Traefik Manager

{% if not temp_password_mode %}

{% endif %}

{{ _('A web interface for the routes, middlewares and services Traefik already serves. This setup takes about a minute: point it at your Traefik API, pick the views you want, and set a password. Everything here can be changed later in Settings.') }}

{{ _('Create, edit and disable them through a form or raw YAML, written straight to your dynamic config file.') }}

{{ _('Router, service and middleware health read from Traefik itself, not from a cached copy.') }}

{{ _('Expiry dates from your ACME store, and the access log read as analytics rather than a wall of text.') }}

{{ _('Nothing leaves the container. No account, no telemetry, no outbound calls you did not configure.') }}

{{ _('What Traefik Manager looks like for anyone who has not chosen for themselves. Each person can still override it from the toolbar.') }}

{{ _('Traefik Manager reads everything through the Traefik API. This is the one step it cannot work without.') }}

Traefik API

API URL

{{ _('Where this container reaches the Traefik API. On the same Docker network that is usually %(http_traefik_8080)s - the service name, not %(localhost)s. Requires %(api)s in your static config.', http_traefik_8080=tag('code', 'http://traefik:8080', class_='font-mono'), localhost=tag('code', 'localhost', class_='font-mono'), api=tag('code', 'api: {}', class_='font-mono')) }}

{{ _('API credentials %(optional)s', optional=tag('span', _('optional'), class_='wz-opt')) }}

{{ _('Only if your Traefik dashboard sits behind basic auth. Leave both blank when the API is reachable without credentials.') }}

{{ _("A convenience list for the route form's host dropdown. It does not change your Traefik config, your TLS, or your routing - domains found in existing routes are picked up automatically, so this is just seeding.") }}

{{ _('Resolver names from your %(traefik_yml)s, comma-separated. The first becomes the per-route default. If you manage certificates outside ACME, enter %(none)s.', traefik_yml=tag('code', 'traefik.yml', class_='font-mono'), none=tag('code', 'none', class_='font-mono')) }}

{{ _('Give this interface its own hostname through Traefik, so you can reach it over TLS instead of a published port. Writes a %(traefik_manager_self)s into your config directory. Skip it if you already route to this container yourself.', traefik_manager_self=tag('code', 'traefik-manager-self.yml', class_='font-mono')) }}

{% if detected_self_domain %}{{ _('Detected from your existing configuration. Clear it to skip this step.') }}{% else %}{{ _('The hostname you want to open Traefik Manager on. Leave blank to skip this step entirely.') }}{% endif %}

{{ _('How Traefik reaches this container from inside the network. Normally the compose service name and port.') }}

{{ _('The Traefik entry point to attach the router to, as named in your static config - commonly %(websecure)s or %(https)s.', websecure=tag('code', 'websecure', class_='font-mono'), https=tag('code', 'https', class_='font-mono')) }}

{{ _('Each of these adds a tab to the navigation. Turn on what you use - an unused tab is just noise. All of them can be toggled later under Settings, so nothing here is a commitment.') }}

{{ _('An overview of every router grouped by entry point, and a graph of how requests reach each service.') }}

{{ _('Switched on for every provider Traefik is reporting right now. Turn any of them off if you would rather not see it.') }}

Docker

Kubernetes

Swarm

Nomad

ECS

Consul Catalog

Redis

etcd

Consul KV

ZooKeeper

{{ _('Read-only views of routes Traefik discovers from other providers. Turn on the ones you actually run - these routes live in Docker labels or a KV store, so Traefik Manager shows them but cannot edit them.') }}

{{ _('Certificates, Plugins and Logs each read a file that has to be mounted into this container. If it is not mounted yet, the view tells you the exact volume line to add. GeoIP resolves client addresses to countries in Logs and CrowdSec, downloading a free database on first use.') }}

CrowdSec

{{ _('If you run CrowdSec, Traefik Manager can read its local API and show who is probing this host, from which networks, with which scenarios, and what is already blocked. Leave the URL blank to skip.') }}

LAPI URL

{{ _('Where the CrowdSec local API listens. On the same Docker network that is usually %(http_crowdsec_8080)s.', http_crowdsec_8080=tag('code', 'http://crowdsec:8080', class_='font-mono')) }}

{{ _('Reads active decisions - the bans in force. Generate one with %(cscli_bouncers_add)s.', cscli_bouncers_add=tag('code', 'cscli bouncers add traefik-manager', class_='font-mono')) }}

{{ _('Machine login %(optional)s', optional=tag('span', _('optional'), class_='wz-opt')) }}

{{ _('Reads alerts, which is where scenarios, targeted paths and attacking networks come from. This complements the bouncer key rather than replacing it: with only the bouncer key you see bans but not the attacks behind them.') }}

{{ _('Commit every configuration change to a git repository, so you get history, diffs and a one-click restore to any earlier commit. Local file backups happen regardless - this adds an off-box copy. Leave the URL blank to skip.') }}

{{ _('Any HTTPS git remote: GitHub, GitLab, Gitea, Forgejo, or self-hosted. Use a private repository - your dynamic config is in it.') }}

{{ _('The branch to commit to, and the account the token belongs to.') }}

{{ _('A personal access token with write access to that one repository. Stored encrypted, and never shown again after setup.') }}

{{ _('Commit and push on every configuration change. With this off, you push by hand from the Backups pane.') }}

{{ _('Send a message when a route is saved or deleted, a backup runs, or a restore completes. This sets up one destination that receives every event; add more, and choose which events reach each one, in Settings.') }}

{{ _('Payload format for the target service. Generic sends a plain JSON body you can shape yourself downstream.') }}

{{ _('Basic auth %(optional)s', optional=tag('span', _('optional'), class_='wz-opt')) }}

{{ _('Credentials for endpoints that require authentication.') }}

{% if not temp_password_mode %}

{{ _('This is the last step. The password protects the whole interface and is stored as a bcrypt hash, never in plain text. You can change it, add two-factor, or switch to an identity provider later in Settings.') }}

{{ _('At least 8 characters. A long passphrase beats a short complicated one.') }}

{% endif %}

Traefik {{ pgettext('label', '·') }} Traefik Manager

{{ _('Welcome to Traefik Manager') }}

{{ _('Connect to Traefik') }}

{{ _('Route to Traefik Manager itself') }}

{{ _('Choose your views') }}

CrowdSec

{{ _('Git backup') }}

{{ pgettext('heading', 'Notifications') }}

{{ _('Set your password') }}