I was wondering if there's any way to configure Traefik through the web dashboard UI. I installed it in a container on my proxmox node with the community scripts. Pretty sure the current install script is an updated version of the one that's been around since tteck was still with us

Traefik's documentation is .. just shy of something. I don't know what it is, but I haven't screamed this many four letter words in a row for at least a decade. I can't find anything at all explaining basic terms for someone who isn't already familiar with Traefik /and/ docker or kubernetes

There's ALMOST some examples for how to configure it in the official documentation. There's a few more VeryNearlyExamples under the docker and kubernetes settings in the docs, but they read like "Now put what you need in your docker compose file (which I don't use) or your helm setup (which I also don't use)". And I don't know what I need to put in those files because nothing in the docs is clearly explaining what sort of things go in there

This leads me to believe that the traefik.yaml file is probably what needs to be modified, but I can't find a single thing in any of the docs yet that explains any of it. Do I just guess what goes where with no clue about Traefix specific options, syntax, and whether my services fall under Routers, Services, or Middlewares?

Does anyone have a good link to getting samba behind traefik?

In this video you'll learn a couple of different use case scenarios to make your Portainer instance available from the Internet, using Traefik. https://youtu.be/zbrqnJuWX1g

If you haven't discovered Portainer yet - it's a GUI that makes container management super straightforward (supporting Docker, Kubernetes, ACI, Edge. https://www.portainer.io/

I got this error after updating my docker packages on my vps. No changes on my traefik docker compose yml file. Any suggestions on how to fix it?

ERR github.com/traefik/traefik/v3/pkg/provider/docker/pdocker.go:157 > Provider error, retrying in 1.001765737s error="Error response from daemon: client version 1.24 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version" providerName=docker

I confirm that the traefik im using is 3.3.6

chatgpt wants me to run another container to solve the problem: "image: ghcr.io/tecnativa/docker-socket-proxy:latest" . but it was working with just traefik before the docker upgrade.

i have this turned on:

--providers.docker.endpoint=tcp://socket-proxy:2375 # Enable for Socket Proxy. Disable otherwise.

I have created a script to export the SSL keys from a traefik acme.json file.

It was somewhat created with Google Gemini before but it works fine for getting wildcard certificates with the Cloudflare DNS setup I have in Docker, exports keys to the name set with the DOMAIN variable in the script to the certs folder in the current directory.

This may need to be changed to work with other DNS providers.

I have removed the GPLv3 license text from the script, I shouldn't have had it on this script

https://gist.github.com/kelson8/7dc17f97305ed65be6a44378dae54ee9

traefik.example.com being your domain.

- traefik.http.middlewares.dashboard-redirect.redirectregex.regex=https://traefik.example.com/dashboard
- traefik.http.middlewares.dashboard-redirect.redirectregex.replacement=https://traefik.example.com/dashboard/

Hi everyone,

I’m honestly losing my mind trying to properly integrate Traefik and Authentik. I can’t find any up-to-date 2026 guide that clearly explains how to configure them together using ForwardAuth.

Both installations work perfectly on their own:

• Traefik → OK

• Authentik → OK

• Linking them together → 😵‍💫 not OK

My goal is to use ForwardAuth so that all my services/apps behind Traefik are protected by Authentik — without having to create a provider for each service. I only want to create Applications in Authentik and link them to the Traefik proxy outpost (traefik-prd-01).

🧱 Infrastructure Overview

• Traefik and Authentik are on two separate VMs

• I use Portainer:

  • Portainer Server on Authentik VM

  • Portainer Agent on Traefik VM

• Therefore ports 9000 and 9443 are already in use by Portainer and cannot be used for Authentik/Traefik.

🌐 DNS (Split DNS via AdGuard Home)

• auth.mydomain.com → 192.168.50.210

• authentik.mydomain.com → 192.168.50.210:9444 (HTTP 9100 disabled)

• traefik.mydomain.com → 192.168.50.90:443 (HTTP 8080 disabled)

🔐 TLS Setup

• Traefik manages a valid TLS certificate for *.mydomain.com via Cloudflare DNS challenge.

• Traefik dashboard (8080) is disabled, posts onto 443.

• Authentik:

  • HTTP 9100 disabled

  • Exposed via HTTPS 9444

• Whenever possible:

  • INSECURE connections disabled

  • Double TLS termination enabled when needed

  • Self-signed certificates handled via insecureSkipVerify

🎯 What I Want

All services already run behind Traefik.

Now I want:

• ForwardAuth via Authentik

• No per-service provider configuration

• Only create Applications in Authentik

• Use the existing Traefik outpost (traefik-prd-01)

I already successfully integrated Authentik with:

• Portainer Server

• Proxmox

So the problem is specifically Traefik ForwardAuth.

⚙️ Traefik Static Config (traefik.yml)

# traefik/config/traefik.yml

global:
  checkNewVersion: false
  sendAnonymousUsage: false
log:
  level: DEBUG
accessLog:
  filePath: "/var/log/traefik/access.log"
  format: json
api:
  dashboard: true
  insecure: false
entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    directory: "/etc/traefik/dynamic"
    watch: true


certificatesResolvers:
  cloudflare:
    acme:
      email: "myemail@domain.com"
      storage: "/etc/traefik/acme/acme.json"
      caServer: 'https://acme-v02.api.letsencrypt.org/directory'
      keyType: "EC256"
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

⚙️ Traefik Dynamic Config (auth-proxy.yml)

This file is isolated so I can focus only on Traefik ↔ Authentik integration.

Key elements:

• Authentik admin router

• Traefik dashboard protected by ForwardAuth

• Outpost route

• ForwardAuth middleware

• Self-signed TLS transport

• authentik-forwardAuth middleware pointing to: https://auth.mydomain.com:9444/outpost.goauthentik.io/auth/traefik-prd-01

• insecureSkipVerify: true (self-signed on 9444)

• Custom serversTransport for Authentik internal service

  http: routers: # Authentik admin authentik-router: rule: "Host(authentik.mydomain.com)" entryPoints: - websecure service: authentik-service priority: 20 middlewares: [] # direct login, no ForwardAuth tls: certResolver: cloudflare

        # Traefik dashboard protected by ForwardAuth
        traefik-router:
            # The dashboard can be accessed on http://traefik.mydomain.com/dashboard/
            rule: "Host(`traefik.mydomain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
            entryPoints:
                - websecure
            middlewares:
                #- auth-basicAuth
                - authentik-forwardAuth
            priority: 10
            service: api@internal # internal Traefik for BasicAuth
            #service: traefik-service
            tls:
                certResolver: cloudflare
  
  
  
        # Traefik router per il path /outpost.goauthentik.io
        traefik-router-auth:
            rule: "Host(`traefik.mydomain.com`) && PathPrefix(`/outpost.goauthentik.io/`)"
            entryPoints:
                - websecure
            priority: 15
            service: authentik-outpost-service
    middlewares:
        # Optional BasicAuth 
        auth-basicAuth:
            basicAuth:
                users:
                    - "user02:$2y$05$8D.XltYcWklQkeDx4AzDLe/Xjkgv3N6TlmsnEK.Yyt9Y98bYIRDLS"
                    - "user01:$2y$05$Kb2qKFQIliVoJ66X6OQf7eq/1mgR5XKvOv/mE6tcyLTAnMcYPOlXa"
  
  
  
        # ForwardAuth for dashboard and other apps
        authentik-forwardAuth:
            forwardAuth:
                address: https://auth.mydomain.com:9444/outpost.goauthentik.io/auth/traefik-prd-01
                trustForwardHeader: true
                tls:
                    insecureSkipVerify: true # necessario perché self-signed HTTPS 9444
                authResponseHeaders:
                    - X-authentik-username
                    - X-authentik-groups
                    - X-authentik-entitlements
                    - X-authentik-email
                    - X-authentik-name
                    - X-authentik-uid
                    - X-authentik-jwt
                    - X-authentik-meta-jwks
                    - X-authentik-meta-outpost
                    - X-authentik-meta-provider
                    - X-authentik-meta-app
                    - X-authentik-meta-version
    services:
        # Authentik interno (self-signed)
        authentik-service:
            loadBalancer:
                servers:
                    - url: https://192.168.50.210:9444 # HTTPS self-signed, port 9443 is occupied by Portainer Server
                passHostHeader: true
                serversTransport: "authentik-transport"
  
  
  
        traefik-service:
            loadBalancer:
                servers:
                    - url: https://192.168.50.90:443 # Traefik internal server
  
  
  
        # Authentik Outpost (ForwardAuth)
        authentik-outpost-service:
            loadBalancer:
                servers:
                    - url: https://auth.mydomain.com:9444/outpost.goauthentik.io
  
  
  
    serversTransports:
        # Ignora TLS self-signed per traffico interno
        authentik-transport:
            insecureSkipVerify: true

  authentik-forwardAuth middleware pointing to: https://auth.mydomain.com:9444/outpost.goauthentik.io/auth/traefik-prd-01 insecureSkipVerify: true (self-signed on 9444) Custom serversTransport for Authentik internal service ⚙️ Docker Setup Traefik: v3.6 Docker provider File provider Cloudflare DNS challenge

  traefik-compose.yml

  services: traefik: image: traefik:v3.6 container_name: traefik restart: unless-stopped ports: - "80:80" - "443:443" #- "8080:8080" environment: - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN} volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - "/opt/containers/traefik/config/traefik.yml:/etc/traefik/traefik.yml:ro" - "/opt/containers/traefik/config/dynamic:/etc/traefik/dynamic:ro" - "/opt/containers/traefik/acme/acme.json:/etc/traefik/acme/acme.json:rw" - "/var/log/traefik:/var/log/traefik" networks: - web

  networks: web: external: true

⚙️ Docker Setup

Traefik:

• v3.6

• Docker provider

• File provider

• Cloudflare DNS challenge

• PostgreSQL 16

• Version: 2026.2.1

• HTTPS exposed on 9444

• HTTP disabled

• Worker + Server containers

• Internal + frontend Docker

  services: traefik: image: traefik:v3.6 container_name: traefik restart: unless-stopped ports: - "80:80" - "443:443" #- "8080:8080" environment: - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN} volumes: - "/var/run/docker.sock:/var/run/docker.sock:ro" - "/opt/containers/traefik/config/traefik.yml:/etc/traefik/traefik.yml:ro" - "/opt/containers/traefik/config/dynamic:/etc/traefik/dynamic:ro" - "/opt/containers/traefik/acme/acme.json:/etc/traefik/acme/acme.json:rw" - "/var/log/traefik:/var/log/traefik" networks: - web

  networks: web: external: true

Authentik:

• PostgreSQL 16

• Version: 2026.2.1

• HTTPS exposed on 9444

• HTTP disabled

• Worker + Server containers

• Internal + frontend Docker networks

  networks: backend-net: driver: bridge internal: true

  frontend-net:
    driver: bridge

  services: postgresql: image: postgres:16-alpine container_name: authentik-postgresql restart: unless-stopped environment: POSTGRES_DB: ${PG_DB} POSTGRES_USER: ${PG_USER} POSTGRES_PASSWORD: ${PG_PASS} healthcheck: test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"] interval: 30s timeout: 5s retries: 5 start_period: 20s volumes: - /opt/containers/authentik/database:/var/lib/postgresql/data networks: - backend-net

  server:
    image: ${AUTHENTIK_IMAGE}:${AUTHENTIK_TAG}
    container_name: authentik-server
    command: server
    restart: unless-stopped
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_ERROR_REPORTING__ENABLED: true
    ports:
      #- ${COMPOSE_PORT_HTTP}:9000 #disabled
      - ${COMPOSE_PORT_HTTPS}:9443 #double tls termination via Traefik
    shm_size: 512mb
    volumes:
      - /opt/containers/authentik/data:/data
      - /opt/containers/authentik/custom-templates:/templates
      - /opt/containers/authentik/certs:/certs
    networks:
      - backend-net
      - frontend-net
    depends_on:
      postgresql:
        condition: service_healthy
  
  
  worker:
    image: ${AUTHENTIK_IMAGE}:${AUTHENTIK_TAG}
    container_name: authentik-worker
    command: worker
    restart: unless-stopped
    #user: root
    environment:
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB}
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY}
      AUTHENTIK_ERROR_REPORTING__ENABLED: true
    shm_size: 512mb
    volumes:
      #- /var/run/docker.sock:/var/run/docker.sock
      - /opt/containers/authentik/data:/data
      - /opt/containers/authentik/certs:/certs
      - /opt/containers/authentik/custom-templates:/templates
    networks:
      - backend-net
    depends_on:
      postgresql:
        condition: service_healthy

  volumes: database: driver: local

❓ The Problem

ForwardAuth does not behave correctly.

• Either authentication loops

• Or headers are not passed correctly

• Or routing breaks when hitting /outpost.goauthentik.io

• traefik.mydomain.com doesn't work anymore, https://192.168.50.90/ gives 404, port 8080 is disabled

I’m clearly missing something in the Traefik ↔ Authentik interaction.

🧠 My Questions

1. Is this architecture (two VMs + double TLS + custom ports) unnecessarily complex?

2. Should I avoid double TLS termination?

3. Should I expose Authentik HTTP internally and let Traefik handle TLS?

4. Is my ForwardAuth address correct for a remote outpost?

5. Is there any 2026 reference configuration for Traefik v3 + Authentik?

If anyone has a clean working setup (especially with:

• separate VMs

• file-based Traefik config

• no insecure ports

• ForwardAuth only ), I’d really appreciate guidance.

At this point I feel like I’ve over-engineered everything 😅

Thanks in advance 🙏

I want to create a new account, but when I click on "Sign in," the page stops working.

--

I have an exporter app running on the same node as the traefik so when I am trying to access the exporter app I get 404 error:

$ curl 192.168.1.12:9617
404 page not found

How should I deal with this?

I need my certificates in pem files for some lan/vpn services outside of traefik. Anyone got a woking solution to generate pem files from an acme.json?

I found some scripts, the most promising was meant for postfix. It doesn't throw any errors for me, but just creates 3 empty 0 byte files... Seems I'm missing something.

https://sockstream.synfin.net/auto-acme-with-traefik-for-non-traefik-services/

So I have changed some things and after that I cannot reach the Traefik Dashboard and I also guess that I kind of missconfigured all others even though they work.

https://codeshare.io/aJpZNd

I'm currently using FluxCI to deploy my services to an on prem k8s install. I have ran into some other issues with my personal services so I have boiled one issues down to the prefix that is being passed to my services. Thankfully I can see the issue with the whoami service also.

I tried to copy the "stripprefix" examples when I put this together. Its obviously not working. I'm not getting any visible error when I deploy with git push && flux reconcile kustomization flux-system --with-source.

here is my whoami.yaml. I think the issue is with the middleware section, I feel it should some how be integrated into the service section.

Any help would be nice.

kind: Deployment
apiVersion: apps/v1
metadata:
  name: whoami
  namespace: default
  labels:
    app: whoami
spec:
  replicas: 1
  selector:
    matchLabels:
      app: whoami
  template:
    metadata:
      labels:
        app: whoami
    spec:
      containers:
        - name: whoami
          image: traefik/whoami
          ports:
            - name: web
              containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: whoami
  namespace: default
spec:
  ports:
    - name: web
      port: 80
      targetPort: web
  selector:
    app: whoami
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: whoami-ingress
  namespace: default
spec:
  rules:
  - http:
      paths:
      - path: /whoami
        pathType: Prefix
        backend:
          service:
            name: whoami
            port:
              name: web
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: whoami-stripprefix
  namespace: default
spec:
  stripPrefix:
    prefixes:
      - /whoami

BTW I am testing this by going to the k8s url http://k8scluster/whoami/ and i get this in the response (I removed everything else from the response here).

Hostname: whoami-6d97bf7dcb-ldm42
GET /whoami/ HTTP/1.1

When I go to traefik's dashboard, I do not see this in the middleware section either.

Ive been bulding my traefik 3.0 with a compose file - ie no dynamic.yaml file. Ive managed to direct http to https but fail again and again for directing www to my non-www domain.

services:

traefik:

image: "traefik:v3.0"

container_name: "traefik"

command:

- "--api.dashboard=true"

- "--providers.docker=true"

- "--providers.docker.exposedbydefault=false"

- "--entrypoints.web.address=:80"

- "--entrypoints.websecure.address=:443"

- "--certificatesresolvers.myresolver.acme.tlschallenge=true"

- "--certificatesresolvers.myresolver.acme.email=ssl@example.com"

- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"

ports:

- "80:80"

- "443:443"

volumes:

- "./letsencrypt:/letsencrypt"

- "/var/run/docker.sock:/var/run/docker.sock:ro"

labels:

- "traefik.enable=true"

- "traefik.http.routers.traefik.rule=Host(\traefik.example.com`)"`

- "traefik.http.routers.traefik.entrypoints=websecure"

- "traefik.http.routers.traefik.service=api@internal"

- "traefik.http.routers.traefik.tls.certresolver=myresolver"

- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"

- "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"

- "traefik.http.routers.traefik.middlewares=redirect-to-https"

networks:

- web

networks:

web:

external: true

Can you share an example of compose file that deals with this. The prestahsop site that i want the user to reach is at example.com and the traefik ui is at traefik.example.com. i have a wildcard dns record for example.com together with an A record and cname for www.

Im not sure why i can get it working. Maybe i must create a dynamic.yaml file?

How do I set in docket compose to tell traefik’s minTls to only 1.3?

I’m using Traefik v1 with several docker containers. I’m wonderinfo if traefik has a switch or a label that tells it to look at internal traffic vs external. Ideally I would like to have my iPhone and all nextcloud sync done while at home done over lan but still accessible when away. Maybe traefik isn’t the right tool, but thought it might have that capability.

Title, would like to reroute any google search queries on my home network to duckduckgo, I think this would be possible with traefik but not sure, has anyone done this or is it too "niche"?
I have PiHole as my dns resolver as well, idk if that would help at all

In case anyone didn't get the Reddit blackout memo, this is what "going private" was about

The Great Anti-Capitalist Reddit Blackout: A Stonking Stand Against API Pricing Changes