Traefik dashboard
New proxy configurations do not expose the Traefik dashboard. The upgrade removes the legacy dashboard router from saved configurations; restart the proxy to apply that change. Create a dynamic router to access the dashboard through HTTPS and protect it with basic authentication.
Do not route the Traefik dashboard at /api on the same hostname as the Coolify dashboard. Traefik's dashboard uses /api, which conflicts with Coolify's API routes. Use a separate hostname such as traefik.example.com.
Create dashboard credentials
Generate a bcrypt credential with htpasswd:
htpasswd -nbB <username> '<password>'Copy the complete <username>:<hash> output. Dynamic YAML does not require Docker Compose dollar-sign escaping.
Enable the dashboard API
In the proxy configuration, enable the dashboard API in secure mode with --api.dashboard=true. Save the validated configuration and restart the proxy. Keep insecure mode disabled.
Coolify does not sync edits to /data/coolify/proxy/docker-compose.yml back into the UI once a proxy configuration is saved in Coolify. Make changes under Servers > your server > Proxy > Configuration and save them there. Starting or restarting the proxy through Coolify writes its saved configuration to disk and can overwrite disk-only edits.
Add the dashboard route
Open Servers > your server > Proxy > Dynamic Configurations, select Add, and create traefik-dashboard.yaml:
http:
middlewares:
dashboard-auth:
basicAuth:
users:
- '<username>:<bcrypt-hash>'
dashboard-https-redirect:
redirectScheme:
scheme: https
routers:
dashboard-http:
rule: 'Host(`traefik.example.com`)'
entryPoints:
- http
middlewares:
- dashboard-https-redirect
service: api@internal
dashboard-https:
rule: 'Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))'
entryPoints:
- https
middlewares:
- dashboard-auth
service: api@internal
tls:
certResolver: letsencryptReplace the hostname and credential, then save the file. Point the hostname's DNS record to this server.
Open https://traefik.example.com/dashboard/ and sign in with the configured credential.
Do not use insecure mode on a public server
Setting --api.insecure=true exposes the dashboard directly on Traefik's API port without authentication. If your proxy configuration publishes port 8080, enabling insecure mode can expose the dashboard through the server firewall.
Use the authenticated HTTPS route above instead. If you temporarily enable insecure mode for isolated debugging, restrict port 8080 at the firewall and remove --api.insecure=true immediately afterward.