Overview

A self-hosted web UI for managing and monitoring your Traefik reverse proxy - add routes, manage middlewares, view TLS certificates, and inspect live traffic, all without editing YAML by hand.

---

Get Started

One command installs the tm CLI and runs tm install, which sets up Traefik and Traefik Manager together, Traefik Manager on its own, or the agent on a remote host.

curl -fsSL https://get-traefik.xyzlab.dev | bash

tm then manages the install: tm status, tm update, tm reconfigure, tm doctor.

What the installer sets up →

Install it yourself

DockerYou already run containers. Compose file, image on GHCR.PodmanYou want rootless. Quadlet units and SELinux labels covered.LinuxNo container runtime. Python and a systemd service on the host.UnraidInstall from the Community Applications template.

---

Management

Always visible. These tabs read and write your Traefik dynamic config.

Tab	Description
Routes	Create, edit, delete, and enable/disable HTTP, TCP, and UDP routes
Middlewares	Create and manage middlewares with built-in templates
Services	Read-only view of all services across every provider

Multiple config files - mount several dynamic config files with CONFIG_DIR or CONFIG_PATHS. A dropdown in the route and middleware forms picks the file each entry is written to. See Environment Variables.

---

Navigation and layout

Tabs live in the left side nav, grouped Traffic, Observability, Infrastructure and Providers. Settings opens from its foot, or with Shift + P.

Layout is set under Settings - Interface - Layout, instance-wide.

Layout	Content	Detail panel
Fluid (default)	Fills the screen	Pushes the page
Fixed	Capped width	Slides over

---

Stat panel

Above the content on the Dashboard, Routes, Middlewares and Services tabs sits a panel that answers one question: is anything wrong right now.

A verdict line sums up every problem in plain language and names the providers responsible. Four cards - HTTP routers, TCP/UDP routers, services and middlewares - each show a total, a strip with one cell per object worst-first, and counts you can click to jump straight to the broken ones. A provider strip scopes all four cards to one provider in a click. Below them, entry points list their protocol, flags, address and bound router count, over a runtime footer with the Traefik version, uptime and whether metrics, access logs and tracing are on.

Colour is rationed: a healthy install is almost monochrome, so anything coloured is worth reading.

Choose which of the four tabs show it under Settings - Interface - Show on, and switch to a denser layout with Compact stat cards. The Logs and CrowdSec analytics panels use the same visual language.

---

Static Config Editor

Edit your Traefik static config (traefik.yml) from the UI - no SSH needed. Changes are staged until you save, every save is backed up first, and a one-click restart applies them via your configured restart method.

What you can manage:

• Entrypoints - ports, redirects, trusted IPs, PROXY protocol, TLS defaults, middleware chains, timeouts
• Certificate resolvers - ACME challenges, custom CA, key type, EAB, DNS propagation
• Providers - Docker and File toggles, other providers via templates, throttle duration
• Plugins (remote and local), API and dashboard, logging with rotation and access-log filters
• Observability (ping, Prometheus, OTLP tracing) and system options (servers transport, rule syntax)
• Raw YAML editor (Monaco/VS Code engine) for anything else

Works identically for remote agents - the sections read and write the active agent's own traefik.yml.

Setup required:

Requirement	Details
Mount traefik.yml read-write	-v /path/to/traefik.yml:/app/traefik.yml (no :ro)
Set STATIC_CONFIG_PATH	Path inside the container, e.g. /app/traefik.yml. No default. Also settable under Settings - System Monitoring - File Paths
Set RESTART_METHOD	How TM restarts Traefik after a config change - proxy (default), poison-pill or socket

Once the file is readable, Settings - Interface - Tabs places the editor: Off, inside Settings, or as its own Tab.

See Static Config Editor for each restart method.

---

Multi-Server

Manage remote Traefik instances from one UI through TMA, a small Go agent that runs next to Traefik on each server. A switcher at the top of the side nav changes the active server, and every tab - routes, middlewares, services, backups, logs - then works against it. No VPN or SSH required.

Adding an agent generates a ready-to-paste Docker Compose or Docker Run command. The API key is shown once and stored encrypted.

---

Backups

Every change writes a timestamped backup first, and any of them can be restored in one click. Retention is configurable.

Git backup additionally pushes your config to GitHub, Gitea, Forgejo, GitLab or any HTTPS remote, with commit history, side-by-side diffs and one-click restore of any commit. Agents can push to the Host's repository on their own branch, one branch per server, so a single repository covers every server.

---

Visualizations

Optional tabs, no extra mounts needed. Dashboard, Route Map and TLS Options toggle on in Settings - Interface - Tabs; CrowdSec in Settings - System Monitoring - Tab Visibility. The setup wizard can turn on Dashboard and Route Map; TLS Options and CrowdSec are Settings only.

Tab	Description
Dashboard	Routes grouped by category with app icons, custom groups, per-card editing, and one-click app launching
Route Map	Topology connection map - entry points → routes → middlewares → services
TLS Options	Named tls.options profiles - min/max version, ciphers, mTLS - assignable per route
CrowdSec	Who is attacking, from where, how and what they went after, from a CrowdSec LAPI; ban, captcha, bypass or unban with one click

---

Monitoring

Optional tabs - each requires a file mounted into the container.

Tab	Mount required	Description
Certificates	acme.json:/app/acme.json:ro	TLS certificates with expiry tracking. ACME_JSON_PATH accepts several files or a directory, for setups with one resolver per storage file
Plugins	traefik.yml:/app/traefik.yml plus STATIC_CONFIG_PATH=/app/traefik.yml (no default)	Plugins from your static config with the middlewares using each one, plus a guided install. Versions are checked against the catalog daily and flagged when one is out of date. Add :ro to keep the tab read-only
Logs	access.log:/app/logs/access.log:ro	Access log analytics: status, latency, paths, clients and services as clickable cards over a live tail, with optional auto refresh and a world map

---

Providers

Read-only tabs that pull live data from the Traefik API - no extra mounts, just a working API connection. Each lists that provider's routers and its middlewares.

Orchestrators

Tab	Provider
Docker	docker
Kubernetes	kubernetesCRD / kubernetesIngress / kubernetesGateway
Swarm	swarm
Nomad	nomad
ECS	ecs
Consul Catalog	consulCatalog

Key-Value Stores

Tab	Provider
Redis	redis
etcd	etcd
Consul KV	consul
ZooKeeper	zooKeeper

Config-based

Tab	Provider
HTTP Provider	http
File (external)	file

Traefik Manager's own routes are automatically excluded from the File provider tab.

---

Configuration

Settings open from the foot of the side nav. Each pane lists its settings as aligned rows carrying the setting name, what it does and its control.

The search box above the panes filters every pane at once by name and description: matches elsewhere show as a count beside that pane in the sidebar, so you can find a setting without knowing where it lives.

A verdict line above the search flags anything that needs attention, such as no authentication being active.

Page	Description
manager.yml	Full settings file reference - all keys, types, and defaults
Environment Variables	All supported environment variables with override behaviour
OIDC / SSO Login	OpenID Connect as an additional login method alongside the built-in password
Notification Webhooks	Forward events to Discord, Slack, ntfy or any JSON endpoint
Git Repository Backup	Auto-push, commit history, diff viewer and one-click restore

---

Operations

Page	Description
Reset Password	CLI reset, TOTP recovery, and manual reset via manager.yml
Security	Security controls, API keys, sessions, and hardening recommendations
Traefik Hardening	CVE advisories, header aliases, forwardAuth limits, and real client IPs
Development	Project layout, running the test suite, and what a pull request needs

---

Self Route

Put Traefik Manager itself behind Traefik so you can reach it on a domain with HTTPS.

Go to Settings - Connection - Self Route. The URL pre-fills from your current hostname; the service URL and entry point are detected from your existing config. Click Save Route and TM writes the router and service entries into your dynamic config file. No changes to traefik.yml needed.

---

Traefik provider config snippets

Minimal additions to your traefik.yml to enable each provider tab.

providers:
  docker:
    exposedByDefault: false

---

Mobile App

A companion Android app. See the requirements table for which server version each app release needs.

Connect it with an API key: go to Settings - Authentication - API Keys, click Add Key, enter a device name, and copy the generated key. Each device gets its own key, so one can be revoked without affecting the others.

Traefik Manager Mobile

Browse routes, middlewares, and services. Enable/disable routes. Add and edit with built-in templates. Follows system light/dark theme.

Download APKRelease page

Mobile docs →

---

Tech Stack

Layer	Technology
Backend	Python 3.11 · Flask 3.1 · Gunicorn
Agent	Go 1.25 · Alpine Linux (TMA - remote agent daemon)
Config	ruamel.yaml (preserves comments and Go templates)
Auth	bcrypt · pyotp (TOTP) · Flask sessions · CSRF · Flask-Limiter · Fernet
Frontend	Vanilla JS · Tailwind CSS 3.4 · Phosphor Icons
Editor	Monaco Editor 0.52 (VS Code engine)
Route Map	dagre 3.1 (graph layout)
Geolocation	maxminddb · DB-IP Lite (local lookups, no external calls)
Tests	pytest · ruff · go test - run on every pull request
Container	Docker · Alpine Linux · all JS/CSS bundled at build time (no CDN at runtime)