
 [[constraint]]
   name = "github.com/opentracing/opentracing-go"
@@ -154,12 +147,8 @@ required = [
   source = "github.com/containous/go-rancher-metadata"
 
 [[constraint]]
-  branch = "master"
-  name = "github.com/ryanuber/go-glob"
-
-[[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.1.0"
+  name = "github.com/Masterminds/sprig"
+  version = "2.19.0"
 
 [[constraint]]
   branch = "master"
@@ -171,11 +160,13 @@ required = [
 
 [[constraint]]
   name = "github.com/uber/jaeger-client-go"
-  version = "2.15.0"
+  source = "github.com/jaegertracing/jaeger-client-go"
+  version = "2.16.0"
 
 [[constraint]]
   name = "github.com/uber/jaeger-lib"
-  version = "1.3.0"
+  source = "github.com/jaegertracing/jaeger-lib"
+  version = "2.0.0"
 
 [[constraint]]
   branch = "v1"
@@ -190,13 +181,20 @@ required = [
   name = "github.com/vulcand/oxy"
 
 [[constraint]]
-  branch = "master"
   name = "github.com/go-acme/lego"
-#  version = "2.4.0"
+  version = "2.6.0"
 
 [[constraint]]
   name = "google.golang.org/grpc"
-  version = "1.5.2"
+  version = "1.13.0"
+
+[[override]]
+  name = "golang.org/x/sys"
+  revision = "1c9583448a9c3aa0f9a6a5241bf73c0bd8aafded"
+
+[[constraint]]
+  name = "github.com/golang/protobuf"
+  version = "v1.3.0"
 
 [[constraint]]
   name = "gopkg.in/fsnotify.v1"
@@ -275,8 +273,12 @@ required = [
 
 [[constraint]]
   name = "gopkg.in/DataDog/dd-trace-go.v1"
-  version = "1.7.0"
+  version = "1.15.0"
 
 [[constraint]]
   name = "github.com/instana/go-sensor"
   version = "1.4.12"
+
+[[constraint]]
+  name = "github.com/ExpediaDotCom/haystack-client-go"
+  version = "0.2.3"

Makefile

@@ -1,4 +1,22 @@
-.PHONY: all docs docs-serve clear-static
+.PHONY: all docs docs-serve
+
+SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
+
+TAG_NAME := $(shell git tag -l --contains HEAD)
+SHA := $(shell git rev-parse HEAD)
+VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
+VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
+
+BIND_DIR := "dist"
+
+GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
+TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
+
+REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
+TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
+
+INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
+DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 
 TRAEFIK_ENVS := \
 	-e OS_ARCH_ARG \
@@ -11,123 +29,116 @@ TRAEFIK_ENVS := \
 	-e CI \
 	-e CONTAINER=DOCKER		# Indicator for integration tests that we are running inside a container.
 
-SRCS = $(shell git ls-files '*.go' | grep -v '^vendor/')
-
-TAG_NAME := $(shell git tag -l --contains HEAD)
-SHA := $(shell git rev-parse HEAD)
-VERSION_GIT := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
-VERSION := $(if $(VERSION),$(VERSION),$(VERSION_GIT))
-
-BIND_DIR := "dist"
 TRAEFIK_MOUNT := -v "$(CURDIR)/$(BIND_DIR):/go/src/github.com/containous/traefik/$(BIND_DIR)"
-
-GIT_BRANCH := $(subst heads/,,$(shell git rev-parse --abbrev-ref HEAD 2>/dev/null))
-TRAEFIK_DEV_IMAGE := traefik-dev$(if $(GIT_BRANCH),:$(subst /,-,$(GIT_BRANCH)))
-REPONAME := $(shell echo $(REPO) | tr '[:upper:]' '[:lower:]')
-TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
-INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
-
-DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
 DOCKER_RUN_TRAEFIK := docker run $(INTEGRATION_OPTS) -it $(DOCKER_RUN_OPTS)
 DOCKER_RUN_TRAEFIK_NOTTY := docker run $(INTEGRATION_OPTS) -i $(DOCKER_RUN_OPTS)
 
-print-%: ; @echo $*=$($*)
+PRE_TARGET ?= build-dev-image
 
 default: binary
 
-all: generate-webui build ## validate all checks, build linux binary, run all tests\ncross non-linux binaries
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh
-
-binary: generate-webui build ## build the linux binary
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary
-
-crossbinary-default: generate-webui build
-	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default
-
-crossbinary-default-parallel:
-	$(MAKE) generate-webui
-	$(MAKE) build crossbinary-default
-
-test: build ## run the unit and integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
-
-test-unit: build ## run the unit tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit
-
-test-integration: build ## run the integration tests
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate binary test-integration
-	TEST_HOST=1 ./script/make.sh test-integration
-
-validate: build  ## validate code, vendor
-	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate validate-lint validate-misspell validate-vendor
-
-build: dist
+## Build Dev Docker image
+build-dev-image: dist
 	docker build $(DOCKER_BUILD_ARGS) -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
 
-build-no-cache: dist
+## Build Dev Docker image without cache
+build-dev-image-no-cache: dist
 	docker build --no-cache -t "$(TRAEFIK_DEV_IMAGE)" -f build.Dockerfile .
 
-shell: build ## start a shell inside the build env
-	$(DOCKER_RUN_TRAEFIK) /bin/bash
-
-image-dirty: binary ## build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-image: clear-static binary ## clean up static directory and build a docker traefik image
-	docker build -t $(TRAEFIK_IMAGE) .
-
-docs:
-	make -C ./docs docs
-
-docs-serve:
-	make -C ./docs docs-serve
-
+## Create the "dist" directory
 dist:
 	mkdir dist
 
-run-dev:
-	go generate
-	go build ./cmd/traefik
-	./traefik
-
-clear-static:
-	rm -rf static
-
-build-webui:
+## Build WebUI Docker image
+build-webui-image:
 	docker build -t traefik-webui -f webui/Dockerfile webui
 
-generate-webui: build-webui
+## Generate WebUI
+generate-webui: build-webui-image
 	if [ ! -d "static" ]; then \
 		mkdir -p static; \
-		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui npm run build; \
+		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui npm run build:nc; \
 		docker run --rm -v "$$PWD/static":'/src/static' traefik-webui chown -R $(shell id -u):$(shell id -g) ../static; \
 		echo 'For more informations show `webui/readme.md`' > $$PWD/static/DONT-EDIT-FILES-IN-THIS-DIRECTORY.md; \
 	fi
 
-generate-crd:
-	./script/update-generated-crd-code.sh
+## Build the linux binary
+binary: generate-webui $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate binary
 
-lint:
-	script/validate-lint
+## Build the binary for the standard plaforms (linux, darwin, windows)
+crossbinary-default: generate-webui build-dev-image
+	$(DOCKER_RUN_TRAEFIK_NOTTY) ./script/make.sh generate crossbinary-default
 
-fmt:
-	gofmt -s -l -w $(SRCS)
+## Build the binary for the standard plaforms (linux, darwin, windows) in parallel
+crossbinary-default-parallel:
+	$(MAKE) generate-webui
+	$(MAKE) build-dev-image crossbinary-default
 
+## Run the unit and integration tests
+test: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) ./script/make.sh generate test-unit binary test-integration
+
+## Run the unit tests
+test-unit: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate test-unit
+
+## Pull all images for integration tests
 pull-images:
 	grep --no-filename -E '^\s+image:' ./integration/resources/compose/*.yml | awk '{print $$2}' | sort | uniq | xargs -P 6 -n 1 docker pull
 
+## Run the integration tests
+test-integration: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK),TEST_CONTAINER=1) ./script/make.sh generate binary test-integration
+	TEST_HOST=1 ./script/make.sh test-integration
+
+## Validate code and docs
+validate-files: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell
+	bash $(CURDIR)/script/validate-shell-script.sh
+
+## Validate code, docs, and vendor
+validate: $(PRE_TARGET)
+	$(if $(PRE_TARGET),$(DOCKER_RUN_TRAEFIK)) ./script/make.sh generate validate-lint validate-misspell validate-vendor
+	bash $(CURDIR)/script/validate-shell-script.sh
+
+## Clean up static directory and build a Docker Traefik image
+build-image: binary
+	rm -rf static
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Build a Docker Traefik image
+build-image-dirty: binary
+	docker build -t $(TRAEFIK_IMAGE) .
+
+## Start a shell inside the build env
+shell: build-dev-image
+	$(DOCKER_RUN_TRAEFIK) /bin/bash
+
+## Build documentation site
+docs:
+	make -C ./docs docs
+
+## Serve the documentation site localy
+docs-serve:
+	make -C ./docs docs-serve
+
+## Generate CRD clientset
+generate-crd:
+	./script/update-generated-crd-code.sh
+
+## Download dependencies
 dep-ensure:
 	dep ensure -v
 	./script/prune-dep.sh
 
+## Clean vendor directory
 dep-prune:
 	./script/prune-dep.sh
 
-help: ## this help
-	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {sub("\\\\n",sprintf("\n%22c"," "), $$2);printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST)
-
-release-packages: generate-webui build
+## Create packages for the release
+release-packages: generate-webui build-dev-image
 	rm -rf dist
 	$(DOCKER_RUN_TRAEFIK_NOTTY) goreleaser release --skip-publish
 	$(DOCKER_RUN_TRAEFIK_NOTTY) tar cfz dist/traefik-${VERSION}.src.tar.gz \
@@ -138,3 +149,12 @@ release-packages: generate-webui build
 		--exclude .github \
 		--exclude dist .
 	$(DOCKER_RUN_TRAEFIK_NOTTY) chown -R $(shell id -u):$(shell id -g) dist/
+
+## Format the Code
+fmt:
+	gofmt -s -l -w $(SRCS)
+
+run-dev:
+	go generate
+	go build ./cmd/traefik
+	./traefik

README.md

@@ -8,11 +8,11 @@
 [![Go Report Card](https://goreportcard.com/badge/containous/traefik)](http://goreportcard.com/report/containous/traefik)
 [![](https://images.microbadger.com/badges/image/traefik.svg)](https://microbadger.com/images/traefik)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/containous/traefik/blob/master/LICENSE.md)
-[![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
+[![Join the community support forum at https://community.containo.us/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.containo.us/)
 [![Twitter](https://img.shields.io/twitter/follow/traefik.svg?style=social)](https://twitter.com/intent/follow?screen_name=traefik)
 
 
-Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
+Traefik (pronounced _traffic_) is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy.
 Traefik integrates with your existing infrastructure components ([Docker](https://www.docker.com/), [Swarm mode](https://docs.docker.com/engine/swarm/), [Kubernetes](https://kubernetes.io), [Marathon](https://mesosphere.github.io/marathon/), [Consul](https://www.consul.io/), [Etcd](https://coreos.com/etcd/), [Rancher](https://rancher.com), [Amazon ECS](https://aws.amazon.com/ecs), ...) and configures itself automatically and dynamically.
 Pointing Traefik at your orchestrator should be the _only_ configuration step you need.
 
@@ -33,7 +33,7 @@ Pointing Traefik at your orchestrator should be the _only_ configuration step yo
 
 ---
 
-:construction: As stated in the [1.7 release note](https://blog.containo.us/traefik-1-7-yet-another-slice-of-awesomeness-2a9c99737889#782d), a significant update is in progress on the [master](https://github.com/containous/traefik/tree/master) branch. This branch will remain in constant evolution and prone to change with little notice, so use it for test purposes only.
+:warning: Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now. If you're testing out v2, please ensure you are using a [v2 configuration](https://docs.traefik.io/v2.0/).
 
 ## Overview
 
@@ -86,10 +86,6 @@ _(But if you'd rather configure some of your routes manually, Traefik supports t
 
 To get your hands on Traefik, you can use the [5-Minute Quickstart](http://docs.traefik.io/#the-traefik-quickstart-using-docker) in our documentation (you will need Docker).
 
-Alternatively, if you don't want to install anything on your computer, you can try Traefik online in this great [Katacoda tutorial](https://www.katacoda.com/courses/traefik/deploy-load-balancer) that shows how to load balance requests between multiple Docker containers. 
-
-If you are looking for a more comprehensive and real use-case example, you can also check [Play-With-Docker](http://training.play-with-docker.com/traefik-load-balancing/) to see how to load balance between multiple nodes.
-
 ## Web UI
 
 You can access the simple HTML frontend of Traefik.
@@ -102,11 +98,12 @@ You can access the simple HTML frontend of Traefik.
 You can find the complete documentation at [https://docs.traefik.io](https://docs.traefik.io).
 A collection of contributions around Traefik can be found at [https://awesome.traefik.io](https://awesome.traefik.io).
 
+:warning: If you're testing out v2, please ensure you are using the [v2 documentation](https://docs.traefik.io/v2.0/).
+
 ## Support
 
 To get community support, you can:
-- join the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
-- use [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
+- join the Traefik community forum: [![Join the chat at https://community.containo.us/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.containo.us/)
 
 If you need commercial support, please contact [Containo.us](https://containo.us) by mail: <mailto:support@containo.us>.
 
@@ -132,6 +129,8 @@ git clone https://github.com/containous/traefik
 
 ## Introductory Videos
 
+:warning: Please be aware that these videos are for v1.X. The old configurations for Traefik v1.X are NOT compatible with Traefik v2. If you're testing out v2, please ensure you are using a [v2 configuration](https://docs.traefik.io/v2.0/).
+
 Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at GopherCon 2017.
 You will learn Traefik basics in less than 10 minutes.
 
@@ -144,7 +143,7 @@ You will learn fundamental Traefik features and see some demos with Kubernetes.
 
 ## Maintainers
 
-[Information about process and maintainers](MAINTAINER.md)
+[Information about process and maintainers](docs/content/contributing/maintainers.md)
 
 ## Contributing
 

build.Dockerfile

@@ -1,19 +1,20 @@
 FROM golang:1.12-alpine
 
 RUN apk --update upgrade \
-&& apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \
-&& rm -rf /var/cache/apk/*
+    && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar ca-certificates tzdata \
+    && update-ca-certificates \
+    && rm -rf /var/cache/apk/*
 
 # Download golangci-lint and misspell binary to bin folder in $GOPATH
-RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b $GOPATH/bin v1.15.0 \
+RUN curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | bash -s -- -b $GOPATH/bin v1.17.1 \
     && go get github.com/client9/misspell/cmd/misspell
 
 # Download goreleaser binary to bin folder in $GOPATH
 RUN curl -sfL https://install.goreleaser.com/github.com/goreleaser/goreleaser.sh | sh
 
 # Which docker version to test on
-ARG DOCKER_VERSION=17.03.2
-ARG DEP_VERSION=0.5.0
+ARG DOCKER_VERSION=18.09.7
+ARG DEP_VERSION=0.5.4
 
 # Download go-bindata binary to bin folder in $GOPATH
 RUN mkdir -p /usr/local/bin \
@@ -27,7 +28,7 @@ RUN mkdir -p /usr/local/bin \
 
 # Download docker
 RUN mkdir -p /usr/local/bin \
-    && curl -fL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}-ce.tgz \
+    && curl -fL https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz \
     | tar -xzC /usr/local/bin --transform 's#^.+/##x'
 
 WORKDIR /go/src/github.com/containous/traefik

cmd/configuration.go

@@ -3,39 +3,27 @@ package cmd
 import (
 	"time"
 
-	"github.com/containous/flaeg/parse"
 	"github.com/containous/traefik/pkg/config/static"
-	"github.com/containous/traefik/pkg/middlewares/accesslog"
-	"github.com/containous/traefik/pkg/ping"
-	"github.com/containous/traefik/pkg/provider/docker"
-	"github.com/containous/traefik/pkg/provider/file"
-	"github.com/containous/traefik/pkg/provider/kubernetes/ingress"
-	"github.com/containous/traefik/pkg/provider/marathon"
-	"github.com/containous/traefik/pkg/provider/rest"
-	"github.com/containous/traefik/pkg/tracing/datadog"
-	"github.com/containous/traefik/pkg/tracing/instana"
-	"github.com/containous/traefik/pkg/tracing/jaeger"
-	"github.com/containous/traefik/pkg/tracing/zipkin"
 	"github.com/containous/traefik/pkg/types"
-	jaegercli "github.com/uber/jaeger-client-go"
 )
 
-// TraefikConfiguration holds GlobalConfiguration and other stuff
-type TraefikConfiguration struct {
-	static.Configuration `mapstructure:",squash" export:"true"`
-	ConfigFile           string `short:"c" description:"Configuration file to use (TOML)." export:"true"`
+// TraefikCmdConfiguration wraps the static configuration and extra parameters.
+type TraefikCmdConfiguration struct {
+	static.Configuration `export:"true"`
+	// ConfigFile is the path to the configuration file.
+	ConfigFile string `description:"Configuration file to use. If specified all other flags are ignored." export:"true"`
 }
 
-// NewTraefikConfiguration creates a TraefikConfiguration with default values
-func NewTraefikConfiguration() *TraefikConfiguration {
-	return &TraefikConfiguration{
+// NewTraefikConfiguration creates a TraefikCmdConfiguration with default values.
+func NewTraefikConfiguration() *TraefikCmdConfiguration {
+	return &TraefikCmdConfiguration{
 		Configuration: static.Configuration{
 			Global: &static.Global{
 				CheckNewVersion: true,
 			},
 			EntryPoints: make(static.EntryPoints),
 			Providers: &static.Providers{
-				ProvidersThrottleDuration: parse.Duration(2 * time.Second),
+				ProvidersThrottleDuration: types.Duration(2 * time.Second),
 			},
 			ServersTransport: &static.ServersTransport{
 				MaxIdleConnsPerHost: 200,
@@ -44,153 +32,3 @@ func NewTraefikConfiguration() *TraefikConfiguration {
 		ConfigFile: "",
 	}
 }
-
-// NewTraefikDefaultPointersConfiguration creates a TraefikConfiguration with pointers default values
-func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
-	// default File
-	var defaultFile file.Provider
-	defaultFile.Watch = true
-	defaultFile.Filename = "" // needs equivalent to  viper.ConfigFileUsed()
-
-	// default Ping
-	var defaultPing = ping.Handler{
-		EntryPoint: "traefik",
-	}
-
-	// default TraefikLog
-	defaultTraefikLog := types.TraefikLog{
-		Format:   "common",
-		FilePath: "",
-	}
-
-	// default AccessLog
-	defaultAccessLog := types.AccessLog{
-		Format:   accesslog.CommonFormat,
-		FilePath: "",
-		Filters:  &types.AccessLogFilters{},
-		Fields: &types.AccessLogFields{
-			DefaultMode: types.AccessLogKeep,
-			Headers: &types.FieldHeaders{
-				DefaultMode: types.AccessLogKeep,
-			},
-		},
-	}
-
-	// default Tracing
-	defaultTracing := static.Tracing{
-		Backend:       "jaeger",
-		ServiceName:   "traefik",
-		SpanNameLimit: 0,
-		Jaeger: &jaeger.Config{
-			SamplingServerURL:      "http://localhost:5778/sampling",
-			SamplingType:           "const",
-			SamplingParam:          1.0,
-			LocalAgentHostPort:     "127.0.0.1:6831",
-			Propagation:            "jaeger",
-			Gen128Bit:              false,
-			TraceContextHeaderName: jaegercli.TraceContextHeaderName,
-		},
-		Zipkin: &zipkin.Config{
-			HTTPEndpoint: "http://localhost:9411/api/v1/spans",
-			SameSpan:     false,
-			ID128Bit:     true,
-			Debug:        false,
-			SampleRate:   1.0,
-		},
-		DataDog: &datadog.Config{
-			LocalAgentHostPort: "localhost:8126",
-			GlobalTag:          "",
-			Debug:              false,
-			PrioritySampling:   false,
-		},
-		Instana: &instana.Config{
-			LocalAgentHost: "localhost",
-			LocalAgentPort: 42699,
-			LogLevel:       "info",
-		},
-	}
-
-	// default ApiConfiguration
-	defaultAPI := static.API{
-		EntryPoint: "traefik",
-		Dashboard:  true,
-	}
-	defaultAPI.Statistics = &types.Statistics{
-		RecentErrors: 10,
-	}
-
-	// default Metrics
-	defaultMetrics := types.Metrics{
-		Prometheus: &types.Prometheus{
-			Buckets:    types.Buckets{0.1, 0.3, 1.2, 5},
-			EntryPoint: static.DefaultInternalEntryPointName,
-		},
-		Datadog: &types.Datadog{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		StatsD: &types.Statsd{
-			Address:      "localhost:8125",
-			PushInterval: "10s",
-		},
-		InfluxDB: &types.InfluxDB{
-			Address:      "localhost:8089",
-			Protocol:     "udp",
-			PushInterval: "10s",
-		},
-	}
-
-	defaultResolver := types.HostResolverConfig{
-		CnameFlattening: false,
-		ResolvConfig:    "/etc/resolv.conf",
-		ResolvDepth:     5,
-	}
-
-	var defaultDocker docker.Provider
-	defaultDocker.Watch = true
-	defaultDocker.ExposedByDefault = true
-	defaultDocker.Endpoint = "unix:///var/run/docker.sock"
-	defaultDocker.SwarmMode = false
-	defaultDocker.SwarmModeRefreshSeconds = 15
-	defaultDocker.DefaultRule = docker.DefaultTemplateRule
-
-	// default Rest
-	var defaultRest rest.Provider
-	defaultRest.EntryPoint = static.DefaultInternalEntryPointName
-
-	// default Marathon
-	var defaultMarathon marathon.Provider
-	defaultMarathon.Watch = true
-	defaultMarathon.Endpoint = "http://127.0.0.1:8080"
-	defaultMarathon.ExposedByDefault = true
-	defaultMarathon.DialerTimeout = parse.Duration(5 * time.Second)
-	defaultMarathon.ResponseHeaderTimeout = parse.Duration(60 * time.Second)
-	defaultMarathon.TLSHandshakeTimeout = parse.Duration(5 * time.Second)
-	defaultMarathon.KeepAlive = parse.Duration(10 * time.Second)
-	defaultMarathon.DefaultRule = marathon.DefaultTemplateRule
-
-	// default Kubernetes
-	var defaultKubernetes ingress.Provider
-	defaultKubernetes.Watch = true
-
-	defaultProviders := static.Providers{
-		File:       &defaultFile,
-		Docker:     &defaultDocker,
-		Rest:       &defaultRest,
-		Marathon:   &defaultMarathon,
-		Kubernetes: &defaultKubernetes,
-	}
-
-	return &TraefikConfiguration{
-		Configuration: static.Configuration{
-			Providers:    &defaultProviders,
-			Log:          &defaultTraefikLog,
-			AccessLog:    &defaultAccessLog,
-			Ping:         &defaultPing,
-			API:          &defaultAPI,
-			Metrics:      &defaultMetrics,
-			Tracing:      &defaultTracing,
-			HostResolver: &defaultResolver,
-		},
-	}
-}

cmd/healthcheck/healthcheck.go

@@ -7,34 +7,34 @@ import (
 	"os"
 	"time"
 
-	"github.com/containous/flaeg"
-	"github.com/containous/traefik/cmd"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/config/static"
 )
 
-// NewCmd builds a new HealthCheck command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "healthcheck",
-		Description:           `Calls traefik /ping to check health (web provider must be enabled)`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run:                   runCmd(traefikConfiguration),
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
+// NewCmd builds a new HealthCheck command.
+func NewCmd(traefikConfiguration *static.Configuration, loaders []cli.ResourceLoader) *cli.Command {
+	return &cli.Command{
+		Name:          "healthcheck",
+		Description:   `Calls Traefik /ping to check the health of Traefik (the API must be enabled).`,
+		Configuration: traefikConfiguration,
+		Run:           runCmd(traefikConfiguration),
+		Resources:     loaders,
 	}
 }
 
-func runCmd(traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		traefikConfiguration.Configuration.SetEffectiveConfiguration(traefikConfiguration.ConfigFile)
+func runCmd(traefikConfiguration *static.Configuration) func(_ []string) error {
+	return func(_ []string) error {
+		traefikConfiguration.SetEffectiveConfiguration()
 
-		resp, errPing := Do(traefikConfiguration.Configuration)
+		resp, errPing := Do(*traefikConfiguration)
+		if resp != nil {
+			resp.Body.Close()
+		}
 		if errPing != nil {
 			fmt.Printf("Error calling healthcheck: %s\n", errPing)
 			os.Exit(1)
 		}
+
 		if resp.StatusCode != http.StatusOK {
 			fmt.Printf("Bad healthcheck status: %s\n", resp.Status)
 			os.Exit(1)
@@ -50,7 +50,8 @@ func Do(staticConfiguration static.Configuration) (*http.Response, error) {
 	if staticConfiguration.Ping == nil {
 		return nil, errors.New("please enable `ping` to use health check")
 	}
-	pingEntryPoint, ok := staticConfiguration.EntryPoints[staticConfiguration.Ping.EntryPoint]
+
+	pingEntryPoint, ok := staticConfiguration.EntryPoints["traefik"]
 	if !ok {
 		return nil, errors.New("missing `ping` entrypoint")
 	}

cmd/storeconfig/storeconfig.go

@@ -1,150 +0,0 @@
-package storeconfig
-
-import (
-	"encoding/json"
-	"fmt"
-	stdlog "log"
-
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
-	"github.com/containous/traefik/cmd"
-)
-
-// NewCmd builds a new StoreConfig command
-func NewCmd(traefikConfiguration *cmd.TraefikConfiguration, traefikPointersConfiguration *cmd.TraefikConfiguration) *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "storeconfig",
-		Description:           `Stores the static traefik configuration into a Key-value stores. Traefik will not start.`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		HideHelp:              true, // TODO storeconfig
-		Metadata: map[string]string{
-			"parseAllSources": "true",
-		},
-	}
-}
-
-// Run store config in KV
-func Run(kv *staert.KvSource, traefikConfiguration *cmd.TraefikConfiguration) func() error {
-	return func() error {
-		if kv == nil {
-			return fmt.Errorf("error using command storeconfig, no Key-value store defined")
-		}
-
-		fileConfig := traefikConfiguration.Providers.File
-		if fileConfig != nil {
-			traefikConfiguration.Providers.File = nil
-			if len(fileConfig.Filename) == 0 && len(fileConfig.Directory) == 0 {
-				fileConfig.Filename = traefikConfiguration.ConfigFile
-			}
-		}
-
-		jsonConf, err := json.Marshal(traefikConfiguration.Configuration)
-		if err != nil {
-			return err
-		}
-		stdlog.Printf("Storing configuration: %s\n", jsonConf)
-
-		err = kv.StoreConfig(traefikConfiguration.Configuration)
-		if err != nil {
-			return err
-		}
-
-		if fileConfig != nil {
-			jsonConf, err = json.Marshal(fileConfig)
-			if err != nil {
-				return err
-			}
-
-			stdlog.Printf("Storing file configuration: %s\n", jsonConf)
-			config, err := fileConfig.BuildConfiguration()
-			if err != nil {
-				return err
-			}
-
-			stdlog.Print("Writing config to KV")
-			err = kv.StoreConfig(config)
-			if err != nil {
-				return err
-			}
-		}
-
-		// if traefikConfiguration.Configuration.ACME != nil {
-		// 	account := &acme.Account{}
-		//
-		// 	accountInitialized, err := keyExists(kv, traefikConfiguration.Configuration.ACME.Storage)
-		// 	if err != nil && err != store.ErrKeyNotFound {
-		// 		return err
-		// 	}
-		//
-		// 	// Check to see if ACME account object is already in kv store
-		// 	if traefikConfiguration.Configuration.ACME.OverrideCertificates || !accountInitialized {
-		//
-		// 		// Stores the ACME Account into the KV Store
-		// 		// Certificates in KV Stores will be overridden
-		// 		meta := cluster.NewMetadata(account)
-		// 		err = meta.Marshall()
-		// 		if err != nil {
-		// 			return err
-		// 		}
-		//
-		// 		source := staert.KvSource{
-		// 			Store:  kv,
-		// 			Prefix: traefikConfiguration.Configuration.ACME.Storage,
-		// 		}
-		//
-		// 		err = source.StoreConfig(meta)
-		// 		if err != nil {
-		// 			return err
-		// 		}
-		// 	}
-		// }
-		return nil
-	}
-}
-
-// func keyExists(source *staert.KvSource, key string) (bool, error) {
-// 	list, err := source.List(key, nil)
-// 	if err != nil {
-// 		return false, err
-// 	}
-//
-// 	return len(list) > 0, nil
-// }
-
-// CreateKvSource creates KvSource
-// TLS support is enable for Consul and Etcd backends
-func CreateKvSource(traefikConfiguration *cmd.TraefikConfiguration) (*staert.KvSource, error) {
-	var kv *staert.KvSource
-	// var kvStore store.Store
-	var err error
-
-	// TODO kv store
-	// switch {
-	// case traefikConfiguration.Providers.Consul != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Consul.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Consul.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Etcd != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Etcd.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Etcd.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Zookeeper != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Zookeeper.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Zookeeper.Prefix,
-	// 	}
-	// case traefikConfiguration.Providers.Boltdb != nil:
-	// 	kvStore, err = traefikConfiguration.Providers.Boltdb.CreateStore()
-	// 	kv = &staert.KvSource{
-	// 		Store:  kvStore,
-	// 		Prefix: traefikConfiguration.Providers.Boltdb.Prefix,
-	// 	}
-	// }
-	return kv, err
-}

cmd/traefik/traefik.go

@@ -4,38 +4,31 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	fmtlog "log"
+	stdlog "log"
 	"net/http"
 	"os"
 	"path/filepath"
-	"reflect"
 	"strings"
 	"time"
 
-	"github.com/cenkalti/backoff"
-	"github.com/containous/flaeg"
-	"github.com/containous/staert"
 	"github.com/containous/traefik/autogen/genstatic"
 	"github.com/containous/traefik/cmd"
 	"github.com/containous/traefik/cmd/healthcheck"
-	"github.com/containous/traefik/cmd/storeconfig"
 	cmdVersion "github.com/containous/traefik/cmd/version"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/collector"
-	"github.com/containous/traefik/pkg/config"
+	"github.com/containous/traefik/pkg/config/dynamic"
 	"github.com/containous/traefik/pkg/config/static"
-	"github.com/containous/traefik/pkg/job"
 	"github.com/containous/traefik/pkg/log"
+	"github.com/containous/traefik/pkg/provider/acme"
 	"github.com/containous/traefik/pkg/provider/aggregator"
-	"github.com/containous/traefik/pkg/provider/kubernetes/k8s"
 	"github.com/containous/traefik/pkg/safe"
 	"github.com/containous/traefik/pkg/server"
 	"github.com/containous/traefik/pkg/server/router"
 	traefiktls "github.com/containous/traefik/pkg/tls"
-	"github.com/containous/traefik/pkg/types"
 	"github.com/containous/traefik/pkg/version"
 	"github.com/coreos/go-systemd/daemon"
 	assetfs "github.com/elazarl/go-bindata-assetfs"
-	"github.com/ogier/pflag"
 	"github.com/sirupsen/logrus"
 	"github.com/vulcand/oxy/roundrobin"
 )
@@ -48,162 +41,57 @@ func init() {
 	os.Setenv("GODEBUG", goDebug+"tls13=1")
 }
 
-// sliceOfStrings is the parser for []string
-type sliceOfStrings []string
-
-// String is the method to format the flag's value, part of the flag.Value interface.
-// The String method's output will be used in diagnostics.
-func (s *sliceOfStrings) String() string {
-	return strings.Join(*s, ",")
-}
-
-// Set is the method to set the flag value, part of the flag.Value interface.
-// Set's argument is a string to be parsed to set the flag.
-// It's a comma-separated list, so we split it.
-func (s *sliceOfStrings) Set(value string) error {
-	parts := strings.Split(value, ",")
-	if len(parts) == 0 {
-		return fmt.Errorf("bad []string format: %s", value)
-	}
-	for _, entrypoint := range parts {
-		*s = append(*s, entrypoint)
-	}
-	return nil
-}
-
-// Get return the []string
-func (s *sliceOfStrings) Get() interface{} {
-	return *s
-}
-
-// SetValue sets the []string with val
-func (s *sliceOfStrings) SetValue(val interface{}) {
-	*s = val.([]string)
-}
-
-// Type is type of the struct
-func (s *sliceOfStrings) Type() string {
-	return "sliceOfStrings"
-}
-
 func main() {
 	// traefik config inits
-	traefikConfiguration := cmd.NewTraefikConfiguration()
-	traefikPointersConfiguration := cmd.NewTraefikDefaultPointersConfiguration()
+	tConfig := cmd.NewTraefikConfiguration()
 
-	// traefik Command init
-	traefikCmd := &flaeg.Command{
+	loaders := []cli.ResourceLoader{&cli.FileLoader{}, &cli.FlagLoader{}, &cli.EnvLoader{}}
+
+	cmdTraefik := &cli.Command{
 		Name: "traefik",
-		Description: `traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
+		Description: `Traefik is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease.
 Complete documentation is available at https://traefik.io`,
-		Config:                traefikConfiguration,
-		DefaultPointersConfig: traefikPointersConfiguration,
-		Run: func() error {
-			return runCmd(&traefikConfiguration.Configuration, traefikConfiguration.ConfigFile)
+		Configuration: tConfig,
+		Resources:     loaders,
+		Run: func(_ []string) error {
+			return runCmd(&tConfig.Configuration)
 		},
 	}
 
-	// storeconfig Command init
-	storeConfigCmd := storeconfig.NewCmd(traefikConfiguration, traefikPointersConfiguration)
-
-	// init flaeg source
-	f := flaeg.New(traefikCmd, os.Args[1:])
-	// add custom parsers
-	f.AddParser(reflect.TypeOf(static.EntryPoints{}), &static.EntryPoints{})
-
-	f.AddParser(reflect.SliceOf(reflect.TypeOf("")), &sliceOfStrings{})
-	f.AddParser(reflect.TypeOf(traefiktls.FilesOrContents{}), &traefiktls.FilesOrContents{})
-	f.AddParser(reflect.TypeOf(types.Constraints{}), &types.Constraints{})
-	f.AddParser(reflect.TypeOf(k8s.Namespaces{}), &k8s.Namespaces{})
-	f.AddParser(reflect.TypeOf([]types.Domain{}), &types.Domains{})
-	f.AddParser(reflect.TypeOf(types.DNSResolvers{}), &types.DNSResolvers{})
-	f.AddParser(reflect.TypeOf(types.Buckets{}), &types.Buckets{})
-
-	f.AddParser(reflect.TypeOf(types.StatusCodes{}), &types.StatusCodes{})
-	f.AddParser(reflect.TypeOf(types.FieldNames{}), &types.FieldNames{})
-	f.AddParser(reflect.TypeOf(types.FieldHeaderNames{}), &types.FieldHeaderNames{})
-
-	// add commands
-	f.AddCommand(cmdVersion.NewCmd())
-	f.AddCommand(storeConfigCmd)
-	f.AddCommand(healthcheck.NewCmd(traefikConfiguration, traefikPointersConfiguration))
-
-	usedCmd, err := f.GetCommand()
+	err := cmdTraefik.AddCommand(healthcheck.NewCmd(&tConfig.Configuration, loaders))
 	if err != nil {
-		fmtlog.Println(err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}
 
-	if _, err := f.Parse(usedCmd); err != nil {
-		if err == pflag.ErrHelp {
-			os.Exit(0)
-		}
-		fmtlog.Printf("Error parsing command: %s\n", err)
-		os.Exit(1)
-	}
-
-	// staert init
-	s := staert.NewStaert(traefikCmd)
-	// init TOML source
-	toml := staert.NewTomlSource("traefik", []string{traefikConfiguration.ConfigFile, "/etc/traefik/", "$HOME/.traefik/", "."})
-
-	// add sources to staert
-	s.AddSource(toml)
-	s.AddSource(f)
-	if _, err := s.LoadConfig(); err != nil {
-		fmtlog.Printf("Error reading TOML config file %s : %s\n", toml.ConfigFileUsed(), err)
-		os.Exit(1)
-	}
-
-	traefikConfiguration.ConfigFile = toml.ConfigFileUsed()
-
-	kv, err := storeconfig.CreateKvSource(traefikConfiguration)
+	err = cmdTraefik.AddCommand(cmdVersion.NewCmd())
 	if err != nil {
-		fmtlog.Printf("Error creating kv store: %s\n", err)
+		stdlog.Println(err)
 		os.Exit(1)
 	}
-	storeConfigCmd.Run = storeconfig.Run(kv, traefikConfiguration)
 
-	// if a KV Store is enable and no sub-command called in args
-	if kv != nil && usedCmd == traefikCmd {
-		s.AddSource(kv)
-		operation := func() error {
-			_, err := s.LoadConfig()
-			return err
-		}
-		notify := func(err error, time time.Duration) {
-			log.WithoutContext().Errorf("Load config error: %+v, retrying in %s", err, time)
-		}
-		err := backoff.RetryNotify(safe.OperationWithRecover(operation), job.NewBackOff(backoff.NewExponentialBackOff()), notify)
-		if err != nil {
-			fmtlog.Printf("Error loading configuration: %s\n", err)
-			os.Exit(1)
-		}
-	}
-
-	if err := s.Run(); err != nil {
-		fmtlog.Printf("Error running traefik: %s\n", err)
+	err = cli.Execute(cmdTraefik)
+	if err != nil {
+		stdlog.Println(err)
 		os.Exit(1)
 	}
 
 	os.Exit(0)
 }
 
-func runCmd(staticConfiguration *static.Configuration, configFile string) error {
+func runCmd(staticConfiguration *static.Configuration) error {
 	configureLogging(staticConfiguration)
 
-	if len(configFile) > 0 {
-		log.WithoutContext().Infof("Using TOML configuration file %s", configFile)
-	}
-
 	http.DefaultTransport.(*http.Transport).Proxy = http.ProxyFromEnvironment
 
 	if err := roundrobin.SetDefaultWeight(0); err != nil {
 		log.WithoutContext().Errorf("Could not set roundrobin default weight: %v", err)
 	}
 
-	staticConfiguration.SetEffectiveConfiguration(configFile)
-	staticConfiguration.ValidateConfiguration()
+	staticConfiguration.SetEffectiveConfiguration()
+	if err := staticConfiguration.ValidateConfiguration(); err != nil {
+		return err
+	}
 
 	log.WithoutContext().Infof("Traefik version %s built on %s", version.Version, version.BuildDate)
 
@@ -227,15 +115,9 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error
 
 	providerAggregator := aggregator.NewProviderAggregator(*staticConfiguration.Providers)
 
-	acmeProvider, err := staticConfiguration.InitACMEProvider()
-	if err != nil {
-		log.WithoutContext().Errorf("Unable to initialize ACME provider: %v", err)
-	} else if acmeProvider != nil {
-		if err := providerAggregator.AddProvider(acmeProvider); err != nil {
-			log.WithoutContext().Errorf("Unable to add ACME provider to the providers list: %v", err)
-			acmeProvider = nil
-		}
-	}
+	tlsManager := traefiktls.NewManager()
+
+	acmeProviders := initACMEProvider(staticConfiguration, &providerAggregator, tlsManager)
 
 	serverEntryPointsTCP := make(server.TCPEntryPoints)
 	for entryPointName, config := range staticConfiguration.EntryPoints {
@@ -244,27 +126,31 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error
 		if err != nil {
 			return fmt.Errorf("error while building entryPoint %s: %v", entryPointName, err)
 		}
-		serverEntryPointsTCP[entryPointName].RouteAppenderFactory = router.NewRouteAppenderFactory(*staticConfiguration, entryPointName, acmeProvider)
+		serverEntryPointsTCP[entryPointName].RouteAppenderFactory = router.NewRouteAppenderFactory(*staticConfiguration, entryPointName, acmeProviders)
 
 	}
 
-	tlsManager := traefiktls.NewManager()
-
-	if acmeProvider != nil {
-		acmeProvider.SetTLSManager(tlsManager)
-		if acmeProvider.TLSChallenge != nil &&
-			acmeProvider.HTTPChallenge == nil &&
-			acmeProvider.DNSChallenge == nil {
-			tlsManager.TLSAlpnGetter = acmeProvider.GetTLSALPNCertificate
-		}
-	}
-
 	svr := server.NewServer(*staticConfiguration, providerAggregator, serverEntryPointsTCP, tlsManager)
 
-	if acmeProvider != nil && acmeProvider.OnHostRule {
-		acmeProvider.SetConfigListenerChan(make(chan config.Configuration))
-		svr.AddListener(acmeProvider.ListenConfiguration)
+	resolverNames := map[string]struct{}{}
+
+	for _, p := range acmeProviders {
+		resolverNames[p.ResolverName] = struct{}{}
+		svr.AddListener(p.ListenConfiguration)
 	}
+
+	svr.AddListener(func(config dynamic.Configuration) {
+		for rtName, rt := range config.HTTP.Routers {
+			if rt.TLS == nil || rt.TLS.CertResolver == "" {
+				continue
+			}
+
+			if _, ok := resolverNames[rt.TLS.CertResolver]; !ok {
+				log.WithoutContext().Errorf("the router %s uses a non-existent resolver: %s", rtName, rt.TLS.CertResolver)
+			}
+		}
+	})
+
 	ctx := cmd.ContextWithSignal(context.Background())
 
 	if staticConfiguration.Ping != nil {
@@ -289,7 +175,11 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error
 		safe.Go(func() {
 			tick := time.Tick(t)
 			for range tick {
-				_, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				resp, errHealthCheck := healthcheck.Do(*staticConfiguration)
+				if resp != nil {
+					resp.Body.Close()
+				}
+
 				if staticConfiguration.Ping == nil || errHealthCheck == nil {
 					if ok, _ := daemon.SdNotify(false, "WATCHDOG=1"); !ok {
 						log.WithoutContext().Error("Fail to tick watchdog")
@@ -307,24 +197,53 @@ func runCmd(staticConfiguration *static.Configuration, configFile string) error
 	return nil
 }
 
+// initACMEProvider creates an acme provider from the ACME part of globalConfiguration
+func initACMEProvider(c *static.Configuration, providerAggregator *aggregator.ProviderAggregator, tlsManager *traefiktls.Manager) []*acme.Provider {
+	challengeStore := acme.NewLocalChallengeStore()
+	localStores := map[string]*acme.LocalStore{}
+
+	var resolvers []*acme.Provider
+	for name, resolver := range c.CertificatesResolvers {
+		if resolver.ACME != nil {
+			if localStores[resolver.ACME.Storage] == nil {
+				localStores[resolver.ACME.Storage] = acme.NewLocalStore(resolver.ACME.Storage)
+			}
+
+			p := &acme.Provider{
+				Configuration:  resolver.ACME,
+				Store:          localStores[resolver.ACME.Storage],
+				ChallengeStore: challengeStore,
+				ResolverName:   name,
+			}
+
+			if err := providerAggregator.AddProvider(p); err != nil {
+				log.WithoutContext().Errorf("Unable to add ACME provider to the providers list: %v", err)
+				continue
+			}
+			p.SetTLSManager(tlsManager)
+			if p.TLSChallenge != nil {
+				tlsManager.TLSAlpnGetter = p.GetTLSALPNCertificate
+			}
+			p.SetConfigListenerChan(make(chan dynamic.Configuration))
+			resolvers = append(resolvers, p)
+		}
+	}
+	return resolvers
+}
+
 func configureLogging(staticConfiguration *static.Configuration) {
 	// configure default log flags
-	fmtlog.SetFlags(fmtlog.Lshortfile | fmtlog.LstdFlags)
+	stdlog.SetFlags(stdlog.Lshortfile | stdlog.LstdFlags)
 
 	// configure log level
 	// an explicitly defined log level always has precedence. if none is
 	// given and debug mode is disabled, the default is ERROR, and DEBUG
 	// otherwise.
-	var levelStr string
-	if staticConfiguration.Log != nil {
-		levelStr = strings.ToLower(staticConfiguration.Log.LogLevel)
-	}
-	if levelStr == "" {
-		levelStr = "error"
-		if staticConfiguration.Global.Debug {
-			levelStr = "debug"
-		}
+	levelStr := "error"
+	if staticConfiguration.Log != nil && staticConfiguration.Log.Level != "" {
+		levelStr = strings.ToLower(staticConfiguration.Log.Level)
 	}
+
 	level, err := logrus.ParseLevel(levelStr)
 	if err != nil {
 		log.WithoutContext().Errorf("Error getting level: %v", err)
@@ -377,7 +296,7 @@ func checkNewVersion() {
 func stats(staticConfiguration *static.Configuration) {
 	if staticConfiguration.Global.SendAnonymousUsage == nil {
 		log.WithoutContext().Error(`
-You haven't specify the sendAnonymousUsage option, it will be enable by default.
+You haven't specified the sendAnonymousUsage option, it will be enabled by default.
 `)
 		sendAnonymousUsage := true
 		staticConfiguration.Global.SendAnonymousUsage = &sendAnonymousUsage

cmd/version/version.go

@@ -7,7 +7,7 @@ import (
 	"runtime"
 	"text/template"
 
-	"github.com/containous/flaeg"
+	"github.com/containous/traefik/pkg/cli"
 	"github.com/containous/traefik/pkg/version"
 )
 
@@ -18,19 +18,17 @@ Built:        {{.BuildTime}}
 OS/Arch:      {{.Os}}/{{.Arch}}`
 
 // NewCmd builds a new Version command
-func NewCmd() *flaeg.Command {
-	return &flaeg.Command{
-		Name:                  "version",
-		Description:           `Print version`,
-		Config:                struct{}{},
-		DefaultPointersConfig: struct{}{},
-		Run: func() error {
+func NewCmd() *cli.Command {
+	return &cli.Command{
+		Name:          "version",
+		Description:   `Shows the current Traefik version.`,
+		Configuration: nil,
+		Run: func(_ []string) error {
 			if err := GetPrint(os.Stdout); err != nil {
 				return err
 			}
 			fmt.Print("\n")
 			return nil
-
 		},
 	}
 }

contrib/scripts/dumpcerts.sh

@@ -1,171 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2017 Brian 'redbeard' Harrington <redbeard@dead-city.org>
-#
-# dumpcerts.sh - A simple utility to explode a Traefik acme.json file into a
-#                directory of certificates and a private key
-#
-# Usage - dumpcerts.sh /etc/traefik/acme.json /etc/ssl/
-#
-# Dependencies -
-#   util-linux
-#   openssl
-#   jq
-# The MIT License (MIT)
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-
-# Exit codes:
-# 1 - A component is missing or could not be read
-# 2 - There was a problem reading acme.json
-# 4 - The destination certificate directory does not exist
-# 8 - Missing private key
-
-set -o errexit
-set -o pipefail
-set -o nounset
-
-USAGE="$(basename "$0") <path to acme> <destination cert directory>"
-
-# Platform variations
-case "$(uname)" in
-	'Linux')
-		# On Linux, -d should always work. --decode does not work with Alpine's busybox-binary
-		CMD_DECODE_BASE64="base64 -d"
-		;;
-	*)
-		# Max OS-X supports --decode and -D, but --decode may be supported by other platforms as well.
-		CMD_DECODE_BASE64="base64 --decode"
-		;;
-esac
-
-# Allow us to exit on a missing jq binary
-exit_jq() {
-	echo "
-You must have the binary 'jq' to use this.
-jq is available at: https://stedolan.github.io/jq/download/
-
-${USAGE}" >&2
-	exit 1
-}
-
-bad_acme() {
-	echo "
-There was a problem parsing your acme.json file.
-
-${USAGE}" >&2
-	exit 2
-}
-
-if [ $# -ne 2 ]; then
-	echo "
-Insufficient number of parameters.
-
-${USAGE}" >&2
-	exit 1
-fi
-
-readonly acmefile="${1}"
-readonly certdir="${2%/}"
-
-if [ ! -r "${acmefile}" ]; then
-	echo "
-There was a problem reading from '${acmefile}'
-We need to read this file to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 2
-fi
-
-
-if [ ! -d "${certdir}" ]; then
-	echo "
-Path ${certdir} does not seem to be a directory
-We need a directory in which to explode the JSON bundle... exiting.
-
-${USAGE}" >&2
-	exit 4
-fi
-
-jq=$(command -v jq) || exit_jq
-
-priv=$(${jq} -e -r '.Account.PrivateKey' "${acmefile}") || bad_acme
-
-if [ ! -n "${priv}" ]; then
-	echo "
-There didn't seem to be a private key in ${acmefile}.
-Please ensure that there is a key in this file and try again." >&2
-	exit 8
-fi
-
-# If they do not exist, create the needed subdirectories for our assets
-# and place each in a variable for later use, normalizing the path
-mkdir -p "${certdir}"/{certs,private}
-
-pdir="${certdir}/private/"
-cdir="${certdir}/certs/"
-
-# Save the existing umask, change the default mode to 600, then
-# after writing the private key switch it back to the default
-oldumask=$(umask)
-umask 177
-trap 'umask ${oldumask}' EXIT
-
-# traefik stores the private key in stripped base64 format but the certificates
-# bundled as a base64 object without stripping headers.  This normalizes the
-# headers and formatting.
-#
-# In testing this out it was a balance between the following mechanisms:
-# gawk:
-#  echo ${priv} | awk 'BEGIN {print "-----BEGIN RSA PRIVATE KEY-----"}
-#     {gsub(/.{64}/,"&\n")}1
-#     END {print "-----END RSA PRIVATE KEY-----"}' > "${pdir}/letsencrypt.key"
-#
-# openssl:
-# echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-#   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-#
-# and sed:
-# echo "-----BEGIN RSA PRIVATE KEY-----" > "${pdir}/letsencrypt.key"
-# echo ${priv} | sed -E 's/(.{64})/\1\n/g' >> "${pdir}/letsencrypt.key"
-# sed -i '$ d' "${pdir}/letsencrypt.key"
-# echo "-----END RSA PRIVATE KEY-----" >> "${pdir}/letsencrypt.key"
-# openssl rsa -noout -in "${pdir}/letsencrypt.key" -check  # To check if the key is valid
-
-# In the end, openssl was chosen because most users will need this script
-# *because* of openssl combined with the fact that it will refuse to write the
-# key if it does not parse out correctly. The other mechanisms were left as
-# comments so that the user can choose the mechanism most appropriate to them.
-echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----" \
-   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"
-
-# Process the certificates for each of the domains in acme.json
-domains=$(jq -r '.Certificates[].Domain.Main' ${acmefile}) || bad_acme
-for domain in $domains; do
-	# Traefik stores a cert bundle for each domain.  Within this cert
-	# bundle there is both proper the certificate and the Let's Encrypt CA
-	echo "Extracting cert bundle for ${domain}"
-	cert=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-         	select (.Domain.Main == $domain )| .Certificate' ${acmefile}) || bad_acme
-	echo "${cert}" | ${CMD_DECODE_BASE64} > "${cdir}/${domain}.crt"
-
-	echo "Extracting private key for ${domain}"
-	key=$(jq -e -r --arg domain "$domain" '.Certificates[] |
-		select (.Domain.Main == $domain )| .Key' ${acmefile}) || bad_acme
-	echo "${key}" | ${CMD_DECODE_BASE64} > "${pdir}/${domain}.key"
-done

docs/.markdownlint.json

@@ -3,7 +3,9 @@
     "MD007": { "indent": 4 },
     "MD009": false,
     "MD013": false,
+    "MD024": false,
     "MD026": false,
     "MD033": false,
-    "MD034": false
+    "MD034": false,
+    "MD036": false
 }

docs/content/contributing/building-testing.md

@@ -43,29 +43,42 @@ $ ls dist/
 traefik*
 ```
 
+The following targets can be executed outside Docker by setting the variable `PRE_TARGET` to an empty string (we don't recommend that):
+
+- `test-unit`
+- `test-integration`
+- `validate`
+- `binary` (the webUI is still generated by using Docker)
+
+ex:
+
+```bash
+PRE_TARGET= make test-unit
+```
+
 ### Method 2: Using `go`
 
-You need `go` v1.9+.
+You need `go` v1.12+.
 
 !!! tip "Source Directory"
- 
+
     It is recommended that you clone Traefik into the `~/go/src/github.com/containous/traefik` directory.
     This is the official golang workspace hierarchy that will allow dependencies to be properly resolved.
 
 !!! note "Environment"
 
     Set your `GOPATH` and `PATH` variable to be set to `~/go` via:
-    
+
     ```bash
     export GOPATH=~/go
     export PATH=$PATH:$GOPATH/bin
     ```
- 
+
     For convenience, add `GOPATH` and `PATH` to your `.bashrc` or `.bash_profile`
-    
+
     Verify your environment is setup properly by running `$ go env`.
     Depending on your OS and environment, you should see an output similar to:
-    
+
     ```bash
     GOARCH="amd64"
     GOBIN=""
@@ -110,7 +123,7 @@ If you happen to update the provider's templates (located in `/templates`), you
 The [dep](https://github.com/golang/dep) command is not required for building;
 however, it is necessary if you need to update the dependencies (i.e., add, update, or remove third-party packages).
 
-You need [dep](https://github.com/golang/dep) >= 0.5.0.
+You need [dep](https://github.com/golang/dep) >= 0.5.4.
 
 If you want to add a dependency, use `dep ensure -add` to have [dep](https://github.com/golang/dep) put it into the vendor folder and update the dep manifest/lock files (`Gopkg.toml` and `Gopkg.lock`, respectively).
 

docs/content/contributing/data-collection.md

@@ -14,9 +14,9 @@ For this very reason, the sendAnonymousUsage option is mandatory: we want you to
 ??? example "Enabling Data Collection with TOML"
 
     ```toml
-    [Global]
-        # Send anonymous usage data
-        sendAnonymousUsage = true
+    [global]
+      # Send anonymous usage data
+      sendAnonymousUsage = true
     ```
 
 ??? example "Enabling Data Collection with the CLI"
@@ -50,25 +50,24 @@ Once a day (the first call begins 10 minutes after the start of Traefik), we col
 ??? example "Original configuration"
 
     ```toml
-    [entrypoints]
-        [entrypoints.web]
-           address = ":80"
+    [entryPoints]
+      [entryPoints.web]
+         address = ":80"
     
     [api]
     
-    [Docker]
+    [providers.docker]
       endpoint = "tcp://10.10.10.10:2375"
-      domain = "foo.bir"
       exposedByDefault = true
       swarmMode = true
     
-      [Docker.TLS]
+      [providers.docker.TLS]
         ca = "dockerCA"
         cert = "dockerCert"
         key = "dockerKey"
         insecureSkipVerify = true
     
-    [ECS]
+    [providers.ecs]
       domain = "foo.bar"
       exposedByDefault = true
       clusters = ["foo-bar"]
@@ -80,25 +79,25 @@ Once a day (the first call begins 10 minutes after the start of Traefik), we col
 ??? example "Resulting Obfuscated Configuration"
 
     ```toml
-    [entrypoints]
-        [entrypoints.web]
-           address = ":80"
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
     
     [api]
     
-    [Docker]
+    [providers.docker]
       endpoint = "xxxx"
       domain = "xxxx"
       exposedByDefault = true
       swarmMode = true
     
-      [Docker.TLS]
+      [providers.docker.TLS]
         ca = "xxxx"
         cert = "xxxx"
         key = "xxxx"
         insecureSkipVerify = false
     
-    [ECS]
+    [providers.ecs]
       domain = "xxxx"
       exposedByDefault = true
       clusters = []

docs/content/contributing/documentation.md

@@ -10,7 +10,7 @@ Let's see how.
 
 ### General
 
-This [documentation](http://docs.traefik.io/) is built with [mkdocs](http://mkdocs.org/).
+This [documentation](https://docs.traefik.io/) is built with [mkdocs](https://mkdocs.org/).
 
 ### Method 1: `Docker` and `make`
 

docs/content/contributing/maintainers.md

@@ -16,6 +16,7 @@
 * Gérald Croës [@geraldcroes](https://github.com/geraldcroes)
 * Jean-Baptiste Doumenjou [@jbdoumenjou](https://github.com/jbdoumenjou)
 * Damien Duportal [@dduportal](https://github.com/dduportal)
+* Mathieu Lonjaret [@mpl](https://github.com/mpl)
 
 ## Contributions Daily Meeting
 
@@ -27,7 +28,7 @@
 * Modifying an issue or a pull request (labels, assignees, milestone) is only possible:
     * During the Contributions Daily Meeting
     * By an assigned maintainer
-    * In case of emergency, if a change proposal is approved by 2 other maintainers (on Slack, Discord, etc)
+    * In case of emergency, if a change proposal is approved by 2 other maintainers (on Slack, Discord, Discourse, etc)
 
 ## PR review process:
 

docs/content/contributing/submitting-issues.md

@@ -11,11 +11,10 @@ To save us some time and get quicker feedback, be sure to follow the guide lines
 !!! important "Getting Help Vs Reporting an Issue"
 
     The issue tracker is not a general support forum, but a place to report bugs and asks for new features.
-    
+
     For end-user related support questions, try using first:
-    
-    - the Traefik community Slack channel: [![Join the chat at https://slack.traefik.io](https://img.shields.io/badge/style-register-green.svg?style=social&label=Slack)](https://slack.traefik.io)
-    - [Stack Overflow](https://stackoverflow.com/questions/tagged/traefik) (using the `traefik` tag)
+
+    - the Traefik community forum: [![Join the chat at https://community.containo.us/](https://img.shields.io/badge/style-register-green.svg?style=social&label=Discourse)](https://community.containo.us/)
 
 ## Issue Title
 

docs/content/contributing/submitting-pull-requests.md

@@ -42,4 +42,4 @@ Help the readers focus on what matters, and help them understand the structure o
 
 !!! tip "10 Tips for Better Pull Requests"
 
-    We enjoyed this article, maybe you will too! [10 tips for better pull requests](http://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).
+    We enjoyed this article, maybe you will too! [10 tips for better pull requests](https://blog.ploeh.dk/2015/01/15/10-tips-for-better-pull-requests/).

docs/content/contributing/thank-you.md

@@ -8,3 +8,20 @@ and wouldn't have become what it is today without the help of our [many contribu
 not accounting for people having helped with issues, tests, comments, articles, ... or just enjoying it and letting others know.
 
 So once again, thank you for your invaluable help on making Traefik such a good product.
+
+!!! question "Where to Go Next?"
+    If you want to:
+
+    - Propose and idea, request a feature a report a bug,
+      read the page [Submitting Issues](./submitting-issues.md).
+    - Discover how to make an efficient contribution,
+      read the page [Submitting Pull Requests](./submitting-pull-requests.md).
+    - Learn how to build and test Traefik,
+      the page [Building and Testing](./building-testing.md) is for you.
+    - Contribute to the documentation,
+      read the related page [Documentation](./documentation.md).
+    - Understand how do we learn about Traefik usage,
+      read the [Data Collection](./data-collection.md) page.
+    - Spread the love about Traefik, please check the [Advocating](./advocating.md) page.
+    - Learn about who are the maintainers and how they work on the project,
+      read the [Maintainers](./maintainers.md) page.

docs/content/getting-started/concepts.md

@@ -5,7 +5,8 @@ Everything You Need to Know
 
 ## Edge Router
 
-Traefik is an _Edge Router_, it means that it's the door to your platform, and that it intercepts and routes every incoming request: it knows all the logic and every rule that determine which services handle which requests (based on the [path](../../routing/routers/#rule), the [host](../../routing/routers/#rule), [headers](../../routing/routers/#rule), [and so on](../../routing/routers/#rule) ...).
+Traefik is an _Edge Router_, it means that it's the door to your platform, and that it intercepts and routes every incoming request:
+it knows all the logic and every rule that determine which services handle which requests (based on the [path](../routing/routers/index.md#rule), the [host](../routing/routers/index.md#rule), [headers](../routing/routers/index.md#rule), [and so on](../routing/routers/index.md#rule) ...).
 
 ![The Door to Your Infrastructure](../assets/img/traefik-concepts-1.png)
 
@@ -13,12 +14,12 @@ Traefik is an _Edge Router_, it means that it's the door to your platform, and t
 
 Where traditionally edge routers (or reverse proxies) need a configuration file that contains every possible route to your services, Traefik gets them from the services themselves.
 
-Deploying your services, you attach information that tell Traefik the characteristics of the requests the services can handle.
+Deploying your services, you attach information that tells Traefik the characteristics of the requests the services can handle.
 
 ![Decentralized Configuration](../assets/img/traefik-concepts-2.png)
 
 It means that when a service is deployed, Traefik detects it immediately and updates the routing rules in real time.
-The opposite is true: when you remove a service from your infrastructure, the route will disapear accordingly.
+The opposite is true: when you remove a service from your infrastructure, the route will disappear accordingly.
 
 You no longer need to create and synchronize configuration files cluttered with IP addresses or other rules.
 

docs/content/getting-started/configuration-overview.md

@@ -1,4 +1,4 @@
-# Configuration Overview
+# Configuration Introduction
 
 How the Magic Happens
 {: .subtitle }
@@ -6,21 +6,25 @@ How the Magic Happens
 ![Configuration](../assets/img/static-dynamic-configuration.png)
 
 Configuration in Traefik can refer to two different things:
-   
+
 - The fully dynamic routing configuration (referred to as the _dynamic configuration_)
 - The startup configuration (referred to as the _static configuration_)
 
-Elements in the _static configuration_ set up connections to [providers](../../providers/overview/) and define the [entrypoints](../../routing/entrypoints/) Traefik will listen to (these elements don't change often).
+Elements in the _static configuration_ set up connections to [providers](../providers/overview.md) and define the [entrypoints](../routing/entrypoints.md) Traefik will listen to (these elements don't change often).
 
 The _dynamic configuration_ contains everything that defines how the requests are handled by your system.
-This configuration can change and is seamlessly hot-reloaded, without any request interuption or connection loss.    
+This configuration can change and is seamlessly hot-reloaded, without any request interruption or connection loss.    
+
+!!! warning "Incompatible Configuration"
+    Please be aware that the old configurations for Traefik v1.X are NOT compatible with the v2.X config as of now.
+    If you're testing out v2, please ensure you are using a v2 configuration.
 
 ## The Dynamic Configuration 
 
-Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): wether an orchestrator, a service registry, or a plain old configuration file. Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../providers/overview.md).
+Traefik gets its _dynamic configuration_ from [providers](../providers/overview.md): whether an orchestrator, a service registry, or a plain old configuration file. Since this configuration is specific to your infrastructure choices, we invite you to refer to the [dedicated section of this documentation](../providers/overview.md).
 
 !!! Note 
-   
+
     In the [Quick Start example](../getting-started/quick-start.md), the dynamic configuration comes from docker in the form of labels attached to your containers.
     
 !!! Note
@@ -29,31 +33,28 @@ Traefik gets its _dynamic configuration_ from [providers](../providers/overview.
  
 ## The Static Configuration
 
-There are three different locations where you can define static configuration options in Traefik:
+There are three different, mutually exclusive, ways to define static configuration options in Traefik:
 
-- In a key-value store
-- In the command-line arguments
 - In a configuration file
+- In the command-line arguments
+- As environment variables
 
-If you don't provide a value for a given option, default values apply.
+These ways are evaluated in the order listed above.
 
-!!! important "Precedence Order"
-
-    The following precedence order applies for configuration options: key-value > command-line > configuration file.
+If no value was provided for a given option, a default value applies.
+Moreover, if an option has sub-options, and any of these sub-options is not specified, a default value will apply as well.
     
-    It means that arguments override configuration file, and key-value store overrides arguments.
-    
-!!! important "Default Values"
-
-    Some root options are enablers: they set default values for all their children. 
-    
-    For example, the `--providers.docker` option enables the docker provider.
-    Once positioned, this option sets (and resets) all the default values under the root `providers.docker`.
-    If you define child options using a lesser precedence configuration source, they will be overwritten by the default values.  
+For example, the `--providers.docker` option is enough by itself to enable the docker provider, even though sub-options like `--providers.docker.endpoint` exist.
+Once positioned, this option sets (and resets) all the default values of the sub-options of `--providers.docker`.
     
 ### Configuration File
 
-At startup, Traefik searches for a file named `traefik.toml` in `/etc/traefik/`, `$HOME/.traefik/`, and `.` (_the working directory_).
+At startup, Traefik searches for a file named `traefik.toml` (or `traefik.yml` or `traefik.yaml`) in:
+
+- `/etc/traefik/`
+- `$XDG_CONFIG_HOME/`
+- `$HOME/.config/`
+- `.` (_the working directory_).
 
 You can override this using the `configFile` argument.
 
@@ -63,16 +64,22 @@ traefik --configFile=foo/bar/myconfigfile.toml
 
 ### Arguments
 
-Use `traefik --help` to get the list of the available arguments.
+To get the list of all available arguments:
 
-### Key-Value Stores
+```bash
+traefik --help
 
-Traefik supports several Key-value stores:
+# or
 
-- [Consul](https://consul.io)
-- [etcd](https://coreos.com/etcd/)
-- [ZooKeeper](https://zookeeper.apache.org/)
-- [boltdb](https://github.com/boltdb/bolt)
+docker run traefik[:version] --help
+# ex: docker run traefik:2.0 --help
+```
+
+All available arguments can also be found [here](../reference/static-configuration/cli.md).
+
+### Environment Variables
+
+All available environment variables can be found [here](../reference/static-configuration/env.md)
 
 ## Available Configuration Options
 

docs/content/getting-started/install-traefik.md

@@ -0,0 +1,70 @@
+# Install Traefik
+
+You can install Traefik with the following flavors:
+
+* [Use the official Docker image](./#use-the-official-docker-image)
+* [Use the binary distribution](./#use-the-binary-distribution)
+* [Compile your binary from the sources](./#compile-your-binary-from-the-sources)
+
+## Use the Official Docker Image
+
+Choose one of the [official Docker images](https://hub.docker.com/_/traefik) and run it with the [sample configuration file](https://raw.githubusercontent.com/containous/traefik/master/traefik.sample.toml):
+
+```shell
+docker run -d -p 8080:8080 -p 80:80 \
+    -v $PWD/traefik.toml:/etc/traefik/traefik.toml traefik:v2.0
+```
+
+For more details, go to the [Docker provider documentation](../providers/docker.md)
+
+!!! tip
+
+    * Prefer a fixed version than the latest that could be an unexpected version.
+    ex: `traefik:v2.0.0`
+    * Docker images comes in 2 flavors: scratch based or alpine based.
+    * All the orchestrator using docker images could fetch the official Traefik docker image.
+
+## Use the Binary Distribution
+
+Grab the latest binary from the [releases](https://github.com/containous/traefik/releases) page.
+
+??? tip "Check the integrity of the downloaded file"
+
+    ```bash tab="Linux"
+    # Compare this value to the one found in traefik-${traefik_version}_checksums.txt
+    sha256sum ./traefik_${traefik_version}_linux_${arch}.tar.gz
+    ```
+
+    ```bash tab="macOS"
+    # Compare this value to the one found in traefik-${traefik_version}_checksums.txt
+    shasum -a256 ./traefik_${traefik_version}_darwin_amd64.tar.gz
+    ```
+
+    ```powershell tab="Windows PowerShell"
+    # Compare this value to the one found in traefik-${traefik_version}_checksums.txt
+    Get-FileHash ./traefik_${traefik_version}_windows_${arch}.zip -Algorithm SHA256
+    ```
+
+??? tip "Extract the downloaded archive"
+
+    ```bash tab="Linux"
+    tar -zxvf traefik_${traefik_version}_linux_${arch}.tar.gz
+    ```
+
+    ```bash tab="macOS"
+    tar -zxvf ./traefik_${traefik_version}_darwin_amd64.tar.gz
+    ```
+
+    ```powershell tab="Windows PowerShell"
+    Expand-Archive traefik_${traefik_version}_windows_${arch}.zip
+    ```
+
+And run it:
+
+```bash
+./traefik --help
+```
+
+## Compile your Binary from the Sources
+
+All the details are available in the [Contributing Guide](../contributing/building-testing.md)

docs/content/getting-started/quick-start.md

@@ -5,9 +5,6 @@ A Simple Use Case Using Docker
 
 ![quickstart-diagram](../assets/img/quickstart-diagram.png)
 
-!!! tip 
-    To save some time, you can clone [Traefik's repository](https://github.com/containous/traefik).
-
 ## Launch Traefik With the Docker Provider
 
 Create a `docker-compose.yml` file where you will define a `reverse-proxy` service that uses the official Traefik image:
@@ -17,13 +14,18 @@ version: '3'
 
 services:
   reverse-proxy:
-    image: traefik # The official Traefik docker image
-    command: --api --docker # Enables the web UI and tells Traefik to listen to docker
+    # The official v2.0 Traefik docker image
+    image: traefik:v2.0
+    # Enables the web UI and tells Traefik to listen to docker
+    command: --api --providers.docker
     ports:
-      - "80:80"     # The HTTP port
-      - "8080:8080" # The Web UI (enabled by --api)
+      # The HTTP port
+      - "80:80"
+      # The Web UI (enabled by --api)
+      - "8080:8080"
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
+      # So that Traefik can listen to the Docker events
+      - /var/run/docker.sock:/var/run/docker.sock
 ```
 
 **That's it. Now you can launch Traefik!**
@@ -45,9 +47,10 @@ Edit your `docker-compose.yml` file and add the following at the end of your fil
 ```yaml
 # ...
   whoami:
-    image: containous/whoami # A container that exposes an API to show its IP address
+    # A container that exposes an API to show its IP address
+    image: containous/whoami
     labels:
-      - "traefik.router.rule=Host:whoami.docker.localhost"
+      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
 ```
 
 The above defines `whoami`: a simple web service that outputs information about the machine it is deployed on (its IP address, host, and so on).
@@ -84,7 +87,7 @@ docker-compose up -d --scale whoami=2
 
 Go back to your browser ([http://localhost:8080/api/rawdata](http://localhost:8080/api/rawdata)) and see that Traefik has automatically detected the new instance of the container.
 
-Finally, see that Traefik load-balances between the two instances of your services by running twice the following command:
+Finally, see that Traefik load-balances between the two instances of your service by running the following command twice:
 
 ```shell
 curl -H Host:whoami.docker.localhost http://127.0.0.1

docs/content/glossary.md

@@ -9,8 +9,8 @@ Where Every Technical Word finds its Definition`
 - [ ] Routers
 - [ ] Middleware
 - [ ] Service
-- [ ] Static Configuration
-- [ ] Dynamic Configuration
+- [ ] [Static configuration](getting-started/configuration-overview.md#the-static-configuration)
+- [ ] [Dynamic configuration](getting-started/configuration-overview.md#the-dynamic-configuration)
 - [ ] ACME
 - [ ] TraefikEE
 - [ ] Tracing

docs/content/https-tls/overview.md

@@ -1,145 +0,0 @@
-# HTTPS & TLS
-
-Traefik supports HTTPS & TLS, and is able to accept new certificates / updates over time (without being restarted).
-TLS is enabled at the [router](../routing/routers/index.md) level, but some options are configured in dedicated sections (`tlsOptions` & `tlsStores`) described in this section.
-
-## Configuration Example
-
-??? example "Configuring a Default Certificate"
-
-    ```toml
-    [tlsStores]
-     [tlsStores.default]
-       [tlsStores.default.defaultCertificate]
-         certFile = "path/to/cert.crt"
-         keyFile  = "path/to/cert.key"
-    ```
-
-??? example "Configuring a Minimum TLS Version"
-
-    ```toml
-    [tlsOptions]
-      [tlsOptions.default]
-        minVersion = "VersionTLS12"
-    ```
-
-??? example "Defining Certificates"
-
-    ```toml
-    [[tls]]
-      [tls.certificate]
-         certFile = "/path/to/domain.cert"
-         keyFile = "/path/to/domain.key"
-
-    [[tls]]
-      [tls.certificate]
-         certFile = "/path/to/other-domain.cert"
-         keyFile = "/path/to/other-domain.key"
-    ```
-
-!!! important "File Provider Only"
-    
-    In the above example, we've used the [file provider](../providers/file.md) to handle the TLS configuration (tlsStores, tlsOptions, and TLS certificates).
-    In its current alpha version, it is the only available method to configure these elements.
-    Of course, these options are hot reloaded and can be updated at runtime (they belong to the [dynamic configuration](../getting-started/configuration-overview.md)).
-
-## Configuration Options
-
-### Dynamic Certificates
-
-To add / remove TLS certificates while Traefik is running, the [file provider](../providers/file.md) supports Dynamic TLS certificates in its `[[tls]]` section.
-
-!!! example "Defining Certificates"
-
-    ```toml
-    [[tls]]
-      stores = ["default"]
-      [tls.certificate]
-         certFile = "/path/to/domain.cert"
-         keyFile = "/path/to/domain.key"
-
-    [[tls]]
-      stores = ["default"]
-      [tls.certificate]
-         certFile = "/path/to/other-domain.cert"
-         keyFile = "/path/to/other-domain.key"
-    ```
-
-    ??? note "Stores"
-
-        During the alpha version, the stores option will be ignored and be automatically set to ["default"].
-
-### Mutual Authentication
-
-Traefik supports both optional and non optional (defaut value) mutual authentication.
-
-- When `optional = false`, Traefik accepts connections only from client presenting a certificate signed by a CA listed in `ClientCA.files`.
-- When `optional = true`, Traefik authorizes connections from client presenting a certificate signed by an unknown CA.
-
-!!! example "Non Optional Mutual Authentication"
-
-    In the following example, both `snitest.com` and `snitest.org` will require client certificates.
-
-    ```toml
-    [tlsOptions]
-       [tlsOptions.default]
-          [tlsOptions.default.ClientCA]
-            files = ["tests/clientca1.crt", "tests/clientca2.crt"]
-            optional = false
-    ```
-
-    ??? note "ClientCA.files"
-
-        You can use a file per `CA:s`, or a single file containing multiple `CA:s` (in `PEM` format).
-
-        `ClientCA.files` is not optional: every client will have to present a valid certificate. (This requirement will apply to every server certificate declared in the entrypoint.)
-
-### Minimum TLS Version
-
-!!! example "Min TLS version & [cipherSuites](https://godoc.org/crypto/tls#pkg-constants)"
-
-    ```toml
-    [tlsOptions]
-      [tlsOptions.default]
-          minVersion = "VersionTLS12"
-          cipherSuites = [
-            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
-            "TLS_RSA_WITH_AES_256_GCM_SHA384"
-          ]
-    ```
-
-### Strict SNI Checking
-
-With strict SNI checking, Traefik won't allow connections without a matching certificate.
-
-!!! example "Strict SNI"
-
-    ```toml
-    [tlsOptions]
-      [tlsOptions.default]
-        sniStrict = true
-    ```
-
-### Default Certificate
-
-Traefik can use a default certificate for connections without a SNI, or without a matching domain.
-
-If no default certificate is provided, Traefik generates and uses a self-signed certificate.
-
-!!! example "Setting a Default Certificate"
-
-    ```toml
-    [tlsStores]
-     [tlsStores.default]
-       [tlsStores.default.defaultCertificate]
-         certFile = "path/to/cert.crt"
-         keyFile  = "path/to/cert.key"
-    ```
-
-    ??? note "Only One Default Certificate"
-
-        There can only be one `defaultCertificate` per tlsOptions.
-
-    ??? note "Default TLS Store"
-
-        During the alpha version, there is only one globally available TLS Store (`default`).

docs/content/https/acme.md

@@ -1,4 +1,4 @@
-# ACME
+# Let's Encrypt
 
 Automatic HTTPS
 {: .subtitle }
@@ -11,47 +11,76 @@ You can configure Traefik to use an ACME provider (like Let's Encrypt) for autom
 ## Configuration Examples
 
 ??? example "Enabling ACME"
-
-    ```toml
-    [entrypoints]
-      [entrypoints.web]
-         address = ":80"
     
-      [entrypoints.http-tls]
-         address = ":443"
-    
-    [acme] # every router with TLS enabled will now be able to use ACME for its certificates
-       email = "your-email@your-domain.org"
-       storage = "acme.json"
-       onHostRule = true # dynamic generation based on the Host() & HostSNI() matchers
-       [acme.httpChallenge]
-          entryPoint = "web" # used during the challenge
-    ```
-
-??? example "Configuring Wildcard Certificates"
-
-    ```toml
-    [entrypoints]
-      [entrypoints.web]
+    ```toml tab="File (TOML)"
+    [entryPoints]
+      [entryPoints.web]
         address = ":80"
-
-      [entrypoints.http-tls]
+    
+      [entryPoints.web-secure]
         address = ":443"
-
-    [acme]
+    
+    [certificatesResolvers.sample.acme]
       email = "your-email@your-domain.org"
       storage = "acme.json"
-      [acme.dnsChallenge]
-        provider = "xxx"
-
-      [[acme.domains]]
-        main = "*.mydomain.com"
-        sans = ["mydomain.com"]
+      [acme.httpChallenge]
+        # used during the challenge
+        entryPoint = "web"
+    ```
+    
+    ```yaml tab="File (YAML)"
+    entryPoints:
+      web:
+        address: ":80"
+    
+      web-secure:
+        address: ":443"
+    
+    certificatesResolvers:
+      sample:
+        acme:
+          email: your-email@your-domain.org
+          storage: acme.json
+          httpChallenge:
+            # used during the challenge
+            entryPoint: web
+    ```
+    
+    ```bash tab="CLI"
+    --entryPoints.web.address=":80"
+    --entryPoints.websecure.address=":443"
+    # ...
+    --certificatesResolvers.sample.acme.email: your-email@your-domain.org
+    --certificatesResolvers.sample.acme.storage: acme.json
+    # used during the challenge
+    --certificatesResolvers.sample.acme.httpChallenge.entryPoint: web
     ```
 
-!!! note "Configuration Reference"
+??? note "Configuration Reference"
+    
+    There are many available options for ACME.
+    For a quick glance at what's possible, browse the configuration reference:
+    
+    ```toml tab="File (TOML)"
+    --8<-- "content/https/ref-acme.toml"
+    ```
+    
+    ```yaml tab="File (YAML)"
+    --8<-- "content/https/ref-acme.yaml"
+    ```
+    
+    ```bash tab="CLI"
+    --8<-- "content/https/ref-acme.txt"
+    ```
 
-    There are many available options for ACME. For a quick glance at what's possible, browse the [configuration reference](../reference/acme.md).
+## Automatic Renewals
+
+Traefik automatically tracks the expiry date of ACME certificates it generates.
+
+If there are less than 30 days remaining before the certificate expires, Traefik will attempt to renew it automatically.
+
+!!! note
+    Certificates that are no longer used may still be renewed, as Traefik does not currently check if the certificate is being used before renewing.
 
 ## The Different ACME Challenges
 
@@ -64,25 +93,69 @@ when using the `TLS-ALPN-01` challenge, Traefik must be reachable by Let's Encry
 
 ??? example "Configuring the `tlsChallenge`"
 
-    ```toml
-    [acme]
-       [acme.tlsChallenge]
+    ```toml tab="File (TOML)"
+    [certificatesResolvers.sample.acme]
+      # ...
+      [certificatesResolvers.sample.acme.tlsChallenge]
+    ```
+
+    ```yaml tab="File (YAML)"
+    certificatesResolvers:
+      sample:
+        acme:
+          # ...
+          tlsChallenge: {}
     ```
     
+    ```bash tab="CLI"
+    # ...
+    --certificatesResolvers.sample.acme.tlsChallenge
+    ```
+
 ### `httpChallenge`
 
 Use the `HTTP-01` challenge to generate and renew ACME certificates by provisioning an HTTP resource under a well-known URI.
 
 As described on the Let's Encrypt [community forum](https://community.letsencrypt.org/t/support-for-ports-other-than-80-and-443/3419/72),
-when using the `HTTP-01` challenge, `acme.httpChallenge.entryPoint` must be reachable by Let's Encrypt through port 80.
+when using the `HTTP-01` challenge, `certificatesResolvers.sample.acme.httpChallenge.entryPoint` must be reachable by Let's Encrypt through port 80.
 
 ??? example "Using an EntryPoint Called http for the `httpChallenge`"
 
-    ```toml
-    [acme]
-       # ...
-       [acme.httpChallenge]
-          entryPoint = "http"
+    ```toml tab="File (TOML)"
+    [entryPoints]
+      [entryPoints.web]
+        address = ":80"
+      
+      [entryPoints.web-secure]
+        address = ":443"
+    
+    [certificatesResolvers.sample.acme]
+      # ...
+      [certificatesResolvers.sample.acme.httpChallenge]
+        entryPoint = "web"
+    ```
+
+    ```yaml tab="File (YAML)"
+    entryPoints:
+      web:
+        address: ":80"
+    
+      web-secure:
+        address: ":443"
+    
+    certificatesResolvers:
+      sample:
+        acme:
+          # ...
+          httpChallenge:
+            entryPoint: web
+    ```
+    
+    ```bash tab="CLI"
+    --entryPoints.web.address=":80"
+    --entryPoints.websecure.address=":443"
+    # ...
+    --certificatesResolvers.sample.acme.httpChallenge.entryPoint=web
     ```
 
 !!! note
@@ -94,12 +167,30 @@ Use the `DNS-01` challenge to generate and renew ACME certificates by provisioni
 
 ??? example "Configuring a `dnsChallenge` with the DigitalOcean Provider"
 
-    ```toml
-    [acme]
-       # ...
-       [acme.dnsChallenge]
-          provider = "digitalocean"
-          delayBeforeCheck = 0
+    ```toml tab="File (TOML)"
+    [certificatesResolvers.sample.acme]
+      # ...
+      [certificatesResolvers.sample.acme.dnsChallenge]
+        provider = "digitalocean"
+        delayBeforeCheck = 0
+    # ...
+    ```
+    
+    ```yaml tab="File (YAML)"
+    certificatesResolvers:
+      sample:
+        acme:
+          # ...
+          dnsChallenge:
+            provider: digitalocean
+            delayBeforeCheck: 0
+        # ...
+    ```
+    
+    ```bash tab="CLI"
+    # ...
+    --certificatesResolvers.sample.acme.dnsChallenge.provider=digitalocean
+    --certificatesResolvers.sample.acme.dnsChallenge.delayBeforeCheck=0
     # ...
     ```
 
@@ -110,68 +201,73 @@ Use the `DNS-01` challenge to generate and renew ACME certificates by provisioni
  
 Here is a list of supported `providers`, that can automate the DNS verification,
 along with the required environment variables and their [wildcard & root domain support](#wildcard-domains).
-Do not hesitate to complete it. 
+Do not hesitate to complete it.
 
-| Provider Name                                               | Provider Code  | Environment Variables                                                                                                                       | Wildcard & Root Domain Support |
-|-------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
-| [ACME DNS](https://github.com/joohoi/acme-dns)              | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                                | Not tested yet                 |
-| [Alibaba Cloud](https://www.vultr.com)                      | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                          | Not tested yet                 |
-| [Auroradns](https://www.pcextreme.com/aurora/dns)           | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                           | Not tested yet                 |
-| [Azure](https://azure.microsoft.com/services/dns/)          | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]`   | Not tested yet                 |
-| [Blue Cat](https://www.bluecatnetworks.com/)                | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                    | Not tested yet                 |
-| [ClouDNS](https://www.cloudns.net/)                         | `cloudns`      | `CLOUDNS_AUTH_ID`, `CLOUDNS_AUTH_PASSWORD`                                                                                                  | YES                            |
-| [Cloudflare](https://www.cloudflare.com)                    | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                               | YES                            |
-| [CloudXNS](https://www.cloudxns.net)                        | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                   | Not tested yet                 |
-| [ConoHa](https://www.conoha.jp)                             | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                            | YES                            |
-| [DigitalOcean](https://www.digitalocean.com)                | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                             | YES                            |
-| [DNSimple](https://dnsimple.com)                            | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                                 | YES                            |
-| [DNS Made Easy](https://dnsmadeeasy.com)                    | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                      | Not tested yet                 |
-| [DNSPod](https://www.dnspod.com/)                           | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                            | Not tested yet                 |
-| [DreamHost](https://www.dreamhost.com/)                     | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                         | YES                            |
-| [Duck DNS](https://www.duckdns.org/)                        | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                             | YES                            |
-| [Dyn](https://dyn.com)                                      | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                        | Not tested yet                 |
-| External Program                                            | `exec`         | `EXEC_PATH`                                                                                                                                 | YES                            |
-| [Exoscale](https://www.exoscale.com)                        | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                              | YES                            |
-| [Fast DNS](https://www.akamai.com/)                         | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                      | YES                            |
-| [Gandi](https://www.gandi.net)                              | `gandi`        | `GANDI_API_KEY`                                                                                                                             | Not tested yet                 |
-| [Gandi v5](http://doc.livedns.gandi.net)                    | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                           | YES                            |
-| [Glesys](https://glesys.com/)                               | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                        | Not tested yet                 |
-| [GoDaddy](https://godaddy.com/domains)                      | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                     | Not tested yet                 |
-| [Google Cloud DNS](https://cloud.google.com/dns/docs/)      | `gcloud`       | `GCE_PROJECT`, Application Default Credentials [^2] [^3], [`GCE_SERVICE_ACCOUNT_FILE`]                                                        | YES                            |
-| [hosting.de](https://www.hosting.de)                        | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                  | Not tested yet                 |
-| HTTP request                                                | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` [^1]                                                              | YES                            |
-| [IIJ](https://www.iij.ad.jp/)                               | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                           | Not tested yet                 |
-| [INWX](https://www.inwx.de/en)                              | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                            | YES                            |
-| [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | Not tested yet                 |
-| [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | Not tested yet                 |
-| [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | Not tested yet                 |
-| manual                                                      | -              | none, but you need to run Traefik interactively, turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                      | YES                            |
-| [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | YES                            |
-| [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | YES                            |
-| [name.com](https://www.name.com/)                           | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                   | Not tested yet                 |
-| [Netcup](https://www.netcup.eu/)                            | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                           | Not tested yet                 |
-| [NIFCloud](https://cloud.nifty.com/service/dns.htm)         | `nifcloud`     | `NIFCLOUD_ACCESS_KEY_ID`, `NIFCLOUD_SECRET_ACCESS_KEY`                                                                                      | Not tested yet                 |
-| [Ns1](https://ns1.com/)                                     | `ns1`          | `NS1_API_KEY`                                                                                                                               | Not tested yet                 |
-| [Open Telekom Cloud](https://cloud.telekom.de)              | `otc`          | `OTC_DOMAIN_NAME`, `OTC_USER_NAME`, `OTC_PASSWORD`, `OTC_PROJECT_NAME`, `OTC_IDENTITY_ENDPOINT`                                             | Not tested yet                 |
-| [OVH](https://www.ovh.com)                                  | `ovh`          | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                                                         | YES                            |
-| [Openstack Designate](https://docs.openstack.org/designate) | `designate`    | `OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_TENANT_NAME`, `OS_REGION_NAME`                                                             | YES                            |
-| [Oracle Cloud](https://cloud.oracle.com/home)               | `oraclecloud`  | `OCI_COMPARTMENT_OCID`, `OCI_PRIVKEY_FILE`, `OCI_PRIVKEY_PASS`, `OCI_PUBKEY_FINGERPRINT`, `OCI_REGION`, `OCI_TENANCY_OCID`, `OCI_USER_OCID` | YES                            |
-| [PowerDNS](https://www.powerdns.com)                        | `pdns`         | `PDNS_API_KEY`, `PDNS_API_URL`                                                                                                              | Not tested yet                 |
-| [Rackspace](https://www.rackspace.com/cloud/dns)            | `rackspace`    | `RACKSPACE_USER`, `RACKSPACE_API_KEY`                                                                                                       | Not tested yet                 |
-| [RFC2136](https://tools.ietf.org/html/rfc2136)              | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                   | Not tested yet                 |
-| [Route 53](https://aws.amazon.com/route53/)                 | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.             | YES                            |
-| [Sakura Cloud](https://cloud.sakura.ad.jp/)                 | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                               | Not tested yet                 |
-| [Selectel](https://selectel.ru/en/)                         | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                        | YES                            |
-| [Stackpath](https://www.stackpath.com/)                     | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                      | Not tested yet                 |
-| [TransIP](https://www.transip.nl/)                          | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                          | YES                            |
-| [VegaDNS](https://github.com/shupp/VegaDNS-API)             | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                                | Not tested yet                 |
-| [Vscale](https://vscale.io/)                                | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                          | YES                            |
-| [VULTR](https://www.vultr.com)                              | `vultr`        | `VULTR_API_KEY`                                                                                                                             | Not tested yet                 |
-| [Zone.ee](https://www.zone.ee)                              | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                         | YES                            |
+Every lego environment variable can be overridden by their respective `_FILE` counterpart, which should have a filepath to a file that contains the secret as its value.
+For example, `CF_API_EMAIL_FILE=/run/secrets/traefik_cf-api-email` could be used to provide a Cloudflare API email address as a Docker secret named `traefik_cf-api-email`.
+
+| Provider Name                                               | Provider Code  | Environment Variables                                                                                                                       |                                                                             |
+|-------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
+| [ACME DNS](https://github.com/joohoi/acme-dns)              | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/acme-dns)     |
+| [Alibaba Cloud](https://www.alibabacloud.com)               | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/alidns)       |
+| [Auroradns](https://www.pcextreme.com/aurora/dns)           | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/auroradns)    |
+| [Azure](https://azure.microsoft.com/services/dns/)          | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]`   | [Additional configuration](https://go-acme.github.io/lego/dns/azure)        |
+| [Blue Cat](https://www.bluecatnetworks.com/)                | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                    | [Additional configuration](https://go-acme.github.io/lego/dns/bluecat)      |
+| [ClouDNS](https://www.cloudns.net/)                         | `cloudns`      | `CLOUDNS_AUTH_ID`, `CLOUDNS_AUTH_PASSWORD`                                                                                                  | [Additional configuration](https://go-acme.github.io/lego/dns/cloudns)      |
+| [Cloudflare](https://www.cloudflare.com)                    | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                               | [Additional configuration](https://go-acme.github.io/lego/dns/cloudflare)   |
+| [CloudXNS](https://www.cloudxns.net)                        | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/cloudxns)     |
+| [ConoHa](https://www.conoha.jp)                             | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/conoha)       |
+| [DigitalOcean](https://www.digitalocean.com)                | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/digitalocean) |
+| [DNSimple](https://dnsimple.com)                            | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                                 | [Additional configuration](https://go-acme.github.io/lego/dns/dnsimple)     |
+| [DNS Made Easy](https://dnsmadeeasy.com)                    | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/dnsmadeeasy)  |
+| [DNSPod](https://www.dnspod.com/)                           | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/dnspod)       |
+| [Domain Offensive (do.de)](https://www.do.de/)              | `dode`         | `DODE_TOKEN`                                                                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/dode)         |
+| [DreamHost](https://www.dreamhost.com/)                     | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/dreamhost)    |
+| [Duck DNS](https://www.duckdns.org/)                        | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/duckdns)      |
+| [Dyn](https://dyn.com)                                      | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/dyn)          |
+| External Program                                            | `exec`         | `EXEC_PATH`                                                                                                                                 | [Additional configuration](https://go-acme.github.io/lego/dns/exec)         |
+| [Exoscale](https://www.exoscale.com)                        | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/exoscale)     |
+| [Fast DNS](https://www.akamai.com/)                         | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/fastdns)      |
+| [Gandi](https://www.gandi.net)                              | `gandi`        | `GANDI_API_KEY`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/gandi)        |
+| [Gandi v5](http://doc.livedns.gandi.net)                    | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/gandiv5)      |
+| [Glesys](https://glesys.com/)                               | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/glesys)       |
+| [GoDaddy](https://godaddy.com/)                             | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                     | [Additional configuration](https://go-acme.github.io/lego/dns/godaddy)      |
+| [Google Cloud DNS](https://cloud.google.com/dns/docs/)      | `gcloud`       | `GCE_PROJECT`, Application Default Credentials [^2] [^3], [`GCE_SERVICE_ACCOUNT_FILE`]                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/gcloud)       |
+| [hosting.de](https://www.hosting.de)                        | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                  | [Additional configuration](https://go-acme.github.io/lego/dns/hostingde)    |
+| HTTP request                                                | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` [^1]                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/httpreq)      |
+| [IIJ](https://www.iij.ad.jp/)                               | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/iij)          |
+| [INWX](https://www.inwx.de/en)                              | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/inwx)         |
+| [Lightsail](https://aws.amazon.com/lightsail/)              | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                    | [Additional configuration](https://go-acme.github.io/lego/dns/lightsail)    |
+| [Linode](https://www.linode.com)                            | `linode`       | `LINODE_API_KEY`                                                                                                                            | [Additional configuration](https://go-acme.github.io/lego/dns/linode)       |
+| [Linode v4](https://www.linode.com)                         | `linodev4`     | `LINODE_TOKEN`                                                                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/linodev4)     |
+| manual                                                      | -              | none, but you need to run Traefik interactively [^4], turn on debug log to see instructions and press <kbd>Enter</kbd>.                 |                                                                                               |
+| [MyDNS.jp](https://www.mydns.jp/)                           | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                     | [Additional configuration](https://go-acme.github.io/lego/dns/mydnsjp)      |
+| [Namecheap](https://www.namecheap.com)                      | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/namecheap)    |
+| [name.com](https://www.name.com/)                           | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/namedotcom)   |
+| [Netcup](https://www.netcup.eu/)                            | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                           | [Additional configuration](https://go-acme.github.io/lego/dns/netcup)       |
+| [NIFCloud](https://cloud.nifty.com/service/dns.htm)         | `nifcloud`     | `NIFCLOUD_ACCESS_KEY_ID`, `NIFCLOUD_SECRET_ACCESS_KEY`                                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/nifcloud)     |
+| [Ns1](https://ns1.com/)                                     | `ns1`          | `NS1_API_KEY`                                                                                                                               | [Additional configuration](https://go-acme.github.io/lego/dns/ns1)          |
+| [Open Telekom Cloud](https://cloud.telekom.de)              | `otc`          | `OTC_DOMAIN_NAME`, `OTC_USER_NAME`, `OTC_PASSWORD`, `OTC_PROJECT_NAME`, `OTC_IDENTITY_ENDPOINT`                                             | [Additional configuration](https://go-acme.github.io/lego/dns/otc)          |
+| [OVH](https://www.ovh.com)                                  | `ovh`          | `OVH_ENDPOINT`, `OVH_APPLICATION_KEY`, `OVH_APPLICATION_SECRET`, `OVH_CONSUMER_KEY`                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/ovh)          |
+| [Openstack Designate](https://docs.openstack.org/designate) | `designate`    | `OS_AUTH_URL`, `OS_USERNAME`, `OS_PASSWORD`, `OS_TENANT_NAME`, `OS_REGION_NAME`                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/designate)    |
+| [Oracle Cloud](https://cloud.oracle.com/home)               | `oraclecloud`  | `OCI_COMPARTMENT_OCID`, `OCI_PRIVKEY_FILE`, `OCI_PRIVKEY_PASS`, `OCI_PUBKEY_FINGERPRINT`, `OCI_REGION`, `OCI_TENANCY_OCID`, `OCI_USER_OCID` | [Additional configuration](https://go-acme.github.io/lego/dns/oraclecloud)  |
+| [PowerDNS](https://www.powerdns.com)                        | `pdns`         | `PDNS_API_KEY`, `PDNS_API_URL`                                                                                                              | [Additional configuration](https://go-acme.github.io/lego/dns/pdns)         |
+| [Rackspace](https://www.rackspace.com/cloud/dns)            | `rackspace`    | `RACKSPACE_USER`, `RACKSPACE_API_KEY`                                                                                                       | [Additional configuration](https://go-acme.github.io/lego/dns/rackspace)    |
+| [RFC2136](https://tools.ietf.org/html/rfc2136)              | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                   | [Additional configuration](https://go-acme.github.io/lego/dns/rfc2136)      |
+| [Route 53](https://aws.amazon.com/route53/)                 | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.             | [Additional configuration](https://go-acme.github.io/lego/dns/route53)      |
+| [Sakura Cloud](https://cloud.sakura.ad.jp/)                 | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                               | [Additional configuration](https://go-acme.github.io/lego/dns/sakuracloud)  |
+| [Selectel](https://selectel.ru/en/)                         | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                        | [Additional configuration](https://go-acme.github.io/lego/dns/selectel)     |
+| [Stackpath](https://www.stackpath.com/)                     | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                      | [Additional configuration](https://go-acme.github.io/lego/dns/stackpath)    |
+| [TransIP](https://www.transip.nl/)                          | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/transip)      |
+| [VegaDNS](https://github.com/shupp/VegaDNS-API)             | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                                | [Additional configuration](https://go-acme.github.io/lego/dns/vegadns)      |
+| [Vscale](https://vscale.io/)                                | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                          | [Additional configuration](https://go-acme.github.io/lego/dns/vscale)       |
+| [VULTR](https://www.vultr.com)                              | `vultr`        | `VULTR_API_KEY`                                                                                                                             | [Additional configuration](https://go-acme.github.io/lego/dns/vultr)        |
+| [Zone.ee](https://www.zone.ee)                              | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                         | [Additional configuration](https://go-acme.github.io/lego/dns/zoneee)       |
 
 [^1]: more information about the HTTP message format can be found [here](https://go-acme.github.io/lego/dns/httpreq/)
 [^2]: [providing_credentials_to_your_application](https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application)
 [^3]: [google/default.go](https://github.com/golang/oauth2/blob/36a7019397c4c86cf59eeab3bc0d188bac444277/google/default.go#L61-L76)
+[^4]: `docker stack` remark: there is no way to support terminal attached to container when deploying with `docker stack`, so you might need to run container with `docker run -it` to generate certificates using `manual` provider.
 
 !!! note "`delayBeforeCheck`"
     By default, the `provider` verifies the TXT record _before_ letting ACME verify.
@@ -182,12 +278,29 @@ Do not hesitate to complete it.
 
 Use custom DNS servers to resolve the FQDN authority.
 
-```toml
-[acme]
-   # ...
-   [acme.dnsChallenge]
+```toml tab="File (TOML)"
+[certificatesResolvers.sample.acme]
+  # ...
+  [certificatesResolvers.sample.acme.dnsChallenge]
+    # ...
+    resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+```
+
+```yaml tab="File (YAML)"
+certificatesResolvers:
+  sample:
+    acme:
       # ...
-      resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+      dnsChallenge:
+        # ...
+        resolvers:
+        - "1.1.1.1:53"
+        - "8.8.8.8:53"
+```
+
+```bash tab="CLI"
+# ...
+--certificatesResolvers.sample.acme.dnsChallenge.resolvers:="1.1.1.1:53,8.8.8.8:53"
 ```
 
 #### Wildcard Domains
@@ -195,101 +308,61 @@ Use custom DNS servers to resolve the FQDN authority.
 [ACME V2](https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579) supports wildcard certificates.
 As described in [Let's Encrypt's post](https://community.letsencrypt.org/t/staging-endpoint-for-acme-v2/49605) wildcard certificates can only be generated through a [`DNS-01` challenge](#dnschallenge).
 
-```toml
-[acme]
-   # ...
-   [[acme.domains]]
-      main = "*.local1.com"
-      sans = ["local1.com"]
-
-# ...
-```
-
-!!! note "Double Wildcard Certificates"
-    It is not possible to request a double wildcard certificate for a domain (for example `*.*.local.com`).
-
-Due to an ACME limitation it is not possible to define wildcards in SANs (alternative domains).
-Thus, the wildcard domain has to be defined as a main domain.
-
-Most likely the root domain should receive a certificate too, so it needs to be specified as SAN and 2 `DNS-01` challenges are executed.
-In this case the generated DNS TXT record for both domains is the same.
-Even though this behavior is [DNS RFC](https://community.letsencrypt.org/t/wildcard-issuance-two-txt-records-for-the-same-name/54528/2) compliant,
-it can lead to problems as all DNS providers keep DNS records cached for a given time (TTL) and this TTL can be greater than the challenge timeout making the `DNS-01` challenge fail.
-
-The Traefik ACME client library [LEGO](https://github.com/go-acme/lego) supports some but not all DNS providers to work around this issue.
-The [Supported `provider` table](#providers) indicates if they allow generating certificates for a wildcard domain and its root domain.
-
-## Known Domains, SANs
-
-You can set SANs (alternative domains) for each main domain.
-Every domain must have A/AAAA records pointing to Traefik.
-Each domain & SAN will lead to a certificate request.
-
-```toml
-[acme]
-   # ...
-   [[acme.domains]]
-      main = "local1.com"
-      sans = ["test1.local1.com", "test2.local1.com"]
-   [[acme.domains]]
-      main = "local2.com"
-   [[acme.domains]]
-      main = "*.local3.com"
-      sans = ["local3.com", "test1.test1.local3.com"]
-# ...
-```
-
-!!! important
-    The certificates for the domains listed in `acme.domains` are negotiated at Traefik startup only.
-
-!!! note
-    Wildcard certificates can only be verified through a `DNS-01` challenge.
-
 ## `caServer`
 
 ??? example "Using the Let's Encrypt staging server"
 
-    ```toml
-    [acme]
-       # ...
-       caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
-       # ...
+    ```toml tab="File (TOML)"
+    [certificatesResolvers.sample.acme]
+      # ...
+      caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+      # ...
+    ```
+    
+    ```yaml tab="File (YAML)"
+    certificatesResolvers:
+      sample:
+        acme:
+          # ...
+          caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+          # ...
     ```
 
-## `onHostRule`
-
-Enable certificate generation on [routers](../routing/routers/index.md) `Host` & `HostSNI` rules.
-
-This will request a certificate from Let's Encrypt for each router with a Host rule.
-
-```toml
-[acme]
-   # ...
-   onHostRule = true
-   # ...
-```
-
-!!! note "Multiple Hosts in a Rule"
-    The rule `Host(test1.traefik.io,test2.traefik.io)` will request a certificate with the main domain `test1.traefik.io` and SAN `test2.traefik.io`.
-
-!!! warning
-    `onHostRule` option can not be used to generate wildcard certificates. Refer to [wildcard generation](#wildcard-domains) for further information.
+    ```bash tab="CLI"
+    # ...
+    --certificatesResolvers.sample.acme.caServer="https://acme-staging-v02.api.letsencrypt.org/directory"
+    # ...
+    ```
 
 ## `storage`
 
 The `storage` option sets the location where your ACME certificates are saved to.
 
-```toml
-[acme]
-   # ...
-   storage = "acme.json"
-   # ...
+```toml tab="File (TOML)"
+[certificatesResolvers.sample.acme]
+  # ...
+  storage = "acme.json"
+  # ...
 ```
 
-The value can refer to two kinds of storage:
+```toml tab="File (TOML)"
+certificatesResolvers:
+  sample:
+    acme:
+      # ...
+      storage: acme.json
+      # ...
+```
+
+```bash tab="CLI"
+# ...
+--certificatesResolvers.sample.acme.storage=acme.json
+# ...
+```
+
+The value can refer to some kinds of storage:
 
 - a JSON file
-- a KV store entry
 
 ### In a File
 
@@ -308,20 +381,7 @@ docker run -v "/my/host/acme:/etc/traefik/acme" traefik
 !!! warning
     For concurrency reason, this file cannot be shared across multiple instances of Traefik. Use a key value store entry instead.
 
-### In a a Key Value Store Entry
-
-ACME certificates can be stored in a key-value store entry.
-
-```toml
-storage = "traefik/acme/account"
-```
-
-!!! note "Storage Size"
-
-    Because key-value stores have limited entry size, the certificates list is compressed _before_ it is saved.
-    For example, it is possible to store up to _approximately_ 100 ACME certificates in Consul.
-
-## Fallbacks
+## Fallback
 
 If Let's Encrypt is not reachable, the following certificates will apply:
 

docs/content/https/overview.md

@@ -0,0 +1,16 @@
+# HTTPS & TLS
+
+Overview
+{: .subtitle }
+
+Traefik supports HTTPS & TLS, which concerns roughly two parts of the configuration:
+routers, and the TLS connection (and its underlying certificates).
+
+When a router has to handle HTTPS traffic,
+it should be specified with a `tls` field of the router definition.
+See the TLS section of the [routers documentation](../routing/routers/index.md#tls).
+
+The next sections of this documentation explain how to configure the TLS connection itself.
+That is to say, how to obtain [TLS certificates](./tls.md#certificates-definition):
+either through a definition in the dynamic configuration, or through [Let's Encrypt](./acme.md) (ACME).
+And how to configure [TLS options](./tls.md#tls-options), and [certificates stores](./tls.md#certificates-stores).

docs/content/https/ref-acme.toml

@@ -0,0 +1,89 @@
+# Enable ACME (Let's Encrypt): automatic SSL.
+[certificatesResolvers.sample.acme]
+
+  # Email address used for registration.
+  #
+  # Required
+  #
+  email = "test@traefik.io"
+
+  # File or key used for certificates storage.
+  #
+  # Required
+  #
+  storage = "acme.json"
+
+  # CA server to use.
+  # Uncomment the line to use Let's Encrypt's staging server,
+  # leave commented to go to prod.
+  #
+  # Optional
+  # Default: "https://acme-v02.api.letsencrypt.org/directory"
+  #
+  # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+  # KeyType to use.
+  #
+  # Optional
+  # Default: "RSA4096"
+  #
+  # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
+  #
+  # keyType = "RSA4096"
+
+  # Use a TLS-ALPN-01 ACME challenge.
+  #
+  # Optional (but recommended)
+  #
+  [certificatesResolvers.sample.acme.tlsChallenge]
+
+  # Use a HTTP-01 ACME challenge.
+  #
+  # Optional
+  #
+  # [certificatesResolvers.sample.acme.httpChallenge]
+
+    # EntryPoint to use for the HTTP-01 challenges.
+    #
+    # Required
+    #
+    # entryPoint = "web"
+
+  # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
+  # Note: mandatory for wildcard certificate generation.
+  #
+  # Optional
+  #
+  # [certificatesResolvers.sample.acme.dnsChallenge]
+
+    # DNS provider used.
+    #
+    # Required
+    #
+    # provider = "digitalocean"
+
+    # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
+    # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
+    # Useful if internal networks block external DNS queries.
+    #
+    # Optional
+    # Default: 0
+    #
+    # delayBeforeCheck = 0
+
+    # Use following DNS servers to resolve the FQDN authority.
+    #
+    # Optional
+    # Default: empty
+    #
+    # resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+
+    # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
+    #
+    # NOT RECOMMENDED:
+    # Increase the risk of reaching Let's Encrypt's rate limits.
+    #
+    # Optional
+    # Default: false
+    #
+    # disablePropagationCheck = true

docs/content/https/ref-acme.txt

@@ -0,0 +1,89 @@
+# Enable ACME (Let's Encrypt): automatic SSL.
+--certificatesResolvers.sample.acme
+
+# Email address used for registration.
+#
+# Required
+#
+--certificatesResolvers.sample.acme.email="test@traefik.io"
+
+# File or key used for certificates storage.
+#
+# Required
+#
+--certificatesResolvers.sample.acme.storage="acme.json"
+
+# CA server to use.
+# Uncomment the line to use Let's Encrypt's staging server,
+# leave commented to go to prod.
+#
+# Optional
+# Default: "https://acme-v02.api.letsencrypt.org/directory"
+#
+--certificatesResolvers.sample.acme.caServer="https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# KeyType to use.
+#
+# Optional
+# Default: "RSA4096"
+#
+# Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
+#
+--certificatesResolvers.sample.acme.keyType=RSA4096
+
+# Use a TLS-ALPN-01 ACME challenge.
+#
+# Optional (but recommended)
+#
+--certificatesResolvers.sample.acme.tlsChallenge
+
+# Use a HTTP-01 ACME challenge.
+#
+# Optional
+#
+--certificatesResolvers.sample.acme.httpChallenge
+
+# EntryPoint to use for the HTTP-01 challenges.
+#
+# Required
+#
+--certificatesResolvers.sample.acme.httpChallenge.entryPoint=web
+
+# Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
+# Note: mandatory for wildcard certificate generation.
+#
+# Optional
+#
+--certificatesResolvers.sample.acme.dnsChallenge
+
+# DNS provider used.
+#
+# Required
+#
+--certificatesResolvers.sample.acme.dnsChallenge.provider=digitalocean
+
+# By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
+# If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
+# Useful if internal networks block external DNS queries.
+#
+# Optional
+# Default: 0
+#
+--certificatesResolvers.sample.acme.dnsChallenge.delayBeforeCheck=0
+
+# Use following DNS servers to resolve the FQDN authority.
+#
+# Optional
+# Default: empty
+#
+--certificatesResolvers.sample.acme.dnsChallenge.resolvers="1.1.1.1:53,8.8.8.8:53"
+
+# Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
+#
+# NOT RECOMMENDED:
+# Increase the risk of reaching Let's Encrypt's rate limits.
+#
+# Optional
+# Default: false
+#
+--certificatesResolvers.sample.acme.dnsChallenge.disablePropagationCheck=true

docs/content/https/ref-acme.yaml

@@ -0,0 +1,93 @@
+certificatesResolvers:
+  sample:
+    # Enable ACME (Let's Encrypt): automatic SSL.
+    acme:
+
+      # Email address used for registration.
+      #
+      # Required
+      #
+      email: "test@traefik.io"
+
+      # File or key used for certificates storage.
+      #
+      # Required
+      #
+      storage: "acme.json"
+
+      # CA server to use.
+      # Uncomment the line to use Let's Encrypt's staging server,
+      # leave commented to go to prod.
+      #
+      # Optional
+      # Default: "https://acme-v02.api.letsencrypt.org/directory"
+      #
+      # caServer: "https://acme-staging-v02.api.letsencrypt.org/directory"
+
+      # KeyType to use.
+      #
+      # Optional
+      # Default: "RSA4096"
+      #
+      # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
+      #
+      # keyType: RSA4096
+
+      # Use a TLS-ALPN-01 ACME challenge.
+      #
+      # Optional (but recommended)
+      #
+      tlsChallenge:
+
+      # Use a HTTP-01 ACME challenge.
+      #
+      # Optional
+      #
+      # httpChallenge:
+
+        # EntryPoint to use for the HTTP-01 challenges.
+        #
+        # Required
+        #
+        # entryPoint: web
+
+      # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
+      # Note: mandatory for wildcard certificate generation.
+      #
+      # Optional
+      #
+      # dnsChallenge:
+
+        # DNS provider used.
+        #
+        # Required
+        #
+        # provider: digitalocean
+
+        # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
+        # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
+        # Useful if internal networks block external DNS queries.
+        #
+        # Optional
+        # Default: 0
+        #
+        # delayBeforeCheck: 0
+
+        # Use following DNS servers to resolve the FQDN authority.
+        #
+        # Optional
+        # Default: empty
+        #
+        # resolvers
+        # - "1.1.1.1:53"
+        # - "8.8.8.8:53"
+
+        # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
+        #
+        # NOT RECOMMENDED:
+        # Increase the risk of reaching Let's Encrypt's rate limits.
+        #
+        # Optional
+        # Default: false
+        #
+        # disablePropagationCheck: true

docs/content/https/tls.md

@@ -0,0 +1,215 @@
+# TLS
+
+Transport Layer Security
+{: .subtitle }
+
+## Certificates Definition
+
+### Automated
+
+See the [Let's Encrypt](./acme.md) page.
+
+### User defined
+
+To add / remove TLS certificates, even when Traefik is already running, their definition can be added to the [dynamic configuration](../getting-started/configuration-overview.md), in the `[[tls.certificates]]` section:
+
+```toml tab="TOML"
+[[tls.certificates]]
+  certFile = "/path/to/domain.cert"
+  keyFile = "/path/to/domain.key"
+
+[[tls.certificates]]
+  certFile = "/path/to/other-domain.cert"
+  keyFile = "/path/to/other-domain.key"
+```
+
+```yaml tab="YAML"
+tls:
+  certificates:
+  - certFile: /path/to/domain.cert
+    keyFile: /path/to/domain.key
+  - certFile: /path/to/other-domain.cert
+    keyFile: /path/to/other-domain.key
+```
+
+!!! important "File Provider Only"
+
+    In the above example, we've used the [file provider](../providers/file.md) to handle these definitions.
+    In its current alpha version, it is the only available method to configure the certificates (as well as the options and the stores).
+
+## Certificates Stores
+
+In Traefik, certificates are grouped together in certificates stores, which are defined as such:
+
+```toml tab="TOML"
+[tls.stores]
+  [tls.stores.default]
+```
+
+```yaml tab="YAML"
+tls:
+  stores:
+    default: {}
+```
+
+!!! important "Alpha restriction"
+
+    During the alpha version, any store definition other than the default one (named `default`) will be ignored,
+    and there is thefore only one globally available TLS store.
+
+In the `tls.certificates` section, a list of stores can then be specified to indicate where the certificates should be stored:
+
+```toml tab="TOML"
+[[tls.certificates]]
+  certFile = "/path/to/domain.cert"
+  keyFile = "/path/to/domain.key"
+  stores = ["default"]
+
+[[tls.certificates]]
+  # Note that since no store is defined,
+  # the certificate below will be stored in the `default` store.
+  certFile = "/path/to/other-domain.cert"
+  keyFile = "/path/to/other-domain.key"
+```
+
+```yaml tab="YAML"
+tls:
+  certificates:
+  - certFile: /path/to/domain.cert
+    keyFile: /path/to/domain.key
+    stores:
+    - default
+  # Note that since no store is defined,
+  # the certificate below will be stored in the `default` store.
+  - certFile: /path/to/other-domain.cert
+    keyFile: /path/to/other-domain.key
+```
+
+!!! important "Alpha restriction"
+
+    During the alpha version, the `stores` list will actually be ignored and automatically set to `["default"]`.
+
+### Default Certificate
+
+Traefik can use a default certificate for connections without a SNI, or without a matching domain.
+This default certificate should be defined in a TLS store:
+
+```toml tab="TOML"
+[tls.stores]
+  [tls.stores.default]
+    [tls.stores.default.defaultCertificate]
+      certFile = "path/to/cert.crt"
+      keyFile  = "path/to/cert.key"
+```
+
+```yaml tab="YAML"
+tls:
+  stores:
+    default:
+      defaultCertificate:
+        certFile: path/to/cert.crt
+        keyFile: path/to/cert.key
+```
+
+If no default certificate is provided, Traefik generates and uses a self-signed certificate.
+
+## TLS Options
+
+The TLS options allow one to configure some parameters of the TLS connection.
+
+### Minimum TLS Version
+
+```toml tab="TOML"
+[tls.options]
+
+  [tls.options.default]
+    minVersion = "VersionTLS12"
+
+  [tls.options.mintls13]
+    minVersion = "VersionTLS13"
+```
+
+```yaml tab="YAML"
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+
+    mintls13:
+      minVersion: VersionTLS13
+```
+
+### Client Authentication (mTLS)
+
+Traefik supports mutual authentication, through the `ClientAuth` section.
+
+For authentication policies that require verification of the client certificate, the certificate authority for the certificate should be set in `ClientAuth.caFiles`.
+ 
+The `ClientAuth.clientAuthType` option governs the behaviour as follows:
+
+- `NoClientCert`: disregards any client certificate.
+- `RequestClientCert`: asks for a certificate but proceeds anyway if none is provided.
+- `RequireAnyClientCert`: requires a certificate but does not verify if it is signed by a CA listed in `ClientAuth.caFiles`.
+- `VerifyClientCertIfGiven`: if a certificate is provided, verifies if it is signed by a CA listed in `ClientAuth.caFiles`. Otherwise proceeds without any certificate.
+- `RequireAndVerifyClientCert`: requires a certificate, which must be signed by a CA listed in `ClientAuth.caFiles`. 
+
+```toml tab="TOML"
+[tls.options]
+  [tls.options.default]
+    [tls.options.default.clientAuth]
+      # in PEM format. each file can contain multiple CAs.
+      caFiles = ["tests/clientca1.crt", "tests/clientca2.crt"]
+      clientAuthType = "RequireAndVerifyClientCert"
+```
+
+```yaml tab="YAML"
+tls:
+  options:
+    default:
+      clientAuth:
+        # in PEM format. each file can contain multiple CAs.
+        caFiles:
+        - tests/clientca1.crt
+        - tests/clientca2.crt
+        clientAuthType: RequireAndVerifyClientCert
+```
+
+### Cipher Suites
+
+See [cipherSuites](https://godoc.org/crypto/tls#pkg-constants) for more information.
+
+```toml tab="TOML"
+[tls.options]
+  [tls.options.default]
+    cipherSuites = [
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_RSA_WITH_AES_256_GCM_SHA384"
+    ]
+```
+
+```yaml tab="YAML"
+tls:
+  options:
+    default:
+      cipherSuites:
+      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+      - TLS_RSA_WITH_AES_256_GCM_SHA384
+```
+
+### Strict SNI Checking
+
+With strict SNI checking, Traefik won't allow connections from clients connections
+that do not specify a server_name extension.
+
+```toml tab="TOML"
+[tls.options]
+  [tls.options.default]
+    sniStrict = true
+```
+
+```yaml tab="YAML"
+tls:
+  options:
+    default:
+      sniStrict: true
+```

docs/content/middlewares/addprefix.md

@@ -9,37 +9,44 @@ The AddPrefix middleware updates the URL Path of the request before forwarding i
 
 ## Configuration Examples
 
-??? example "File -- Prefixing with /foo"
+```yaml tab="Docker"
+# Prefixing with /foo
+labels:
+- "traefik.http.middlewares.add-foo.addprefix.prefix=/foo"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.add-foo.AddPrefix]
-         prefix = "/foo"
-    ```
+```yaml tab="Kubernetes"
+# Prefixing with /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: add-foo
+spec:
+  addPrefix:
+    prefix: /foo
+```
 
-??? example "Docker -- Prefixing with /bar"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.add-foo.addprefix.prefix": "/foo"
+}
+```
 
-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.add-bar.addprefix.prefix=/bar"
-    ```
+```yaml tab="Rancher"
+# Prefixing with /foo
+labels:
+- "traefik.http.middlewares.add-foo.addprefix.prefix=/foo"
+```
 
-??? example "Kubernetes -- Prefixing with /bar"
-
-    ```yaml
-    apiVersion: traefik.containo.us/v1alpha1
-    kind: Middleware
-    metadata:
-      name: addprefix
-    spec:
-      addprefix:
-        prefix: /bar
-    ```
+```toml tab="File"
+# Prefixing with /foo
+[http.middlewares]
+  [http.middlewares.add-foo.addPrefix]
+    prefix = "/foo"
+```
 
 ## Configuration Options
 
-### prefix
+### `prefix`
 
 `prefix` is the string to add before the current path in the requested URL. It should include the leading slash (`/`).

docs/content/middlewares/basicauth.md

@@ -9,23 +9,50 @@ The BasicAuth middleware is a quick way to restrict access to your services to k
 
 ## Configuration Examples
 
-??? example "File -- Declaring the user list"
+```yaml tab="Docker"
+# Declaring the user list
+#
+# Note: all dollar signs in the hash need to be doubled for escaping.
+# To create user:password pair, it's possible to use this command:
+# echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g
+labels:
+  - "traefik.http.middlewares.test-auth.basicauth.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/,test2:$$apr1$$d9hr9HBB$$4HxwgUir3HP4EsggP/QNo0"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.basicauth]
-      users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
-      "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
-    ```
+```yaml tab="Kubernetes"
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  basicAuth:
+    users:
+    - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+    - test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
+```
 
-??? example "Docker -- Using an external file for the authorized users"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.basicauth.users": "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
+}
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.declared-users-only.basicauth.usersFile=path-to-file.ext",
-    ```
+```yaml tab="Rancher"
+# Declaring the user list
+labels:
+  - "traefik.http.middlewares.test-auth.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"
+```
+
+```toml tab="File"
+# Declaring the user list
+[http.middlewares]
+  [http.middlewares.test-auth.basicAuth]
+  users = [
+    "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
+    "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
+  ]
+```
 
 ## Configuration Options
 
@@ -34,10 +61,10 @@ The BasicAuth middleware is a quick way to restrict access to your services to k
 Passwords must be encoded using MD5, SHA1, or BCrypt.
 
 !!! tip 
-   
+
     Use `htpasswd` to generate the passwords.
 
-### users
+### `users`
 
 The `users` option is an array of authorized users. Each user will be declared using the `name:encoded-password` format.
 
@@ -45,7 +72,7 @@ The `users` option is an array of authorized users. Each user will be declared u
     
     If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
 
-### usersFile
+### `usersFile`
 
 The `usersFile` option is the path to an external file that contains the authorized users for the middleware.
 
@@ -53,7 +80,7 @@ The file content is a list of `name:encoded-password`.
 
 ??? example "A file containing test/test and test2/test2"
 
-    ```
+    ```txt
     test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
     test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
     ```
@@ -62,22 +89,42 @@ The file content is a list of `name:encoded-password`.
     
     If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
 
-### realm
+### `realm`
 
 You can customize the realm for the authentication with the `realm` option. The default value is `traefik`. 
 
-### headerField
+### `headerField`
 
 You can customize the header field for the authenticated user using the `headerField`option.
 
-??? example "File -- Passing Authenticated Users to Services Via Headers"
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.my-auth.basicauth.headerField=X-WebAuth-User"
+```
 
-    ```toml
-      [http.middlewares.my-auth.basicauth]
-        usersFile = "path-to-file.ext"
-        headerField = "X-WebAuth-User" # header for the authenticated user
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: my-auth
+spec:
+  basicAuth:
+    # ...
+    headerField: X-WebAuth-User
+```
 
-### removeHeader
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.my-auth.basicauth.headerField": "X-WebAuth-User"
+}
+```
+
+```toml tab="File"
+[http.middlewares.my-auth.basicAuth]
+  # ...
+  headerField = "X-WebAuth-User"
+```
+
+### `removeHeader`
 
 Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)

docs/content/middlewares/buffering.md

@@ -13,46 +13,65 @@ This can help services deal with large data (multipart/form-data for example), a
 
 ## Configuration Examples
 
-??? example "File -- Sets the maximum request body to 2Mb"
-    
-    ```toml
-    [http.middlewares]
-      [http.middlewares.2Mb-limit.buffering]
-          maxRequestBodyBytes = 250000
-    ``` 
+```yaml tab="Docker"
+# Sets the maximum request body to 2Mb
+labels:
+- "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=250000"
+```
 
-??? example "Docker -- Buffers 1Mb of the request in memory, then writes to disk"
+```yaml tab="Kubernetes"
+# Sets the maximum request body to 2Mb
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: limit
+spec:
+  buffering:
+    maxRequestBodyBytes: 250000
+```
 
-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.1Mb-memory.buffering.memRequestBodyBytes=125000",
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes": "250000"
+}
+```
+
+```yaml tab="Rancher"
+# Sets the maximum request body to 2Mb
+labels:
+- "traefik.http.middlewares.limit.buffering.maxRequestBodyBytes=250000"
+```
+
+```toml tab="File"
+# Sets the maximum request body to 2Mb
+[http.middlewares]
+  [http.middlewares.limit.buffering]
+    maxRequestBodyBytes = 250000
+```
 
 ## Configuration Options
 
-### maxRequestBodyBytes
+### `maxRequestBodyBytes`
 
 With the `maxRequestBodyBytes` option, you can configure the maximum allowed body size for the request (in Bytes).
 
 If the request exceeds the allowed size, the request is not forwarded to the service and the client gets a `413 (Request Entity Too Large) response.
 
-### memRequestBodyBytes
+### `memRequestBodyBytes`
 
 You can configure a thresold (in Bytes) from which the request will be buffered on disk instead of in memory with the `memRequestBodyBytes` option. 
 
-### maxResponseBodyBytes
+### `maxResponseBodyBytes`
 
 With the `maxReesponseBodyBytes` option, you can configure the maximum allowed response size from the service (in Bytes).
 
 If the response exceeds the allowed size, it is not forwarded to the client. The client gets a `413 (Request Entity Too Large) response` instead.
 
-### memResponseBodyBytes
+### `memResponseBodyBytes`
 
 You can configure a thresold (in Bytes) from which the response will be buffered on disk instead of in memory with the `memResponseBodyBytes` option. 
 
-### retryExpression
+### `retryExpression`
 
 You can have the Buffering middleware replay the request with the help of the `retryExpression` option.
 

docs/content/middlewares/chain.md

@@ -1,6 +1,6 @@
 # Chain
 
-When One Isn't Enougth
+When One Isn't Enough
 {: .subtitle }
 
 ![Chain](../assets/img/middleware/chain.png)
@@ -10,31 +10,128 @@ It makes reusing the same groups easier.
 
 ## Configuration Example
 
-??? example "A Chain for WhiteList, BasicAuth, and HTTPS"
-    
-    ```toml
-    # ...    
-    [http.routers]
-        [http.routers.router1]
-            service = "service1"
-            middlewares = ["secured"]
-            rule = "Host: mydomain"
-    
-    [http.middlewares]
-        [http.middlewares.secured.Chain]
-            middlewares = ["https-only", "known-ips", "auth-users"]
-            
-        [http.middlewares.auth-users.BasicAuth]
-            users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]
-        [http.middlewares.https-only.SchemeRedirect]
-            scheme = "https"
-        [http.middlewares.known-ips.ipWhiteList]
-            sourceRange = ["192.168.1.7", "x.x.x.x", "x.x.x.x"]
-    
-    [http.services]
-      [http.services.service1]
-        [http.services.service1.LoadBalancer]
-          [[http.services.service1.LoadBalancer.Servers]]
-            URL = "http://127.0.0.1:80"
-            Weight = 1
-    ```
+Example "A Chain for WhiteList, BasicAuth, and HTTPS"
+
+```yaml tab="Docker"
+labels:
+- "traefik.http.routers.router1.service=service1"
+- "traefik.http.routers.router1.middlewares=secured"
+- "traefik.http.routers.router1.rule=Host(`mydomain`)"
+- "traefik.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
+- "traefik.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
+- "traefik.http.middlewares.https-only.redirectscheme.scheme=https"
+- "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange=192.168.1.7,127.0.0.1/32"
+- "http.services.service1.loadbalancer.server.port=80"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: test
+  namespace: default
+
+spec:
+  entryPoints:
+    - web
+
+  routes:
+    - match: Host(`mydomain`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+      middlewares:
+        - name: secured
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: secured
+spec:
+  chain:
+    middlewares:
+    - https-only
+    - known-ips
+    - auth-users
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-users
+spec:
+  basicAuth:
+    users:
+    - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: https-only
+spec:
+  redirectScheme:
+    scheme: https
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: known-ips
+spec:
+  ipWhiteList:
+    sourceRange:
+    - 192.168.1.7
+    - 127.0.0.1/32
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.routers.router1.service": "service1",
+  "traefik.http.routers.router1.middlewares": "secured",
+  "traefik.http.routers.router1.rule": "Host(`mydomain`)",
+  "traefik.http.middlewares.secured.chain.middlewares": "https-only,known-ips,auth-users",
+  "traefik.http.middlewares.auth-users.basicauth.users": "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/",
+  "traefik.http.middlewares.https-only.redirectscheme.scheme": "https",
+  "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange": "192.168.1.7,127.0.0.1/32",
+  "http.services.service1.loadbalancer.server.port": "80"
+}
+```
+
+```yaml tab="Rancher"
+labels:
+- "traefik.http.routers.router1.service=service1"
+- "traefik.http.routers.router1.middlewares=secured"
+- "traefik.http.routers.router1.rule=Host(`mydomain`)"
+- "traefik.http.middlewares.secured.chain.middlewares=https-only,known-ips,auth-users"
+- "traefik.http.middlewares.auth-users.basicauth.users=test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
+- "traefik.http.middlewares.https-only.redirectscheme.scheme=https"
+- "traefik.http.middlewares.known-ips.ipwhitelist.sourceRange=192.168.1.7,127.0.0.1/32"
+- "http.services.service1.loadbalancer.server.port=80"
+```
+
+```toml tab="File"
+# ...    
+[http.routers]
+  [http.routers.router1]
+    service = "service1"
+    middlewares = ["secured"]
+    rule = "Host(`mydomain`)"
+
+[http.middlewares]
+  [http.middlewares.secured.chain]
+    middlewares = ["https-only", "known-ips", "auth-users"]
+
+  [http.middlewares.auth-users.basicAuth]
+    users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"]
+
+  [http.middlewares.https-only.redirectScheme]
+    scheme = "https"
+
+  [http.middlewares.known-ips.ipWhiteList]
+    sourceRange = ["192.168.1.7", "127.0.0.1/32"]
+
+[http.services]
+  [http.services.service1]
+    [http.services.service1.loadBalancer]
+      [[http.services.service1.loadBalancer.servers]]
+        url = "http://127.0.0.1:80"
+```

docs/content/middlewares/circuitbreaker.md

@@ -23,23 +23,41 @@ To assess if your system is healthy, the circuit breaker constantly monitors the
 
 ## Configuration Examples
 
-??? example "Latency Check -- Using Toml"
+```yaml tab="Docker"
+# Latency Check
+labels:
+- "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
+```
 
-    ```toml
-    [http.middlewares]
-       [http.middlewares.latency-check.circuitbreaker]
-          expression = "LatencyAtQuantileMS(50.0) > 100"
-    ```
+```yaml tab="Kubernetes"
+# Latency Check
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: latency-check
+spec:
+  circuitBreaker:
+    expression: LatencyAtQuantileMS(50.0) > 100
+```
 
-??? example "Latency Check -- Using Docker Labels"
-   
-    ```yaml
-    # in a docker compose file
-    container-definition:
-         image: image-name
-         labels:
-             - "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.latency-check.circuitbreaker.expression": "LatencyAtQuantileMS(50.0) > 100"
+}
+```
+
+```yaml tab="Rancher"
+# Latency Check
+labels:
+- "traefik.http.middlewares.latency-check.circuitbreaker.expression=LatencyAtQuantileMS(50.0) > 100"
+```
+
+```toml tab="File"
+# Latency Check
+[http.middlewares]
+  [http.middlewares.latency-check.circuitBreaker]
+    expression = "LatencyAtQuantileMS(50.0) > 100"
+```
 
 ## Possible States
 
@@ -48,7 +66,7 @@ There are three possible states for your circuit breaker:
 - Close (your service operates normally)
 - Open (the fallback mechanism takes over your service)
 - Recovering (the circuit breaker tries to resume normal operations by progressively sending requests to your service)
-   
+
 ### Close
 
 While close, the circuit breaker only collects metrics to analyze the behavior of the requests.
@@ -57,11 +75,14 @@ At specified intervals (`checkPeriod`), it will evaluate `expression` to decide
 
 ### Open
 
-While open, the fallback mechanism takes over the normal service calls for a duration of `FallbackDuration`. After this duration, it will enter the recovering state.
+While open, the fallback mechanism takes over the normal service calls for a duration of `FallbackDuration`.
+After this duration, it will enter the recovering state.
 
 ### Recovering
 
-While recovering, the circuit breaker will progressively send requests to your service again (in a linear way, for `RecoveryDuration`). If your service fails during recovery, the circuit breaker becomes open again. If the service operates normally during the whole recovering duration, then the circuit breaker returns to close.
+While recovering, the circuit breaker will progressively send requests to your service again (in a linear way, for `RecoveryDuration`).
+If your service fails during recovery, the circuit breaker becomes open again.
+If the service operates normally during the whole recovering duration, then the circuit breaker returns to close.
 
 ## Configuration Options
 
@@ -74,12 +95,12 @@ The `expression` can check three different metrics:
 - The network error ratio (`NetworkErrorRatio`)
 - The status code ratio (`ResponseCodeRatio`)
 - The latency at quantile, in milliseconds (`LatencyAtQuantileMS`)
-   
-#### NetworkErrorRatio
+
+#### `NetworkErrorRatio`
 
 If you want the circuit breaker to trigger at a 30% ratio of network errors, the expression will be `NetworkErrorRatio() > 0.30`
 
-#### ResponseCodeRatio
+#### `ResponseCodeRatio`
 
 You can trigger the circuit breaker based on the ratio of a given range of status codes.
 
@@ -94,11 +115,11 @@ The operation that will be computed is sum(`to` -> `from`) / sum (`dividedByFrom
 
 For example, the expression `ResponseCodeRatio(500, 600, 0, 600) > 0.25` will trigger the circuit breaker if 25% of the requests returned a 5XX status (amongst the request that returned a status code from 0 to 5XX). 
 
-#### LatencyAtQuantileMS
+#### `LatencyAtQuantileMS`
 
 You can trigger the circuit breaker when a given proportion of your requests become too slow.
 
-For example, the expression `LatencyAtQuantileMS(50.0) > 100` will trigger the circuit breaker when the median lantency (quantile 50) reaches 100MS.
+For example, the expression `LatencyAtQuantileMS(50.0) > 100` will trigger the circuit breaker when the median latency (quantile 50) reaches 100MS.
 
 !!! Note
 
@@ -111,7 +132,7 @@ You can combine multiple metrics using operators in your expression.
 Supported operators are:
 
 - AND (`&&`)
-- OR (`||)
+- OR (`||`)
 
 For example, `ResponseCodeRatio(500, 600, 0, 600) > 0.30 || NetworkErrorRatio() > 0.10` triggers the circuit breaker when 30% of the requests return a 5XX status code, or when the ratio of network errors reaches 10%. 
 
@@ -130,16 +151,16 @@ Here is the list of supported operators:
 ### Fallback mechanism
 
 The fallback mechanism returns a `HTTP 503 Service Unavailable` to the client (instead of calling the target service). This behavior cannot be configured. 
-   
-### CheckPeriod
+
+### `CheckPeriod`
 
 The interval used to evaluate `expression` and decide if the state of the circuit breaker must change. By default, `CheckPeriod` is 100Ms. This value cannot be configured.
 
-### FallbackDuration
+### `FallbackDuration`
 
 By default, `FallbackDuration` is 10 seconds. This value cannot be configured.
 
-### RecoveringDuration
+### `RecoveringDuration`
 
 The duration of the recovering mode (recovering state). 
 

docs/content/middlewares/compress.md

@@ -9,21 +9,39 @@ The Compress middleware enables the gzip compression.
 
 ## Configuration Examples
 
-??? example "File -- enable gzip compression"
+```yaml tab="Docker"
+# Enable gzip compression
+labels:
+- "traefik.http.middlewares.test-compress.compress=true"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-compress.Compress]
-    ```
-    
-??? example "Docker -- enable gzip compression"
+```yaml tab="Kubernetes"
+# Enable gzip compression
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-compress
+spec:
+  compress: {}
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-compress.compress=true",
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-compress.compress": "true"
+}
+```
+
+```yaml tab="Rancher"
+# Enable gzip compression
+labels:
+- "traefik.http.middlewares.test-compress.compress=true"
+```
+
+```toml tab="File"
+# Enable gzip compression
+[http.middlewares]
+  [http.middlewares.test-compress.compress]
+```
 
 ## Notes
 

docs/content/middlewares/digestauth.md

@@ -9,22 +9,43 @@ The DigestAuth middleware is a quick way to restrict access to your services to
 
 ## Configuration Examples
 
-??? example "File -- Declaring the user list"
+```yaml tab="Docker"
+labels:
+- "traefik.http.middlewares.test-auth.digestauth.users=test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.digestauth]
-      users = ["test:traefik:a2688e031edb4be6a3797f3882655c05", "test2:traefik:518845800f9e2bfb1f1f740ec24f074e"]
-    ```
+```yaml tab="Kubernetes"
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  digestAuth:
+    users:
+    - test:traefik:a2688e031edb4be6a3797f3882655c05
+    - test2:traefik:518845800f9e2bfb1f1f740ec24f074e
+```
 
-??? example "Docker -- Using an external file for the authorized users"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.digestauth.users": "test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+}
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.declared-users-only.digestauth.usersFile=path-to-file.ext",
-    ```
+```yaml tab="Rancher"
+labels:
+- "traefik.http.middlewares.test-auth.digestauth.users=test:traefik:a2688e031edb4be6a3797f3882655c05,test2:traefik:518845800f9e2bfb1f1f740ec24f074e"
+```
+
+```toml tab="File"
+[http.middlewares]
+  [http.middlewares.test-auth.digestAuth]
+    users = [
+      "test:traefik:a2688e031edb4be6a3797f3882655c05",
+      "test2:traefik:518845800f9e2bfb1f1f740ec24f074e",
+    ]
+```
 
 !!! tip 
    
@@ -32,7 +53,7 @@ The DigestAuth middleware is a quick way to restrict access to your services to
 
 ## Configuration Options
 
-### Users
+### `users`
 
 The `users` option is an array of authorized users. Each user will be declared using the `name:realm:encoded-password` format.
 
@@ -40,7 +61,7 @@ The `users` option is an array of authorized users. Each user will be declared u
     
     If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
 
-### UsersFile
+### `usersFile`
 
 The `usersFile` option is the path to an external file that contains the authorized users for the middleware.
 
@@ -48,7 +69,7 @@ The file content is a list of `name:realm:encoded-password`.
 
 ??? example "A file containing test/test and test2/test2"
 
-    ```
+    ```txt
     test:traefik:a2688e031edb4be6a3797f3882655c05
     test2:traefik:518845800f9e2bfb1f1f740ec24f074e
     ```
@@ -57,22 +78,49 @@ The file content is a list of `name:realm:encoded-password`.
     
     If both `users` and `usersFile` are provided, the two are merged. The content of `usersFile` has precedence over `users`.
 
-### Realm
+### `realm`
 
 You can customize the realm for the authentication with the `realm` option. The default value is `traefik`. 
 
-### HeaderField
+### `headerField`
 
 You can customize the header field for the authenticated user using the `headerField`option.
 
-??? example "File -- Passing Authenticated Users to Services Via Headers"
+Example "File -- Passing Authenticated User to Services Via Headers"
 
-    ```toml
-      [http.middlewares.my-auth.digestauth]
-        usersFile = "path-to-file.ext"
-        headerField = "X-WebAuth-User" # header for the authenticated user
-    ```
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.my-auth.digestauth.headerField=X-WebAuth-User"
+```
 
-### RemoveHeader
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: my-auth
+spec:
+  digestAuth:
+    # ...
+    headerField: X-WebAuth-User
+```
+
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.my-auth.digestauth.headerField=X-WebAuth-User"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.my-auth.digestauth.headerField": "X-WebAuth-User"
+}
+```
+
+```toml tab="File"
+[http.middlewares.my-auth.digestAuth]
+  # ...
+  headerField = "X-WebAuth-User"
+```
+
+### `removeHeader`
 
 Set the `removeHeader` option to `true` to remove the authorization header before forwarding the request to your service. (Default value is `false`.)

docs/content/middlewares/errorpages.md

@@ -12,42 +12,61 @@ The ErrorPage middleware returns a custom page in lieu of the default, according
 
 ## Configuration Examples
 
-??? example "File -- Custom Error Page for 5XX"
+```yaml tab="Docker"
+# Dynamic Custom Error Page for 5XX Status Code
+labels:
+- "traefik.http.middlewares.test-errorpage.errors.status=500-599"
+- "traefik.http.middlewares.test-errorpage.errors.service=serviceError"
+- "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html"
+```
 
-    ```toml
-    [http.routers]
-      [http.routers.router1]
-        Service = "my-service"
-        Rule = Host(`my-domain`)
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-errorpage
+spec:
+  errors:
+    status:
+    - 500-599
+    service: serviceError
+    query: /{status}.html
+```
 
-    [http.middlewares]
-      [http.middlewares.5XX-errors.Errors]
-        status = ["500-599"]
-        service = "error-handler-service"
-        query = "/error.html"
-                
-    [http.services]
-      # ... definition of error-handler-service and my-service
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-errorpage.errors.status": "500-599",
+  "traefik.http.middlewares.test-errorpage.errors.service": "serviceError",
+  "traefik.http.middlewares.test-errorpage.errors.query": "/{status}.html"
+}
+```
 
-??? example "Docker -- Dynamic Custom Error Page for 5XX Status Code"
+```yaml tab="Rancher"
+# Dynamic Custom Error Page for 5XX Status Code
+labels:
+- "traefik.http.middlewares.test-errorpage.errors.status=500-599"
+- "traefik.http.middlewares.test-errorpage.errors.service=serviceError"
+- "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html"
+```
 
-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.test-errorpage.errors.status=500-599",
-          - "traefik.http.middlewares.test-errorpage.errors.service=serviceError",
-          - "traefik.http.middlewares.test-errorpage.errors.query=/{status}.html",
-            		
-    ```
-    
-    !!! note 
-        In this example, the error page URL is based on the status code (`query=/{status}.html)`.
+```toml tab="File"
+# Custom Error Page for 5XX
+[http.middlewares]
+  [http.middlewares.test-errorpage.errors]
+    status = ["500-599"]
+    service = "serviceError"
+    query = "/{status}.html"
+
+[http.services]
+  # ... definition of error-handler-service and my-service
+```
+
+!!! note 
+    In this example, the error page URL is based on the status code (`query=/{status}.html)`.
 
 ## Configuration Options
 
-### status
+### `status`
 
 The `status` that will trigger the error page.
 
@@ -57,10 +76,10 @@ The status code ranges are inclusive (`500-599` will trigger with every code bet
 
     You can define either a status code like `500` or ranges with a syntax like `500-599`.
 
-### service
+### `service`
 
 The service that will serve the new requested error page.
 
-### query
+### `query`
 
 The URL for the error page (hosted by `service`). You can use `{status}` in the query, that will be replaced by the received status code.

docs/content/middlewares/forwardauth.md

@@ -1,6 +1,6 @@
 # ForwardAuth
 
-Using an External Service to Ccheck for Credentials
+Using an External Service to Check for Credentials
 {: .subtitle }
 
 ![AuthForward](../assets/img/middleware/authforward.png)
@@ -11,53 +11,93 @@ Otherwise, the response from the authentication server is returned.
 
 ## Configuration Examples
 
-??? example "File -- Forward authentication to authserver.com"
+```yaml tab="Docker"
+# Forward authentication to authserver.com
+labels:
+- "traefik.http.middlewares.test-auth.forwardauth.address=https://authserver.com/auth"
+- "traefik.http.middlewares.test-auth.forwardauth.authResponseHeaders=X-Auth-User, X-Secret"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.ca=path/to/local.crt"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.caOptional=true"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.cert=path/to/foo.cert"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.insecureSkipVerify=true"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.key=path/to/foo.key"
+- "traefik.http.middlewares.test-auth.forwardauth.trustForwardHeader=true"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-auth.forwardauth]
-        address = "https://authserver.com/auth"
-        trustForwardHeader = true
-        authResponseHeaders = ["X-Auth-User", "X-Secret"]
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-auth
+spec:
+  forwardAuth:
+    address: https://authserver.com/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+    - X-Auth-User
+    - X-Secret
+    tls:
+      ca: path/to/local.crt
+      caOptional: true
+      cert: path/to/foo.cert
+      key: path/to/foo.key  
+```
 
-        [http.middlewares.test-auth.forwardauth.tls]
-          ca = "path/to/local.crt"
-          caOptional = true
-          cert = "path/to/foo.cert"
-          key = "path/to/foo.key"      
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-auth.forwardauth.address": "https://authserver.com/auth",
+  "traefik.http.middlewares.test-auth.forwardauth.authResponseHeaders": "X-Auth-User,X-Secret",
+  "traefik.http.middlewares.test-auth.forwardauth.tls.ca": "path/to/local.crt",
+  "traefik.http.middlewares.test-auth.forwardauth.tls.caOptional": "true",
+  "traefik.http.middlewares.test-auth.forwardauth.tls.cert": "path/to/foo.cert",
+  "traefik.http.middlewares.test-auth.forwardauth.tls.insecureSkipVerify": "true",
+  "traefik.http.middlewares.test-auth.forwardauth.tls.key": "path/to/foo.key",
+  "traefik.http.middlewares.test-auth.forwardauth.trustForwardHeader": "true"
+}
+```
 
-??? example "Docker -- Forward authentication to authserver.com"
+```yaml tab="Rancher"
+# Forward authentication to authserver.com
+labels:
+- "traefik.http.middlewares.test-auth.forwardauth.address=https://authserver.com/auth"
+- "traefik.http.middlewares.test-auth.forwardauth.authResponseHeaders=X-Auth-User, X-Secret"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.ca=path/to/local.crt"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.caOptional=true"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.cert=path/to/foo.cert"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.InisecureSkipVerify=true"
+- "traefik.http.middlewares.test-auth.forwardauth.tls.key=path/to/foo.key"
+- "traefik.http.middlewares.test-auth.forwardauth.trustForwardHeader=true"
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-auth.ForwardAuth.Address=https://authserver.com/auth"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.AuthResponseHeaders=X-Auth-User, X-Secret"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CA=path/to/local.crt"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.CAOptional=true"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Cert=path/to/foo.cert"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.InsecureSkipVerify=true"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TLS.Key=path/to/foo.key"
-              - "traefik.http.middlewares.test-auth.ForwardAuth.TrustForwardHeader=true"
-              		
-    ```
+```toml tab="File"
+# Forward authentication to authserver.com
+[http.middlewares]
+  [http.middlewares.test-auth.forwardAuth]
+    address = "https://authserver.com/auth"
+    trustForwardHeader = true
+    authResponseHeaders = ["X-Auth-User", "X-Secret"]
+
+    [http.middlewares.test-auth.forwardAuth.tls]
+      ca = "path/to/local.crt"
+      caOptional = true
+      cert = "path/to/foo.cert"
+      key = "path/to/foo.key"
+```
 
 ## Configuration Options
 
-### address
+### `address`
 
 The `address` option defines the authentication server address.
 
-### trustForwardHeader
+### `trustForwardHeader`
 
-Set the `trustForwardHeader` option to true to trust all the existing X-Forwarded-* headers.
+Set the `trustForwardHeader` option to `true` to trust all the existing `X-Forwarded-*` headers.
 
-### authResponseHeaders
+### `authResponseHeaders`
 
 The `authResponseHeaders` option is the list of the headers to copy from the authentication server to the request.
 
-### tls
+### `tls`
 
-The `tls` option is the tls configuration from Traefik to the authentication server.
+The `tls` option is the TLS configuration from Traefik to the authentication server.

docs/content/middlewares/headers.md

@@ -13,76 +13,186 @@ The Headers middleware can manage the requests/responses headers.
 
 Add the `X-Script-Name` header to the proxied request and the `X-Custom-Response-Header` to the response
 
-??? example "File"
+```yaml tab="Docker"
+labels:
+- "traefik.http.middlewares.testHeader.headers.customrequestheaders.X-Script-Name=test"
+- "traefik.http.middlewares.testHeader.headers.customresponseheaders.X-Custom-Response-Header=True"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        [http.middlewares.testHeader.headers.CustomRequestHeaders]
-            X-Script-Name = "test"
-        [http.middlewares.testHeader.headers.CustomResponseHeaders]
-            X-Custom-Response-Header = "True"
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    customRequestHeaders:
+      X-Script-Name: "test"
+    customResponseHeaders:
+      X-Custom-Response-Header: "True"
+```
 
-??? example "Docker"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name": "test",
+  "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header": "True"
+}
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test",
-              - "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True",
-    ```
+```yaml tab="Rancher"
+labels:
+- "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
+- "traefik.http.middlewares.testheader.headers.customresponseheaders.X-Custom-Response-Header=True"
+```
+
+```toml tab="File"
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    [http.middlewares.testHeader.headers.customRequestHeaders]
+        X-Script-Name = "test"
+    [http.middlewares.testHeader.headers.customResponseHeaders]
+        X-Custom-Response-Header = "True"
+```
 
 ### Adding and Removing Headers
 
-`X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` header removed from the request, and the `X-Custom-Response-Header` header removed from the response.
+`X-Script-Name` header added to the proxied request, the `X-Custom-Request-Header` header removed from the request,
+and the `X-Custom-Response-Header` header removed from the response.
 
-??? example "File"
+Please note that is not possible to remove headers through the use of labels (Docker, Rancher, Marathon, ...) for now.
 
-    ```toml    
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        [http.middlewares.testHeader.headers.CustomRequestHeaders]
-            X-Script-Name = "test"
-        [http.middlewares.testHeader.headers.CustomResponseHeaders]
-            X-Custom-Response-Header = "True"
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    customRequestHeaders:
+      X-Script-Name: "test" # Adds
+      X-Custom-Request-Header: "" # Removes
+    customResponseHeaders:
+      X-Custom-Response-Header: "" # Removes
+```
 
-??? example "Docker"
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name=test"
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.CustomRequestHeaders.X-Script-Name=test",
-              - "traefik.http.middlewares.testHeader.Headers.CustomResponseHeaders.X-Custom-Response-Header=True",
-    ```
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testheader.headers.customrequestheaders.X-Script-Name": "test",
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    [http.middlewares.testHeader.headers.customRequestHeaders]
+        X-Script-Name = "test" # Adds
+        X-Custom-Request-Header = "" # Removes
+    [http.middlewares.testHeader.headers.customResponseHeaders]
+        X-Custom-Response-Header = "" # Removes
+```
 
 ### Using Security Headers
 
 Security related headers (HSTS headers, SSL redirection, Browser XSS filter, etc) can be added and configured per frontend in a similar manner to the custom headers above.
 This functionality allows for some easy security features to quickly be set.
 
-??? example "File"
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.testHeader.headers.framedeny=true"
+  - "traefik.http.middlewares.testHeader.headers.sslredirect=true"
+```
 
-    ```toml    
-    [http.middlewares]
-      [http.middlewares.testHeader.headers]
-        FrameDeny = true
-        SSLRedirect = true
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    frameDeny: "true"
+    sslRedirect: "true"
+```
 
-??? example "Docker"
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testheader.headers.framedeny=true"
+  - "traefik.http.middlewares.testheader.headers.sslredirect=true"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testheader.headers.framedeny": "true",
+  "traefik.http.middlewares.testheader.headers.sslredirect": "true"
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    FrameDeny = true
+    SSLRedirect = true
+```
+
+### CORS Headers
+
+CORS (Cross-Origin Resource Sharing) headers can be added and configured per frontend in a similar manner to the custom headers above.
+This functionality allows for more advanced security features to quickly be set.
+
+```yaml tab="Docker"
+labels:
+  - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
+  - "traefik.http.middlewares.testheader.headers.accesscontrolalloworigin=origin-list-or-null"
+  - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
+  - "traefik.http.middlewares.testheader.headers.addvaryheader=true"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: testHeader
+spec:
+  headers:
+    accessControlAllowMethods:
+      - "GET"
+      - "OPTIONS"
+      - "PUT"
+    accessControlAllowOrigin: "origin-list-or-null"
+    accessControlMaxAge: 100
+    addVaryHeader: "true"
+```
+
+```yaml tab="Rancher"
+labels:
+  - "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
+  - "traefik.http.middlewares.testheader.headers.accesscontrolalloworigin=origin-list-or-null"
+  - "traefik.http.middlewares.testheader.headers.accesscontrolmaxage=100"
+  - "traefik.http.middlewares.testheader.headers.addvaryheader=true"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.testheader.headers.accesscontrolallowmethods": "GET,OPTIONS,PUT",
+  "traefik.http.middlewares.testheader.headers.accesscontrolalloworigin": "origin-list-or-null",
+  "traefik.http.middlewares.testheader.headers.accesscontrolmaxage": "100",
+  "traefik.http.middlewares.testheader.headers.addvaryheader": "true"
+}
+```
+
+```toml tab="File"    
+[http.middlewares]
+  [http.middlewares.testHeader.headers]
+    accessControlAllowMethods= ["GET", "OPTIONS", "PUT"]
+    accessControlAllowOrigin = "origin-list-or-null"
+    accessControlMaxAge = 100
+    addVaryHeader = true
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.testHeader.Headers.FrameDeny=true",
-              - "traefik.http.middlewares.testHeader.Headers.SSLRedirect=true",
-    ```
-       
 ## Configuration Options
 
 ### General
@@ -93,87 +203,130 @@ This functionality allows for some easy security features to quickly be set.
 !!! note
     The detailed documentation for the security headers can be found in [unrolled/secure](https://github.com/unrolled/secure#available-options).
 
-### customRequestHeaders
+### `customRequestHeaders`
 
 The `customRequestHeaders` option lists the Header names and values to apply to the request.
 
-### allowedHosts 
+### `customResponseHeaders`
+
+The `customResponseHeaders` option lists the Header names and values to apply to the response.
+
+### `accessControlAllowCredentials`
+
+The `accessControlAllowCredentials` indicates whether the request can include user credentials.
+
+### `accessControlAllowHeaders`
+
+The `accessControlAllowHeaders` indicates which header field names can be used as part of the request.
+
+### `accessControlAllowMethods`
+
+The  `accessControlAllowMethods` indicates which methods can be used during requests.
+
+### `accessControlAllowOrigin`
+
+The `accessControlAllowOrigin` indicates whether a resource can be shared by returning different values.
+The three options for this value are:
+
+- `origin-list-or-null`
+- `*`
+- `null`
+
+### `accessControlExposeHeaders`
+
+The `accessControlExposeHeaders` indicates which headers are safe to expose to the api of a CORS API specification.
+
+### `accessControlMaxAge`
+
+The `accessControlMaxAge` indicates how long a preflight request can be cached.
+
+### `addVaryHeader`
+
+The `addVaryHeader` is used in conjunction with `accessControlAllowOrigin` to determine whether the vary header should be added or modified to demonstrate that server responses can differ beased on the value of the origin header.
+
+### `allowedHosts` 
 
 The `allowedHosts` option lists fully qualified domain names that are allowed.
 
-### hostsProxyHeaders 
+### `hostsProxyHeaders` 
 
 The `hostsProxyHeaders` option is a set of header keys that may hold a proxied hostname value for the request.
 
-### sslRedirect 
+### `sslRedirect` 
 
 The `sslRedirect` is set to true, then only allow https requests.
 
-### sslTemporaryRedirect
+### `sslTemporaryRedirect`
                     
 Set the `sslTemporaryRedirect` to `true` to force an SSL redirection using a 302 (instead of a 301).
 
-### sslHost 
+### `sslHost` 
 
-The `SSLHost` option is the host name that is used to redirect http requests to https.
+The `sslHost` option is the host name that is used to redirect http requests to https.
 
-### sslProxyHeaders 
+### `sslProxyHeaders` 
 
-The `sslProxyHeaders` option is set of header keys with associated values that would indicate a valid https request. Useful when using other proxies with header like: `"X-Forwarded-Proto": "https"`.
+The `sslProxyHeaders` option is set of header keys with associated values that would indicate a valid https request.
+Useful when using other proxies with header like: `"X-Forwarded-Proto": "https"`.
 
-### sslForceHost 
+### `sslForceHost` 
 
 Set `sslForceHost` to true and set SSLHost to forced requests to use `SSLHost` even the ones that are already using SSL.
 
-### stsSeconds 
+### `stsSeconds` 
 
-The `stsSeconds` is the max-age of the Strict-Transport-Security header. If set to 0, would NOT include the header.
+The `stsSeconds` is the max-age of the Strict-Transport-Security header.
+If set to 0, would NOT include the header.
 
-### stsIncludeSubdomains 
+### `stsIncludeSubdomains` 
 
 The `stsIncludeSubdomains` is set to true, the `includeSubdomains` will be appended to the Strict-Transport-Security header.
 
-### stsPreload 
+### `stsPreload` 
 
-Set `STSPreload` to true to have the `preload` flag appended to the Strict-Transport-Security header.
+Set `stsPreload` to true to have the `preload` flag appended to the Strict-Transport-Security header.
 
-### forceSTSHeader
+### `forceSTSHeader`
 
-Set `ForceSTSHeader` to true, to add the STS header even when the connection is HTTP.
+Set `forceSTSHeader` to true, to add the STS header even when the connection is HTTP.
 
-### frameDeny 
+### `frameDeny` 
 
 Set `frameDeny` to true to add the `X-Frame-Options` header with the value of `DENY`.
  
-### customFrameOptionsValue 
+### `customFrameOptionsValue` 
 
-The `customFrameOptionsValue` allows the `X-Frame-Options` header value to be set with a custom value. This overrides the FrameDeny option.
+The `customFrameOptionsValue` allows the `X-Frame-Options` header value to be set with a custom value.
+This overrides the FrameDeny option.
 
-### contentTypeNosniff
+### `contentTypeNosniff`
 
 Set `contentTypeNosniff` to true to add the `X-Content-Type-Options` header with the value `nosniff`.
 
-### browserXssFilter
+### `browserXssFilter`
 
-Set `BrowserXssFilter` to true to add the `X-XSS-Protection` header with the value `1; mode=block`.
+Set `browserXssFilter` to true to add the `X-XSS-Protection` header with the value `1; mode=block`.
 
-### customBrowserXSSValue
+### `customBrowserXSSValue`
 
-The `customBrowserXssValue` option allows the `X-XSS-Protection` header value to be set with a custom value. This overrides the BrowserXssFilter option.
+The `customBrowserXssValue` option allows the `X-XSS-Protection` header value to be set with a custom value.
+This overrides the BrowserXssFilter option.
 
-### contentSecurityPolicy
+### `contentSecurityPolicy`
 
 The `contentSecurityPolicy` option allows the `Content-Security-Policy` header value to be set with a custom value.
 
-### publicKey
+### `publicKey`
 
 The `publicKey` implements HPKP to prevent MITM attacks with forged certificates. 
 
-### referrerPolicy
+### `referrerPolicy`
 
 The `referrerPolicy` allows sites to control when browsers will pass the Referer header to other sites.
 
-### isDevelopment
+### `isDevelopment`
 
-Set `isDevelopment` to true when developing. The AllowedHosts, SSL, and STS options can cause some unwanted effects. Usually testing happens on http, not https, and on localhost, not your production domain.  
+Set `isDevelopment` to true when developing.
+The AllowedHosts, SSL, and STS options can cause some unwanted effects.
+Usually testing happens on http, not https, and on localhost, not your production domain.  
 If you would like your development environment to mimic production with complete Host blocking, SSL redirects, and STS headers, leave this as false.

docs/content/middlewares/ipwhitelist.md

@@ -9,38 +9,58 @@ IPWhitelist accepts / refuses requests based on the client IP.
 
 ## Configuration Examples
 
-??? example "File -- Accepts request from defined IP"
+```yaml tab="Docker"
+# Accepts request from defined IP
+labels:
+- "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-ipwhitelist.ipWhiteList]
-        sourceRange = ["127.0.0.1/32", "192.168.1.7"]
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ipwhitelist
+spec:
+  ipWhiteList:
+    sourceRange:
+    - 127.0.0.1/32
+    - 192.168.1.7
+```
 
-??? example "Docker -- Accepts request from defined IP"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.sourcerange": "127.0.0.1/32,192.168.1.7"
+}
+```
 
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.Middleware9.IPWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
-    ```
+```yaml tab="Rancher"
+# Accepts request from defined IP
+labels:
+- "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+```
+
+```toml tab="File"
+# Accepts request from defined IP
+[http.middlewares]
+  [http.middlewares.test-ipwhitelist.ipWhiteList]
+    sourceRange = ["127.0.0.1/32", "192.168.1.7"]
+```
 
 ## Configuration Options
 
-### sourceRange
+### `sourceRange`
 
 The `sourceRange` option sets the allowed IPs (or ranges of allowed IPs).
 
-### ipStrategy
+### `ipStrategy`
 
 The `ipStrategy` option defines two parameters that sets how Traefik will determine the client IP: `depth`, and `excludedIPs`.
 
-#### ipStrategy.depth 
+#### `ipStrategy.depth`
 
 The `depth` option tells Traefik to use the `X-Forwarded-For` header and take the IP located at the `depth` position (starting from the right).
 
-!!! note "Examples of Depth & X-Forwaded-For"
+!!! note "Examples of Depth & X-Forwarded-For"
 
     If `depth` was equal to 2, and the request `X-Forwarded-For` header was `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` then the "real" client IP would be `"10.0.0.1"` (at depth 4) but the IP used for the whitelisting would be `"12.0.0.1"` (`depth=2`).
     
@@ -51,25 +71,50 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
         | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `1`     | `"13.0.0.1"` |
         | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `3`     | `"11.0.0.1"` |
         | `"10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1"` | `5`     | `""`         |
-
-??? example "File -- Whitelisting Based on `X-Forwarded-For` with `depth=2`"
-
-    ```toml
+    
+    ```yaml tab="Docker"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    labels:
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
+    ```
+    
+    ```yaml tab="Kubernetes"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: Middleware
+    metadata:
+      name: testIPwhitelist
+    spec:
+      ipWhiteList:
+        sourceRange:
+        - 127.0.0.1/32
+        - 192.168.1.7
+        ipStrategy:
+          depth: 2
+    ```
+    
+    ```yaml tab="Rancher"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
+    labels:
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.1.7"
+        - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
+    ```
+    
+    ```json tab="Marathon"
+    "labels": {
+        "traefik.http.middlewares.testIPwhitelist.ipwhitelist.sourcerange": "127.0.0.1/32, 192.168.1.7",
+        "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth": "2"
+    }
+    ```
+    
+    ```toml tab="File"
+    # Whitelisting Based on `X-Forwarded-For` with `depth=2`
     [http.middlewares]
       [http.middlewares.test-ipwhitelist.ipWhiteList]
         sourceRange = ["127.0.0.1/32", "192.168.1.7"]
         [http.middlewares.test-ipwhitelist.ipWhiteList.ipStrategy]
-            depth = 2
-    ```
-
-??? example "Docker -- Whitelisting Based on `X-Forwarded-For` with `depth=2`"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.testIPwhitelist.ipWhiteList.SourceRange=127.0.0.1/32, 192.168.1.7"
-                - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.depth=2"
+          depth = 2
     ```
 
 !!! note
@@ -77,11 +122,11 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
     - If `depth` is greater than the total number of IPs in `X-Forwarded-For`, then the client IP will be empty.
     - `depth` is ignored if its value is is lesser than or equal to 0.
 
-#### ipStrategy.excludedIPs
+#### `ipStrategy.excludedIPs`
 
 `excludedIPs` tells Traefik to scan the `X-Forwarded-For` header and pick the first IP not in the list.
 
-!!! note "Examples of ExcludedIPs & X-Forwaded-For"
+!!! note "Examples of ExcludedIPs & X-Forwarded-For"
 
     | `X-Forwarded-For`                       | `excludedIPs`         | clientIP     |
     |-----------------------------------------|-----------------------|--------------|
@@ -94,20 +139,42 @@ The `depth` option tells Traefik to use the `X-Forwarded-For` header and take th
 !!! important
     If `depth` is specified, `excludedIPs` is ignored.
 
-??? example "File -- Exclude from `X-Forwarded-For`"
+```yaml tab="Docker"
+# Exclude from `X-Forwarded-For`
+labels:
+    - "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedips=127.0.0.1/32, 192.168.1.7"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-ipwhitelist.ipWhiteList]
-        [http.middlewares.test-ipwhitelist.ipWhiteList.ipStrategy]
-          excludedIPs = ["127.0.0.1/32", "192.168.1.7"]
-    ```
+```yaml tab="Kubernetes"
+# Exclude from `X-Forwarded-For`
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ipwhitelist
+spec:
+  ipWhiteList:
+    ipStrategy:
+      excludedIPs:
+      - 127.0.0.1/32
+      - 192.168.1.7
+```
 
-??? example "Docker -- Exclude from `X-Forwarded-For`"
+```yaml tab="Rancher"
+# Exclude from `X-Forwarded-For`
+labels:
+    - "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedips=127.0.0.1/32, 192.168.1.7"
+```
 
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.testIPwhitelist.ipwhitelist.ipstrategy.excludedIPs=127.0.0.1/32, 192.168.1.7"
-    ```
+```json tab="Marathon"
+"labels": {
+    "traefik.http.middlewares.test-ipwhitelist.ipwhitelist.ipstrategy.excludedips": "127.0.0.1/32, 192.168.1.7"
+}
+```
+
+```toml tab="File"
+# Exclude from `X-Forwarded-For`
+[http.middlewares]
+  [http.middlewares.test-ipwhitelist.ipWhiteList]
+    [http.middlewares.test-ipwhitelist.ipWhiteList.ipStrategy]
+      excludedIPs = ["127.0.0.1/32", "192.168.1.7"]
+```

docs/content/middlewares/maxconnection.md

@@ -9,26 +9,44 @@ To proactively prevent services from being overwhelmed with high load, a maximum
 
 ## Configuration Examples
 
-??? example "File -- Limiting to 10 simultaneous connections"
+```yaml tab="Docker"
+# Limiting to 10 simultaneous connections
+labels:
+- "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-maxconn.maxconn]
-      amount = 10 
-    ```
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-maxconn
+spec:
+  maxConn:
+    amount: 10
+```
 
-??? example "Docker -- Limiting to 10 simultaneous connections"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-maxconn.maxconn.amount": "10"
+}
+```
 
-    ```yml
-    a-container:
-          image: a-container-image 
-            labels:
-              - "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
-    ```
+```yaml tab="Rancher"
+# Limiting to 10 simultaneous connections
+labels:
+- "traefik.http.middlewares.test-maxconn.maxconn.amount=10"
+```
+
+```toml tab="File"
+# Limiting to 10 simultaneous connections
+[http.middlewares]
+  [http.middlewares.test-maxconn.maxConn]
+    amount = 10 
+```
 
 ## Configuration Options
 
-### amount
+### `amount`
 
 The `amount` option defines the maximum amount of allowed simultaneous connections.
 The middleware will return an `HTTP 429 Too Many Requests` if there are already `amount` requests in progress (based on the same `extractorfunc` strategy).

docs/content/middlewares/overview.md

@@ -13,109 +13,154 @@ Pieces of middleware can be combined in chains to fit every scenario.
 
 ## Configuration Example
 
-??? example "As Toml Configuration File"
+```yaml tab="Docker"
+# As a Docker Label
+whoami:
+  #  A container that exposes an API to show its IP address
+  image: containous/whoami
+  labels:
+    # Create a middleware named `foo-add-prefix`
+    - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+    # Apply the middleware named `foo-add-prefix` to the router named `router1`
+    - "traefik.http.routers.router1.middlewares=foo-add-prefix@docker"
+```
 
-    ```toml
-    [providers]
-       [providers.file]
-
-    [http.routers]
-      [http.routers.router1]
-        Service = "myService"
-        Middlewares = ["foo-add-prefix"]
-        Rule = "Host: example.com"
-
-    [http.middlewares]
-     [http.middlewares.foo-add-prefix.AddPrefix]
-        prefix = "/foo"
-
-    [http.services]
-     [http.services.service1]
-       [http.services.service1.LoadBalancer]
-
-         [[http.services.service1.LoadBalancer.Servers]]
-           URL = "http://127.0.0.1:80"
-           Weight = 1
-    ```
-
-??? example "As a Docker Label"
-
-    ```yaml
-    # A container that exposes a simple API
-    whoami:
-      image: containous/whoami  # A container that exposes an API to show its IP address
-        labels:
-          - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo",
-    ```
-
-??? example "As a Kubernetes Traefik IngressRoute"
-
-    ```yaml
-    apiVersion: apiextensions.k8s.io/v1beta1
-    kind: CustomResourceDefinition
-    metadata:
-      name: middlewares.traefik.containo.us
-    spec:
-      group: traefik.containo.us
-      version: v1alpha1
-      names:
-        kind: Middleware
-        plural: middlewares
-        singular: middleware
-      scope: Namespaced
-
-    ---
-    apiVersion: traefik.containo.us/v1alpha1
+```yaml tab="Kubernetes"
+# As a Kubernetes Traefik IngressRoute
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: middlewares.traefik.containo.us
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
     kind: Middleware
-    metadata:
-      name: stripprefix
-    spec:
-      stripprefix:
-        prefixes:
-          - /stripit
+    plural: middlewares
+    singular: middleware
+  scope: Namespaced
 
-    ---
-    apiVersion: traefik.containo.us/v1alpha1
-    kind: IngressRoute
-    metadata:
-      name: ingressroute.crd
-    spec:
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: stripprefix
+spec:
+  stripPrefix:
+    prefixes:
+      - /stripit
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroute
+spec:
+# more fields...
+  routes:
     # more fields...
-      routes:
-        # more fields...
-        middleware:
-        - name: stripprefix
-    ```
+    middlewares:
+    - name: stripprefix
+```
 
-## Advanced Configuration
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.foo-add-prefix.addprefix.prefix": "/foo",
+  "traefik.http.router.router1.middlewares": "foo-add-prefix@marathon"
+}
+```
 
-When you declare a middleware, it lives in its `provider` namespace.
-For example, if you declare a middleware using a Docker label, under the hoods, it will reside in the docker `provider` namespace.
+```yaml tab="Rancher"
+# As a Rancher Label
+labels:
+  # Create a middleware named `foo-add-prefix`
+  - "traefik.http.middlewares.foo-add-prefix.addprefix.prefix=/foo"
+  # Apply the middleware named `foo-add-prefix` to the router named `router1`
+  - "traefik.http.router.router1.middlewares=foo-add-prefix@rancher"
+```
 
-If you use multiple `providers` and wish to reference a middleware declared in another `provider`, then you'll have to prefix the middleware name with the `provider` name.
+```toml tab="File"
+# As Toml Configuration File
+[http.routers]
+  [http.routers.router1]
+    service = "myService"
+    middlewares = ["foo-add-prefix"]
+    rule = "Host(`example.com`)"
 
-??? abstract "Referencing a Middleware from Another Provider"
+[http.middlewares]
+  [http.middlewares.foo-add-prefix.addPrefix]
+    prefix = "/foo"
+
+[http.services]
+  [http.services.service1]
+    [http.services.service1.loadBalancer]
+
+      [[http.services.service1.loadBalancer.servers]]
+        url = "http://127.0.0.1:80"
+```
+
+## Provider Namespace
+
+When you declare a middleware, it lives in its provider namespace.
+For example, if you declare a middleware using a Docker label, under the hoods, it will reside in the docker provider namespace.
+
+If you use multiple providers and wish to reference a middleware declared in another provider
+(aka referencing a cross-provider middleware),
+then you'll have to append to the middleware name, the `@` separator, followed by the provider name.
+
+```text
+<resource-name>@<provider-name>
+```
+
+!!! important "Kubernetes Namespace"
+
+	As Kubernetes also has its own notion of namespace, one should not confuse the "provider namespace"
+with the "kubernetes namespace" of a resource when in the context of a cross-provider usage.
+In this case, since the definition of the middleware is not in kubernetes,
+specifying a "kubernetes namespace" when referring to the resource does not make any sense,
+and therefore this specification would be ignored even if present.
+
+!!! abstract "Referencing a Middleware from Another Provider"
 
     Declaring the add-foo-prefix in the file provider.
 
     ```toml
-    [providers]
-       [providers.file]
-
     [http.middlewares]
-     [http.middlewares.add-foo-prefix.AddPrefix]
+      [http.middlewares.add-foo-prefix.addPrefix]
         prefix = "/foo"
     ```
 
-    Using the add-foo-prefix middleware from docker.
+    Using the add-foo-prefix middleware from other providers:
 
-    ```yaml
+    ```yaml tab="Docker"
     your-container: #
-        image: your-docker-image
+      image: your-docker-image
 
-        labels:
-          # Attach file.add-foo-prefix middleware (declared in file)
-          - "traefik.http.routers.middlewares=file.add-foo-prefix",
+      labels:
+        # Attach add-foo-prefix@file middleware (declared in file)
+        - "traefik.http.routers.my-container.middlewares=add-foo-prefix@file"
+    ```
+
+    ```yaml tab="Kubernetes"
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: IngressRoute
+    metadata:
+      name: ingressroutestripprefix
+
+    spec:
+      entryPoints:
+        - web
+      routes:
+        - match: Host(`bar.com`)
+          kind: Rule
+        services:
+          - name: whoami
+            port: 80
+        middlewares:
+          - name: add-foo-prefix@file
+          # namespace: bar
+          # A namespace specification such as above is ignored
+          # when the cross-provider syntax is used.
     ```
 
 ## Available Middlewares
@@ -127,14 +172,14 @@ If you use multiple `providers` and wish to reference a middleware declared in a
 | [Buffering](buffering.md)                 | Buffers the request/response                      | Request Lifecycle           |
 | [Chain](chain.md)                         | Combine multiple pieces of middleware             | Middleware tool             |
 | [CircuitBreaker](circuitbreaker.md)       | Stop calling unhealthy services                   | Request Lifecycle           |
-| [Compress](circuitbreaker.md)             | Compress the response                             | Content Modifier            |
+| [Compress](compress.md)                   | Compress the response                             | Content Modifier            |
 | [DigestAuth](digestauth.md)               | Adds Digest Authentication                        | Security, Authentication    |
 | [Errors](errorpages.md)                   | Define custom error pages                         | Request Lifecycle           |
 | [ForwardAuth](forwardauth.md)             | Authentication delegation                         | Security, Authentication    |
 | [Headers](headers.md)                     | Add / Update headers                              | Security                    |
 | [IPWhiteList](ipwhitelist.md)             | Limit the allowed client IPs                      | Security, Request lifecycle |
 | [MaxConnection](maxconnection.md)         | Limit the number of simultaneous connections      | Security, Request lifecycle |
-| [PassTLSClientCert](passtlsclientcert.md) | TODO                                              | Security                    |
+| [PassTLSClientCert](passtlsclientcert.md) | Adding Client Certificates in a Header            | Security                    |
 | [RateLimit](ratelimit.md)                 | Limit the call frequency                          | Security, Request lifecycle |
 | [RedirectScheme](redirectscheme.md)       | Redirect easily the client elsewhere              | Request lifecycle           |
 | [RedirectRegex](redirectregex.md)         | Redirect the client elsewhere                     | Request lifecycle           |

docs/content/middlewares/passtlsclientcert.md

@@ -1,4 +1,4 @@
-# TODO - PassTLSClientCert
+# PassTLSClientCert
 
 Adding Client Certificates in a Header
 {: .subtitle }
@@ -9,33 +9,150 @@ PassTLSClientCert adds in header the selected data from the passed client tls ce
 
 ## Configuration Examples
 
-??? example "File -- Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
+Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+
+```yaml tab="Docker"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+labels:
+- "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem=true"
+```
+
+```yaml tab="Kubernetes"
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: addprefix
+spec:
+  passTLSClientCert:
+    pem: true
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem": "true"
+}
+```
+
+```yaml tab="Rancher"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+labels:
+- "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.pem=true"
+```
+
+```toml tab="File"
+# Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header.
+[http.middlewares]
+  [http.middlewares.test-passtlsclientcert.passTLSClientCert]
+    pem = true
+```
+
+??? example "Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
+
+    ```yaml tab="Docker"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    labels:
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
+    ```
     
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-passtlsclientcert.passtlsclientcert]
-        pem = true
+    ```yaml tab="Kubernetes"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    apiVersion: traefik.containo.us/v1alpha1
+    kind: Middleware
+    metadata:
+      name: test-passtlsclientcert
+    spec:
+      passTLSClientCert:
+        info:
+          notAfter: true
+          notBefore: true
+          sans: true
+          subject:
+            country: true
+            province: true
+            locality: true
+            organization: true
+            commonName: true
+            serialNumber: true
+            domainComponent: true
+          issuer:
+            country: true
+            province: true
+            locality: true
+            organization: true
+            commonName: true
+            serialNumber: true
+            domainComponent: true
+    ```
+    
+    ```yaml tab="Rancher"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
+    labels:
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
+    - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
+    ```
+        
+    ```json tab="Marathon"
+    "labels": {
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province": "true",
+      "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber": "true"
+    }
     ```
 
-??? example "Docker -- Pass the escaped pem in the `X-Forwarded-Tls-Client-Cert` header"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.Middleware11.passtlsclientcert.pem=true"
-    ```
-
-??? example "File -- Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header"
-
-    ```toml
+    ```toml tab="File"
+    # Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header
     [http.middlewares]
-      [http.middlewares.test-passtlsclientcert.passtlsclientcert]
-        [http.middlewares.test-passtlsclientcert.passtlsclientcert.info]
+      [http.middlewares.test-passtlsclientcert.passTLSClientCert]
+        [http.middlewares.test-passtlsclientcert.passTLSClientCert.info]
           notAfter = true
           notBefore = true
           sans = true
-          [http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject]
+          [http.middlewares.test-passtlsclientcert.passTLSClientCert.info.subject]
             country = true
             province = true
             locality = true
@@ -43,7 +160,7 @@ PassTLSClientCert adds in header the selected data from the passed client tls ce
             commonName = true
             serialNumber = true
             domainComponent = true
-          [http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer]
+          [http.middlewares.test-passtlsclientcert.passTLSClientCert.info.issuer]
             country = true
             province = true
             locality = true
@@ -53,39 +170,14 @@ PassTLSClientCert adds in header the selected data from the passed client tls ce
             domainComponent = true
     ```
 
-??? example "Docker -- Pass all the available info in the `X-Forwarded-Tls-Client-Cert-Info` header"
-
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notafter=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.notbefore=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.sans=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.commonname=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.country=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.domaincomponent=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.locality=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.organization=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.province=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.subject.serialnumber=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.commonname=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.country=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.domaincomponent=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.locality=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.organization=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.province=true"
-                - "traefik.http.middlewares.test-passtlsclientcert.passtlsclientcert.info.issuer.serialnumber=true"
-    ```
-
 ## Configuration Options
 
 ### General
 
 PassTLSClientCert can add two headers to the request: 
 
-* `X-Forwarded-Tls-Client-Cert` that contains the escaped pem.
-* `X-Forwarded-Tls-Client-Cert-Info` that contains all the selected certificate information in an escaped string.
+- `X-Forwarded-Tls-Client-Cert` that contains the escaped pem.
+- `X-Forwarded-Tls-Client-Cert-Info` that contains all the selected certificate information in an escaped string.
 
 !!! note
     The headers are filled with escaped string so it can be safely placed inside a URL query.
@@ -196,9 +288,10 @@ In the following example, you can see a complete certificate. We will use each p
     -----END CERTIFICATE-----
     ```
 
-### pem
+### `pem`
 
 The `pem` option sets the `X-Forwarded-Tls-Client-Cert` header with the escape certificate.
+
 In the example, it is the part between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` delimiters :
 
 ??? example "The data used by the pem option"
@@ -247,10 +340,16 @@ In the example, it is the part between `-----BEGIN CERTIFICATE-----` and `-----E
     The delimiters and `\n` will be removed.  
     If there are more than one certificate, they are separated by a "`;`".
 
-### info
+!!! note "`X-Forwarded-Tls-Client-Cert` value could exceed the web server header size limit"
+
+    The header size limit of web servers is commonly between 4kb and 8kb.  
+    You could change the server configuration to allow bigger header or use the `info` option with the needed field(s).
+
+### `info`
 
 The `info` option select the specific client certificate details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
 The value of the header will be an escaped concatenation of all the selected certificate details.
+
 The following example shows an unescaped result that uses all the available fields: 
 
 ```text
@@ -261,9 +360,10 @@ Subject="DC=org,DC=cheese,C=FR,C=US,ST=Cheese org state,ST=Cheese com state,L=TO
 
     If there are more than one certificate, they are separated by a `;`.
 
-#### info.notafter 
+#### `info.notAfter`
+
+Set the `info.notAfter` option to `true` to add the `Not After` information from the `Validity` part.
 
-Set the `info.notafter` option to `true` to add the `Not After` information from the `Validity` part.
 The data are taken from the following certificate part:      
 
 ```text
@@ -271,15 +371,15 @@ The data are taken from the following certificate part:
         Not After : Dec  5 11:10:16 2020 GMT            
 ```
 
-The escape `notafter` info part will be like:
+The escape `notAfter` info part will be like:
 
 ```text
 NA=1607166616
 ```
 
-#### info.notbefore
+#### `info.notBefore`
 
-Set the `info.notafter` option to `true` to add the `Not Before` information from the `Validity` part.
+Set the `info.notBefore` option to `true` to add the `Not Before` information from the `Validity` part.
 
 The data are taken from the following certificate part:
 
@@ -288,15 +388,16 @@ Validity
     Not Before: Dec  6 11:10:16 2018 GMT
 ```
 
-The escape `notafter` info part will be like:
+The escape `notBefore` info part will be like:
 
 ```text
 NB=1544094616
 ```
 
-#### info.sans
+#### `info.sans`
 
 Set the `info.sans` option to `true` to add the `Subject Alternative Name` information from the `Subject Alternative Name` part.
+
 The data are taken from the following certificate part:
 
 ```text
@@ -314,7 +415,7 @@ SAN=*.cheese.org,*.cheese.net,*.cheese.com,test@cheese.org,test@cheese.net,10.0.
 
     All the SANs data are separated by a `,`.
     
-#### info.subject
+#### `info.subject`
 
 The `info.subject` select the specific client certificate subject details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
 
@@ -324,7 +425,7 @@ The data are taken from the following certificate part :
 Subject: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=*.cheese.org, CN=*.cheese.com, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Cheese org state, ST=Cheese com state/emailAddress=cert@cheese.org/emailAddress=cert@scheese.com
 ```
 
-##### info.subject.country
+##### `info.subject.country`
 
 Set the `info.subject.country` option to true to add the `country` information into the subject.  
 The data are taken from the subject part with the `C` key. 
@@ -334,7 +435,7 @@ The escape country info in the subject part will be like :
 C=FR,C=US
 ```
 
-##### info.subject.province
+##### `info.subject.province`
 
 Set the `info.subject.province` option to true to add the `province` information into the subject.
   
@@ -346,7 +447,7 @@ The escape province info in the subject part will be like :
 ST=Cheese org state,ST=Cheese com state
 ```
 
-##### info.subject.locality
+##### `info.subject.locality`
 
 Set the `info.subject.locality` option to true to add the `locality` information into the subject.
   
@@ -358,7 +459,7 @@ The escape locality info in the subject part will be like :
 L=TOULOUSE,L=LYON
 ```
 
-##### info.subject.organization
+##### `info.subject.organization`
 
 Set the `info.subject.organization` option to true to add the `organization` information into the subject.
   
@@ -370,33 +471,33 @@ The escape organization info in the subject part will be like :
 O=Cheese,O=Cheese 2
 ```
 
-##### info.subject.commonname
+##### `info.subject.commonName`
 
-Set the `info.subject.commonname` option to true to add the `commonname` information into the subject.
+Set the `info.subject.commonName` option to true to add the `commonName` information into the subject.
   
 The data are taken from the subject part with the `CN` key.
 
-The escape commonname info in the subject part will be like :
+The escape common name info in the subject part will be like :
 
 ```text
 CN=*.cheese.com
 ```
 
-##### info.subject.serialnumber
+##### `info.subject.serialNumber`
 
-Set the `info.subject.serialnumber` option to true to add the `serialnumber` information into the subject.
+Set the `info.subject.serialNumber` option to true to add the `serialNumber` information into the subject.
   
 The data are taken from the subject part with the `SN` key.
 
-The escape serialnumber info in the subject part will be like :
+The escape serial number info in the subject part will be like :
 
 ```text
 SN=1234567890
 ```
 
-##### info.subject.domaincomponent
+##### `info.subject.domainComponent`
 
-Set the `info.subject.domaincomponent` option to true to add the `domaincomponent` information into the subject.
+Set the `info.subject.domainComponent` option to true to add the `domainComponent` information into the subject.
   
 The data are taken from the subject part with the `DC` key.
 
@@ -406,7 +507,7 @@ The escape domaincomponent info in the subject part will be like :
 DC=org,DC=cheese
 ```
 
-#### info.issuer
+#### `info.issuer`
 
 The `info.issuer` select the specific client certificate issuer details you want to add to the `X-Forwarded-Tls-Client-Cert-Info` header.
 
@@ -416,7 +517,7 @@ The data are taken from the following certificate part :
 Issuer: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=Simple Signing CA, CN=Simple Signing CA 2, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Signing State, ST=Signing State 2/emailAddress=simple@signing.com/emailAddress=simple2@signing.com
 ```
 
-##### info.issuer.country
+##### `info.issuer.country`
 
 Set the `info.issuer.country` option to true to add the `country` information into the issuer.  
 The data are taken from the issuer part with the `C` key. 
@@ -426,7 +527,7 @@ The escape country info in the issuer part will be like :
 C=FR,C=US
 ```
 
-##### info.issuer.province
+##### `info.issuer.province`
 
 Set the `info.issuer.province` option to true to add the `province` information into the issuer.
   
@@ -438,7 +539,7 @@ The escape province info in the issuer part will be like :
 ST=Signing State,ST=Signing State 2
 ```
 
-##### info.issuer.locality
+##### `info.issuer.locality`
 
 Set the `info.issuer.locality` option to true to add the `locality` information into the issuer.
   
@@ -450,7 +551,7 @@ The escape locality info in the issuer part will be like :
 L=TOULOUSE,L=LYON
 ```
 
-##### info.issuer.organization
+##### `info.issuer.organization`
 
 Set the `info.issuer.organization` option to true to add the `organization` information into the issuer.
   
@@ -462,37 +563,37 @@ The escape organization info in the issuer part will be like :
 O=Cheese,O=Cheese 2
 ```
 
-##### info.issuer.commonname
+##### `info.issuer.commonName`
 
-Set the `info.issuer.commonname` option to true to add the `commonname` information into the issuer.
+Set the `info.issuer.commonName` option to true to add the `commonName` information into the issuer.
   
 The data are taken from the issuer part with the `CN` key.
 
-The escape commonname info in the issuer part will be like :
+The escape common name info in the issuer part will be like :
 
 ```text
 CN=Simple Signing CA 2
 ```
 
-##### info.issuer.serialnumber
+##### `info.issuer.serialNumber`
 
-Set the `info.issuer.serialnumber` option to true to add the `serialnumber` information into the issuer.
+Set the `info.issuer.serialNumber` option to true to add the `serialNumber` information into the issuer.
   
 The data are taken from the issuer part with the `SN` key.
 
-The escape serialnumber info in the issuer part will be like :
+The escape serial number info in the issuer part will be like :
 
 ```text
 SN=1234567890
 ```
 
-##### info.issuer.domaincomponent
+##### `info.issuer.domainComponent`
 
-Set the `info.issuer.domaincomponent` option to true to add the `domaincomponent` information into the issuer.
+Set the `info.issuer.domainComponent` option to true to add the `domainComponent` information into the issuer.
   
 The data are taken from the issuer part with the `DC` key.
 
-The escape domaincomponent info in the issuer part will be like :
+The escape domain component info in the issuer part will be like :
 
 ```text
 DC=org,DC=cheese

docs/content/middlewares/ratelimit.md

@@ -1,4 +1,7 @@
-# TODO -- RateLimit
+# RateLimit
+
+!!! warning
+    This middleware is disable for now.
 
 Protection from Too Many Calls
 {: .subtitle }
@@ -9,42 +12,88 @@ The RateLimit middleware ensures that services will receive a _fair_ number of r
 
 ## Configuration Example
 
-??? example "Limit to 100 requests every 10 seconds (with a possible burst of 200)"
+```yaml tab="Docker"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+labels:
+- "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc=client.ip"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period=10s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average=100"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst=200"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period=3s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average=5"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst=10"
+  		
+```
 
-    ```toml
-    [http.middlewares]
-        [http.middlewares.fair-ratelimit.ratelimit]
-            extractorfunc = "client.ip"
+```yaml tab="Kubernetes"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-ratelimit
+spec:
+  rateLimit:
+    extractorFunc: client.ip
+    rateSet:
+      rate0:
+          period: 10s
+          average: 100
+          burst: 200
+      rate1:
+          period: 3s
+          average: 5
+          burst: 10
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc": "client.ip",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period": "10s",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average": "100",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst": "200",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period": "3s",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average": "5",
+  "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst": "10"
+}
+```
+
+```yaml tab="Rancher"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+labels:
+- "traefik.http.middlewares.test-ratelimit.ratelimit.extractorfunc=client.ip"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.period=10s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.average=100"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate0.burst=200"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.period=3s"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.average=5"
+- "traefik.http.middlewares.test-ratelimit.ratelimit.rateset.rate1.burst=10"
+  		
+```
+
+```toml tab="File"
+# Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.
+# These can "burst" up to 10 and 200 in each period, respectively.
+[http.middlewares]
+  [http.middlewares.test-ratelimit.rateLimit]
+    extractorfunc = "client.ip"
     
-              [http.middlewares.fair-ratelimit.ratelimit.rateset1]
-                period = "10s"
-                average = 100
-                burst = 200
-    ```
-
-??? example "Combine multiple limits"
-
-    ```toml
-    [http.middlewares]
-        [http.middlewares.fair-ratelimit.ratelimit]
-            extractorfunc = "client.ip"
+    [http.middlewares.test-ratelimit.rateLimit.rateSet.rate0]
+      period = "10s"
+      average = 100
+      burst = 200
     
-              [http.middlewares.fair-ratelimit.ratelimit.rateset1]
-                period = "10s"
-                average = 100
-                burst = 200
-
-              [http.middlewares.fair-ratelimit.ratelimit.rateset2]
-                period = "3s"
-                average = 5
-                burst = 10
-    ```
-    
-    Here, an average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds. These can "burst" up to 10 and 200 in each period, respectively. 
+    [http.middlewares.test-ratelimit.rateLimit.rateSet.rate1]
+      period = "3s"
+      average = 5
+      burst = 10
+```
 
 ## Configuration Options
 
-### extractorfunc
+### `extractorfunc`
  
 The `extractorfunc` option defines the strategy used to categorize requests.
 
@@ -54,12 +103,12 @@ The possible values are:
 - `client.ip` categorizes requests based on the client ip.
 - `request.header.ANY_HEADER` categorizes requests based on the provided `ANY_HEADER` value.
 
-### ratelimit (multiple values)
+### `rateSet`
 
-You can combine multiple ratelimit. 
-The ratelimit will trigger with the first reached limit.
+You can combine multiple rate limits. 
+The rate limit will trigger with the first reached limit.
 
-Each ratelimit has 3 options, `period`, `average`, and `burst`.
+Each rate limit has 3 options, `period`, `average`, and `burst`.
 
 The rate limit will allow an average of `average` requests every `period`, with a maximum of `burst` request on that period.
 

docs/content/middlewares/redirectregex.md

@@ -1,4 +1,4 @@
-# TODO - RedirectRegex
+# RedirectRegex
 
 Redirecting the Client to a Different Location
 {: .subtitle }
@@ -9,34 +9,56 @@ RegexRedirect redirect a request from an url to another with regex matching and
 
 ## Configuration Examples
 
-??? example "File -- Redirect with domain replacement"
+```yaml tab="Docker"
+# Redirect with domain replacement
+labels:
+- "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
+- "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-redirectregex.redirectregex]
-        regex = "^http://localhost/(.*)"
-        replacement = "http://mydomain/$1"
-    ```
+```yaml tab="Kubernetes"
+# Redirect with domain replacement
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-redirectregex
+spec:
+  redirectRegex:
+    regex: ^http://localhost/(.*)
+    replacement: http://mydomain/$1
+```
 
-??? example "Docker -- Redirect with domain replacement"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-redirectregex.redirectregex.regex": "^http://localhost/(.*)",
+  "traefik.http.middlewares.test-redirectregex.redirectregex.replacement": "http://mydomain/$1"
+}
+```
 
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
-                - "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
-    ```
+```yaml tab="Rancher"
+# Redirect with domain replacement
+labels:
+- "traefik.http.middlewares.test-redirectregex.redirectregex.regex=^http://localhost/(.*)"
+- "traefik.http.middlewares.test-redirectregex.redirectregex.replacement=http://mydomain/$1"
+```
+
+```toml tab="File"
+# Redirect with domain replacement
+[http.middlewares]
+  [http.middlewares.test-redirectregex.redirectRegex]
+    regex = "^http://localhost/(.*)"
+    replacement = "http://mydomain/$1"
+```
 
 ## Configuration Options
 
-### permanent
+### `permanent`
 
 Set the `permanent` option to `true` to apply a permanent redirection.
 
-### regex
+### `regex`
 
-The `Regex` option is the regular expression to match and capture elements form the request URL.
+The `regex` option is the regular expression to match and capture elements from the request URL.
 
 !!! warning
 
@@ -46,7 +68,7 @@ The `Regex` option is the regular expression to match and capture elements form
 
     Regular expressions and replacements can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
     
-### replacement
+### `replacement`
 
 The `replacement` option defines how to modify the URl to have the new target URL.
  

docs/content/middlewares/redirectscheme.md

@@ -1,4 +1,4 @@
-# TODO - RedirectScheme
+# RedirectScheme
 
 Redirecting the Client to a Different Scheme/Port
 {: .subtitle }
@@ -9,33 +9,52 @@ RegexRedirect redirect request from a scheme to another.
 
 ## Configuration Examples
 
-??? example "File -- Redirect to https"
+```yaml tab="Docker"
+# Redirect to https
+labels:
+- "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-redirectscheme.redirectscheme]
-        scheme = "https"
-    ```
+```yaml tab="Kubernetes"
+# Redirect to https
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-redirectscheme
+spec:
+  redirectScheme:
+    scheme: https
+```
 
-??? example "Docker -- Redirect to https"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme": "https"
+}
+```
 
-    ```yml
-     a-container:
-        image: a-container-image 
-            labels:
-                - "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
-    ```
+```yaml tab="Rancher"
+# Redirect to https
+labels:
+- "traefik.http.middlewares.test-redirectscheme.redirectscheme.scheme=https"
+```
+
+```toml tab="File"
+# Redirect to https
+[http.middlewares]
+  [http.middlewares.test-redirectscheme.redirectScheme]
+    scheme = "https"
+```
 
 ## Configuration Options
 
-### permanent
+### `permanent`
 
 Set the `permanent` option to `true` to apply a permanent redirection.
 
-### scheme
+### `scheme`
 
 The `scheme` option defines the scheme of the new url.
 
-### port
+### `port`
 
 The `port` option defines the port of the new url.

docs/content/middlewares/replacepath.md

@@ -1,4 +1,4 @@
-# TODO -- ReplacePath
+# ReplacePath
 
 Updating the Path Before Forwarding the Request
 {: .subtitle }
@@ -9,32 +9,51 @@ Replace the path of the request url.
 
 ## Configuration Examples
 
-??? example "File -- Replace the path by /foo"
+```yaml tab="Docker"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
+```
 
-    ```toml
-    [http.middlewares]
-      [http.middlewares.test-replacepath.ReplacePath]
-         path = "/foo"
-    ```
+```yaml tab="Kubernetes"
+# Replace the path by /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-replacepath
+spec:
+  replacePath:
+    path: /foo
+```
 
-??? example "Docker --Replace the path by /foo"
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-replacepath.replacepath.path": "/foo"
+}
+```
+
+```yaml tab="Rancher"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
+```
+
+```toml tab="File"
+# Replace the path by /foo
+[http.middlewares]
+  [http.middlewares.test-replacepath.replacePath]
+    path = "/foo"
+```
 
-    ```yaml
-    a-container:
-      image: a-container-image 
-        labels:
-          - "traefik.http.middlewares.test-replacepath.replacepath.path=/foo"
-    ```
-    
 ## Configuration Options
 
 ### General
 
 The ReplacePath middleware will:
 
-* replace the actual path by the specified one.
-* store the original path in a `X-Replaced-Path` header.
+- replace the actual path by the specified one.
+- store the original path in a `X-Replaced-Path` header.
 
-### path
+### `path`
 
 The `path` option defines the path to use as replacement in the request url.

docs/content/middlewares/replacepathregex.md

@@ -1,4 +1,76 @@
-# TODO -- ReplacePathRegex
+# ReplacePathRegex
 
 Updating the Path Before Forwarding the Request (Using a Regex)
-{: .subtitle }
+{: .subtitle }
+
+`TODO: add schema`
+
+The ReplaceRegex replace a path from an url to another with regex matching and replacement.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Replace path with regex
+labels:
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex=^/foo/(.*)"
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement=/bar/$1"
+```
+
+```yaml tab="Kubernetes"
+# Replace path with regex
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-replacepathregex
+spec:
+  replacePathRegex:
+    regex: ^/foo/(.*)
+    replacement: /bar/$1
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex": "^/foo/(.*)",
+  "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement": "/bar/$1"
+}
+```
+
+```yaml tab="Rancher"
+# Replace path with regex
+labels:
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.regex=^/foo/(.*)"
+- "traefik.http.middlewares.test-replacepathregex.replacepathregex.replacement=/bar/$1"
+```
+
+```toml tab="File"
+# Redirect with domain replacement
+[http.middlewares]
+  [http.middlewares.test-replacepathregex.replacePathRegex]
+    regex = "^/foo/(.*)"
+    replacement = "/bar/$1"
+```
+
+## Configuration Options
+
+### General
+
+The ReplacePathRegex middleware will:
+
+- replace the matching path by the specified one.
+- store the original path in a `X-Replaced-Path` header.
+
+### `regex`
+
+The `regex` option is the regular expression to match and capture the path from the request URL.
+
+!!! warning
+
+    Care should be taken when defining replacement expand variables: `$1x` is equivalent to `${1x}`, not `${1}x` (see [Regexp.Expand](https://golang.org/pkg/regexp/#Regexp.Expand)), so use `${1}` syntax.
+
+!!! tip
+
+    Regular expressions and replacements can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
+    
+### `replacement`
+
+The `replacement` option defines how to modify the path to have the new target path.

docs/content/middlewares/retry.md

@@ -1,20 +1,54 @@
-# TODO -- Retry
+# Retry
 
 Retrying until it Succeeds
 {: .subtitle }
 
-## Old Content
+`TODO: add schema`
 
-## Retry Configuration
+Retry to send request on attempt failure.
 
-```toml
-# Enable retry sending request if network error
-[retry]
+## Configuration Examples
 
-# Number of attempts
-#
-# Optional
-# Default: (number servers in backend) -1
-#
-# attempts = 3
+```yaml tab="Docker"
+# Retry to send request 4 times
+labels:
+- "traefik.http.middlewares.test-retry.retry.attempts=4"
 ```
+
+```yaml tab="Kubernetes"
+# Retry to send request 4 times
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-retry
+spec:
+  retry:
+    attempts: 4
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-retry.retry.attempts": "4"
+}
+```
+
+```yaml tab="Rancher"
+# Retry to send request 4 times
+labels:
+- "traefik.http.middlewares.test-retry.retry.attempts=4"
+```
+
+```toml tab="File"
+# Retry to send request 4 times
+[http.middlewares]
+  [http.middlewares.test-retry.retry]
+     attempts = 4
+```
+
+## Configuration Options
+
+### `attempts` 
+
+_mandatory_
+
+The `attempts` option defines how many times to try sending the request.

docs/content/middlewares/stripprefix.md

@@ -1,13 +1,74 @@
-# TODO -- StripPrefix
+# StripPrefix
 
 Removing Prefixes From the Path Before Forwarding the Request
 {: .subtitle }
 
-## OldContent
- 
-Use a `*Strip` matcher if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
-For instance, `PathPrefixStrip: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.  
-Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.  
+`TODO: add schema`
+
+Remove the specified prefixes from the URL path.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Strip prefix /foobar and /fiibar
+labels:
+- "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes=/foobar, /fiibar"
+```
+
+```yaml tab="Kubernetes"
+# Strip prefix /foobar and /fiibar
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-stripprefix
+spec:
+  stripPrefix:
+    prefixes:
+    - /foobar
+    - /fiibar
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes": "/foobar, /fiibar"
+}
+```
+
+```yaml tab="Rancher"
+# Strip prefix /foobar and /fiibar
+labels:
+- "traefik.http.middlewares.test-stripprefix.stripprefix.prefixes=/foobar, /fiibar"
+```
+
+```toml tab="File"
+# Strip prefix /foobar and /fiibar
+[http.middlewares]
+  [http.middlewares.test-stripprefix.stripPrefix]
+    prefixes = ["/foobar", "/fiibar"]
+```
+
+## Configuration Options
+
+### General
+
+The StripPrefix middleware will:
+
+- strip the matching path prefix.
+- store the matching path prefix in a `X-Forwarded-Prefix` header.
+
+!!! tip
+    
+    Use a `StripPrefix` middleware if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
+
+### `prefixes`
+
+The `prefixes` option defines the prefixes to strip from the request URL.
+
+For instance, `/products` would match `/products` but also `/products/shoes` and `/products/shirts`.
+
+Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.
+
 If your backend is serving assets (e.g., images or Javascript files), chances are it must return properly constructed relative URLs.  
 Continuing on the example, the backend should return `/products/shoes/image.png` (and not `/images.png` which Traefik would likely not be able to associate with the same backend).  
-The `X-Forwarded-Prefix` header (available since Traefik 1.3) can be queried to build such URLs dynamically.
+
+The `X-Forwarded-Prefix` header can be queried to build such URLs dynamically.

docs/content/middlewares/stripprefixregex.md

@@ -1,13 +1,77 @@
-# TODO -- StripPrefix
+# StripPrefixRegex
 
 Removing Prefixes From the Path Before Forwarding the Request (Using a Regex)
 {: .subtitle }
 
-## OldContent
+`TODO: add schema`
+
+Remove the matching prefixes from the URL path.
+
+## Configuration Examples
+
+```yaml tab="Docker"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex=^/foo/(.*)",
+```
+
+```yaml tab="Kubernetes"
+# Replace the path by /foo
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: test-stripprefixregex
+spec:
+  stripPrefixRegex:
+    regex: "^/foo/(.*)"
+```
+
+```json tab="Marathon"
+"labels": {
+  "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex": "^/foo/(.*)"
+}
+```
+
+```yaml tab="Rancher"
+# Replace the path by /foo
+labels:
+- "traefik.http.middlewares.test-stripprefixregex.stripprefixregex.regex=^/foo/(.*)",
+```
+
+```toml tab="File"
+# Replace the path by /foo
+[http.middlewares]
+  [http.middlewares.test-stripprefixregex.stripPrefixRegex]
+     regex: "^/foo/(.*)"
+```
+
+## Configuration Options
+
+### General
+
+The StripPrefixRegex middleware will:
+
+- strip the matching path prefix.
+- store the matching path prefix in a `X-Forwarded-Prefix` header.
+
+!!! tip
+    
+    Use a `stripPrefixRegex` middleware if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
+
+### `regex`
+
+The `regex` option is the regular expression to match the path prefix from the request URL.
+
+!!! tip
+
+    Regular expressions can be tested using online tools such as [Go Playground](https://play.golang.org/p/mWU9p-wk2ru) or the [Regex101](https://regex101.com/r/58sIgx/2).
+
+For instance, `/products` would match `/products` but also `/products/shoes` and `/products/shirts`.  
 
-Use a `*Strip` matcher if your backend listens on the root path (`/`) but should be routeable on a specific prefix.
-For instance, `PathPrefixStrip: /products` would match `/products` but also `/products/shoes` and `/products/shirts`.  
 Since the path is stripped prior to forwarding, your backend is expected to listen on `/`.  
+
 If your backend is serving assets (e.g., images or Javascript files), chances are it must return properly constructed relative URLs.  
+
 Continuing on the example, the backend should return `/products/shoes/image.png` (and not `/images.png` which Traefik would likely not be able to associate with the same backend).  
-The `X-Forwarded-Prefix` header (available since Traefik 1.3) can be queried to build such URLs dynamically.
+
+The `X-Forwarded-Prefix` header can be queried to build such URLs dynamically.

docs/content/observability/access-logs.md

@@ -5,51 +5,57 @@ Who Calls Whom?
 
 By default, logs are written to stdout, in text format.
 
-## Configuration Examples
+## Configuration 
 
-??? example "Enabling Access Logs"
+To enable the access logs:
 
-    ```toml
-    [accessLog]
-    ```
+```toml tab="File"
+[accessLog]
+```
 
-## Configuration Options 
+```bash tab="CLI"
+--accesslog
+```
 
-### filePath
+### `filePath`
 
 By default access logs are written to the standard output.
 To write the logs into a log file, use the `filePath` option.
 
 in the Common Log Format (CLF), extended with additional fields.
 
-### format
+### `format`
  
 By default, logs are written using the Common Log Format (CLF).
 To write logs in JSON, use `json` in the `format` option.
 
 !!! note "Common Log Format"
-
-#### CLF - Common Log Format
-
+    
     ```html
     <remote_IP_address> - <client_user_name_if_available> [<timestamp>] "<request_method> <request_path> <request_protocol>" <origin_server_HTTP_status> <origin_server_content_size> "<request_referrer>" "<request_user_agent>" <number_of_requests_received_since_Traefik_started> "<Traefik_frontend_name>" "<Traefik_backend_URL>" <request_duration_in_ms>ms 
     ```
 
-#### bufferingSize
+### `bufferingSize`
 
 To write the logs in an asynchronous fashion, specify a  `bufferingSize` option.
 This option represents the number of log lines Traefik will keep in memory before writing them to the selected output.
 In some cases, this option can greatly help performances.
 
-??? example "Configuring a buffer of 100 lines"
+```toml tab="File"
+# Configuring a buffer of 100 lines
+[accessLog]
+  filePath = "/path/to/access.log"
+  bufferingSize = 100
+```
 
-    ```toml
-    [accessLog]
-    filePath = "/path/to/access.log"
-    bufferingSize = 100
-    ```
+```bash tab="CLI"
+# Configuring a buffer of 100 lines
+--accesslog
+--accesslog.filepath="/path/to/access.log"
+--accesslog.bufferingsize=100
+```
 
-#### Filtering
+### Filtering
 
 To filter logs, you can specify a set of filters which are logically "OR-connected". 
 Thus, specifying multiple filters will keep more access logs than specifying only one.
@@ -60,20 +66,29 @@ The available filters are:
 - `retryAttempts`, to keep the access logs when at least one retry has happened
 - `minDuration`, to keep access logs when requests take longer than the specified duration
 
-??? example "Configuring Multiple Filters"
+```toml tab="File"
+# Configuring Multiple Filters
+[accessLog]
+filePath = "/path/to/access.log"
+format = "json"
 
-    ```toml
-    [accessLog]
-    filePath = "/path/to/access.log"
-    format = "json"
-    
-      [accessLog.filters]    
-        statusCodes = ["200", "300-302"]
-        retryAttempts = true
-        minDuration = "10ms"
-    ```
+  [accessLog.filters]    
+    statusCodes = ["200", "300-302"]
+    retryAttempts = true
+    minDuration = "10ms"
+```
 
-#### Limiting the Fields
+```bash tab="CLI"
+# Configuring Multiple Filters
+--accesslog
+--accesslog.filepath="/path/to/access.log"
+--accesslog.format="json"
+--accesslog.filters.statuscodes="200, 300-302"
+--accesslog.filters.retryattempts
+--accesslog.filters.minduration="10ms"
+```
+
+### Limiting the Fields
 
 You can decide to limit the logged fields/headers to a given list with the `fields.names` and `fields.header` options
 
@@ -83,65 +98,76 @@ Each field can be set to:
 - `drop` to drop the value
 - `redact` to replace the value with "redacted"
 
-??? example "Limiting the Logs to Specific Fields"
+The `defaultMode` for `fields.header` is `drop`.
 
-    ```toml
-    [accessLog]
-        filePath = "/path/to/access.log"
-        format = "json"
-        
-        [accessLog.filters]
-            statusCodes = ["200", "300-302"]
-    
-        [accessLog.fields]
-            defaultMode = "keep"
-    
-            [accessLog.fields.names]
-                "ClientUsername" = "drop"
+```toml tab="File"
+# Limiting the Logs to Specific Fields
+[accessLog]
+  filePath = "/path/to/access.log"
+  format = "json"
+
+  [accessLog.fields]
+    defaultMode = "keep"
+
+    [accessLog.fields.names]
+      "ClientUsername" = "drop"
+
+    [accessLog.fields.headers]
+      defaultMode = "keep"
+  
+      [accessLog.fields.headers.names]
+        "User-Agent" = "redact"
+        "Authorization" = "drop"
+        "Content-Type" = "keep"
+```
+
+```bash tab="CLI"
+# Limiting the Logs to Specific Fields
+--accesslog
+--accesslog.filepath="/path/to/access.log"
+--accesslog.format="json"
+--accesslog.fields.defaultmode="keep"
+--accesslog.fields.names.ClientUsername="drop"
+--accesslog.fields.headers.defaultmode="keep"
+--accesslog.fields.headers.names.User-Agent="redact"
+--accesslog.fields.headers.names.Authorization="drop"
+--accesslog.fields.headers.names.Content-Type="keep"
+```
 
-            [accessLog.fields.headers]
-                defaultMode = "keep"
-        
-                [accessLog.fields.headers.names]
-                    "User-Agent" = "redact"
-                    "Authorization" = "drop"
-                    "Content-Type" = "keep"
-    ```
-    
 ??? list "Available Fields"
 
-    ```ini
-    StartUTC
-    StartLocal
-    Duration
-    FrontendName
-    BackendName
-    BackendURL
-    BackendAddr
-    ClientAddr
-    ClientHost
-    ClientPort
-    ClientUsername
-    RequestAddr
-    RequestHost
-    RequestPort
-    RequestMethod
-    RequestPath
-    RequestProtocol
-    RequestLine
-    RequestContentSize
-    OriginDuration
-    OriginContentSize
-    OriginStatus
-    OriginStatusLine
-    DownstreamStatus
-    DownstreamStatusLine
-    DownstreamContentSize
-    RequestCount
-    GzipRatio
-    Overhead
-    RetryAttempts
-    ```
+    | Field                   | Description                                                                                                                                                         |
+    |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+    | `StartUTC`              | The time at which request processing started.                                                                                                                       |
+    | `StartLocal`            | The local time at which request processing started.                                                                                                                 |
+    | `Duration`              | The total time taken by processing the response, including the origin server's time but not the log writing time.                                                   |
+    | `FrontendName`          | The name of the Traefik frontend.                                                                                                                                   |
+    | `BackendName`           | The name of the Traefik backend.                                                                                                                                    |
+    | `BackendURL`            | The URL of the Traefik backend.                                                                                                                                     |
+    | `BackendAddr`           | The IP:port of the Traefik backend (extracted from `BackendURL`)                                                                                                    |
+    | `ClientAddr`            | The remote address in its original form (usually IP:port).                                                                                                          |
+    | `ClientHost`            | The remote IP address from which the client request was received.                                                                                                   |
+    | `ClientPort`            | The remote TCP port from which the client request was received.                                                                                                     |
+    | `ClientUsername`        | The username provided in the URL, if present.                                                                                                                       |
+    | `RequestAddr`           | The HTTP Host header (usually IP:port). This is treated as not a header by the Go API.                                                                              |
+    | `RequestHost`           | The HTTP Host server name (not including port).                                                                                                                     |
+    | `RequestPort`           | The TCP port from the HTTP Host.                                                                                                                                    |
+    | `RequestMethod`         | The HTTP method.                                                                                                                                                    |
+    | `RequestPath`           | The HTTP request URI, not including the scheme, host or port.                                                                                                       |
+    | `RequestProtocol`       | The version of HTTP requested.                                                                                                                                      |
+    | `RequestLine`           | `RequestMethod` + `RequestPath` + `RequestProtocol`                                                                                                                 |
+    | `RequestContentSize`    | The number of bytes in the request entity (a.k.a. body) sent by the client.                                                                                         |
+    | `OriginDuration`        | The time taken by the origin server ('upstream') to return its response.                                                                                            |
+    | `OriginContentSize`     | The content length specified by the origin server, or 0 if unspecified.                                                                                             |
+    | `OriginStatus`          | The HTTP status code returned by the origin server. If the request was handled by this Traefik instance (e.g. with a redirect), then this value will be absent.     |
+    | `OriginStatusLine`      | `OriginStatus` + Status code explanation                                                                                                                            |
+    | `DownstreamStatus`      | The HTTP status code returned to the client.                                                                                                                        |
+    | `DownstreamStatusLine`  | `DownstreamStatus` + Status code explanation                                                                                                                        |
+    | `DownstreamContentSize` | The number of bytes in the response entity returned to the client. This is in addition to the "Content-Length" header, which may be present in the origin response. |
+    | `RequestCount`          | The number of requests received since the Traefik instance started.                                                                                                 |
+    | `GzipRatio`             | The response body compression ratio achieved.                                                                                                                       |
+    | `Overhead`              | The processing time overhead caused by Traefik.                                                                                                                     |
+    | `RetryAttempts`         | The amount of attempts the request was retried.                                                                                                                     |
 
 ## Log Rotation
 

docs/content/observability/logs.md

@@ -5,41 +5,57 @@ Reading What's Happening
 
 By default, logs are written to stdout, in text format.
 
-## Configuration Example
-
-??? example "Writing Logs in a File"
-
-    ```toml
-    [log]
-    filePath = "/path/to/traefik.log"
-    ```
-
-??? example "Writing Logs in a File, in JSON"
-
-    ```toml
-    [log]
-    filePath = "/path/to/log-file.log"
-    format   = "json"
-    ```
-
-## Configuration Options
+## Configuration
 
 ### General
 
 Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on).
 
-#### filePath
+#### `filePath`
 
 By default, the logs are written to the standard output.
 You can configure a file path instead using the `filePath` option.
 
-#### format
+```toml tab="File"
+# Writing Logs to a File
+[log]
+  filePath = "/path/to/traefik.log"
+```
+
+```bash tab="CLI"
+# Writing Logs to a File
+--log.filePath="/path/to/traefik.log"
+```
+
+#### `format`
 
 By default, the logs use a text format (`common`), but you can also ask for the `json` format in the `format` option.   
 
-#### logLevel
+```toml tab="File"
+# Writing Logs to a File, in JSON
+[log]
+  filePath = "/path/to/log-file.log"
+  format   = "json"
+```
 
-By default, the `logLevel` is set to `error`, but you can choose amongst `debug`, `panic`, `fatal`, `error`, `warn`, and `info`. 
+```bash tab="CLI"
+# Writing Logs to a File, in JSON
+--log.filePath="/path/to/traefik.log"
+--log.format="json"
+```
+
+#### `level`
+
+By default, the `level` is set to `ERROR`. Alternative logging levels are `DEBUG`, `PANIC`, `FATAL`, `ERROR`, `WARN`, and `INFO`. 
+
+```toml tab="File"
+[log]
+  level = "DEBUG"
+```
+
+```bash tab="CLI"
+--log.level="DEBUG"
+```
 
 ## Log Rotation
 

docs/content/observability/metrics/datadog.md

@@ -0,0 +1,106 @@
+# DataDog
+
+To enable the DataDog:
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.dataDog]
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.datadog
+```
+
+#### `address`
+
+_Required, Default="127.0.0.1:8125"_
+
+Address instructs exporter to send metrics to datadog-agent at this address.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.dataDog]
+    address = "127.0.0.1:8125"
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  dataDog:
+    address: 127.0.0.1:8125
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.datadog.address="127.0.0.1:8125"
+```
+
+#### `addEntryPointsLabels`
+
+_Optional, Default=true_
+
+Enable metrics on entry points.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.dataDog]
+    addEntryPointsLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  dataDog:
+    addEntryPointsLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.datadog.addEntryPointsLabels=true
+```
+
+#### `addServicesLabels`
+
+_Optional, Default=true_
+
+Enable metrics on services.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.dataDog]
+    addServicesLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  dataDog:
+    addServicesLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.datadog.addServicesLabels=true
+```
+
+#### `pushInterval`
+
+_Optional, Default=10s_
+
+The interval used by the exporter to push metrics to datadog-agent.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.dataDog]
+    pushInterval = 10s
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  dataDog:
+    pushInterval: 10s
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.datadog.pushInterval=10s
+```
+

docs/content/observability/metrics/influxdb.md

@@ -0,0 +1,225 @@
+# InfluxDB
+
+To enable the InfluxDB:
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb: {}
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb
+```
+
+#### `address`
+
+_Required, Default="localhost:8089"_
+
+Address instructs exporter to send metrics to influxdb at this address.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    address = "localhost:8089"
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    address: localhost:8089
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.address="localhost:8089"
+```
+
+#### `protocol`
+
+_Required, Default="udp"_
+
+InfluxDB's address protocol (udp or http).
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    protocol = "upd"
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    protocol: udp
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.protocol="udp"
+```
+
+#### `database`
+
+_Optional, Default=""_
+
+InfluxDB database used when protocol is http.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    database = ""
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    database: ""
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.database=""
+```
+
+#### `retentionPolicy`
+
+_Optional, Default=""_
+
+InfluxDB retention policy used when protocol is http.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    retentionPolicy = ""
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    retentionPolicy: ""
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.retentionPolicy=""
+```
+
+#### `username`
+
+_Optional, Default=""_
+
+InfluxDB username (only with http).
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    username = ""
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    username: ""
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.username=""
+```
+
+#### `password`
+
+_Optional, Default=""_
+
+InfluxDB password (only with http).
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    password = ""
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    password: ""
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.password=""
+```
+
+#### `addEntryPointsLabels`
+
+_Optional, Default=true_
+
+Enable metrics on entry points.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    addEntryPointsLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    addEntryPointsLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.addEntryPointsLabels=true
+```
+
+#### `addServicesLabels`
+
+_Optional, Default=true_
+
+Enable metrics on services.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    addServicesLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    addServicesLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.addServicesLabels=true
+```
+
+#### `pushInterval`
+
+_Optional, Default=10s_
+
+The interval used by the exporter to push metrics to influxdb.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.influxdb]
+    pushInterval = 10s
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  influxdb:
+    pushInterval: 10s
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.influxdb.pushInterval=10s
+```

docs/content/observability/metrics/overview.md

@@ -0,0 +1,26 @@
+# Metrics
+Metrics system
+{: .subtitle }
+
+Traefik supports 4 metrics backends:
+
+- [DataDog](./datadog.md)
+- [InfluxDB](./influxdb.md)
+- [Prometheus](./prometheus.md)
+- [StatsD](./statsd.md)
+
+## Configuration
+
+To enable metrics:
+
+```toml tab="File (TOML)"
+[metrics]
+```
+
+```yaml tab="File (TOML)"
+metrics: {}
+```
+
+```bash tab="CLI"
+--metrics
+```

docs/content/observability/metrics/prometheus.md

@@ -0,0 +1,91 @@
+# Prometheus
+
+To enable the Prometheus:
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.prometheus]
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  prometheus: {}
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.prometheus
+```
+
+#### `buckets`
+
+_Optional, Default="0.100000, 0.300000, 1.200000, 5.000000"_
+
+Buckets for latency metrics.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.prometheus]
+    buckets = [0.1,0.3,1.2,5.0]
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  prometheus:
+    buckets:
+    - 0.1
+    - 0.3
+    - 1.2
+    - 5.0
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.prometheus.buckets=0.100000, 0.300000, 1.200000, 5.000000
+```
+
+#### `addEntryPointsLabels`
+
+_Optional, Default=true_
+
+Enable metrics on entry points.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.prometheus]
+    addEntryPointsLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.prometheus.addEntryPointsLabels=true
+```
+
+#### `addServicesLabels`
+
+_Optional, Default=true_
+
+Enable metrics on services.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.prometheus]
+    addServicesLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  prometheus:
+    addServicesLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.prometheus.addServicesLabels=true
+```

docs/content/observability/metrics/statsd.md

@@ -0,0 +1,110 @@
+# StatsD
+
+To enable the Statsd:
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsd]
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  statsd: {}
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.statsd
+```
+
+#### `address`
+
+_Required, Default="localhost:8125"_
+
+Address instructs exporter to send metrics to statsd at this address.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsd]
+    address = "localhost:8125"
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  statsd:
+    address: localhost:8125
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.statsd.address="localhost:8125"
+```
+
+#### `addEntryPointsLabels`
+
+_Optional, Default=true_
+
+Enable metrics on entry points.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsd]
+    addEntryPointsLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  statsd:
+    addEntryPointsLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.statsd.addEntryPointsLabels=true
+```
+
+#### `addServicesLabels`
+
+_Optional, Default=true_
+
+Enable metrics on services.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsd]
+    addServicesLabels = true
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  statsd:
+    addServicesLabels: true
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.statsd.addServicesLabels=true
+```
+
+#### `pushInterval`
+
+_Optional, Default=10s_
+
+The interval used by the exporter to push metrics to statsD.
+
+```toml tab="File (TOML)"
+[metrics]
+  [metrics.statsd]
+    pushInterval = 10s
+```
+
+```yaml tab="File (TOML)"
+metrics:
+  statsd:
+    pushInterval: 10s
+```
+
+```bash tab="CLI"
+--metrics
+--metrics.statsd.pushInterval=10s
+```

docs/content/observability/tracing.md

@@ -1,234 +0,0 @@
-# Tracing
-
-Visualize the Requests Flow
-{: .subtitle }
-
-The tracing system allows developers to visualize call flows in their infrastructure.
-
-Traefik uses OpenTracing, an open standard designed for distributed tracing.
-
-Traefik supports three tracing backends: Jaeger, Zipkin, DataDog, and Instana.
-
-## Configuration Reference
-
-??? example "With Jaeger" 
-
-    ```toml
-    # Tracing definition
-    [tracing]
-      # Backend name used to send tracing data
-      #
-      # Default: "jaeger"
-      #
-      backend = "jaeger"
-    
-      # Service name used in Jaeger backend
-      #
-      # Default: "traefik"
-      #
-      serviceName = "traefik"
-        
-      # Span name limit allows for name truncation in case of very long Frontend/Backend names
-      # This can prevent certain tracing providers to drop traces that exceed their length limits
-      #
-      # Default: 0 - no truncation will occur
-      # 
-      spanNameLimit = 0
-    
-      [tracing.jaeger]
-        # Sampling Server URL is the address of jaeger-agent's HTTP sampling server
-        #
-        # Default: "http://localhost:5778/sampling"
-        #
-        samplingServerURL = "http://localhost:5778/sampling"
-    
-        # Sampling Type specifies the type of the sampler: const, probabilistic, rateLimiting
-        #
-        # Default: "const"
-        #
-        samplingType = "const"
-    
-        # Sampling Param is a value passed to the sampler.
-        # Valid values for Param field are:
-        #   - for "const" sampler, 0 or 1 for always false/true respectively
-        #   - for "probabilistic" sampler, a probability between 0 and 1
-        #   - for "rateLimiting" sampler, the number of spans per second
-        #
-        # Default: 1.0
-        #
-        samplingParam = 1.0
-    
-        # Local Agent Host Port instructs reporter to send spans to jaeger-agent at this address
-        #
-        # Default: "127.0.0.1:6831"
-        #
-        localAgentHostPort = "127.0.0.1:6831"
-       
-        # Generate 128-bit trace IDs, compatible with OpenCensus
-        #
-        # Default: false
-        gen128Bit = true
-       
-        # Set the propagation header type. This can be either:
-        #   - "jaeger", jaeger's default trace header.
-        #   - "b3", compatible with OpenZipkin
-        #
-        # Default: "jaeger"
-        propagation = "jaeger"
-        
-        # Trace Context Header Name is the http header name used to propagate tracing context.
-        # This must be in lower-case to avoid mismatches when decoding incoming headers.
-        #
-        # Default: "uber-trace-id"
-        #
-        traceContextHeaderName = "uber-trace-id"
-    ```
-
-    !!! warning
-        Traefik is only able to send data over the compact thrift protocol to the [Jaeger agent](https://www.jaegertracing.io/docs/deployment/#agent).
-
-??? example "With Zipkin"
-
-    ```toml
-    # Tracing definition
-    [tracing]
-      # Backend name used to send tracing data
-      #
-      # Default: "jaeger"
-      #
-      backend = "zipkin"
-    
-      # Service name used in Zipkin backend
-      #
-      # Default: "traefik"
-      #
-      serviceName = "traefik"
-        
-      # Span name limit allows for name truncation in case of very long Frontend/Backend names
-      # This can prevent certain tracing providers to drop traces that exceed their length limits
-      #
-      # Default: 0 - no truncation will occur
-      # 
-      spanNameLimit = 150
-    
-      [tracing.zipkin]
-        # Zipkin HTTP endpoint used to send data
-        #
-        # Default: "http://localhost:9411/api/v1/spans"
-        #
-        httpEndpoint = "http://localhost:9411/api/v1/spans"
-    
-        # Enable Zipkin debug
-        #
-        # Default: false
-        #
-        debug = false
-    
-        # Use Zipkin SameSpan RPC style traces
-        #
-        # Default: false
-        #
-        sameSpan = false
-    
-        # Use Zipkin 128 bit root span IDs
-        #
-        # Default: true
-        #
-        id128Bit = true
-    
-        # The rate between 0.0 and 1.0 of requests to trace.
-        #
-        # Default: 1.0
-        #
-        sampleRate = 0.2
-    ```
-
-??? example "With DataDog"
-
-    ```toml
-    # Tracing definition
-    [tracing]
-      # Backend name used to send tracing data
-      #
-      # Default: "jaeger"
-      #
-      backend = "datadog"
-    
-      # Service name used in DataDog backend
-      #
-      # Default: "traefik"
-      #
-      serviceName = "traefik"
-      
-      # Span name limit allows for name truncation in case of very long Frontend/Backend names
-      # This can prevent certain tracing providers to drop traces that exceed their length limits
-      #
-      # Default: 0 - no truncation will occur
-      # 
-      spanNameLimit = 100
-    
-      [tracing.datadog]
-        # Local Agent Host Port instructs reporter to send spans to datadog-tracing-agent at this address
-        #
-        # Default: "127.0.0.1:8126"
-        #
-        localAgentHostPort = "127.0.0.1:8126"
-    
-        # Enable DataDog debug
-        #
-        # Default: false
-        #
-        debug = false
-    
-        # Apply shared tag in a form of Key:Value to all the traces
-        #
-        # Default: ""
-        #
-        globalTag = ""
-        
-        # Enable priority sampling. When using distributed tracing, this option must be enabled in order
-        # to get all the parts of a distributed trace sampled.
-        #
-        # Default: false
-        #
-        prioritySampling = false
-
-    ```
-    
-??? example "With Instana"
-
-    ```toml
-    # Tracing definition
-    [tracing]
-      # Backend name used to send tracing data
-      #
-      # Default: "jaeger"
-      #
-      backend = "instana"
-      # Service name used in Instana backend
-      #
-      # Default: "traefik"
-      #
-      serviceName = "traefik"
-      [tracing.instana]
-        # Local Agent Host instructs reporter to send spans to instana-agent at this address
-        #
-        # Default: "127.0.0.1"
-        #
-        localAgentHost = "127.0.0.1"
-        # Local Agent port instructs reporter to send spans to the instana-agent at this port
-        # 
-        # Default: 42699
-        #
-        localAgentPort = 42699
-        # Set Instana tracer log level
-        #
-        # Default: info
-        # Valid values for logLevel field are:
-        #   - error
-        #   - warn
-        #   - debug
-        #   - info
-        #
-        logLevel = "info"
-    ``` 

docs/content/observability/tracing/datadog.md

@@ -0,0 +1,111 @@
+# DataDog
+
+To enable the DataDog:
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.dataDog]
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  dataDog: {}
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.datadog
+```
+
+#### `localAgentHostPort`
+
+_Required, Default="127.0.0.1:8126"_
+
+Local Agent Host Port instructs reporter to send spans to datadog-tracing-agent at this address.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.dataDog]
+    localAgentHostPort = "127.0.0.1:8126"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  dataDog:
+    localAgentHostPort: 127.0.0.1:8126
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.datadog.localAgentHostPort="127.0.0.1:8126"
+```
+
+#### `debug`
+
+_Optional, Default=false_
+
+Enable DataDog debug.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.dataDog]
+    debug = true
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  dataDog:
+    debug: true
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.datadog.debug=true
+```
+
+#### `globalTag`
+
+_Optional, Default=empty_
+
+Apply shared tag in a form of Key:Value to all the traces.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.dataDog]
+    globalTag = "sample"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  dataDog:
+    globalTag: sample
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.datadog.globalTag="sample"
+```
+
+#### `prioritySampling`
+
+_Optional, Default=false_
+
+Enable priority sampling. When using distributed tracing,
+this option must be enabled in order to get all the parts of a distributed trace sampled.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.dataDog]
+    prioritySampling = true
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  dataDog:
+    prioritySampling: true
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.datadog.prioritySampling=true
+```

docs/content/observability/tracing/haystack.md

@@ -0,0 +1,180 @@
+# Haystack
+
+To enable the Haystack:
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack: {}
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack
+```
+
+#### `localAgentHost`
+
+_Require, Default="127.0.0.1"_
+
+Local Agent Host instructs reporter to send spans to haystack-agent at this address.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    localAgentHost = "127.0.0.1"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    localAgentHost: 127.0.0.1
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.localAgentHost="127.0.0.1"
+```
+
+#### `localAgentPort`
+
+_Require, Default=42699_
+
+Local Agent port instructs reporter to send spans to the haystack-agent at this port.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    localAgentPort = 42699
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    localAgentPort: 42699
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.localAgentPort=42699
+```
+
+#### `globalTag`
+
+_Optional, Default=empty_
+
+Apply shared tag in a form of Key:Value to all the traces.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    globalTag = "sample:test"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    globalTag: sample:test
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.globalTag="sample:test"
+```
+
+#### `traceIDHeaderName`
+
+_Optional, Default=empty_
+
+Specifies the header name that will be used to store the trace ID.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    traceIDHeaderName = "sample"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    traceIDHeaderName: sample
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.traceIDHeaderName="sample"
+```
+
+#### `parentIDHeaderName`
+
+_Optional, Default=empty_
+
+Specifies the header name that will be used to store the span ID.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    parentIDHeaderName = "sample"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    parentIDHeaderName: "sample"
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.parentIDHeaderName="sample"
+```
+
+#### `spanIDHeaderName`
+
+_Optional, Default=empty_
+
+Apply shared tag in a form of Key:Value to all the traces.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    spanIDHeaderName = "sample:test"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    spanIDHeaderName: "sample:test"
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.spanIDHeaderName=sample:test
+```
+
+#### `baggagePrefixHeaderName`
+
+_Optional, Default=empty_
+
+Specifies the header name prefix that will be used to store baggage items in a map.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.haystack]
+    baggagePrefixHeaderName = "sample"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  haystack:
+    baggagePrefixHeaderName: "sample"
+```
+
+
+```bash tab="CLI"
+--tracing
+--tracing.haystack.baggagePrefixHeaderName="sample"
+```

docs/content/observability/tracing/instana.md

@@ -0,0 +1,94 @@
+# Instana
+
+To enable the Instana:
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.instana]
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  instana: {}
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.instana
+```
+
+#### `localAgentHost`
+
+_Require, Default="127.0.0.1"_
+
+Local Agent Host instructs reporter to send spans to instana-agent at this address.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.instana]
+    localAgentHost = "127.0.0.1"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  instana:
+    localAgentHost: 127.0.0.1
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.instana.localAgentHost="127.0.0.1"
+```
+
+#### `localAgentPort`
+
+_Require, Default=42699_
+
+Local Agent port instructs reporter to send spans to the instana-agent at this port.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.instana]
+    localAgentPort = 42699
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  instana:
+    localAgentPort: 42699
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.instana.localAgentPort=42699
+```
+
+#### `logLevel`
+
+_Require, Default="info"_
+
+Set Instana tracer log level.
+
+Valid values for logLevel field are:
+
+- `error`
+- `warn`
+- `debug`
+- `info`
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.instana]
+    logLevel = "info"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  instana:
+    logLevel: info
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.instana.logLevel="info"
+```

docs/content/observability/tracing/jaeger.md

@@ -0,0 +1,267 @@
+# Jaeger
+
+To enable the Jaeger:
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger: {}
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger
+```
+
+!!! warning
+    Traefik is able to send data over the compact thrift protocol to the [Jaeger agent](https://www.jaegertracing.io/docs/deployment/#agent)
+    or a [Jaeger collector](https://www.jaegertracing.io/docs/deployment/#collectors).
+
+#### `samplingServerURL`
+
+_Required, Default="http://localhost:5778/sampling"_
+
+Sampling Server URL is the address of jaeger-agent's HTTP sampling server.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    samplingServerURL = "http://localhost:5778/sampling"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    samplingServerURL: http://localhost:5778/sampling
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.samplingServerURL="http://localhost:5778/sampling"
+```
+
+#### `samplingType`
+
+_Required, Default="const"_
+
+Sampling Type specifies the type of the sampler: `const`, `probabilistic`, `rateLimiting`.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    samplingType = "const"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    samplingType: const
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.samplingType="const"
+```
+
+#### `samplingParam`
+
+_Required, Default=1.0_
+
+Sampling Param is a value passed to the sampler.
+
+Valid values for Param field are:
+
+- for `const` sampler, 0 or 1 for always false/true respectively
+- for `probabilistic` sampler, a probability between 0 and 1
+- for `rateLimiting` sampler, the number of spans per second
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    samplingParam = 1.0
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    samplingParam: 1.0
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.samplingParam="1.0"
+```
+
+#### `localAgentHostPort`
+
+_Required, Default="127.0.0.1:6831"_
+
+Local Agent Host Port instructs reporter to send spans to jaeger-agent at this address.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    localAgentHostPort = "127.0.0.1:6831"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    localAgentHostPort: 127.0.0.1:6831
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.localAgentHostPort="127.0.0.1:6831"
+```
+
+#### `gen128Bit`
+
+_Optional, Default=false_
+
+Generate 128-bit trace IDs, compatible with OpenCensus.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    gen128Bit = true
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    gen128Bit: true
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.gen128Bit
+```
+
+#### `propagation`
+
+_Required, Default="jaeger"_
+
+Set the propagation header type.
+This can be either:
+
+- `jaeger`, jaeger's default trace header.
+- `b3`, compatible with OpenZipkin
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    propagation = "jaeger"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    propagation: jaeger
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.propagation="jaeger"
+```
+
+#### `traceContextHeaderName`
+
+_Required, Default="uber-trace-id"_
+
+Trace Context Header Name is the http header name used to propagate tracing context.
+This must be in lower-case to avoid mismatches when decoding incoming headers.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger]
+    traceContextHeaderName = "uber-trace-id"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    traceContextHeaderName: uber-trace-id
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.traceContextHeaderName="uber-trace-id"
+```
+
+### `collector`
+#### `endpoint`
+
+_Optional, Default=""_
+
+Collector Endpoint instructs reporter to send spans to jaeger-collector at this URL.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger.collector]
+    endpoint = "http://127.0.0.1:14268/api/traces?format=jaeger.thrift"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    collector:
+        endpoint: http://127.0.0.1:14268/api/traces?format=jaeger.thrift
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.collector.endpoint="http://127.0.0.1:14268/api/traces?format=jaeger.thrift"
+```
+
+#### `user`
+
+_Optional, Default=""_
+
+User instructs reporter to include a user for basic http authentication when sending spans to jaeger-collector.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger.collector]
+    user = "my-user"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    collector:
+        user: my-user
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.collector.user="my-user"
+```
+
+#### `password`
+
+_Optional, Default=""_
+
+Password instructs reporter to include a password for basic http authentication when sending spans to jaeger-collector.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.jaeger.collector]
+    password = "my-password"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  jaeger:
+    collector:
+        password: my-password
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.jaeger.collector.password="my-password"
+```

docs/content/observability/tracing/overview.md

@@ -0,0 +1,81 @@
+# Tracing
+
+Visualize the Requests Flow
+{: .subtitle }
+
+The tracing system allows developers to visualize call flows in their infrastructure.
+
+Traefik uses OpenTracing, an open standard designed for distributed tracing.
+
+Traefik supports five tracing backends:
+
+- [Jaeger](./jaeger.md)
+- [Zipkin](./zipkin.md)
+- [DataDog](./datadog.md)
+- [Instana](./instana.md)
+- [Haystack](./haystack.md)
+
+## Configuration
+
+By default, Traefik uses Jaeger as tracing backend.
+
+To enable the tracing:
+
+```toml tab="File (TOML)"
+[tracing]
+```
+
+```yaml tab="File (YAML)"
+tracing: {}
+```
+
+```bash tab="CLI"
+--tracing
+```
+
+### Common Options
+
+#### `serviceName`
+
+_Required, Default="traefik"_
+
+Service name used in selected backend.
+
+```toml tab="File (TOML)"
+[tracing]
+  serviceName = "traefik"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  serviceName: traefik
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.serviceName="traefik"
+```
+
+#### `spanNameLimit`
+
+_Required, Default=0_
+
+Span name limit allows for name truncation in case of very long names.
+This can prevent certain tracing providers to drop traces that exceed their length limits.
+
+`0` means no truncation will occur.
+
+```toml tab="File (TOML)"
+[tracing]
+  spanNameLimit = 150
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  spanNameLimit: 150
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.spanNameLimit=150
+```

docs/content/observability/tracing/zipkin.md

@@ -0,0 +1,133 @@
+# Zipkin
+
+To enable the Zipkin:
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin: {}
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin
+```
+
+#### `httpEndpoint`
+
+_Required, Default="http://localhost:9411/api/v1/spans"_
+
+Zipkin HTTP endpoint used to send data.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+    httpEndpoint = "http://localhost:9411/api/v1/spans"
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin:
+    httpEndpoint: http://localhost:9411/api/v1/spans
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin.httpEndpoint="http://localhost:9411/api/v1/spans"
+```
+
+#### `debug`
+
+_Optional, Default=false_
+
+Enable Zipkin debug.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+    debug = true
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin:
+    debug: true
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin.debug=true
+```
+
+#### `sameSpan`
+
+_Optional, Default=false_
+
+Use Zipkin SameSpan RPC style traces.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+    sameSpan = true
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin:
+    sameSpan: true
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin.sameSpan=true
+```
+
+#### `id128Bit`
+
+_Optional, Default=true_
+
+Use Zipkin 128 bit root span IDs.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+    id128Bit = false
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin:
+    id128Bit: false
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin.id128Bit=false
+```
+
+#### `sampleRate`
+
+_Required, Default=1.0_
+
+The rate between 0.0 and 1.0 of requests to trace.
+
+```toml tab="File (TOML)"
+[tracing]
+  [tracing.zipkin]
+    sampleRate = 0.2
+```
+
+```yaml tab="File (YAML)"
+tracing:
+  zipkin:
+    sampleRate: 0.2
+```
+
+```bash tab="CLI"
+--tracing
+--tracing.zipkin.sampleRate="0.2"
+```

docs/content/operations/api.md

@@ -0,0 +1,94 @@
+# API
+
+!!! important
+    In the beta version, you can't configure middlewares (basic authentication or white listing) anymore, but as security is important, this will change before the RC version.
+
+Traefik exposes a number of information through an API handler, such as the configuration of all routers, services, middlewares, etc.
+
+As with all features of Traefik, this handler can be enabled with the [static configuration](../getting-started/configuration-overview.md#the-static-configuration).
+
+## Security
+
+Enabling the API in production is not recommended, because it will expose all configuration elements,
+including sensitive data.
+
+In production, it should be at least secured by authentication and authorizations.
+
+A good sane default (non exhaustive) set of recommendations
+would be to apply the following protection mechanisms:
+
+* At the transport level:  
+  NOT publicly exposing the API's port,
+  keeping it restricted to internal networks
+  (as in the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), applied to networks).
+
+!!! important
+    In the beta version, you can't configure middlewares (basic authentication or white listing) anymore, but as security is important, this will change before the RC version.
+
+## Configuration
+
+To enable the API handler:
+
+```toml tab="File"
+[api]
+```
+
+```bash tab="CLI"
+--api
+```
+
+### `dashboard`
+
+_Optional, Default=true_
+
+Enable the dashboard. More about the dashboard features [here](./dashboard.md).
+
+```toml tab="File"
+[api]
+  dashboard = true
+```
+
+```bash tab="CLI"
+--api.dashboard
+```
+
+### `debug`
+
+_Optional, Default=false_
+
+Enable additional endpoints for debugging and profiling, served under `/debug/`.
+
+```toml tab="File"
+[api]
+  debug = true
+```
+
+```bash tab="CLI"
+--api.debug=true
+```
+
+## Endpoints
+
+All the following endpoints must be accessed with a `GET` HTTP request.
+
+| Path                           | Description                                                                               |
+|--------------------------------|-------------------------------------------------------------------------------------------|
+| `/api/http/routers`            | Lists all the HTTP routers information.                                                   |
+| `/api/http/routers/{name}`     | Returns the information of the HTTP router specified by `name`.                           |
+| `/api/http/services`           | Lists all the HTTP services information.                                                  |
+| `/api/http/services/{name}`    | Returns the information of the HTTP service specified by `name`.                          |
+| `/api/http/middlewares`        | Lists all the HTTP middlewares information.                                               |
+| `/api/http/middlewares/{name}` | Returns the information of the HTTP middleware specified by `name`.                       |
+| `/api/tcp/routers`             | Lists all the TCP routers information.                                                    |
+| `/api/tcp/routers/{name}`      | Returns the information of the TCP router specified by `name`.                            |
+| `/api/tcp/services`            | Lists all the TCP services information.                                                   |
+| `/api/tcp/services/{name}`     | Returns the information of the TCP service specified by `name`.                           |
+| `/api/entrypoints`             | Lists all the entry points information.                                                   |
+| `/api/entrypoints/{name}`      | Returns the information of the entry point specified by `name`.                           |
+| `/api/version`                 | Returns information about Traefik version.                                                |
+| `/debug/vars`                  | See the [expvar](https://golang.org/pkg/expvar/) Go documentation.                        |
+| `/debug/pprof/`                | See the [pprof Index](https://golang.org/pkg/net/http/pprof/#Index) Go documentation.     |
+| `/debug/pprof/cmdline`         | See the [pprof Cmdline](https://golang.org/pkg/net/http/pprof/#Cmdline) Go documentation. |
+| `/debug/pprof/profile`         | See the [pprof Profile](https://golang.org/pkg/net/http/pprof/#Profile) Go documentation. |
+| `/debug/pprof/symbol`          | See the [pprof Symbol](https://golang.org/pkg/net/http/pprof/#Symbol) Go documentation.   |
+| `/debug/pprof/trace`           | See the [pprof Trace](https://golang.org/pkg/net/http/pprof/#Trace) Go documentation.     |

docs/content/operations/cli.md

@@ -6,48 +6,56 @@ The Traefik Command Line
 ## General
 
 ```bash
-traefik [command] [--flag=flag_argument]
+traefik [command] [flags] [arguments]
 ```
 
-Available commands: 
+Use `traefik [command] --help` for help on any command.
 
-- `version` : Print version
-- `storeconfig` : Store the static Traefik configuration into a Key-value stores. Please refer to the `Store Traefik configuration`(TODO: add doc and link) section to get documentation on it.
-- `healthcheck`: Calls Traefik `/ping` to check health.
+Commands:
 
-Each command can have additional flags.
+- `healthcheck` Calls Traefik `/ping` to check the health of Traefik (the API must be enabled).
+- `version` Shows the current Traefik version.
 
-All those flags will be displayed with:
+Flag's usage:
 
 ```bash
-traefik [command] --help
+# set flag_argument to flag(s)
+traefik [--flag=flag_argument] [-f [flag_argument]]
+
+# set true/false to boolean flag(s)
+traefik [--flag[=true|false| ]] [-f [true|false| ]]
 ```
 
-Each command is described at the beginning of the help section:
+### `healthcheck`
 
-```bash
-traefik --help
+Calls Traefik `/ping` to check the health of Traefik.
+Its exit status is `0` if Traefik is healthy and `1` otherwise.
 
-# or
-
-docker run traefik[:version] --help
-# ex: docker run traefik:1.5 --help
-```
-
-### Command: healthcheck
-
-Checks the health of Traefik.
-Its exit status is `0` if Traefik is healthy and `1` if it is unhealthy.
-
-This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction or any other health check orchestration mechanism.
+This can be used with Docker [HEALTHCHECK](https://docs.docker.com/engine/reference/builder/#healthcheck) instruction
+or any other health check orchestration mechanism.
 
 !!! note
     The [`ping` endpoint](../ping/) must be enabled to allow the `healthcheck` command to call `/ping`.
 
-```bash
-traefik healthcheck
-```
+Usage:
 
 ```bash
+traefik healthcheck [command] [flags] [arguments]
+```
+
+Example:
+
+```bash
+$ traefik healthcheck
 OK: http://:8082/ping
 ```
+
+### `version`
+
+Shows the current Traefik version.
+
+Usage:
+
+```bash
+traefik version
+```

docs/content/operations/dashboard.md

@@ -5,18 +5,18 @@ See What's Going On
 
 The dashboard is the central place that shows you the current active routes handled by Traefik. 
 
-??? note "Dashboard WIP"
-   Currently, the dashboard is in a Work In Progress State while being reconstructed for v2. 
-   Therefore, the dashboard is currently not working.
+!!! warning "Dashboard WIP"
+    Currently, the dashboard is in a Work In Progress State while being reconstructed for v2. 
+    Therefore, the dashboard is currently not working.
 
 <figure>
-   <img src="../../assets/img/dashboard-main.png" alt="Dashboard - Providers" />
-   <figcaption>The dashboard in action with Traefik listening to 3 different providers</figcaption>
+    <img src="../../assets/img/dashboard-main.png" alt="Dashboard - Providers" />
+    <figcaption>The dashboard in action with Traefik listening to 3 different providers</figcaption>
 </figure>
 
 <figure>
-   <img src="../../assets/img/dashboard-health.png" alt="Dashboard - Health" />
-   <figcaption>The dashboard shows the health of the system.</figcaption>
+    <img src="../../assets/img/dashboard-health.png" alt="Dashboard - Health" />
+    <figcaption>The dashboard shows the health of the system.</figcaption>
 </figure>
 
 By default, the dashboard is available on `/` on port `:8080`.

docs/content/operations/debug-mode.md

@@ -1,15 +0,0 @@
-# The Debug Mode
-
-Getting More Information (Not For Production)
-{: .subtitle }
-
-The debug mode will make Traefik be _extremely_ verbose in its logs, and is NOT intended for production purposes.
-
-## Configuration Example
-
-??? example "TOML -- Enabling the Debug Mode"
-
-    ```toml
-    [Global]
-       debug = true
-    ```

docs/content/operations/ping.md

@@ -5,52 +5,16 @@ Checking the Health of Your Traefik Instances
 
 ## Configuration Examples
 
-??? example "Enabling /ping on the http EntryPoint"
+??? example "Enabling /ping"
 
     ```toml
-    [entrypoints]
-       [entrypoints.web]
-          address = ":80"
-    
     [ping]
-      entryPoint = "http"
     ```
 
-??? example "Enabling /ping on the https EntryPoint"
-
-    ```toml
-    [entrypoints]
-       [entrypoints.web]
-          address = ":80"
-
-      [entrypoints.web-secure]
-         address = ":443"
-         [entrypoints.web-secure.tls]   
-    
-    [ping]
-      entryPoint = "https"
-    ```
-
-??? example "Enabling /ping on a dedicated EntryPoint"
-    
-    ```toml    
-    [entrypoints]
-      [entrypoints.web]
-        address = ":80"
-      
-      [entrypoints.ping]
-        address = ":8082"
-    
-    [ping]
-        entryPoint = "ping"
-    ```
-
-| Path    | Method        | Description                                                                                        |
-|---------|---------------|----------------------------------------------------------------------------------------------------|
+| Path    | Method        | Description                                                                                         |
+|---------|---------------|-----------------------------------------------------------------------------------------------------|
 | `/ping` | `GET`, `HEAD` | A simple endpoint to check for Traefik process liveness. Return a code `200` with the content: `OK` |
 
 ## Configuration Options
 
-The `/ping` health-check URL is enabled with the command-line `--ping` or config file option `[ping]`.
-
-You can customize the `entryPoint` where the `/ping` is active with the `entryPoint` option (default value: `traefik`)
+The `/ping` health-check URL is enabled with the command-line `--ping` or config file option `[ping]`.

docs/content/providers/crd_ingress_route.yml

@@ -11,3 +11,18 @@ spec:
     plural: ingressroutes
     singular: ingressroute
   scope: Namespaced
+
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: ingressroutetcps.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: IngressRouteTCP
+    plural: ingressroutetcps
+    singular: ingressroutetcp
+  scope: Namespaced

docs/content/providers/crd_tls_option.yml

@@ -0,0 +1,13 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: tlsoptions.traefik.containo.us
+
+spec:
+  group: traefik.containo.us
+  version: v1alpha1
+  names:
+    kind: TLSOption
+    plural: tlsoptions
+    singular: tlsoption
+  scope: Namespaced

docs/content/providers/docker.md

@@ -15,10 +15,18 @@ Attach labels to your containers and let Traefik do the rest!
 ??? example "Configuring Docker & Deploying / Exposing Services"
 
     Enabling the docker provider
-
-    ```toml
-    [docker]
-    endpoint = "unix:///var/run/docker.sock"
+    
+    ```toml tab="File (TOML)"
+    [providers.docker]
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      docker: {}
+    ```
+    
+    ```bash tab="CLI"
+    --providers.docker
     ```
 
     Attaching labels to containers (in your docker compose file)
@@ -29,23 +37,38 @@ Attach labels to your containers and let Traefik do the rest!
       my-container:
         # ...
         labels:
-          - traefik.http.services.my-container.rule=Host(my-domain)
+          - traefik.http.routers.my-container.rule=Host(`my-domain`)
     ```
 
 ??? example "Configuring Docker Swarm & Deploying / Exposing Services"
 
     Enabling the docker provider (Swarm Mode)
 
-    ```toml
-    [docker]
-    # swarm classic (1.12-)
-    # endpoint = "tcp://127.0.0.1:2375"
-    # docker swarm mode (1.12+)
-    endpoint = "tcp://127.0.0.1:2377"
-    swarmMode = true
+    ```toml tab="File (TOML)"
+    [providers.docker]
+      # swarm classic (1.12-)
+      # endpoint = "tcp://127.0.0.1:2375"
+      # docker swarm mode (1.12+)
+      endpoint = "tcp://127.0.0.1:2377"
+      swarmMode = true
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      docker:
+        # swarm classic (1.12-)
+        # endpoint = "tcp://127.0.0.1:2375"
+        # docker swarm mode (1.12+)
+        endpoint: "tcp://127.0.0.1:2375"
+        swarmMode: true
+    ```
+    
+    ```bash tab="CLI"
+    --providers.docker.endpoint="tcp://127.0.0.1:2375"
+    --providers.docker.swarmMode
     ```
 
-    Attaching labels to containers (in your docker compose file)
+    Attach labels to services (not to containers) while in Swarm mode (in your docker compose file)
 
     ```yaml
     version: "3"
@@ -53,19 +76,36 @@ Attach labels to your containers and let Traefik do the rest!
       my-container:
         deploy:
           labels:
-            - traefik.http.services.my-container.rule=Host(my-domain)
+            - traefik.http.routers.my-container.rule=Host(`my-domain`)
     ```
 
     !!! important "Labels in Docker Swarm Mode"
-        If you use a compose file with the Swarm mode, labels should be defined in the `deploy` part of your service.
+        While in Swarm Mode, Traefik uses labels found on services, not on individual containers. Therefore, if you use a compose file with Swarm Mode, labels should be defined in the `deploy` part of your service.
         This behavior is only enabled for docker-compose version 3+ ([Compose file reference](https://docs.docker.com/compose/compose-file/#labels-1)).
 
 ## Provider Configuration Options
 
 !!! tip "Browse the Reference"
-    If you're in a hurry, maybe you'd rather go through the [Docker Reference](../reference/providers/docker.md).
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/docker.md) configuration references.
 
-### endpoint
+### `endpoint`
+
+_Required, Default="unix:///var/run/docker.sock"_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  endpoint = "unix:///var/run/docker.sock"
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+```
+
+```bash tab="CLI"
+--providers.docker.endpoint="unix:///var/run/docker.sock"
+```
 
 Traefik requires access to the docker socket to get its dynamic configuration.
 
@@ -86,7 +126,7 @@ Traefik requires access to the docker socket to get its dynamic configuration.
         - [KubeCon EU 2018 Keynote, Running with Scissors, from Liz Rice](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
         - [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html)
         - [A thread on Stack Overflow about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
-        - [To Dind or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
+        - [To DinD or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
 
 ??? tip "Security Compensation"
 
@@ -94,14 +134,10 @@ Traefik requires access to the docker socket to get its dynamic configuration.
     It allows different implementation levels of the [AAA (Authentication, Authorization, Accounting) concepts](https://en.wikipedia.org/wiki/AAA_(computer_security)), depending on your security assessment:
 
     - Authentication with Client Certificates as described in ["Protect the Docker daemon socket."](https://docs.docker.com/engine/security/https/)
-
     - Authorization with the [Docker Authorization Plugin Mechanism](https://docs.docker.com/engine/extend/plugins_authorization/)
-
     - Accounting at networking level, by exposing the socket only inside a Docker private network, only available for Traefik.
-
     - Accounting at container level, by exposing the socket on a another container than Traefik's.
       With Swarm mode, it allows scheduling of Traefik on worker nodes, with only the "socket exposer" container on the manager nodes.
-
     - Accounting at kernel level, by enforcing kernel calls with mechanisms like [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux), to only allows an identified set of actions for Traefik's process (or the "socket exposer" process).
 
     ??? tip "Additional Resources"
@@ -124,7 +160,7 @@ Traefik requires access to the docker socket to get its dynamic configuration.
     services:
 
       traefik:
-         image: traefik
+         image: traefik:v2.0 # The official v2.0 Traefik docker image
          ports:
            - "80:80"
          volumes:
@@ -133,24 +169,57 @@ Traefik requires access to the docker socket to get its dynamic configuration.
 
     We specify the docker.sock in traefik's configuration file.
 
-    ```toml
+    ```toml tab="File (TOML)"
+    [providers.docker]
+      endpoint = "unix:///var/run/docker.sock"
+      # ...
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      docker:
+        endpoint: "unix:///var/run/docker.sock"
+         # ...
+    ```
+    
+    ```bash tab="CLI"
+    --providers.docker.endpoint="unix:///var/run/docker.sock"
     # ...
-    [providers]
-       [providers.docker]
-          endpoint = "unix:///var/run/docker.sock"
     ```
 
-### usebindportip (_Optional_, _Default=false_)
+### `useBindPortIP`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  useBindPortIP = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    useBindPortIP: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.useBindPortIP=true
+# ...
+```
 
 Traefik routes requests to the IP/Port of the matching container.
-When setting `usebindportip=true`, you tell Traefik to use the IP/Port attached to the container's _binding_ instead of its inner network IP/Port.
+When setting `useBindPortIP=true`, you tell Traefik to use the IP/Port attached to the container's _binding_ instead of its inner network IP/Port.
 
-When used in conjunction with the `traefik.port` label (that tells Traefik to route requests to a specific port), Traefik tries to find a binding on port `traefik.port`.
-If it can't find such a binding, Traefik falls back on the internal network IP of the container, but still uses the `traefik.port` that is set in the label.
+When used in conjunction with the `traefik.http.services.XXX.loadbalancer.server.port` label (that tells Traefik to route requests to a specific port),
+Traefik tries to find a binding on port `traefik.http.services.XXX.loadbalancer.server.port`.
+If it can't find such a binding, Traefik falls back on the internal network IP of the container,
+but still uses the `traefik.http.services.XXX.loadbalancer.server.port` that is set in the label.
 
 ??? example "Examples of `usebindportip` in different situations."
 
-    | traefik.port label | Container's binding                                | Routes to      |
+    | port label         | Container's binding                                | Routes to      |
     |--------------------|----------------------------------------------------|----------------|
     |          -         |           -                                        | IntIP:IntPort  |
     |          -         | ExtPort:IntPort                                    | IntIP:IntPort  |
@@ -163,55 +232,221 @@ If it can't find such a binding, Traefik falls back on the internal network IP o
     !!! note
         In the above table, ExtIp stands for "external IP found in the binding", IntIp stands for "internal network container's IP", ExtPort stands for "external Port found in the binding", and IntPort stands for "internal network container's port."
 
-### exposedByDefault (_Optional_, _Default=true_)
+### `exposedByDefault`
+
+_Optional, Default=true_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  exposedByDefault = false
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    exposedByDefault: false
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.exposedByDefault=false
+# ...
+```
 
 Expose containers by default through Traefik.
 If set to false, containers that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.
 
-### network (_Optional_)
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+### `network`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  network = "test"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    network: test
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.network=test
+# ...
+```
 
 Defines a default docker network to use for connections to all containers.
 
 This option can be overridden on a container basis with the `traefik.docker.network` label.
 
-### domain (_Optional_, _Default=docker.localhost_)
+### `defaultRule`
 
-This is the default base domain used for the router rules.
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
 
-This option can be overridden on a container basis with the
-`traefik.domain` label.
+```toml tab="File (TOML)"
+[providers.docker]
+  defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+  # ...
+```
 
-### swarmMode (_Optional_, _Default=false_)
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+# ...
+```
+
+For a given container if no routing rule was defined by a label, it is defined by this defaultRule instead.
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+The container service name can be accessed as the `Name` identifier,
+and the template has access to all the labels defined on this container.
+
+### `swarmMode`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  swarmMode = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    swarmMode: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.swarmMode
+# ...
+```
 
 Activates the Swarm Mode.
 
-### swarmModeRefreshSeconds (_Optional_, _Default=15_)
+### `swarmModeRefreshSeconds`
+
+_Optional, Default=15_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  swarmModeRefreshSeconds = "30s"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    swarmModeRefreshSeconds: "30s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.swarmModeRefreshSeconds=30s
+# ...
+```
 
 Defines the polling interval (in seconds) in Swarm Mode.
 
+### `constraints`
+
+_Optional, Default=""_
+
+```toml tab="File (TOML)"
+[providers.docker]
+  constraints = "Label(`a.label.name`, `foo`)"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  docker:
+    constraints: "Label(`a.label.name`, `foo`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.docker.constraints="Label(`a.label.name`, `foo`)"
+# ...
+```
+
+Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
+That is to say, if none of the container's labels match the expression, no route for the container is created.
+If the expression is empty, all detected containers are included.
+
+The expression syntax is based on the `Label("key", "value")`, and `LabelRegexp("key", "value")` functions, as well as the usual boolean logic, as shown in examples below.
+
+??? example "Constraints Expression Examples"
+
+    ```toml
+    # Includes only containers having a label with key `a.label.name` and value `foo`
+    constraints = "Label(`a.label.name`, `foo`)"
+    ```
+    
+    ```toml
+    # Excludes containers having any label with key `a.label.name` and value `foo`
+    constraints = "!Label(`a.label.name`, `value`)"
+    ```
+    
+    ```toml
+    # With logical AND.
+    constraints = "Label(`a.label.name`, `valueA`) && Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical OR.
+    constraints = "Label(`a.label.name`, `valueA`) || Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical AND and OR, with precedence set by parentheses.
+    constraints = "Label(`a.label.name`, `valueA`) && (Label(`another.label.name`, `valueB`) || Label(`yet.another.label.name`, `valueC`))"
+    ```
+    
+    ```toml
+    # Includes only containers having a label with key `a.label.name` and a value matching the `a.+` regular expression.
+    constraints = "LabelRegexp(`a.label.name`, `a.+`)"
+    ```
+
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
 ## Routing Configuration Options
 
 ### General
 
 Traefik creates, for each container, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).
 
-The Service automatically gets a server per instance of the container, and the router gets a default rule attached to it, based on the container name.
+The Service automatically gets a server per instance of the container,
+and the router automatically gets a rule defined by defaultRule (if no rule for it was defined in labels).
 
 ### Routers
 
-To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change. For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.
+To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.http.routers.{name-of-your-choice}.` and followed by the option you want to change. For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.
 
 Every [Router](../routing/routers/index.md) parameter can be updated this way.
 
 ### Services
 
-To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change. For example, to change the load balancer method, you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.method=drr`.
+To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`, followed by the option you want to change. For example, to change the passhostheader behavior, you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.
 
 Every [Service](../routing/services/index.md) parameter can be updated this way.
 
 ### Middleware
 
-You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`schemeredirect`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.schemeredirect.scheme: https`.
+You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options. For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
 
 ??? example "Declaring and Referencing a Middleware"
 
@@ -220,27 +455,46 @@ You can declare pieces of middleware using labels starting with `traefik.http.mi
          my-container:
            # ...
            labels:
-             - traefik.http.middlewares.my-redirect.schemeredirect.scheme=https
-             - traefik.http.routers.middlewares=my-redirect
+             - traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
+             - traefik.http.routers.my-container.middlewares=my-redirect
     ```
 
 !!! warning "Conflicts in Declaration"
 
     If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
 
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TCP
+
+You can declare TCP Routers and/or Services using labels.
+
+??? example "Declaring TCP Routers and Services"
+
+    ```yaml
+       services:
+         my-container:
+           # ...
+           labels:
+             - traefik.tcp.routers.my-router.rule="HostSNI(`my-host.com`)"
+             - traefik.tcp.routers.my-router.rule.tls="true"
+             - traefik.tcp.services.my-service.loadbalancer.server.port="4123"
+    ```
+
+!!! warning "TCP and HTTP"
+
+    If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined).
+    You can declare both a TCP Router/Service and an HTTP Router/Service for the same container (but you have to do so manually).
+
 ### Specific Options
 
-#### traefik.enable
+#### `traefik.enable`
 
 You can tell Traefik to consider (or not) the container by setting `traefik.enable` to true or false.
 
 This option overrides the value of `exposedByDefault`.
 
-#### traefik.tags
-
-Sets the tags for [constraints filtering](./overview.md#constraints-configuration).
-
-#### traefik.docker.network
+#### `traefik.docker.network`
 
 Overrides the default docker network to use for connections to the container.
 
@@ -248,3 +502,10 @@ If a container is linked to several networks, be sure to set the proper network
 
 !!! warning
     When deploying a stack from a compose file `stack`, the networks defined are prefixed with `stack`.
+
+#### `traefik.docker.lbswarm`
+
+Enables Swarm's inbuilt load balancer (only relevant in Swarm Mode).
+
+If you enable this option, Traefik will use the virtual IP provided by docker swarm instead of the containers IPs.
+Which means that Traefik will not perform any kind of load balancing and will delegate this task to swarm.

docs/content/providers/file.md

@@ -3,12 +3,11 @@
 Good Old Configuration File
 {: .subtitle } 
 
-The file provider lets you define the [dynamic configuration](./overview.md) in a `toml` file.
+The file provider lets you define the [dynamic configuration](./overview.md) in a TOML or YAML file.
 You can write these configuration elements:
 
-* At the end of the main Traefik configuration file (by default: `traefik.toml`).
-* In [a dedicated file](#filename-optional)
-* In [several dedicated files](#directory-optional)
+* In [a dedicated file](#filename)
+* In [several dedicated files](#directory)
 
 !!! note
     The file provider is the default format used throughout the documentation to show samples of the configuration for many features. 
@@ -20,22 +19,38 @@ You can write these configuration elements:
 
 ??? example "Declaring Routers, Middlewares & Services"
 
-    ``` toml
-    # Enabling the file provider
-    [providers.files]
+    Enabling the file provider:
     
+    ```toml tab="File (TOML)"
+    [providers.file]
+      filename = "/my/path/to/dynamic-conf.toml"
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      file:
+        filename: "/my/path/to/dynamic-conf.yml"
+    ```
+    
+    ```bash tab="CLI"
+    --providers.file.filename=/my/path/to/dynamic_conf.toml
+    ```
+    
+    Declaring Routers, Middlewares & Services:
+    
+    ```toml tab="TOML"
     [http]
       # Add the router
       [http.routers]
         [http.routers.router0]
-          entrypoints = ["web"]
+          entryPoints = ["web"]
           middlewares = ["my-basic-auth"]
           service = "service-foo"
           rule = "Path(`foo`)"
     
         # Add the middleware
         [http.middlewares]    
-          [http.middlewares.my-basic-auth.BasicAuth]
+          [http.middlewares.my-basic-auth.basicAuth]
             users = ["test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/", 
                       "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"]
             usersFile = "etc/traefik/.htpasswd"
@@ -43,64 +58,131 @@ You can write these configuration elements:
         # Add the service
         [http.services]
           [http.services.service-foo]
-            [http.services.service-foo.LoadBalancer]
-              method = "wrr"
-              [[http.services.service-foo.LoadBalancer.Servers]]
+            [http.services.service-foo.loadBalancer]
+              [[http.services.service-foo.loadBalancer.servers]]
                 url = "http://foo/"
-                weight = 30
-              [[http.services.service-foo.LoadBalancer.Servers]]
+              [[http.services.service-foo.loadBalancer.servers]]
                 url = "http://bar/"
-                weight = 70
+    ```
+    
+    ```yaml tab="YAML"
+    http:
+      # Add the router
+      routers:
+        router0:
+          entryPoints:
+          - web
+          middlewares:
+          - my-basic-auth
+          service: service-foo
+          rule: Path(`foo`)
+      
+      # Add the middleware
+      middlewares:
+        my-basic-auth:
+          basicAuth:
+            users:
+            - test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+            - test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0
+            usersFile: etc/traefik/.htpasswd
+      
+      # Add the service
+      services:
+        service-foo:
+          loadBalancer:
+            servers:
+            - url: http://foo/
+            - url: http://bar/
+            passHostHeader: false
     ```
 
 ## Provider Configuration Options
 
 !!! tip "Browse the Reference"
-    If you're in a hurry, maybe you'd rather go through the [File Reference](../reference/providers/file.md).
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/file.md) configuration references.
+    
+### `filename`
 
-### filename (_Optional_)
+_Optional_
 
 Defines the path of the configuration file.
 
-```toml
+```toml tab="File (TOML)"
 [providers]
   [providers.file]
-    filename = "rules.toml"
+    filename = "dynamic_conf.toml"
 ```
 
-### directory (_Optional_)
+```yaml tab="File (YAML)"
+providers:
+  file:
+    filename: dynamic_conf.yml
+```
+
+```bash tab="CLI"
+--providers.file.filename=dynamic_conf.toml
+```
+
+### `directory`
+
+_Optional_
 
 Defines the directory that contains the configuration files.
 
-```toml
+```toml tab="File (TOML)"
 [providers]
   [providers.file]
     directory = "/path/to/config"
 ```
 
-### watch (_Optional_)
+```yaml tab="File (YAML)"
+providers:
+  file:
+    directory: /path/to/config
+```
+
+```bash tab="CLI"
+--providers.file.directory=/path/to/config
+```
+
+### `watch`
+
+_Optional_
 
 Set the `watch` option to `true` to allow Traefik to automatically watch for file changes.  
 It works with both the `filename` and the `directory` options.
 
-```toml
+```toml tab="File (TOML)"
 [providers]
   [providers.file]
-    filename = "rules.toml"
+    filename = "dynamic_conf.toml"
     watch = true
 ```
 
-### TOML Templating
+```yaml tab="File (YAML)"
+providers:
+  file:
+    filename: dynamic_conf.yml
+    watch: true
+```
+
+```bash tab="CLI"
+--providers.file.filename=dynamic_conf.toml
+--providers.file.watch=true
+```
+
+### Go Templating
 
 !!! warning
-    TOML templating only works along with dedicated configuration files. Templating does not work in the Traefik main configuration file.
+    Go Templating only works along with dedicated configuration files.
+    Templating does not work in the Traefik main configuration file.
 
-Traefik allows using TOML templating.  
+Traefik allows using Go templating.  
 Thus, it's possible to define easily lot of routers, services and TLS certificates as described in the file `template-rules.toml` :
 
 ??? example "Configuring Using Templating"
-
-    ```toml
+    
+    ```toml tab="TOML"
     # template-rules.toml
     [http]
     
@@ -111,7 +193,7 @@ Thus, it's possible to define easily lot of routers, services and TLS certificat
       {{ end }}  
       
       
-      [http.Services]
+      [http.services]
       {{ range $i, $e := until 100 }}
           [http.services.service{{ $e }}]
           # ...
@@ -126,24 +208,62 @@ Thus, it's possible to define easily lot of routers, services and TLS certificat
       {{ end }}  
       
       
-      [tcp.Services]
+      [tcp.services]
       {{ range $i, $e := until 100 }}
           [http.services.service{{ $e }}]
           # ...
       {{ end }}  
     
     {{ range $i, $e := until 10 }}
-    [[TLS]]
-      Store = ["my-store-foo-{{ $e }}", "my-store-bar-{{ $e }}"]
-      [TLS.Certificate]
-        CertFile = "/etc/traefik/cert-{{ $e }}.pem"
-        KeyFile = "/etc/traefik/cert-{{ $e }}.key"
+    [[tls.certificates]]
+      certFile = "/etc/traefik/cert-{{ $e }}.pem"
+      keyFile = "/etc/traefik/cert-{{ $e }}.key"
+      store = ["my-store-foo-{{ $e }}", "my-store-bar-{{ $e }}"]
     {{ end }}
     
-    [TLSConfig]
+    [tls.config]
     {{ range $i, $e := until 10 }}
-      [TLSConfig.TLS{{ $e }}]
+      [tls.config.TLS{{ $e }}]
       # ...
     {{ end }}
-    
+    ```
+    
+    ```yaml tab="YAML"
+    http:
+    
+    {{range $i, $e := until 100 }}
+      routers:
+        router{{ $e }:
+          # ...
+    {{end}}
+    
+    {{range $i, $e := until 100 }}
+      services:
+        application{{ $e }}:
+          # ...
+    {{end}}
+    
+    tcp:
+    
+    {{range $i, $e := until 100 }}
+      routers:
+        router{{ $e }:
+          # ...
+    {{end}}
+    
+    {{range $i, $e := until 100 }}
+      services:
+        service{{ $e }}:
+          # ...
+    {{end}}
+    
+    {{ range $i, $e := until 10 }}
+    tls:
+      certificates:
+      - certFile: "/etc/traefik/cert-{{ $e }}.pem"
+        keyFile: "/etc/traefik/cert-{{ $e }}.key"
+        store:
+        - "my-store-foo-{{ $e }}"
+        - "my-store-bar-{{ $e }}"
+    {{end}}
     ```

docs/content/providers/kubernetes-crd.md

@@ -3,30 +3,191 @@
 The Kubernetes Ingress Controller, The Custom Resource Way.
 {: .subtitle }
 
-[comment]: # (Link "Kubernetes Ingress controller" to ./kubernetes-ingress.md)
-
-The Traefik Kubernetes provider used to be a Kubernetes Ingress controller in the strict sense of the term; that is to say,
-it would manage access to a cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
+Traefik used to support Kubernetes only through the [Kubernetes Ingress provider](./kubernetes-ingress.md), which is a Kubernetes Ingress controller in the strict sense of the term.
 
 However, as the community expressed the need to benefit from Traefik features without resorting to (lots of) annotations,
 we ended up writing a [Custom Resource Definition](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) (alias CRD in the following) for an IngressRoute type, defined below, in order to provide a better way to configure access to a Kubernetes cluster.
 
-## Traefik IngressRoute definition
+## Provider Configuration
+
+### `endpoint`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  endpoint = "http://localhost:8080"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    endpoint = "http://localhost:8080"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.endpoint="http://localhost:8080"
+```
+
+The Kubernetes server endpoint as URL.
+
+When deployed into Kubernetes, Traefik will read the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` or `KUBECONFIG` to construct the endpoint.
+
+The access token will be looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+Both are provided mounted automatically when deployed inside Kubernetes.
+
+The endpoint may be specified to override the environment variable values inside a cluster.
+
+When the environment variables are not found, Traefik will try to connect to the Kubernetes API server with an external-cluster client.
+In this case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.
+
+### `token`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  token = "mytoken"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    token = "mytoken"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.token="mytoken"
+```
+
+Bearer token used for the Kubernetes client configuration.
+
+### `certAuthFilePath`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  certAuthFilePath = "/my/ca.crt"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    certAuthFilePath: "/my/ca.crt"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.certauthfilepath="/my/ca.crt"
+```
+
+Path to the certificate authority file.
+Used for the Kubernetes client configuration.
+
+### `namespaces`
+
+_Optional, Default: all namespaces (empty array)_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  namespaces = ["default", "production"]
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    namespaces:
+    - "default"
+    - "production"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.namespaces="default,production"
+```
+
+Array of namespaces to watch.
+
+### `labelselector`
+
+_Optional,Default: empty (process all Ingresses)_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  labelselector = "A and not B"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    labelselector: "A and not B"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.labelselector="A and not B"
+```
+
+By default, Traefik processes all Ingress objects in the configured namespaces.
+A label selector can be defined to filter on specific Ingress objects only.
+
+See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.
+
+### `ingressClass`
+
+_Optional, Default: empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesCRD]
+  ingressClass = "traefik-internal"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesCRD:
+    ingressClass: "traefik-internal"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetescrd.ingressclass="traefik-internal"
+```
+
+Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
+
+If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.
+Otherwise, Ingresses missing the annotation, having an empty value, or the value `traefik` are processed.
+
+## Resource Configuration
+
+If you're in a hurry, maybe you'd rather go through the [dynamic](../reference/dynamic-configuration/kubernetes-crd.md) configuration reference.
+
+### Traefik IngressRoute definition
 
 ```yaml
 --8<-- "content/providers/crd_ingress_route.yml"
 ```
 
-That `IngressRoute` kind can then be used to define an `IngressRoute` object, such as:
+That `IngressRoute` kind can then be used to define an `IngressRoute` object, such as in:
 
 ```yaml
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutefoo.crd
+  name: ingressroutefoo
 
 spec:
-  entrypoints:
+  entryPoints:
     - web
   routes:
   # Match is the rule corresponding to an underlying router.
@@ -42,9 +203,25 @@ spec:
     services:
     - name: whoami
       port: 80
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: ingressroutetcpfoo.crd
+
+spec:
+  entryPoints:
+    - footcp
+  routes:
+  # Match is the rule corresponding to an underlying router.
+  - match: HostSNI(`*`)
+    services:
+    - name: whoamitcp
+      port: 8080
 ```
 
-## Middleware
+### Middleware
 
 Additionally, to allow for the use of middlewares in an `IngressRoute`, we defined the CRD below for the `Middleware` kind.
 
@@ -59,9 +236,10 @@ apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
   name: stripprefix
+  namespace: foo
 
 spec:
-  stripprefix:
+  stripPrefix:
     prefixes:
       - /stripit
 
@@ -69,10 +247,10 @@ spec:
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutebar.crd
+  name: ingressroutebar
 
 spec:
-  entrypoints:
+  entryPoints:
     - web
   routes:
   - match: Host(`bar.com`) && PathPrefix(`/stripit`)
@@ -82,9 +260,70 @@ spec:
       port: 80
     middlewares:
     - name: stripprefix
+      namespace: foo
 ```
 
-## TLS
+!!! important "Cross-provider namespace"
+
+	As Kubernetes also has its own notion of namespace, one should not confuse the kubernetes namespace of a resource
+(in the reference to the middleware) with the [provider namespace](../middlewares/overview.md#provider-namespace),
+when the definition of the middleware is from another provider.
+In this context, specifying a namespace when referring to the resource does not make any sense, and will be ignored.
+
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TLS Option
+
+Additionally, to allow for the use of TLS options in an IngressRoute, we defined the CRD below for the TLSOption kind.
+More information about TLS Options is available in the dedicated [TLS Configuration Options](../../https/tls/#tls-options).
+
+```yaml
+--8<-- "content/providers/crd_tls_option.yml"
+```
+
+Once the TLSOption kind has been registered with the Kubernetes cluster or defined in the File Provider, it can then be used in IngressRoute definitions, such as:
+
+```yaml
+apiVersion: traefik.containo.us/v1alpha1
+kind: TLSOption
+metadata:
+  name: mytlsoption
+  namespace: default
+
+spec:
+  minVersion: VersionTLS12
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ingressroutebar
+
+spec:
+  entryPoints:
+    - web
+  routes:
+  - match: Host(`bar.com`) && PathPrefix(`/stripit`)
+    kind: Rule
+    services:
+    - name: whoami
+      port: 80
+  tls:
+    options: 
+      name: mytlsoption
+      namespace: default
+```
+
+!!! important "References and namespaces"
+
+    If the optional `namespace` attribute is not set, the configuration will be applied with the namespace of the IngressRoute.
+
+	Additionally, when the definition of the TLS option is from another provider,
+the cross-provider syntax (`middlewarename@provider`) should be used to refer to the TLS option,
+just as in the [middleware case](../middlewares/overview.md#provider-namespace).
+Specifying a namespace attribute in this case would not make any sense, and will be ignored.
+
+### TLS
 
 To allow for TLS, we made use of the `Secret` kind, as it was already defined, and it can be directly used in an `IngressRoute`:
 
@@ -102,7 +341,7 @@ data:
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: ingressroutetls.crd
+  name: ingressroutetls
 
 spec:
   entryPoints:
@@ -117,6 +356,6 @@ spec:
     secretName: supersecret
 ```
 
-## Full reference example
+## Further
 
-[Traefik IngressRoute Reference](../reference/providers/kubernetescrd.md).
+Also see the [full example](../user-guides/crd-acme/index.md) with Let's Encrypt.

docs/content/providers/kubernetes-ingress.md

@@ -1,6 +1,310 @@
 # Traefik & Kubernetes
 
-Kubernetes Ingress.
+The Kubernetes Ingress Controller.
 {: .subtitle }
 
-TODO
+The Traefik Kubernetes Ingress provider is a Kubernetes Ingress controller; that is to say,
+it manages access to a cluster services by supporting the [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) specification.
+
+## Enabling and using the provider
+
+As usual, the provider is enabled through the static configuration:
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress: {}
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress
+```
+
+The provider then watches for incoming ingresses events, such as the example below, and derives the corresponding dynamic configuration from it, which in turn will create the resulting routers, services, handlers, etc.
+
+```yaml tab="File (YAML)"
+kind: Ingress
+apiVersion: extensions/v1beta1
+metadata:
+  name: "foo"
+  namespace: production
+
+spec:
+  rules:
+  - host: foo.com
+    http:
+      paths:
+      - path: /bar
+        backend:
+          serviceName: service1
+          servicePort: 80
+      - path: /foo
+        backend:
+          serviceName: service1
+          servicePort: 80
+```
+
+## Provider Configuration Options
+
+!!! tip "Browse the Reference"
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) configuration reference.
+
+### `endpoint`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  endpoint = "http://localhost:8080"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    endpoint = "http://localhost:8080"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.endpoint="http://localhost:8080"
+```
+
+The Kubernetes server endpoint as URL, which is only used when the behavior based on environment variables described below does not apply.
+
+When deployed into Kubernetes, Traefik reads the environment variables `KUBERNETES_SERVICE_HOST` and `KUBERNETES_SERVICE_PORT` or `KUBECONFIG` to construct the endpoint.
+
+The access token is looked up in `/var/run/secrets/kubernetes.io/serviceaccount/token` and the SSL CA certificate in `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`.
+They are both provided automatically as mounts in the pod where Traefik is deployed.
+
+When the environment variables are not found, Traefik tries to connect to the Kubernetes API server with an external-cluster client.
+In which case, the endpoint is required.
+Specifically, it may be set to the URL used by `kubectl proxy` to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.
+
+### `token`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  token = "mytoken"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    token = "mytoken"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.token="mytoken"
+```
+
+Bearer token used for the Kubernetes client configuration.
+
+### `certAuthFilePath`
+
+_Optional, Default=empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  certAuthFilePath = "/my/ca.crt"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    certAuthFilePath: "/my/ca.crt"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.certauthfilepath="/my/ca.crt"
+```
+
+Path to the certificate authority file.
+Used for the Kubernetes client configuration.
+
+### `disablePassHostHeaders`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  disablePassHostHeaders = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    disablePassHostHeaders: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.disablepasshostheaders=true
+```
+
+Whether to disable PassHost Headers.
+
+### `namespaces`
+
+_Optional, Default: all namespaces (empty array)_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  namespaces = ["default", "production"]
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    namespaces:
+    - "default"
+    - "production"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.namespaces="default,production"
+```
+
+Array of namespaces to watch.
+
+### `labelSelector`
+
+_Optional,Default: empty (process all Ingresses)_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  labelSelector = "A and not B"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    labelselector: "A and not B"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.labelselector="A and not B"
+```
+
+By default, Traefik processes all Ingress objects in the configured namespaces.
+A label selector can be defined to filter on specific Ingress objects only.
+
+See [label-selectors](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors) for details.
+
+### `ingressClass`
+
+_Optional, Default: empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress]
+  ingressClass = "traefik-internal"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    ingressClass: "traefik-internal"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.ingressclass="traefik-internal"
+```
+
+Value of `kubernetes.io/ingress.class` annotation that identifies Ingress objects to be processed.
+
+If the parameter is non-empty, only Ingresses containing an annotation with the same value are processed.
+Otherwise, Ingresses missing the annotation, having an empty value, or with the value `traefik` are processed.
+
+### `ingressEndpoint`
+
+#### `hostname`
+
+_Optional, Default: empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress.ingressEndpoint]
+  hostname = "foo.com"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    ingressEndpoint:
+      hostname: "foo.com"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.ingressendpoint.hostname="foo.com"
+```
+
+Hostname used for Kubernetes Ingress endpoints.
+
+#### `ip`
+
+_Optional, Default: empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress.ingressEndpoint]
+  ip = "1.2.3.4"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    ingressEndpoint:
+      ip: "1.2.3.4"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.ingressendpoint.ip="1.2.3.4"
+```
+
+IP used for Kubernetes Ingress endpoints.
+
+#### `publishedService`
+
+_Optional, Default: empty_
+
+```toml tab="File (TOML)"
+[providers.kubernetesIngress.ingressEndpoint]
+  publishedService = "foo-service"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  kubernetesIngress:
+    ingressEndpoint:
+      publishedService: "foo-service"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.kubernetesingress.ingressendpoint.publishedservice="foo-service"
+```
+
+Published Kubernetes Service to copy status from.
+
+## Further
+
+If one wants to know more about the various aspects of the Ingress spec that Traefik supports, many examples of Ingresses definitions are located in the tests [data](https://github.com/containous/traefik/tree/v2.0/pkg/provider/kubernetes/ingress/fixtures) of the Traefik repository.

docs/content/providers/marathon.md

@@ -0,0 +1,588 @@
+# Traefik & Marathon
+
+Traefik can be configured to use Marathon as a provider.
+{: .subtitle }
+
+See also [Marathon user guide](../user-guides/marathon.md).
+
+## Configuration Examples
+
+??? example "Configuring Marathon & Deploying / Exposing Applications"
+
+    Enabling the marathon provider
+
+    ```toml tab="File (TOML)"
+    [providers.marathon]
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      marathon: {}
+    ```
+    
+    ```bash tab="CLI"
+    --providers.marathon
+    ```
+
+    Attaching labels to marathon applications
+
+    ```json
+	{
+		"id": "/whoami",
+		"container": {
+			"type": "DOCKER",
+			"docker": {
+				"image": "containous/whoami",
+				"network": "BRIDGE",
+				"portMappings": [
+					{
+						"containerPort": 80,
+						"hostPort": 0,
+						"protocol": "tcp"
+					}
+				]
+			}
+		},
+		"labels": {
+			"traefik.http.Routers.app.Rule": "PathPrefix(`/app`)"
+		}
+	}
+    ```
+
+## Provider Configuration Options
+
+!!! tip "Browse the Reference"
+    If you're in a hurry, maybe you'd rather go through the [static](../reference/static-configuration/overview.md) and the [dynamic](../reference/dynamic-configuration/marathon.md) configuration references.
+
+### `basic`
+
+_Optional_
+
+```toml tab="File (TOML)"
+[providers.marathon.basic]
+  httpBasicAuthUser = "foo"
+  httpBasicPassword = "bar"
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    basic:
+      httpBasicAuthUser: foo
+      httpBasicPassword: bar
+```
+
+```bash tab="CLI"
+--providers.marathon.basic.httpbasicauthuser="foo"
+--providers.marathon.basic.httpbasicpassword="bar"
+```
+
+Enables Marathon basic authentication.
+
+### `dcosToken`
+
+_Optional_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  dcosToken = "xxxxxx"
+  # ...
+```
+
+```toml tab="File (YAML)"
+providers:
+  marathon:
+    dcosToken: "xxxxxx"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.dcosToken="xxxxxx"
+```
+
+DCOSToken for DCOS environment.
+
+If set, it overrides the Authorization header.
+
+### `defaultRule`
+
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+# ...
+```
+
+For a given application if no routing rule was defined by a label, it is defined by this defaultRule instead.
+
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+
+The app ID can be accessed as the Name identifier,
+and the template has access to all the labels defined on this Marathon application.
+
+### `dialerTimeout`
+
+_Optional, Default=5s_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  dialerTimeout = "10s"
+  # ...
+```
+
+```toml tab="File (YAML)"
+providers:
+  marathon:
+    dialerTimeout: "10s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.dialerTimeout=10s
+```
+
+Overrides DialerTimeout.
+
+Amount of time the Marathon provider should wait before timing out,
+when trying to open a TCP connection to a Marathon master.
+
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `endpoint`
+
+_Optional, Default=http://127.0.0.1:8080_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  endpoint = "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+  # ...
+```
+
+```toml tab="File (YAML)"
+providers:
+  marathon:
+    endpoint: "http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.endpoint="http://10.241.1.71:8080,10.241.1.72:8080,10.241.1.73:8080"
+```
+
+Marathon server endpoint.
+
+You can optionally specify multiple endpoints:
+
+### `exposedByDefault`
+
+_Optional, Default=true_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  exposedByDefault = false
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    exposedByDefault: false
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.exposedByDefault=false
+# ...
+```
+
+Exposes Marathon applications by default through Traefik.
+
+If set to false, applications that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.
+
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+### `constraints`
+
+_Optional, Default=""_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  constraints = "Label(`a.label.name`, `foo`)"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    constraints: "Label(`a.label.name`, `foo`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.constraints="Label(`a.label.name`, `foo`)"
+# ...
+```
+
+Constraints is an expression that Traefik matches against the application's labels to determine whether to create any route for that application.
+That is to say, if none of the application's labels match the expression, no route for the application is created.
+In addition, the expression also matched against the application's constraints, such as described in [Marathon constraints](https://mesosphere.github.io/marathon/docs/constraints.html).
+If the expression is empty, all detected applications are included.
+
+The expression syntax is based on the `Label("key", "value")`, and `LabelRegexp("key", "value")`, as well as the usual boolean logic.
+In addition, to match against marathon constraints, the function `MarathonConstraint("field:operator:value")` can be used, where the field, operator, and value parts are joined together in a single string with the `:` separator.
+
+??? example "Constraints Expression Examples"
+
+    ```toml
+    # Includes only applications having a label with key `a.label.name` and value `foo`
+    constraints = "Label(`a.label.name`, `foo`)"
+    ```
+    
+    ```toml
+    # Excludes applications having any label with key `a.label.name` and value `foo`
+    constraints = "!Label(`a.label.name`, `value`)"
+    ```
+    
+    ```toml
+    # With logical AND.
+    constraints = "Label(`a.label.name`, `valueA`) && Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical OR.
+    constraints = "Label(`a.label.name`, `valueA`) || Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical AND and OR, with precedence set by parentheses.
+    constraints = "Label(`a.label.name`, `valueA`) && (Label(`another.label.name`, `valueB`) || Label(`yet.another.label.name`, `valueC`))"
+    ```
+    
+    ```toml
+    # Includes only applications having a label with key `a.label.name` and a value matching the `a.+` regular expression.
+    constraints = "LabelRegexp(`a.label.name`, `a.+`)"
+    ```
+
+    ```toml
+    # Includes only applications having a Marathon constraint with field `A`, operator `B`, and value `C`.
+    constraints = "MarathonConstraint(`A:B:C`)"
+    ```
+
+    ```toml
+    # Uses both Marathon constraint and application label with logical operator.
+    constraints = "MarathonConstraint(`A:B:C`) && Label(`a.label.name`, `value`)"
+    ```
+
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+### `forceTaskHostname`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  forceTaskHostname = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    forceTaskHostname: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.forceTaskHostname=true
+# ...
+```
+
+By default, a task's IP address (as returned by the Marathon API) is used as backend server if an IP-per-task configuration can be found;
+otherwise, the name of the host running the task is used.
+The latter behavior can be enforced by enabling this switch.
+
+### `keepAlive`
+
+_Optional, Default=10s_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  keepAlive = "30s"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    keepAlive: "30s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.keepAlive=30s
+# ...
+```
+
+Set the TCP Keep Alive interval for the Marathon HTTP Client.
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `respectReadinessChecks`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  respectReadinessChecks = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    respectReadinessChecks: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.respectReadinessChecks=true
+# ...
+```
+
+Applications may define readiness checks which are probed by Marathon during deployments periodically, and these check results are exposed via the API.
+Enabling respectReadinessChecks causes Traefik to filter out tasks whose readiness checks have not succeeded.
+Note that the checks are only valid at deployment times.
+
+See the Marathon guide for details.
+
+### `responseHeaderTimeout`
+
+_Optional, Default=60s_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  responseHeaderTimeout = "66s"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    responseHeaderTimeout: "66s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.responseHeaderTimeout="66s"
+# ...
+```
+
+Overrides ResponseHeaderTimeout.
+Amount of time the Marathon provider should wait before timing out,
+when waiting for the first response header from a Marathon master.
+
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration), or directly as a number of seconds.
+
+### `TLS`
+
+_Optional_
+
+```toml tab="File (TOML)"
+[providers.marathon.tls]
+  ca = "/etc/ssl/ca.crt"
+  cert = "/etc/ssl/marathon.cert"
+  key = "/etc/ssl/marathon.key"
+  insecureSkipVerify = true
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon
+    tls:
+      ca: "/etc/ssl/ca.crt"
+      cert: "/etc/ssl/marathon.cert"
+      key: "/etc/ssl/marathon.key"
+      insecureSkipVerify:  true
+```
+
+```bash tab="CLI"
+--providers.marathon.tls.ca="/etc/ssl/ca.crt"
+--providers.marathon.tls.cert="/etc/ssl/marathon.cert"
+--providers.marathon.tls.key="/etc/ssl/marathon.key"
+--providers.marathon.tls.insecureskipverify=true
+```
+
+TLS client configuration. [tls/#Config](https://golang.org/pkg/crypto/tls/#Config).
+
+### `tlsHandshakeTimeout`
+
+_Optional, Default=5s_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  responseHeaderTimeout = "10s"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    responseHeaderTimeout: "10s"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.responseHeaderTimeout="10s"
+# ...
+```
+
+Overrides TLSHandshakeTimeout.
+
+Amount of time the Marathon provider should wait before timing out,
+when waiting for the TLS handshake to complete.
+Can be provided in a format supported by [time.ParseDuration](https://golang.org/pkg/time/#ParseDuration),
+or directly as a number of seconds.
+
+### `trace`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  trace = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    trace: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.trace=true
+# ...
+```
+
+Displays additional provider logs (if available).
+
+### `watch`
+
+_Optional, Default=true_
+
+```toml tab="File (TOML)"
+[providers.marathon]
+  watch = false
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  marathon:
+    watch: false
+    # ...
+```
+
+```bash tab="CLI"
+--providers.marathon.watch=false
+# ...
+```
+
+Enables watching for Marathon changes.
+
+## Routing Configuration Options
+
+### General
+
+Traefik creates, for each Marathon application, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).
+
+The Service automatically gets a server per instance of the application,
+and the router automatically gets a rule defined by defaultRule (if no rule for it was defined in labels).
+
+### Routers
+
+To update the configuration of the Router automatically attached to the application,
+add labels starting with `traefik.http.routers.{router-name-of-your-choice}.` and followed by the option you want to change.
+For example, to change the routing rule, you could add the label ```traefik.http.routers.routername.rule=Host(`my-domain`)```.
+
+Every [Router](../routing/routers/index.md) parameter can be updated this way.
+
+### Services
+
+To update the configuration of the Service automatically attached to the container,
+add labels starting with `traefik.http.services.{service-name-of-your-choice}.`, followed by the option you want to change.
+For example, to change the passHostHeader behavior, you'd add the label `traefik.http.services.servicename.loadbalancer.passhostheader=false`.
+
+Every [Service](../routing/services/index.md) parameter can be updated this way.
+
+### Middleware
+
+You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{middleware-name-of-your-choice}.`, followed by the middleware type/options.
+For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+
+??? example "Declaring and Referencing a Middleware"
+
+    ```json
+	{
+		...
+		"labels": {
+			"traefik.http.middlewares.my-redirect.redirectscheme.scheme": "https",
+			"traefik.http.routers.my-container.middlewares": "my-redirect"
+		}
+	}
+    ```
+
+!!! warning "Conflicts in Declaration"
+
+    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### TCP
+
+You can declare TCP Routers and/or Services using labels.
+
+??? example "Declaring TCP Routers and Services"
+
+    ```json
+	{
+		...
+		"labels": {
+			"traefik.tcp.routers.my-router.rule": "HostSNI(`my-host.com`)",
+			"traefik.tcp.routers.my-router.tls": "true",
+			"traefik.tcp.services.my-service.loadbalancer.server.port": "4123"
+		}
+	}
+    ```
+
+!!! warning "TCP and HTTP"
+
+    If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (as it would by default if no TCP Router/Service is defined).
+    Both a TCP Router/Service and an HTTP Router/Service can be created for the same application, but it has to be done explicitly in the config.
+
+### Specific Options
+
+#### `traefik.enable`
+
+Setting this option controls whether Traefik exposes the application.
+It overrides the value of `exposedByDefault`.
+
+#### `traefik.marathon.ipadressidx`
+
+If a task has several IP addresses, this option specifies which one, in the list of available addresses, to select.

docs/content/providers/overview.md

@@ -26,70 +26,46 @@ Even if each provider is different, we can categorize them in four groups:
 
 Below is the list of the currently supported providers in Traefik. 
 
-| Provider                        | Type         | Configuration Type |
-|---------------------------------|--------------|--------------------|
-| [Docker](./docker.md)           | Orchestrator | Label              |
-| [File](./file.md)               | Orchestrator | Custom Annotation  |
-| [Kubernetes](kubernetes-crd.md) | Orchestrator | Custom Resource    |
-| Marathon (not yet documented)   | Orchestrator | Label              |
+| Provider                          | Type         | Configuration Type |
+|-----------------------------------|--------------|--------------------|
+| [Docker](./docker.md)             | Orchestrator | Label              |
+| [Kubernetes](./kubernetes-crd.md) | Orchestrator | Custom Resource    |
+| [Marathon](./marathon.md)         | Orchestrator | Label              |
+| [Rancher](./rancher.md)           | Orchestrator | Label              |
+| [File](./file.md)                 | Manual       | TOML format        |
 
 !!! note "More Providers"
 
-    The current version of Traefik is in development and doesn't support (yet) every provider. See the previous version (1.7) for more providers.
-    
-## Constraints Configuration
+    The current version of Traefik is in development and doesn't support (yet) every provider.
+    See the previous version (1.7) for more providers.
 
-If you want to limit the scope of Traefik service discovery, you can set constraints.
-Doing so, Traefik will create routes for containers that match these constraints only.
+<!--
+TODO (document TCP VS HTTP dynamic configuration)
+-->
 
-??? example "Containers with the api Tag"
+## Restrict the Scope of Service Discovery
 
-    ```toml
-    constraints = ["tag==api"]
-    ```
+By default Traefik will create routes for all detected containers.
 
-??? example "Containers without the api Tag"
+If you want to limit the scope of Traefik's service discovery,
+i.e. disallow route creation for some containers,
+you can do so in two different ways:
+either with the generic configuration option `exposedByDefault`,
+or with a finer granularity mechanism based on constraints.
 
-    ```toml
-    constraints = ["tag!=api"]
-    ```
-    
-??? example "Containers with tags starting with 'us-'"
+### `exposedByDefault` and `traefik.enable`
 
-    ```toml
-    constraints = ["tag==us-*"]
-    ```
+List of providers that support that feature:
 
-??? example "Multiple constraints"
+- [Docker](./docker.md#exposedbydefault)
+- [Rancher](./rancher.md#exposedbydefault)
+- [Marathon](./marathon.md#exposedbydefault)
 
-    ```toml
-    # Multiple constraints
-    #   - "tag==" must match with at least one tag
-    #   - "tag!=" must match with none of tags
-    constraints = ["tag!=us-*", "tag!=asia-*"]
-    ```
+### Constraints
 
-??? note "List of Providers that Support Constraints"
+List of providers that support constraints:
 
-    - Docker
-    - Consul K/V
-    - BoltDB
-    - Zookeeper
-    - ECS
-    - Etcd
-    - Consul Catalog
-    - Rancher
-    - Marathon
-    - Kubernetes (using a provider-specific mechanism based on label selectors)
-    
-!!! note
-
-    The constraint option belongs to the provider configuration itself.
-   
-    ??? example "Setting the Constraint Options for Docker"
-   
-        ```toml
-        [providers]
-         [providers.docker]
-            constraints = ["tag==api"]
-        ```
+- [Docker](./docker.md#constraints)
+- [Rancher](./rancher.md#constraints)
+- [Marathon](./marathon.md#constraints)
+- [Kubernetes CRD](./kubernetes-crd.md#labelselector)

docs/content/providers/rancher.md

@@ -0,0 +1,330 @@
+# Traefik & Rancher
+
+A Story of Labels, Services & Containers
+{: .subtitle }
+
+![Rancher](../assets/img/providers/rancher.png)
+
+Attach labels to your services and let Traefik do the rest!
+
+!!! important
+    This provider is specific to Rancher 1.x.
+    Rancher 2.x requires Kubernetes and does not have a metadata endpoint of its own for Traefik to query.
+    As such, Rancher 2.x users should utilize the [Kubernetes provider](./kubernetes-crd.md) directly.
+
+## Configuration Examples
+
+??? example "Configuring Rancher & Deploying / Exposing Services"
+
+    Enabling the rancher provider
+
+    ```toml tab="File (TOML)"
+    [providers.rancher]
+    ```
+    
+    ```yaml tab="File (YAML)"
+    providers:
+      rancher: {}
+    ```
+    
+    ```bash tab="CLI"
+    --providers.rancher
+    ```
+
+    Attaching labels to services
+
+    ```yaml
+    labels:
+      - traefik.http.services.my-service.rule=Host(`my-domain`)
+    ```
+
+## Provider Configuration Options
+
+??? tip "Browse the Reference"
+    If you're in a hurry, maybe you'd rather go through the configuration reference:
+    
+    ```toml tab="File (TOML)"
+    --8<-- "content/providers/rancher.toml"
+    ```
+    
+    ```yaml tab="File (YAML)"
+    --8<-- "content/providers/rancher.yml"
+    ```
+    
+    ```bash tab="CLI"
+    --8<-- "content/providers/rancher.txt"
+    ```
+
+### `exposedByDefault`
+
+_Optional, Default=true_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  exposedByDefault = false
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    exposedByDefault: false
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.exposedByDefault=false
+# ...
+```
+
+Expose Rancher services by default in Traefik.
+If set to false, services that don't have a `traefik.enable=true` label will be ignored from the resulting routing configuration.
+
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+### `defaultRule`
+
+_Optional, Default=```Host(`{{ normalize .Name }}`)```_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  defaultRule = "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    defaultRule: "Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.defaultRule="Host(`{{ .Name }}.{{ index .Labels \"customLabel\"}}`)"
+# ...
+```
+
+The default host rule for all services.
+
+For a given container if no routing rule was defined by a label, it is defined by this defaultRule instead.
+It must be a valid [Go template](https://golang.org/pkg/text/template/),
+augmented with the [sprig template functions](http://masterminds.github.io/sprig/).
+The service name can be accessed as the `Name` identifier,
+and the template has access to all the labels defined on this container.
+
+This option can be overridden on a container basis with the `traefik.http.routers.Router1.rule` label.
+
+### `enableServiceHealthFilter`
+
+_Optional, Default=true_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  enableServiceHealthFilter = false
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    enableServiceHealthFilter: false
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.enableServiceHealthFilter=false
+# ...
+```
+
+Filter services with unhealthy states and inactive states.
+
+### `refreshSeconds`
+
+_Optional, Default=15_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  refreshSeconds = 30
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    refreshSeconds: 30
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.refreshSeconds=30
+# ...
+```
+
+Defines the polling interval (in seconds).
+
+### `intervalPoll`
+
+_Optional, Default=false_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  intervalPoll = true
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    intervalPoll: true
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.intervalPoll=true
+# ...
+```
+
+Poll the Rancher metadata service for changes every `rancher.refreshSeconds`,
+which is less accurate than the default long polling technique which will provide near instantaneous updates to Traefik.
+
+### `prefix`
+
+_Optional, Default=/latest_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  prefix = "/test"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    prefix: "/test"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.prefix="/test"
+# ...
+```
+
+Prefix used for accessing the Rancher metadata service
+
+### `constraints`
+
+_Optional, Default=""_
+
+```toml tab="File (TOML)"
+[providers.rancher]
+  constraints = "Label(`a.label.name`, `foo`)"
+  # ...
+```
+
+```yaml tab="File (YAML)"
+providers:
+  rancher:
+    constraints: "Label(`a.label.name`, `foo`)"
+    # ...
+```
+
+```bash tab="CLI"
+--providers.rancher.constraints="Label(`a.label.name`, `foo`)"
+# ...
+```
+
+Constraints is an expression that Traefik matches against the container's labels to determine whether to create any route for that container.
+That is to say, if none of the container's labels match the expression, no route for the container is created.
+If the expression is empty, all detected containers are included.
+
+The expression syntax is based on the `Label("key", "value")`, and `LabelRegexp("key", "value")` functions, as well as the usual boolean logic, as shown in examples below.
+
+??? example "Constraints Expression Examples"
+
+    ```toml
+    # Includes only containers having a label with key `a.label.name` and value `foo`
+    constraints = "Label(`a.label.name`, `foo`)"
+    ```
+    
+    ```toml
+    # Excludes containers having any label with key `a.label.name` and value `foo`
+    constraints = "!Label(`a.label.name`, `value`)"
+    ```
+    
+    ```toml
+    # With logical AND.
+    constraints = "Label(`a.label.name`, `valueA`) && Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical OR.
+    constraints = "Label(`a.label.name`, `valueA`) || Label(`another.label.name`, `valueB`)"
+    ```
+    
+    ```toml
+    # With logical AND and OR, with precedence set by parentheses.
+    constraints = "Label(`a.label.name`, `valueA`) && (Label(`another.label.name`, `valueB`) || Label(`yet.another.label.name`, `valueC`))"
+    ```
+    
+    ```toml
+    # Includes only containers having a label with key `a.label.name` and a value matching the `a.+` regular expression.
+    constraints = "LabelRegexp(`a.label.name`, `a.+`)"
+    ```
+
+See also [Restrict the Scope of Service Discovery](./overview.md#restrict-the-scope-of-service-discovery).
+
+## Routing Configuration Options
+
+### General
+
+Traefik creates, for each rancher service, a corresponding [service](../routing/services/index.md) and [router](../routing/routers/index.md).
+
+The Service automatically gets a server per container in this rancher service, and the router gets a default rule attached to it, based on the service name.
+
+### Routers
+
+To update the configuration of the Router automatically attached to the container, add labels starting with `traefik.routers.{name-of-your-choice}.` and followed by the option you want to change.
+For example, to change the rule, you could add the label `traefik.http.routers.my-container.rule=Host(my-domain)`.
+
+Every [Router](../routing/routers/index.md) parameter can be updated this way.
+
+### Services
+
+To update the configuration of the Service automatically attached to the container, add labels starting with `traefik.http.services.{name-of-your-choice}.`,
+followed by the option you want to change. For example, to change the passhostheader behavior,
+you'd add the label `traefik.http.services.{name-of-your-choice}.loadbalancer.passhostheader=false`.
+
+Every [Service](../routing/services/index.md) parameter can be updated this way.
+
+### Middleware
+
+You can declare pieces of middleware using labels starting with `traefik.http.middlewares.{name-of-your-choice}.`, followed by the middleware type/options.
+For example, to declare a middleware [`redirectscheme`](../middlewares/redirectscheme.md) named `my-redirect`, you'd write `traefik.http.middlewares.my-redirect.redirectscheme.scheme: https`.
+
+??? example "Declaring and Referencing a Middleware"
+    
+    ```yaml
+    # ...
+    labels:
+     - traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
+     - traefik.http.routers.my-container.middlewares=my-redirect
+    ```
+
+!!! warning "Conflicts in Declaration"
+
+    If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.
+
+More information about available middlewares in the dedicated [middlewares section](../middlewares/overview.md).
+
+### Specific Options
+
+#### `traefik.enable`
+
+You can tell Traefik to consider (or not) the container by setting `traefik.enable` to true or false.
+
+This option overrides the value of `exposedByDefault`.
+
+#### Port Lookup
+
+Traefik is now capable of detecting the port to use, by following the default rancher flow.
+That means, if you just expose lets say port :1337 on the rancher ui, traefik will pick up this port and use it.

docs/content/providers/rancher.toml

@@ -0,0 +1,20 @@
+# Enable Rancher Provider.
+[providers.rancher]
+
+  # Expose Rancher services by default in Traefik.
+  exposedByDefault = true
+
+  # Enable watch Rancher changes.
+  watch = true
+
+  # Filter services with unhealthy states and inactive states.
+  enableServiceHealthFilter = true
+
+  # Defines the polling interval (in seconds).
+  refreshSeconds = true
+
+  # Poll the Rancher metadata service for changes every `rancher.refreshSeconds`, which is less accurate
+  intervalPoll = false
+
+  # Prefix used for accessing the Rancher metadata service
+  prefix = "/latest"

docs/content/providers/rancher.txt

@@ -0,0 +1,20 @@
+# Enable Rancher Provider.
+--providers.rancher
+
+# Expose Rancher services by default in Traefik.
+--providers.rancher.exposedByDefault=true
+
+# Enable watch Rancher changes.
+--providers.rancher.watch=true
+
+# Filter services with unhealthy states and inactive states.
+--providers.rancher.enableServiceHealthFilter=true
+
+# Defines the polling interval (in seconds).
+--providers.rancher.refreshSeconds=true
+
+# Poll the Rancher metadata service for changes every `rancher.refreshSeconds`, which is less accurate
+--providers.rancher.intervalPoll=false
+
+# Prefix used for accessing the Rancher metadata service
+--providers.rancher.prefix="/latest"

docs/content/providers/rancher.yml

@@ -0,0 +1,21 @@
+# Enable Rancher Provider.
+providers:
+  rancher:
+
+  # Expose Rancher services by default in Traefik.
+  exposedByDefault: true
+
+  # Enable watch Rancher changes.
+  watch: true
+
+  # Filter services with unhealthy states and inactive states.
+  enableServiceHealthFilter: true
+
+  # Defines the polling interval (in seconds).
+  refreshSeconds: true
+
+  # Poll the Rancher metadata service for changes every `rancher.refreshSeconds`, which is less accurate
+  intervalPoll: false
+
+  # Prefix used for accessing the Rancher metadata service
+  prefix: "/latest"

docs/content/reference/acme.md

@@ -1,166 +0,0 @@
-# ACME - Reference
-
-Every Options for ACME
-{: .subtitle} 
-
-## TOML
-
-```toml
-    # Sample entrypoint configuration when using ACME.
-    [entrypoints]
-      [entrypoints.web]
-      address = ":80"
-      [entrypoints.web-secure]
-      address = ":443"
-        
-    # Enable ACME (Let's Encrypt): automatic SSL.
-    [acme]
-    
-    # Email address used for registration.
-    #
-    # Required
-    #
-    email = "test@traefik.io"
-    
-    # File used for certificates storage.
-    #
-    # Optional (Deprecated)
-    #
-    #storageFile = "acme.json"
-    
-    # File or key used for certificates storage.
-    #
-    # Required
-    #
-    storage = "acme.json"
-    # or `storage = "traefik/acme/account"` if using KV store.
-    
-    # Deprecated, replaced by [acme.dnsChallenge].
-    #
-    # Optional.
-    #
-    # dnsProvider = "digitalocean"
-    
-    # Deprecated, replaced by [acme.dnsChallenge.delayBeforeCheck].
-    #
-    # Optional
-    # Default: 0
-    #
-    # delayDontCheckDNS = 0
-    
-    # If true, display debug log messages from the acme client library.
-    #
-    # Optional
-    # Default: false
-    #
-    # acmeLogging = true
-    
-    # If true, override certificates in key-value store when using storeconfig.
-    #
-    # Optional
-    # Default: false
-    #
-    # overrideCertificates = true
-    
-    # Deprecated. Enable on demand certificate generation.
-    #
-    # Optional
-    # Default: false
-    #
-    # onDemand = true
-    
-    # Enable certificate generation on frontends host rules.
-    #
-    # Optional
-    # Default: false
-    #
-    # onHostRule = true
-    
-    # CA server to use.
-    # Uncomment the line to use Let's Encrypt's staging server,
-    # leave commented to go to prod.
-    #
-    # Optional
-    # Default: "https://acme-v02.api.letsencrypt.org/directory"
-    #
-    # caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
-    
-    # KeyType to use.
-    #
-    # Optional
-    # Default: "RSA4096"
-    #
-    # Available values : "EC256", "EC384", "RSA2048", "RSA4096", "RSA8192"
-    #
-    # KeyType = "RSA4096"
-    
-    # Use a TLS-ALPN-01 ACME challenge.
-    #
-    # Optional (but recommended)
-    #
-    [acme.tlsChallenge]
-    
-    # Use a HTTP-01 ACME challenge.
-    #
-    # Optional
-    #
-    # [acme.httpChallenge]
-    
-      # EntryPoint to use for the HTTP-01 challenges.
-      #
-      # Required
-      #
-      # entryPoint = "http"
-    
-    # Use a DNS-01 ACME challenge rather than HTTP-01 challenge.
-    # Note: mandatory for wildcard certificate generation.
-    #
-    # Optional
-    #
-    # [acme.dnsChallenge]
-    
-      # DNS provider used.
-      #
-      # Required
-      #
-      # provider = "digitalocean"
-    
-      # By default, the provider will verify the TXT DNS challenge record before letting ACME verify.
-      # If delayBeforeCheck is greater than zero, this check is delayed for the configured duration in seconds.
-      # Useful if internal networks block external DNS queries.
-      #
-      # Optional
-      # Default: 0
-      #
-      # delayBeforeCheck = 0
-    
-      # Use following DNS servers to resolve the FQDN authority.
-      #
-      # Optional
-      # Default: empty
-      #
-      # resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
-    
-      # Disable the DNS propagation checks before notifying ACME that the DNS challenge is ready.
-      #
-      # NOT RECOMMENDED:
-      # Increase the risk of reaching Let's Encrypt's rate limits.
-      #
-      # Optional
-      # Default: false
-      #
-      # disablePropagationCheck = true
-    
-    # Domains list.
-    # Only domains defined here can generate wildcard certificates.
-    # The certificates for these domains are negotiated at traefik startup only.
-    #
-    # [[acme.domains]]
-    #   main = "local1.com"
-    #   sans = ["test1.local1.com", "test2.local1.com"]
-    # [[acme.domains]]
-    #   main = "local2.com"
-    # [[acme.domains]]
-    #   main = "*.local3.com"
-    #   sans = ["local3.com", "test1.test1.local3.com"]
-```