traefik-manager-agent

Overview

Puts an Unraid server under a Traefik Manager you already run somewhere else. The agent exposes this server Traefik config, certificates, logs and CrowdSec to that hub over one authenticated port, so its routes are edited from the same UI as every other server. It has no UI of its own. Install Traefik Manager first, add a server under Settings, Agents to generate the API key, then paste that key here.

Readme

View on GitHub

Traefik Manager for Unraid

Traefik Manager is a web UI for managing Traefik routes, services, middlewares and certificates. It edits your Traefik dynamic config directly, so routes you create in the UI are ordinary YAML you can read, back up and revert.

Both apps are in Unraid Community Applications. Open the Apps tab, search for Traefik Manager and click Install.

App	Community Applications
Traefik Manager	traefik-manager
Traefik Manager agent	traefik-manager-agent

Which one do I want?

Traefik Manager is the app itself, with the web UI. Install this if Traefik runs on this Unraid server and you want to manage it here.

Traefik Manager agent has no UI. Install it when Traefik runs on this server but you manage it from a Traefik Manager on another machine. Add the server in that Traefik Manager under Settings - Agents to generate an API key, then paste the key into the template.

Features

Routes - HTTP, TCP and UDP routes with multiple domains and backends, sticky sessions, health checks, certificate resolvers and TLS options
Services - load balancer, weighted, mirroring and failover services
Middlewares - 30 guided wizards for auth, rate limiting, headers, CORS, redirects and more, plus a raw YAML editor
Dashboard and Route Map - your apps with icons and health, and a topology map from entry point to backend
Certificates - every certificate in acme.json with expiry, unused certificates and orphaned resolvers
Monitoring - live router and service health from the Traefik API, provider tabs and CVE advisories for your Traefik version
Logs and CrowdSec - access log analytics, CrowdSec attacks, bans and decisions
Notifications - Discord, Slack, ntfy, Gotify, Pushover, Pushbullet, Telegram, UnifiedPush and webhooks, with background checks when the UI is closed
Static config editor - edit traefik.yml and restart Traefik from the UI
Plugins - install Traefik plugins and see which middlewares use them
Backups - a local backup before every change, plus git push with history, diffs and restore
Multi-server - manage Traefik on other hosts through the agent, no VPN or SSH
Security - two-factor login, OIDC single sign-on, per-device API keys and secrets encrypted at rest
Mobile - a native Android app, and the web app installs as a PWA

Configuration

Every template field maps to an environment variable. The Unraid guide covers what to set, which paths to mount for the optional tabs, and how to reach the Traefik API. The environment variable reference lists them all with defaults.

The full documentation is at traefik-manager.xyzlab.dev.

Help and issues

Bugs and feature requests - open an issue on the Traefik Manager tracker
Questions - check the documentation first, then ask on the tracker
Template problems - a missing field, wrong default or broken icon in the Unraid template also goes on the tracker, mention Unraid in the title
Chat - questions and release news on the Discord

When reporting a bug, include your Traefik Manager version, your Traefik version, and the container log from the Unraid Docker tab.

License

GPL-3.0, see LICENSE.

Requirements

A running Traefik Manager elsewhere to connect to, and Traefik on this server with its API reachable from this container.

Related apps

Explore more like this

Explore all

Utilities apps Management apps

Links

Projectgithub.com Supportgithub.com GHCRghcr.io Templateraw.githubusercontent.com

Details

Repository

ghcr.io/chr0nzz/traefik-manager-agent:latest

Registry

https://ghcr.io/chr0nzz/traefik-manager-agent

Last Updated2026-10-27

First Seen2026-09-13

Runtime arguments

Web UI: http://[IP]:[PORT:8090]/health
Network: bridge
Shell: sh
Privileged: false
Extra Params: --restart=unless-stopped

Template configuration

Agent PortPorttcp

Port the Traefik Manager hub connects to. Publish it only on a network the hub can reach.

Target: 8090
Default: 8090
Value: 8090

Config DirectoryPathrw

Your Traefik dynamic config on this server. Point it at the directory Traefik loads, or at a single .yml file. The agent writes here, so it cannot be read only.

Target: /app/config
Default: /mnt/user/appdata/traefik/config
Value: /mnt/user/appdata/traefik/config

Backups DirectoryPathrw

Timestamped backups taken before every change, and the git clone when backups go to a repository. Without this mapping everything here is lost each time the container is updated.

Target: /app/backups
Default: /mnt/user/appdata/traefik-manager-agent/backups
Value: /mnt/user/appdata/traefik-manager-agent/backups

API KeyVariable

Key the hub authenticates with. Generate it in Traefik Manager under Settings, Agents, then paste the same value here.

Target: TMA_API_KEY

Traefik API URLVariable

URL of the Traefik API on this server. Usually http://traefik:8080 when both containers share a Docker network.

Target: TRAEFIK_API_URL
Default: http://traefik:8080
Value: http://traefik:8080

Static Config / Plugins - traefik.ymlPathrw

Optional: this server traefik.yml, for the Static Config editor and the Plugins tab. Must be the same file Traefik itself reads, and read-write to allow saving. Also set the Static Config Path variable to match.

Target: /etc/traefik/traefik.yml

Certs - acme.jsonPathro

Optional: this server acme.json, for certificate expiry and for spotting certificates nothing uses. Also set the acme.json Path variable to /app/acme.json. Read-only is enough to view them; set it read-write, with a Restart Method, to remove certificates from this server.

Target: /app/acme.json

Logs - access.logPathro

Optional: this server Traefik access log, for the Logs tab. Also set the Access Log Path variable to /app/logs/access.log.

Target: /app/logs/access.log

Docker Socket (direct restart)Pathro

Optional: only for Restart Method socket. A socket proxy is the safer choice. Host path: /var/run/docker.sock

Target: /var/run/docker.sock

Restart Signals VolumePathrw

Optional: only for Restart Method poison-pill. Map a shared path here and at the same target in your watcher container, then point Signal File Path inside it. Leave blank for the other restart methods.

Target: /signals

Config PathVariable

Path inside the container to the config mapped above. Change it only if you mapped the config somewhere other than /app/config.

Target: CONFIG_PATH
Default: /app/config
Value: /app/config

Static Config PathVariable

Path inside the container to traefik.yml, for example /etc/traefik/traefik.yml. Leave blank unless you mapped it above.

Target: STATIC_CONFIG_PATH

acme.json PathVariable

Path inside the container to acme.json. Accepts several files comma-separated, or a directory, for one storage file per resolver.

Target: ACME_JSON_PATH

Access Log PathVariable

Path inside the container to the Traefik access log.

Target: ACCESS_LOG_PATH

Plugins DirectoryVariable

Path inside the container to Traefik local plugins directory, for the Plugins tab.

Target: PLUGINS_DIR

Traefik API UsernameVariable

Optional: basic-auth username, when the Traefik API sits behind a basicAuth middleware.

Target: TRAEFIK_API_USER

Traefik API PasswordVariable

Optional: basic-auth password for the Traefik API.

Target: TRAEFIK_API_PASSWORD

Skip Traefik API TLS VerificationVariable

Set true when the Traefik API URL is https with a self-signed or Origin certificate.

Target: TRAEFIK_INSECURE_SKIP_VERIFY
Default: false
Value: false

Restart MethodVariable

How this agent restarts Traefik after a static config change. proxy for a Docker socket proxy, socket for the Docker socket directly, poison-pill for a signal file read by a watcher. Leave blank to disable restarts.

Target: RESTART_METHOD

Traefik Container NameVariable

Name of the Traefik container to restart, used by the proxy and socket methods.

Target: TRAEFIK_CONTAINER
Default: traefik
Value: traefik

Docker Host (socket proxy)Variable

Socket proxy address for Restart Method proxy, for example tcp://socket-proxy:2375.

Target: DOCKER_HOST

Signal File Path (poison pill)Variable

File the agent touches to ask a watcher sidecar to restart Traefik, for example /signals/restart.sig. Map the same volume into both containers.

Target: SIGNAL_FILE_PATH

Backup Directory PathVariable

Path inside the container for backups. Change it only if you mapped backups somewhere other than /app/backups.

Target: BACKUP_DIR
Default: /app/backups
Value: /app/backups

Backup RetentionVariable

Keep only the last N backups per config file. 0 keeps every backup.

Target: BACKUP_KEEP_COUNT
Default: 0
Value: 0

Agent Listen PortVariable

Port the agent listens on inside the container. Change the port mapping above to match if you change this.

Target: TMA_PORT
Default: 8090
Value: 8090

Rate LimitVariable

Requests per minute accepted from the hub.

Target: TMA_RATE_LIMIT
Default: 300
Value: 300

Debug LoggingVariable

Set true to log every request the agent handles.

Target: TMA_DEBUG
Default: false
Value: false

CrowdSec LAPI URLVariable

Optional: CrowdSec Local API on this server, for example http://crowdsec:8080. Enables the CrowdSec tab for this server.

Target: CROWDSEC_LAPI_URL

CrowdSec API KeyVariable

Optional: CrowdSec bouncer key, used to read decisions. Generate with: cscli bouncers add traefik-manager

Target: CROWDSEC_API_KEY

CrowdSec Machine IDVariable

Optional: CrowdSec machine login, needed to view alerts and to unban. Create with: cscli machines add traefik-manager --auto

Target: CROWDSEC_MACHINE_ID

CrowdSec Machine PasswordVariable

Optional: password for the CrowdSec machine login above.

Target: CROWDSEC_MACHINE_PASSWORD

CrowdSec Client CertificateVariable

Optional: path inside the container to a TLS client certificate, when the LAPI requires mTLS instead of a key.

Target: CROWDSEC_CLIENT_CERT

CrowdSec Client KeyVariable

Optional: path inside the container to the private key for the client certificate above.

Target: CROWDSEC_CLIENT_KEY

CrowdSec CA CertificateVariable

Optional: path inside the container to the CA that signed the LAPI certificate.

Target: CROWDSEC_CA_CERT

CrowdSec Alert LimitVariable

How many alerts to read at once, 0 to 100000.

Target: CROWDSEC_ALERT_LIMIT
Default: 500
Value: 500

CrowdSec Read TimeoutVariable

Seconds to wait for a CrowdSec LAPI response, 1 to 120.

Target: CROWDSEC_READ_TIMEOUT
Default: 20
Value: 20

Git Backup EnabledVariable

Leave false unless this agent pushes to git on its own. The usual setup is Use Host Repository in Traefik Manager under Backups, Git, where the hub pushes this server config to its own repository on a separate branch and nothing is configured here.

Target: GIT_BACKUP_ENABLED
Default: false
Value: false

Git Backup RepositoryVariable

Only for a standalone agent: HTTPS URL of the repository to push to.

Target: GIT_BACKUP_REPO

Git Backup BranchVariable

Only for a standalone agent: branch to push to. Give every server its own branch, or they overwrite each other.

Target: GIT_BACKUP_BRANCH
Default: main
Value: main

Git Backup UsernameVariable

Only for a standalone agent: username the token belongs to.

Target: GIT_BACKUP_USERNAME

Git Backup TokenVariable

Only for a standalone agent: personal access token with write access to the repository.

Target: GIT_BACKUP_TOKEN

Git Backup Auto PushVariable

Only for a standalone agent: push after every change instead of committing locally.

Target: GIT_BACKUP_AUTO_PUSH
Default: true
Value: true

Git Backup Commit MessageVariable

Only for a standalone agent: commit message template. {action} and {timestamp} are replaced.

Target: GIT_BACKUP_COMMIT_MESSAGE
Default: traefik-manager: {action} at {timestamp}
Value: traefik-manager: {action} at {timestamp}

Library

Curated

Categories

traefik-manager-agent

Overview

Readme

Traefik Manager for Unraid

Which one do I want?

Features

Configuration

Help and issues

Links

License

Requirements

Categories

Related apps

Links

Details

Runtime arguments

Template configuration