Traefik proxy¶

Traefik provides optional reverse-proxy routing for service UIs and user-managed external routes. When enabled, it exposes a single entry point and maps requests to services through DUMB-generated dynamic config and, optionally, Traefik Proxy Admin. Cloudflared can then carry Cloudflare Tunnel traffic to that same entrypoint.

What Traefik does in DUMB¶

• Builds dynamic routes for enabled embedded service UIs
• Adds path prefixes for UI services under /service/ui/<service>
• Supports embedded iframes in the frontend
• Can poll Traefik Proxy Admin for user-managed host-based reverse proxy routes
• Can load the optional DUMB-managed Authelia ForwardAuth middleware
• Can receive public traffic through the optional Cloudflared service

Default access¶

How routes are generated¶

The backend generates Traefik config based on enabled services and their ports. Services with UIs are registered automatically when they are enabled in dumb_config.json.

DUMB separates Traefik configuration ownership into lanes:

Traefik watches /config/traefik/dynamic with the file provider. When Traefik Proxy Admin is enabled, DUMB also adds Traefik's HTTP provider pointed at TPA's generated config endpoint.

This split is intentional:

• DUMB can safely regenerate embedded UI routes whenever services change.
• TPA can manage host-based routes, auth, and middleware without DUMB overwriting them.
• The Authelia wizard can publish dumb-authelia-forward-auth@file, which TPA may attach to selected routes.
• Cloudflared can bring external traffic to Traefik without replacing either DUMB's routes or TPA's routes.

Default configuration¶

"traefik": {
  "enabled": false,
  "process_name": "Traefik",
  "pinned_version": "v3.6.6",
  "suppress_logging": false,
  "log_level": "INFO",
  "log_file": "/log/traefik.log",
  "access_log_file": "/log/traefik_access.log",
  "port": 18080,
  "entrypoints": {
    "web": {
      "address": ":18080"
    }
  },
  "command": [
    "/traefik/traefik",
    "--configFile=/config/traefik/traefik.yml"
  ],
  "config_dir": "/config/traefik",
  "config_file": "/config/traefik/traefik.yml"
}

pinned_version selects the Traefik binary DUMB installs. The config and both log paths live under the persistent /config and /log mounts. DUMB rewrites its generated route files when service UI definitions change; put operator-owned host routes in Traefik Proxy Admin rather than editing services.yaml by hand.

Security considerations¶

Do not protect the Authelia portal with its own ForwardAuth middleware. Also avoid combining the Authelia ForwardAuth middleware with TPA Service SSO on one router unless two sequential login gates are intentional.

Related pages¶

• Embedded UIs
• Traefik Proxy Admin
• Authelia
• Cloudflared
• Service ports