traefik-manager

Overview

A web UI for managing Traefik routes, middlewares, services, and certificates. Supports multiple config files, API keys for mobile access, two-factor authentication, and config backups. Requires access to your Traefik dynamic config file and the Traefik API.

Readme

View on GitHub

Traefik Manager for Unraid

Traefik Manager is a web UI for managing Traefik routes, services, middlewares and certificates. It edits your Traefik dynamic config directly, so routes you create in the UI are ordinary YAML you can read, back up and revert.

Both apps are in Unraid Community Applications. Open the Apps tab, search for Traefik Manager and click Install.

App	Community Applications
Traefik Manager	traefik-manager
Traefik Manager agent	traefik-manager-agent

Which one do I want?

Traefik Manager is the app itself, with the web UI. Install this if Traefik runs on this Unraid server and you want to manage it here.

Traefik Manager agent has no UI. Install it when Traefik runs on this server but you manage it from a Traefik Manager on another machine. Add the server in that Traefik Manager under Settings - Agents to generate an API key, then paste the key into the template.

Features

Routes - HTTP, TCP and UDP routes with multiple domains and backends, sticky sessions, health checks, certificate resolvers and TLS options
Services - load balancer, weighted, mirroring and failover services
Middlewares - 30 guided wizards for auth, rate limiting, headers, CORS, redirects and more, plus a raw YAML editor
Dashboard and Route Map - your apps with icons and health, and a topology map from entry point to backend
Certificates - every certificate in acme.json with expiry, unused certificates and orphaned resolvers
Monitoring - live router and service health from the Traefik API, provider tabs and CVE advisories for your Traefik version
Logs and CrowdSec - access log analytics, CrowdSec attacks, bans and decisions
Notifications - Discord, Slack, ntfy, Gotify, Pushover, Pushbullet, Telegram, UnifiedPush and webhooks, with background checks when the UI is closed
Static config editor - edit traefik.yml and restart Traefik from the UI
Plugins - install Traefik plugins and see which middlewares use them
Backups - a local backup before every change, plus git push with history, diffs and restore
Multi-server - manage Traefik on other hosts through the agent, no VPN or SSH
Security - two-factor login, OIDC single sign-on, per-device API keys and secrets encrypted at rest
Mobile - a native Android app, and the web app installs as a PWA

Configuration

Every template field maps to an environment variable. The Unraid guide covers what to set, which paths to mount for the optional tabs, and how to reach the Traefik API. The environment variable reference lists them all with defaults.

The full documentation is at traefik-manager.xyzlab.dev.

Help and issues

Bugs and feature requests - open an issue on the Traefik Manager tracker
Questions - check the documentation first, then ask on the tracker
Template problems - a missing field, wrong default or broken icon in the Unraid template also goes on the tracker, mention Unraid in the title
Chat - questions and release news on the Discord

When reporting a bug, include your Traefik Manager version, your Traefik version, and the container log from the Unraid Docker tab.

License

GPL-3.0, see LICENSE.

Requirements

Traefik must be running and its API must be reachable from this container.

Related apps

Explore more like this

Explore all

Utilities apps Management apps

Links

Projectgithub.com Supportgithub.com GHCRghcr.io Templateraw.githubusercontent.com

Details

Repository

ghcr.io/chr0nzz/traefik-manager:latest

Registry

https://ghcr.io/chr0nzz/traefik-manager

Last Updated2026-10-27

First Seen2026-09-13

Runtime arguments

Web UI: http://[IP]:[PORT:5000]
Network: bridge
Shell: sh
Privileged: false
Extra Params: --restart=unless-stopped

Template configuration

Web UI PortPorttcp

Port to access the Traefik Manager web UI.

Target: 5000
Default: 5000
Value: 5000

Config DirectoryPathrw

Stores manager.yml (settings, password, API keys) and the session signing key. Must be persistent.

Target: /app/config
Default: /mnt/user/appdata/traefik-manager/config
Value: /mnt/user/appdata/traefik-manager/config

Backups DirectoryPathrw

Timestamped backups of your dynamic config are saved here before every change.

Target: /app/backups
Default: /mnt/user/appdata/traefik-manager/backups
Value: /mnt/user/appdata/traefik-manager/backups

Traefik API URLVariable

URL of the Traefik API. Usually http://traefik:8080 when on the same Docker network.

Target: TRAEFIK_API_URL
Default: http://traefik:8080
Value: http://traefik:8080

Traefik API UsernameVariable

Optional: basic-auth username for the Traefik API, if your API/dashboard is protected by a basicAuth middleware.

Target: TRAEFIK_API_USER

Traefik API PasswordVariable

Optional: basic-auth password for the Traefik API. Only needed if TRAEFIK_API_USER is set.

Target: TRAEFIK_API_PASSWORD

DomainsVariable

Comma-separated list of base domains shown in the Add Route form. Example: example.com,home.lab

Target: DOMAINS
Default: example.com
Value: example.com

Cert ResolverVariable

Default ACME certificate resolver name from your traefik.yml. Comma-separate multiple resolvers.

Target: CERT_RESOLVER
Default: cloudflare
Value: cloudflare

Config File Path (single file)Variable

Path inside the container to your Traefik dynamic config file. Use this for a single config file. Mount the file via the path mapping below. Leave blank if using CONFIG_DIR or CONFIG_PATHS.

Target: CONFIG_PATH
Default: /app/config/dynamic.yml
Value: /app/config/dynamic.yml

Config Directory Path (multi-file)Variable

Path inside the container to a directory containing multiple .yml config files. All .yml files in this directory will be loaded. Use instead of CONFIG_PATH when managing multiple files. Leave blank if using CONFIG_PATH.

Target: CONFIG_DIR

Config Paths (explicit list)Variable

Comma-separated list of full config file paths inside the container. Use instead of CONFIG_PATH for 2-5 named files. Example: /app/config/routes.yml,/app/config/services.yml. Leave blank if using CONFIG_PATH or CONFIG_DIR.

Target: CONFIG_PATHS

Certs Tab - acme.jsonPathro

Optional: path to your Traefik acme.json file on the host. Required for the Certs tab. Read-only is enough to see certificates and which of them nothing uses. Set it read-write, together with a Restart Method, to also remove certificates from the Certs tab.

Target: /app/acme.json

Static Config / Plugins Tab - traefik.ymlPathrw

Optional: path to your Traefik static config file (traefik.yml) on the host. Required for the Plugins tab and the Static Config editor. Mount read-write to allow editing; read-only enables the Plugins tab only. Also set the Static Config Path variable below to /app/traefik.yml.

Target: /app/traefik.yml

Static Config PathVariable

Path inside the container to the static config (traefik.yml) you mounted above. Set to /app/traefik.yml to enable the Static Config editor and Plugins tab. Leave blank if not mounting traefik.yml.

Target: STATIC_CONFIG_PATH

Logs Tab - access.logPathro

Optional: path to your Traefik access log file on the host. Required for the Logs tab. Enable access logging in traefik.yml first: accessLog: filePath: /logs/access.log. Mount read-only.

Target: /app/logs/access.log

Restart MethodVariable

How Traefik Manager restarts Traefik after a static config change. Options: proxy (socket proxy - recommended), socket (direct Docker socket), poison-pill (signal file, requires watcher sidecar). Removing this field falls back to proxy, it does not turn restarts off.

Target: RESTART_METHOD
Default: proxy
Value: proxy

Traefik Container NameVariable

Name of the Traefik Docker container to restart. Used by the proxy and socket restart methods.

Target: TRAEFIK_CONTAINER
Default: traefik
Value: traefik

Docker Host (socket proxy)Variable

Docker host URL for the socket proxy restart method. Example: tcp://socket-proxy:2375. Only set when RESTART_METHOD=proxy.

Target: DOCKER_HOST

Signal File Path (poison pill)Variable

Path to the signal file written by Traefik Manager to trigger a Traefik restart. Only used when RESTART_METHOD=poison-pill. Mount a shared volume to /signals in both this container and the watcher sidecar.

Target: SIGNAL_FILE_PATH
Default: /signals/restart.sig
Value: /signals/restart.sig

Docker Socket (direct)Pathro

Optional: mount the Docker socket for the direct socket restart method (RESTART_METHOD=socket). Host path: /var/run/docker.sock

Target: /var/run/docker.sock

Restart Signals VolumePathrw

Optional: only for Restart Method poison-pill. Map a shared path here and at the same target in your watcher container, then point Signal File Path inside it. Leave blank for the other restart methods.

Target: /signals

Admin PasswordVariable

Optional: set a fixed admin password. If left empty a temporary password is generated on first start - check the container log for it.

Target: ADMIN_PASSWORD

Cookie SecureVariable

Set to true when accessing Traefik Manager over HTTPS (e.g. behind a Traefik reverse proxy with TLS). Required for session cookies to work correctly over HTTPS.

Target: COOKIE_SECURE
Default: false
Value: false

Auth EnabledVariable

Set to false to disable built-in login. Only use this when Traefik Manager is protected by an external auth provider such as Authentik or Authelia.

Target: AUTH_ENABLED
Default: true
Value: true

CrowdSec LAPI URLVariable

Optional: CrowdSec Local API URL (e.g. http://crowdsec:8080) to enable the CrowdSec tab. Can also be set in Settings.

Target: CROWDSEC_LAPI_URL

CrowdSec API KeyVariable

Optional: CrowdSec bouncer API key, used to read decisions. Generate with: cscli bouncers add traefik-manager

Target: CROWDSEC_API_KEY

CrowdSec Machine IDVariable

Optional: CrowdSec machine login, required to view Alerts and to unban (bouncer keys cannot). Create with: cscli machines add traefik-manager --auto

Target: CROWDSEC_MACHINE_ID

CrowdSec Machine PasswordVariable

Optional: password for the CrowdSec machine login above. Found in /etc/crowdsec/local_api_credentials.yaml.

Target: CROWDSEC_MACHINE_PASSWORD

Settings File PathVariable

Path inside the container to the Traefik Manager settings file. Change this if you want to store it separately from the dynamic config.

Target: SETTINGS_PATH
Default: /app/config/manager.yml
Value: /app/config/manager.yml

Backup Directory PathVariable

Path inside the container where backups are written. Change this if you mount a custom backup volume at a different path.

Target: BACKUP_DIR
Default: /app/backups
Value: /app/backups

Inactivity Timeout (minutes)Variable

Minutes of inactivity before a non-remembered session is logged out.

Target: INACTIVITY_TIMEOUT_MINUTES
Default: 120
Value: 120

OTP Encryption KeyVariable

Fernet key for encrypting the 2FA TOTP secret at rest. Auto-generated on first start if not set. Set this if you want to manage the key yourself or ensure it survives config volume replacement. Generate with: python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

Target: OTP_ENCRYPTION_KEY

Secret KeyVariable

Session signing key. Auto-generated on first start and saved to /app/config/.secret_key. Set this explicitly to ensure sessions survive a full config wipe, or to share a key across multiple instances.

Target: SECRET_KEY

Trusted Proxy HopsVariable

How many reverse-proxy hops to trust when reading X-Forwarded-For. With Cloudflare in front of Traefik in front of this container, set 2 so the login and audit log record the real client. Set 0 to ignore the header entirely. Only count hops you actually control - each trusted hop is one more entry a client could forge.

Target: PROXY_FIX_HOPS
Default: 1
Value: 1

Trusted ProxiesVariable

Addresses allowed to set X-Forwarded-For, -Proto and -Host, as comma-separated IPs or CIDR ranges. Empty uses loopback, private and CGNAT ranges. * trusts every peer.

Target: TRUSTED_PROXIES

Wrong passwords allowed across all addresses before login is paused. Separate limits with ; and set off to disable.

Target: LOGIN_FAILURE_LIMIT
Default: 30 per minute;200 per hour
Value: 30 per minute;200 per hour

2FA Failure LimitVariable

Wrong 2FA codes allowed across all addresses before the code step is paused. Separate limits with ; and set off to disable.

Target: OTP_FAILURE_LIMIT
Default: 10 per minute;30 per hour
Value: 10 per minute;30 per hour

Skip Traefik API TLS VerificationVariable

Set true when the Traefik API URL is https with a self-signed or Cloudflare Origin certificate.

Target: TRAEFIK_INSECURE_SKIP_VERIFY
Default: false
Value: false

acme.json PathVariable

Path to acme.json inside the container, when it is not the default /app/acme.json. Accepts several files comma-separated, or a directory whose .json files are all read - Traefik writes one storage file per certificate resolver.

Target: ACME_JSON_PATH

Access Log PathVariable

Path to the Traefik access log inside the container, when it is not the default /app/logs/access.log.

Target: ACCESS_LOG_PATH

Plugins DirectoryVariable

Path to Traefik's local plugins directory, for the Plugins tab.

Target: PLUGINS_DIR

Backup RetentionVariable

Keep only the last N backups per config file. 0 keeps every backup.

Target: BACKUP_KEEP_COUNT
Default: 0
Value: 0

GeoIP Database PathVariable

Path to a custom MaxMind-format .mmdb for IP geolocation. Leave empty to use the free DB-IP Lite database, downloaded on demand. Lookups run locally - no IP leaves the server.

Target: GEOIP_DB_PATH

Log LevelVariable

Logging verbosity. One of debug, info, warning, error.

Target: LOG_LEVEL
Default: info
Value: info

Base PathVariable

Serve Traefik Manager under a sub path instead of its own hostname, for example /tm. Leave blank to serve at the root.

Target: BASE_PATH

CrowdSec Alert LimitVariable

How many CrowdSec alerts to read at once. Leave blank for the default of 500.

Target: CROWDSEC_ALERT_LIMIT

CrowdSec Client CertificateVariable

Path inside the container to a TLS client certificate for the CrowdSec LAPI, when it requires mTLS instead of an API key.

Target: CROWDSEC_CLIENT_CERT

CrowdSec Client KeyVariable

Path inside the container to the private key for the CrowdSec client certificate.

Target: CROWDSEC_CLIENT_KEY

CrowdSec CA CertificateVariable

Path inside the container to the CA that signed the CrowdSec LAPI certificate.

Target: CROWDSEC_CA_CERT

CrowdSec Connect TimeoutVariable

Seconds to wait for the CrowdSec LAPI to accept a connection. Leave blank for the default.

Target: CROWDSEC_CONNECT_TIMEOUT

CrowdSec Read TimeoutVariable

Seconds to wait for a CrowdSec LAPI response. Leave blank for the default.

Target: CROWDSEC_READ_TIMEOUT

OIDC EnabledVariable

Set true to sign in with an OpenID Connect provider such as Authentik, Authelia or Keycloak.

Target: OIDC_ENABLED
Default: false
Value: false

OIDC Provider URLVariable

Issuer URL of your OIDC provider, for example https://auth.example.com/application/o/traefik-manager/

Target: OIDC_PROVIDER_URL

OIDC Client IDVariable

Client ID issued by your OIDC provider.

Target: OIDC_CLIENT_ID

OIDC Client SecretVariable

Client secret issued by your OIDC provider.

Target: OIDC_CLIENT_SECRET

OIDC Display NameVariable

Name shown on the sign in button, for example Authentik.

Target: OIDC_DISPLAY_NAME

OIDC Allowed EmailsVariable

Comma-separated list of email addresses allowed to sign in.

Target: OIDC_ALLOWED_EMAILS

OIDC Allowed GroupsVariable

Comma-separated list of groups allowed to sign in.

Target: OIDC_ALLOWED_GROUPS

OIDC Groups ClaimVariable

Name of the token claim that carries group membership. Defaults to groups.

Target: OIDC_GROUPS_CLAIM

OIDC Allow Any AuthenticatedVariable

Set true to let anyone your provider authenticates sign in, instead of listing emails or groups.

Target: OIDC_ALLOW_ANY_AUTHENTICATED
Default: false
Value: false

OIDC Auto Sign InVariable

Set true to send visitors straight to the provider instead of showing the login form.

Target: OIDC_AUTO_LOGIN
Default: false
Value: false

Agent API Rate LimitVariable

Requests per minute allowed on the agent API. Leave blank for the default.

Target: AGENT_API_RATE_LIMIT

Extra CA BundleVariable

Path inside the container to a CA bundle, when Traefik or CrowdSec use a private certificate authority.

Target: REQUESTS_CA_BUNDLE

Library

Curated

Categories

traefik-manager

Overview

Readme

Traefik Manager for Unraid

Which one do I want?

Features

Configuration

Help and issues

Links

License

Requirements

Categories

Related apps

Links

Details

Runtime arguments

Template configuration