Swaps the nSelf reverse proxy from nginx to Traefik with route, TLS and upstream parity. Free, experimental.

nself add traefik

No license key. nself remove traefik restores the nginx setup.

nself build always writes .nself/generated/routes.json (the provider-neutral route model, contract:cli.proxy-routes v1). With this plugin installed the stack runs three services instead of nginx:

Traefik's readTimeout is per entrypoint and is one total deadline (also the only header deadline), so the 60 s of web and websecure cuts a long upload that nginx lets through. The owner ruling keeps 60 s there. The knob is a separate entrypoint upload (container port :8444) whose readTimeout is configurable and which carries routers only for the routes you name. Traefik's static file cannot read environment variables, so the renderer renders it (--static-out).

Each named route is served on upload with the same routers, chains, rules and priorities as on its normal listener (the secure listener when the route has one, else the plain one). The default server has no routers on upload: an unknown Host there gets Traefik's own 404, and so does a route that was not named. The static configuration is read at start, so changing any of these needs the stack restarted (nself restart), not only a re-render. Parity: an 80 s trickle upload to the named route passes on upload (120 s), is still cut on :80, and every other route answers 404 on :8444.

Rendered from the model: routers per (route, location) with nginx longest-prefix and exact-first ordering, security headers, blocked paths (404), deny_all (403), method restriction (403), redirects, per-zone rate limits (429) and connection limits (429), body limit (413), gzip, upstream timeouts, TLS protocols and ciphers, the default server (unknown Host on 80 redirects or answers OK; on 443 an empty 404 with no upstream reached) and the ACME webroot.

tests/parity.sh proves it in Linux containers: the same requests go through nginx (the cli golden confs) and through Traefik (the rendered file) and must return equal status, headers (minus Date and Server), body digest and TLS SAN list. Websocket upgrade is checked on both.

The renderer exits 1, names the route id and field, and writes nothing when the model holds something it cannot express: a route with unmodelled or shadowed_by, a non-empty unmodelled_global, an unknown rate zone key, limit_req without nodelay, a send timeout, a header value holding an nginx variable, a redirect target other than https://$host$request_uri, a certificate lineage that is missing, a rate zone of 0r/s or a negative burst, body limit or conn_limit (Traefik reads zero as no limit), a rate zone keyed on $http_authorization or $http_x_tenant_id (nginx skips requests without the header, Traefik would share one bucket among them), a second route serving the same server name on the same entrypoint (names compare case-insensitively, and .x counts as both x and *.x), a server name that is not ASCII as written (checked before lowercasing), more than 19999 blocked_paths in one route, a return status outside 200-599 or one of 204, 205, 304 and 444, a health_probe location restricted to a method other than GET or HEAD, a location path too long to rank below the next priority class (see Host precedence), a server name with an empty label or a last character that is not a letter or digit (a..example.test, a.example.test.: Traefik ignores a trailing dot, nginx keeps it, so the two names would be one host here), a location that sets more than one of static_root, deny_all, return and an upstream, a deny_all, return or static_root location that sets health_probe, rate_limit, timeouts or websocket (or methods, except on the ACME webroot, which keeps its GET-only restriction), two route ids that would produce the same router name, a route with neither http nor https, a wildcard server name with non-default TLS protocols or ciphers (Traefik picks TLS options by SNI from Host() rules only), a cipher list that leaves no cipher Go implements, a header name that is not a token or a value holding a control character, or any routes.json field the renderer does not model (a new restriction must never render as an unrestricted route, so the plugin is updated together with the contract). The previous dynamic.yml stays in place, so a running Traefik keeps serving the last good configuration after a refusal; watch the traefik-config exit code.

No service mounts /var/run/docker.sock or sets DOCKER_HOST; there is no Docker provider and no certificatesResolvers section. Certificates stay core-issued (ADR 0026): dynamic.yml points each certFile and keyFile at the resolved generation directory of the lineage (ssl/certificates/.<dir>.gen-<n>/), so a renewal changes the parsed configuration and the file provider reloads. ssl/ is mounted read-only in every service. The renderer only resolves the generation link and checks that fullchain.pem and privkey.pem exist (it never reads key bytes); Traefik reads them itself.

Routes the model does not carry (for example the api-docs server nginx generates) are not rendered.

free/traefik/: cmd/render (renderer and helper), internal/render (model to dynamic.yml), internal/staticcfg (static configuration and the upload entrypoint), internal/static (webroot and fixed answers), docker-compose.plugin.yml, config/traefik.yml (hand-written base, embedded by config/config.go), tests/ (fragment policy test, parity.sh, ptool), testdata/ (cli fixtures and goldens).