Traefik Proxy Admin Manage Traefik HTTP provider services, authentication, sessions, and live proxy diagnostics from one focused UI.

Traefik Proxy Admin is a production-focused web UI for managing Traefik dynamic HTTP configuration. It runs as a standalone Next.js container backed by PostgreSQL and generates Traefik routers, services, middlewares, service authentication, shared links, and live diagnostics.

Use it when you want a managed UI/API for exposing private HTTP services through Traefik without manually maintaining every dynamic config file.

Core Capabilities

• Create, edit, disable, import, and export proxied services
• Generate Traefik routers, services, TLS settings, middlewares, and advanced router rules
• Protect the admin UI/API with local accounts or OIDC/SSO
• Link an Authelia provider managed by DUMB while retaining optional local break-glass login
• Protect proxied services with shared links, Basic Auth, or SSO forwardAuth
• Add service-level Bypass Rules for webhooks, companion apps, health checks, and automations, with optional observed bypass session tracking
• Discover live Traefik entrypoints, routers, services, and middlewares when the Traefik API is configured
• Inspect generated-config drift, service target health, and optional Traefik access logs from the Traefik Live page

Screenshots

Login	Add Service
Discovered Entrypoints	Dynamic Add Middleware
Service List	Session Management
Global Configuration	Service Configuration

Production Deployment

The published image contains only the Traefik Proxy Admin application. Run PostgreSQL and Traefik as separate services.

Example compose service:

services:
  traefik-proxy-admin:
    image: iampuid0/traefik-proxy-admin:latest
    environment:
      DATABASE_URL: postgresql://tpa:change-me@postgres:5432/traefik_proxy_admin
      ADMIN_AUTH_ENABLED: "true"
      ADMIN_AUTH_SECRET: ${ADMIN_AUTH_SECRET}
      ADMIN_AUTH_PROVIDER: local
      TRAEFIK_API_URL: http://traefik:8080
      TRAEFIK_ACCESS_LOG_PATH: /logs/traefik/access.log
    ports:
      - "3000:3000"
    volumes:
      - /var/log/traefik/access.log:/logs/traefik/access.log:ro
    depends_on:
      - postgres

  postgres:
    image: postgres:16
    environment:
      POSTGRES_DB: traefik_proxy_admin
      POSTGRES_USER: tpa
      POSTGRES_PASSWORD: change-me
    volumes:
      - tpa-postgres:/var/lib/postgresql/data

volumes:
  tpa-postgres:

Generate ADMIN_AUTH_SECRET before first start:

openssl rand -base64 48

Then open the app and create the first local admin account. Review Deployment, Authentication, and Security Hardening before exposing the admin UI beyond a trusted network.

Traefik Provider Setup

Configure Traefik to poll the generated config endpoint:

providers:
  http:
    endpoints:
      - "http://traefik-proxy-admin:3000/api/traefik/config"
    pollInterval: "10s"

Keep /api/traefik/config reachable only by Traefik or an internal network path. See Traefik Integration for forwardAuth, live discovery, target probe, and access-log viewer guidance.

Fork Delta

This fork has diverged substantially from upstream after commit bc1bf6.

The main differences are:

• Modernized the app into a Next.js App Router codebase under src/, with TypeScript 6, React 19, Next 16, pnpm, Vitest, Playwright, and a devcontainer workflow.
• Added production packaging and release automation: Docker Hub publishing, multi-arch builds, Release Please, Dependabot, CI, CodeQL-oriented permissions, and pre-push verification docs.
• Added secure-by-default admin authentication with local admin users, optional admin SSO/OIDC, role-aware admin sessions, CSRF/same-origin checks, rate/body guards, and recovery-oriented auth docs.
• Expanded service protection beyond the original shared-link flow with reusable Basic Auth configs, reusable service SSO providers, signed SSO state, multi-domain service SSO tickets, session risk metadata, and service-level Bypass Rules with Simple or Observed modes.
• Added Traefik operator tooling: live API status, entrypoint/router/service/middleware discovery, middleware validation, target reachability checks with SSRF guards, generated-config preview/diff, drift checks, router import preview, and an optional access-log viewer.
• Added portable service import/export plus full backup/restore for domains, services, security configs, auth providers, app config, shared links, secrets, and admin auth config.
• Added bundled operator documentation inside the app, contextual help bubbles, screenshots, and expanded production/development/security documentation.
• Added legacy database repair and migration safety for pre-Drizzle installs, plus tests covering middleware utilities, access-log parsing, Traefik middleware routes, homepage behavior, and functional API flows.

Documentation

Production and operator docs:

• Deployment: production container setup, required environment, startup flow, backups, restores, and upgrade notes. The same operator docs are also available inside the app from the Docs navigation item.
• Authentication: admin auth, local users, SSO/OIDC, service auth, bypass observation, public auth endpoints, and lockout recovery.
• Service Configuration: services, domains, middlewares, Bypass Rules, advanced routers, managed middlewares, and import/export.
• Traefik Integration: HTTP provider setup, live discovery, config endpoint exposure, target probes, and access log viewing.
• Security Hardening: production checklist, cookie domains, Traefik API access, target probes, and secrets.
• Comparison: Middleware Manager: how TPA compares with hhftechnology/middleware-manager, including fit, overlap, and ownership boundaries.

Contributor docs:

• Contributing: branch model, pull requests, conventional commits, and checks.
• Development: devcontainer usage, local Traefik files, reverse-proxied Next dev origins, and verification.
• Security Policy: supported branches and private vulnerability reporting.

Community

• Join the Discord community for real-time discussion and troubleshooting.
• Use GitHub Discussions for questions and ideas that benefit from a searchable answer.
• Use GitHub Issues for reproducible bugs and actionable feature requests.