How to Update Traefik Proxy in Coolify (v3.6 to v3.7) Without Downtime Surprises

I opened my Coolify dashboard the other day and saw a yellow banner: “New Traefik minor version available (v3.7)”, plus an “Attention required” status on my localhost server. My first thought was that something had broken. It had not. Coolify was simply telling me the Traefik proxy it manages is a version behind.

In this post I will show you how I update it, how I check that everything still works, and what to do if the warning stays after the upgrade.

What this notice actually means

Coolify uses Traefik as its reverse proxy. It runs as a container called coolify-proxy and listens on ports 80 and 443. Your apps get their domains and SSL certificates through it.

Coolify does not upgrade this container for you when you update Coolify itself. The proxy is defined in a compose file on the server, and the image tag in that file is what decides the version. So the banner is informational. Nothing is down.

Before you start

• Back up the current config. SSH into the server and run:

  sudo cp /data/coolify/proxy/docker-compose.yml /data/coolify/proxy/docker-compose.yml.bak

• Read the migration notes. The official Traefik v3 migration guide lists what changed between minor versions. When I checked, the v3.6 to v3.7 items mostly affect the Kubernetes providers (Ingress NGINX, Gateway API, CRDs) and wildcard Host matching. Coolify uses the Docker provider, which was not listed as affected, but read it yourself, especially if you added custom labels.
• Pick a quiet time. The proxy restarts, so your sites will drop for a few seconds.

Step 1: Open the proxy configuration

In Coolify, go to Servers, pick your server (for example localhost), then open the Proxy tab and click Configuration. You will see the full docker-compose.yml for Traefik, the same file that lives at /data/coolify/proxy/docker-compose.yml.

Step 2: Change the image tag

Find the image: line. Mine looked like this:

image: traefik:v3.6

Change it to the version Coolify suggests in the banner. For example:

image: traefik:v3.7

I prefer to use the tag Coolify recommends rather than guessing the latest patch. If you want to pin an exact patch release, check the tags on Docker Hub first. Do not touch the rest of the file unless you know why.

For reference, this is the file I ran after the change. The only line I edited was image:; everything else is the Coolify default:

name: coolify-proxy
networks:
  coolify:
    external: true
services:
  traefik:
    container_name: coolify-proxy
    image: 'traefik:v3.7'
    restart: unless-stopped
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    networks:
      - coolify
    ports:
      - '80:80'
      - '443:443'
      - '443:443/udp'
      - '8080:8080'
    healthcheck:
      test: 'wget -qO- http://localhost:80/ping || exit 1'
      interval: 4s
      timeout: 2s
      retries: 5
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
      - '/data/coolify/proxy/:/traefik'
    command:
      - '--ping=true'
      - '--ping.entrypoint=http'
      - '--api.dashboard=true'
      - '--entrypoints.http.address=:80'
      - '--entrypoints.https.address=:443'
      - '--entrypoints.http.http.encodequerysemicolons=true'
      - '--entryPoints.http.http2.maxConcurrentStreams=250'
      - '--entrypoints.https.http.encodequerysemicolons=true'
      - '--entryPoints.https.http2.maxConcurrentStreams=250'
      - '--entrypoints.https.http3'
      - '--providers.file.directory=/traefik/dynamic/'
      - '--providers.file.watch=true'
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http'
      - '--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json'
      - '--api.insecure=false'
      - '--providers.docker=true'
      - '--providers.docker.exposedbydefault=false'
    labels:
      - traefik.enable=true
      - traefik.http.routers.traefik.entrypoints=http
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.services.traefik.loadbalancer.server.port=8080
      - coolify.managed=true
      - coolify.proxy=true

I saved it, restarted the proxy, and it came up on v3.7 with no errors.

Step 3: Save and restart the proxy

Click Save, then go back to the Proxy page and click Restart Proxy. Coolify pulls the new image and recreates the coolify-proxy container. Dynamic config under /data/coolify/proxy/dynamic/ is picked up without a restart, but changes to the main compose file always need one.

Step 4: Verify it worked

Do not trust the green badge alone. Check from the server:

docker ps --filter name=coolify-proxy
docker exec coolify-proxy traefik version
docker logs --tail 50 coolify-proxy

You want to see the container as healthy, the new version number, and no repeating errors in the logs. Then open two or three of your apps over HTTPS and confirm they load with a valid certificate.

If something breaks: roll back

Put the old tag back in the Configuration editor (or restore the backup you made) and restart the proxy:

sudo cp /data/coolify/proxy/docker-compose.yml.bak /data/coolify/proxy/docker-compose.yml

Coolify also has a Reset Configuration button. Be careful with it. It restores the default file and throws away any custom edits you made, such as extra entrypoints or flags.

The warning is still there after upgrading

This confused me too. After a successful upgrade, the “Proxy: Update available” notice and the “Attention required” status can stay for a while. People have reported this on Coolify v4.3.x (see issue #11868). The cause is stale version records in Coolify’s database. Two things usually clear it:

• Wait for the hourly version-check job to run again.
• Reboot the host. This fixed it for some users straight away.

As long as traefik version shows the new number and your apps work, you are fine.

One security note

The default proxy file enables the Traefik dashboard (--api.dashboard=true) and publishes port 8080, while --api.insecure=false keeps the unauthenticated dashboard switched off. That is the safe default, but I still do not like an extra port open to the internet if I do not use it. Block 8080 in your cloud firewall or ufw, or remove the '8080:8080' mapping, and never set --api.insecure=true on a public server.

Quick summary

1. Back up /data/coolify/proxy/docker-compose.yml.
2. Read the Traefik migration notes.
3. Servers, Proxy, Configuration: change the image: tag and save.
4. Restart the proxy.
5. Check docker logs, the version, and your sites.
6. If the banner stays, wait for the hourly check or reboot.

Have you hit any other odd behaviour after a Traefik upgrade in Coolify? Tell me in the comments and I will add it here.

Sources: Traefik v3 migration guide, Coolify issue #11868, Coolify Traefik docs.