traefik-manager

Traefik Manager

A clean, self-hosted web UI for your Traefik reverse proxy.

Routes, middlewares, Services, Plugins, certificates, crowdsec and logs, without editing YAML by hand.

_{Built for homelabbers who love Traefik but hate editing YAML at 2am.}

Quick start

Installer

curl -fsSL https://get-traefik.xyzlab.dev | bash

Installs the tm CLI and runs tm install. Six modes: Traefik + Traefik Manager together, Traefik Manager on its own (Docker or native), or the agent for a remote host (Docker, Docker + Traefik, or binary).

Afterwards tm manages the install: tm status, tm update, tm logs, tm reconfigure, tm doctor. Full guide

Docker Compose

For an existing Traefik install.

services:
  traefik-manager:
    image: ghcr.io/chr0nzz/traefik-manager:latest
    container_name: traefik-manager
    restart: unless-stopped
    ports:
      - "5000:5000"
    environment:
      - COOKIE_SECURE=false
    volumes:
      - /path/to/traefik/dynamic.yml:/app/config/dynamic.yml
      - /path/to/traefik-manager/config:/app/config
      - /path/to/traefik-manager/backups:/app/backups

Open http://your-server:5000 and the setup wizard takes it from there.

Features

Routes - HTTP, TCP and UDP. Multiple domains and backends per route, each with its own scheme including h2c for cleartext HTTP/2, sticky sessions, health checks, priority, per-route certificate resolvers, editable tls.domains and TLS profiles. Guided presets for security headers and media streaming.

Services - build a load balancer, weighted, mirroring or failover service on its own, or balance a route across a mix of raw addresses and existing services with a weight on each row. Services Traefik Manager did not write stay read only until you take them over, which records ownership without touching the file.

Middlewares - 30 wizards covering auth, rate limiting, headers, CORS, redirects, prefixes, error pages and TLS client certificates, plus a raw YAML editor and your own reusable templates.

Dashboard and Route Map - a homepage-style grid of your apps with icons and health, and a topology map from entry point through middlewares to backend, coloured per hop.

Certificates - every certificate in acme.json, with expiry, the ones no router serves, and the ones whose resolver is gone from your static config. Filter by domain or by either of those. Mount the file read-write and set a restart method to remove them, one at a time or in bulk, with a timestamped backup you can restore.

Monitoring - live router and service health from the Traefik API, provider tabs for Docker, Kubernetes, Swarm, Nomad, ECS, Consul, Redis and more, which switch themselves on the first time Traefik reports routers from them, and CVE advisories for your running Traefik version.

Logs and CrowdSec - access log analytics and CrowdSec attacks, bans and decisions. Optional country flags and a world map, resolved on your own server.

Notifications - nine destinations: Discord, Slack, ntfy, Gotify, Pushover, Pushbullet, Telegram, UnifiedPush and generic webhooks. Route events to each one by category and severity, with quiet hours, hourly or daily digests, and errors that break through anyway. Desktop notifications while a tab is open.

Background monitoring - the server checks your routes on a schedule and tells you when a backend goes down or a pool degrades, alongside certificate expiry, Traefik and agent reachability, CrowdSec activity, GeoIP freshness and new releases. Alerts arrive whether or not the interface is open.

Static config editor - edit traefik.yml from the UI and apply it with a one-click restart, via socket proxy, poison pill or direct socket.

Plugins - see every Traefik plugin with the middlewares using it, install new ones, and get flagged when the catalog has a newer version.

Backups - timestamped local backups before every change, plus git push with commit history, diffs and one-click restore.

Multi-server - a lightweight Go agent runs beside Traefik on any remote host, and every tab works against whichever server you pick. No VPN, no SSH.

Security - bcrypt, TOTP two-factor, OIDC single sign-on, per-device API keys, CSRF protection, rate limiting, and secrets encrypted at rest.

Two layouts - Fluid fills the screen, Fixed caps the width.

Mobile - a native Android app on Google Play, and the web app installs as a PWA on any platform.

Full documentation.

Deployment

Runtime	Guide
Installer	Full stack, TM only, agent
Docker	Compose, networking, behind Traefik
Podman	Rootless, Quadlet, SELinux
Linux	Native Python and systemd
Unraid	Community Applications and appdata paths
umbrelOS	Community app store, ports and routing
Agent	TMA for multi-server management

Documentation

traefik-manager.xyzlab.dev

Overview · Configuration · Environment variables · Security · API · OIDC · Reset password · Beta

Questions, help and release news: Discord

tm CLI

One binary that installs and manages the whole stack. Six install modes: Traefik and Traefik Manager together, Traefik Manager on its own (Docker or native), or an agent for a remote host (Docker, Docker + Traefik, or binary). Afterwards tm status, tm update, tm logs, tm reconfigure, tm doctor and tm password reset manage it in place.

curl -fsSL https://get-traefik.xyzlab.dev | bash

Repository · Releases · Docs

Mobile app

Native Android (Kotlin and Jetpack Compose) and iOS (Swift and SwiftUI) apps for phones and tablets. Needs Traefik Manager v1.14.0 or newer and a per-device API key from Settings - Authentication - API Keys.

Repository · Releases · Docs

Built with

All JS and CSS is bundled at build time - nothing is fetched from a CDN at runtime.

Translations

v1.15.0 is the first release that is not English-only. The whole interface is ready for translation - every page, dialog, tooltip, toast and server message - and the work happens on Weblate.

v1.15.0 ships in French, French (Canada), German, Spanish, Portuguese (Portugal), Portuguese (Brazil), Dutch, Chinese (Simplified), Russian, Czech and Danish, plus English spellings for the United States and the United Kingdom. Any other language is added on request.

Traefik Manager deletes routers and rewrites live proxy configuration, so a mistranslated confirmation button is a destructive bug rather than a cosmetic one. Every translation is escaped when the page renders it, and CI rejects a translation that adds markup, links or control characters, or that changes a placeholder such as {name} or %(name)s.

Contributing

Pull requests are welcome. See CONTRIBUTING.md for reporting bugs, suggesting features, and running the project locally.

Contributors

Thanks as well to everyone who has opened an issue or a discussion - several features started as a question from someone running into something unexpected.

Stats

License

GPL-3.0