docker-compose.yml

version: '3'

services:

  traefik:
    image: traefik:v2.10
    command:
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      - "--entrypoints.web.address=:8088"
      - "--entryPoints.web.forwardedHeaders.insecure"
    # docker swarm mode (1.12+)
      #- --providers.docker.endpoint=tcp://127.0.0.1:2377
      #- --providers.docker.swarmMode=true
     # regular compose
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
    ports:
      - "8088:8088"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    labels:
      #### set core configs
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=(PathPrefix(`/traefik`) || HeadersRegexp(`Referer`, `.*/traefik/.*`))"
      #### set traefik dashboard
      - "traefik.http.routers.traefik.service=api@internal"
      #### set middlewares: stripprefix for dashboard
      - "traefik.http.routers.traefik.middlewares=mystrip"
      - "traefik.http.middlewares.mystrip.stripprefix.prefixes=/traefik"
    restart: unless-stopped

  traefik-forward-auth:
   image: thomseddon/traefik-forward-auth:latest
   environment:
     - DEFAULT_PROVIDER=oidc
     - PROVIDERS_OIDC_ISSUER_URL=https://keycloakserver/realms/realmName
     - PROVIDERS_OIDC_CLIENT_ID=client-id
     - PROVIDERS_OIDC_CLIENT_SECRET=client-secret-from-keycloak
     - SECRET=FjCMBgnd63cdaj8PSE=90543db6-0af6-45e4-86eb-32c7223b13f8
     # INSECURE_COOKIE is required if not using a https entrypoint
     - INSECURE_COOKIE=true
     - URL_PATH=/_oauth
     - LOG_LEVEL=debug
   labels:
     - "traefik.enable=true"
     - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181"
     - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User,X-Auth-User,Authorization"
     - "traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181"
     - "traefik.http.routers.traefik-forward-auth.middlewares=traefik-forward-auth"
     - "traefik.http.middlewares.traefik-forward-auth.forwardauth.trustForwardHeader=true"
     - "traefik.http.routers.traefik-forward-auth.rule=Path(`/_oauth`)"

  echo-server:
    image: ealen/echo-server
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.echo-server.rule=PathPrefix(`/`)"
      - "traefik.http.routers.echo-server.entrypoints=web"
      - "traefik.http.services.echo-server.loadbalancer.server.port=80"
      - "traefik.http.routers.echo-server.middlewares=traefik-forward-auth@docker"