Traefik Warden
Stop automated scanners from finding your .env files, backup archives, and admin endpoints before they ever reach your backend.
Traefik Warden (github.com/routewarden/traefik-warden) is a lightweight, pure Go middleware plugin for Traefik v2 and v3. It acts as an in-line shield at your gateway: dropping malicious scans, neutralizing path evasion tricks, and whitelisting trusted team IPs.
What Does Traefik Warden Do?
🛡️ Block Sensitive File Scans
Automatically blocks bots searching for .env, .git, AWS keys, database dumps, and debug endpoints out of the box.
🔍 Neutralize Path Evasion
Stops sneaky URL encoding tricks like double percent-encoding (%252e), semicolon matrix parameters (/;param/.env), Windows backslashes, and null bytes.
🌍 Whitelist Trusted IPs & VPNs
Let office subnets, Tailscale, or developer IPs bypass security rules using simple CIDR rules with full X-Forwarded-For support.
⚡ Zero Dependencies & Yaegi Native
Built with 100% Go standard library. Runs cleanly inside Traefik's Yaegi runtime with zero external binary dependencies.
30-Second Quick Start
Attach the Traefik Warden middleware to your routers:
# docker-compose.yml: Global protection on entryPointservices: traefik: image: traefik:latest command: - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden" - "--experimental.plugins.routewarden.version=v1.4.2" - "--providers.docker=true" - "--entrypoints.web.address=:80" - "--entrypoints.web.http.middlewares=warden@docker" ports: - "80:80" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro labels: - "traefik.enable=true" # Global EntryPoint Shield: protects ALL services automatically - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true" - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true" # All services are now shielded automatically without router labels: webapp: image: nginx:alpine labels: - "traefik.enable=true" - "traefik.http.routers.app.rule=PathPrefix(`/`)" - "traefik.http.routers.app.entrypoints=web"Installation & Setup
Declare the Traefik Warden plugin in Traefik's static configuration or container launch arguments:
services: traefik: image: traefik:latest command: - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden" - "--experimental.plugins.routewarden.version=v1.4.2" - "--providers.docker=true" - "--entrypoints.web.address=:80" - "--entrypoints.web.http.middlewares=warden@docker" ports: - "80:80" volumes: - /var/run/docker.sock:/var/run/docker.sock:ro labels: - "traefik.enable=true" - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true" - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true"Explore the Documentation
| Guide | Description |
|---|---|
| 🚀 Getting Started | Install Traefik Warden on Traefik v2/v3 in under 5 minutes. |
| ⚙️ Configuration Reference | Static, dynamic, and container label configuration parameters. |
| 💻 Local Deployment | Test and develop plugins locally using experimental.localPlugins. |
| 🧪 Testing & CI | Verification routines, unit testing, and Docker Compose test suites. |
| 💡 Traefik Recipes & Examples | Real-world blueprints (Docker Compose, Kubernetes IngressRoute, Immich). |
| 📜 Changelog & Releases | Complete release history, breaking changes, and migration notes. |