Traefik

Traefik supports forward auth through its forwardAuth middleware.

Caution

The agent ignores X-Forwarded-For / X-Forwarded-Host unless the caller’s source IP is listed in proxy.trusted_proxies. Add your Traefik host’s IP (e.g. 100.64.0.1/32 or the LAN IP it binds to) before forward auth will see real client tunnel IPs.

Dynamic configuration

Middleware definition

traefik/dynamic/atreo-auth.yml

http:
  middlewares:
    atreo-auth:
      forwardAuth:
        address: "http://100.64.0.1:9091/auth"
        authResponseHeaders:
          - "X-Auth-User"
          - "X-Auth-Member-ID"
          - "X-Auth-Role"

Router and service

traefik/dynamic/jellyfin.yml

http:
  routers:
    jellyfin:
      rule: "Host(`jellyfin.alice.atreo.link`)"
      middlewares:
        - atreo-auth
      service: jellyfin
      entryPoints:
        - websecure

  services:
    jellyfin:
      loadBalancer:
        servers:
          - url: "http://localhost:8096"

Docker labels

If you manage Traefik with Docker labels:

services:
  jellyfin:
    image: jellyfin/jellyfin
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.rule=Host(`jellyfin.alice.atreo.link`)"
      - "traefik.http.routers.jellyfin.middlewares=atreo-auth"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"

Note

Make sure Traefik is listening on the WireGuard tunnel IP (100.64.0.1) or on the host network.

Entrypoint binding

To restrict Traefik to the tunnel interface:

traefik/traefik.yml

entryPoints:
  websecure:
    address: "100.64.0.1:443"

TLS certificates

The agent obtains and renews wildcard TLS certificates automatically. Each served suffix has its own subdirectory under certs/:

./agent-data/certs/<your-subdomain>.atreo.link/fullchain.pem
./agent-data/certs/<your-subdomain>.atreo.link/privkey.pem

If you’ve attached a custom domain, its cert lives in a sibling subdirectory keyed on the parent zone (e.g. ./agent-data/certs/home.example.com/).

Bind-mount the agent’s certs/ directory into your Traefik container read-only:

volumes:
  - /path/to/agent-data/certs:/atreo-certs:ro

(Use the absolute path if your Traefik compose file lives outside the agent’s directory.)

Reference each suffix from a file-based TLS provider, listing one entry per suffix you want Traefik to serve:

traefik/dynamic/tls.yml

tls:
  certificates:
    - certFile: /atreo-certs/alice.atreo.link/fullchain.pem
      keyFile: /atreo-certs/alice.atreo.link/privkey.pem

The agent renews them in the background; Traefik’s file provider hot-reloads when files change.