Traefik stands at the front door of your server and hands each visitor to the right app, with a proper HTTPS certificate. You install it once and then mostly forget it's there.
On this page
At a glance#
- What it is
- Reverse Proxy Networking
- Where it opens
- Admin Dashboard
On its own port at
http://your-server:port, ortraefik.your-domainonce you have a domain - Updates
- Automatic A backup is taken first, and it rolls back if the update fails
- Backups
- Included Part of the daily backup when that's switched on
- Copies
- One per server
What it's good for#
Without Traefik, every app lives on its own port: http://192.168.1.50:5123 for one, :6204 for the next. That works perfectly well at home. Traefik is what lets the same apps have addresses like https://nextcloud.example.com, all on the normal web ports, each with a certificate your browser trusts.
It listens on ports 80 and 443, looks at the name each visitor asked for, and passes them to the app that owns that name. It also fetches and renews the certificates from Let's Encrypt, and it's where LibrePortal applies the checks that sit in front of apps: the trusted places allowlist for private apps, Authelia's sign-in page, CrowdSec's blocklist, and the optional login described below.
You need Traefik for either of LibrePortal's HTTPS choices, with a domain or without. Domains and HTTPS walks through the whole setup; this page is about Traefik itself.
Installing Traefik#
Install it from the App Center like any other app. If you've already added a domain, the install asks for an Email for Let's Encrypt notices. It's optional: Let's Encrypt no longer needs one, and only uses it to warn you about certificates. Leave it empty if you like.
Ports 80 and 443 must be free
Traefik needs ports 80 and 443 on the server to itself. If something else already uses them, like a web server you installed by hand, Traefik can't start. And for Let's Encrypt, both ports have to reach your server from the internet: on a VPS that's usually already true; at home, forward them on your router.
Apps you installed before Traefik don't get their domain address straight away. Open each one and press Update Configuration on its Config tab to give it one.
The dashboard#
Traefik's Admin Dashboard shows what it's doing: every address it knows, which app each one goes to, and whether it's served over HTTPS. It's read-only, so you can look around without breaking anything. When an app's domain address doesn't work, this is the place to check that its route exists.
The dashboard starts private: only your trusted places and your devices on the LibrePortal VPN can open it.
- On its own port (
http://192.168.1.50:port), it has no login of its own, which is exactly why it's private. If the server's firewall isn't on, LibrePortal goes further and keeps the dashboard on the server itself only, until the firewall is on and Traefik is reinstalled. - On your domain (
traefik.example.com), it also asks for a username and password. LibrePortal generates both when it's installed. Traefik's Login Details (press Welcome on Traefik's page) have a box for them, Website Authentication (Traefik basic-auth).
The card doesn't show this login yet
In 0.4.7 that box shows (see CFG_TRAEFIK_USER) where the username should be, and Show on the password gives (see CFG_TRAEFIK_PASS) rather than the password. Until that's fixed, you can print the password in a terminal on the server:
sudo -u libreportal libreportal secret get system CFG_TRAEFIK_PASS
If you don't know the username either, the simplest way is to set a new pair: run Reset Dashboard Login on the Tools tab with a username you'll remember and the password left empty. The task's result shows the new username and password. To check: drop this callout once Traefik's card reads CFG_TRAEFIK_USER and CFG_TRAEFIK_PASS (apps-manager.js reads window.globalConfig, which nothing sets)
The login you can put in front of other apps#
The same username and password can guard any app's domain address. On an app's Config → Network, press Show advanced fields and set a port's Login Required to True. Traefik then asks for that login before letting anyone through to the app.
It's a plain browser login box, handy for an app that has no login of its own. It only applies to the domain address, and if the app is behind Authelia, Authelia takes over instead. For anything public and important, Authelia is the stronger choice.
To change the username or password, use Reset Dashboard Login on Traefik's Tools tab. Leave the username empty to keep it, and the password empty to have a strong one made for you.
Good to know#
- Updates are automatic within Traefik 3. Traefik is what every domain address depends on, and a backup is taken first.
- It isn't a firewall. Private apps are kept private by the server's firewall on their own ports, and by Traefik on their domain addresses. Traefik alone doesn't decide what the internet can reach.
- One per server. There's only one pair of ports 80 and 443 to go round.
- Metrics. With Prometheus and Grafana installed, Export metrics to Grafana in its settings gives you a Grafana dashboard of requests, error codes and the slowest apps.
What the install asks#
When you install Traefik, LibrePortal asks for a little more than usual before it starts:
- Certificate email You can leave this one empty.
Addresses and ports#
Traefik has 3 ports. LibrePortal picks a free port number for each when you install, so yours will differ from anyone else's. The Config tab's Network section shows them, and the app's Open button uses the right one. "Anyone" means it's reachable from wherever your server is reachable; you can make it private later.
| What it is | Who can reach it | With a domain |
|---|---|---|
| Admin Dashboard | Trusted places only | traefik.your-domain |
| HTTPS Traffic TCP | Anyone | Port only |
| HTTP Traffic TCP | Anyone | Port only |
Settings#
In its config file#
Traefik's own settings aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.
| Setting | What it does | Starts as |
|---|---|---|
NameCFG_TRAEFIK_DISPLAY_NAME |
What this app is called on your dashboards. Leave empty to use its usual name | Empty |
Show on the LibrePortal DashboardCFG_TRAEFIK_SHOW_ON_DASHBOARD |
Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard Choices: true, false |
false |
Tools#
Traefik's Tools tab has 1 button for jobs you'd otherwise need a terminal for. Each one runs as a task, so you can watch it on the Tasks page and read what it did. More about Tools.
Set new dashboard login credentials. Leave fields blank to keep the username or generate a new password.
Works with#
These are the other apps Traefik knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.
- Grafana: Shows dashboards for the apps that have one. works with every app
- Prometheus: Collects metrics from the apps that can export them. works with every app
- Uptime Kuma: Watches your apps and shows when one goes down. works with every app
Privacy and security#
All clear Traefik is your reverse proxy and sends no usage statistics. LibrePortal turns off its new-version check; it asks Let's Encrypt for certificates only when you use a domain.
What leaves this server#
- Certificates come from Let's Encrypt when you use a domain
What LibrePortal turns off#
- Check for new versions with Traefik's servers
- Anonymous usage statistics
Licence: MIT. Audited: 21 October 2026. See the privacy of every app and the Promise.
Sources#
Under the hood#
- It runs this image:
traefik:v3.7.16@sha256:1336e85aaed293bd63d005086e0dd013b04078b26aaeb1c18b26a2f928af7e65. - It can sit behind Authelia's sign-in once Authelia is installed.
- Its own project and documentation: github.com/traefik/traefik
Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.
