Port to access the Traefik Manager web UI.

Target

5000

Default

5000

Value

5000

Stores manager.yml (settings, password, API keys) and the session signing key. Must be persistent.

Target

/app/config

Default

/mnt/user/appdata/traefik-manager/config

Value

/mnt/user/appdata/traefik-manager/config

Timestamped backups of your dynamic config are saved here before every change.

Target

/app/backups

Default

/mnt/user/appdata/traefik-manager/backups

Value

/mnt/user/appdata/traefik-manager/backups

URL of the Traefik API. Usually http://traefik:8080 when on the same Docker network.

Target

TRAEFIK_API_URL

Default

http://traefik:8080

Value

http://traefik:8080

Optional: basic-auth username for the Traefik API, if your API/dashboard is protected by a basicAuth middleware.

Target

TRAEFIK_API_USER

Optional: basic-auth password for the Traefik API. Only needed if TRAEFIK_API_USER is set.

Target

TRAEFIK_API_PASSWORD

Comma-separated list of base domains shown in the Add Route form. Example: example.com,home.lab

Target

DOMAINS

Default

example.com

Value

example.com

Default ACME certificate resolver name from your traefik.yml. Comma-separate multiple resolvers.

Target

CERT_RESOLVER

Default

cloudflare

Value

cloudflare

Path inside the container to your Traefik dynamic config file. Use this for a single config file. Mount the file via the path mapping below. Leave blank if using CONFIG_DIR or CONFIG_PATHS.

Target

CONFIG_PATH

Default

/app/config/dynamic.yml

Value

/app/config/dynamic.yml

Path inside the container to a directory containing multiple .yml config files. All .yml files in this directory will be loaded. Use instead of CONFIG_PATH when managing multiple files. Leave blank if using CONFIG_PATH.

Target

CONFIG_DIR

Comma-separated list of full config file paths inside the container. Use instead of CONFIG_PATH for 2-5 named files. Example: /app/config/routes.yml,/app/config/services.yml. Leave blank if using CONFIG_PATH or CONFIG_DIR.

Target

CONFIG_PATHS

Optional: path to your Traefik acme.json file on the host. Required for the Certs tab. Mount read-only.

Target

/app/acme.json

Optional: path to your Traefik static config file (traefik.yml) on the host. Required for the Plugins tab and the Static Config editor. Mount read-write to allow editing; read-only enables the Plugins tab only. Also set the Static Config Path variable below to /app/traefik.yml.

Target

/app/traefik.yml

Path inside the container to the static config (traefik.yml) you mounted above. Set to /app/traefik.yml to enable the Static Config editor and Plugins tab. Leave blank if not mounting traefik.yml.

Target

STATIC_CONFIG_PATH

Optional: path to your Traefik access log file on the host. Required for the Logs tab. Enable access logging in traefik.yml first: accessLog: filePath: /logs/access.log. Mount read-only.

Target

/app/logs/access.log

How Traefik Manager restarts Traefik after a static config change. Options: proxy (socket proxy - recommended), socket (direct Docker socket), poison-pill (signal file, requires watcher sidecar). Leave empty to disable automatic restart.

Target

RESTART_METHOD

Default

proxy

Value

proxy

Name of the Traefik Docker container to restart. Used by the proxy and socket restart methods.

Target

TRAEFIK_CONTAINER

Default

traefik

Value

traefik

Docker host URL for the socket proxy restart method. Example: tcp://socket-proxy:2375. Only set when RESTART_METHOD=proxy.

Target

DOCKER_HOST

Path to the signal file written by Traefik Manager to trigger a Traefik restart. Only used when RESTART_METHOD=poison-pill. Mount a shared volume to /signals in both this container and the watcher sidecar.

Target

SIGNAL_FILE_PATH

Default

/signals/restart.sig

Value

/signals/restart.sig

Optional: mount the Docker socket for the direct socket restart method (RESTART_METHOD=socket). Host path: /var/run/docker.sock

Target

/var/run/docker.sock

Optional: set a fixed admin password. If left empty a temporary password is generated on first start - check the container log for it.

Target

ADMIN_PASSWORD

Set to true when accessing Traefik Manager over HTTPS (e.g. behind a Traefik reverse proxy with TLS). Required for session cookies to work correctly over HTTPS.

Target

COOKIE_SECURE

Default

false

Value

false

Set to false to disable built-in login. Only use this when Traefik Manager is protected by an external auth provider such as Authentik or Authelia.

Target

AUTH_ENABLED

Default

true

Value

true

Optional: CrowdSec Local API URL (e.g. http://crowdsec:8080) to enable the CrowdSec tab. Can also be set in Settings.

Target

CROWDSEC_LAPI_URL

Optional: CrowdSec bouncer API key, used to read decisions. Generate with: cscli bouncers add traefik-manager

Target

CROWDSEC_API_KEY

Optional: CrowdSec machine login, required to view Alerts and to unban (bouncer keys cannot). Create with: cscli machines add traefik-manager --auto

Target

CROWDSEC_MACHINE_ID

Optional: password for the CrowdSec machine login above. Found in /etc/crowdsec/local_api_credentials.yaml.

Target

CROWDSEC_MACHINE_PASSWORD

Path inside the container to the Traefik Manager settings file. Change this if you want to store it separately from the dynamic config.

Target

SETTINGS_PATH

Default

/app/config/manager.yml

Value

/app/config/manager.yml

Path inside the container where backups are written. Change this if you mount a custom backup volume at a different path.

Target

BACKUP_DIR

Default

/app/backups

Value

/app/backups

Minutes of inactivity before a non-remembered session is logged out.

Target

INACTIVITY_TIMEOUT_MINUTES

Default

120

Value

120

Fernet key for encrypting the 2FA TOTP secret at rest. Auto-generated on first start if not set. Set this if you want to manage the key yourself or ensure it survives config volume replacement. Generate with: python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

Target

OTP_ENCRYPTION_KEY

Session signing key. Auto-generated on first start and saved to /app/config/.secret_key. Set this explicitly to ensure sessions survive a full config wipe, or to share a key across multiple instances.

Target

SECRET_KEY

How many reverse-proxy hops to trust when reading X-Forwarded-For. With Cloudflare in front of Traefik in front of this container, set 2 so the login and audit log record the real client. Set 0 to ignore the header entirely. Only count hops you actually control - each trusted hop is one more entry a client could forge.

Target

PROXY_FIX_HOPS

Default

1

Value

1

Set true when the Traefik API URL is https with a self-signed or Cloudflare Origin certificate.

Target

TRAEFIK_INSECURE_SKIP_VERIFY

Default

false

Value

false

Path to acme.json inside the container, when it is not the default /app/acme.json. Accepts several files comma-separated, or a directory whose .json files are all read - Traefik writes one storage file per certificate resolver.

Target

ACME_JSON_PATH

Path to the Traefik access log inside the container, when it is not the default /app/logs/access.log.

Target

ACCESS_LOG_PATH

Path to Traefik's local plugins directory, for the Plugins tab.

Target

PLUGINS_DIR

Keep only the last N backups per config file. 0 keeps every backup.

Target

BACKUP_KEEP_COUNT

Default

0

Value

0

Path to a custom MaxMind-format .mmdb for IP geolocation. Leave empty to use the free DB-IP Lite database, downloaded on demand. Lookups run locally - no IP leaves the server.

Target

GEOIP_DB_PATH

Logging verbosity. One of debug, info, warning, error.

Target

LOG_LEVEL

Default

info

Value

info

Serve Traefik Manager under a sub path instead of its own hostname, for example /tm. Leave blank to serve at the root.

Target

BASE_PATH

How many CrowdSec alerts to read at once. Leave blank for the default of 500.

Target

CROWDSEC_ALERT_LIMIT

Path inside the container to a TLS client certificate for the CrowdSec LAPI, when it requires mTLS instead of an API key.

Target

CROWDSEC_CLIENT_CERT

Path inside the container to the private key for the CrowdSec client certificate.

Target

CROWDSEC_CLIENT_KEY

Path inside the container to the CA that signed the CrowdSec LAPI certificate.

Target

CROWDSEC_CA_CERT

Seconds to wait for the CrowdSec LAPI to accept a connection. Leave blank for the default.

Target

CROWDSEC_CONNECT_TIMEOUT

Seconds to wait for a CrowdSec LAPI response. Leave blank for the default.

Target

CROWDSEC_READ_TIMEOUT

Set true to sign in with an OpenID Connect provider such as Authentik, Authelia or Keycloak.

Target

OIDC_ENABLED

Default

false

Value

false

Issuer URL of your OIDC provider, for example https://auth.example.com/application/o/traefik-manager/

Target

OIDC_PROVIDER_URL

Client ID issued by your OIDC provider.

Target

OIDC_CLIENT_ID

Client secret issued by your OIDC provider.

Target

OIDC_CLIENT_SECRET

Name shown on the sign in button, for example Authentik.

Target

OIDC_DISPLAY_NAME

Comma-separated list of email addresses allowed to sign in.

Target

OIDC_ALLOWED_EMAILS

Comma-separated list of groups allowed to sign in.

Target

OIDC_ALLOWED_GROUPS

Name of the token claim that carries group membership. Defaults to groups.

Target

OIDC_GROUPS_CLAIM

Set true to let anyone your provider authenticates sign in, instead of listing emails or groups.

Target

OIDC_ALLOW_ANY_AUTHENTICATED

Default

false

Value

false

Set true to send visitors straight to the provider instead of showing the login form.

Target

OIDC_AUTO_LOGIN

Default

false

Value

false

Requests per minute allowed on the agent API. Leave blank for the default.

Target

AGENT_API_RATE_LIMIT

Path inside the container to a CA bundle, when Traefik or CrowdSec use a private certificate authority.

Target

REQUESTS_CA_BUNDLE