docker-compose.yaml

version: "3.6"
services:
  traefik:
    image: traefik:v2.6
    restart: unless-stopped
    command:
      - --providers.file.watch=true
      - --providers.docker.watch=true
      - --providers.docker.swarmMode=false
      - --providers.docker.endpoint=unix:///var/run/docker.sock
      - --api.debug=true
      - --log.level=TRACE
      - --api.dashboard=true
      - --accesslog=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --entryPoints.traefik.address=:9080
      - --providers.file.filename=/etc/traefik/traefik.config.yml
      - --providers.docker.exposedByDefault=false
    networks:
      - services
    ports:
      - "80:80"
      - "443:443"
      - "9080:9080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.config.toml.tmpl:/etc/traefik/traefik.config.yml
      ### mounts for certs for tls settings
      - ${DOCKER_SECRETS_DIR}/test_crt:/etc/traefik/ssl/server.crt
      - ${DOCKER_SECRETS_DIR}/test_key:/etc/traefik/ssl/server.key
    labels:
      - traefik.enable=true
      - traefik.port=9080
      - traefik.docker.network=services-development
      - traefik.http.routers.traefik_insecure.rule=Host(`traefik.example.com`)
      - traefik.http.routers.traefik_insecure.middlewares=https-redirect@file
      - traefik.http.routers.traefik_insecure.entrypoints=http
      - traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
      - traefik.http.routers.traefik.entrypoints=traefik
      - traefik.http.routers.traefik.middlewares=compression@file,auth@file
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.service=api@internal
      ### thesee settings are the same as what is in the traefik.config.toml file
      # - "traefik.http.middlewares.traefik-forward-auth.forwardauth.address=http://forwardauth:4181"
      # - "traefik.http.middlewares.traefik-forward-auth.forwardauth.authResponseHeaders=X-Forwarded-User"
      # - "traefik.http.middlewares.traefik-forward-auth.forwardauth.trustForwardHeader=true"
      # - traefik.http.middlewares.traefik-forward-auth.forwardAuth.tls.cert=/etc/traefik/ssl/server.crt
      # - traefik.http.middlewares.traefik-forward-auth.forwardAuth.tls.key=/etc/traefik/ssl/server.key
  whoami:
    image: containous/whoami
    networks:
      - services
    labels:
      - traefik.enable=true
      - traefik.docker.network=services-development
      - traefik.http.routers.whoami_insecure.rule=Host(`whoami.example.com`)
      - traefik.http.routers.whoami_insecure.entrypoints=http
      - traefik.http.routers.whoami_insecure.middlewares=https-redirect@file
      - traefik.http.routers.whoami.rule=Host(`whoami.example.com`)
      - traefik.http.routers.whoami.entrypoints=https
      - traefik.http.routers.whoami.middlewares=compression@file,traefik-forward-auth@file
      - traefik.http.routers.whoami.middlewares=compression@file
      - traefik.http.routers.whoami.tls=true
  forwardauth:
    image: mesosphere/traefik-forward-auth:3.0.3
    restart: unless-stopped
    networks:
      - services
    environment:
      - "SECRET=VWh61HroDu1cXfX9qFuTj1q7qjrOcIQn"
      - PROVIDER_URI=https://accounts.example.com/auth/realms/master
      - CLIENT_ID=traefik-forwardauth
      - CLIENT_SECRET=xxx
      - LOG_LEVEL=trace
    labels:
      - traefik.enable=true
      - traefik.docker.network=services-development
      - traefik.http.services.forwardauth.loadbalancer.server.port=4181
      - traefik.http.routers.forwardauth.entrypoints=https
      - traefik.http.routers.forwardauth.rule=Path(`/_oauth`)
      - traefik.http.routers.forwardauth.middlewares=traefik-forward-auth@file
      - traefik.http.routers.forwardauth.tls=true
networks:
  services:
    external: true
    name: services-development

traefik.config.toml

[http.middlewares]
  [http.middlewares.https-redirect.redirectScheme]
    scheme = "https"

#  Enables gzip compression
  [http.middlewares.compression.compress]

#  Authentication middleware
  [http.middlewares.auth.basicAuth]
    users = [
      "USER:PASSWORD"
    ]

  [http.middlewares.stripApiPrefix.stripPrefix]
    prefixes = [ "/api" ]

  [http.middlewares.traefik-forward-auth.forwardAuth]
    address = "http://forwardauth:4181"
    authResponseHeaders = ["X-Forwarded-User"]
    trustForwardHeader = true
    [http.middlewares.traefik-forward-auth.forwardAuth.tls]
      cert = "/etc/traefik/ssl/server.crt"
      key = "/etc/traefik/ssl/server.key"
      caOptional = false

[tls]
  [[tls.certificates]]
    certFile = "/etc/traefik/ssl/server.crt"
    keyFile = "/etc/traefik/ssl/server.key"

  [tls.options]
    [tls.options.default]
      maxVersion = "VersionTLS12"
    
    [tls.options.maxtls12]
      maxVersion = "VersionTLS12"