Rollout validates first, then pushes to all workers. Rollback reverts to the previous revision.
Monitor
Per-VIP traffic + per-route upstream health (all users). Node & mgmt system metrics are admin-only.
Traffic
→
VIPs
VIP
Zone
Address
Requests
Routes healthy
Routes
Route
Host
VIP(s)
Upstreams
Upstream health
Cluster nodes
Node
Role
Status
CPU
Memory
Disk
Load
Uptime
Caddy
Reporting
Connections and data used over a period, grouped by VIP, route, or route owner.
Export (current range):
VIP
Connections
Data used
Scheduled reports
Automated usage reports emailed on a schedule (branded HTML summary + CSV attachment) via the SMTP relay (see Alerts). The default is a monthly report on the 1st at 01:30 for the previous calendar month.
Name
Recipients
Group
Period
Runs
Enabled
Last run
Add scheduled report
Route client IPs
Every client IP that accessed a route over the selected period, with request count and data transferred. Real internet source IPs (the edge firewall DNATs without SNAT). Top talkers first.
Client IP
Requests
Data transferred
WAF detections
OWASP CRS / Coraza rule matches across every VIP — blocked (enforced 403) and detected (would-block, logged only). Persisted and filterable; newest first. Click a row for the matched rules, or Whitelist to suppress a false-positive rule at route/VIP/global scope.
Active WAF exclusions (0) — whitelisted rules
Rule
Scope
Target
Note
By
Removing an exclusion re-enables the rule. Add/remove needs a rollout to apply.
Time
Action
Severity
VIP
Route
Client IP
Method
URI
Rule
Listeners (VIPs)
A VIP is a virtual server bound to an interface/VLAN with its own TLS, WAF and bandwidth policy.
Name
Zone
Iface
VLAN
VIP
Ports
VRID
TLS
WAF
BW default
Routes
A route maps a host to upstreams under a VIP, with an optional SSO gate and bandwidth cap.
ID
Listener
Host
Upstreams
Bandwidth
SSO
Mode
Worker nodes
The SSH secret is used once for bootstrap and never stored — the node then authenticates with an mTLS identity issued by the manager.
Name
Mgmt addr
Kind
State
Labels
VIP roles
Applied
Rolling: one node at a time, drained → apt → reboot → rejoin. N-1 always serving; halts on failure.
Worker placement
Location labels
Comma-separated admin tags (e.g. homeoffice, customer). A VIP can target workers by label.
VIP roles on this worker
Check a managed VIP to have this worker carry it. Unchecking an all-workers VIP pins it to the remaining workers. Inline & label-derived VIPs are shown read-only.
Certificates
Live TLS certificates served for each HTTPS host (probed from the workers). Admins can force a reissue and view ACME logs; members see only certs for the routes/VIPs they manage.
Renewal is automatic (Let's Encrypt, ~60 days before expiry). Force-renew only if a cert is stuck.
Host
VIP
Issuer
Expires
Days left
Status
Validation methods
How Let's Encrypt validates each domain. The built-in default (deSEC dns-01) covers our own domains; add a method to issue for a customer's domain with their own DNS token (dns-01) or via HTTP (http-01, no credentials — they just point an A record at us). Most-specific domain wins.
Name
Type
Provider
Domains
Enabled
Add validation method
ACME / TLS activity
Tenant SSO providers
These OIDC providers authenticate end users of proxy hosts — a separate identity plane from management sign-in. Each customer tenant registers their own IdP here. The client secret is stored server-side and never shown again.
ID
Tenant
Name
Issuer
Client ID
Secret
Users
SSO accounts are auto-provisioned from single-sign-through (role from BIFROST_ADMIN_USERS). Internal accounts are created below with a password and sign in directly — for operators without SSO. Assign either to access groups on the Groups tab.
A welcome email is sent on creation when an email is set and SMTP is configured (see Alerts). Editing an existing user with a blank password keeps the current one.
User
Role
Groups
Source
First seen
Last sign-in
Access groups
Local RBAC groups. Add usernames (local or SSO) as members, then assign groups to VIPs/routes — a member sees and can edit only the VIPs/routes in a group they belong to. Assign multiple groups to a VIP/route so several teams can co-manage it.
ID
Name
Members
Error pages
Custom HTML pages. Assign one to a route as its WAF-block (403) page, or to a VIP as its 404 page. Unassigned routes/VIPs use the Bifrost-branded defaults. Roll out to apply.
Name
ID
Type
Used by
Add block page
HTML — served verbatim on a 403. {http.request.uuid} is replaced with a support reference.
Live preview
Header policies
Named sets of response headers — CSP, HSTS, common security headers, plus any custom headers. Assign one to a route (Header policy field) or to a VIP (applies to all its routes unless a route overrides). Roll out to apply.
Name
ID
Headers
Used by
Add header policy
Configuration history
Every configuration change — VIPs, routes, SSO providers, nodes, and each rollout/rollback — attributed to the user who made it. Newest first. Persisted across manager restarts.
Time
User
Action
Detail
Revision
Alerts
Email alerts routed by scope — the whole server (admin), a VIP, or a route — so each alert reaches the right destination. Sent via the SMTP relay (PMG on :26).
SMTP relay
Alert rules
Each rule emails its destination when a matching event fires within its scope.
Name
Scope
Target
Email
Events
Threshold
On
Settings
Instance-wide settings, independent of any specific VIP, route or node.
Branding
Replace the ◆ Bifrost mark shown in the header, login and PDF exports. Leave unset for the default. Max 512 KB each; PNG/SVG recommended.
Logo
—
Favicon
—
Add VIP
Worker placement — which workers carry this VIP. No workers checked and no labels = every worker (default).
Workers
Labels (any-match)
Ctrl/⌘-click
Active member (VRRP master)
Others stay backups (failover). Auto = spread.
VRID (keepalived failover id) is auto-assigned — the next free id on the VLAN. Interface & VLAN prefill from the zone.
Add Route
SSO gates the host behind a tenant provider (empty allow-lists = any authenticated user). L4 passthrough streams TLS by SNI without termination. WAF override sets this route's Coraza posture independently of the VIP (e.g. detection for a print service while the VIP stays blocking); leave as “inherit” to follow the VIP.
Raw config
Custom handlers — a JSON array of Caddy HTTP handlers, spliced into this route just before the reverse proxy. Empty = none.
How to use
This is Caddy's native JSON handler format. Each entry is one handler object; they run in order, then the built-in reverse proxy. Use it for analytics/tracking headers (Matomo), extra security headers, redirects, or rewrites.
Invalid JSON is rejected here. A handler Caddy can't load fails validation on rollout and is rolled back automatically — the route keeps its last good config. See the Caddy JSON docs (caddyserver.com/docs/json) for all handlers.
Whitelist a WAF rule
Rule to whitelist
Scope
Source IP (optional)
Leave off to whitelist for everyone. On = the rule is suppressed only for this IP/CIDR (a conditional rule).
Removes the selected CRS rule at the chosen scope (SecRuleRemoveById, or a source-IP-conditional rule). Prefer the specific attack rule over the “Anomaly Score” meta-rule. Roll out to apply.