Examples & Cookbook Overview
Browse ready-to-run configurations and production blueprints for RouteWarden across different deployment targets.
Scenario Index
| Scenario | Description | Target |
|---|---|---|
| 1. Basic Sensitive Files | Shield .env, .git, backups, and configs with custom JSON errors. | Docker Compose / Traefik |
| 2. Global EntryPoint Shield | Protect all microservices and routes automatically at the Traefik entrypoint. | Docker Compose |
| 3. Service-Level Docker Compose | Tailor rules, custom regexes, and safe allowlists per service. | Docker Compose |
| 4. IP / Subnet Whitelisting | Allow internal corporate VPNs, office IPs, and developer subnets. | Docker Compose / Traefik |
| 5. Captcha Verification Challenge | Challenge clients via Cloudflare Turnstile or hCaptcha on sensitive routes. | Docker Compose / Traefik |
| 6. Kubernetes IngressRoute | Production IngressRoute and Middleware CRD setup for Traefik Kubernetes. | Kubernetes CRD |
Production Case Studies
| Case Study | Focus & Threat Model | Protection Pattern |
|---|---|---|
| 1. Immich Dual-Router Shield | Public photo/video sharing without exposing login/admin APIs. | Dual Traefik Routers + 404 Masking |
| 2. Zero-Trust Webhooks | Secure Stripe/GitHub webhook ingress from unauthorized HTTP injection. | Provider CIDR Whitelisting + Silent Drop |
| 3. Observability & Metrics Cloaking | Prevent public harvesting of Prometheus /metrics and /actuator. | VPC / Internal Scraper IP Exemption |
| 4. CMS & WordPress Brute-Force Shield | Eliminate credential-stuffing on wp-login.php, xmlrpc.php, and /admin. | Cloudflare Turnstile / hCaptcha Challenge |
| 5. Password Vaults (Vaultwarden) | Public mobile password sync while restricting /admin to Tailscale/WireGuard. | VPN Subnet Filter + 404 Error Cloaking |
| 6. Honeypots & Staging Cloaking | Neutralize scanning bots and hide pull-request preview clusters from crawlers. | TCP RST (silentDrop) & 307 Deflection |
In-Repo Runnable Code
All examples are checked directly into the examples/ directory of the RouteWarden GitHub repository. You can clone the repo and run any scenario in seconds:
bash
git clone https://github.com/routewarden/traefik-warden.git
cd routewarden/examples/01-basic-sensitive-files
docker compose up -d