Create custom groups and assign routes to them using the edit button on each route card.
Edit Route
DISPLAY NAME
ICON
GROUP
Loading services...
These routes are managed by Docker labels and are read-only. Edit them via your container's labels.
Loading docker routes...
These routes are managed by Kubernetes (CRD, Ingress, or Gateway API) and are read-only. Edit them via your Kubernetes resources.
Loading Kubernetes routes...
These routes are discovered via Docker Swarm labels and are read-only. Edit them via your Swarm service definitions.
Loading Swarm routes...
These routes are discovered via HashiCorp Nomad and are read-only. Edit them via your Nomad job definitions.
Loading Nomad routes...
These routes are discovered via Amazon ECS and are read-only. Edit them via your ECS task definitions.
Loading ECS routes...
These routes are discovered via Consul service catalog and are read-only. Edit them via your Consul service registrations.
Loading Consul Catalog routes...
These routes are stored in Redis and are read-only here. Edit them directly in your Redis KV store.
Loading Redis routes...
These routes are stored in etcd and are read-only here. Edit them directly in your etcd KV store.
Loading etcd routes...
These routes are stored in Consul's key-value store and are read-only here. Edit them directly in Consul KV.
Loading Consul KV routes...
These routes are stored in ZooKeeper and are read-only here. Edit them directly in your ZooKeeper instance.
Loading ZooKeeper routes...
These routes are sourced from an HTTP endpoint configured in Traefik and are read-only here.
Loading HTTP provider routes...
These routes come from external file provider configurations and are read-only here. Routes managed by traefik-manager are shown in the Routes tab instead.
Loading file provider routes...
TLS certificates are managed automatically by Traefik's ACME resolver. Renew or revoke them via your Traefik config.
Loading certificates...
Loading TLS profiles...
CrowdSec not configured
Add your LAPI URL and API key in Settings → System Monitoring → CrowdSec
Active Decisions0
Loading decisions...
Recent Alerts0
Loading alerts...
Add Decision
Add Plugin
Plugins run inside the Traefik process with full access to your traffic. Review the plugin source on GitHub before installing. A Traefik restart is required to activate the plugin after saving.
Edit the middleware before saving - replace all placeholder values and any {{ }} template blocks with real values or Traefik will crash
Restart Traefik to activate
Loading plugins...
Access logs not loaded
Configure Access Log Path in Settings
Log Detail
Raw Line
Add TLS Profile
Used as the tls.options key and referenced in router configs.
SNI Strict
Reject connections with no or mismatched SNI. Requires non-wildcard certificates.
One per line. Leave empty to use Traefik defaults. Only applies to TLS 1.0-1.2.
One per line. Leave empty to use Traefik defaults.
One per line. Default: h2, http/1.1, acme-tls/1 - leave empty to use Traefik defaults. Include acme-tls/1 if using ACME cert challenges.
Paths to CA certificate files inside the container, one per line.
Client IP Diagnostic
What this instance sees for your own request right now. Use it to check whether the real client IP is reaching the app before it feeds logs, CrowdSec and ipAllowList.
Trusted IPs Helper
Adds forwardedHeaders.trustedIPs to an entrypoint so Traefik believes X-Forwarded-For from your proxies. This trust feeds logs, CrowdSec, ipAllowList and the login limiter - check what reaches the app first with the .
This edits the static config - it is global and needs a Traefik restart to take effect. A backup is created automatically before the save. Every trusted range can forge client IPs, so only add proxies you control.
Sources to add
HTTP
Middleware Details
Loading...
TLS Profile
HTTP
Service Details
Plugin Details
HTTP
Route Details
Loading...
Settings
Domains
Convenience list used to build Host() rules in the route form - it does not affect your Traefik configuration, TLS, or routing. Domains found in existing routes are added to the route form automatically, so this list is optional seeding.
Certificate Resolver
One or more cert resolver names, comma-separated (e.g. letsencrypt, cloudflare). The first is the default - each route can override it individually. If you manage certificates externally and don't use ACME, type none.
Traefik API URL
Base URL of the Traefik API used for live stats.
Password saved
Settings saved to manager.yml
Self Route
Create a Traefik route for this Traefik Manager instance.
Saved
Route Monitoring
Provider tabs pulled live from the Traefik API - no file mounts needed.
System Monitoring
These tabs require a file mount in your compose file - each tab shows the exact volume line to add if not yet mounted.
Intrusion Detection
Requires API credentials, not a file mount. Configure the LAPI URL and key in the CrowdSec tab.
These paths refer to files inside this container. Mount the file into Traefik Manager in your docker-compose.yml first, then set the path here.
acme.json Path
Path to Traefik's acme.json for the Certificates tab. Leave blank to use the ACME_JSON_PATH env var.
Access Log Path
Path to Traefik's access log for the Logs tab. Leave blank to use the ACCESS_LOG_PATH env var.
Static Config Path
Path to traefik.yml for the Plugins tab. Leave blank to use the STATIC_CONFIG_PATH env var.
Paths saved to manager.yml
LAPI URL
CrowdSec Local API URL. Leave blank to use the CROWDSEC_LAPI_URL env var.
API Key
Bouncer API key, used to read decisions. Stored encrypted. Leave blank to use the CROWDSEC_API_KEY env var.
API key configured
Machine Credentials (optional)
Required to read alerts and to unban (delete decisions) - bouncer keys cannot access those endpoints. Create one with cscli machines add traefik-manager --auto and copy the values from local_api_credentials.yaml.
Machine password configured
Leave blank to use the CROWDSEC_MACHINE_ID / CROWDSEC_MACHINE_PASSWORD env vars.
CrowdSec credentials saved
No authentication is active
This interface is publicly accessible. Enable Built-in Authentication (below) or configure OIDC / SSO. API keys still work but do not protect the web UI.
Built-in Authentication
Auth is enabled - controlled by AUTH_ENABLED env var
Change Password
Two-Factor Authentication
Status: Disabled
Scan the QR code with Google Authenticator or any TOTP app, then enter the 6-digit code to confirm.
Or enter manually:
Authentication settings are not available - no password has been configured.
App / Mobile API Keys
Per-device keys used by the mobile app via X-Api-Key header. Up to 10 keys.
Device name
No active keys
Copy this key now - it will not be shown again.
OIDC / SSO Login
Status: Disabled
Provider
Base URL of your OIDC provider (without /.well-known/...)
Shown on the login button: "Sign in with ..."
Credentials
Access Control
Comma-separated. Leave empty to allow any verified account.
Comma-separated group names. Leave empty to skip group check.
Claim name that contains groups. Keycloak: groups, some providers: roles.
Off by default. When both allowlists above are empty, OIDC logins are denied unless you enable this. Only turn it on if every account at your provider should have full admin access.
Saved
Dynamic Config Backups
Restoring overwrites your current config. A backup is created automatically before restoring.
Keep last N backups per file
Older .bak files are pruned automatically. 0 = keep all.
Backup retention on this agent is set via the BACKUP_KEEP_COUNT environment variable.
Loading backups...
Static Config Backups
Restoring overwrites your current static config. A backup is created automatically before restoring.
Keep last N backups per file
Older .bak files are pruned automatically. 0 = keep all.
Loading...
Git Repository Backup
Used for this push only. Leave blank to use the template above.
This agent can also push independently using its own GIT_BACKUP_* environment variables.
Use Host Repository
Push this server's config to the Host's git repository on its own branch
Must differ from the Host branch - each server pushes to its own branch
Enable Git Backup
Automatically push config changes to your repository
Token is set
Use {action} and {timestamp} as placeholders
Auto-push on save
Push after every route, middleware, or static config change
Git History
No commits yet - push your first backup to see history
Pending changes - not yet saved
Restart required for changes to take effect
Changes here can break Traefik
Only edit what you understand - a misconfigured static config will prevent Traefik from starting.
A backup is created automatically before every save. Restore from if something goes wrong.
Loading...
APPEARANCE
Default theme
Also set by the theme toggle in the nav bar
GEOLOCATION
IP geolocation
Show country flags and a world map in the Logs and CrowdSec tabs. Lookups run on the server against a local database - no IPs leave your server.
Database
Not downloaded
Free IP Geolocation by DB-IP (CC-BY 4.0), refreshed monthly. Set GEOIP_DB_PATH to use your own MaxMind/DB-IP .mmdb instead.
DASHBOARD
Show stat cards
HTTP Routers, TCP/UDP, Services and Middlewares overview
Compact stat cards
Smaller count with status breakdown (ok / warn / error)
Show entry points bar
Traefik entry point badges below the stat cards
ROUTES
Show app icons
Display the app icon next to each route name, like the dashboard. Applies to host and agent routes.
NAVBAR
Show Traefik version badge
Traefik version badge, highlights when an update is available.
Show Traefik Manager version badge
Traefik Manager Version badge, highlights when an update is available.
Show documentation link
Traefik Manager documentation.
Show API reference link
Opens the interactive API reference.
Show keyboard shortcuts button
Quick reference panel for keyboard shortcuts.
Show Client IP Diagnostic button
Read-only tool showing the client IP this instance sees for your request.
TABS
Dashboard
Routes grouped by category with app icons and per-card editing
Manage tls.options profiles in your dynamic config
Webhook
Send a notification to a webhook on every event (route saved, deleted, backup restored, etc.).
Remote Agents
Loading agents…
Add Agent
123
Enter the name and URL for this remote agent. The URL is where TMA is reachable from this Traefik Manager instance.
The public address where TMA is running on the remote server.
Save this API key - it will not be shown again.
Set TMA_API_KEY to this value in your agent's environment. The key is stored encrypted in TM settings.
Configure paths and options, then copy the generated install commands to your remote server.
Domains for route creation on this agent - lets you pick a domain chip instead of typing the full hostname.
Internal Traefik API - typically http://traefik:8080 (not the public dashboard URL)
Cert resolver names for this server's Traefik, comma-separated. Resolvers already used by this server's routes are detected automatically from its Traefik API, so this is only needed for a resolver no route uses yet.
Skip TLS Verification
Disable cert check for HTTPS Traefik API URLs (use if self-signed or Cloudflare Origin cert)
Where the agent stores local backup zips. Defaults to /app/backups - set a host path here to persist backups across container restarts.
Keep only the last N .bak files per config file (BACKUP_KEEP_COUNT). 0 = keep all.
Machine login enables the Alerts view and unban. Create with cscli machines add traefik-manager --auto.
API key is hidden after first creation. Use the key already in your running agent compose - do not rotate unless you want to invalidate the old key and reconfigure your agent.
Save this new key - it will not be shown again. Your agent will stop working until you update it.