Minimal example for traefik with dashboard and basic auth

Traefik Traefik v2
,
22

@lonix , did you change this line to the actual hostname of the remote machine, or did you keep it as localhost?

23

it seems the answers, at least for traefik v3, lie in turning off --api-insecure=true and replacing it with just --api or --api=true. I got basic auth on the dashboard to work using the following docker-compose.yml (note: traefik v3.3):

# docker-compose.yml

services:
  traefik:
    # The official v3 Traefik docker image
    image: traefik:v3.3
    # Enables the web UI and tells Traefik to listen to docker
    command:
      - --api=true
      - --providers.docker
      - --log.level=DEBUG
      - --providers.docker.network=traefik
    networks:
      - traefik
    ports:
      # The HTTP port
      - "80:80"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
    labels:
      - "traefik.http.routers.traefik.rule=Host(`traefik.docker.localhost`)"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=dashboard-auth"
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$$apr1$$vO3/IDvg$$JrbhU9NSQub83/mQu9/fP1" # admin/password

  whoami:
    # A container that exposes an API to show its IP address
    image: traefik/whoami
    labels:
      - "traefik.http.routers.whoami.rule=Host(`whoami.docker.localhost`)"
    networks:
      - traefik

networks:
  traefik:
    driver: bridge
    name: traefik
    external: true

whoami, and other apps, work as expected, but going to traefik.docker.localhost gives me the basic auth dialog and then the dashboard. I can change the Host line to use a different hostname if I want this accessible remotely.

Note that I didn't bother to keep the 8080 port, since I am using a dedicated hostname for this dashboard. You probably won't want log.level=DEBUG in production, change the username/password, don't put it in plaintext in this config file, etc.

The network config lines in the yaml file, above, are specific to my use case and not strictly necessary for proper dashboard basic auth, so you can probably ignore those. I am using traefik for proxying other apps with other docker-compose.yml files on the same hardware, so I built a traefik network so that traefik can talk to them all.