Back to Mutex Studio

Traefork

A soft-fork of Traefik, kept in sync with upstream. It precompiles additional plugins into Traefik itself.

Built on Traefik (MIT). Not affiliated with or endorsed by Traefik Labs.

Request Access

The fork

Plugins compiled into Traefik.

Traefik loads community middleware with Yaegi, a Go interpreter. Those middlewares run on every request, so the interpreter sits on the hot path: more memory, more CPU, and profiles that do not show the plugin code.

Traefork keeps the upstream tree in sync and compiles the extra plugins into the binary. The plugin source stays the same. Upstream declined shipping that workflow.

Compiled into the binary

ModSecurity, Geoblock, RealIP, CrowdSec, and Sablier are part of the Traefik build. Yaegi does not run them. A Yaegi plugin can still be loaded when it is not in this set.

Kept in sync with upstream

Each release tracks an upstream Traefik version and pins the plugins compiled into it. The fork carries the compile-in patch.

Tested as a set

The image is exercised with the compiled middlewares before it is published, including a comparison against the same stacks running under Yaegi.

What's included

Upstream Traefik, plus these plugins.

Compiled into the binary. Each release pins the upstream Traefik version and these plugin versions.

Traefik core

Upstream proxy, kept in sync

ModSecurity

WAF middleware

Geoblock

Country lookup and blocking

RealIP

Client IP from trusted proxies

CrowdSec

Bouncer, and a fork of that plugin

Sablier

Wake a service on request

Instead of Front Door

The request is the advantage.

You switch because Traefork handles the request: routing, certificates, and a security stack compiled into the ingress. In Europe, under 10 TB, a gigabyte from Front Door’s edge is $0.083 and a gigabyte from a virtual machine on routing preference Internet is $0.08.

Azure Front Door Premium

Clients
  • TLS ends at the Front Door profile
Front Door profile
  • Routing Host and path, plus a rules engine that rewrites and redirects.
  • Certificates A managed certificate owned by the profile.
  • Security Microsoft’s managed WAF and bot rules.
Kubernetes origin
  • The cluster is a backend. The route, the certificate, and the WAF live in another control plane.

Traefork

Clients
  • TLS ends on the node
One node in the cluster
  • Routing Host, path, headers, method, query. Weight, mirror, TCP.
  • Certificates ACME on the route, including a DNS-01 wildcard.
  • Security Rate limit, then ModSecurity, then CrowdSec. Compiled in.
Cluster services
  • The next hop is the service. The middleware chain is attached to that route.

Routing

A Traefik router matches host, path, headers, method, and query, then sends the request to a weighted set of services, a mirror, or a TCP service. Front Door matches host and path. Its rules engine rewrites and redirects, and an origin group can carry a weight.

Certificates

ACME runs on the ingress. The certificate is issued for that route, from an account you control, including a DNS-01 wildcard. Front Door’s managed certificate is free, and it belongs to the Front Door profile.

Security

Rate limit, ModSecurity, and CrowdSec run in that order inside the Traefork process. Each route can carry its own chain. Front Door Premium applies its managed WAF and bot rules at the edge. It does not run ModSecurity or a CrowdSec bouncer.

The bill

A quarter of the Front Door bill.

Five million requests a day, about 4 KB on the way back. That is 600 GB out. Front Door Premium is $607.80. Traefork is $143.58. The profile is $330 a month until you delete it, and every million requests is $1.50, including a request the WAF blocks. Those two meters are $555. Edge back to origin is $3. Out to clients is $49.80 from the edge and $40 from the node.

Meter Front Door Premium Traefork
Base fee $330 —
Requests $225 —
Out to clients $49.80 $40
Edge back to origin $3 —
Node, 1-year reserved — $103.58
Month $607.80 $143.58

You keep $464.22 a month, $5,571 a year. 150 million responses at about 4 KB are 600 GB, and 600 × $0.083 is $49.80. The $555 of profile and request charges is most of the Front Door bill. The published request price covers the first 250 million a month, about 8.3 million requests a day, and the requests after that are contact-us. Premium includes the managed WAF, bot rules, and the rules engine. Access logs are a separate meter when you export them: Analytics Logs in West Europe are $2.99 a gigabyte after the first 5 GB, and this log cannot use the Basic plan at $0.65. CrowdSec on the node is $0. The node is a Standard_D4s_v5, 1-year reservation. Outbound uses routing preference Internet: the first 100 GB are free, then 500 GB × $0.08.

Open Source

Licenses & compliance

Traefork redistributes Traefik and the plugins compiled into it. We comply with the license terms of every component in each image. This page summarizes the approach — the authoritative list is the NOTICE file shipped inside every release.

Component License Notes
Traefik MIT Copyright Traefik Labs. Mutex Studio is not affiliated with Traefik Labs.
Embedded plugins MIT / Apache 2.0 Per-plugin license listed in the image NOTICE file. Only permissive OSS licenses are included.
Mutex Studio additions Proprietary Image build, curation, testing, and release packaging by Mutex Studio S.L.

What we ship

  • → A NOTICE file listing every OSS component and its license
  • → Full copyright and attribution notices as required by upstream licenses
  • → Source references for all embedded open-source plugins

Trademark notice

Traefik® is a registered trademark of Traefik Labs. Traefork is an independent soft-fork of the open-source Traefik project. Use of the Traefik name refers to the upstream software, not an official Traefik Labs offering.

Need a specific plugin bundle?

Get in touch for the current image tags, embedded plugin lists, and custom bundles for your stack.

Get in touch