Catchall router that returns 503 Service Unavailable response code

Traefik Traefik v2
1

Hello everybody,

This topic exists to provide an example for a catchall non-TLS router that will make unmatched requests answered by a 503 Service Unavailable response code. It could be adapted as a TLS router for HTTPS.

The example below is only a file provider version (yaml) of the configuration, thus if anyone wants to adapt it for other providers, it will be gladly welcomed.

Static configuration (traefik.yaml):

entrypoints:
  web:
    address: :80

providers:
  file:
    filename: dynamic.yaml

Dynamic configuration (dynamic.yaml):

http:
  routers:
    catchall:
      # attached only to web entryPoint
      entryPoints:
        - "web"
      # catchall rule
      rule: "PathPrefix(`/`)"
      service: unavailable
      # lowest possible priority
      # evaluated when no other router is matched
      priority: 1

  services:
    # Service that will always answer a 503 Service Unavailable response
    unavailable:
      loadBalancer:
        servers: {}
4 Likes
2

Hey @rtribotte ,

Does it work with docker swarm provider?

3

Ok, this is the solution I found for docker swarm provider:

I've just added these lines:

traefik:
    image: traefik:v2.4
    ...
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.traefik-502.entrypoints=http"
        - "traefik.http.routers.traefik-502.rule=PathPrefix(`/`)"
        - "traefik.http.routers.traefik-502.priority=1"
        - "traefik.http.services.traefik-502.loadbalancer.server.port=0"

With the above code, any not registered rule or with empty backends (without up replicas) will throw 502 instead of 404

PS: I did not define any service for that, just mapping the same traefik service to an invalid port

Full script here: Traefik fix 502 for empty backends · GitHub

1 Like
4

This not works for https

5

yeah https does not work, any idea how with https entrypoint also this can work?

6

This only works with valid TLS certs, otherwise the browser/client will show an error. So the only thing you could do is catchall on sub-domains (of one domain) via wildcard.

1 Like
7

what about someone binds my IP with his/ her domain? how to catch that?

8

You can do a catchall on https/443 with HostSNI(`*`). Traefik will use a default TLS cert. The browser will most probably show an error, but user can continue. Then catchall works as usual.

9

u mean a TCP route using HostSNI(*)?

can I use 443 again? since 443 was being used for https!