# Muximux Wiki

[![OWASP ASVS](https://img.shields.io/badge/OWASP_ASVS-Level_2-005571?logo=owasp)](security.md)
[![Security](https://sonarcloud.io/api/project_badges/measure?project=mescon_Muximux&metric=security_rating)](https://sonarcloud.io/summary/overall?id=mescon_Muximux)
[![Codecov](https://codecov.io/gh/mescon/Muximux/branch/main/graph/badge.svg)](https://codecov.io/gh/mescon/Muximux)
[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=mescon_Muximux&metric=alert_status)](https://sonarcloud.io/summary/overall?id=mescon_Muximux)

Muximux is a modern, self-hosted web application portal for your homelab. It runs as a single binary, serves on a single port, and stores all configuration in one YAML file. Add your self-hosted applications, organize them into groups, and access them from a unified dashboard with health monitoring, keyboard shortcuts, and a built-in reverse proxy.

![Muximux tour](https://raw.githubusercontent.com/mescon/Muximux/main/docs/muximux-tour.gif)

[![Muximux dashboard](https://raw.githubusercontent.com/mescon/Muximux/main/docs/screenshots/09-dashboard-dark.png)](https://raw.githubusercontent.com/mescon/Muximux/main/docs/screenshots/09-dashboard-dark.png)

## How You Can Use Muximux

Muximux is designed to fit your setup, from a simple dashboard to a full reverse proxy appliance.

**Dashboard only** -- Run Muximux behind your existing reverse proxy (Traefik, nginx, Caddy, etc.) with `auth: none` and let your proxy handle TLS and authentication. Apps open via their direct URLs or in iframes. This is the simplest setup.

**Dashboard + built-in reverse proxy** -- Same as above, but enable `proxy: true` on apps that don't work in iframes. Muximux proxies those apps through `/proxy/{slug}/`, stripping iframe-blocking headers and rewriting paths. This works in all deployment modes -- no extra configuration needed.

**Full reverse proxy appliance** -- Use Muximux as your only reverse proxy. Configure `tls.domain` for automatic HTTPS and declare your other services under `gateway_sites:` (or set them up in **Settings -> Gateway**) to serve them on their own subdomains. Caddy handles TLS certificates, HTTP-to-HTTPS redirects, and routing -- all from one binary. Optionally gate each subdomain behind the Muximux login (`require_auth: true`) so one sign-in covers your whole homelab. See [TLS & HTTPS](tls-and-gateway.md) and [Gateway Auth Gate](gateway-auth.md) for full walkthroughs.

## Table of Contents

- [Installation](installation.md) -- Docker, binary, and building from source
- [Getting Started](getting-started.md) -- First launch, onboarding wizard, and initial setup
- [Configuration Reference](configuration.md) -- Full config.yaml format and all available options
- [Apps](apps.md) -- Adding, configuring, and managing applications
- [Built-in Reverse Proxy](reverse-proxy.md) -- Proxying app traffic through Muximux
- [Docker Discovery](docker-discovery.md) -- Auto-import containers as apps with a background refresh poller
- [Security Overview](security.md) -- Security measures, OWASP ASVS compliance, and hardening details
- [Authentication](authentication.md) -- Built-in auth, forward auth, and OIDC
  - [Microsoft Entra ID](oidc-microsoft-entra-id.md) -- step-by-step OIDC setup, including readable group names
  - [Keycloak](oidc-keycloak.md) -- realm-based OIDC client with the `groups` mapper
  - [Authentik](oidc-authentik.md) -- OAuth2 / OpenID provider with the `groups` scope
  - [Pocket ID](oidc-pocket-id.md) -- minimal self-hosted IdP with passkey sign-in
  - [Zitadel](oidc-zitadel.md) -- self-hosted IdP with project roles as groups
  - [Google](oidc-google.md) -- consumer + Workspace accounts (no group support)
  - [Authelia](forward-auth-authelia.md) -- forward auth via Traefik / Nginx / Caddy, or OIDC mode
  - [Cloudflare Access](forward-auth-cloudflare-access.md) -- forward auth via Cloudflare Zero Trust
- [TLS & HTTPS](tls-and-gateway.md) -- Automatic certificates, custom certificates, and gateway mode
- [Gateway Examples](gateway-examples.md) -- Recipes for proxying common homelab services
- [Gateway Auth Gate](gateway-auth.md) -- Single sign-on across gateway subdomains
- [Navigation & Layout](navigation.md) -- Sidebar positions, auto-hide, labels, and display options
- [Split View](split-view.md) -- Side-by-side or stacked app panels with draggable divider
- [Themes](themes.md) -- Built-in themes, custom themes, and CSS custom properties
- [Health Monitoring](health-monitoring.md) -- Opt-in health checks and status indicators
- [Keyboard Shortcuts](keyboard-shortcuts.md) -- Default shortcuts and custom keybindings
- [Icons](icons.md) -- Dashboard Icons, Lucide icons, custom icons, and caching
- [Deployment Guide](deployment.md) -- Production deployment, reverse proxies, and networking
- [Troubleshooting](troubleshooting.md) -- Common issues and solutions
- [API Reference](api.md) -- REST API endpoints for programmatic access