Administration UI Configuration Reference

This page lists the settings that configure the deployment of the Administration UI: how it connects to your gateway, and to the services behind each feature. These are not the fields of the forms that create and edit routes in the UI.

Each setting is available as a command-line flag and as an environment variable. The tables on this page list both. To derive the environment variable of a flag, remove the leading --, replace each . with _, change the name to upper case, and add the prefix TRAEFIK_HUB_DASHBOARD_. For example, --api.url is TRAEFIK_HUB_DASHBOARD_API_URL, and --gitops.github.clientID is TRAEFIK_HUB_DASHBOARD_GITOPS_GITHUB_CLIENTID. A flag overrides its environment variable. Flag names are case-insensitive.

Run traefik-hub-dashboard serve --help to list every flag, and traefik-hub-dashboard version to print the version.

Token features

The gateway token must include the following features:

Feature	Required for
ai-dashboard	Running the Administration UI. The UI exits at startup without it.
mcp-server	Ask your gateway. Without it, the UI logs a warning at startup and turns off the feature.

General settings

Flag	Environment variable	Default	Description
--addr	TRAEFIK_HUB_DASHBOARD_ADDR	:8080	Address the Administration UI listens on.
--api.url	TRAEFIK_HUB_DASHBOARD_API_URL		URL of the gateway API, for example http://traefik-hub-api.traefik.svc:8080/api. Required.
--log.format	TRAEFIK_HUB_DASHBOARD_LOG_FORMAT	json	Log format: json or console.
--log.level	TRAEFIK_HUB_DASHBOARD_LOG_LEVEL	info	Log level.
--token	TRAEFIK_HUB_DASHBOARD_TOKEN		Gateway token that includes the ai-dashboard feature. Required.

HTTP client settings

The Administration UI calls four upstream services: the gateway API, the metrics store, the model route, and the Traefik MCP Server. Each service has its own HTTP client settings, and the settings have the same names for all four. The clients never retry. The gateway API and the metrics store time out after 30 seconds. The model route and the Traefik MCP Server have no timeout, so an answer can stream for as long as it takes.

To set an HTTP client setting, join the prefix of the upstream service to the suffix of the setting. The following table lists the prefixes:

Upstream service	Flag prefix	Environment variable prefix
Gateway API	--api	TRAEFIK_HUB_DASHBOARD_API
Metrics store	--analytics.mimir	TRAEFIK_HUB_DASHBOARD_ANALYTICS_MIMIR
Model route	--agent.llm	TRAEFIK_HUB_DASHBOARD_AGENT_LLM
Traefik MCP Server	--agent.mcp	TRAEFIK_HUB_DASHBOARD_AGENT_MCP

The following table lists the suffixes:

Flag suffix	Environment variable suffix	Description
.httpClient.headers.<name>	_HTTPCLIENT_HEADERS_<NAME>	Header sent with every request to the upstream service. Set credentials with an environment variable, because a flag is visible in the process list.
.httpClient.tls.ca	_HTTPCLIENT_TLS_CA	CA to trust, as a PEM file path or the PEM content.
.httpClient.tls.cert	_HTTPCLIENT_TLS_CERT	Client certificate for mutual TLS.
.httpClient.tls.insecureSkipVerify	_HTTPCLIENT_TLS_INSECURESKIPVERIFY	Skips the verification of the server certificate. Default: false.
.httpClient.tls.key	_HTTPCLIENT_TLS_KEY	Client key for mutual TLS.

For example, the CA of the Traefik MCP Server is set with the flag --agent.mcp.httpClient.tls.ca or the environment variable TRAEFIK_HUB_DASHBOARD_AGENT_MCP_HTTPCLIENT_TLS_CA. The environment variable TRAEFIK_HUB_DASHBOARD_ANALYTICS_MIMIR_HTTPCLIENT_HEADERS_AUTHORIZATION="Basic <credentials>" sends a Basic authentication header to the metrics store.

Analytics

Setting --analytics.mimir.url enables the Analytics pages.

Flag	Environment variable	Default	Description
--analytics.mimir.tenantID	TRAEFIK_HUB_DASHBOARD_ANALYTICS_MIMIR_TENANTID		Mimir tenant, sent as the X-Scope-OrgID header.
--analytics.mimir.url	TRAEFIK_HUB_DASHBOARD_ANALYTICS_MIMIR_URL		URL of the Prometheus HTTP API of the metrics store, for example http://mimir:8080/prometheus.

Ask your gateway

Setting --agent.llm.url, or --agent.llm.model for a hosted provider, enables Ask your gateway. The agent also requires --agent.llm.model and --agent.mcp.url.

Flag	Environment variable	Default	Description
--agent.llm.model	TRAEFIK_HUB_DASHBOARD_AGENT_LLM_MODEL		Model requested from the route. Required.
--agent.llm.provider	TRAEFIK_HUB_DASHBOARD_AGENT_LLM_PROVIDER	openai-compatible	API format of the route: openai-compatible, responses, or a hosted provider (openai, anthropic, gemini, ollama, mistral, deepseek, groq, llamacpp, zai).
--agent.llm.url	TRAEFIK_HUB_DASHBOARD_AGENT_LLM_URL		Base URL of the model route, for example https://ai.example.com/v1. Required for responses and for openai-compatible. Hosted providers have a default.
--agent.mcp.url	TRAEFIK_HUB_DASHBOARD_AGENT_MCP_URL		URL of the MCP endpoint of the Traefik MCP Server, for example http://traefik-mcp.traefik.svc:8090/mcp. Required.

GitOps

Setting --gitops.repository enables route creation, editing, and deletion. The --gitops.externalURL and the three --gitops.github credentials are then required.

Flag	Environment variable	Default	Description
--gitops.baseBranch	TRAEFIK_HUB_DASHBOARD_GITOPS_BASEBRANCH	main	Branch the pull requests target.
--gitops.externalURL	TRAEFIK_HUB_DASHBOARD_GITOPS_EXTERNALURL		Public URL of the Administration UI, where the browser returns after sign-in, for example https://admin.example.com. Required.
--gitops.fileProviderConfig	TRAEFIK_HUB_DASHBOARD_GITOPS_FILEPROVIDERCONFIG		Path of the dynamic configuration file (YAML) that the file provider reads, inside the repository and under --gitops.root, relative to the repository root, for example manifests/dynamic.yaml. Leave empty when the file provider isn't managed. The file must be plain YAML, without Go templates.
--gitops.github.clientID	TRAEFIK_HUB_DASHBOARD_GITOPS_GITHUB_CLIENTID		Client ID of the GitHub App. Required.
--gitops.github.clientSecret	TRAEFIK_HUB_DASHBOARD_GITOPS_GITHUB_CLIENTSECRET		Client secret of the GitHub App. Required.
--gitops.github.privateKey	TRAEFIK_HUB_DASHBOARD_GITOPS_GITHUB_PRIVATEKEY		Path to the PEM file with the private key of the GitHub App. Required.
--gitops.github.url	TRAEFIK_HUB_DASHBOARD_GITOPS_GITHUB_URL	https://github.com	URL of the GitHub server, for GitHub Enterprise Server.
--gitops.refreshInterval	TRAEFIK_HUB_DASHBOARD_GITOPS_REFRESHINTERVAL	30s	How often the Administration UI checks the base branch for a new commit, as a duration such as 10s. Lower it to pick up merged changes sooner. The value must be positive.
--gitops.repository	TRAEFIK_HUB_DASHBOARD_GITOPS_REPOSITORY		URL of the repository, in the form https://github.com/<owner>/<repository>.
--gitops.root	TRAEFIK_HUB_DASHBOARD_GITOPS_ROOT		Directory of the Kubernetes manifests in the repository. Leave empty for the repository root.

The container image includes git. The Administration UI needs a writable HOME and temporary directory for its clone of the repository, so the installation manifest sets HOME to /tmp and mounts an emptyDir volume there.

Endpoints

The Administration UI serves the following paths:

Path	Description
/	The web UI.
/api/agent/*	The agent API, when Ask your gateway is enabled.
/api/analytics/*	The Analytics API, when a metrics store is configured.
/api/gitops/*	The GitOps API, when a repository is configured.
/api/*	Other requests under /api/ are forwarded to the gateway API, without the caller's Authorization and Cookie headers. The agent API instead forwards Authorization to the model route and the Traefik MCP Server, as described in Set up Ask your gateway.
/healthz	Returns 200 while the process runs. Use it as the liveness probe.
/readyz	Returns 200 when the Administration UI can serve. With GitOps enabled, it returns 200 after the repository is fetched. Use it as the readiness probe.

Because the Administration UI forwards /api/* to the gateway API, protect the route with an authentication middleware, as described in Install the Administration UI.