Protect with Authentik

Traefik's forwardAuth middleware can send each request to an Authentik proxy provider before it reaches an application. Authentik handles sign-in and returns identity headers to Traefik after successful authentication.

Use this guide when Authentik and the protected resource can communicate over a shared Docker network on the same Coolify server.

Configure Authentik

Deploy the Authentik service, then follow Authentik's forward authentication documentation to:

1. Create a proxy provider that uses forward authentication.
2. Create an Authentik application and attach the proxy provider.
3. Set the provider's cookie domain to the parent domain shared by the protected services when you want single sign-on across subdomains.
4. Add the protected domain to Authentik's application or provider configuration.

Make sure the Authentik server container and protected resource share a Docker network that Traefik can use to reach Authentik.

Create the Traefik middleware

Find the Authentik server container or service name on the shared network. In the example below it is authentik-server and listens on port 9000.

Open Servers > your server > Proxy > Dynamic Configurations and create authentik-forward-auth.yaml:

http:
  middlewares:
    authentik-forward-auth:
      forwardAuth:
        address: 'http://authentik-server:9000/outpost.goauthentik.io/auth/traefik'
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-entitlements
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

Replace authentik-server with the actual internal hostname. Do not use the public Authentik URL unless the proxy cannot reach Authentik privately and you intentionally want the external traffic path.

Attach the middleware

traefik.http.routers.https-0-<resource-id>.middlewares=gzip 
traefik.http.routers.https-0-<resource-id>.middlewares=gzip,authentik-forward-auth@file 

Verify authentication

Open the protected domain in a private browser window. Traefik should redirect you to Authentik, then return you to the application after sign-in.

Troubleshooting