me
e7e40439eb
- traefik.yml/dynamic/* copied from /etc/dokploy/traefik (acme.json gitignored — stays on host) - compose.yaml: same image/binds/ports as dokploy-traefik, joins dokploy-network + komodo - dynamic/komodo.yml: komodo.paginica.com router (inactive until cutover)
94 lines
3.1 KiB
YAML
94 lines
3.1 KiB
YAML
# Traefik dynamic config — forward auth via authentik embedded outpost.
|
|
# Deploy to: /etc/dokploy/traefik/dynamic/authentik-forwardauth.yml
|
|
# All objects carry the `ak-` prefix; this file is never managed by Dokploy.
|
|
#
|
|
# Bypass model: the gated Host router (managed by Dokploy domain middlewares)
|
|
# covers UI paths only. More-specific rules win automatically:
|
|
# Host + PathPrefix(`/outpost.goauthentik.io`) -> outpost (auth callbacks)
|
|
# Host + PathPrefix(`/api`) -> app API (CLI/SDK/agents/UI fetches)
|
|
http:
|
|
services:
|
|
ak-authentik:
|
|
loadBalancer:
|
|
servers:
|
|
- url: http://authentik-server:9000
|
|
passHostHeader: true
|
|
ak-dokploy:
|
|
loadBalancer:
|
|
servers:
|
|
- url: http://dokploy:3000
|
|
passHostHeader: true
|
|
ak-infisical:
|
|
loadBalancer:
|
|
servers:
|
|
- url: http://infisical:8080
|
|
passHostHeader: true
|
|
|
|
middlewares:
|
|
ak-fw:
|
|
forwardAuth:
|
|
# embedded outpost reachable internally — no Cloudflare roundtrip
|
|
address: http://authentik-server:9000/outpost.goauthentik.io/auth/traefik
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- X-authentik-username
|
|
- X-authentik-groups
|
|
- X-authentik-email
|
|
- X-authentik-name
|
|
- X-authentik-uid
|
|
- X-authentik-jwt
|
|
- X-authentik-meta-jwks
|
|
- X-authentik-meta-outpost
|
|
- X-authentik-meta-provider
|
|
- X-authentik-meta-app
|
|
- X-authentik-meta-version
|
|
ak-fw-errors:
|
|
# turns the outpost 401 into its login redirect for browsers;
|
|
# machine paths bypass via dedicated routers and never see this
|
|
errors:
|
|
status: ["401-403"]
|
|
service: ak-authentik
|
|
query: /outpost.goauthentik.io/start?rd={url}
|
|
|
|
routers:
|
|
# Outpost endpoints on each gated host (forward_single mode needs these
|
|
# public: start/callback/sign_out live on the application domain).
|
|
ak-infisical-outpost:
|
|
rule: Host(`infisical.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
|
|
service: ak-authentik
|
|
entryPoints: [websecure]
|
|
tls:
|
|
certResolver: letsencrypt
|
|
priority: 1000
|
|
ak-panel-outpost:
|
|
rule: Host(`panel.paginica.com`) && PathPrefix(`/outpost.goauthentik.io`)
|
|
service: ak-authentik
|
|
entryPoints: [websecure]
|
|
tls:
|
|
certResolver: letsencrypt
|
|
priority: 1000
|
|
|
|
|
|
|
|
# Infisical API bypass — UI fetches, CLI, SDK, agentes y syncs usan /api
|
|
# con tokens propios de Infisical; gated /api romperia el propio web vault.
|
|
ak-infisical-api:
|
|
rule: Host(`infisical.paginica.com`) && PathPrefix(`/api`)
|
|
service: ak-infisical
|
|
entryPoints: [websecure]
|
|
tls:
|
|
certResolver: letsencrypt
|
|
priority: 900
|
|
|
|
# Panel API bypass — keeps /api (tRPC, better-auth, deploy webhooks)
|
|
# outside the auth gate. Higher priority than the gated root router.
|
|
ak-panel-api:
|
|
rule: Host(`panel.paginica.com`) && PathPrefix(`/api`)
|
|
service: ak-dokploy
|
|
entryPoints: [websecure]
|
|
tls:
|
|
certResolver: letsencrypt
|
|
priority: 900
|
|
|
|
|