auto backup 2026-03-25_13:03:04

02_traefik/compose.yaml

@@ -13,14 +13,40 @@ services:
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
 
+      # ✅ Cloudflare DNS challenge
       - --certificatesresolvers.cloudflare.acme.dnschallenge=true
       - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
       - --certificatesresolvers.cloudflare.acme.email=${ADM_EMAIL}
       - --certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json
 
+      # ✅ Trust Cloudflare
       - --entrypoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22
       - --entrypoints.websecure.forwardedHeaders.insecure=true
- 
+
+    labels:
+      - traefik.enable=true
+
+      # =========================
+      # 🔐 AUTHENTIK FORWARD AUTH
+      # =========================
+      - traefik.http.middlewares.authentik.forwardauth.address=http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
+      - traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true
+      - traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
+
+      # =========================
+      # 🏠 LOCAL BYPASS (optionnel)
+      # =========================
+      - traefik.http.middlewares.local-ipwhitelist.ipwhitelist.sourcerange=10.0.0.0/8,192.168.0.0/16
+
+      # =========================
+      # 🔗 GLOBAL CHAIN
+      # =========================
+      # 👉 AVEC bypass LAN :
+      - traefik.http.middlewares.chain-auth.chain.middlewares=local-ipwhitelist,authentik
+
+      # 👉 SI tu veux FORCER auth partout (sans bypass LAN) :
+      # - traefik.http.middlewares.chain-auth.chain.middlewares=authentik
+
     ports:
       - 80:80
       - 443:443