brightopia/trauth repository overview

⁠trauth

A simple ForwardAuth⁠ service for Traefik.

Unlike other ForwardAuth projects that enable neat OpenID / OAuth flows, trauth reads a simple htpasswd file as a credentials database, prompting via HTTP basic auth. This is perfect for private, isolated services served using Traefik needing a simple SSO solution.

⁠usage

An example docker-compose.yml is included to show how to get it up and running. It assumes that htpass is mounted externally.

Of course, you could compile from source or download from the releases⁠ page and run outside of docker too.

⁠setup

Depending on your setup, a few environment variables must be configured. For a docker-compose setup you would need TRAUTH_DOMAIN and TRAUTH_PASSWORD_FILE_LOCATION at the very least.

environment:
    - TRAUTH_DOMAIN=yourdomain.local
    - TRAUTH_PASSWORD_FILE_LOCATION=/config/htpass

Other variables also exist. Those are:

• TRAUTH_SERVER_PORT - The port the server should listen on. (Defaults to 8080)
• TRAUTH_DOMAIN - The domain trauth should set the sso cookie for. This is usually scoped for the parent domain.
• TRAUTH_COOKIE_PATH - The path used for the sso cookie. (Defaults to /)
• TRAUTH_COOKIE_NAME - The name of the sso cookie. (Defaults to trauth)
• TRAUTH_PASSWORD_FILE_LOCATION - The location for the htpasswd file. (Defaults to ./htpass)

⁠enabling for Traefik web services

To use it in Traefik you need to define a new middleware telling Traefik where the auth server is. For example:

- "traefik.http.middlewares.trauth.forwardauth.address=http://trauth.web:8080/"

Next, you simply need to add the middleware label to web services that should make use of it. For example:

- "traefik.http.routers.netdata.middlewares=trauth"

⁠adding users

trauth uses a basic Apache htpasswd file. For detailed usage of htpasswd, please see this⁠ guide.

To add a new user in a new htpass file, using the Bcrypt hashing algorithm, run:

htpasswd -Bc htpass username1

To add a new user to an existing htpass file, run:

htpasswd -B htpass username2