Does traefik support dynamic entrypoint

[pavanbhaskardev]

Hi everyone,

We’re trying to proxy multiple TCP connections to our databases inside a private network

# traefik.yaml
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
  ping:
    address: ":8082"
  postgres:
    address: ":5432/tcp"
  mongo:
    address: ":27017/tcp"
  mysql:
    address: ":3306/tcp"
  redis:
    address: ":6379/tcp"

ping:
  entryPoint: ping

providers:
  etcd:
    rootKey: "customers"
  file:
    filename: /dynamic/tls.yaml

api:
  dashboard: true

log:
  level: DEBUG

# ETCD Configuration
etcdctl put 'customers/tcp/routers/mongo-router/entrypoints/0' "mongo" && \
etcdctl put 'customers/tcp/routers/mongo-router/rule' 'HostSNI(`*`)' && \
etcdctl put 'customers/tcp/routers/mongo-router/service' "mongo-service" && \
etcdctl put 'customers/tcp/services/mongo-service/loadbalancer/servers/0/address' '100.67.124.124:13232'

• We don’t have TLS Termination at database level
• so we can’t specify hostname in HostSNI
• is there any way to mention port in entrypoint

etcdctl put 'customers/tcp/routers/mongo-router/entrypoints/0' "mongo:2202"

etcdctl put 'customers/tcp/routers/mongo-router/rule' 'HostSNI(`mongo.mydomain.com`)'

[bluepuma77]

Can you provide more context, what you are trying to achieve?

[pavanbhaskardev]

Hi @bluepuma77

I wanted add port-range in entrypoint

Is it possible to have a port range for an Entrypoint?

Hi community, I'd really like to open a large range of UDP ports on Traefik. I'm running Jitsi Meet (video conferencing software) behind Traefik but the video quality seems low. It's possible the this is effect by not having enough UDP ports open. The suggestion in the documentation is that you need to open 10000-20000/udp to help improve this. Is it possible to do this in traefik somehow with specifying each one as a separate entrypoint? Cheers Ric

Port Ranges for entryPoints

[bluepuma77]

It’s currently not possible, entrypoints accepts only a single port (doc).

It seems the feature request is too niche, with very little interest, so it’s not implemented by the devs to not bloat Traefik.

[pavanbhaskardev]

Thanks you,

If entrypoints are not dynamic, is there anyway to achieve this in traefik

[bluepuma77]

For every port used, you need to create a separate entrypoint in static config. And for every change in static config, you need to restart Traefik.

[pavanbhaskardev]

Thanks @bluepuma77

We’re building a platform https://dflow.sh, Open source alternative to Railway, Vercel & Heroku where users can bring there own servers and deploy Applications, Databases

• customer servers will be added to our private network.
• we’re exposing traefik instance (reverse proxy) from our side for proxying request to customer machines.
• Application level proxy (http/https) was good using traefik.
• But proxy at Database level we don’t have tls termination support at database level.
• We’ve checked if there’s any other way proxy (TCP/UDP connections) via dynamic port configuration. We got a limitation of static entrypoint configuration and traefik restart.
• Restarting traefik causes down-time to our application.

It would be nice if this is feature got added in future versions

[bluepuma77]

The challenge is that you need HostSNI to be enabled by the database protocol. I think only MongoDB does that, but MySQL, MariaDB and Postgres does not support HostSNI.

Options: use a different TCP port for every database with HostSNI(`*`). If you want this dynamic, you could implement it, Traefik is open source.

Having 10000s of ports open is probably not a good idea, as each will create an overhead of CPU and RAM usage.

Not sure if a database packet router could be implemented inside Traefik.

You probably need to use a different reverse proxy for the database connections with database routing enabled. Maybe check haproxy or envoy.