Add authentication (basic auth, token headers, IP allowlist) to any service
2.7K
Add authentication to any service with a single container. Supports basic auth, token headers, and IP allowlisting — with automatic HTTPS via Caddy.
Many services (dashboards, APIs, internal tools) don't have built-in auth. Instead of modifying each app, put auth-proxy in front and get instant authentication plus HTTPS.
services:
auth-proxy:
image: zachbg/auth-proxy:latest
restart: unless-stopped
ports:
- "443:443"
environment:
UPSTREAM: http://app:8080
AUTH_USER: admin
AUTH_PASSWORD: supersecret
DOMAIN: dashboard.example.com
app:
image: grafana/grafana:latest
# No ports exposed — auth-proxy handles access
| Variable | Default | Description |
|---|---|---|
UPSTREAM | required | Backend URL (e.g., http://app:8080) |
AUTH_TYPE | basic | Auth method: basic, header, none |
AUTH_USER | admin | Username for basic auth |
AUTH_PASSWORD | Password for basic auth | |
AUTH_HEADER | X-Auth-Token | Header name for header auth |
AUTH_TOKEN | Expected token value for header auth | |
LISTEN_PORT | 80 | Port to listen on |
DOMAIN | Domain for automatic HTTPS | |
TRUSTED_IPS | Space-separated trusted IP ranges |
environment:
UPSTREAM: http://app:3000
AUTH_TYPE: basic
AUTH_USER: admin
AUTH_PASSWORD: mypassword
environment:
UPSTREAM: http://api:8080
AUTH_TYPE: header
AUTH_HEADER: Authorization
AUTH_TOKEN: "Bearer my-secret-token"
environment:
UPSTREAM: http://app:3000
AUTH_USER: admin
AUTH_PASSWORD: mypassword
TRUSTED_IPS: "192.168.1.0/24 10.0.0.0/8"
environment:
UPSTREAM: http://app:3000
AUTH_TYPE: none
DOMAIN: app.example.com
Content type
Image
Digest
sha256:6a1971a30…
Size
23.4 MB
Last updated
6 months ago
docker pull zachbg/auth-proxy