Routes and traffic

An application route sends an HTTP request to a container. It connects a public hostname and path to the application's internal port. Traefik runs on your selected ingress nodes and handles that routing, HTTPS, and any configured middleware.

For a normal website, select ingress nodes once, add a domain and target port to the application, and enable an automatic certificate. Use the advanced options when the application needs path changes, traffic restrictions, or custom proxy behavior.

Set up cluster ingress

1. Open Fleet → cluster → Ingress & TLS.
2. Select one or more Ingress nodes. These nodes receive public HTTP traffic.
3. For automatic HTTPS, add an ACME account email.
4. Select Use Let's Encrypt production for browser-trusted certificates. Leave it unchecked only for testing.
5. Select Save and apply and wait for the operation to finish.
6. Allow TCP 80 and 443 to the selected ingress nodes, directly or through your load balancer.

One node can serve traffic directly. With several nodes, point each domain to a selected node or put your own load balancer or floating IP in front of the pool. Selecting nodes does not provision a load balancer at your hosting provider.

Every ingress setting

Only trust the actual proxies in front of your ingress. Trusting arbitrary clients lets them spoof visitor addresses used by IP rules and rate limits. When trusted-proxy routing expects a client address but it is missing, IP protection rejects the request.

The page shows ingress health, certificate mode, and any reported error. Redeploy ingress restarts Traefik while application containers continue running. Static configuration changes require that restart; do it during a suitable window because incoming requests can be interrupted.

Add your first route

1. Open the application and its Application tab.
2. In Routes, select Add route.
3. Enter Hostname, such as app.example.com, without https:// or a URL path.
4. Keep Public path at / for the whole site.
5. Enter Target port, the port the application listens on inside the container, such as 3000.
6. Choose Automatic certificate and Let's Encrypt if cluster automatic HTTPS is configured.
7. Save the application, then deploy the saved revision.
8. At your DNS provider, point the hostname to the ingress node or load-balancer address.
9. Check the saved route's DNS and certificate badges, then use Open route.

The application's process must listen on a container-reachable interface, usually 0.0.0.0, not only on 127.0.0.1.

sslip.io can generate a hostname for a known ingress address when you want to test before configuring your own domain. If there are several addresses, choose the one that should receive traffic.

Route fields

Simple view shows the common fields. Full view reveals path rewriting, middleware, and redirect controls. Switching views hides controls; it does not discard their values.

A public path is a prefix match, not an exact-match route. If you need more complex matching rules, use a manual Traefik configuration.

Path examples

Assume the incoming URL is https://example.com/api/users:

Use stripping when the app serves / but visitors should use a prefix. Use an internal path when the app expects a different prefix. The app may also need its own base-URL setting so that links, redirects, and static assets use the public path.

DNS and certificates

Built-in automatic HTTPS uses HTTP-01 validation. The domain must resolve to a configured ingress address and its port 80 must reach the cluster's ingress. Certificates are synchronized across the selected ingress nodes.

After saving a route, its status row shows DNS and certificate progress. Recheck DNS checks updated DNS records. Retry certificate retries issuance or verification after you fix a reported problem.

In Full view → DNS & certificate details, inspect resolved addresses, last DNS check, certificate issuer and expiry, last certificate check, last synchronization, and the next scheduled check.

A certificate marked active is different from merely having automatic TLS selected. The redirect option waits for verification so HTTP does not immediately send visitors to an unready HTTPS endpoint.

Use an existing certificate

1. Open Cluster → Traefik.
2. Upload the certificate chain and matching private key, for example under certs/.
3. Create a file directly inside dynamic/, such as dynamic/custom-tls.yml, referring to their mounted paths:

tls:
  certificates:
    - certFile: /etc/traefik/certs/example-fullchain.pem
      keyFile: /etc/traefik/certs/example-key.pem

4. Save the file and wait for synchronization.
5. In the application's route, choose Existing uploaded certificate, save, and deploy.
6. Check that the certificate becomes active and matches the hostname.

The certificate must cover the hostname, be valid, and have a matching key. Selecting an existing certificate does not enroll it in automatic renewal; replace it before it expires.

Use a custom resolver

Configure the resolver under certificatesResolvers in traefik.yml, supply the credentials and files required by that resolver, and redeploy ingress. Then select Custom resolver on the route and enter that resolver's name. Merely typing a name in the route does not create it.

Use a custom resolver only when you need certificate behavior outside the built-in flow. A typical public application can use the built-in Let's Encrypt setting.

Protect an application

The application's Security tab provides traffic controls without editing YAML. Save your changes, then deploy the new revision to apply them.

These controls require Upvale's default generated routing. If you manually edited the application's Traefik file, restore defaults before relying on the Security tab to change its routing.

Rate limiting

Enable Limit requests per visitor IP to reject excess requests with HTTP 429.

Limits are enforced by Traefik instances; this is not an organization-wide request quota shared across all ingress nodes. Configure trusted proxies correctly if traffic arrives through a CDN or load balancer.

Request size

Enable Limit request body size and set Maximum request body in KiB, MiB, or GiB. Requests over the limit receive HTTP 413. Disable this control for streaming uploads that should not be buffered by the proxy.

IP access policy

Enable Apply IP access rules, then select:

• Open with blocklist to accept traffic except from blocked addresses.
• Allowlist only to accept only listed addresses or ranges.

Enter individual IPs or CIDRs under Allowed IPs and ranges and Blocked IPs and ranges. Blocked ranges take priority. Keep your own client address in an allowlist if you still need to reach the site.

Security headers

Enable Security headers to add the selected response headers. They override matching headers returned by the application.

Add a custom middleware

A middleware changes or checks a request before it reaches the application, or modifies the response on the way back. Examples include compression, authentication, headers, and redirects.

To add compression:

1. Open Cluster → Traefik.
2. Create dynamic/custom-middlewares.yml.
3. Add and save:

http:
  middlewares:
    compress:
      compress: {}

4. Open the application's Routes, switch to Full view, and set Middlewares to compress@file.
5. Save and deploy the application.

The @file suffix refers to Traefik's file provider. Multiple names are comma-separated and run in the order entered. A reference to a nonexistent middleware does not create it.

Use the built-in Security tab for the common protections above. Custom middleware is useful for behavior those fields do not expose.

Edit Traefik files

The cluster Traefik tab manages files synchronized to the ingress nodes under /etc/traefik.

Files directly in dynamic/ reload automatically after synchronization. Supporting files such as certificates can live elsewhere. Edit traefik.yml for static configuration, then use Ingress & TLS → Redeploy ingress to restart with it.

Validation checks the accepted format and syntax. It is not a complete test that your upstream exists, a hostname resolves, or every Traefik option will produce the intended behavior. Check ingress health and your route after changes.

Generated and manually managed application files

The application's Traefik tab opens its routing file. Upvale creates it on the first deployment.

While it is generated, application route and Security settings update it. Saving a manual edit makes it manually managed, so later route settings do not overwrite your custom file.

Select Restore defaults to regenerate routing from the application's managed settings. This replaces custom content and queues a normal deployment. Use file revision history when you want to restore a previous manual revision instead.

Choose one editing approach for an application at a time. If a saved route or security option seems to have no effect, check whether its Traefik file is manually managed.

Compose routes

Compose services can have managed public routes while keeping their declared service networks. During Compose setup, map the HTTP service and choose the network Traefik should use to reach it. The application route still has a hostname, target port, and TLS settings.

Make changes owned by Compose through the project's Compose workflow so the preview and applied configuration remain consistent. See Managed Compose.

Common problems