Explore oidc auth plugin

services/traefik/compose.local.yml

@@ -11,6 +11,23 @@ services:
       - 'traefik.http.routers.whoami.rule=Host("whoami.${HOME_SERVER_CNAME}")'    # Set the rule to reverse proxy here
       - "traefik.http.services.whoami-websecure.loadbalancer.server.port=80"
       - 'traefik.docker.network=whoami'
+
+      # Validating a middleware.
+      - "traefik.http.middlewares.whoami-custom-headers.headers.customrequestheaders.Cross-Origin-Resource-Policy=cross-origin"
+      - "traefik.http.middlewares.whoami-custom-headers.headers.customrequestheaders.Cross-Origin-Embedder-Policy=require-corp"
+
+      # Setting the OIDC
+      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.loglevel=debug'
+      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.callbackuri=https://whoami.${HOME_SERVER_BASE_URL}'
+      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.sessioncookie.domain=.${HOME_SERVER_BASE_URL}'  # prevents redirect
+      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.scopes=openid,profile,email,groups'
+      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.url=http://pocket-id:1411"
+      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.usepkce=false"
+      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.secret=MLFs4TT99kOOq8h3UAVRtYoCTDYXiRcZ" # From the examples to try things out
+      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.clientid=FILLMEOUT"
+      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.clientsecret=FILLMEOUT"
+      # Assigning the list
+      - 'traefik.http.routers.whoami.middlewares=whoami-oidc-auth,whoami-custom-headers'
     networks:
       - whoami
 networks:

services/traefik/compose.yml

@@ -24,8 +24,12 @@ services:
       - no-new-privileges:true
     depends_on:
       - socket-proxy
+    env_file:
+      - "${HOME_SERVER_SECRETS_DIR}/traefik/traefik.env"
+    extra_hosts:
+      - "localhost:172.17.0.1" # To make OIDC discovery work correctly
     command:
-      - "--log.level=ERROR"
+      - "--log.level=DEBUG"
 
       # Providers
       - "--providers.docker=true"
@@ -53,6 +57,11 @@ services:
       - "--certificatesresolvers.default.acme.dnschallenge=true"
       - "--certificatesresolvers.default.acme.dnschallenge.provider=cloudflare"
       - "--certificatesresolvers.default.acme.storage=/data/letsencrypt/acme.json"
+
+      # Proxy for the services that do not support OIDC
+      - "--experimental.plugins.traefik-oidc-auth.moduleName=github.com/sevensolutions/traefik-oidc-auth"
+      - "--experimental.plugins.traefik-oidc-auth.version=v0.13.0"
+
       # TODO:
       # - Secure headers: https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/headers/
       # - IP Allowlist headers (likely not required atm): ...

services/traefik/traefik.example.env

@@ -1 +1,3 @@
-TRAEFIK_CERTIFICATESRESOLVERS_default_ACME_EMAIL=some-email
+TRAEFIK_OIDC_AUTH_SECRET=MLFs4TT99kOOq8h3UAVRtYoCTDYXiRcZ # From the example
+TRAEFIK_OIDC_AUTH_CLIENT_ID=...
+TRAEFIK_OIDC_AUTH_CLIENT_SECRET=...