{
  "slug": "traefik-forwardauth-middleware",
  "kind": "kubernetes",
  "metadata": {
    "name": "Traefik ForwardAuth Middleware",
    "description": "Traefik Middleware CRD for delegating request authentication to an external forward-auth endpoint such as Authentik, Authelia, or a custom identity proxy.",
    "tags": [],
    "icon": {
      "provider": "selfhst",
      "id": "traefik"
    },
    "draft": true,
    "version": {
      "name": "3.5.3",
      "source_dep_name": "manual/traefik-forwardauth-middleware"
    }
  },
  "variables": [
    {
      "title": "General",
      "name": "general",
      "items": [
        {
          "name": "resource_name",
          "type": "str",
          "title": "Middleware name",
          "required": false,
          "default": "forwardauth",
          "config": {
            "placeholder": "forwardauth"
          }
        },
        {
          "name": "namespace",
          "type": "str",
          "title": "Namespace",
          "required": false,
          "default": "default",
          "config": {
            "placeholder": "default"
          }
        }
      ]
    },
    {
      "title": "ForwardAuth",
      "name": "forwardauth",
      "items": [
        {
          "name": "address",
          "type": "str",
          "title": "ForwardAuth address",
          "required": true,
          "description": "HTTP or HTTPS endpoint Traefik should call for authentication decisions.",
          "config": {
            "placeholder": "https://auth.example.com/outpost.goauthentik.io/auth/traefik"
          }
        },
        {
          "name": "trust_forward_header",
          "type": "bool",
          "title": "Trust forwarded headers",
          "required": false,
          "default": true,
          "description": "Trust X-Forwarded-* headers sent by the previous hop."
        },
        {
          "name": "auth_response_headers_enabled",
          "type": "bool",
          "title": "Auth response headers",
          "required": false,
          "default": true,
          "description": "Forward selected headers from the auth response to the upstream service."
        },
        {
          "name": "auth_response_headers",
          "type": "str",
          "title": "Auth response headers list",
          "required": false,
          "default": "X-authentik-username,X-authentik-groups,X-authentik-email",
          "description": "Comma-separated list of response headers Traefik should pass to the upstream service.",
          "config": {
            "placeholder": "X-authentik-username,X-authentik-groups,X-authentik-email"
          }
        },
        {
          "name": "auth_request_headers_enabled",
          "type": "bool",
          "title": "Auth request headers",
          "required": false,
          "default": false,
          "description": "Restrict which request headers Traefik forwards to the auth service."
        },
        {
          "name": "auth_request_headers",
          "type": "str",
          "title": "Auth request headers list",
          "required": false,
          "default": "Accept,X-Forwarded-Host,X-Forwarded-Method,X-Forwarded-Proto,X-Forwarded-Uri",
          "description": "Comma-separated list of request headers Traefik should forward to the auth service.",
          "config": {
            "placeholder": "Accept,X-Forwarded-Host,X-Forwarded-Method,X-Forwarded-Proto,X-Forwarded-Uri"
          }
        },
        {
          "name": "tls_insecure_skip_verify",
          "type": "bool",
          "title": "Skip TLS verification",
          "required": false,
          "default": false,
          "description": "Disable TLS certificate verification for the auth endpoint."
        }
      ]
    }
  ]
}