How to remove public access to your Dokploy UI and restrict it to SSH tunneling

This is going to be a short post, demonstrating how you can remove public exposure from your Dokploy management interface and only allow access via SSH tunneling.

Change Traefik routing

First, SSH into your Dokploy host and modify the Traefik configuration and replace the existing dokploy.yaml with the following content. This will stop Traefik from exposing the Dokploy service to the world.

http:
  routers:
    dokploy-router-app:
      rule: Host(`localhost`)
      service: dokploy-service-app
      entryPoints:
        - web
  services:
    dokploy-service-app:
      loadBalancer:
        servers:
          - url: http://dokploy:3000
            passHostHeader: true

Adjust the list of allowed origins

Next, we need to change the ALLOWED_ORIGINS value so that logins from localhost are allowed.

docker service update --env-rm ALLOWED_ORIGINS --env-add ALLOWED_ORIGINS=http://localhost:3000 dokploy

SSH & port forward to your Dokploy host

That's it. Now you can SSH & port forward to your Dokploy host and securely access the UI via http://localhost:3000

ssh user@host -L3000:localhost:3000

Happy hacking 😎