feat: security-chain (authentik) on no-login services, SSO traefik dashboard

.gitignore

@@ -21,6 +21,7 @@ metube/MeTube_downloads
 uptime-kuma/data/
 termix/termix-data/*
 cfddns/config.json
+checkmk/checkmk/*
 
 # Steaming services files
 streaming/jellyfin/*
@@ -32,7 +33,8 @@ streaming/qbittorrent/*
 streaming/prowlarr/*
 
 # Homepage 
-homepage/files/assets/images/team/*
+homepages/forust_files/assets/images/team/*
+
 
 # Traefik files
 traefik/letsencrypt/acme.json

authentik/.env.example

@@ -0,0 +1,20 @@
+# ===================================
+# Authentification app (authentik)
+
+# PostgresQL conf 
+PG_PASS=change_this_cuz_its_ur_db_pass
+PG_USER=authentik # it's okay
+
+# Image Settings
+AUTHENTIK_IMAGE=ghcr.io/goauthentik/server
+AUTHENTIK_TAG=2025.10.2
+
+# Networking
+PORT_HTTP=9000
+PORT_HTTPS=9443 # btw likely already used by portainer
+
+AUTHENTIK_SECRET_KEY=super_secret_super_scary_authenik_key
+
+AUTHENTIK_BOOTSTRAP_PASSWORD=pls_change_this
+
+AUTHENTIK_ERROR_REPORTING__ENABLED=true # Or false to turn off

authentik/compose.yaml

@@ -0,0 +1,106 @@
+services:
+  postgresql:
+    image: docker.io/library/postgres:15-alpine
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${PG_DB:-authentik}
+      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
+      POSTGRES_USER: ${PG_USER:-authentik}
+    healthcheck:
+      interval: 30s
+      retries: 5
+      start_period: 20s
+      test:
+        - CMD-SHELL
+        - pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}
+      timeout: 5s
+    volumes:
+      - database:/var/lib/postgresql/data
+    networks:
+      - authentik
+
+  server:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    command: server
+    container_name: authentik-server
+    restart: unless-stopped
+    ports:
+      - ${PORT_HTTP:-9000}:9000
+      - ${PORT_HTTPS:-9443}:9443
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+      # Services
+      # - "traefik.http.services.authentik-server.loadbalancer.server.port=9443"
+      - "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
+
+      # Prod Router
+      - "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
+      - "traefik.http.routers.authentik-server.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server.service=authentik-server"
+      - "traefik.http.routers.authentik-server.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
+      - "traefik.http.routers.authentik-server-local.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-local.service=authentik-server"
+      - "traefik.http.routers.authentik-server-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
+      - "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
+      - "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.authentik-server-dev.service=authentik-server"
+      - "traefik.http.routers.authentik-server-dev.tls=true"
+    volumes:
+      - ./media:/media
+      - ./custom-templates:/templates
+    networks:
+      - traefik-proxy
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+  worker:
+    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2025.10.2}
+    restart: unless-stopped
+    user: root
+    command: worker
+    env_file:
+      - .env
+    environment:
+      AUTHENTIK_POSTGRESQL__HOST: postgresql
+      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
+      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
+      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
+      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:?secret key required}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./media:/media
+      - ./certs:/certs
+      - ./custom-templates:/templates
+    networks:
+      - authentik
+    depends_on:
+      postgresql:
+        condition: service_healthy
+volumes:
+  database:
+    driver: local
+networks:
+  authentik:
+  traefik-proxy:
+    external: true

dockmon/compose.yaml

@@ -24,7 +24,7 @@ services:
          # Prod Router
          - "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
          - "traefik.http.routers.dockmon.entrypoints=websecure"
-         - "traefik.http.routers.dockmon.middlewares=security-headers@file,dockmon-auth@file"
+         - "traefik.http.routers.dockmon.middlewares=security-chain@file"
          - "traefik.http.routers.dockmon.service=dockmon"
          - "traefik.http.routers.dockmon.tls=true"
          - "traefik.http.services.dockmon.loadbalancer.server.port=443"
@@ -41,7 +41,7 @@ services:
          # Dev Router
          - "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
          - "traefik.http.routers.dockmon-dev.entrypoints=websecure"
-         - "traefik.http.routers.dockmon-dev.middlewares=security-headers@file"
+         - "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
          - "traefik.http.routers.dockmon-dev.service=dockmon"
          - "traefik.http.routers.dockmon-dev.tls=true"
 

glance/compose.yaml

@@ -16,7 +16,7 @@ services:
       # Prod Router
       - "traefik.http.routers.glance.rule=Host(`glance.forust.xyz`)"
       - "traefik.http.routers.glance.entrypoints=websecure"
-      - "traefik.http.routers.glance.middlewares=security-headers@file"
+      - "traefik.http.routers.glance.middlewares=security-chain@file"
       - "traefik.http.routers.glance.tls=true"
 
       # Local Router
@@ -28,7 +28,7 @@ services:
       # Dev Router
       - "traefik.http.routers.glance-dev.rule=Host(`glance.gigaforust.internal`)"
       - "traefik.http.routers.glance-dev.entrypoints=websecure"
-      - "traefik.http.routers.glance-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.glance-dev.middlewares=security-chain@file"
       - "traefik.http.routers.glance-dev.tls=true"
     networks:
       - traefik-proxy

homepage/compose.yaml

@@ -1,39 +0,0 @@
-services:
-  forust-homepage:
-    build: .
-    ports:
-      - "8085:80"
-    restart: unless-stopped
-    volumes:
-      - ./files:/usr/share/nginx/html
-    networks:
-      - traefik-proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.docker.network=traefik-proxy"
-
-      # Prod Router
-      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
-      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage.tls=true"
-      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
-
-      # Local Router
-      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
-      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-local.tls=true"
-
-      # Dev Router
-      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
-      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
-      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
-      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
-      - "traefik.http.routers.forust-homepage-dev.tls=true"
-
-networks:
-  traefik-proxy:
-    external: true

homepages/Dockerfile.forust

@@ -0,0 +1,10 @@
+# everyone use that
+FROM nginx:alpine
+
+RUN rm -rf /usr/share/nginx/html/*
+
+COPY ./forust_files /usr/share/nginx/html
+
+EXPOSE 80
+# Start 
+CMD ["nginx", "-g", "daemon off;"]

homepages/Dockerfile.xdfnx

@@ -3,7 +3,7 @@ FROM nginx:alpine
 
 RUN rm -rf /usr/share/nginx/html/*
 
-COPY ./files /usr/share/nginx/html
+COPY ./xdfnx_files /usr/share/nginx/html
 
 EXPOSE 80
 # Start 

homepages/compose.yaml

@@ -0,0 +1,83 @@
+services:
+  forust:
+    build:
+      context: .
+      dockerfile: Dockerfile.forust
+    ports:
+      - "8085:80"
+    restart: unless-stopped
+    volumes:
+      - ./forust_files:/usr/share/nginx/html
+    networks:
+      - traefik-proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Services
+      - "traefik.http.services.forust-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.forust-homepage.rule=Host(`forust.xyz`)"
+      - "traefik.http.routers.forust-homepage.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.forust-homepage-local.rule=Host(`landing.workstation.internal`) || Host(`landing.internal`)"
+      - "traefik.http.routers.forust-homepage-local.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-local.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-local.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.forust-homepage-dev.rule=Host(`landing.gigaforust.internal`)"
+      - "traefik.http.routers.forust-homepage-dev.entrypoints=websecure"
+      - "traefik.http.routers.forust-homepage-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.forust-homepage-dev.service=forust-homepage"
+      - "traefik.http.routers.forust-homepage-dev.tls=true"
+
+  xdfnx:
+    build:
+      context: .
+      dockerfile: Dockerfile.xdfnx
+    ports:
+      - "8086:80"
+    restart: unless-stopped
+    volumes:
+      - ./xdfnx_files:/usr/share/nginx/html
+    networks:
+      - traefik-proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+      
+      # Services
+      - "traefik.http.services.xdfnx-homepage.loadbalancer.server.port=80"
+
+      # Prod Router
+      - "traefik.http.routers.xdfnx.rule=Host(`xdfnx.cfd`)"
+      - "traefik.http.routers.xdfnx.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx.tls=true"
+
+      # Local Router
+      - "traefik.http.routers.xdfnx-local.rule=Host(`xdfnx.workstation.internal`) || Host(`xdfnx.internal`)"
+      - "traefik.http.routers.xdfnx-local.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-local.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx-local.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx-local.tls=true"
+
+      # Dev Router
+      - "traefik.http.routers.xdfnx-dev.rule=Host(`xdfnx.gigaforust.internal`)"
+      - "traefik.http.routers.xdfnx-dev.entrypoints=websecure"
+      - "traefik.http.routers.xdfnx-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
+      - "traefik.http.routers.xdfnx-dev.tls=true"
+
+
+networks:
+  traefik-proxy:
+    external: true

metube/compose.yaml

@@ -19,7 +19,7 @@ services:
       # Prod Router
       - "traefik.http.routers.metube.rule=Host(`metube.forust.xyz`)"
       - "traefik.http.routers.metube.entrypoints=websecure"
-      - "traefik.http.routers.metube.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube.middlewares=security-chain@file"
       - "traefik.http.routers.metube.service=metube"
       - "traefik.http.routers.metube.tls=true"
       - "traefik.http.services.metube.loadbalancer.server.port=8081"
@@ -27,14 +27,14 @@ services:
       # Local Router
       - "traefik.http.routers.metube-local.rule=Host(`metube.workstation.internal`) || Host(`metube.internal`)"
       - "traefik.http.routers.metube-local.entrypoints=websecure"
-      - "traefik.http.routers.metube-local.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-local.middlewares=security-headers@file"
       - "traefik.http.routers.metube-local.service=metube"
       - "traefik.http.routers.metube-local.tls=true"
 
       # Dev Router
       - "traefik.http.routers.metube-dev.rule=Host(`metube.gigaforust.internal`)"
       - "traefik.http.routers.metube-dev.entrypoints=websecure"
-      - "traefik.http.routers.metube-dev.middlewares=security-headers@file,metube-auth@file"
+      - "traefik.http.routers.metube-dev.middlewares=security-chain@file"
       - "traefik.http.routers.metube-dev.service=metube"
       - "traefik.http.routers.metube-dev.tls=true"
 

nextcloud/compose.yaml

@@ -1,6 +1,6 @@
 services:
   nextcloud-aio-mastercontainer:
-    image: ghcr.io/nextcloud-releases/all-in-one:latest
+    image: ghcr.io/nextcloud-releases/all-in-one:beta
     init: true # This setting makes sure that signals from main process inside the container are correctly forwarded to children. See https://docs.docker.com/reference/compose-file/services/#init
     restart: unless-stopped
     container_name: nextcloud-aio-mastercontainer # Do not change
@@ -10,7 +10,6 @@ services:
     networks:
       - nextcloud-aio
       - traefik-proxy # Optional: Connects the mastercontainer to the traefik-proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md
- 
       # ports:
       # - 8081:80 # may be removed if under reverse-proxy
       # - 8443:8443 

traefik/.env.example

@@ -0,0 +1,3 @@
+# ===================================
+# Traefik envs 
+EMAIL=bobrovod@national.shitposting.agency

traefik/compose.yaml

@@ -44,24 +44,24 @@ services:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik-proxy"
 
-      # Prod Router (Dashboard) - DISABLED per user request
-      # - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
-      # - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
-      # - "traefik.http.routers.traefik-dashboard.middlewares=auth,security-headers"
-      # - "traefik.http.routers.traefik-dashboard.service=api@internal"
-      # - "traefik.http.routers.traefik-dashboard.tls=true"
+      # Prod Router (Dash)
+      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.forust.xyz`)"
+      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
+      - "traefik.http.routers.traefik-dashboard.middlewares=security-chain@file"
+      - "traefik.http.routers.traefik-dashboard.service=api@internal"
+      - "traefik.http.routers.traefik-dashboard.tls=true"
 
       # Local Router
       - "traefik.http.routers.traefik-dashboard-local.rule=Host(`traefik.workstation.internal`) || Host(`traefik.internal`)"
       - "traefik.http.routers.traefik-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-local.middlewares=auth@file,security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-local.middlewares=security-headers@file"
       - "traefik.http.routers.traefik-dashboard-local.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-local.tls=true"
 
       # Dev Router
       - "traefik.http.routers.traefik-dashboard-dev.rule=Host(`traefik.gigaforust.internal`)"
       - "traefik.http.routers.traefik-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-headers@file"
+      - "traefik.http.routers.traefik-dashboard-dev.middlewares=security-chain@file"
       - "traefik.http.routers.traefik-dashboard-dev.service=api@internal"
       - "traefik.http.routers.traefik-dashboard-dev.tls=true"
 

traefik/dynamic/middlewares.yml

@@ -10,7 +10,7 @@ http:
     metube-auth:
       basicAuth:
         users:
-          -  "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
+          - "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
 
         realm: "MeTube Access"
 
@@ -27,7 +27,7 @@ http:
         users:
           - "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
         realm: "Dockmon Access"
-    
+
     # Cloudflare IP Whitelist
     cloudflare-ipwhitelist:
       ipWhiteList:
@@ -48,6 +48,29 @@ http:
           - "172.64.0.0/13"
           - "131.0.72.0/22"
 
+    # Authentik + secure headers
+    security-chain:
+      chain:
+        middlewares:
+          - authentik@file
+          - security-headers@file
+    authentik:
+      forwardAuth:
+        address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - X-authentik-username
+          - X-authentik-groups
+          - X-authentik-email
+          - X-authentik-name
+          - X-authentik-uid
+          - X-authentik-jwt
+          - X-authentik-meta-jwks
+          - X-authentik-meta-outpost
+          - X-authentik-meta-provider
+          - X-authentik-meta-app
+          - X-authentik-meta-version
+
     # Security Headers
     security-headers:
       headers:
@@ -82,5 +105,5 @@ http:
     nextcloud-chain:
       chain:
         middlewares:
-          - nextcloud-secure-headers
-          - security-headers
+          - nextcloud-secure-headers@file
+          - security-headers@file

traefik/dynamic/tls.yml

@@ -4,7 +4,8 @@ tls:
     # Cloudflare Origin CA *.forust.xyz
     - certFile: /certs/cloudflare.pem
       keyFile: /certs/cloudflare.key
-
+    - certFile: /certs/xdfnx.pem
+      keyFile: /certs/xdfnx.key
   stores:
     default:
       defaultCertificate: