Dokploy Traefik Dashboard: How to Enable It, Lock It Down and Read the Routers When a Domain Does Not Work

Every domain on a Dokploy server passes through Traefik, so when a domain returns 404, a certificate never appears or an app answers Bad Gateway, Traefik is where the answer is. Dokploy exposes it in two ways that share a name: a file editor for Traefik’s configuration inside the Dokploy UI, and Traefik’s own dashboard on port 8080, which is disabled until you turn it on. This guide covers both, the way Dokploy wires Traefik underneath (read from the Dokploy source and issue tracker on 31 October 2026), how to expose the dashboard without leaving an unauthenticated panel open, and how to read it when something is broken. It assumes a server like the $9.58 Starter preset on the Dokploy hosting page; nothing here needs more.

Two dashboards, one name

• Dokploy’s Traefik file editor lives in the Dokploy UI at /dashboard/traefik: a file-system view of every Traefik configuration file the platform manages, editable in the browser. Each application also has a Traefik section at the bottom of its Advanced tab that opens that app’s own dynamic configuration file.
• Traefik’s dashboard is the web UI that ships with Traefik itself: HTTP routers, services, middlewares, TLS certificates and entrypoints, read-only, on port 8080. Dokploy generates Traefik’s static config with api.insecure: true, so the API is enabled, but port 8080 is not published on the host until you enable the dashboard from the UI.

Searchers asking for "dokploy traefik dashboard" usually want the second one and end up in the first. Both are useful; the second is the one that explains a broken domain.

How Dokploy runs Traefik

Dokploy runs Traefik as a container named dokploy-traefik from the official traefik:v3 image (the default tag in the Dokploy source on 31 October 2026 is 3.7.16), with three mounts: the static configuration /etc/dokploy/traefik/traefik.yml (mounted inside the container as /etc/traefik/traefik.yml), the dynamic configuration directory /etc/dokploy/traefik/dynamic, which Traefik watches for changes, and the Docker socket. Let’s Encrypt state lives in /etc/dokploy/traefik/dynamic/acme.json.

The generated static config defines two entrypoints, web on port 80 and websecure on port 443 (with HTTP/3 advertised on UDP 443), a Docker provider on the dokploy-network with exposedByDefault: false, a Swarm provider when clustering is on, a file provider on the dynamic directory, and a letsencrypt certificate resolver using the HTTP challenge on the web entrypoint. Applications get a dynamic file each; Docker Compose services and templates are routed through Traefik labels instead, which is why a Compose domain change needs a redeploy before it takes effect.

Enable the Traefik dashboard from the Dokploy UI

1. Open Web Server in the Dokploy settings, then the Traefik section.
2. Click Enable dashboard. Dokploy adds a port mapping for 8080 to Traefik’s additional ports and recreates the dokploy-traefik container; it keeps the previous container as dokploy-traefik-previous while it does so. Since the fix merged on 6 December 2025 (pull request 2997), Dokploy checks that port 8080 is free first and names the container that holds it if not.
3. Open http://YOUR-SERVER-IP:8080/dashboard/, with the trailing slash. Without it Traefik returns 404.

Confirm from the shell that the port is published:

docker ps --filter name=dokploy-traefik --format '{{.Names}} {{.Ports}}'
ss -ltnp | grep 8080

The dashboard has no authentication. With api.insecure: true, anyone who can reach port 8080 sees every hostname, backend address and middleware on the server. Treat enabling it as a temporary debugging step, or secure it as described next.

Lock it down

Option 1, firewall it. If UFW is active (Dokploy’s hardening guide and our Dokploy security post assume it is), allow 8080 only from your own address and nothing else:

sudo ufw allow from 203.0.113.10 to any port 8080 proto tcp
sudo ufw status numbered

Remember that Docker publishes ports through its own iptables chain, so a plain ufw deny 8080 does not block a published container port; the per-source allow rule above works because UFW’s rules for the host address are evaluated first. Disable the dashboard again from the same UI button when you are done.

Option 2, a domain with HTTPS and basic auth. Create a dynamic file, for example /etc/dokploy/traefik/dynamic/traefik-dashboard.yml, through the file editor at /dashboard/traefik or over SSH:

http:
  routers:
    traefik-dashboard:
      rule: "Host(`traefik.example.com`)"
      entryPoints:
        - websecure
      service: api@internal
      middlewares:
        - dashboard-auth
      tls:
        certResolver: letsencrypt
  middlewares:
    dashboard-auth:
      basicAuth:
        users:
          - "admin:$apr1$REPLACE$WITH-YOUR-HASH"

Generate the hash with htpasswd -nB admin (package apache2-utils) or openssl passwd -apr1, point the DNS record at the server, and Traefik serves the dashboard at https://traefik.example.com/dashboard/ behind a password. api@internal is Traefik’s built-in service for its own API, so no port needs to be published; once this works, remove the 8080 mapping (disable the dashboard in the UI) so the only open ports are 22, 80 and 443.

Reading the dashboard when a domain does not work

The dashboard turns Traefik from a black box into a list. Work through it in this order:

• HTTP > Routers. Is there a router whose rule contains your hostname? No router means Traefik never learned about the domain: for an application, check the domain entry in Dokploy and that the dynamic file exists; for a Compose service or template, the domain is a label, so redeploy and wait for the deployment to finish. A router that exists but shows an error badge usually names a missing middleware or certificate resolver.
• HTTP > Services. Click the router’s service and look at the server URL. The port must be the one the application listens on inside the container (3000 for a default Next.js app, 8000 for Laravel with Octane, 80 for Nginx). A wrong port is the usual cause of Bad Gateway; the other is an app bound to 127.0.0.1 instead of 0.0.0.0, which the dashboard cannot see but the application logs can.
• HTTP > Middlewares. A redirect loop or a stripped prefix comes from here; Dokploy’s per-app Traefik section is where those were added.
• TLS > Certificates. If the domain is routed but the certificate is Traefik’s default self-signed one, the ACME challenge failed. Common causes, from Dokploy’s troubleshooting page: the DNS record was added after the domain in Dokploy (recreate the domain or restart Traefik), port 80 is blocked so the HTTP challenge cannot complete, or a Cloudflare proxy sits in front. Our certificate troubleshooting post walks through each.

A plain 404 page not found from Traefik with no router means the request reached Traefik and matched nothing; a browser connection error means it never reached Traefik, so check DNS and the firewall before anything inside Dokploy.

Logs, restarts and ports from the shell

# follow Traefik's log
docker logs dokploy-traefik --tail 200 -f

# list the dynamic configuration Dokploy wrote
ls -la /etc/dokploy/traefik/dynamic/

# restart Traefik after a manual edit of traefik.yml (dynamic files reload on their own)
docker restart dokploy-traefik

Lines such as use of closed network connection during a restart are normal, per Dokploy’s troubleshooting docs. Traefik’s listening ports (80 and 443 by default, plus any additional ports) are managed from Web Server > Traefik > Ports in Dokploy 0.29 and later, so change them there rather than in the file; the maintainers pointed users to that screen in August 2026. One known hazard: on Dokploy 0.25.x, editing Traefik’s additional port mappings could recreate the container without its Docker networks, so every domain returned a gateway timeout until each service was redeployed (issue 3022, closed as a duplicate of 2996 and fixed by the same pull request). If you ever see every domain fail at once right after a Traefik port change, docker network inspect dokploy-network and a redeploy per service is the recovery.

What the server needs

Traefik itself is light, a few tens of megabytes of RAM and negligible CPU at small-site traffic, so enabling its dashboard changes nothing about sizing. What matters is that Traefik, Dokploy and your applications share one host: the 2 vCPU, 4 GB Starter preset on the Dokploy hosting page ($9.58 a month on shared cores, $19.80 on dedicated) runs Dokploy, Traefik, a small Postgres and two or three applications comfortably; builds that peg the CPU are the reason to step up to Growth or to a separate build server, not the proxy. MassiveGRID installs Dokploy for you on request after you order, Traefik included.

Frequently Asked Questions

Why does enabling the Traefik dashboard fail with "port is already allocated"?

Another container on the server is already publishing port 8080, which is the port Traefik’s dashboard uses. Find it with docker ps and look for 8080 in the ports column (Redpanda Console, Jenkins, Portainer’s edge agent and many dev tools default to 8080), move or stop it, then enable the dashboard again. Dokploy has checked for this conflict before recreating Traefik since the fix merged on 6 December 2025; on older versions a conflict could leave the Traefik container stopped and every domain down, and the recovery was to free the port and restart dokploy-traefik.

Is it safe to leave the Dokploy Traefik dashboard enabled?

Not on a public port. Dokploy enables Traefik’s API in insecure mode, so the dashboard on port 8080 has no login and lists every hostname, backend and middleware on the server. Either enable it only while debugging and disable it afterwards, restrict port 8080 to your own IP in the firewall, or route it through a domain with HTTPS and a basic-auth middleware as shown above and close the port.

Where are Dokploy’s Traefik configuration files?

On the host under /etc/dokploy/traefik: traefik.yml is the static configuration (entrypoints, providers, the Let’s Encrypt resolver), the dynamic directory holds one file per application plus acme.json with the certificates, and Traefik watches that directory so edits apply without a restart. The same files are editable in the Dokploy UI at /dashboard/traefik and, per application, from the Traefik section of the Advanced tab.