Traefik dashboard

Coolify enables Traefik's dashboard API in secure mode, but does not publish it on a domain. Create a dynamic router to access the dashboard through HTTPS and protect it with basic authentication.

Create dashboard credentials

Generate a bcrypt credential with htpasswd:

htpasswd -nbB <username> '<password>'

Copy the complete <username>:<hash> output. Dynamic YAML does not require Docker Compose dollar-sign escaping.

Add the dashboard route

Open Servers > your server > Proxy > Dynamic Configurations, select Add, and create traefik-dashboard.yaml:

http:
  middlewares:
    dashboard-auth:
      basicAuth:
        users:
          - '<username>:<bcrypt-hash>'
    dashboard-https-redirect:
      redirectScheme:
        scheme: https

  routers:
    dashboard-http:
      rule: 'Host(`traefik.example.com`)'
      entryPoints:
        - http
      middlewares:
        - dashboard-https-redirect
      service: api@internal

    dashboard-https:
      rule: 'Host(`traefik.example.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))'
      entryPoints:
        - https
      middlewares:
        - dashboard-auth
      service: api@internal
      tls:
        certResolver: letsencrypt

Replace the hostname and credential, then save the file. Point the hostname's DNS record to this server.

Open https://traefik.example.com/dashboard/ and sign in with the configured credential.

Do not use insecure mode on a public server

Setting --api.insecure=true exposes the dashboard directly on Traefik's API port without authentication. Coolify maps port 8080 in the default Traefik configuration, so enabling insecure mode can publish the dashboard through the server firewall.

Use the authenticated HTTPS route above instead. If you temporarily enable insecure mode for isolated debugging, restrict port 8080 at the firewall and remove --api.insecure=true immediately afterward.

Troubleshooting