middlewares

Reusable request and response policies.

`type: headers`

Set, add or remove request and response headers.

`middlewares.<name>.hsts`

Type: object

HTTP Strict Transport Security, sent on HTTPS responses only.

`middlewares.<name>.hsts.include_subdomains`

Type: boolean · Default: false

Apply the policy to all subdomains too.

`middlewares.<name>.hsts.max_age`

Type: Duration · Required

How long browsers remember the policy. 0s removes it.

`middlewares.<name>.hsts.preload`

Type: boolean · Default: false

Ask for inclusion in browser preload lists. This is hard to undo.

`middlewares.<name>.request`

Type: object · Default: {"add":{},"remove":[],"set":{}}

Changes to the request sent to the backend.

`middlewares.<name>.request.add`

Type: map of names to string

Append header values.

`middlewares.<name>.request.remove`

Type: list of string

Remove headers.

`middlewares.<name>.request.set`

Type: map of names to string

Replace headers.

`middlewares.<name>.response`

Type: object · Default: {"add":{},"remove":[],"set":{}}

Changes to the response sent to the client.

`middlewares.<name>.response.add`

Type: map of names to string

Append header values.

`middlewares.<name>.response.remove`

Type: list of string

Remove headers.

`middlewares.<name>.response.set`

Type: map of names to string

Replace headers.

`type: redirect`

Redirect to another scheme or to a URL built from a regular expression.

`middlewares.<name>.permanent`

Type: boolean · Default: false

301/308 when true, 302/307 when false (the second code of each pair is used for methods other than GET, so the method and body are kept), as in Traefik.

`middlewares.<name>.port`

Type: integer

Port for scheme redirects when it is not the scheme’s default.

`middlewares.<name>.regex`

Type: string

Regular expression matched against the full request URL.

`middlewares.<name>.replacement`

Type: string

Target URL; may use $1, ${name} groups from regex.

`middlewares.<name>.scheme`

Type: http · https

Redirect to this scheme, keeping host, path and query.

http: http://.
https: https://.

`type: rewrite`

Rewrite the path with a regular expression.

`middlewares.<name>.regex`

Type: string · Required

Regular expression matched against the path.

`middlewares.<name>.replacement`

Type: string · Required

Replacement path; may use $1, ${name} groups.

`type: strip_prefix`

Remove a path prefix before forwarding.

`middlewares.<name>.prefixes`

Type: list of string · Required

Prefixes to remove; the first that matches is used.

`type: add_prefix`

Add a path prefix before forwarding.

`middlewares.<name>.prefix`

Type: string · Required

Prefix to add, starting with /.

`type: replace_path`

Replace the whole path before forwarding.

`middlewares.<name>.path`

Type: string · Required

New path, starting with /.

`type: basic_auth`

HTTP Basic authentication with hashed passwords.

`middlewares.<name>.realm`

Type: string

Realm shown by browsers.

`middlewares.<name>.remove_header`

Type: boolean · Default: false

Remove the Authorization header before forwarding.

`middlewares.<name>.users`

Type: list of string

user:hash entries.

`middlewares.<name>.users_file`

Type: string

File with one user:hash entry per line.

`type: forward_auth`

Ask an external service (Authelia, Authentik, oauth2-proxy…) whether to allow a request.

`middlewares.<name>.address`

Type: HttpUrl · Required

Authentication endpoint. A 2xx answer allows the request; anything else is returned to the client.

`middlewares.<name>.copy_headers`

Type: list of string

Response headers of the auth service copied to the forwarded request.

`middlewares.<name>.request_headers`

Type: list of string

Request headers sent to the auth service (all when empty).

`middlewares.<name>.timeout`

Type: Duration · Default: 5s

Time allowed for the auth service. Requests fail closed on timeout.

`middlewares.<name>.trust_forward_header`

Type: boolean · Default: false

Trust X-Forwarded-* headers already present on the request.

`type: ip_allow`

Allow only these client networks.

`middlewares.<name>.cidrs`

Type: list of IpNetwork · Required

IP addresses or CIDR ranges.

`type: ip_deny`

Reject these client networks.

`middlewares.<name>.cidrs`

Type: list of IpNetwork · Required

IP addresses or CIDR ranges.

`type: rate_limit`

Token-bucket rate limiting.

`middlewares.<name>.average`

Type: integer · Required

Requests allowed per period on average.

`middlewares.<name>.burst`

Type: integer

Largest burst; defaults to average.

`middlewares.<name>.key`

Type: RateLimitKey · Default: client_ip

What to count by.

`middlewares.<name>.period`

Type: Duration · Default: 1s

Period of average.

`type: cors`

Cross-origin resource sharing.

`middlewares.<name>.allow_credentials`

Type: boolean · Default: false

Allow cookies and credentials. Not allowed together with *.

`middlewares.<name>.allowed_headers`

Type: list of string

Allowed request headers.

`middlewares.<name>.allowed_methods`

Type: list of string · Default: ["GET","HEAD","POST"]

Allowed methods.

`middlewares.<name>.allowed_origins`

Type: list of string · Required

Allowed origins (https://app.example.com) or *.

`middlewares.<name>.exposed_headers`

Type: list of string

Response headers exposed to scripts.

`middlewares.<name>.max_age`

Type: Duration

How long browsers may cache the preflight answer.

`type: compress`

Response compression.

`middlewares.<name>.algorithms`

Type: list of gzip · br · zstd · Default: ["gzip"]

Algorithms offered, in order of preference.

`middlewares.<name>.content_types`

Type: list of string

Content types to compress; common text types when empty.

`middlewares.<name>.min_size`

Type: ByteSize · Default: 1KiB

Smallest response compressed.

`type: errors`

Custom error pages.

`middlewares.<name>.file`

Type: string

Static HTML file to serve. Set this or service.

`middlewares.<name>.path`

Type: string

Path requested from service; {status} is replaced by the code.

`middlewares.<name>.service`

Type: string

Service that renders the error page. Set this or file.

`middlewares.<name>.status`

Type: list of string · Required

Status codes or ranges, e.g. 404 or 500-599.

`type: maintenance`

Maintenance mode.

`middlewares.<name>.allow`

Type: list of IpNetwork

Clients that still reach the service (e.g. your office).

`middlewares.<name>.enabled`

Type: boolean · Default: true

Turn maintenance mode on.

`middlewares.<name>.file`

Type: string

HTML page to serve.

`middlewares.<name>.retry_after`

Type: Duration

Retry-After value sent to clients.

`middlewares.<name>.status`

Type: integer · Default: 503

Status code returned.