Systems

These are the internal building blocks of the Traefik process. Each is a Go package (or a small set of related packages) with a clear responsibility. Together they implement the path from "configuration arrived" to "request was answered".

What's where

graph TD
    subgraph Edge
        EP[Entry points<br/>pkg/server]
        TLSm[TLS manager<br/>pkg/tls]
    end
    subgraph Routing
        Mux[Muxers<br/>pkg/muxer]
        Rules[Rule parser<br/>pkg/rules]
        RouterFactory[Router factory<br/>pkg/server]
    end
    subgraph Configuration
        Static[Static config<br/>pkg/config/static]
        Dynamic[Dynamic config<br/>pkg/config/dynamic]
        Runtime[Runtime config<br/>pkg/config/runtime]
        Watcher[Watcher<br/>pkg/server]
        Aggregator[Provider aggregator<br/>pkg/provider/aggregator]
    end
    subgraph Backend
        Service[Services<br/>pkg/server/service]
        LB[Load balancers<br/>pkg/server/service/loadbalancer]
        Proxy[Reverse proxies<br/>pkg/proxy]
    end
    subgraph Observability
        Logs[Logs<br/>pkg/observability/logs]
        Metrics[Metrics<br/>pkg/observability/metrics]
        Tracing[Tracing<br/>pkg/observability/tracing]
    end
    subgraph ControlPlane
        API[API + dashboard<br/>pkg/api + webui]
        Plugins[Plugins<br/>pkg/plugins]
    end

    Static --> Watcher
    Aggregator --> Watcher
    Watcher --> RouterFactory
    Dynamic --> RouterFactory
    Runtime <-.-> RouterFactory
    RouterFactory --> Service
    RouterFactory --> Mux
    Mux --> Rules
    EP --> Mux
    EP --> TLSm
    Service --> LB
    LB --> Proxy
    API --> Runtime
    Plugins --> RouterFactory
    Watcher -.-> Logs
    Service -.-> Metrics
    Service -.-> Tracing

Subsystem index

Subsystem	Page	Source
Configuration loading and live updates	Configuration	pkg/config/static, pkg/config/dynamic, pkg/config/runtime, pkg/server/configurationwatcher.go
Entry points (TCP/UDP/HTTP/HTTP3 listeners)	Entry points	pkg/server/server_entrypoint_*.go
Routing — rule grammar, muxers, router factory	Routing	pkg/rules, pkg/muxer, pkg/server/router, pkg/server/routerfactory.go
Service & load balancing — backends and traffic policies	Service and load balancing	pkg/server/service, pkg/server/service/loadbalancer/*, pkg/proxy/*
TLS — certificates, ACME, OCSP	TLS	pkg/tls, pkg/provider/acme
Observability — logs, metrics, tracing	Observability	pkg/observability/*, pkg/middlewares/observability, pkg/middlewares/capture, pkg/middlewares/metrics, pkg/middlewares/accesslog
API and dashboard	API and dashboard	pkg/api, webui
Plugins (Yaegi + Wasm)	Plugins	pkg/plugins

How they relate

A few invariants hold across these subsystems:

• Configuration is the source of truth. Everything downstream is rebuilt from a dynamic.Configurations snapshot. There is no out-of-band state that survives a configuration apply.
• Hot path stays in Go. Entry points, muxers, and proxies do not call into Yaegi/Wasm on every request — only middlewares loaded as plugins do.
• The configuration watcher is the only writer of router state. Other code reads the runtime configuration; only the apply loop mutates it.
• Observability is built into the middleware chain. No subsystem needs explicit "instrument me" calls — middlewares automatically wrap user-defined chains.

If you don't know where to look, start at Configuration and follow the data into Routing.