No authentication is active - this interface is publicly accessible. Enable a password or OIDC in Settings - Authentication.
Checking
HTTP Routers
TCP / UDP Routers
Services
Middlewares
HTTP dynamic_config.yml

redirect-to-https

redirectScheme:
  scheme: https
HTTP dynamic_config.yml

files-basic-auth

headers:
  customRequestHeaders:
    Authorization: Basic YWRtaW46TFZYZnpYRlA0dzdzZDk=
HTTP dynamic_config.yml

authentik

forwardAuth:
  address: http://authentik:9000/outpost.goauthentik.io/auth/traefik
  trustForwardHeader: true
  authResponseHeaders:
    - X-authentik-username
    - X-authentik-groups
    - X-authentik-entitlements
    - X-authentik-email
    - X-authentik-name
    - X-authentik-uid
    - X-authentik-jwt
    - X-authentik-meta-jwks
    - X-authentik-meta-outpost
    - X-authentik-meta-provider
    - X-authentik-meta-app
    - X-authentik-meta-version
  maxResponseBodySize: 4096
HTTP dynamic_config.yml

crowdsec-bouncer

plugin:
  crowdsec-bouncer:
    enabled: true
    crowdsecMode: "stream"
    updateIntervalSeconds: 60
    crowdsecLapiKey: "nQftMYvc7uJtgTaRZsL47JDwn0NAeSd1uhZOY8/8V/o"
    crowdsecLapiHost: "crowdsec:8080"
          # THIS SAVES YOU FROM LOCKOUTS:
    clientTrustedIPs:
      - "127.0.0.1/32"
      - "172.19.0.0/16"
      - "192.168.2.0/24"
      - "172.16.23.0/24"
      - "108.70.51.191/32"
      - "2606:a300:9010:cb51::/64"
      - "2606:a300:9010:cb50::/64"
      - "146.85.156.191/32"
      - "172.16.50.0/24"
      - "2600:1700:4dd0:945f::/64"
      - "2606:a300:9010:cb50:c662:37ff:fe02:4c13/128"
    captchaProvider: "turnstile"
    captchaSiteKey: "0x4AAAAAACJYAUokokdaXJe7"
    captchaSecretKey: "0x4AAAAAACJYAYr6gX6hQqka3Ec7zns4jO0"
    captchaGracePeriodSeconds: 3600
HTTP dynamic_config.yml

securityHeaders

headers:
  customResponseHeaders:
    X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
    X-Forwarded-Proto: "https"
    server: ""
  customRequestHeaders:
    X-Forwarded-Proto: "https"
  sslProxyHeaders:
    X-Forwarded-Proto: "https"
  referrerPolicy: "same-origin"
  hostsProxyHeaders:
    - "X-Forwarded-Host"
  contentTypeNosniff: true
  browserXssFilter: true
  forceSTSHeader: true
  stsIncludeSubdomains: true
  stsSeconds: 63072000
  stsPreload: true
HTTP dynamic_config.yml

uli-auth

headers:
  customRequestHeaders:
    X-ULI-Proxy-Auth: 5416af2414015728636505945b4bddeaede47c34d8af4dad4d8f9c9f88fcb093
HTTP jellyfin.yaml

jellyfin-mw

headers:
        # Privacy: Prevent search engines from indexing your login page
  customResponseHeaders:
    X-Robots-Tag: "noindex, nofollow, nosnippet, noarchive, notranslate, noimageindex"
    X-XSS-Protection: "1; mode=block"

        # Protocol Security
  sslRedirect: true

        # HTTP Strict Transport Security (HSTS)
  stsSeconds: 315360000
  stsIncludeSubdomains: true
  stsPreload: true
  forceSTSHeader: true

        # Clickjacking & Sniffing Protection
  frameDeny: true
  contentTypeNosniff: true
  customFrameOptionsValue: "allow-from https://vcdx71.com"

Middleware Templates

Reusable YAML you can start a middleware from. Pick one under Template in the middleware form. Templates are shared across every server, not just the one selected here.

Dashboard settings

Custom groups 0

Assign a route to a group with the pencil on its card. A group disappears when nothing uses it.

Hidden apps 0

Hidden apps stay off the dashboard only. They keep running and still appear on the Routes tab.

Card settings

These settings change how this app appears on the dashboard. They do not touch the route itself.

Useful when the route has a wildcard host, or the app lives on a different port.

Do not make this card clickable
Hide from the dashboard - restore it under Dashboard settings

Loading services...

Loading docker routes...

Loading Kubernetes routes...

Loading Swarm routes...

Loading Nomad routes...

Loading ECS routes...

Loading Consul Catalog routes...

Loading Redis routes...

Loading etcd routes...

Loading Consul KV routes...

Loading ZooKeeper routes...

Loading HTTP provider routes...

Loading file provider routes...

Loading certificates...

Loading TLS profiles...

CrowdSec not configured

Add your LAPI URL plus a bouncer API key, machine credentials, or a mTLS client certificate in Settings → System Monitoring → CrowdSec.

The bouncer key reads active decisions, the machine login reads alerts. They are complementary, not tiered. A client certificate covers both.

Add Decision

Single IP or CIDR range.

Stored as the decision scenario.

Custom Decisions

Loading plugins...

Add Plugin

Edit the middleware before saving - replace all placeholder values and any {{ }} template blocks with real values or Traefik will crash

Changes here can break Traefik
Only edit what you understand - a misconfigured static config will prevent Traefik from starting. A backup is created automatically before every save. Restore from if something goes wrong.

Loading...

Access logs not loaded

Configure Access Log Path in Settings

Log Detail

Raw Line


            

        

    












        

            

                

                    
                    
Add Route

                

                
            


            

                
                
                
                
                
                

                    
                    
                    
                

                

                    
                    

                        
                        
                        
                    

                


                

                

                    
                    
                


                

                    

                        
                        
                    


                    

                    

                        

                            
                            
                        

                        

                            
                            

                            
                            

                            

                            
                            

                        

                    

                    


                    
                    

                        

                            
                            
                        

                        
                        

                            
                            
                        

                        

                            

                                
                            

                            

                                
                            

                        

                        

                        
Add more backends to load-balance across several servers.

                    

                    

                        
                        
                    

                    
                    

                        
                        

                            Loading...
                        

                        
                    

                    

                        
                        
                        

                            Loading...
                        

                        
                    

                    

                        
                        
                    

                    

                        

                            
                            Pass Host Header
                        

                        
                    

                    

                        

                            
                            Skip TLS Verification
                        

                        
                    

                    

                        

                            

                                
                                Security headers preset
                            

                            
                        

                        
                        
                        
                        
                        
                    

                    

                        

                            

                                
                                Optimize for streaming (Jellyfin / Emby / Plex)
                            

                            
                        

                        
                        
                        
                    

                    
                    
                    
                    

                        
                        
                    

                    
                


                

                    

                        
                        
                        
Use HostSNI(`*`) to match all TLS or leave empty for passthrough

                    

                    

                        
                        
                    

                    
                    

                        

                            
                            
                        

                        

                            
                            
                        

                    

                    

                    

                        
Add more backends to load-balance across several servers.

                        
                    

                    

                        
                        
                    

                    
                    

                        
                        

                            Loading...
                        

                        
                    

                    

                        
                        
                        

                            Loading...
                        

                        
                    

                    

                        
                        

                            
                            
                            
                        

                        
                        
                    

                    
                


                

                    

                        
                        
                    

                    
                    

                        

                            
                            
                        

                        

                            
                            
                        

                    

                    

                    

                        
Add more backends to load-balance across several servers.

                        
                    

                    
                    

                        
                        
                        

                    

                    

                         UDP routers don't support rules. Traffic is routed by entry point only.
                    

                

            


            

                
                
            

        








        

            

                

                    
                    
Add Middleware

                

                
            


            

                
                
                
                
                

                    
                    
                    
                

                
                
                
                

                    
                    

                        
                        
                    

                

                

                    

                        
                        
                    

                    

                        
                        
                    

                


                

                    
                    
                


                

                

                    
                    

                    
                

            


            

                
                
            

        








    

        

            
            
Add TLS Profile

        

        
    


        

            
            

            
            

                
                
                
                
                
            

            

            

                
                
                
Used as the tls.options key and referenced in router configs.

            


            

                

                    
                    
                

                

                    
                    
                

            


            

                
                SNI Strict
            

            
Reject connections with no or mismatched SNI. Requires non-wildcard certificates.


            

                
                
                
One per line. Leave empty to use Traefik defaults. Only applies to TLS 1.0-1.2.

            


            

                
                
                
One per line. Leave empty to use Traefik defaults.

            


            

                
                
                
One per line. Default: h2, http/1.1, acme-tls/1 - leave empty to use Traefik defaults. Include acme-tls/1 if using ACME cert challenges.

            


            

                
                
            


            
        


    

        
        
    








    

        

            
            
Client IP Diagnostic

        

        
    


        

            
What this instance sees for your own request right now. Use it to check whether the real client IP is reaching the app before it feeds logs, CrowdSec and ipAllowList.

            

        


    

        
        
    








    

        

            
            
Trusted IPs Helper

        

        
    


        

            
Adds forwardedHeaders.trustedIPs to an entrypoint so Traefik believes X-Forwarded-For from your proxies. This trust feeds logs, CrowdSec, ipAllowList and the login limiter - check what reaches the app first with the .


            

                
                This edits the static config - it is global and needs a Traefik restart to take effect. A backup is created automatically before the save. Every trusted range can forge client IPs, so only add proxies you control.
            


            

                
                
                

            


            

                
Sources to add

                
                
                

                    
                    
                

            


            

                
                

            

        


    

        
        
    








    

        

            HTTP
            
Middleware Details

        

        

            
            
        

    

    

        

            
            Loading...
        

    








    

        

            
            
TLS Profile

        

        

            
            
        

    

    








    

        

            HTTP
            
Service Details

        

        
    

    








    

        

            
            
Plugin Details

        

        
    

    








    

        

            HTTP
            
Route Details

        

        

            
            
        

    

    

        

            
            Loading...