### Setup User and Directories

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux

Creates a dedicated system user for Traefik Hub and prepares the necessary configuration and log directories.

```bash
sudo useradd -r traefik-hub -s /usr/sbin/nologin
sudo mkdir /etc/traefik-hub
sudo touch /var/log/traefik-hub.log
sudo chown traefik-hub: /var/log/traefik-hub.log
```

--------------------------------

### Install Redis using Helm Chart

Source: https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim

Installs Redis in the 'traefik' namespace using the provided Helm chart. This is a prerequisite for the APIPlan feature. For production, consult the official Redis production installation guide.

```bash
helm install redis oci://registry-1.docker.docker.io/cloudpirates/redis -n traefik --wait  

```

--------------------------------

### Example Deployment and Service for Whoami Application (Kubernetes)

Source: https://doc.traefik.io/traefik-hub/api-gateway/expose/middleware/redirect

A Kubernetes Deployment for the 'traefik/whoami' application and a corresponding Service. This is a common setup used in Traefik examples to demonstrate routing and middleware functionality.

```yaml
kind: Deployment  
apiVersion: apps/v1  
metadata:  
  name: whoami  
  namespace: apps  
spec:  
  replicas: 1  
  selector:  
    matchLabels:  
      app: whoami  
  template:  
    metadata:  
      labels:  
        app: whoami  
    spec:  
      containers:  
      - name: whoami  
        image: traefik/whoami  
  
---  
apiVersion: v1  
kind: Service  
metadata:  
  name: whoami  
  namespace: apps  
  labels:  
    app: whoami  
spec:  
  type: ClusterIP  
  ports:  
  - port: 80  
    name: whoami  
  selector:  
    app: whoami  

```

--------------------------------

### Install Traefik Hub with MCP Gateway via Helm

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Adds the Traefik Helm repository and installs the Traefik controller with the MCP Gateway feature enabled and custom request body limits.

```bash
helm repo add traefik https://traefik.github.io/charts
helm repo update

helm install traefik traefik/traefik \
  --namespace traefik \
  --create-namespace \
  --set hub.token=<YOUR_HUB_TOKEN> \
  --set hub.mcpgateway.enabled=true \
  --set hub.mcpgateway.maxRequestBodySize=2097152
```

--------------------------------

### Install and Configure 'whoami' Application

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

This section details the installation of the 'whoami' application, a simple tool to expose HTTP requests. It involves downloading, extracting, and moving the binary, followed by creating a dedicated system user and group for the application. This prepares 'whoami' to be run as a service.

```bash
curl -L https://github.com/traefik/whoami/releases/download/v1.11.0/whoami_v1.11.0_linux_amd64.tar.gz -o /tmp/whoami.tar.gz
tar xvzf /tmp/whoami.tar.gz -C /tmp whoami
rm -f /tmp/whoami.tar.gz
sudo mv /tmp/whoami /usr/local/bin/whoami
sudo chown root:root /usr/local/bin/whoami
sudo chmod 755 /usr/local/bin/whoami
sudo groupadd --system whoami
sudo useradd \
  -g whoami --no-user-group \
  --home-dir /var/www --no-create-home \
  --shell /usr/sbin/nologin \
  --system whoami
```

--------------------------------

### Traefik Debug Log for Denied Request

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

An example Traefik debug log message indicating that a request was denied because no matching policy was found in the MCP middleware configuration.

```log
2025-10-07T13:39:51Z DBG github.com/traefik/traefik-hub/v3/hub/pkg/middleware/mcp/middleware.go:188
> The request has been denied since no policy matched middlewareName=apps-deepwiki-mcp-
gateway@kubernetescrd middlewareType=mcp

```

--------------------------------

### Generate and Manage Test JWT

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Creates a shell script to generate JWT tokens for testing authentication policies, including installation instructions for the required jwt-cli tool.

```bash
cat > generate-jwt.sh <<'SCRIPT'
#!/bin/bash
SECRET="my-super-secret-key-change-in-production"
jwt encode \
  --secret "$SECRET" \
  --exp='+1 hour' \
  '{"sub":"test-user","groups":["developer"],"email":"test@example.com"}'
SCRIPT
chmod +x generate-jwt.sh
```

```bash
# Using Homebrew (macOS/Linux)
brew install mike-engel/jwt-cli/jwt-cli

# Using cargo
cargo install jwt-cli

# Using Manjaro/Arch:
sudo pacman -S jwt-cli
```

```bash
export TEST_JWT=$(./generate-jwt.sh)
echo $TEST_JWT

# Verify the token
jwt decode $TEST_JWT
```

--------------------------------

### Enable and Start 'whoami' Service

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

This set of commands copies the systemd unit file for the 'whoami' application, sets the correct ownership and permissions, reloads the systemd daemon, and then enables and starts the 'whoami' service. Finally, it checks the status of the 'whoami' service.

```bash
sudo cp api-gateway/1-getting-started/linux/whoami.service /etc/systemd/system/whoami.service
sudo chmod 644 /etc/systemd/system/whoami.service
sudo chown root:root /etc/systemd/system/whoami.service
sudo systemctl daemon-reload
sudo systemctl enable --now whoami
sudo systemctl status whoami
```

--------------------------------

### Configure OAuth-Protected MCP Servers

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Implements passthrough OAuth for MCP servers by configuring a Service, MCP Gateway middleware, CORS middleware, and an IngressRoute. This setup requires HTTPS and specific CORS headers to support browser-based clients like the MCP Inspector.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: notion-mcp-server
  namespace: apps
spec:
  type: ExternalName
  externalName: mcp.notion.com
  ports:
    - name: https
      port: 443
      protocol: TCP
```

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: notion-mcp-gateway
  namespace: apps
spec:
  plugin:
    mcp:
      resourceMetadata:
        resource: https://notion-mcp.localhost/mcp
        authorizationServers:
          - https://mcp.notion.com
      policies:
        - match: "Equals(`mcp.method`, `tools/call`) && Equals(`mcp.params.name`, `notion-get-self`)"
          action: deny
      defaultAction: allow
```

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: notion-mcp-cors
  namespace: apps
spec:
  headers:
    accessControlAllowMethods:
      - "GET"
      - "OPTIONS"
      - "POST"
    accessControlAllowHeaders:
      - "*"
    accessControlAllowOriginList:
      - "*"
    accessControlExposeHeaders:
      - "*"
    accessControlMaxAge: 100
    addVaryHeader: true
```

```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: notion-mcp-route
  namespace: apps
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - kind: Rule
      match: Host(`notion-mcp.localhost`)
      middlewares:
        - name: notion-mcp-cors
        - name: notion-mcp-gateway
      services:
        - name: notion-mcp-server
          port: 443
          scheme: https
          passHostHeader: false
```

--------------------------------

### GRPC Request Example using grpcurl

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi

Demonstrates how to send a GRPC request to the configured echo service using the `grpcurl` command-line tool. This example shows the expected output, including headers and assertion details, after a successful GRPC call to the Echo method.

```bash
$ grpcurl -plaintext echo.localhost:80 gateway_api_conformance.echo_basic.grpcecho.GrpcEcho/Echo

{
  "assertions": {
    "fullyQualifiedMethod": "/gateway_api_conformance.echo_basic.grpcecho.GrpcEcho/Echo",
    "headers": [
      {
        "key": "x-real-ip",
        "value": "10.42.2.0"
      },
      {
        "key": "x-forwarded-server",
        "value": "traefik-74b4cf85d8-nkqqf"
      },
      {
        "key": "x-forwarded-port",
        "value": "80"
      },
      {
        "key": "x-forwarded-for",
        "value": "10.42.2.0"
      },
      {
        "key": "grpc-accept-encoding",
        "value": "gzip"
      },
      {
        "key": "user-agent",
        "value": "grpcurl/1.9.1 grpc-go/1.61.0"
      },
      {
        "key": "content-type",
        "value": "application/grpc"
      },
      {
        "key": "x-forwarded-host",
        "value": "echo.localhost:80"
      },
      {
        "key": ":authority",
        "value": "echo.localhost:80"
      },
      {
        "key": "accept-encoding",
        "value": "gzip"
      },
      {
        "key": "x-forwarded-proto",
        "value": "http"
      }
    ],
    "authority": "echo.localhost:80",
    "context": {
      "namespace": "default",
      "pod": "echo-78f76675cf-9k7rf"
    }
  }
}

```

--------------------------------

### OpenAPI Spec: Including Request/Response Examples

Source: https://doc.traefik.io/traefik-hub/reference/specs/openapi

Demonstrates how to provide meaningful examples for requests and responses within an OpenAPI specification using the `example` keyword. This enhances developer understanding of data formats for the `/forecast` endpoint.

```yaml
paths:
  /forecast:
    get:
      responses:
        '200':
          description: "Success"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Forecast"
              example:
                - location: "London"
                  temperature: 18
                  conditions: "Cloudy"
                - location: "Paris"
                  temperature: 22
                  conditions: "Sunny"

components:
  schemas:
    Forecast:
      type: object
      properties:
        location:
          type: string
          example: "London"
        temperature:
          type: integer
          example: 18
        conditions:
          type: string
          example: "Cloudy"

```

--------------------------------

### Install Docker and Docker Compose

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

Installs Docker and Docker Compose on the system. These are prerequisites for using the Docker provider in Traefik Hub.

```bash
sudo apt-get update
sudo apt-get install -y docker.io docker-compose
```

--------------------------------

### Start MCP Inspector with Docker

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Runs the MCP Inspector tool as a Docker container. This command maps necessary ports and ensures the container can access the host network.

```bash
docker run --rm --network host -p 6274:6274 -p 6277:6277 ghcr.io/modelcontextprotocol/inspector:latest  
```

--------------------------------

### Create System User and Directory for Traefik Hub

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

These commands set up the necessary system environment for Traefik Hub. This includes creating a dedicated system group and user, establishing configuration and dynamic directories, and creating log files with appropriate ownership and permissions.

```bash
sudo groupadd --system traefik-hub
sudo useradd \
  -g traefik-hub --no-user-group \
  --home-dir /var/www --no-create-home \
  --shell /usr/sbin/nologin \
  --system traefik-hub
sudo mkdir -p /etc/traefik-hub/dynamic
sudo chown root:root /etc/traefik-hub
sudo chown traefik-hub:traefik-hub /etc/traefik-hub/dynamic
sudo touch /var/log/traefik-hub.log
sudo chown traefik-hub:traefik-hub /var/log/traefik-hub.log
```

--------------------------------

### Get Traefik LoadBalancer IP

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Retrieves the IP address of the Traefik LoadBalancer service across all namespaces in a Kubernetes cluster. This is used for configuring DNS resolution for Docker users.

```bash
# Get Traefik LoadBalancer IP
kubectl get svc -A | grep LoadBalancer  
```

--------------------------------

### Initialize Go Module (go.mod)

Source: https://doc.traefik.io/traefik-hub/api-gateway/guides/plugin-development-guide

Initializes the Go module for the plugin, specifying the module name which should align with the repository path.

```go
go mod init github.com/my-org/my-plugin
```

```go
go mod init gitlab.com/my-org/my-plugin
```

--------------------------------

### Verify API Deployment

Source: https://doc.traefik.io/traefik-hub/operations/azure/azure-arc-apim

Lists all API resources within the specified namespace to verify successful deployment.

```bash
kubectl get apis -n apps
```

--------------------------------

### Verify IngressRoute Status

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Checks the status of the deployed IngressRoute in the specified namespace.

```bash
kubectl get ingressroute deepwiki-mcp-route -n apps
```

--------------------------------

### Step 1: Show Everything Debugging

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/mcp

Initial step in debugging Traefik Hub list filtering by setting the default action to 'show' to display all items.

```yaml
listDefaultAction: show
```

--------------------------------

### Start MCP Inspector with npx

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Launches the MCP Inspector UI using Node Package Manager (npx). MCP Inspector is a tool for testing and debugging MCP servers, supporting various transports.

```bash
npx @modelcontextprotocol/inspector  
```

--------------------------------

### Verify StripPrefix Middleware Configuration

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Checks the status and configuration of the 'deepwiki-strip-prefix' middleware in the 'apps' namespace using kubectl.

```bash
kubectl get middleware deepwiki-strip-prefix -n apps
```

--------------------------------

### Test 'whoami' Application Locally

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

This command sends an HTTP GET request to the 'whoami' application running locally on port 3000. The output shows the details of the request, including hostname, IP addresses, and request headers, confirming the application is running.

```bash
curl http://localhost:3000
```

--------------------------------

### Manage Systemd Service

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux

Commands to reload the systemd daemon, enable the service to start on boot, and control the service lifecycle.

```bash
sudo systemctl daemon-reload
sudo systemctl enable traefik-hub
sudo systemctl start traefik-hub
sudo systemctl status traefik-hub
```

--------------------------------

### IngressRouteUDP Basic Configuration Example

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/udp/routers/ref-ingressrouteudp

This example demonstrates a basic IngressRouteUDP configuration, specifying the entry point and routing to a Kubernetes Service with load balancing options.

```yaml
apiVersion: traefik.io/v1alpha1
kind: IngressRouteUDP
metadata:
  name: ingressrouteudpfoo
  namespace: apps
spec:
  entryPoints:
    - fooudp
  routes:
  - services:
    - name: foo
      port: 8080
      weight: 10
      nativeLB: true
      nodePortLB: true

```

--------------------------------

### Retrieve JWT Token

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Prints the value of the TEST_JWT environment variable, which is used as the authentication token when connecting to MCP services.

```bash
echo $TEST_JWT  
```

--------------------------------

### Verify Plugin Loading via Logs

Source: https://doc.traefik.io/traefik-hub/api-gateway/guides/plugin-development-guide

Commands to inspect Traefik logs for plugin installation status and expected debug output.

```bash
kubectl logs -n traefik -l app.kubernetes.io/name=traefik --tail=50 | grep -i plugin
```

```text
time="..." level=info msg="Loading plugins..." plugins="[myPlugin]"
time="..." level=debug msg="Installing plugin: myPlugin: github.com/my-org/my-plugin@v1.0.0"
time="..." level=info msg="Plugins loaded."
```

--------------------------------

### Install Traefik Hub Binary

Source: https://doc.traefik.io/traefik-hub/api-gateway/getting-started

Downloads and installs the latest Traefik Hub binary on a Linux system.

```bash
LATEST_VERSION=$(curl -s https://api.github.com/repos/traefik/hub/releases/latest | grep 'tag_name' | cut -d '"' -f 4)
curl -L "https://github.com/traefik/hub/releases/download/$LATEST_VERSION/traefik-hub_${LATEST_VERSION}_linux_amd64.tar.gz" -o /tmp/traefik-hub.tar.gz
tar xvzf /tmp/traefik-hub.tar.gz -C /tmp traefik-hub-linux-amd64
sudo mv /tmp/traefik-hub-linux-amd64 /usr/local/bin/traefik-hub
sudo chmod 755 /usr/local/bin/traefik-hub
```

--------------------------------

### Verify MCP Gateway Middleware Configuration

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Checks the status and configuration of the 'deepwiki-mcp-gateway' middleware in the 'apps' namespace using kubectl.

```bash
kubectl get middleware deepwiki-mcp-gateway -n apps
```

--------------------------------

### Helm Chart Example: Setting Additional Arguments

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/install/ref-helm

Demonstrates how to pass additional arguments to Traefik's binary using Helm's `--set` flag. This is useful for enabling specific features or debugging.

```bash
helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"
```

--------------------------------

### Traefik Hub API Gateway: Path Matcher Examples

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/http/routers/ref-rules-prios

Provides examples of using Path and PathPrefix matchers to route requests based on their URL path. Path matches the exact path, while PathPrefix matches any path starting with the specified prefix.

```Traefik Rules
Path(`/login`)
```

```Traefik Rules
PathPrefix(`/api/v1`)
```

--------------------------------

### Manage Traefik Hub Service

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/linux/installation

Standard Linux systemctl commands to reload the daemon, enable the service to start on boot, and control the service lifecycle.

```bash
sudo systemctl daemon-reload
sudo systemctl enable my-service
sudo systemctl start my-service
sudo systemctl status my-service
```

--------------------------------

### Integrate Kustomize with Static Analyzer

Source: https://doc.traefik.io/traefik-hub/static-analyzer

Demonstrates how to process Kustomize overlays or manifests containing variables before running the static analyzer, as the tool requires raw, fully-rendered manifests.

```bash
kubectl kustomize /path/to/manifests -o /tmp/kustomized
hub-static-analyzer lint -p /tmp/kustomized
```

```bash
go install github.com/drone/envsubst/cmd/envsubst@latest
export MY_VARIABLE=MY_VALUE
kubectl kustomize /path/to/manifests -o /tmp/kustomized | $GOPATH/bin/envsubst | yq --split-exp '.metadata.name + "." + $index + ".yaml"' --no-doc
hub-static-analyzer lint -p /tmp/kustomized
```

--------------------------------

### Verify Routing with CLI Tools

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi

Commands to test TCP and TLS routing configurations using netcat and OpenSSL.

```bash
$ nc localhost 3000

$ openssl s_client -quiet -connect localhost:3443 -servername whoami.localhost
```

--------------------------------

### Create ExternalName Service for MCP Server

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Defines a Kubernetes Service of type ExternalName to route traffic to an external MCP server host.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: deepwiki-mcp-server
  namespace: apps
spec:
  type: ExternalName
  externalName: mcp.deepwiki.com
  ports:
    - name: https
      port: 443
      protocol: TCP
```

--------------------------------

### Create Namespace for Sample API

Source: https://doc.traefik.io/traefik-hub/api-mocking/on-premises-setup

Creates a Kubernetes namespace named 'apps' to deploy the sample Pastry API. This isolates the sample API deployment from other applications in the cluster.

```bash
kubectl create namespace apps  
```

--------------------------------

### Verify Traefik Pod Readiness

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Uses kubectl to wait for the Traefik deployment pods to reach a ready state within the specified namespace.

```bash
kubectl -n traefik wait --for=condition=ready pod -l app.kubernetes.io/name=traefik --timeout=90s
```

--------------------------------

### Echo Deployment and Service Manifests

Source: https://doc.traefik.io/traefik-hub/api-gateway/reference/routing/kubernetes/ref-routing-provider-gatewayapi

Sets up the echo backend deployment and its corresponding Kubernetes Service. The deployment uses a specific image and configures environment variables for the pod. The service exposes the deployment on port 3000, making it accessible for GRPC requests.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: echo
  namespace: default
spec:
  selector:
    matchLabels:
      app: echo

  template:
    metadata:
      labels:
        app: echo
    spec:
      containers:
        - name: echo-basic
          image: gcr.io/k8s-staging-gateway-api/echo-basic
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: GRPC_ECHO_SERVER
              value: "1"

---
apiVersion: v1
kind: Service
metadata:
  name: echo
  namespace: default
spec:
  selector:
    app: echo

  ports:
    - port: 3000

```

--------------------------------

### Create Kubernetes Cluster with k3d

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Initializes a local Kubernetes cluster using k3d, configured with specific ports for the Traefik Hub load balancer.

```bash
k3d cluster create traefik-hub --port 80:30000@loadbalancer --port 443:30001@loadbalancer --k3s-arg "--disable=traefik@server:0"
```

--------------------------------

### Download and Install Traefik Hub Binary

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/linux

Downloads the specified version of the Traefik Hub binary for Linux, extracts it, and moves it to the system binary directory with appropriate execution permissions.

```bash
VERSION=v3.5.1
ARCH=amd64
curl -L https://github.com/traefik/hub/releases/download/${VERSION}/traefik-hub_${VERSION}_linux_${ARCH}.tar.gz -o traefik-hub.tar.gz
tar xfvz traefik-hub.tar.gz
sudo mv traefik-hub-linux-amd64 /usr/local/bin/traefik-hub
sudo chmod +x /usr/local/bin/traefik-hub
rm -f traefik-hub.tar.gz
```

--------------------------------

### Test OAuth Discovery Endpoint

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Queries the MCP Gateway's auto-generated OAuth discovery endpoint to verify resource metadata and authorization server configurations.

```bash
curl http://mcp.localhost/.well-known/oauth-protected-resource/deepwiki-mcp | jq
```

--------------------------------

### Prometheus Query Examples for MCP Metrics

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/mcp

Examples of Prometheus queries to analyze MCP operation metrics. These queries demonstrate how to calculate average operation duration by method, count operations per second by tool name, and determine the 95th percentile of MCP operation latency.

```prometheus
# Average MCP operation duration by method  
rate(mcp_client_operation_duration_sum[5m]) / rate(mcp_client_operation_duration_count[5m])  
  
# MCP operations per second by tool name  
sum(rate(mcp_client_operation_duration_count{mcp_tool_name!=""}[5m])) by (mcp_tool_name)  
  
# 95th percentile MCP operation latency  
histogram_quantile(0.95, sum(rate(mcp_client_operation_duration_bucket[5m])) by (le))  


```

--------------------------------

### Create Traefik IngressRoute for MCP

Source: https://doc.traefik.io/traefik-hub/mcp-gateway/guides/getting-started

Defines a Kubernetes IngressRoute resource that chains JWT, MCP, and StripPrefix middlewares to secure and route traffic to the DeepWiki MCP server.

```yaml
cat <<EOF | kubectl apply -f -  
apiVersion: traefik.io/v1alpha1  
kind: IngressRoute  
metadata:  
  name: deepwiki-mcp-route  
  namespace: apps  
spec:  
  entryPoints:  
    - web  
  routes:  
    - kind: Rule  
      match: Host(`mcp.localhost`) && PathPrefix(`/deepwiki-mcp`)  
      middlewares:  
        - name: deepwiki-mcp-jwt  
        - name: deepwiki-mcp-gateway  
        - name: deepwiki-strip-prefix  
      services:  
        - name: deepwiki-mcp-server  
          port: 443  
          scheme: https  
          passHostHeader: false  
EOF
```

--------------------------------

### Security Monitoring Middleware Example

Source: https://doc.traefik.io/traefik-hub/ai-gateway/middlewares/llm-guard

A Traefik `Middleware` resource example configuring the `llm-guard` plugin for security monitoring. It defines `systemPrompt`, `blockConditions`, and `traceConditions` to analyze requests and integrate with SIEM.

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-monitor
  namespace: apps
spec:
  plugin:
    llm-guard:
      endpoint: http://ollama.apps.svc.cluster.local:11434/v1/chat/completions
      model: llama3.2:3b # Use a generic LLM for custom JSON responses

      request:
        systemPrompt: |
          Analyze this request for security threats. Respond with JSON:
          {"threat_level": "low|medium|high", "categories": ["S1", "S2"]}
        blockConditions:
          - reason: high_threat
            condition: JSONEquals(".threat_level", "high")
        traceConditions:
          - reason: medium_threat
            condition: JSONEquals(".threat_level", "medium")
          - reason: high_threat_traced
            condition: JSONEquals(".threat_level", "high") # Track high threats in traces too

```

--------------------------------

### Migrate Traefik Proxy to Traefik Hub

Source: https://doc.traefik.io/traefik-hub/api-gateway/setup/installation/docker

Instructions for migrating an existing Traefik Proxy setup to Traefik Hub by updating the image and adding the required token parameter.

```bash
--hub.token=YOUR-TRAEFIK-HUB-TOKEN
```