Traefik

Use Traefik when it is already the routing layer for your container platform. Jiandu's security boundary spans both Traefik's static entry-point configuration and the dynamic router, middleware, service, and certificate configuration, so review them together.

This example uses the file provider because the security-sensitive headers remain visible in one version-controlled document. It assumes documents.example.net, a Jiandu service reachable at jiandu:8077, and a direct Traefik address of 172.30.0.2.

1. Configure Jiandu

/etc/jiandu/jiandu.json

{
  "schema_version": 1,
  "server": {
    "bind": "0.0.0.0:8077",
    "request_timeout_seconds": 30,
    "ingress": {
      "mode": "https_reverse_proxy",
      "public_origin": "https://documents.example.net",
      "trusted_proxy_cidrs": ["172.30.0.2/32"]
    }
  }
}

Pinning Traefik to a backend-network address makes the /32 stable. If your orchestrator assigns addresses dynamically, use the smallest dedicated ingress subnet it can guarantee and prevent other workloads from joining it.

2. Configure the HTTPS entry point

/etc/traefik/traefik.yml

entryPoints:
  websecure:
    address: ":443"
    forwardedHeaders:
      insecure: false

providers:
  file:
    filename: /etc/traefik/dynamic.yml
    watch: true

api:
  dashboard: false

forwardedHeaders.insecure: false prevents arbitrary incoming forwarding headers from becoming trusted metadata on the public entry point. If a CDN or load balancer precedes Traefik, configure its documented source networks under forwardedHeaders.trustedIPs; do not switch insecure to true. See Traefik's entry-point forwarding controls.

The dashboard is disabled because it is not needed to serve Jiandu. If your platform operates one, publish and authenticate it as a separate administrative service.

3. Configure the route and TLS certificate

/etc/traefik/dynamic.yml

http:
  routers:
    jiandu:
      entryPoints: [websecure]
      rule: Host(`documents.example.net`)
      service: jiandu
      middlewares: [jiandu-boundary]
      tls: {}

  middlewares:
    jiandu-boundary:
      headers:
        customResponseHeaders:
          Strict-Transport-Security: "max-age=31536000"
        customRequestHeaders:
          X-Forwarded-Proto: "https"
          X-Jiandu-Proxy-Secret: ""
          X-Auth-Subject: ""
          X-Auth-Name: ""
          X-Auth-Groups: ""

  services:
    jiandu:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: http://jiandu:8077

tls:
  certificates:
    - certFile: /etc/traefik/tls/fullchain.pem
      keyFile: /etc/traefik/tls/privkey.pem

Provide the certificate through your existing Traefik ACME resolver instead of tls.certificates when appropriate. In that case, name the resolver under the router's tls.certResolver and remove the static certificate block. Either approach must produce a certificate trusted for the exact public hostname.

Why each dynamic setting is present

Setting	Purpose and caveat
entryPoints: [websecure]	Prevents the Jiandu router from attaching to an accidental plaintext entry point.
exact Host(...) rule	Selects the same hostname as Jiandu's public_origin; avoid a broad HostRegexp rule.
tls: {}	Makes TLS mandatory for this router. A certificate resolver or configured certificate supplies the identity.
HSTS response header	Commits browsers to HTTPS for one year. It intentionally does not include subdomains or preload.
fixed X-Forwarded-Proto	Replaces a browser value with the scheme terminated on websecure.
empty identity headers	Removes client-supplied proxy secret and identity assertions. Extend the list for custom provider headers.
passHostHeader: true	Preserves the original authority for Jiandu's exact host check. This is Traefik's default, but stating it documents the boundary.
private server URL	Keeps the hop to Jiandu inside the backend network. Do not route it back through the public hostname.

Traefik derives X-Forwarded-For from the connection when insecure forwarding is disabled, so the middleware does not copy a browser-supplied value. Traefik streams ordinary requests without an Nginx-style whole-request buffering directive; if you add the buffering middleware, size its body limit above Jiandu's 8 MiB upload chunks and account for disk-backed retries. The Headers middleware and HTTP service reference cover the remaining options.

4. Validate both configurations

traefik check-config --configFile=/etc/traefik/traefik.yml
curl --fail --silent https://documents.example.net/api/v1/health/ready
curl --silent --show-error --head https://documents.example.net/ | grep -i strict-transport-security

Then verify that no host port publishes 8077. A Traefik 404 usually means the entry point or host rule did not match. A 502 points to service discovery, DNS, or the backend network. A Jiandu 421 ingress_not_allowed means the request reached Jiandu but the direct Traefik address or preserved host did not match its ingress boundary.