---
title: "proxy"
summary: "Who owns the ingress proxy, which image runs it, and how TLS is resolved."
status: shipped
generated: true
read_when:
  - "Taking over the Traefik configuration, or turning routing off entirely"
---

This page is generated from the same Go declarations the loader enforces, so it
cannot drift from what `ob validate` accepts.

## Fields on this page

`config` · `dnsChallenge` · `entrypoints` · `image` · `kind` · `managed` · `network` · `port` · `provider` · `resolvers`

## Reference

| Field | Type | Default | What it does |
| --- | --- | --- | --- |
| `config` | string | — | Repository-relative proxy configuration directory. Dynamic YAML or TOML files extend Onebox's managed configuration. A managed DNS challenge may use a directory containing only .env for provider credentials. Including traefik.yml or traefik.yaml instead takes ownership of the static configuration, which must use the watched file-provider directory /etc/traefik/dynamic, must not enable the Docker provider, must define certificatesResolvers.letsencrypt for exact terminating routes, and must define the DNS-01 certificatesResolvers.onebox-wildcard for wildcard terminating routes. Dynamic files may not reuse Onebox-generated router or service names or redefine the managed onebox-compress middleware. Expects a path inside the repository, with no control character or shell metacharacter. |
| `dnsChallenge` | object | — | Managed ACME DNS-01 challenge used to issue wildcard certificates. Provider credentials belong in proxy.config/.env; Onebox continues to own the static proxy configuration. |
| `dnsChallenge.provider` `*` | string | — | Traefik DNS challenge provider name. Its credential variables must be supplied through proxy.config/.env. Expects a lower-case Traefik DNS provider name such as cloudflare or route53. |
| `dnsChallenge.resolvers` | list | — | DNS resolvers used to verify challenge propagation, written as host:port. |
| `entrypoints` | map | — | Additional named TCP listeners published by the managed proxy. Onebox adds them to its generated static configuration; a proxy.config containing custom traefik.yml or traefik.yaml must define matching Traefik entrypoints. |
| `entrypoints.<name>.port` | integer | — | Host and proxy-container TCP port used by this listener. |
| `image` | string | — | Container image used for the managed proxy. Expects a registry reference such as nginx:1.27 or ghcr.io/acme/app@sha256:…. |
| `kind` | `TraefikDocker` · `None` | `TraefikDocker` | Proxy implementation, or none to disable routing. |
| `managed` | boolean | — | Let Onebox converge the host-scoped proxy when routes are declared. |
| `network` | string | `onebox-ingress` | External container network shared with routed workloads; default and Onebox's derived application and service network names are reserved. |

`*` marks a field that is required within its own object.