Traefik ingress / reverse proxy

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

sudo emisar pack install traefik --hash sha256:7e314e1801a55405120f3428a9b588727c5e252a378648494876b2d7f972f522

• traefik.acme_cert_expiry exec low

  ACME certificate expiry (from acme.json)

  Show each ACME/Let's Encrypt certificate in acme.json with its domain and notAfter expiry date. Decodes only the public certificate (base64 PEM) through openssl — never touches the private key. Traefik auto-renews 30 days out, so anything closer than that which is NOT renewing is the thing to investigate. Read-only.

  View source on GitHub
• traefik.acme_domains exec low

  ACME certificate domains (from acme.json)

  Lists the domains (CN + SANs) Traefik holds ACME/Let's Encrypt certificates for, read from the on-disk acme.json storage (no API exposes cert state). Reads only the domain fields — never the certificate or private-key material. Use to confirm a hostname actually has an issued cert.

  View source on GitHub
• traefik.entrypoints script low

  GET /api/entrypoints

  List all configured entrypoints — name, listen address/port, and transport settings (timeouts, HTTP/2, TLS defaults). Use to confirm the front door is listening where you expect (web :80, websecure :443, etc.).

  View source on GitHub
• traefik.http_host_readiness script low

  Check whether a public host is live behind Traefik

  Check a single public host's end-to-end readiness through Traefik — the cutover preflight read. Joins /api/http/routers and /api/http/services into ONE compact verdict: is there an enabled router matching Host(`<host>`), a healthy service behind it, and at least one UP backend? Returns "host", "ready" (true only when nothing is wrong), the matched router and resolved service (name/provider/status/errors), backend counts (up/down/total) with the DOWN backend URLs, and a "failures" list of operator-readable reasons: missing_router, router_not_enabled, router_errors, missing_service, service_not_enabled, service_errors, no_up_backends, backend_down. Use this before a DNS/origin cutover instead of the raw 4 MiB inventory dumps.

  View source on GitHub
• traefik.http_middlewares script low

  GET /api/http/middlewares

  List every HTTP middleware (auth, rate-limit, headers, redirects, retries, circuit-breaker, etc.) with its config, status, and error[]. Use to confirm a middleware is configured as expected and not in error.

  View source on GitHub
• traefik.http_routers script low

  GET /api/http/routers

  List every HTTP router with its rule, entrypoints, service, middlewares, TLS config, and — critically — its status ("enabled" | "warning" | "disabled") and error[] list. To find broken routing, look for any router whose status is not "enabled" and read its error[]. Names are "<name>@<provider>" (e.g. my-router@docker).

  View source on GitHub
• traefik.http_services script low

  GET /api/http/services

  List every HTTP service with its load-balancer config, status, error[], and serverStatus — a per-backend map of URL to "UP"/"DOWN". This is the "which upstream is down?" read: a service with a DOWN server (or a non-"enabled" status) is failing health checks.

  View source on GitHub
• traefik.http_services_summary script low

  List HTTP services, compact health summary

  List every HTTP service as a compact, name-sorted health summary — the preflight-sized view of /api/http/services without its multi-megabyte load-balancer config. One row per service: name, provider, status, error_count + errors, backend counts (up/down/total), and the URLs of only the DOWN backends. Set only_unhealthy=true to return just the services that need attention (not "enabled", carrying errors, a DOWN backend, or a load-balancer with no UP backend). Use traefik.http_services for the full raw load-balancer config of a single service.

  View source on GitHub
• traefik.log_grep_4xx exec low

  Recent 4xx responses from access log

  Greps the Traefik access log for 4xx responses and tails the most recent. Matches both the JSON format (DownstreamStatus field) and the default CLF format (status code after the request line). Read-only.

  View source on GitHub
• traefik.log_grep_5xx exec low

  Recent 5xx responses from access log

  Greps the Traefik access log for 5xx responses and tails the most recent — the front-door view of backend failures. Matches both the JSON format (DownstreamStatus field) and the default CLF format. Read-only.

  View source on GitHub
• traefik.metrics script low

  GET /metrics

  Show Prometheus metrics in text exposition format (requires --metrics.prometheus=true): per-entrypoint/router/service request counts, durations, open connections, and TLS cert expiry gauges. Served on the traefik entrypoint (:8080) by default unless metrics.prometheus.entryPoint moves it.

  View source on GitHub
• traefik.overview script low

  GET /api/overview

  Show dashboard summary — counts of HTTP/TCP/UDP routers, services, and middlewares by state (enabled/warning/errored), enabled providers, and which features (metrics, tracing) are on. The fastest "is anything broken?" read before drilling into the per-router inventory.

  View source on GitHub
• traefik.ping script low

  GET /ping

  Check liveness. Returns 200 with body "OK" when healthy, or the configured terminating status (default 503) during graceful shutdown. Requires --ping=true; served on the ping entrypoint (the traefik entrypoint / :8080 by default, unless moved to a dedicated one — point TRAEFIK_URL at it then).

  View source on GitHub
• traefik.rawdata script low

  GET /api/rawdata

  Show the complete dynamic configuration as Traefik currently sees it — all routers, services, and middlewares across HTTP/TCP/UDP, each with its errors, plus the "usedBy" dependency graph tying routers to services and middlewares. The single most complete read for "what is the actual live config and what depends on what?". Larger than the per-kind endpoints.

  View source on GitHub
• traefik.tcp_routers script low

  GET /api/tcp/routers

  List every TCP router with its rule (HostSNI/...), entrypoints, service, TLS passthrough config, status, and error[]. Use for TCP/SNI routing (databases, message brokers, raw TLS) the same way http_routers covers HTTP.

  View source on GitHub
• traefik.tcp_services script low

  GET /api/tcp/services

  List every TCP service with its load-balancer/weighted config, status, and error[]. The TCP counterpart to http_services.

  View source on GitHub
• traefik.udp_routers script low

  GET /api/udp/routers

  List every UDP router (and its service binding) with status and error[]. Use for UDP entrypoints (DNS, QUIC, syslog) routing visibility. Pair with /api/udp/services via rawdata if you need the service side.

  View source on GitHub
• traefik.version script low

  GET /api/version

  Show Traefik version, codename, and build/start date. Use to confirm which release is running (v2 vs v3 behaviour) and that the API answers.

  View source on GitHub