.env.example

# Traefik Manager (Host) - environment variables
#
# Every variable Traefik Manager reads, with its built-in default. Nothing here
# is required: with no environment at all the setup wizard runs and writes
# everything to manager.yml. Copy this file to .env and uncomment what you need.
#
# Settings marked "UI" can also be changed in the web UI without a restart, and
# the UI value wins over the environment variable.
#
# Full reference: https://traefik-manager.xyzlab.dev/env-vars.html

# ─── Connection ───────────────────────────────────────────────────────────────

# Internal URL of the Traefik API. Must be reachable from inside this container.
# Point it at the internal API, not a public dashboard URL behind auth.
#TRAEFIK_API_URL=http://traefik:8080

# Credentials, if your Traefik API sits behind basic auth. Both are required
# together; leave empty for an unauthenticated internal API.
#TRAEFIK_API_USER=
#TRAEFIK_API_PASSWORD=

# Skip TLS verification when TRAEFIK_API_URL is https with a self-signed or
# Cloudflare Origin certificate.
#TRAEFIK_INSECURE_SKIP_VERIFY=false

# Base domains offered in the Add Route form. Comma-separated.
#DOMAINS=example.com

# ACME cert resolver names, comma-separated. The first is the default for new
# routes. Use "none" if you manage certificates externally.
#CERT_RESOLVER=cloudflare

# ─── Config files ─────────────────────────────────────────────────────────────

# A single dynamic config file.
#CONFIG_PATH=/app/config/dynamic.yml

# Or several explicit files, comma-separated. Takes precedence over CONFIG_PATH.
#CONFIG_PATHS=/app/config/routers.yml,/app/config/services.yml

# Or a whole directory: every .yml/.yaml inside is loaded, recursively, and new
# files can be created from the UI. Takes precedence over both of the above.
#CONFIG_DIR=/app/config

# Where manager.yml and its companion files (agents.yml, templates.yml,
# notifications.yml, dashboard.yml) live.
#SETTINGS_PATH=/app/config/manager.yml

# ─── Optional file paths (UI) ─────────────────────────────────────────────────

# Traefik's acme.json - enables the Certificates tab. Accepts several files
# comma-separated, or a directory whose .json files are all read, since Traefik
# writes one storage file per cert resolver.
#ACME_JSON_PATH=/app/acme.json
#ACME_JSON_PATH=/letsencrypt/ovh.json,/letsencrypt/lan.json
#ACME_JSON_PATH=/letsencrypt

# Traefik's access log - enables the Logs tab. Mount it read-only.
#ACCESS_LOG_PATH=/app/logs/access.log

# Traefik's static config - enables the Static Config editor and Plugins tab.
# Mount read-write if you want to edit it from the UI.
#STATIC_CONFIG_PATH=/app/traefik.yml

# Traefik's plugins directory - enables local plugin listing.
#PLUGINS_DIR=/plugins-local

# ─── Backups ──────────────────────────────────────────────────────────────────

#BACKUP_DIR=/app/backups

# Keep only the last N backups per config file. 0 keeps everything.
#BACKUP_KEEP_COUNT=0

# ─── Authentication ───────────────────────────────────────────────────────────

# Set to false only when another auth layer (Authelia, Authentik, GateKeeper)
# sits in front - the UI is fully open otherwise.
#AUTH_ENABLED=true

# Initial password. Only used on first start, before setup completes. If unset a
# random one is generated and printed to the container log.
#ADMIN_PASSWORD=

# Flask session signing key. Generated and persisted to the config directory if
# unset. Set it to keep sessions valid across a rebuild with no persistent
# config volume.
#SECRET_KEY=

# Encryption key for secrets at rest (TOTP secret, agent API keys, git tokens).
# Generated and persisted if unset. Changing it makes existing secrets
# unreadable and they must be re-entered.
#OTP_ENCRYPTION_KEY=

# Send session cookies only over HTTPS. Set false for plain-http LAN access.
#COOKIE_SECURE=false

# Log out after this many minutes of inactivity.
#INACTIVITY_TIMEOUT_MINUTES=120

# How many reverse-proxy hops to trust when reading X-Forwarded-For. Only count
# hops you actually control: each trusted hop is one more entry a client could
# forge past the login rate-limiter and audit log. 0 ignores the header.
#PROXY_FIX_HOPS=1

# ─── Traefik restart (Static Config editor) ───────────────────────────────────

# How to restart Traefik after a static config change: proxy, poison-pill or socket.
#RESTART_METHOD=proxy

# Container name, used by the proxy and socket methods.
#TRAEFIK_CONTAINER=traefik

# Docker socket-proxy endpoint, used by the proxy method.
#DOCKER_HOST=tcp://socket-proxy:2375

# Signal file the poison-pill method writes, when no socket is available.
#SIGNAL_FILE_PATH=/signals/restart.sig

# ─── CrowdSec (UI) ────────────────────────────────────────────────────────────

#CROWDSEC_LAPI_URL=http://crowdsec:8080

# Bouncer key - reads decisions (active bans, captchas, bypasses).
#CROWDSEC_API_KEY=

# Machine login - required to read alerts and to unban.
#CROWDSEC_MACHINE_ID=
#CROWDSEC_MACHINE_PASSWORD=

# ─── Geolocation (UI) ─────────────────────────────────────────────────────────

# Custom MaxMind-format .mmdb. Leave empty to use the free DB-IP Lite database,
# downloaded on demand. Lookups are local; no IP ever leaves this instance.
#GEOIP_DB_PATH=

# ─── Agents ───────────────────────────────────────────────────────────────────

# Requests per minute this instance allows against its own agent API.
#AGENT_API_RATE_LIMIT=30

# ─── Misc ─────────────────────────────────────────────────────────────────────

#LOG_LEVEL=INFO

# Custom CA bundle, for a private CA in front of Traefik or a git remote.
#REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt