SSO wired up! Insanity overcome

Closes autonomic-cooperative/traefik#2.

configs/prod/file-provider.yml

@@ -0,0 +1,9 @@
+---
+http:
+  middlewares:
+    keycloak:
+      forwardAuth:
+        address: "http://traefik-forward-auth:4181"
+        trustForwardHeader: true
+        authResponseHeaders:
+          - "X-Forwarded-User"

configs/prod/forward.ini.tmpl

@@ -0,0 +1,13 @@
+secret = {{ secret "secret-nonce-v1" }}
+
+default-provider = oidc
+
+providers.oidc.issuer-url = {{ secret "oidc-issuer-url-v1" }}
+providers.oidc.client-id = {{ secret "oidc-client-id-v1" }}
+providers.oidc.client-secret = {{ secret "oidc-client-secret-v1" }}
+
+log-level = error
+
+cookie-domain = swarm.autonomic.zone
+
+auth-host = auth.swarm.autonomic.zone

configs/prod/traefik.yml

@@ -8,6 +8,8 @@ providers:
     exposedByDefault: false
     network: "proxy"
     swarmMode: true
+  file:
+    filename: /etc/traefik/file-provider.yml
 
 api:
   dashboard: true

docker-compose.override.yml

@@ -1,5 +1,5 @@
 ---
-version: "3.7"
+version: "3.8"
 
 services:
   traefik:

docker-compose.production.yml

@@ -1,5 +1,5 @@
 ---
-version: "3.7"
+version: "3.8"
 
 services:
   traefik:
@@ -13,6 +13,8 @@ services:
     configs:
       - source: traefik-yml-prod-v1
         target: /etc/traefik/traefik.yml
+      - source: file-provider-prod-v1
+        target: /etc/traefik/file-provider.yml
     networks:
       - proxy
     deploy:
@@ -30,8 +32,30 @@ services:
         - "traefik.http.routers.traefik.entrypoints=web-secure"
         - "traefik.http.routers.traefik.tls.certresolver=staging"
         - "traefik.http.routers.traefik.service=api@internal"
-        - "traefik.http.routers.traefik.middlewares=traefik-auth"
+        - "traefik.http.routers.traefik.middlewares=keycloak@file"
-        - "traefik.http.middlewares.traefik-auth.basicauth.users=autonomic:$$apr1$$c2uyXKda$$aRey75.6YpkdA82yGf5VN1"
+
+  traefik-forward-auth:
+    image: thomseddon/traefik-forward-auth:2
+    configs:
+      - source: forward-ini-prod-v1
+        target: /etc/forward.ini
+    networks:
+      - proxy
+    environment:
+      - CONFIG=/etc/forward.ini
+    secrets:
+      - oidc-client-id-v1
+      - oidc-client-secret-v1
+      - oidc-issuer-url-v1
+      - secret-nonce-v1
+    deploy:
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.services.tfa.loadBalancer.server.port=4181"
+        - "traefik.http.routers.tfa.rule=Host(`auth.swarm.autonomic.zone`)"
+        - "traefik.http.routers.tfa.entrypoints=web-secure"
+        - "traefik.http.routers.tfa.tls.certresolver=staging"
+        - "traefik.http.routers.tfa.middlewares=keycloak@file"
 
 networks:
   proxy:
@@ -40,6 +64,21 @@ networks:
 configs:
   traefik-yml-prod-v1:
     file: configs/prod/traefik.yml
+  file-provider-prod-v1:
+    file: configs/prod/file-provider.yml
+  forward-ini-prod-v1:
+    file: configs/prod/forward.ini.tmpl
+    template_driver: golang
+
+secrets:
+  secret-nonce-v1:
+    external: true
+  oidc-issuer-url-v1:
+    external: true
+  oidc-client-id-v1:
+    external: true
+  oidc-client-secret-v1:
+    external: true
 
 volumes:
   letsencrypt:

docker-compose.yml

@@ -1,5 +1,5 @@
 ---
-version: "3.7"
+version: "3.8"
 
 services:
   traefik:

requirements.txt

@@ -1 +1 @@
-docker-compose==1.25.5
+docker-compose==1.26.0-rc4