A clean, self-hosted web UI for managing your Traefik reverse proxy.
Add routes, manage middlewares, monitor services, and view TLS certificates - all without touching a YAML file by hand.
Built for homelabbers who love Traefik but hate editing YAML at 2am.
- Routes - add, edit, clone, and enable/disable HTTP, TCP, and UDP routes from the browser
- Load balancing - multiple backends per route, sticky sessions, health checks, and router priority
- Middlewares - 24 guided wizards plus a raw YAML editor, for HTTP and TCP
- Multi-server - manage unlimited remote Traefik instances through a lightweight Go agent
- Static config editor - edit the full
traefik.ymlfrom the UI and apply it with a one-click Traefik restart - Backups - timestamped local backups plus git push with history, diffs, and one-click restore
- Monitoring - live services, certificates, access logs, CrowdSec, and CVE advisory warnings
- Mobile app - Android companion app on Google Play
One-liner installer - installs Traefik + Traefik Manager together, or Traefik Manager on its own via Docker or a native Linux service:
curl -fsSL https://get-traefik.xyzlab.dev | bashManual Docker Compose:
services:
traefik-manager:
image: ghcr.io/chr0nzz/traefik-manager:latest
container_name: traefik-manager
restart: unless-stopped
ports:
- "5000:5000"
environment:
- COOKIE_SECURE=false
volumes:
- /path/to/traefik/dynamic.yml:/app/config/dynamic.yml
- /path/to/traefik-manager/config:/app/config
- /path/to/traefik-manager/backups:/app/backupsdocker compose up -dOpen http://your-server:5000 - the setup wizard will guide you through the rest.
- Add, edit, clone, delete, and enable/disable HTTP, TCP, and UDP routes
- Multiple domains per route with a chip builder, or switch to the advanced rule editor for complex expressions (
PathPrefix,HostRegexp,&&/||) - Multiple backends per route - point HTTP, TCP, or UDP at several servers and let Traefik load-balance across them; route cards show a
+Nbadge - Sticky sessions, health checks, and router priority -
loadBalancer.sticky.cookie,loadBalancer.healthCheck, androuter.priorityas form fields instead of raw YAML - Guided route presets - one-click security headers and streaming tuning for Jellyfin/Emby/Plex; the middlewares they generate stay visible and editable, and hand-written ones are never overwritten
- Per-route certificate resolver - pick any configured resolver, request wildcard certificates, or disable TLS
- TLS options profiles - create named
tls.options(min/max version, ciphers, mTLS, SNI strict) and assign them per route - insecureSkipVerify per service for backends with self-signed certs (Proxmox, Kasm, etc.)
- Multi-config file support - mount several dynamic files via
CONFIG_DIR/CONFIG_PATHS, choose the target file per route, create new files from the UI - Optional app icons on route cards and lists, shared with the Dashboard tab
- 24 guided wizards: Basic/Digest Auth, Forward Auth (with Authentik, Authelia, and Gatekeeper presets), OIDC Auth, Rate Limit, In-Flight Requests, IP Allowlist, Secure Headers, CORS, Redirects, Strip/Add/Replace Prefix, Retry, Circuit Breaker, Buffering, Compress, Chain, Encoded Characters, and more
- Raw YAML editor for anything the wizards don't cover
- Client IP source selector in the IP Allowlist wizard - match the real client instead of your proxy, via trusted hop depth (
ipStrategy.depth) or excluded proxy IPs (ipStrategy.excludedIPs) - TCP middlewares alongside HTTP
- Provider middlewares (Docker, Kubernetes, etc.) shown read-only in the provider tabs
- Real-time stats: router counts, service health, entrypoints, Traefik version
- Provider tabs: Docker, Kubernetes, Swarm, Nomad, ECS, Consul Catalog, Redis, etcd, Consul KV, ZooKeeper, HTTP, File - all API-based, no extra mounts
- Traefik CVE advisory warnings - flags known security advisories affecting your running Traefik version
- Optional tabs (toggle in Settings) - API-based, no mounts:
- Dashboard - routes grouped by category with app icons from selfh.st/icons (cached locally), per-card name/icon/group overrides
- Route Map - entry points, routes, middlewares, and services in a visual topology
- TLS Options - create and manage named
tls.optionsprofiles, assignable per route - CrowdSec - decisions and alerts from a LAPI; ban, captcha, bypass, or unban IPs with one click
- IP geolocation (optional, off by default) - country flags and a shaded, clickable world map of where your traffic and bans come from, on the Logs and CrowdSec tabs; lookups run on the server against a local DB-IP database (no IPs leave your machine), or point
GEOIP_DB_PATHat your own MaxMind.mmdb - Optional tabs that read a mounted file:
- Certs (mount
acme.json) - TLS certificates with expiry tracking; accepts several storage files or a directory, one per cert resolver - Plugins (mount
traefik.yml) - view plugins declared in your static config, and install new ones by pasting the snippet from the plugin catalog - TM writes the static config, optionally creates the matching middleware, and prompts a restart - Logs (mount the Traefik access log) - parsed access log cards with full-detail panel
- Certs (mount
- Client IP Diagnostic - a read-only tool in the top nav showing what this instance actually sees for your own request: the trusted client IP (the one that feeds the login and audit log,
ipAllowList, and CrowdSec), the raw socket peer, the trusted proxy hop count, and the forwarding headers as received. Warns when the trusted IP is private, loopback, or CGNAT while you expect public clients - Source-IP classification in the Logs tab - every IP in Top IPs is tagged Public, Private, CGNAT, Loopback, or Link-local, so local noise like a gateway's hairpin-NAT address is easy to tell apart from real traffic
- Configurable file paths - set the
acme.json, access log, and static config paths from Settings → File Paths without a container restart; UI settings override env vars - Light, dark, or system theme - the nav-bar toggle sets the default for the whole instance, including the login page
- Card/list view toggle on Routes, Middlewares, and Services
- Edit every part of
traefik.ymlfrom the UI - Entrypoints, Cert Resolvers, Plugins, API, Logging, and Providers sections, plus a raw Monaco YAML editor for the full file - Changes are staged and backed up; apply them with a one-click Traefik restart - via socket proxy (recommended), poison pill (no socket needed), or direct socket
- Full-screen reconnect overlay polls until Traefik is back up
- Timestamped backups before every change, one-click restore, configurable retention
- Git repository backup - auto-push your config to GitHub, Gitea, Forgejo, GitLab, or any HTTPS remote; browse commit history, view side-by-side diffs, restore any commit, set custom commit messages
- One repository for all servers - agents can push to the Host's repository on their own branch, one branch per server (enforced), with per-agent history, diffs, and restore
- Traefik Manager Agent (TMA) - a lightweight Go daemon that runs next to Traefik on any remote server
- Server switcher in the nav bar - every tab (routes, services, middlewares, backups, logs) works against the active server
- Setup wizard generates a ready-to-paste Docker Compose or Docker Run command; API key shown once and stored encrypted
- Cert resolvers without mounting the static config - resolvers already in use by that server's routes are detected from its Traefik API, merged with its static config when mounted, plus an optional per-agent override field
- Git backup without agent-side setup - enable Use Host Repository and the Host pushes that agent's config to its git repo on a dedicated branch; or run agents autonomously via
GIT_BACKUP_*env vars - Manage unlimited servers from one TM - no VPN or SSH required
- In-app notification center for logins, config saves, restarts, backups, and CrowdSec actions
- Webhook forwarding to Discord, Slack, ntfy, or any generic JSON endpoint, with a test button in Settings
- bcrypt passwords (cost 12), optional TOTP 2FA, session fixation protection, configurable inactivity timeout
- OIDC / SSO - Keycloak, Google, Authentik, or any OIDC provider; restrict by email or group; can run as the sole login method with built-in auth disabled
- Per-device API keys (up to 10, individually revocable) - the mobile app keeps working in every auth mode
- CSRF protection, rate limiting, SSRF and git-transport hardening, secrets encrypted at rest (Fernet), atomic config writes
- Configurable trusted proxy hops -
PROXY_FIX_HOPS(default1) sets how many reverse-proxy hops to trust when readingX-Forwarded-For, so the login and audit log record the real client behind a chain like Cloudflare → Traefik → TM. Only count hops you actually control - each trusted hop is one more entry a client could forge - See the security and Traefik hardening docs
Full documentation at traefik-manager.xyzlab.dev
| Get Started | Deployment guides for Docker, Podman, and Linux |
| Traefik Stack | One-liner installer guide |
| Configuration | manager.yml reference |
| Environment Variables | CONFIG_DIR, CONFIG_PATHS, auth, domains, and more |
| Security | API keys, sessions, CSRF, rate limits, and hardening |
| Traefik Hardening | CVE advisories, header aliases, forwardAuth limits |
| API Reference | REST API for integrations and the mobile app |
| Agent API | TMA endpoints, auth, and health checks |
| Static Config Editor | Entrypoints, cert resolvers, and the restart flow |
| IP Geolocation | Country flags, world map, and bring-your-own database |
| Notification Webhooks | Discord, Slack, ntfy, and generic JSON payloads |
| OIDC / SSO | OIDC setup, provider examples, and access control |
| Git Repository Backup | Auto-push, commit history, diff viewer, and one-click restore |
| Mobile App | Android companion app setup and features |
| Reset Password | CLI reset, TOTP recovery, manual reset |
| UI Examples | Screenshots and walkthroughs |
| Provider Tabs | Docker, Kubernetes, Swarm, Nomad, ECS, and more |
traefik-manager-mobile is a React Native companion app for managing Traefik Manager from your phone. Requires Traefik Manager v1.0.0 or higher.
| Repo | github.com/chr0nzz/traefik-manager-mobile |
| Download | Latest release |
| Auth | Per-device API key - generate one in Settings → Authentication → App / Mobile API Keys |
Features: browse routes, middlewares, and services · enable/disable routes · add and edit routes and middlewares with guided wizards · multiple domains per route · per-service insecureSkipVerify · multi-config file picker · edit mode for bulk actions · CrowdSec tab · system light/dark theme.
| Layer | Technology |
|---|---|
| Backend | Python 3.11 · Flask 3.1 · Gunicorn |
| Agent | Go 1.23 · Alpine Linux (TMA - remote agent daemon) |
| Config | ruamel.yaml (preserves comments and Go templates) |
| Auth | bcrypt · pyotp (TOTP) · Flask sessions · CSRF · Flask-Limiter · Fernet |
| Frontend | Vanilla JS · Tailwind CSS 3.4 · Phosphor Icons |
| Editor | Monaco Editor 0.52 (VS Code engine) |
| Route Map | dagre 0.8 (graph layout) |
| Geolocation | maxminddb · DB-IP Lite (local lookups, no external calls) |
| Tests | pytest · pyflakes · go test - run on every pull request |
| Container | Docker · Alpine Linux · all JS/CSS dependencies bundled at build time (no CDN at runtime) |
Pull requests are welcome. See CONTRIBUTING.md for how to report bugs, suggest features, and run the project locally.
Traefik Manager is better because of the people who took the time to dig into it and send patches. Thank you.
Thanks as well to everyone who has opened an issue or a discussion. Several features started as a question from someone running into something unexpected, and the detail in those reports is what made them fixable.