We recommend to *not* use tags to store sensitive data (certificates, credentials, etc).
Instead, we recommend to store sensitive data in a safer storage (secrets, file, etc).

Enabling the nomad provider

```yaml tab="Structured (YAML)"
providers:
  nomad: {}
```

```toml tab="Structured (TOML)"
[providers.nomad]
```

```bash tab="CLI"
--providers.nomad=true
```

Attaching tags to services (in your Nomad job file)

```hcl
job "my-service" {
  datacenters = ["dc1"]
  
  group "web" {
    task "app" {
      driver = "docker"
      
      service {
        name = "my-service"
        tags = [
          "traefik.http.routers.my-service.rule=Host(`example.com`)",
        ]
      }
    }
  }
}
```

Forward requests for `http://example.com` to `http://<private IP of container>:12345`:

```hcl
job "my-service" {
  datacenters = ["dc1"]
  
  group "web" {
    task "app" {
      driver = "docker"
      
      service {
        name = "my-service"
        tags = [
          "traefik.http.routers.my-service.rule=Host(`example.com`)",
          "traefik.http.routers.my-service.service=my-service",
          "traefik.http.services.my-service.loadbalancer.server.port=12345",
        ]
      }
    }
  }
}
```

!!! important "Traefik Connecting to the Wrong Port: `HTTP/502 Gateway Error`"
    By default, Traefik uses the first exposed port of a container.

    Setting the tag `traefik.http.services.xxx.loadbalancer.server.port`
    overrides that behavior.

Forwarding requests to more than one port on a container requires referencing the service loadbalancer port definition using the service parameter on the router.

In this example, requests are forwarded for `http://example-a.com` to `http://<private IP of container>:8000` in addition to `http://example-b.com` forwarding to `http://<private IP of container>:9000`:

```hcl
job "my-service" {
  datacenters = ["dc1"]
  
  group "web" {
    task "app" {
      driver = "docker"
      
      service {
        name = "my-service"
        tags = [
          "traefik.http.routers.www-router.rule=Host(`example-a.com`)",
          "traefik.http.routers.www-router.service=www-service",
          "traefik.http.services.www-service.loadbalancer.server.port=8000",
          "traefik.http.routers.admin-router.rule=Host(`example-b.com`)",
          "traefik.http.routers.admin-router.service=admin-service",
          "traefik.http.services.admin-service.loadbalancer.server.port=9000",
        ]
      }
    }
  }
}
```

Tags are case-insensitive.

To learn how to configure Traefik default generated certificate, refer to the [TLS Certificates](../http/tls/tls-certificates.md#acme-default-certificate) page.

```yaml
# ...
# Declaring a middleware
traefik.http.middlewares.my-redirect.redirectscheme.scheme=https
# Referencing a middleware
traefik.http.routers.my-service.middlewares=my-redirect
```

If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.

```yaml
traefik.tcp.routers.my-router.rule=HostSNI(`example.com`)
traefik.tcp.routers.my-router.tls=true
traefik.tcp.services.my-service.loadbalancer.server.port=4123
```

If you declare a TCP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no TCP Router/Service is defined).
You can declare both a TCP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually).

```yaml
# ...
# Declaring a middleware
traefik.tcp.middlewares.test-inflightconn.amount=10
# Referencing a middleware
traefik.tcp.routers.my-service.middlewares=test-inflightconn
```

If you declare multiple middleware with the same name but with different parameters, the middleware fails to be declared.

```yaml
traefik.udp.routers.my-router.entrypoints=udp
traefik.udp.services.my-service.loadbalancer.server.port=4123
```

If you declare a UDP Router/Service, it will prevent Traefik from automatically creating an HTTP Router/Service (like it does by default if no UDP Router/Service is defined).
You can declare both a UDP Router/Service and an HTTP Router/Service for the same Nomad service (but you have to do so manually).