Traefik Label Generator
Build Traefik v2/v3 Docker labels visually for docker-compose.
Client-side only. Nothing leaves your browser
Label syntax is identical between v2 and v3 for these options.
Used as router/service identifier
Port your app listens on inside the container
Comma-separate for multiple hosts: a.example.com, b.example.com
Name of the certificatesResolver from your traefik.yml
Reference middlewares defined elsewhere (file provider, other containers).
Set when the container is on multiple networks
labels:
- "traefik.enable=true"
- "traefik.http.middlewares.myapp-https-redirect.redirectscheme.scheme=https"
- "traefik.http.middlewares.myapp-https-redirect.redirectscheme.permanent=true"
- "traefik.http.routers.myapp.rule=Host(`app.example.com`)"
- "traefik.http.routers.myapp.entrypoints=web"
- "traefik.http.routers.myapp.service=myapp"
- "traefik.http.routers.myapp.middlewares=myapp-https-redirect"
- "traefik.http.routers.myapp-secure.rule=Host(`app.example.com`)"
- "traefik.http.routers.myapp-secure.entrypoints=websecure"
- "traefik.http.routers.myapp-secure.service=myapp"
- "traefik.http.routers.myapp-secure.tls=true"
- "traefik.http.routers.myapp-secure.tls.certresolver=letsencrypt"
- "traefik.http.services.myapp.loadbalancer.server.port=3000"Paste under your service in docker-compose.yml. Indentation is YAML-correct.
What Are Traefik Docker Labels?
Traefik labels are key-value pairs you attach to a Docker container that tell Traefik how to route traffic to it. When the Docker provider is enabled, Traefik watches the Docker socket for containers carrying labels with the traefik.* prefix and dynamically builds routers, services, and middlewares from them, with no separate config file to edit. This makes labels the standard way to expose containers behind Traefik in docker-compose, Docker Swarm, and Portainer setups.
Anatomy of a Traefik Label
Every Traefik label follows the same dotted-key structure. The first segment is always traefik, followed by the resource type (router, service, middleware), the resource name, and the property being set.
| Label | Purpose |
|---|---|
| traefik.enable=true | Opt this container into Traefik routing |
| traefik.http.routers.<name>.rule | Match expression (Host, Path, Headers...) |
| traefik.http.routers.<name>.entrypoints | Which entrypoint(s) to listen on (web, websecure) |
| traefik.http.routers.<name>.tls=true | Terminate TLS for this router |
| traefik.http.routers.<name>.tls.certresolver | Name of the cert resolver (e.g. letsencrypt) |
| traefik.http.routers.<name>.middlewares | Comma-separated middleware chain to apply |
| traefik.http.services.<name>.loadbalancer.server.port | Port the container listens on internally |
| traefik.docker.network | Pick a specific network when container is on many |
Common Traefik Middlewares
| Middleware | What it does |
|---|---|
| redirectscheme | Force HTTP requests to redirect to HTTPS |
| stripprefix | Remove a leading path before forwarding to the backend |
| addprefix | Prepend a path before forwarding |
| basicauth | Require HTTP basic authentication (htpasswd users) |
| headers | Set, replace, or remove request/response headers |
| ipallowlist | Allow only specific source IP ranges (v3) |
| ratelimit | Throttle requests per source |
| compress | gzip-compress responses |
| forwardauth | Delegate auth to an external service (Authelia, Authentik) |
Frequently Asked Questions
What is the difference between Traefik labels and a config file?
Traefik has two configuration layers: static config (traefik.yml or CLI flags) defines entrypoints, providers, and certificate resolvers, which require a Traefik restart to change. Dynamic config (routers, services, middlewares) can come from a file provider, the Docker provider (labels), Kubernetes CRDs, Consul, etc. Labels are just dynamic config attached to a container. Traefik watches the Docker socket and applies them live, with no restart. Use static config for things that rarely change, and labels for per-container routing rules.
Why are my Traefik labels not working?
The most common causes: (1) The container isn't on the same Docker network as Traefik. Add it to the proxy network or set traefik.docker.network. (2) traefik.enable=true is missing and exposedByDefault is false. (3) The router name in the label doesn't match across rule/entrypoints/service lines. (4) The loadbalancer.server.port doesn't match the port the app actually listens on inside the container. Traefik uses the container port, not the host-mapped port. (5) For docker-compose, dollar signs in basic-auth htpasswd values aren't doubled ($$) and YAML parses them as variables.
How do I configure multiple hosts or middlewares with labels?
For multiple hosts in one router, combine them in the rule: Host(a.example.com) || Host(b.example.com). For multiple middlewares, list them comma-separated in a single label: traefik.http.routers.myapp.middlewares=auth,strip-prefix,headers. They run in the order listed, left to right. If you need different middleware chains for HTTP vs HTTPS, define two routers (myapp and myapp-secure) and set the middlewares label on each independently.
Are Traefik v2 and v3 labels the same?
For the labels this generator produces (routers, services, redirectscheme, stripprefix, basicauth, TLS, cert resolvers), the syntax is identical between v2 and v3, so your generated labels work on both. The breaking changes in v3 are mostly elsewhere: Kubernetes CRD apiVersion changed from traefik.containo.us/v1alpha1 to traefik.io/v1alpha1, ipWhiteList was renamed to ipAllowList, and some experimental features moved. Plain Docker label users rarely need to change anything when upgrading from v2 to v3.
Can I use Traefik with Docker without labels?
Yes. The Docker provider is one of many. You can disable it and use the file provider instead, defining all your routers, services, and middlewares in a YAML or TOML file that Traefik watches for changes. This is preferred when you want config in version control alongside Traefik itself, when containers run on a different host than Traefik, or for routes that don't map to a single container (external services, TCP routers to non-Docker backends). You can also mix both: labels for app containers and a file for shared middlewares like a global IP allowlist.
Related Tools
Nginx Config Generator
Generate nginx.conf from form inputs. Covers the common modes: reverse proxy, SSL, static files, load balancer, and basic auth.
Nginx to Caddy Converter
Convert nginx server blocks to Caddyfile syntax. Maps reverse_proxy, TLS, redirects, and headers.
Docker Compose Generator
Build docker-compose.yml visually. Add services, volumes, networks, and env vars, with live YAML and lint warnings.
Dockerfile Generator
Build Dockerfiles from form inputs. Multi-stage builds, healthchecks, and best-practice hints inline.
PM2 Ecosystem Generator
Visual builder for ecosystem.config.js. Configure cluster mode, env vars, watch, and max_memory_restart.
Need to manage SSH connections?
SSH Workbench lets you connect, browse files, and manage servers visually.
Try SSH Workbench Free