> ## Documentation Index
> Fetch the complete documentation index at: https://sitectl.libops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Traefik service commands

> Core sitectl commands for the Traefik service container.

All LibOps application stacks use Traefik for ingress. The `sitectl traefik` namespace is now intentionally small: it exposes service-level inspection, while ingress configuration is owned by the app plugin's `ingress` component.

## Status

Check the Traefik container:

```bash theme={null}
sitectl traefik status
```

## Ingress Settings

Use `sitectl set ingress ...` for settings that alter Traefik and downstream application config. The command applies the file changes immediately:

```bash theme={null}
sitectl set ingress enabled --mode http --domain localhost
sitectl set ingress enabled --mode https --domain app.example.org
sitectl set ingress enabled --mode https-letsencrypt --domain app.example.org --acme-email ops@example.org
sitectl set ingress enabled --mode https-custom --domain app.example.org
sitectl set ingress enabled --mode https-mkcert --domain app.localhost
sitectl set ingress enabled --trusted-ip 203.0.113.10/32 --max-upload-size 2G --upload-timeout 10m
```

The ingress component updates the Compose Traefik service and dynamic router files together with the application settings mapped by the active plugin. On PHP/nginx application services, `--upload-timeout` configures Traefik read timeouts, nginx client-body and FastCGI timeouts, and PHP input, execution, and FPM request-termination timeouts. PHP accepts whole seconds, so subsecond values are rounded up. For another application runtime, the Traefik limit still changes, but the setting is end to end only when that plugin also maps the runtime's supported backend timeout and proxy controls. ArchivesSpace deliberately opts out of the shared PHP/nginx application environment while retaining generic Traefik ingress changes.

## TLS Modes

Use `--mode https` for the self-hosted Cloudflare Origin CA mode. This configures Traefik for HTTPS with certificates mounted at `certs/cert.pem` and `certs/privkey.pem`; put a Cloudflare Origin CA certificate and private key at those paths before starting the stack. Managed LibOps domains use Google Certificate Manager and the LibOps Google Cloud edge; they do not use this self-hosted mode.

Use `--mode https-letsencrypt` when the hostname resolves directly to the origin and is not proxied through Cloudflare during issuance. This mode requires `--acme-email` and stores ACME state in the `acme-data` Compose volume.

Use `--mode https-custom` when you bring your own certificate pair. Drop the public certificate chain at `certs/cert.pem` and the private key at `certs/privkey.pem`.

Traefik receives read-only mounts for those two leaf files, not the whole `certs` directory. Keep CA signing keys such as `rootCA-key.pem` in that directory only when another local tool needs them; ingress convergence removes legacy directory mounts so the signing key is not exposed to the Traefik container.

Use `--mode https-mkcert` only for development-style contexts such as local, dev, test, qa, or sandbox. sitectl runs `mkcert` for the selected domain and writes the same `certs/cert.pem` and `certs/privkey.pem` files for Traefik.

## Bot Mitigation

Bot mitigation remains a component where supported by the active app plugin:

```bash theme={null}
sitectl set bot-mitigation on
```

## Reference

Show the compose service container status

```bash theme={null}
sitectl traefik status
```

| Flag        | Default   | Description          |
| ----------- | --------- | -------------------- |
| `--service` | `traefik` | Compose service name |