Traefik Middleware

Traefik middleware configuration lets you attach request-handling rules to an application or Docker Compose stack without modifying Traefik config files directly. Rules are stored per resource. For applications, the config is written straight into the Traefik file-provider dynamic config on upsert/disable, taking effect immediately; for Docker Compose stacks, rules are injected as Traefik labels and take effect on the next deploy.

Middleware config applies to applications and Docker Compose stacks. Basic Auth is compose-only — applications use the dedicated Security tab instead.

Accessing middleware settings

Navigate to your Application or Compose → Security tab. You need the app_security.read permission to view settings and app_security.write to make changes.

Security headers

Toggle Security Headers on to enable the header middleware. Individual headers can be mixed and matched:

Rate limiting

Toggle Rate Limit on to enable Traefik's rateLimit middleware:

In-flight request limit

Caps the number of concurrent requests forwarded to the service. Enable In-Flight Limit and set:

• Amount — maximum simultaneous requests. Excess requests receive a 429 Too Many Requests response.

Request body size limit

Enable Body Limit and set:

• Max Request Body Bytes — reject requests with a body larger than this value (bytes).

IP allowlist

Enable IP Allowlist and provide a list of IPv4/IPv6 addresses or CIDR ranges. Only requests from listed sources are forwarded; all others receive 403 Forbidden.

Addresses must match the format 1.2.3.4 or 10.0.0.0/24. Characters outside those sets are rejected to prevent label injection.

Basic Auth (compose only)

Enable Basic Auth to require HTTP basic authentication on every request. Passwords are stored as bcrypt hashes and are never returned by the API — only usernames are visible.

Adding a user

Navigate to Compose → Security → Basic Auth and click Add User. Adding the first user automatically enables Basic Auth — you don't need to toggle it on separately beforehand. Provide:

• Username — must not contain spaces or any of : , $ \ ` to avoid Traefik label injection
• Password — stored as a bcrypt hash

POST /api/trpc/traefikMiddlewareConfig.addBasicAuthUser

{
  "composeId": "<compose-id>",
  "username": "alice",
  "password": "s3cr3t"
}

Removing a user

POST /api/trpc/traefikMiddlewareConfig.removeBasicAuthUser

{
  "composeId": "<compose-id>",
  "username": "alice"
}

Apply secure defaults

The Apply Secure Defaults action sets a hardened baseline in one click. Existing values for these fields are overwritten; IP allowlist and Basic Auth settings are left untouched:

POST /api/trpc/traefikMiddlewareConfig.applySecureDefaults

{
  "applicationId": "<application-id>"
}

Disabling all middleware

Disable removes the middleware configuration entry entirely. All Traefik rules are dropped on the next config refresh or deploy.

POST /api/trpc/traefikMiddlewareConfig.disable

{
  "composeId": "<compose-id>"
}

API reference

All endpoints require a valid member session with the appropriate app_security permission.

Get / disable payload

Provide exactly one of applicationId or composeId:

{ "applicationId": "<id>" }

or

{ "composeId": "<id>" }

Upsert payload

All config fields are optional; omitted fields are left unchanged:

{
  "applicationId": "<id>",
  "headersEnabled": true,
  "hstsEnabled": true,
  "frameDeny": true,
  "contentTypeNosniff": true,
  "referrerPolicy": "strict-origin-when-cross-origin",
  "customResponseHeaders": { "X-Powered-By": "" },
  "rateLimitEnabled": true,
  "rateLimitAverage": 100,
  "rateLimitBurst": 50,
  "rateLimitPeriod": "1s",
  "inFlightEnabled": true,
  "inFlightAmount": 20,
  "bodyLimitEnabled": true,
  "maxRequestBodyBytes": 10485760,
  "ipAllowListEnabled": false,
  "ipAllowList": [],
  "basicAuthEnabled": false
}