migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,26 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: << resource_name >>
+  namespace: << namespace >>
+spec:
+  forwardAuth:
+    address: "<< address >>"
+    trustForwardHeader: << trust_forward_header | lower >>
+<%- if auth_response_headers_enabled %>
+    authResponseHeaders:
+<%- for header in auth_response_headers.split(',') %>
+      - << header.strip() >>
+<%- endfor %>
+<%- endif %>
+<%- if auth_request_headers_enabled %>
+    authRequestHeaders:
+<%- for header in auth_request_headers.split(',') %>
+      - << header.strip() >>
+<%- endfor %>
+<%- endif %>
+<%- if tls_insecure_skip_verify %>
+    tls:
+      insecureSkipVerify: true
+<%- endif %>
@@ -0,0 +1,116 @@
+{
+  "slug": "traefik-forwardauth-middleware",
+  "kind": "kubernetes",
+  "metadata": {
+    "name": "Traefik ForwardAuth Middleware",
+    "description": "Traefik Middleware CRD for delegating request authentication to an external forward-auth endpoint such as Authentik, Authelia, or a custom identity proxy.",
+    "tags": [],
+    "icon": {
+      "provider": "selfhst",
+      "id": "traefik"
+    },
+    "draft": true,
+    "version": {
+      "name": "3.5.3",
+      "source_dep_name": "manual/traefik-forwardauth-middleware"
+    }
+  },
+  "variables": [
+    {
+      "title": "General",
+      "name": "general",
+      "items": [
+        {
+          "name": "resource_name",
+          "type": "str",
+          "title": "Middleware name",
+          "required": false,
+          "default": "forwardauth",
+          "config": {
+            "placeholder": "forwardauth"
+          }
+        },
+        {
+          "name": "namespace",
+          "type": "str",
+          "title": "Namespace",
+          "required": false,
+          "default": "default",
+          "config": {
+            "placeholder": "default"
+          }
+        }
+      ]
+    },
+    {
+      "title": "ForwardAuth",
+      "name": "forwardauth",
+      "items": [
+        {
+          "name": "address",
+          "type": "str",
+          "title": "ForwardAuth address",
+          "required": true,
+          "description": "HTTP or HTTPS endpoint Traefik should call for authentication decisions.",
+          "config": {
+            "placeholder": "https://auth.example.com/outpost.goauthentik.io/auth/traefik"
+          }
+        },
+        {
+          "name": "trust_forward_header",
+          "type": "bool",
+          "title": "Trust forwarded headers",
+          "required": false,
+          "default": true,
+          "description": "Trust X-Forwarded-* headers sent by the previous hop."
+        },
+        {
+          "name": "auth_response_headers_enabled",
+          "type": "bool",
+          "title": "Auth response headers",
+          "required": false,
+          "default": true,
+          "description": "Forward selected headers from the auth response to the upstream service."
+        },
+        {
+          "name": "auth_response_headers",
+          "type": "str",
+          "title": "Auth response headers list",
+          "required": false,
+          "default": "X-authentik-username,X-authentik-groups,X-authentik-email",
+          "description": "Comma-separated list of response headers Traefik should pass to the upstream service.",
+          "config": {
+            "placeholder": "X-authentik-username,X-authentik-groups,X-authentik-email"
+          }
+        },
+        {
+          "name": "auth_request_headers_enabled",
+          "type": "bool",
+          "title": "Auth request headers",
+          "required": false,
+          "default": false,
+          "description": "Restrict which request headers Traefik forwards to the auth service."
+        },
+        {
+          "name": "auth_request_headers",
+          "type": "str",
+          "title": "Auth request headers list",
+          "required": false,
+          "default": "Accept,X-Forwarded-Host,X-Forwarded-Method,X-Forwarded-Proto,X-Forwarded-Uri",
+          "description": "Comma-separated list of request headers Traefik should forward to the auth service.",
+          "config": {
+            "placeholder": "Accept,X-Forwarded-Host,X-Forwarded-Method,X-Forwarded-Proto,X-Forwarded-Uri"
+          }
+        },
+        {
+          "name": "tls_insecure_skip_verify",
+          "type": "bool",
+          "title": "Skip TLS verification",
+          "required": false,
+          "default": false,
+          "description": "Disable TLS certificate verification for the auth endpoint."
+        }
+      ]
+    }
+  ]
+}