RouteWarden for Traefik
RouteWarden (github.com/routewarden/traefik-warden) is an ultra-fast, zero-dependency Traefik middleware plugin built in pure Go. It acts as an in-line security shield deployed at your Traefik reverse proxy or ingress controller.
Capabilities Overview
- Automatic Probing Defense: Blocks automated vulnerability bots probing for
.env,.git,.aws/credentials, database dumps, and server diagnostic endpoints. - Path Anti-Evasion Engine: Normalizes double percent-encoding, semicolon matrix parameters, Windows/IIS backslashes, and null bytes before regex evaluation.
- IP & CIDR Whitelisting: Allows trusted corporate VPNs, office IPs, or developer subnets (
allowedIps) to bypass inspection usingX-Forwarded-For,X-Real-IP, or socketRemoteAddr. - Pure Go & Yaegi Native: 100% standard library compliance with Traefik's Yaegi dynamic interpreter. Zero external dependencies.
- Container & Orchestrator Native: Supports Docker Compose labels (global entrypoints and per-service), file dynamic configurations (YAML/TOML), and Kubernetes IngressRoute CRDs.
Quick Navigation
| Guide | Description |
|---|---|
| Getting Started | Install RouteWarden on Traefik v2/v3 in under 5 minutes. |
| Configuration Reference | Static, dynamic, and container label configuration parameters. |
| Local Deployment | Test and develop plugins locally using experimental.localPlugins. |
| Testing & CI | Verification routines, unit testing, and Docker Compose test suites. |
| Traefik Recipes & Examples | Real-world blueprints (Docker Compose, Kubernetes IngressRoute, Immich). |
Installation & Setup
Declare the RouteWarden plugin in Traefik's static configuration or container launch arguments:
services: traefik: image: traefik:v3.3 command: - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden" - "--experimental.plugins.routewarden.version=v1.2.1" - "--providers.docker=true" - "--entrypoints.web.address=:80" - "--entrypoints.web.http.middlewares=warden@docker" ports: - "80:80" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro labels: - "traefik.enable=true" - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true" - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true"30-Second Quick Start
Attach the RouteWarden middleware to your routers:
# docker-compose.yml: Global protection on entryPointservices: traefik: image: traefik:v3.3 command: - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden" - "--experimental.plugins.routewarden.version=v1.2.1" - "--providers.docker=true" - "--entrypoints.web.address=:80" - "--entrypoints.web.http.middlewares=warden@docker" ports: - "80:80" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro labels: - "traefik.enable=true" # Global EntryPoint Shield: protects ALL services automatically - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true" - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true" # All services are now shielded automatically without router labels: webapp: image: nginx:alpine labels: - "traefik.enable=true" - "traefik.http.routers.app.rule=PathPrefix(`/`)" - "traefik.http.routers.app.entrypoints=web"