How to access Traefik dashboard #253

@jalmontecl commented on GitHub (Apr 22, 2025):

Hi,

I can't seem to open the traefik dashboard, can someone help me please?

I tried the http://<Traefik IP>:8080/dashboard/ or http://<Traefik IP>:80/dashboard/ but always get the 404.

The config setup by pangolin install scripts so dashboard is true.

the safest way is create a local resource then in the resource ip add 127.0.0.1 and the port 8080. Everything its going to be working and protected by pangolin

@jalmontecl commented on GitHub (Apr 22, 2025): > Hi, > > I can't seem to open the traefik dashboard, can someone help me please? > > I tried the `http://<Traefik IP>:8080/dashboard/` or `http://<Traefik IP>:80/dashboard/` but always get the 404. > > The config setup by pangolin install scripts so dashboard is true. the safest way is create a local resource then in the resource ip add 127.0.0.1 and the port 8080. Everything its going to be working and protected by pangolin

GiteaMirror commented

@github-actions[bot] commented on GitHub (May 7, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

@github-actions[bot] commented on GitHub (May 7, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

GiteaMirror commented

@gitmotion commented on GitHub (May 12, 2025):

create a local resource and under targets configuration you can use:
method: http
ip / hostname: gerbil
port: 8080

since it's on the same docker network you should be able to target gerbil via hostname and not expose 8080

@gitmotion commented on GitHub (May 12, 2025): create a local resource and under targets configuration you can use: method: http ip / hostname: gerbil port: 8080 since it's on the same docker network you should be able to target gerbil via hostname and not expose 8080

GiteaMirror commented

@Expalmi commented on GitHub (May 20, 2025):

sorry, I think I’m not getting it.

My pangolin is installed on my VPS, with the domain pangolin.xxx.xx, how can I see the dashboard, pangolin.xxx.xx:8080 does not work.

@Expalmi commented on GitHub (May 20, 2025): sorry, I think I’m not getting it. My pangolin is installed on my VPS, with the domain pangolin.xxx.xx, how can I see the dashboard, pangolin.xxx.xx:8080 does not work.

GiteaMirror commented

@AstralDestiny commented on GitHub (May 20, 2025):

Caveat for that is if you are not using insecure mode.. that won't work.. (As without insecure mode traefik doesn't listen on 8080)

At most you will require this to do the below steps, Have this in your traefik.yml (where the entrypoints are located and certificatesResolvers lines are)

api:
 dashboard: true

However you can access it via placing this into your Traefik_dynamic.yml or if you've changed it to be a folder of rules place this into your folder of rules.

http:
  routers:
    dash-rtr:
      rule: "Host(`dash.example.com`)" 
      entryPoints:
        - websecure
      middlewares:
        - badger@http
      service: api@internal

Or via,

  gerbil:
    image: fosrl/gerbil:1.0.0
    container_name: gerbil
    # etc
    labels:
      # Traefik
      - traefik.enable=true
      - traefik.http.routers.traefik-dash.entrypoints=websecure
      - traefik.http.routers.traefik-dash.rule=Host(`dash.example.com`)
      - traefik.http.routers.traefik-dash.middlewares=badger@http
      - traefik.http.routers.traefik-dash.service=api@internal

Though not sure fully how it looks if you are dealing with http.. I can only do https here due to the hsts enforcement and preloads.. So you might need to add the entrypoints for web too.. I'm not fully sure. I know both should work you might have to play with the bader part though.
Assuming Traefik has docker socket for the second and exists in gerbil's stack if so those labels need to be on gerbil and not Traefik's.

@AstralDestiny commented on GitHub (May 20, 2025): Caveat for that is if you are not using insecure mode.. that won't work.. (As without insecure mode traefik doesn't listen on 8080) At most you will require this to do the below steps, Have this in your traefik.yml (where the entrypoints are located and certificatesResolvers lines are) ```yml api: dashboard: true ``` However you can access it via placing this into your Traefik_dynamic.yml or if you've changed it to be a folder of rules place this into your folder of rules. ```yml http: routers: dash-rtr: rule: "Host(`dash.example.com`)" entryPoints: - websecure middlewares: - badger@http service: api@internal ``` Or via, ```yml gerbil: image: fosrl/gerbil:1.0.0 container_name: gerbil # etc labels: # Traefik - traefik.enable=true - traefik.http.routers.traefik-dash.entrypoints=websecure - traefik.http.routers.traefik-dash.rule=Host(`dash.example.com`) - traefik.http.routers.traefik-dash.middlewares=badger@http - traefik.http.routers.traefik-dash.service=api@internal ``` Though not sure fully how it looks if you are dealing with http.. I can only do https here due to the hsts enforcement and preloads.. So you might need to add the entrypoints for web too.. I'm not fully sure. I know both should work you might have to play with the bader part though. Assuming Traefik has docker socket for the second and exists in gerbil's stack if so those labels need to be on gerbil and not Traefik's.

GiteaMirror commented

@Expalmi commented on GitHub (May 20, 2025):

thanks for these examples, I will try to understand how it works.
What I want is a secure way, maybe behind pangolin auth, to access the dashboard.

@Expalmi commented on GitHub (May 20, 2025): thanks for these examples, I will try to understand how it works. What I want is a secure way, maybe behind pangolin auth, to access the dashboard.

GiteaMirror commented

@AstralDestiny commented on GitHub (May 21, 2025):

thanks for these examples, I will try to understand how it works. What I want is a secure way, maybe behind pangolin auth, to access the dashboard.

My example is the secure way. I don't use insecure mode. You might have to play around with the badger part as I don't actually use badger I use authelia for my Idp.

@AstralDestiny commented on GitHub (May 21, 2025): > thanks for these examples, I will try to understand how it works. What I want is a secure way, maybe behind pangolin auth, to access the dashboard. My example is the secure way. I don't use insecure mode. You might have to play around with the badger part as I don't actually use badger I use authelia for my Idp.

GiteaMirror commented

2025-11-13 11:54:34 -06:00

@Expalmi commented on GitHub (May 21, 2025):

Thank you.
I thought installing and configuring pangolin is easy, it is not.
I try to understand how all the components work together and specially how traefik works. I follow the 66 chapters of traefik training by Brian Christner.
Hope it will bring me a little bit further

@Expalmi commented on GitHub (May 21, 2025): Thank you. I thought installing and configuring pangolin is easy, it is not. I try to understand how all the components work together and specially how traefik works. I follow the 66 chapters of traefik training by Brian Christner. Hope it will bring me a little bit further

GiteaMirror commented

@AstralDestiny commented on GitHub (May 22, 2025):

Thank you. I thought installing and configuring pangolin is easy, it is not. I try to understand how all the components work together and specially how traefik works. I follow the 66 chapters of traefik training by Brian Christner. Hope it will bring me a little bit further

Traefik is in charge of the brunt of everything, Pangolin is the UI/UX that gives a JSON which Traefik then picks up via the http endpoint it watches, uses the rules and routes it's defined, Gerbil is the wireguard server and serves the underlying routing if you use newt/Wireguard tunnels to remote sites, Traefik takes in the connections then drops them to gerbil if it's a non local site if it's a local site then Traefik does everything in the end too.

@AstralDestiny commented on GitHub (May 22, 2025): > Thank you. I thought installing and configuring pangolin is easy, it is not. I try to understand how all the components work together and specially how traefik works. I follow the 66 chapters of traefik training by Brian Christner. Hope it will bring me a little bit further Traefik is in charge of the brunt of everything, Pangolin is the UI/UX that gives a JSON which Traefik then picks up via the http endpoint it watches, uses the rules and routes it's defined, Gerbil is the wireguard server and serves the underlying routing if you use newt/Wireguard tunnels to remote sites, Traefik takes in the connections then drops them to gerbil if it's a non local site if it's a local site then Traefik does everything in the end too.

GiteaMirror commented

2025-11-13 11:54:34 -06:00

@Expalmi commented on GitHub (May 22, 2025):

Thanks, then I’ve understood it correctly.
Now I just need to understand how Traefik knows that I want to stay local, on my VPS,
and whether I need to create a DNS A record for that.

@Expalmi commented on GitHub (May 22, 2025): Thanks, then I’ve understood it correctly. Now I just need to understand how Traefik knows that I want to stay local, on my VPS, and whether I need to create a DNS A record for that.

GiteaMirror commented

2025-11-13 11:54:34 -06:00

@Expalmi commented on GitHub (May 22, 2025):

Thank you, hope I got it, do you have time to check what I did

my dynamic_config.yml is in ~/config/traefik/rules, I added your routers config paramaters in this file
created a dns a record dash.
within pangolin I created a lokal resource, pointing to http gerbil 8080
docker compose up -d

did not open port 8080 in the docker-compose.yml

I can open the traefik dashboard with this configuration, after badger authentication,

Can I checke more

@Expalmi commented on GitHub (May 22, 2025): Thank you, hope I got it, do you have time to check what I did - my dynamic_config.yml is in ~/config/traefik/rules, I added your routers config paramaters in this file - created a dns a record dash.<mymaindomain> - within pangolin I created a lokal resource, pointing to http gerbil 8080 - docker compose up -d did not open port 8080 in the docker-compose.yml I can open the traefik dashboard with this configuration, after badger authentication, Can I checke more

GiteaMirror commented

@kmanwar89 commented on GitHub (May 26, 2025):

create a local resource and under targets configuration you can use: method: http ip / hostname: gerbil port: 8080

since it's on the same docker network you should be able to target gerbil via hostname and not expose 8080

Thank you for this - finally had a use for the "local" resource type and this worked perfectly!

@kmanwar89 commented on GitHub (May 26, 2025): > create a local resource and under targets configuration you can use: method: http ip / hostname: gerbil port: 8080 > > since it's on the same docker network you should be able to target gerbil via hostname and not expose 8080 Thank you for this - finally had a use for the "local" resource type and this worked perfectly!

GiteaMirror commented

@github-actions[bot] commented on GitHub (Jun 10, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

@github-actions[bot] commented on GitHub (Jun 10, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

GiteaMirror commented

@Anexgohan commented on GitHub (Jun 12, 2025):

this is for Docker compose
Traefik v3.4.1 above

docker compose

name: pangolin-traefik
services:
  pangolin:
    image: fosrl/pangolin:1.5.1
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./docker-data/config:/app/config
    healthcheck:
      test:
        - CMD
        - curl
        - -f
        - http://localhost:3001/api/v1/
      interval: 10s
      timeout: 10s
      retries: 15

  gerbil:
    image: fosrl/gerbil:1.0.0
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock # <- this is optional
      - ./docker-data/config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 443:443 # Port for traefik because of the network_mode
      - 80:80 # Port for traefik because of the network_mode
      - 8080:8080 # Port for traefik dashboard <- this is required

  traefik:
    image: traefik:v3.4.1
    container_name: traefik
    restart: unless-stopped
    network_mode: service:gerbil # Ports appear on the gerbil service
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock # <- this is required
      - ./docker-data/config/traefik:/etc/traefik:ro
      - ./docker-data/config/traefik/logs:/var/log/traefik
      - ./docker-data/config/letsencrypt:/letsencrypt
    env_file:
      - .env

networks:
  default:
    driver: bridge
    name: pangolin-network

traefik_config.yml

api:
  insecure: false
  dashboard: true

dynamic_config.yml
Secure Traefik Dashboard

    # Traefik dashboard router
    dashboard-router:
      rule: "Host(`domain.example.com`)"
      service: "api@internal"
      entryPoints:
        - websecure
      middlewares:
        - badger@http
      tls:
        certResolver: letsencrypt
      priority: 100   # can be lower or unset

    # Traefik dashboard redirect
    dashboard-redirect:
      rule: "Host(`domain.example.com`)"
      service: noop@internal
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

Pangolin GUI

Add a local site
Add a resource in general tab with
- Name: traefik
- Domain Type: example.com
Add in proxy tab - Method: HTTP
- IP / Hostname: 192.168.x.x or gerbil or traefik, whichever should work
- Port: 8080
Set authentication if needed, otherwise by default it should as for your pangolin usermail and userpassword

hope it works.

@Anexgohan commented on GitHub (Jun 12, 2025): this is for Docker compose Traefik v3.4.1 above `docker compose` ``` name: pangolin-traefik services: pangolin: image: fosrl/pangolin:1.5.1 container_name: pangolin restart: unless-stopped volumes: - ./docker-data/config:/app/config healthcheck: test: - CMD - curl - -f - http://localhost:3001/api/v1/ interval: 10s timeout: 10s retries: 15 gerbil: image: fosrl/gerbil:1.0.0 container_name: gerbil restart: unless-stopped depends_on: pangolin: condition: service_healthy command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth volumes: - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock # <- this is optional - ./docker-data/config/:/var/config cap_add: - NET_ADMIN - SYS_MODULE ports: - 51820:51820/udp - 443:443 # Port for traefik because of the network_mode - 80:80 # Port for traefik because of the network_mode - 8080:8080 # Port for traefik dashboard <- this is required traefik: image: traefik:v3.4.1 container_name: traefik restart: unless-stopped network_mode: service:gerbil # Ports appear on the gerbil service depends_on: pangolin: condition: service_healthy command: - --configFile=/etc/traefik/traefik_config.yml volumes: - /etc/localtime:/etc/localtime:ro - /var/run/docker.sock:/var/run/docker.sock # <- this is required - ./docker-data/config/traefik:/etc/traefik:ro - ./docker-data/config/traefik/logs:/var/log/traefik - ./docker-data/config/letsencrypt:/letsencrypt env_file: - .env networks: default: driver: bridge name: pangolin-network ``` `traefik_config.yml` ``` api: insecure: false dashboard: true ``` `dynamic_config.yml` Secure Traefik Dashboard ``` # Traefik dashboard router dashboard-router: rule: "Host(`domain.example.com`)" service: "api@internal" entryPoints: - websecure middlewares: - badger@http tls: certResolver: letsencrypt priority: 100 # can be lower or unset # Traefik dashboard redirect dashboard-redirect: rule: "Host(`domain.example.com`)" service: noop@internal entryPoints: - web middlewares: - redirect-to-https ``` `Pangolin GUI` 1. Add a local site 2. Add a resource in general tab with - Name: traefik - Domain Type: example.com 4. Add in proxy tab - Method: HTTP - IP / Hostname: 192.168.x.x or gerbil or traefik, whichever should work - Port: 8080 4. Set authentication if needed, otherwise by default it should as for your pangolin usermail and userpassword hope it works.

GiteaMirror commented