title: programmatically updating traefik IP whitelist
body: <p>I have a docker stack that uses <code>traefik:1.7.28</code> as an ssl-terminator and reverse proxy for a number of services. One of the services is intended for internal use, so I have an IP whitelist set on it to restrict access.</p>
  <p>I would like to enable external access to IP addresses with current SSH connections. That is, when a valid SSH connection is created, I'd like to be able to add the source IP address to the whitelist, and when the session is terminated, remove it from the whitelist.</p>
  <p>Is there a way to programmatically add to and remove from arbitrary/individual traefik parameters? Specifically, I want to be able to influence <code>traefik.frontend.whiteList.sourceRange</code> within the <code>internal</code> service.</p>
  <p>I'm trying to tie together <a href="https://doc.traefik.io/traefik/v1.7/configuration/api/" rel="nofollow noreferrer">https://doc.traefik.io/traefik/v1.7/configuration/api/</a> and <a href="https://doc.traefik.io/traefik/v1.7/configuration/backends/rest/" rel="nofollow noreferrer">https://doc.traefik.io/traefik/v1.7/configuration/backends/rest/</a>. An alternative might be to use <a href="https://doc.traefik.io/traefik/v1.7/basics/#dynamic-traefik-configuration" rel="nofollow noreferrer">dynamic configuration</a> instead of an API.</p>
  <pre class="lang-yml prettyprint-override"><code>version: '3.7'
  services:
    traefik:
      image: traefik:1.7
      command: --api --docker --docker.exposedbydefault=false \
        --docker.domain=mydomain.com \
        --entryPoints=&quot;Name:https Address::443 TLS:/ssl/mydomain-ucc.chained.crt,/ssl/mydomain-cc.key&quot; \
        --entryPoints=&quot;Name:http Address::80 Redirect.EntryPoint:https&quot; \
        --accessLog.format=&quot;json&quot; \
        --accessLog.filePath=&quot;/log/access.log&quot; \
        --traefikLog.format=&quot;json&quot; \
        --traefikLog.filePath=&quot;/log/traefik.log&quot; \
        --rest.entryPoint='traefik
        - target: 80
          published: 80
          mode: host
        - target: 443
          published: 443
          mode: host
        - &quot;8081:8080&quot; # webui
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock:ro
        - /srv/ssl:/ssl:ro
        - /srv/tklogs:/log
    internal:
      image: nginx:1.19
      depends_on:
        - traefik
      volumes:
        - /int/path:/usr/share/nginx/html:ro
      labels:
        - traefik.enable=true
        - traefik.frontend.entryPoints=https
        - traefik.frontend.passHostHeader=true
        - traefik.frontend.whiteList.sourceRange=127.0.0.1/16,172.16.0.0/12
        - traefik.frontend.whiteList.useXForwardedFor=true
        - traefik.frontend.rule=PathPrefixStrip:/int
        - traefik.frontend.headers.referrerPolicy=same-origin
        - traefik.frontend.headers.STSSeconds=315360000
  </code></pre>
  <p>System: ubuntu-16.04, openssh-7.2p2.</p>
  <p>Notes:</p>
  <ul>
  <li>If this is possible in <code>traefik-v2</code> and not in <code>v1.7</code>, that may be the final impetus I need to make the migration.</li>
  <li>It is possible for users to set up a ssh-tunnel and access the internal site that way. That's not what I'm trying to do this time, but will revert to that if needed.</li>
  </ul>