Repository: traefik/traefik (language: go)

Issue:
v2.8.2 go panic
### Welcome!

- [X] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

Watchtower upgraded to 2.8.2, I'm sourcing `latest`. Upgrade should have gone smoothly as usual.

### What did you see instead?

Go panic, can post full stack trace if necessary, its very large and hard to bound.

### What version of Traefik are you using?

```
Version:      2.8.2
Codename:     vacherin
Go version:   go1.19
Built:        2022-08-11T14:55:50Z
OS/Arch:      linux/amd64
```

### What is your environment & configuration?

Docker provider, cannot provide config (company/org). 2.8.1 works as expected.

### If applicable, please paste the log output in DEBUG level

```
 time="2022-08-11T17:16:16-03:00" level=error msg="Error in Go routine: runtime error: slice bounds out of range [2:1]"
traefik-traefik-1  | time="2022-08-11T17:16:16-03:00" level=error msg="Stack: goroutine 29 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:24 +0x65\ngithub.com/traefik/traefik/v2/pkg/safe.defaultRecoverGoroutine({0x36a75c0?, 0xc0007e40c0})\n\tgithub.com/traefik/traefik/v2/pkg/safe/routine.go:66 +0xa5\ngithub.com/traefik/traefik/v2/pkg/safe.GoWithRecover.func1.1()\n\tgithub.com/traefik/traefik/v2/pkg/safe/routine.go:56 +0x36\npanic({0x36a75c0, 0xc0007e40c0})\n\truntime/panic.go:884 +0x212\ngithub.com/traefik/paerser/parser.filler.setSlice({{0x19?, {0x3989c0e?, 0x0?}}}, {0x2ff49c0?, 0xc0004c91f8?, 0x355146f?}, 0xc0004d86c0)\n\tgithub.com/traefik/paerser@v0.1.6/parser/element_fill.go:157 +0xaa5\ngithub.com/traefik/paerser/pa
```

lots more, typical go stack trace. I can't reproduce this frequently, I need to get this server back to production.


Discussion / hints:

<details>
<summary>`traefik.toml`</summary>

```
[accessLog]
    filePath = "/etc/traefik/access.log"

[log]
	format = "common"
    level = "WARN"

[serversTransport]
    insecureSkipVerify = true

[metrics]
  [metrics.prometheus]
    addEntryPointsLabels = true

[api]
    dashboard = true
    insecure = true

[entryPoints]
    [entryPoints.http]
        address = ":80"

    [entryPoints.http.http.redirections.entryPoint]
        to     = "https"
        scheme = "https"

    [entryPoints.https]
        address = ":443"
        [entryPoints.https.http.tls]
            certResolver = "letsencrypt"

[providers]
    [providers.docker]
        watch   = true
        exposedByDefault = false
        network = "traefik-network"

    [providers.file]
        watch = true
        filename = "/etc/traefik/traefik-dynamic.yml"

[certificatesResolvers]
    [certificatesResolvers.letsencrypt.acme]
        email = "email@domain.com" CENSORED
        storage = "/etc/traefik/acme.json"
        [certificatesResolvers.letsencrypt.acme.tlsChallenge]
        [certificatesResolvers.letsencrypt.acme.httpChallenge]
            entrypoint = "http"
```


</details>


<details>
<summary>`traefik-dynamic.yml`</summary>

```
http:
  routers:
    SERVICE-http:
      entrypoints:
        - http
      rule: Host(`HOSTNAME`)
      middlewares:
        - https-redirect
        - sslheader
      service: SERVICE
    SERVICE-https:
      entrypoints:
        - https
      rule: Host(`HOSTNAME`)
      service: SERVICE_NAME
      tls: {}
  services:
    SERVICE:
      loadBalancer:
        healthCheck:
          path: /
          interval: "5s"
          timeout: "3s"
        sticky:
          cookie: {}
        servers:
          - url: 'https://LOCAL_IP:PORT'
          - url: 'https://LOCAL_IP:PORT'
          - url: 'https://LOCAL_IP:PORT'
  middlewares:
    sslheader:
      headers:
        customrequestheaders:
          X-Forwarded-Proto: https
    https-redirect:
      redirectScheme:
        scheme: https
        permanent: true
    loose-headers:
      headers:
        accessControlAllowMethods: 'GET,POST,PUT,PATCH,DELETE,OPTIONS'
        accessControlAllowHeaders: '*'
        accessControlAllowOriginList: '*'
```


</details>
Got the same
If this sort of instability is to be expected perhaps there should be a stable tag to accompany tested versions? I'd prefer not to have to manually pin to each minor version to prevent unrecovered panics in production.
Same here; also broke prod (whee)
Generally it is advised against using things like `watchtower` to update containers, but this is the first time something actually exploded because of it. Hope this gets fixed quick, so I can go back to `latest` :)

I still had a terminal open with the output. Here's the full stacktrace in case it helps to find the issue:
<details>

```
panic: runtime error: slice bounds out of range [2:1]

goroutine 1 [running]:
github.com/traefik/paerser/parser.filler.setSlice({{0x4?, {0x3989c0e?, 0x0?}}}, {0x2ff49c0?, 0xc00063e4c0?, 0x334d43d?}, 0xc0003c3e60)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:157 +0xaa5
github.com/traefik/paerser/parser.filler.fill({{0xa0?, {0x3989c0e?, 0xc000c64a88?}}}, {0x2ff49c0?, 0xc00063e4c0?, 0x700?}, 0xc000c64ac8?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:105 +0x477
github.com/traefik/paerser/parser.filler.setStruct({{0xb0?, {0x3989c0e?, 0x2d8023a?}}}, {0x347afa0?, 0xc00063e4b0?, 0xc000c64ba0?}, 0x4a2e28?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:135 +0x178
github.com/traefik/paerser/parser.filler.fill({{0x20?, {0x3989c0e?, 0x3306580?}}}, {0x347afa0?, 0xc00063e4b0?, 0xc00046ec70?}, 0x8?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:99 +0x4b3
github.com/traefik/paerser/parser.filler.setPtr({{0x90?, {0x3989c0e?, 0xc00007f300?}}}, {0x341f420?, 0xc000012880?, 0x389cfa0?}, 0xc000c64cf8?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.fill({{0xc0?, {0x3989c0e?, 0x8?}}}, {0x341f420?, 0xc000012880?, 0x0?}, 0xc0009e5650?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:101 +0x465
github.com/traefik/paerser/parser.filler.setPtr({{0x98?, {0x3989c0e?, 0x1?}}}, {0xc0004fe1c0?, 0xc000012880?, 0x3555438?}, 0xa5?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.setSliceStruct({{0x1?, {0x3989c0e?, 0x10?}}}, {0x2fe5580?, 0xc0004fe1a0?, 0x0?}, 0xc0003c3cb0)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:254 +0x2e5
github.com/traefik/paerser/parser.filler.setSlice({{0x7?, {0x3989c0e?, 0x0?}}}, {0x2fe5580?, 0xc0004fe1a0?, 0x3555438?}, 0xc0003c3cb0)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:147 +0x2b5
github.com/traefik/paerser/parser.filler.fill({{0xc0?, {0x3989c0e?, 0x3?}}}, {0x2fe5580?, 0xc0004fe1a0?, 0x0?}, 0xc000c64fe0?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:105 +0x477
github.com/traefik/paerser/parser.filler.setStruct({{0x80?, {0x3989c0e?, 0x39a1241?}}}, {0x352abc0?, 0xc0004fe180?, 0xc000c650b8?}, 0x4a2e28?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:135 +0x178
github.com/traefik/paerser/parser.filler.fill({{0x0?, {0x3989c0e?, 0x3306580?}}}, {0x352abc0?, 0xc0004fe180?, 0xc00081a648?}, 0x364d925?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:99 +0x4b3
github.com/traefik/paerser/parser.filler.setPtr({{0x3?, {0x3989c0e?, 0x0?}}}, {0x2f83f00?, 0xc00081a668?, 0x364d92a?}, 0xc4?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.fill({{0x40?, {0x3989c0e?, 0x352aa40?}}}, {0x2f83f00?, 0xc00081a668?, 0x28?}, 0xc00045b8f0?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:101 +0x465
github.com/traefik/paerser/parser.filler.setStruct({{0x4?, {0x3989c0e?, 0x0?}}}, {0x352aa40?, 0xc00081a648?, 0x33881d7?}, 0x71?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:135 +0x178
github.com/traefik/paerser/parser.filler.fill({{0x20?, {0x3989c0e?, 0x7f99ac11ca88?}}}, {0x352aa40?, 0xc00081a648?, 0x0?}, 0x0?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:99 +0x4b3
github.com/traefik/paerser/parser.filler.setStruct({{0x38?, {0x3989c0e?, 0x398a1c7?}}}, {0x3778720?, 0xc00081a620?, 0x0?}, 0x447fe98?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:135 +0x178
github.com/traefik/paerser/parser.filler.fill({{0xc0?, {0x3989c0e?, 0x3306580?}}}, {0x3778720?, 0xc00081a620?, 0x349bc00?}, 0xc000c65560?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:99 +0x4b3
github.com/traefik/paerser/parser.filler.setPtr({{0x38?, {0x3989c0e?, 0x39a1241?}}}, {0x33745c0?, 0xc000012838?, 0xc000c655b8?}, 0x4a2e28?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.fill({{0x0?, {0x3989c0e?, 0x3306580?}}}, {0x33745c0?, 0xc000012838?, 0xc000c65610?}, 0xc000c65680?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:101 +0x465
github.com/traefik/paerser/parser.filler.setPtr({{0x8?, {0x3989c0e?, 0xc000c65700?}}}, {0xc0004fe100?, 0xc000012830?, 0x322c920?}, 0xc00063e330?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.fill({{0x40?, {0x3989c0e?, 0xc00007f300?}}}, {0xc0004fe100?, 0xc000012830?, 0x389cfa0?}, 0xc000c65780?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:101 +0x465
github.com/traefik/paerser/parser.filler.setPtr({{0xe0?, {0x3989c0e?, 0x46b087?}}}, {0xc0004fe140?, 0xc000012830?, 0x1?}, 0xc000c657d8?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:123 +0x24b
github.com/traefik/paerser/parser.filler.fill({{0x98?, {0x3989c0e?, 0x2?}}}, {0xc0004fe140?, 0xc000012830?, 0x98?}, 0x34d00fc?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:101 +0x465
github.com/traefik/paerser/parser.filler.setMap({{0xb?, {0x3989c0e?, 0x0?}}}, {0x3306700?, 0xc0003c2d00?, 0x34d0109?}, 0xc0003c3950)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:308 +0x3e5
github.com/traefik/paerser/parser.filler.fill({{0x0?, {0x3989c0e?, 0xc0003c39e0?}}}, {0x3306700?, 0xc0003c2d00?, 0xc000012760?}, 0x398aac3?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:103 +0x44f
github.com/traefik/paerser/parser.filler.setStruct({{0x18?, {0x3989c0e?, 0x1?}}}, {0x3477300?, 0xc0003c2cf0?, 0xc000c65ac8?}, 0x1af1bb9?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:135 +0x178
github.com/traefik/paerser/parser.filler.fill({{0xc0?, {0x3989c0e?, 0x4?}}}, {0x3477300?, 0xc0003c2cf0?, 0xc000c65b50?}, 0x1af1a26?)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:99 +0x4b3
github.com/traefik/paerser/parser.filler.Fill({{0xc0?, {0x3989c0e?, 0x34aefc0?}}}, {0x34aefc0?, 0xc0003c2cf0?}, 0xc0003c3200)
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:58 +0x13d
github.com/traefik/paerser/parser.Fill({0x34aefc0?, 0xc0003c2cf0?}, 0xc0003965a0?, {0xc0?, {0x3989c0e?, 0xc0003c3200?}})
        github.com/traefik/paerser@v0.1.6/parser/element_fill.go:28 +0x59
github.com/traefik/paerser/file.Decode({0xc0006baec0, 0x19}, {0x34aefc0, 0xc0003c2cf0})
        github.com/traefik/paerser@v0.1.6/file/file.go:37 +0xc5
github.com/traefik/traefik/v2/pkg/cli.loadConfigFiles({0x0?, 0x0?}, {0x34aefc0, 0xc0003c2cf0})
        github.com/traefik/traefik/v2/pkg/cli/loader_file.go:81 +0x1e9
github.com/traefik/traefik/v2/pkg/cli.(*FileLoader).Load(0xc0009e6f20, {0xc000050040?, 0x8?, 0x1?}, 0xc000ae1880)
        github.com/traefik/traefik/v2/pkg/cli/loader_file.go:44 +0x189
github.com/traefik/paerser/cli.run(0xc000ae1880, {0xc000050040?, 0x0, 0x0})
        github.com/traefik/paerser@v0.1.6/cli/commands.go:124 +0x1e3
github.com/traefik/paerser/cli.execute(0xc000ae1880, {0xc000050040?, 0x2, 0x2}, 0xb8?)
        github.com/traefik/paerser@v0.1.6/cli/commands.go:76 +0x74a
github.com/traefik/paerser/cli.Execute(...)
        github.com/traefik/paerser@v0.1.6/cli/commands.go:51
main.main()
        github.com/traefik/traefik/v2/cmd/traefik/traefik.go:78 +0x405
```

</details>

EDIT: I haven't checked the code, but is this even being fuzzed? If you write your own parser I expect things to be fuzzed lol.
Lot of problems too !
Same issue, never happened before with a minor upgrade:

```
time="2022-08-12T00:01:19+02:00" level=info msg="Starting provider aggregator aggregator.ProviderAggregator"
time="2022-08-12T00:01:19+02:00" level=info msg="Starting provider *file.Provider"
time="2022-08-12T00:01:19+02:00" level=error msg="Error in Go routine: runtime error: slice bounds out of range [2:1]"
```

The problem happens when the configuration contains invalid options:


`accessControlAllowMethods`, `accessControlAllowHeaders`, `accessControlAllowOriginList` are lists not a string.


invalid:
```yml
    loose-headers:
      headers:
        accessControlAllowMethods: 'GET,POST,PUT,PATCH,DELETE,OPTIONS'
        accessControlAllowHeaders: '*'
        accessControlAllowOriginList: '*'
```

valid:
```yml
    loose-headers:
      headers:
        accessControlAllowMethods:
          - 'GET'
          - 'POST'
          - 'PUT'
          - 'PATCH'
          - 'DELETE'
          - 'OPTIONS'
        accessControlAllowHeaders:
          - '*'
        accessControlAllowOriginList: 
          - '*'
````
> Watchtower upgraded to 2.8.2, I'm sourcing `latest`. Upgrade should have gone smoothly as usual.

Watchtower has a [Monitor Only](https://containrrr.dev/watchtower/container-selection/#monitor_only) feature so you are notified but you still have to manually update the container. At least enable it on critical container such as a reverse proxy, and let Watchtower update everything else.

You could also use [DIUN](https://crazymax.dev/diun/) instead, which works exactly like watchtower in monitor only mode, but works out of the box for discord

I know, it's tideous, but we have the perfect exemple here of the limits of autoupdating containers, especially with something as critical as a reverse proxy.


please check your configuration, the error happens when a string is used instead of a list.

https://github.com/traefik/traefik/issues/9249#issuecomment-1212577006
@ldez does that mean a patch release caused a breaking change? 🤔
I will create a path that will return an error instead of panic.

But your configuration needs to be changed

> does that mean a patch release caused a breaking change?

The previous behavior (<2.8.2) was a bug, so it's not a breaking change, now we just detect invalid configuration.


> now we just detect invalid configuration.

how do we identify where the problem in the config is exactly? my dynamic config is pretty big...and there's no indication of the lines that create the problem. 
You can use JSON schema validation.

https://www.schemastore.org/json/
Okay so here's the fun bit though: I only have toml files. And the only thing I could find with a comma separated list looks like valid toml... I'm very confused oh what's not parsing correctly on my end. Maybe the future error will detail exactly what I need to change :D
> Okay so here's the fun bit though: I only have toml files. And the only thing I could find with a comma separated list looks like valid toml...

in TOML lists are inside `[]`
Correct. That is the case. Both my `provider.toml` and my `traefik.toml` are valid toml files.
> Correct. That is the case. Both my provider.toml and my traefik.toml are valid toml files.

can you provide your files?

Sure. Should I go too hard on the censoring let me know.

`docker-compose.yml` just to give you the environment it's running in as well. Note that I added the working tag.

<details>

```yml
services:
  traefik:
    container_name: traefik
    image: traefik:2.8.1
    environment:
      CF_API_EMAIL: -censored-
      CF_API_KEY: -censored-
    ports:
      - 443:443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/STORAGE/cloud/tools/traefik/config:/etc/traefik
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.rule=Host(`traefik.my.domain`)
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      - com.centurylinklabs.watchtower.enable=true
    networks:
      - web
      - ipv6

networks:
  web:
    external: true
  ipv6:
    external: true
```

</details>

`providers.toml`:

<details>

```toml
[http]
  [http.routers]
    [http.routers.netdata]
      rule = "Host(`sys.my.domain`)"
      service = "netdata"
      entryPoints=["https"]
    [http.routers.fw]
      rule = "Host(`fw.my.domain`)"
      service = "fw"
      entryPoints=["https"]

  [http.services]
    [http.services.netdata.loadBalancer]
      [[http.services.netdata.loadBalancer.servers]]
        url = "http://10.0.0.200:19999"
    [http.services.fw.loadBalancer]
      [[http.services.fw.loadBalancer.servers]]
        url = "http://btr-fw:80"
```

</details>

`traefik.toml` (I'm aware that I need to get rid of the pilot token but oh well :P):

<details>

```toml
[log]
  level = "INFO"

[api]
  insecure = true

[pilot]
  token = "-censored-"

[providers.docker]
  endpoint = "unix:///var/run/docker.sock"
  watch = true
  exposedByDefault = false
  network = "web"

[providers]
  [providers.file]
    filename = "/etc/traefik/providers.toml"
    watch = true

[certificatesResolvers.letsencrypt.acme]
  email = "acme@my.domain"
  storage = "/etc/traefik/acme.json"
  #caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
  caServer = "https://acme-v02.api.letsencrypt.org/directory"

  [certificatesResolvers.letsencrypt.acme.dnsChallenge]
    provider = "cloudflare"
    resolvers = ["1.1.1.1:53", "1.0.0.1:53"]
    #delaybeforecheck=0

[entryPoints]
  [entryPoints.https]
    address = ":443"
      [entryPoints.https.http.tls]
        options = "default"
        certResolver = "letsencrypt"
            
      [[entryPoints.https.http.tls.domains]]
        main = "*.my.domain"
        sans = "my.domain"
#  [entryPoints.http_internal]
#    address = ":8080"
```

</details>

Hope this helps.
your problem is here:

invalid configuration:
```toml
[[entryPoints.https.http.tls.domains]]
main = "*.my.domain"
sans = "my.domain" <------ HERE
```

valid configuration:
```toml
[[entryPoints.https.http.tls.domains]]
main = "*.my.domain"
sans = ["my.domain"] <------ the fix
```


Oh wow that's really sneaky. Thank you! Will change and update to the latest tag to try out, and then edit this message if it worked.

EDIT: Works!

On that note, I copied this from the official documentation back then, so I assume a lot of Europeans are going to wake up tomorrow with broken containers.
> I copied this from the official documentation

can you point me to the page?

FYI I'm European, it's 1:45 am for me :wink:
I agree with @Byter09 that the config schema seems to have changed somewhere along the line, as I had a similar situation with config copied from the official documentation that is now considered "invalid". I'd be interested to see if that change was ever communicated in any release notes.
>  I had a similar situation with config copied from the official documentation

can you point me to the page?
@ldez it's changed on the documentation now, I'm trying to find an earlier version of the documentation that showed what I originally used.
All the versions of the documentation are available, ex: https://doc.traefik.io/traefik/v2.7/

Can you point me to the page?

If you can provide a precise pointer on a specific configuration section, it will help others.
@ldez I honestly couldn't tell you. It's been... years, since I created that config file. And given the time I'm also going to sleep, now that everything is working again. I hope @MattKobayashi will help you out 😅

Thank you for the super quick response though. Didn't expect that to get resolved so fast :D
I've been back through all the official docs and I can't seem to find an instance of the config I originally used. Perhaps I made the assumption that if it was a single value, a string instead of a list would be fine. Now I know better!
> You can use JSON schema validation.
> 
> https://www.schemastore.org/json/

Thanks a lot for the hint. I installed the [vscode-yaml](https://github.com/redhat-developer/vscode-yaml) extension that also supports SchemaStore repo.

It immediately found the issue in my big dynamic config file:

problem (string)
```yml
hostsProxyHeaders: "X-Forwarded-Host"
```

fix (array/list)
```yml
hostsProxyHeaders: 
  - "X-Forwarded-Host"
```

Now v2.8.2 starts correctly.
When i start i get the following error
```
traefik docker-compose up
Creating traefik ... done
Attaching to traefik
traefik    | time="2022-08-12T08:35:14+08:00" level=info msg="Configuration loaded from file: /traefik.yml"
traefik    | 2022/08/12 08:35:14 traefik.go:80: command traefik error: error while building entryPoint websecure: error preparing server: error opening listener: listen tcp: lookup ║24║: no such host
```
But I can start normally when I change the tag to 2.7.3
> But I can start normally when I change the tag to 2.7.3

Post your traefik.yml config, there's an error in the syntax.
<details>

```
api:
  dashboard: true

log:
  filePath: "/traefik.log"
  format: json
  level: DEBUG
accesslog:
  filePath: "/access.log"
  format: <remote_IP_address> - <client_user_name_if_available> [<timestamp>] "<request_method> <request_path> <request_protocol>" <origin_server_HTTP_status> <origin_server_content_size> "<request_referrer>" "<request_user_agent>" <number_of_requests_received_since_Traefik_started> "<Traefik_router_name>" "<Traefik_server_URL>" <request_duration_in_ms>ms
  bufferingSize: 100
#experimental:
#  http3: true
entryPoints:
  web:
    address: :10445
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true
  websecure:
    address:
      - :10446
    http:
      middlewares:
        - secureHeaders@file
        - usercompress@file
        - autodetect@file
      tls:
        certResolver: dnspod
        options: default
        domains:
          - main: "domain.xx"
            sans:
              - "*.domain.xx"
pilot:
  dashboard: false
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /configurations/
    watch: true
certificatesResolvers:
  zerossl:
    acme:
      caServer: https://acme.zerossl.com/v2/DV90
      email: "xxx@email"
      storage: acme.json
      keyType: 'EC384'
      dnsChallenge:
        provider: xxx
        delayBeforeCheck: 0
      eab:
        kid: xxx
        hmacEncoded: xxx
  dnspod:
    acme:
      email: "xxx@email"
      storage: acme.json
      keyType: 'EC384'
      dnsChallenge:
        provider: dnspod
        delayBeforeCheck: 0
```

</details>

Thanks, here is my traefik.yaml file

You have an invalid configuration:

```yml
  websecure:
    address:
      - :10446 <--- HERE
```

```yml
  websecure:
    address: :10446 <--- the fix
```
Thanks, I planned to add a port and forgot to change it back, but I don't know why 2.7.3 can run, sorry
this should ideally not panic; perhaps provide the error diagnostic? I'm sure there's a way to validate the config file before loading it.
this is dynamic configuration after all
> this should ideally not panic; perhaps provide the error diagnostic? I'm sure there's a way to validate the config file before loading it.

yes it was my problem, sorry
> this is dynamic configuration after all

no, that's the static. and the error was clear in the log: the websecure definition.
I missed the point of the series of errors, sorry and thank you very much
And when the tag is modified to 2.7.3, it can run normally, which makes me misunderstand the problem of the current version
> And when the tag is modified to 2.7.3, it can run normally, which makes me misunderstand the problem of the current version

If you read @ldez post [here](https://github.com/traefik/traefik/issues/9249#issuecomment-1212579829), he explained why:
 
> The previous behavior (<2.8.2) was a bug, so it's not a breaking change, now we just detect invalid configuration.



This is reportedly fixed in `2.8.3`, traefik has a (slack?) for people still having configuration issues.
> traefik has a (slack?) for people still having configuration issues.

We have a forum: https://community.traefik.io/
> This is reportedly fixed in `2.8.3`, traefik has a (slack?) for people still having configuration issues.

I would advise using an editor that can leverage the JSON schema available on [schemastore](https://www.schemastore.org/json/), so that when you edit the static/dynamic config files you don't make mistakes. I just installed the appropriate extension in vscode and it works beautifully. So no config issues anymore in the future. :)

[Here](https://github.com/redhat-developer/yaml-language-server#clients) you can find some supported clients/editors:

![image](https://user-images.githubusercontent.com/7027842/184267301-eb9f4fcc-d73e-4852-860e-367428b6f300.png)

( real links )

- [Eclipse Che](https://www.eclipse.org/che/)
- [vscode-yaml](https://marketplace.visualstudio.com/items?itemName=redhat.vscode-yaml) for VSCode
- [ide-yaml](https://atom.io/packages/ide-yaml) for Atom editor
- [coc-yaml](https://github.com/neoclide/coc-yaml) for [coc.nvim](https://github.com/neoclide/coc.nvim)
- [Eclipse Wild Web Developer](https://marketplace.eclipse.org/content/eclipse-wild-web-developer-web-development-eclipse-ide) for Eclipse IDE
- [lsp-mode](https://github.com/emacs-lsp/lsp-mode) for Emacs
- [vim-lsp](https://github.com/prabirshrestha/vim-lsp) for Vim
- [LSP-yaml](https://packagecontrol.io/packages/LSP-yaml) for Sublime Text
- [monaco-yaml](https://monaco-yaml.js.org) for Monaco editor
- [Vim-EasyComplete](https://github.com/jayli/vim-easycomplete) for Vim/NeoVim
- [nova-yaml](https://github.com/robb-j/nova-yaml/) for Nova
> ( real links )

the word `Here` was a link to the source page, with the links. :)
I know, I copied them properly for others.
> You have an invalid configuration:
> 
> ```yaml
>   websecure:
>     address:
>       - :10446 <--- HERE
> ```
> 
> ```yaml
>   websecure:
>     address: :10446 <--- the fix
> ```
One more question, the following is my configuration file, but it reports an error when running, please take a look
error message`{"level":"debug","msg":"No default certificate, generating one","time":"2022-08-12T09:56:17+08:00","tlsStoreName":"default"}`

traefik.yaml file

<details>

```
api:
  dashboard: true

log:
  filePath: "/traefik.log"
  format: json
  level: DEBUG
accesslog:
  filePath: "/access.log"
  format: <remote_IP_address> - <client_user_name_if_available> [<timestamp>] "<request_method> <request_path> <request_protocol>" <origin_server_HTTP_status> <origin_server_content_size> "<request_referrer>" "<request_user_agent>" <number_of_requests_received_since_Traefik_started> "<Traefik_router_name>" "<Traefik_server_URL>" <request_duration_in_ms>ms
  bufferingSize: 100
entryPoints:
  web:
    address: :10445
#    http:
#      redirections:
#        entryPoint:
#          to: websecure
#          scheme: https
#          permanent: true
  websecure:
    address: :10446
    http:
      middlewares:
        - secureHeaders@file
        - usercompress@file
        - autodetect@file
      tls:
        certResolver: dnspod
        options: default
        domains:
        - main: "domain.xx"
          sans:
          - "*.domain.xx"
pilot:
  dashboard: false
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: /configurations/
    watch: true
certificatesResolvers:
  dnspod:
    acme:
      email: "xxx@email"
      storage: acme.json
      keyType: 'EC384'
      dnsChallenge:
        provider: dnspod
        delayBeforeCheck: 0
```


</details>

configurations/tls.yaml


<details>

```
tls:
  options:
    default:
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      minVersion: VersionTLS12
```

</details>

configurations/router.yaml


<details>

```yaml
http:
  routers:
    btscnoti:
      service: aria2
      service: aria2
      rule: "Host(`aria.domain.xx`)"
      middlewares:
        - user-auth
```

</details>

configurations/services.yaml


<details>

```
http:
  services:
    aria2:
      loadBalancer:
        servers:
          - url: "http://10.201.1.227:58088"
```

</details>

configurations/middlewares.yml


<details>

```yaml
http:
  middlewares:
    secureHeaders:
      headers:
        sslRedirect: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customResponseHeaders:
          Permissions-Policy: "interest-cohort=()"
    user-auth:
      basicauth:
        users:
          - "xxx:xxx"
```

</details>

docker-compose.yaml


<details>

```yaml
version: "3.7"
services:
  traefik:
    image: traefik:latest
    container_name: traefik
    environment:
     - DNSPOD_API_KEY=xxxxx,xxxxx
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/localtime:/etc/localtime
      - ./data/traefik.yml:/traefik.yml
      - ./data/acme.json:/acme.json:rw
      - ./data/configurations:/configurations
      - ./data/run/access.log:/access.log
      - ./data/run/traefik.log:/traefik.log
    ports:
      - 10445:10445
      - 10446:10446
    security_opt:
      - no-new-privileges:true
    network_mode: bridge
    restart: always
```


</details>

@Stonestonestone this is not an error but rather a debug log, it just means there is no [default certificate](https://doc.traefik.io/traefik/https/tls/#default-certificate) configured so Traefik is generating a self signed one that will be served if no other certs match your routers host rules
yes, but i set acme and don't know why the certificate is not generated
Closed by #9250.
I documented the problem into the migration guide: https://doc.traefik.io/traefik/migration/v2/#v283

We will add a link to this page inside the release note of v2.8.3


Fix patch:
diff --git a/docs/content/migration/v2.md b/docs/content/migration/v2.md
index 73e58aba6b..03c7eec498 100644
--- a/docs/content/migration/v2.md
+++ b/docs/content/migration/v2.md
@@ -480,14 +480,3 @@ Since `v2.5.0`, the `PreferServerCipherSuites` is [deprecated and ignored](https
 in `v2.8.2` the `preferServerCipherSuites` option is also deprecated and ignored in Traefik.
 
 In `v2.8.2`, Traefik now reject certificates signed with the SHA-1 hash function. ([details](https://tip.golang.org/doc/go1.18#sha1))
-
-## v2.8.3
-
-Since `v2.8.2`, when using the [file provider](https://doc.traefik.io/traefik/v2.8/providers/file/),
-malformed options of the [dynamic configuration](https://doc.traefik.io/traefik/v2.8/getting-started/configuration-overview/#the-dynamic-configuration) are detected.
-If a string is used as a value for a list/array in a configuration file an error is raised.
-
-In `v2.8.2`, the malformed dynamic configuration produced a panic, which is now reported as an error in `v2.8.3`.
-
-If you are using the [file provider](https://doc.traefik.io/traefik/v2.8/providers/file/) to define the dynamic configuration,
-we recommend using a [JSON Schema](https://www.schemastore.org/json/) to validate the configuration before upgrading to a version higher than `v2.8.1`.
diff --git a/go.mod b/go.mod
index 1e4a121c04..98b128bb08 100644
--- a/go.mod
+++ b/go.mod
@@ -55,7 +55,7 @@ require (
 	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.8.0
 	github.com/stvp/go-udp-testing v0.0.0-20191102171040-06b61409b154
-	github.com/traefik/paerser v0.1.7
+	github.com/traefik/paerser v0.1.8
 	github.com/traefik/yaegi v0.14.1
 	github.com/uber/jaeger-client-go v2.30.0+incompatible
 	github.com/uber/jaeger-lib v2.2.0+incompatible
diff --git a/go.sum b/go.sum
index 94e8b2c1e2..31044ce793 100644
--- a/go.sum
+++ b/go.sum
@@ -1903,8 +1903,8 @@ github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea/go.mod h1:WPnis/6cRcDZSUvVmezrxJPkiO87ThFYsoUiMwWNDJk=
 github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305 h1:y/1cL5AL2oRcfzz8CAHHhR6kDDfIOT0WEyH5k40sccM=
 github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305/go.mod h1:gXOLibKqQTRAVuVZ9gX7G9Ykky8ll8yb4slxsEMoY0c=
-github.com/traefik/paerser v0.1.7 h1:xy84brL05/DMoff+KhY2ucq9+D3rnN9MH+3WtlmvvKU=
-github.com/traefik/paerser v0.1.7/go.mod h1:Dk3Bfz6Zyj13/S8pJyRdx/FNvXlsVRVbtp0UK4ZSiA0=
+github.com/traefik/paerser v0.1.8 h1:DmX/v9KwWAFvRr5A/XQzLLfd1BSWgh710q+dZJmjZ+c=
+github.com/traefik/paerser v0.1.8/go.mod h1:Dk3Bfz6Zyj13/S8pJyRdx/FNvXlsVRVbtp0UK4ZSiA0=
 github.com/traefik/yaegi v0.14.1 h1:t0ssyzeZCWTFGd/JnVuDxH/slMQfYg+2CDD4dLW/rU0=
 github.com/traefik/yaegi v0.14.1/go.mod h1:AVRxhaI2G+nUsaM1zyktzwXn69G3t/AuTDrCiTds9p0=
 github.com/transip/gotransip/v6 v6.6.1 h1:nsCU1ErZS5G0FeOpgGXc4FsWvBff9GPswSMggsC4564=


Test patch: