traefik-hardening SKILL.md skillA
traefik-hardening from air-gapped/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add air-gapped/skills/traefik-hardening@git:20261027.35cd08fPins git:20261027.35cd08f in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- air-gapped/skills
- Path
.claude/skills/traefik-hardening/SKILL.md- Versions recorded
- 9
- Latest version
- git:20261027.0311dd9, committed Oct 27, 2026
- First version recorded
- Jul 22, 2026
- Size
- 13,198 bytes
- Repository stars
- 6
- License
- MIT
Harden a Traefik 2.x/3.x reverse proxy against abusive or unwanted traffic — per-identity rate + concurrency limiting, IP allowlisting, request-body buffering, middleware chaining, keying limits on a JWT claim/header instead of raw source IP, air-gapped plugin loading (localPlugins/WASM), and detection/response via access logs. Covers the 2.x→3.x middleware deltas (IPWhiteList→IPAllowList, Redis-backed distributed RateLimit, status-based Retry), the single-leader-counting trap, and where…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Traefik hardening — capping abusive traffic at the ingress Harden a Traefik reverse proxy (standalone or Kubernetes ingress, 2.x or 3.x) against traffic that is *authorized but abusive* — a real user replaying their session token from a script, one client opening 50 parallel streams, request floods, scrapers — the cases a login wall doesn't stop. ## The one idea to internalize first **A proxy usually cannot reliably tell a "bad" client from a "good" one — so don't try to classify; cap per-identity resource use regardless of client type.** Every instinct to *detect* the abuser fails on inspection: - **User-Agent** is one line to spoof (`curl -A "Mozilla/…"`). - **TLS fingerprint (JA3/JA4)** genuinely separates a browser stack from `python-requests` — but **Traefik cannot see it** (the plugin API never receives the ClientHello; see `references/detection-and-response.md`), and `curl-impersonate` defeats it anyway. - **Request rate** doesn't cleanly separate: a human dragging their mouse across a chat list fires hundreds of cheap GETs in seconds, while an agentic script doing long-context calls may crawl. Rate ≠ client type. …
Read the whole file at its exact version.
How to install
mdr add air-gapped/skills/traefik-hardening@sha256:088e932d82570d9bThe line at the top of this page pins the label git:20261027.35cd08f, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_lbkv6zgxchznxwbo)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 9 versions of this file, between Jul 22, 2026 and Oct 27, 2026, about one every 12 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261027.0311dd9 latest | 2026-10-27 | 0311dd9 | 13,198 B | A | view · diff |
| git:20261027.0bd8d42 | 2026-10-27 | 0bd8d42 | 13,340 B | A | view · diff |
| git:20261027.35cd08f | 2026-10-27 | 35cd08f | 13,428 B | A | view · diff |
| git:20261027.a5c541c | 2026-10-27 | a5c541c | 13,428 B | A | view · diff |
| git:20261027.ebcf721 | 2026-10-27 | ebcf721 | 13,130 B | A | view · diff |
| git:20260915.6a17e6d | 2026-09-15 | 6a17e6d | 12,632 B | A | view · diff |
| git:20260821.f73edf0 | 2026-08-21 | f73edf0 | 10,135 B | A | view · diff |
| git:20260725.aef8f18 | 2026-07-25 | aef8f18 | 10,553 B | A | view · diff |
| git:20260722.863ea8f | 2026-07-22 | 863ea8f | 10,437 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (13198 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
air-gapped/skills · 6 stars · license MIT · pushed 2026-11-04 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_lbkv6zgxchznxwbo GET https://markdownregistry.com/api/v1/resolve?ref=air-gapped/skills/traefik-hardening GET https://markdownregistry.com/api/v1/blob/088e932d82570d9b33786930994bc5cea5fe435468a177b402ebd128b38c56ea
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.