Traefik v3 Dynamic Configuration Generator
Modern Cloud Native Reverse Proxy

Traefik v3 Dynamic Configuration Generator

Construct Traefik v3 HTTP/TCP routers, middlewares (stripPrefix, basicAuth, rateLimit), services, and Let's Encrypt TLS in YAML and TOML.

Multi-Format: YAML • TOML • Docker Labels • IngressRoute
Presets:
Rule Constructor Helper
Hostname
PathPrefix
Operator
Cert Resolver (ACME)
Domains / SANs
Routers: 2•Middlewares: 3•Services: 2
# Traefik v3 Dynamic Configuration
# Generated 100% Client-Side by ToolsAA Traefik Config Generator
# Documentation: https://doc.traefik.io/traefik/v3.0/

http:
  routers:
    # Global automatic HTTP -> HTTPS redirect router
    global-http-redirect:
      entryPoints:
        - "web"
      rule: "PathPrefix(`/`)"
      middlewares:
        - "redirect-to-https"
      service: "noop@internal"
      priority: 1
    api-router:
      entryPoints:
        - "websecure"
      rule: "Host(`api.toolsaa.com`) && PathPrefix(`/v1`)"
      service: "api-service"
      priority: 100
      middlewares:
        - "strip-api-prefix"
        - "api-rate-limit"
        - "security-headers"
      tls:
        certResolver: "letsencrypt"
        domains:
          - main: "api.toolsaa.com"
    auth-router:
      entryPoints:
        - "websecure"
      rule: "Host(`api.toolsaa.com`) && PathPrefix(`/auth`)"
      service: "auth-service"
      priority: 110
      middlewares:
        - "api-rate-limit"
        - "security-headers"
      tls:
        certResolver: "letsencrypt"
        domains:
          - main: "api.toolsaa.com"

  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: "https"
        permanent: true
    strip-api-prefix:
      stripPrefix:
        prefixes:
          - "/v1"
          - "/api/v1"
        forceSlash: false
    api-rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: "1s"
    security-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: "SAMEORIGIN"
        contentTypeNosniff: true
        contentSecurityPolicy: "default-src 'self'"

  services:
    api-service:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://10.0.1.10:8080"
          - url: "http://10.0.1.11:8080"
        healthCheck:
          path: "/healthz"
          interval: "10s"
          timeout: "3s"
        sticky:
          cookie:
            name: "traefik_api_sticky"
            secure: true
            httpOnly: true
            sameSite: "lax"
    auth-service:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://10.0.1.20:4000"
        healthCheck:
          path: "/status"
          interval: "15s"
          timeout: "2s"

tls:
  options:
    default:
      minVersion: "VersionTLS12"
      sniStrict: true
      cipherSuites:
        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
Format: yaml•Lines: 109•Chars: 2829•Bytes: 2829 B
Configured Routers
2 Active Rules
Active Middlewares
3 Chains
Traefik v3.x Ready
Traefik v3.x Ready

100% Client-Side Generation

Zero server uploads or tracking. Your routing rules, upstream URLs, and credential hashes are compiled entirely inside your browser sandbox.

Traefik v3 Specification Conformance

Generates native Traefik v3 syntax including ipAllowList, multi-entrypoint arrays, backtick rules, and modern TLS cipher suites.

Multi-Format Output Pipeline

Seamlessly export to dynamic YAML, TOML, Docker Compose service labels, and Kubernetes IngressRoute Custom Resource Definitions.

Technical Reference & Architecture Guide

Traefik Config Generator — Reference Guide

Production reference and specification guide for generating Traefik v2 and v3 dynamic routing, middleware chains, and TLS configurations.

Key Parameters & Controls

rulestring

Traefik routing expression matching inbound HTTP/TCP request attributes such as Host, PathPrefix, Headers, or Method using boolean operators.

Default: Host(`api.example.com`) && PathPrefix(`/v1`)
entryPointsstring[]

Network ports and listeners defined in static Traefik configuration where this router binds to process traffic (e.g., web or websecure).

Default: ["websecure"]
certResolverstring

Identifier of the ACME certificate resolver declared in static configuration to automate Let's Encrypt TLS issuance and renewals.

Default: "letsencrypt"
healthCheckPathstring

Upstream HTTP endpoint path probed periodically by Traefik to verify backend health before dispatching load-balanced traffic.

Default: "/healthz"
passHostHeaderboolean

Determines whether Traefik preserves the client's original HTTP Host header when forwarding requests upstream to backend servers.

Default: true

Pro Tips & Best Practices

Rule Priority Optimization

When operating overlapping PathPrefix routes (e.g., /api vs /api/v2), assign an explicit integer priority to the more specific route to prevent ambiguous longest-match fallback behavior.

Middleware Order Sequence

Place redirectScheme and ipAllowList filters ahead of stripPrefix and rateLimit; stripping path prefixes early corrupts downstream authentication scopes and access log telemetry.

Sticky Cookie Security Flags

When enabling sticky sessions on TLS entrypoints, pair the service with security headers middleware to enforce HttpOnly, Secure, and SameSite=Lax flags on the affinity cookie.

Common Gotchas & Troubleshooting

Router syntax error: unexpected backtick or missing parenthesis in Host or PathPrefix rule

Wrap domain names and path prefixes in backticks (e.g., Host(`app.domain.com`)) rather than double quotes, and join distinct matchers with logical operators (&& or ||).

Upstream service returns 404 Not Found when matching PathPrefix routes

Backend containers often listen at root path (/); attach a stripPrefix middleware to the router chain to remove the matching path segment before proxying upstream.

ACME HTTP-01 challenge fails on routers assigned exclusively to websecure

ACME HTTP-01 validation requires port 80 accessibility; ensure entrypoint 'web' has an automated HTTP-to-HTTPS redirect or switch your static resolver to DNS-01 challenges.

Frequently Asked Questions

What is the syntax difference between Traefik v2 and v3 router rules?▼

Traefik v3 introduces strict syntax parsing and deprecates legacy comma-separated matcher syntax. Matchers like Host and PathPrefix must use standard function call notations joined by && or ||.

Does this generator transmit upstream backend IPs or TLS certificates to external servers?▼

No. The generator executes entirely inside your client browser JavaScript runtime. No dynamic routing YAML, backend IPs, DNS names, or credentials are sent to or stored on remote servers.

How are TCP and HTTP routers differentiated on the same entryPoint?▼

HTTP routers inspect Layer 7 request headers such as Host and Path, whereas TCP routers inspect Layer 4 SNI metadata via HostSNI(`domain.com`) or catch all non-HTTP traffic using HostSNI(`*`).

How can generated dynamic configurations be applied to Docker Compose or Kubernetes?▼

The generated dynamic YAML or TOML can be loaded via Traefik's file provider (providers.file.directory), or mapped directly into Docker container labels and Kubernetes IngressRoute custom resources.

Related Tools & Utilities

All Tools →
Caddyfile Reverse Proxy & HTTPS Configuration GeneratorDeveloper

Generate modern Caddy 2 server configurations with reverse_proxy, automatic HTTPS, compression, security headers, and basicauth.

Open tool→
Brotli & Gzip Compression Benchmark & Bandwidth Savings EstimatorDeveloper

Analyze text, CSS, and JS payloads with browser-native CompressionStream, estimating Brotli/Gzip ratios and mobile 3G/4G load times.

Open tool→
Protobuf .proto to TypeScript Interfaces & Enums ConverterDeveloper

Parse Protocol Buffers (proto2 & proto3) message definitions, enums, and nested fields into clean TypeScript interfaces.

Open tool→
OpenAPI & Swagger to Markdown API Documentation GeneratorDeveloper

Convert OpenAPI 3.0 and Swagger 2.0 JSON/YAML specifications into clean GitHub Flavored Markdown API reference documentation.

Open tool→
GraphQL SDL to Prisma Schema Converter (Models & Relations)Developer

Translate GraphQL schema definition language (SDL) object types, enums, and directives into clean Prisma ORM models and relations.

Open tool→
SQL DDL to TypeORM Entity Generator (TypeScript Entities)Developer

Convert SQL CREATE TABLE DDL statements into TypeScript TypeORM entity classes with @Column, @PrimaryGeneratedColumn, and relations.

Open tool→