Glossary

ACME — The protocol a program uses to prove it controls a domain name and receive a certificate automatically. Let's Encrypt is the issuer almost everyone means. Chapter 7.

Backend — A real service behind the proxy: the program that actually answers. Called a server in service definitions. Chapters 4 and 10.

Basic authentication (basicAuth) — The browser's built-in name-and-password prompt, checked by a Traefik middleware against hashed entries. A lock for admin corners, not a vault. Chapter 6.

Certificate authority (CA) — Whoever signs certificates and is trusted to have checked. Public CAs certify public names; a local CA is you, signing for your own names and teaching your own devices to trust you. Chapter 7.

Dashboard — Traefik's built-in web view of its routers, services and middlewares. Chapter 8, including why it must not be left open to the network.

Docker labels — Key/value pairs on a container that the Docker provider reads as dynamic configuration: the same routers and rules, declared where the container is defined. Chapter 9.

Dynamic configuration — Everything a provider supplies and Traefik can apply without restarting: routers, services, middlewares, certificates. Chapter 2.

Entrypoint — A listening socket with a name (web, websecure) to which routers attach. Decided in static configuration. Chapter 2.

File provider — The provider that watches a folder of YAML or TOML files and applies their contents as dynamic configuration. The lab's provider. Chapters 3 and 4.

Forwarding headers — X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto and family: what Traefik tells a backend about the original visitor. Chapters 4 and 15.

Health check — Traefik periodically requesting a path on each server and removing those that fail from rotation until they pass again. Chapter 10.

Host rule — A router match on the name the visitor asked for; the basis of name-based routing. Chapters 4 and 5.

Let's Encrypt — The free public CA whose certificates Traefik can obtain and renew by itself through ACME. Chapter 7 (described, not run).

Load balancer — In Traefik, the part of a service that spreads requests across its servers, by default round robin. Chapter 10.

Middleware — A named step applied to requests between matching a router and reaching the service: headers, rewrites, authentication, redirects. Chapter 6.

Provider — A source Traefik watches for dynamic configuration: file, Docker, Kubernetes, and others. Chapter 2.

Reverse proxy — A server that takes requests addressed to it and passes them to the services behind it, so many services share one public door. Chapter 1.

Round robin — Dealing requests to servers in turn, one each, in a circle. The default load-balancing strategy. Chapter 10.

Router — A rule plus a destination: requests matching the rule go to the named service, by way of its middlewares. Chapters 2, 4 and 5.

SNI — Server Name Indication: the name a TLS client asks for at the start of the handshake, which lets one address serve many certificates. The basis of TCP routing and of picking the right certificate. Chapter 7.

Static configuration — What Traefik reads once at startup: entrypoints, providers, global switches. Changing it means restarting. Chapter 2.

Sticky session — Load-balancer setting that pins a visitor to one server with a cookie. A splint for stateful services. Chapter 10.

stripPrefix — Middleware that removes the front of a request path before the backend sees it. Chapter 6.

TLS — The encryption under HTTPS; "SSL" in older speech. Terminated at Traefik in this guide's setup, so backends speak plain HTTP behind it. Chapter 7.

Wildcard certificate — A certificate covering *.example.com: every one-level-deep name under a domain, in one certificate. Convenient for many routers; in the public world it requires a DNS-challenge ACME setup. Chapter 7's mechanism, with more names to cover.