dumbdock
dumbdock
The dumbdock Traefik tab reads Traefik's read-only API to show routers, services, middlewares, entrypoints, and TLS certificates. Traefik does not expose this API by default, so dumbdock may log connection refused errors until it is enabled. This guide covers both ways to enable it, how to verify it works, and how to troubleshoot failures.
dumbdock resolves the Traefik API URL with this fallback chain:
dumbdock.traefik.api label on the Traefik container (used as-is).TRAEFIK_API_URL environment variable set on the dumbdock container.8080 (or the port from --entrypoints.traefik.address=:PORT).127.0.0.1 (preferring 8080).If every endpoint fails at the resolved URL, dumbdock probes fallbacks in order — the published 8080/tcp port, the container IP on 8081, then any other published TCP port — and uses the first one that answers /api/version.
Start Traefik with --api.insecure=true. This serves the dashboard and API on the traefik entrypoint (default port 8080).
docker run -d --name traefik \
-p 80:80 -p 8080:8080 \
-v /var/run/docker.sock:/var/run/docker.sock \
traefik:v3 --api.insecure=true --providers.docker
Compose equivalent:
services:
traefik:
image: traefik:v3
command:
- --api.insecure=true
- --providers.docker=true
ports:
- "80:80"
- "8080:8080"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
Security note: --api.insecure=true has no authentication. Keep port 8080 on a private network (do not publish it to a public interface) and let dumbdock reach it over the Docker network.
No port publishing needed: you do not have to expose 8080 to the host. If dumbdock shares a Docker network with Traefik, it reaches the API directly at the Traefik container's IP on port 8080 — omit the -p 8080:8080 line (or the 8080:8080 entry under ports) entirely:
docker run -d --name traefik \
-p 80:80 \
-v /var/run/docker.sock:/var/run/docker.sock \
traefik:v3 --api.insecure=true --providers.docker
With the port unpublished, 8080 is only reachable from inside the Docker network the Traefik container is attached to. Make sure the dumbdock container is on that same network (for example, join both to a shared user-defined network such as traefik).
To confirm the API is listening inside the network without publishing the port, run a request from a shell in the Traefik container itself:
# Traefik v3 (and v2.6+) ships no curl; use wget if curl is missing
docker exec traefik wget -qO- http://127.0.0.1:8080/api/version
If curl is available in your image, the equivalent is:
docker exec traefik curl -s http://127.0.0.1:8080/api/version
To test reachability across the network (the way dumbdock connects), run the request from the dumbdock container using the Traefik container's name instead of 127.0.0.1:
docker exec dumbdock wget -qO- http://traefik:8080/api/version
A successful response is the same version JSON shown under Verify it works. If wget/curl is not present in the image, install it in a throwaway container on the same network:
docker run --rm --network traefik curlimages/curl -s http://traefik:8080/api/version
Expose the api@internal service through a router instead of the insecure entrypoint, optionally protecting it with auth middleware. Example dynamic configuration (Docker provider labels on the Traefik container):
labels:
- "traefik.enable=true"
- "traefik.http.routers.api.rule=Host(`traefik.example.com`)"
- "traefik.http.routers.api.entrypoints=websecure"
- "traefik.http.routers.api.tls=true"
- "traefik.http.routers.api.service=api@internal"
- "traefik.http.routers.api.middlewares=api-auth"
# Basic auth (use `htpasswd -nb user pass` to generate the value)
- "traefik.http.middlewares.api-auth.basicauth.users=admin:$apr1$..."
Then point dumbdock at it explicitly with the TRAEFIK_API_URL environment variable (this overrides auto-discovery):
environment:
- TRAEFIK_API_URL=https://traefik.example.com
Alternatively, label the Traefik container itself with dumbdock.traefik.api and dumbdock will use that URL as-is.
If Traefik's API is protected, give dumbdock credentials (sent server-side only — they never reach the browser):
TRAEFIK_API_TOKEN on the dumbdock container, or traefikAPIToken in dumbdock.json.TRAEFIK_API_USER and TRAEFIK_API_PASS on the dumbdock container.From the machine running dumbdock (use the same host/port dumbdock will use):
curl -s http://:8080/api/version
A working API returns JSON like:
{"Version":"3.x.x","Codename":"...","StartDate":"...","Goversion":"go1.x"}
If you configured auth, add it to the request:
# Bearer
curl -s -H "Authorization: Bearer " http://:8080/api/version
# Basic
curl -s -u user:pass http://:8080/api/version
Then open the dumbdock Traefik tab — it should show the Traefik version, overview stats, and router/service tables.
--api.insecure=true or the api@internal router is enabled, and that the port is reachable from the dumbdock container.connection refused on every endpoint — nothing is listening on the resolved URL, usually because the API is not enabled or is on a different port. dumbdock logs this once per state change and logs traefik: API recovered when it comes back.TRAEFIK_API_URL (or the dumbdock.traefik.api label) to bypass auto-discovery entirely.TRAEFIK_API_TOKEN or TRAEFIK_API_USER/TRAEFIK_API_PASS.