Traefik Stack

Install Traefik and Traefik Manager with a single interactive command. It installs tm, a CLI that asks what you want to install and how, generates all required config files, starts the services, and manages the install afterwards.

bash

curl -fsSL https://get-traefik.xyzlab.dev | bash

tm lands in /usr/local/bin. Re-running the one-liner updates tm and opens tm install, which detects an existing install and offers to update or reconfigure it. Installs made by the old setup.sh are adopted automatically: run any tm command in the install directory (or pass --dir) for Docker installs; the Linux service and binary agent are picked up by any tm command when no Docker install is found, or by tm install with the same mode. Their secrets stay where they are until the first tm reconfigure, which moves them to .env (or the agent env file for the binary agent).

Managing the install

Command	What it does
`tm status`	Mode, directory, services, URLs, health
`tm update`	Pulls images, `git pull`, or downloads the agent binary, then restarts
`tm logs [service]`	Follows the logs (`--no-follow`, `-n <lines>`)
`tm restart`, `tm start`, `tm stop`	Whole install, or one service
`tm password`	Prints the temporary password from the logs
`tm reconfigure [--section <id>]`	Re-runs the wizard pre-filled, regenerates the files it wrote, restarts (`--list` shows the sections)
`tm add crowdsec`	Adds CrowdSec to an existing install
`tm doctor`	Checks Docker, ports, DNS, `acme.json`, health endpoints, CrowdSec
`tm uninstall`	Stops the services and removes the files tm wrote, keeping any you changed. `--purge` also removes configs, data and volumes
`tm self-update`	Updates `tm` itself

Commands find the install from --dir or TM_DIR, then the current directory, then the installs tm already knows about.

Mode	Secrets	tm's record of the install
Docker modes	`<install dir>/.env` (mode 600)	`<install dir>/.tm/state.yml`
Linux service	-	`/etc/traefik-manager/tm-state.yml`
Binary agent	`/etc/traefik-manager-agent/env`	`/etc/traefik-manager-agent/tm-state.yml`

Non-interactive install

tm install --answers answers.yml --yes runs without prompts. tm install --dump-answers answers.yml writes the answers of a wizard run (no secrets) to start from, and --dry-run renders every file without starting anything. Secrets come from environment variables of the same name (TMA_API_KEY, CF_DNS_API_TOKEN, ...) or a secrets: map in the file. Schema and examples: traefik-stack README.

Install modes

The first question is what to install:

What would you like to install?
  1) Traefik + Traefik Manager (full stack)
  2) Traefik Manager only
  3) Traefik Manager Agent

Traefik Manager only then asks how to deploy it:

Deployment method
  1) Docker
  2) Linux service (systemd)

tm install --mode <mode> skips the menus: full, tm-docker, tm-native, agent-docker, agent-docker-traefik, agent-binary, or agent to pick only the agent method.

Mode 1 - Traefik + Traefik Manager (full stack)

Installs both via Docker Compose. Best for a fresh server with nothing running yet.

Prerequisites

A Linux server (amd64, arm64 or armv7). Docker is installed for you on Debian/Ubuntu, RHEL/Fedora and Arch; anything else falls back to the get.docker.com script.
A domain name with DNS pointing to your server
Ports 80 and 443 open for internet-facing deployments

Sections and review screen

The setup runs through numbered sections (General, Deployment type, Domain, TLS / Certificates, Dynamic config, Optional mounts, CrowdSec, Docker network). After the last one a review table summarizes every answer:

  Review configuration
  ────────────────────────────────────────────────────────
   1  General             ~/traefik-stack
   2  Deployment type     external (internet-facing)
   3  Domain              example.com  dash:traefik.example.com  tm:manager.example.com
   4  TLS / Certificates  Let's Encrypt DNS (cloudflare)  you@example.com
   5  Dynamic config      Directory
   6  Optional mounts     logs certs static(restart:proxy)
   7  CrowdSec            install alongside
   8  Docker network      traefik-net  api:8080
  ────────────────────────────────────────────────────────

  Edit a section (1-8) or Enter to install:

Type a section number to re-configure it, then press Enter with no number to install. Nothing is written to disk until you confirm.

What the wizard configures

Install directory - where all files are created (default: ~/traefik-stack)

Deployment type

External - internet-facing, requires ports 80/443 open and DNS A records
Internal - LAN, VPN, or Tailscale only

Domain

Your base domain and subdomains for:

Traefik dashboard (default: traefik.yourdomain.com)
Traefik Manager (default: manager.yourdomain.com)
Whether to enable the Traefik API dashboard UI

TLS / Certificates

Option	Requires
Let's Encrypt - HTTP challenge	Port 80 open. Simplest for most setups.
Let's Encrypt - DNS: Cloudflare	A Cloudflare API token. Works without port 80.
Let's Encrypt - DNS: Route 53	AWS access key, secret, and region.
Let's Encrypt - DNS: DigitalOcean	A DigitalOcean API token.
Let's Encrypt - DNS: Namecheap	Namecheap API user and key.
Let's Encrypt - DNS: DuckDNS	A DuckDNS token.
Let's Encrypt - DNS: deSEC	A deSEC token. Works without port 80.
No TLS (HTTP only)	Port 80 only. Suitable for internal LAN use.

Dynamic config layout

Option	Description
Single file (`dynamic.yml`)	All routes in one file. Simpler to start with.
Directory (one `.yml` per service)	One file per service. Easier to manage at scale.

Optional mounts

Mount	Default	Enables
Access logs	Yes	Logs tab in Traefik Manager
SSL certs (`acme.json`)	Yes	Certs tab in Traefik Manager
Traefik static config (`traefik.yml`)	No	Plugins tab + Static Config editor

Docker network - network name (default: traefik-net) and Traefik internal API port (default: 8080)

Static config editor - enabling the static config mount also asks which restart method to use (socket proxy, poison pill, or direct socket). tm then writes every required compose addition - socket proxy service, shared signal volume, Traefik healthcheck, env vars on TM - so the editor works out of the box. It covers entrypoints, certificate resolvers, providers, plugins, API, logging, observability and system settings, plus a raw YAML editor for anything else. See Static Config Editor.

For an existing install that skipped it:

tm reconfigure --section mounts - answer the static config questions differently. docker-compose.yml is regenerated from your answers; config files and backups are preserved. If you edited the compose file by hand, tm asks before overwriting it and keeps a backup.
Enable manually - see Enable static config editor to add only the volume, env vars, and restart method to your existing compose.

CrowdSec IDS

Option	What happens
Install as part of this stack	Adds a `crowdsec` service, generates a random bouncer API key, writes `crowdsec/acquis.yaml` pointing at the Traefik access log, and sets `CROWDSEC_LAPI_URL` + `CROWDSEC_API_KEY` on Traefik Manager.
Connect to existing instance	Prompts for the LAPI URL and bouncer key of a CrowdSec instance you already run, plus optional machine credentials for alerts and unban. No new service is added.

Choosing the install option turns the access log mount on automatically - CrowdSec needs it.

Once installed, enable the CrowdSec tab under Settings → System Monitoring → Tab Visibility to view active decisions, recent alerts, and unban IPs.

Directory structure

~/traefik-stack/
- docker-compose.yml
- .env                   (secrets, mode 600)
- .tm/
  - state.yml            (tm's record of the install)
- traefik/
  - traefik.yml
  - acme.json
  - logs/
    - access.log
  - config/
    - dynamic.yml        (single file layout)
    - *.yml              (directory layout)
- traefik-manager/
  - config/
  - backups/
- crowdsec/              (only if CrowdSec install mode chosen)
  - acquis.yaml

DNS records

Create A records before running tm install so Let's Encrypt can issue certificates:

traefik.yourdomain.com  A  <server-ip>
manager.yourdomain.com  A  <server-ip>

Updating

Option	Command
`tm`	`tm update`
Manual	`cd ~/traefik-stack && docker compose pull && docker compose up -d`

Useful commands

bash

tm status
tm logs traefik-manager
tm doctor
tm password
tm restart
tm stop

Or directly with Compose from ~/traefik-stack: docker compose logs -f traefik-manager, docker compose down, docker compose restart.

Mode 2 - Traefik Manager only (Docker)

Installs just Traefik Manager as a Docker container. Use this when Traefik is already running on your server.

Sections and review screen

Numbered sections (General, Network, Access, Dynamic config, Optional mounts) end with the same review table as the other modes:

  Edit a section (1-5) or Enter to install:

What the wizard configures

Install directory - default: ~/traefik-manager

Network - connect to an existing Traefik Docker network (default: traefik-net) or create a new one (default: traefik-manager-net)

Access

Via Traefik labels - expose Traefik Manager through your existing Traefik instance with a domain and TLS certificate (same TLS options as full stack mode)
Direct port - expose a host port (default: 5000), no Traefik labels needed

Dynamic config layout - single file or directory, same options as the full stack mode

Optional mounts - you provide the host paths to your existing Traefik files:

Mount	Default	Path asked
Access logs	Yes	Path to Traefik access log (default: `/var/log/traefik/access.log`)
SSL certs (`acme.json`)	Yes	Path to `acme.json` (default: `/etc/traefik/acme.json`)
Traefik static config	No	Path to `traefik.yml` (default: `/etc/traefik/traefik.yml`)

Static config editor - mounting the static config also asks for the restart method (socket proxy, poison pill, or direct socket) and the Traefik container name (default: traefik).

To add static config support later, either run tm reconfigure --section mounts (regenerates the compose file, preserving config and backups) or follow Enable static config editor.

This mode does not ask about CrowdSec. Connect it after install under Settings → System Monitoring → CrowdSec, or set CROWDSEC_LAPI_URL and CROWDSEC_API_KEY in the compose file yourself.

Directory structure

~/traefik-manager/
- docker-compose.yml
- .env                   (secrets, mode 600, only when there are any)
- .tm/
  - state.yml            (tm's record of the install)
- config/
  - dynamic.yml          (or config directory)
- backups/

Updating

Option	Command
`tm`	`tm update`
Manual	`cd ~/traefik-manager && docker compose pull && docker compose up -d`

Useful commands

bash

tm status
tm logs
tm doctor
tm password

Mode 3 - Traefik Manager only (Linux service)

Installs Traefik Manager as a native systemd service. No Docker required. Use this when you run Traefik natively or prefer not to use containers.

Prerequisites

Python 3.11 or newer
git, curl
systemd

Sections and review screen

Numbered sections (General, Service user, Dynamic config, Optional mounts) end with the same review table as the other modes:

  Edit a section (1-4) or Enter to install:

What the wizard configures

Install directory - where the app is cloned (default: /opt/traefik-manager)
Data directory - config and backups (default: /var/lib/traefik-manager)
Port - default: 5000
Dedicated system user - creates a traefik-manager system user to run the service (recommended)
Dynamic config layout - single file (default: /etc/traefik/dynamic.yml) or directory (default: /etc/traefik/conf.d)

Optional mounts - asks for host paths to each:

Mount	Default	Path asked
SSL certs (`acme.json`)	Yes	Path to `acme.json` (default: `/etc/traefik/acme.json`)
Access logs	Yes	Path to Traefik access log (default: `/var/log/traefik/access.log`)
Traefik static config	No	Path to `traefik.yml` (default: `/etc/traefik/traefik.yml`)

Static config editor - mounting the static config asks how Traefik itself runs on this server:

Traefik runs as	Restart method
Docker	Poison pill (recommended - signal file, no Docker socket) or direct Docker socket, which puts the `traefik-manager` user in the `docker` group. Direct socket also asks for the container name (default: `traefik`).
Linux service (systemd)	Poison pill only. `tm` installs a `traefik-restart.path` unit that restarts your Traefik service (default name: `traefik`) when the signal file appears.

Poison pill asks for the signal file path (default: /var/lib/traefik-manager/signals/restart.sig).

To add static config support later, either run tm reconfigure --section mounts (regenerates the systemd unit and restarts the service) or follow Enable static config editor to add the env vars by hand.

This mode does not ask about CrowdSec. Connect it after install under Settings → System Monitoring → CrowdSec, or add CROWDSEC_LAPI_URL and CROWDSEC_API_KEY to the unit file (sudo systemctl edit traefik-manager).

tm clones the repository, creates a Python venv, installs dependencies, builds the vendor assets and CSS, writes the systemd unit, and enables the service. Its record of the install is /etc/traefik-manager/tm-state.yml.

Useful commands

bash

tm status
tm logs
tm doctor
tm password
tm restart

Or with systemd directly: sudo systemctl status traefik-manager, sudo journalctl -u traefik-manager -f, sudo systemctl restart traefik-manager.

Updating

Option	Command
`tm`	`tm update`
Manual	run as the owner of the install directory (`traefik-manager` when a service user was created): `git pull`, `venv/bin/pip install -q -r requirements.txt gunicorn`, `scripts/setup-assets.sh`, then `sudo systemctl restart traefik-manager`

Mode 4 - Traefik Manager Agent

Installs the TMA agent on a remote server so a central Traefik Manager can manage it. This mode does not install TM itself.

Install methods

After choosing Traefik Manager Agent, tm shows an arrow-key menu:

Install method
▸ Docker - Agent only (alongside existing Traefik)
  Docker - Agent + Traefik (deploy both together)
  Binary - Agent only (systemd service, no Docker)

Use ↑/↓ to move, Enter to select, or type a number.

To skip the menus, pass the mode and the agent settings as flags:

bash

tm install --mode agent-docker --api-key <key> --traefik-url http://traefik:8080

Sections and review screen

  Review configuration
  ────────────────────────────────────────────────────────
   1  Install method     Agent only
   2  API key            sk-••••••••
   3  Traefik connection http://traefik:8080
   4  Optional paths     logs
   5  Restart method     none
   6  CrowdSec           disabled
   7  Git backup         disabled
   8  Install location   /opt/traefik-manager-agent  :8090
  ────────────────────────────────────────────────────────

  Edit a section (1-8) or Enter to install:

Type a section number to re-configure it, then press Enter to return to the review. Press Enter with no number to install. The binary method has no Install location section, so it shows 7.

What the wizard asks

Traefik connection (section 3)

Traefik API URL (default: http://traefik:8080)
Dynamic config path (default: /app/config)
Skip TLS verification - shown only when the URL starts with https://; sets TRAEFIK_INSECURE_SKIP_VERIFY for self-signed or Cloudflare Origin certs
Traefik API basic auth - username and password, if the API is behind it
Mount static config (traefik.yml) - toggle; if enabled, asks for the path

Traefik install (Docker - Agent + Traefik only) replaces section 3

Enable HTTPS on port 443
TLS certificate method: Let's Encrypt HTTP challenge, Let's Encrypt Cloudflare DNS, or no TLS
ACME email (if Let's Encrypt)
Cloudflare DNS API token (if Cloudflare DNS)
Cert resolver name (default: letsencrypt)
Enable Traefik dashboard and hostname
Docker network name (default: traefik-net)

Optional paths (section 4) - all off by default

Mount ACME / certs (default: /etc/traefik/acme.json)
Mount access logs (default: /var/log/traefik/access.log)
Mount plugins directory (default: /etc/traefik/plugins)

Restart method (section 5)

None, socket proxy, poison pill, or direct Docker socket

CrowdSec (section 6)

Option	What it does
None	Skip CrowdSec
Install alongside agent	Adds a `crowdsec` service, generates a random bouncer key, writes `crowdsec/acquis.yaml`. Requires the access log mount (prompts if not set). Docker installs only.
Connect to existing	Enter LAPI URL and API key.

Git backup (section 7) - repo URL, branch, username, token, auto-push toggle

Install location (section 8, Docker only) - install directory and agent port (default: 8090)

Docker - Agent only output

Generates docker-compose.yml with only the env vars and volumes for the options you enabled, puts the API key and other secrets in .env, then runs docker compose up -d. If CrowdSec install was chosen, adds a crowdsec service and writes crowdsec/acquis.yaml.

Docker - Agent + Traefik output

Creates this structure and starts both containers:

/opt/traefik-manager-agent/
  docker-compose.yml           (traefik + traefik-manager-agent services)
  .env                         (secrets, mode 600)
  .tm/state.yml                (tm's record of the install)
  backups/
  traefik/
    traefik.yml                (static config - entrypoints, file provider, cert resolver)
    acme.json                  (created empty, chmod 600 - if TLS enabled)
    config/                    (dynamic config dir, shared between Traefik and agent)
    logs/
      access.log
  crowdsec/                    (only if CrowdSec install chosen)
    acquis.yaml

Traefik's API port (8080) is not published - the agent reaches it over the internal Docker network (http://traefik:8080).

Binary output

Downloads the tma binary from GitHub Releases to /usr/local/bin/tma, writes a systemd unit with the non-secret Environment= lines and EnvironmentFile=/etc/traefik-manager-agent/env for the secrets, then runs systemctl enable --now tma.

Useful commands

Both install methods:

bash

tm status
tm logs
tm doctor
tm update
tm reconfigure --section apikey

Docker:

bash

cd /opt/traefik-manager-agent
docker compose logs -f
docker compose pull && docker compose up -d

Binary:

bash

sudo systemctl status tma
sudo journalctl -u tma -f
sudo systemctl restart tma

Next steps after install

In TM Settings → Agents, click Add Agent
Enter a name and the agent URL (e.g. http://server-ip:8090). Traefik Manager generates the API key and shows it once - copy it and set it as TMA_API_KEY on the agent (tm reconfigure --section apikey, or edit the agent's env if you already installed it with a different key).
Use the server switcher in the TM nav bar to switch to this agent

Once tm install completes it prints a temporary password:

Temporary password  abc123xyz

If it is not shown, run tm password, or read it from the logs:

bash

docker logs traefik-manager | grep -A3 "AUTO-GENERATED"

Log in with the temporary password. You are taken straight to the setup wizard, and a forced password-change screen appears as soon as you finish it.

Traefik Stack ​

Managing the install ​

Non-interactive install ​

Install modes ​

Mode 1 - Traefik + Traefik Manager (full stack) ​

Prerequisites ​

Sections and review screen ​

What the wizard configures ​

Directory structure ​

DNS records ​

Updating ​

Useful commands ​

Mode 2 - Traefik Manager only (Docker) ​

Sections and review screen ​

What the wizard configures ​

Directory structure ​

Updating ​

Useful commands ​

Mode 3 - Traefik Manager only (Linux service) ​

Prerequisites ​

Sections and review screen ​

What the wizard configures ​

Useful commands ​

Updating ​

Mode 4 - Traefik Manager Agent ​

Install methods ​

Sections and review screen ​

What the wizard asks ​

Docker - Agent only output ​

Docker - Agent + Traefik output ​

Binary output ​

Useful commands ​

Next steps after install ​

First login ​

Traefik Stack

Managing the install

Non-interactive install

Install modes

Mode 1 - Traefik + Traefik Manager (full stack)

Prerequisites

Sections and review screen

What the wizard configures

Directory structure

DNS records

Updating

Useful commands

Mode 2 - Traefik Manager only (Docker)

Sections and review screen

What the wizard configures

Directory structure

Updating

Useful commands

Mode 3 - Traefik Manager only (Linux service)

Prerequisites

Sections and review screen

What the wizard configures

Useful commands

Updating

Mode 4 - Traefik Manager Agent

Install methods

Sections and review screen

What the wizard asks

Docker - Agent only output

Docker - Agent + Traefik output

Binary output

Useful commands

Next steps after install

First login