{"id":40037794,"url":"https://github.com/le0developer/traefik-forwardauth-authentik-proxy","last_synced_at":"2026-01-19T05:01:16.806Z","repository":{"id":328530045,"uuid":"1115837307","full_name":"Le0Developer/traefik-forwardauth-authentik-proxy","owner":"Le0Developer","description":null,"archived":false,"fork":false,"pushed_at":"2025-12-30T14:19:47.000Z","size":47,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-01-02T00:40:37.522Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Le0Developer.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-13T16:50:27.000Z","updated_at":"2025-12-30T14:19:39.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Le0Developer/traefik-forwardauth-authentik-proxy","commit_stats":null,"previous_names":["le0developer/traefik-forwardauth-authentik-proxy"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/Le0Developer/traefik-forwardauth-authentik-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Le0Developer%2Ftraefik-forwardauth-authentik-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Le0Developer%2Ftraefik-forwardauth-authentik-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Le0Developer%2Ftraefik-forwardauth-authentik-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Le0Developer%2Ftraefik-forwardauth-authentik-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Le0Developer","download_url":"https://codeload.github.com/Le0Developer/traefik-forwardauth-authentik-proxy/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Le0Developer%2Ftraefik-forwardauth-authentik-proxy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28561842,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-19T03:31:16.861Z","status":"ssl_error","status_checked_at":"2026-01-19T03:31:15.069Z","response_time":67,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-19T05:01:12.626Z","updated_at":"2026-01-19T05:01:16.784Z","avatar_url":"https://github.com/Le0Developer.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# traefik-forwardauth-authentik-proxy\n\n\u003e [!CAUTION]\n\u003e\n\u003e I am still testing this project. Use at your own risk.\n\nThis is a proxy bridging traefik and authentik. Authentik only supports two\nforwardauth modes: Single application and domain level.\n\nThis implement a 3rd option built on Single application, Delegated applications.\n\nAssume the following setup:\n\n- `authentik.example.com` - Authentik instance\n- `access.example.com` - Instance of this project\n- `*.example.com` - A bunch of internal services which require authorization\n\nA user wants to authenticate to `admin.example.com`, which is restricted to the\n`admin`-Authentik Usergroup. We also have `plausible.example.com` which every\nuser can access.\n\nThis is impossible with the Domain level mode. The single application mode would\nrequire two individual providers, two proxy instances, two middleware\nconfigurations etc.\n\nThis project exists to bridge that gap and avoid having to N-providers/proxy\ninstances/middleware configurations (where N is the number of services).\n\n## Using\n\n### Deploy the proxy\n\nDeploy an instance of this proxy behind traefik, with forwardauth pointing to\nit.\n\n```yml\nservices:\n  traefik-forwardauth-authentik-proxy:\n    image: ghcr.io/le0developer/traefik-forwardauth-authentik-proxy:latest\n    environment:\n      ACCESS_BASE_URL: https://access.example.com\n      AUTHENTIK_BASE_URL: https://authentik.example.com\n      AUTHENTIK_CLIENT_ID: \u003cforwardauth-client-id\u003e\n      AUTHENTIK_CLIENT_SECRET: \u003cforwardauth-client-secret\u003e\n      # if you have a backchannel to authentik (e.g. internal network, same machine, etc)\n      # AUTHENTIK_BACKCHANNEL_URL: http://authentik:9000\n    networks:\n      - proxy\n    volumes:\n      - /etc/ssl/certs/:/etc/ssl/certs/:ro\n    labels:\n      traefik.enable: true\n      traefik.http.routers.traefik-forwardauth-authentik-proxy.rule:\n        Host(`access.example.com`) ||\n        PathPrefix(`/.well-known/traefik-forwardauth-authentik-proxy/`)\n      traefik.http.routers.traefik-forwardauth-authentik-proxy.priority: 1000000\n      traefik.http.services.traefik-forwardauth-authentik-proxy.loadbalancer.server.port: 8080\n      traefik.http.middlewares.auth.forwardauth.address: http://traefik-forwardauth-authentik-proxy:8080/verify\n      traefik.http.middlewares.auth.forwardauth.trustForwardHeader: true\n      traefik.http.middlewares.auth.forwardauth.authResponseHeaders: X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid\n\n      traefik.http.middlewares.auth-owner.headers.customRequestHeaders.X-authentik-expected-groups: owner\n    restart: unless-stopped\n```\n\n### Use the middleware in your services\n\nNow, in your services, you can use the forwardauth middleware pointing to the\nproxy, and set the expected groups per service.\n\n```yml\nservices:\n  admin-service:\n    image: admin-service:latest\n    networks:\n      - proxy\n    labels:\n      traefik.enable: true\n      traefik.http.routers.admin-service.rule: Host(`admin.example.com`)\n      # The request header middleware for the expected groups must be used first\n      traefik.http.routers.admin-service.middlewares: auth-owner,auth\n    restart: unless-stopped\n\n  plausible-service:\n    image: plausible-service:latest\n    networks:\n      - proxy\n    labels:\n      traefik.enable: true\n      traefik.http.routers.plausible-service.rule: Host(`plausible.example.com`)\n      traefik.http.routers.plausible-service.middlewares: auth\n    restart: unless-stopped\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fle0developer%2Ftraefik-forwardauth-authentik-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fle0developer%2Ftraefik-forwardauth-authentik-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fle0developer%2Ftraefik-forwardauth-authentik-proxy/lists"}