apt update
apt install -y unzip
wget https://download.authing.cn/docker.zip
unzip docker.zip
cd docker
sudo dpkg -i docker-ce-cli_19.03.9_3-0_ubuntu-focal_amd64.deb
sudo dpkg -i containerd.io_1.3.7-1_amd64.deb
sudo dpkg -i docker-ce_19.03.9_3-0_ubuntu-focal_amd64.deb

wget https://download.authing.cn/docker-compose-Linux-x86_64
mv docker-compose-Linux-x86_64 /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

mkdir traefik

version: '3'

# docker 通讯  如果启动报错 提示找不到 应用@docker
# 执行命令 docker network create traefik
networks:
  traefik:
    external: true

services:
  traefik:
    image: traefik:v2.2
    # 开启 web UI 并且告诉 Traefik 监听 Docker
    command: --api.insecure=true --providers.docker
    # 端口映射  这个 80 端口 是网关入口 比如下边的 whoami 服务
    # 给他分配的域名是 whoami.localhost 那么直接访问 http://whoami.localhost 就可以
    # 如果这里分配的是 8081 之类的其下方的应用都需要带端口比如 http://whoami.localhost:8081
    # 8086 是 traefik web UI 地址
    ports:
      - '80:80'
      - '8086:8080'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik

  whoami:
    image: containous/whoami
    labels:
      # routers. 后边跟的是 services 的名称 rule 是给当前应用绑定域名或者路径
      # 每个 Host 需要配置到 Authing 的 Traefik External URL 参数中，有多个服务的时候用英文逗号分开。
      - 'traefik.http.routers.whoami.rule=Host(`whoami.localhost`)'
      # 中间件使用 traefik-forward-auth 
      - 'traefik.http.routers.whoami.middlewares=traefik-forward-auth'
    networks:
      - traefik

  traefik-forward-auth:
    image: thomseddon/traefik-forward-auth:2
    ports:
      - '4181:4181'
    networks:
      - traefik
    environment:
      # 登录方式 OIDC 下边三个参数授权等信息在 Authing 应用登录配置中 见下方图
      - DEFAULT_PROVIDER=oidc
      - PROVIDERS_OIDC_ISSUER_URL= {PROVIDERS_OIDC_ISSUER_URL}
      - PROVIDERS_OIDC_CLIENT_ID= {PROVIDERS_OIDC_CLIENT_ID}
      - PROVIDERS_OIDC_CLIENT_SECRET= {PROVIDERS_OIDC_CLIENT_SECRET}
      # 更多参数见附录1
      - SECRET=something-random
      # INSECURE_COOKIE is required if not using a https entrypoint
      - INSECURE_COOKIE=true
      - LOG_LEVEL=debug
    labels:
      # address=http://traefik-forward-auth:4181  指的是 traefik-forward-auth 应用的 4181 端口
      # 选项定义外部身份验证服务器地址
      # authResponseHeaders选项定义要从外部身份验证服务器复制到请求的标头列表
      # trustForwardHeader选项设置true表示信任所有现有的X-Forwarded-*标头
      # 更多参数见附录1
      - 'traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://traefik-forward-auth:4181'
      - 'traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User'
      - 'traefik.http.services.traefik-forward-auth.loadbalancer.server.port=4181'

 touch acme.json

$ curl https://whoami.shanyue.tech
Hostname: c9c3cc850e2b
IP: 127.0.0.1
IP: 172.18.0.2
RemoteAddr: 172.18.0.3:35320
GET / HTTP/1.1
Host: whoami.shanyue.tech
User-Agent: curl/7.29.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 59.110.159.217
X-Forwarded-Host: whoami.shanyue.tech
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: 9d783174aca9
X-Real-Ip: 59.110.159.217

"traefik.http.routers.traefik-forward-auth.middlewares=traefik-forward-auth"