A simple service that provides authentication and SSO with OAuth2, OpenID Connect, and Tailscale Whois, for the Traefik reverse proxy.
- Supports authentication with Google, Microsoft Entra ID (formerly Azure AD), GitHub, and generic OpenID Connect providers (including Auth0, Okta, etc).
- Single Sign-On with Tailscale Whois (similarly to Tailscale's nginx-auth)
- Protect multiple Traefik services with a single instance of traefik-forward-auth.
The Docker image is available on GitHub Packages. Container images are multi-arch and run on linux/amd64, linux/arm64, and linux/arm/v7.
Using the 4 tag is recommended:
ghcr.io/italypaleale/traefik-forward-auth:4
You can also pin to the latest patch release as found in the Releases page:
ghcr.io/italypaleale/traefik-forward-auth:4.x.x
The documentation is available at https://traefik-forward-auth.italypaleale.me.
- Quickstart
- Configuration
- All configuration options
- Authentication portals
- Supported providers
- Authorization conditions
- Advanced configuration
- Endpoints
Migrating from a previous version of Traefik Forward Auth: