---
title: "proxy"
summary: "Who owns the ingress proxy, which image runs it, and how TLS is resolved."
status: shipped
generated: true
read_when:
  - "Taking over the Traefik configuration, or turning routing off entirely"
---

This page is generated from the same Go declarations the loader enforces, so it
cannot drift from what `ob validate` accepts.

## Fields on this page

`cert_resolver` · `config` · `image` · `kind` · `managed` · `network`

## Reference

| Field | Type | Default | What it does |
| --- | --- | --- | --- |
| `cert_resolver` | string | — | Traefik certificate resolver used by terminating TLS routes. |
| `config` | string | — | Repository-relative static proxy configuration directory owned by the project; it must contain exactly one of traefik.yml or traefik.yaml. Expects a path inside the repository, with no control character or shell metacharacter. |
| `image` | string | — | Container image used for the managed proxy. Expects a registry reference such as nginx:1.27 or ghcr.io/acme/app@sha256:…. |
| `kind` | `traefik-docker` · `none` | `traefik-docker` | Proxy implementation, or none to disable routing. |
| `managed` | boolean | — | Let Onebox converge the host-scoped proxy when routes are declared. |
| `network` | string | `ob-ingress` | External container network shared with routed workloads. |