docker-compose.yml

---
version: "3"

# example docker-compose to demonstrate how to use trauth.
# there are two implementation examples here. a global and local sso setup.
# the credentials in both cases are admin:password
# for an mTLS example, check out the .dev docker-compose file.

services:
  traefik:
    image: traefik
    command:
      - --api.dashboard=true
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --entryPoints.web.address=:80
      - --experimental.plugins.trauth.modulename=github.com/leonjza/trauth
      - --experimental.plugins.trauth.version=v1.5.0 # or whatever the latest version is
    labels:
      traefik.enable: true
      traefik.http.routers.dashboard.entrypoints: web
      traefik.http.routers.dashboard.rule: Host(`traefik.dev.local`)
      traefik.http.routers.dashboard.service: api@internal
      # configure trauth globally, and reuse the middelware on multiple services
      traefik.http.middlewares.global-sso.plugin.trauth.domain: dev.local
      traefik.http.middlewares.global-sso.plugin.trauth.cookiename: global-sso-cookie
      # see notes about cookiekey's in the documentation.
      traefik.http.middlewares.global-sso.plugin.trauth.cookiekey: 97zh8jwic74b5jcxc09nnxroewfzvn3p
      traefik.http.middlewares.global-sso.plugin.trauth.usersfile: /htpass
    ports:
      - 80:80
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./example-htpass:/htpass

  whoami-1:
    image: traefik/whoami
    depends_on:
      - traefik
    labels:
      traefik.enable: true
      traefik.http.routers.whoami-1.rule: Host(`whoami-1.dev.local`)
      traefik.http.routers.whoami-1.entrypoints: web
      # or, configure a service specific instance of trauth
      traefik.http.routers.whoami-1.middlewares: local-sso
      traefik.http.middlewares.local-sso.plugin.trauth.domain: whoami-1.dev.local
      traefik.http.middlewares.local-sso.plugin.trauth.cookiename: sso-cookie
      # *note* the double $$ here to escape a single $
      traefik.http.middlewares.local-sso.plugin.trauth.users: admin:$$2y$$05$$fVvJElbTaB/Cw9FevNc2keGo6sMRhY2e55..U.6zOsca3rQuuAU1e
      # skip authentication for this service matching the domain and the /test/* or /another-test/* paths
      "traefik.http.middlewares.local-sso.plugin.trauth.rules[0].domain": whoami-1.dev.local
      "traefik.http.middlewares.local-sso.plugin.trauth.rules[0].excludes[0].exclude": ^/test/.*$
      "traefik.http.middlewares.local-sso.plugin.trauth.rules[0].excludes[1].exclude": ^/another-test/.*$

  whoami-2:
    image: traefik/whoami
    depends_on:
      - traefik
    labels:
      traefik.enable: true
      traefik.http.routers.whoami-2.rule: Host(`whoami-2.dev.local`)
      traefik.http.routers.whoami-2.entrypoints: web
      traefik.http.routers.whoami-2.middlewares: global-sso