Advanced Routing & Traefik Features

Configure path-based routing, subdomain dispatch, HTTP redirects, basic authentication, sticky sessions, custom response headers, and wildcard SSL certificates.

---

The routes: Block

For simple applications, specifying domains: [myapp.example.com] is all you need. For fine-grained control, use the routes: block under any service in epd.yml:

servers:
  web:
    hosts: [203.0.113.10]
    port: 3000
    routes:
      # 1. Standard Domain
      - host: example.com

      # 2. Subdomain Routed to a Different Container Port
      - host: api.example.com
        port: 8080

      # 3. Path-Based Routing with Prefix Stripping
      - host: example.com
        path: /api/v1
        port: 5000
        strip_path: true

      # 4. HTTP Basic Authentication Protection
      - host: admin.example.com
        basic_auth:
          - "admin:$apr1$xyz$0123456789abcdefghijk."

      # 5. Permanent Domain Redirect (HTTP 301)
      - host: www.example.com
        redirect: https://example.com

      # 6. Temporary Redirect (HTTP 302)
      - host: promo.example.com
        redirect: https://example.com/summer-sale
        permanent: false

      # 7. Sticky Sessions for WebSockets
      - host: chat.example.com
        sticky: true

      # 8. Security & Custom Headers
      - host: secure.example.com
        headers:
          X-Frame-Options: "DENY"
          X-Content-Type-Options: "nosniff"
          Referrer-Policy: "strict-origin-when-cross-origin"

---

Route Features Breakdown

Path Routing & Prefix Stripping

Direct requests matching /docs or /api to different container ports or backend microservices. Setting strip_path: true removes the prefix before the request reaches the container:

- host: example.com
  path: /blog
  port: 8080
  strip_path: true  # Request for /blog/post-1 becomes /post-1 inside container

Basic Authentication

Protect staging environments or internal admin panels with HTTP Basic Auth:

- host: staging.example.com
  basic_auth:
    - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"

Generating Basic Auth Hashes

Generate password hashes using Apache's htpasswd:

htpasswd -nb admin mypassword

Sticky Sessions (Cookie-Based Load Balancing)

When running multiple replicas, sticky sessions ensure an individual visitor remains connected to the same replica container (essential for in-memory socket state or stateful sessions):

- host: socket.example.com
  sticky: true

---

Wildcard Certificates & DNS Challenges

Standard Let's Encrypt certificates use the http challenge on port 80. For wildcard domains (*.example.com), configure the DNS-01 challenge:

proxy:
  challenge: dns
  dns_provider: cloudflare # or hetzner
  dns_env:
    - CF_DNS_API_TOKEN

servers:
  web:
    hosts: [203.0.113.10]
    port: 3000
    routes:
      - host: "*.example.com"
        priority: 1

---

Inspecting Live Routes

To view the exact Traefik dynamic routing YAML generated on the server:

epd proxy routes

---

Next Steps

• Manage Secrets & Environment Variables
• Set up Persistent Accessories & Databases
• Learn about Multi-Provider DNS Automation