当前位置：首页 > news >正文

别再手动改hosts了！用Docker Compose一键部署Authelia SSO，顺便搞定Traefik反向代理

news 2026/6/4 14:48:57

一键部署Authelia SSO与Traefik反向代理的Docker Compose实战指南

在当今复杂的网络环境中，管理多个Web应用的认证流程往往成为开发者的痛点。手动配置hosts文件、逐个设置访问权限不仅耗时耗力，还容易出错。本文将介绍如何利用Docker Compose快速搭建Authelia单点登录系统，并集成Traefik作为反向代理，实现开箱即用的安全访问控制方案。

1. 技术栈概述与准备工作

Authelia是一款开源的单点登录(SSO)和双因素认证(2FA)系统，专为自托管应用设计。它支持多种认证方式，能与反向代理无缝集成，为内部应用提供统一的认证入口。Traefik则是现代化的反向代理和负载均衡工具，支持自动服务发现和Let's Encrypt证书管理。

部署前准备：

已安装Docker和Docker Compose的Linux服务器（推荐Ubuntu 20.04+）
有效的域名（用于SSL证书申请）
基础命令行操作知识

提示：虽然本文使用.example.com作为演示域名，实际部署时请替换为您自己的域名。

2. Docker Compose编排文件解析

以下是经过优化的docker-compose.yml文件，集成了Authelia、Redis、Traefik和演示站点：

version: '3.8' networks: sso-network: driver: bridge services: authelia: image: authelia/authelia:latest container_name: authelia volumes: - ./authelia/config:/config networks: - sso-network environment: - TZ=Asia/Shanghai labels: - "traefik.enable=true" - "traefik.http.routers.authelia.rule=Host(`auth.yourdomain.com`)" - "traefik.http.routers.authelia.entrypoints=websecure" - "traefik.http.routers.authelia.tls.certresolver=letsencrypt" - "traefik.http.services.authelia.loadbalancer.server.port=9091" redis: image: redis:alpine container_name: redis volumes: - ./redis/data:/data networks: - sso-network restart: unless-stopped traefik: image: traefik:v2.6 container_name: traefik ports: - "80:80" - "443:443" volumes: - ./traefik/config:/etc/traefik - /var/run/docker.sock:/var/run/docker.sock networks: - sso-network command: - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--certificatesresolvers.letsencrypt.acme.email=your@email.com" - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme.json" - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web" whoami: image: containous/whoami container_name: whoami networks: - sso-network labels: - "traefik.enable=true" - "traefik.http.routers.whoami.rule=Host(`app.yourdomain.com`)" - "traefik.http.routers.whoami.entrypoints=websecure" - "traefik.http.routers.whoami.tls.certresolver=letsencrypt" - "traefik.http.routers.whoami.middlewares=authelia@docker"

关键配置说明：

使用独立的Docker网络sso-network确保服务间隔离
Authelia配置挂载到本地./authelia/config目录
Traefik配置自动SSL证书申请
Whoami服务作为演示应用，受Authelia保护

3. Authelia详细配置

在./authelia/config目录下创建两个关键配置文件：

configuration.yml

theme: light jwt_secret: your_secure_jwt_secret_here default_redirection_url: https://app.yourdomain.com server: host: 0.0.0.0 port: 9091 authentication_backend: file: path: /config/users_database.yml password: algorithm: argon2id iterations: 3 memory: 65536 parallelism: 4 access_control: default_policy: deny rules: - domain: "auth.yourdomain.com" policy: bypass - domain: "app.yourdomain.com" policy: two_factor session: name: authelia_session secret: your_session_secret_here expiration: 1h inactivity: 5m domain: yourdomain.com storage: encryption_key: your_encryption_key_here local: path: /config/db.sqlite3 notifier: filesystem: filename: /config/notifications.txt

users_database.yml

users: admin: displayname: "Admin User" password: "$argon2id$v=19$m=65536,t=3,p=4$dGhlc2FsdHlzdHJpbmc$thehashedpassword" email: admin@yourdomain.com groups: - admins developer: displayname: "Developer" password: "$argon2id$v=19$m=65536,t=3,p=4$YW5vdGhlcnNhbHQ$anotherhashedpassword" email: dev@yourdomain.com

生成密码哈希的命令：

docker run --rm authelia/authelia:latest authelia hash-password 'yourpassword'

4. Traefik配置优化

在./traefik/config目录下创建traefik.yml：

api: dashboard: true insecure: true entryPoints: web: address: ":80" http: redirections: entryPoint: to: websecure scheme: https websecure: address: ":443" providers: docker: endpoint: "unix:///var/run/docker.sock" exposedByDefault: false certificatesResolvers: letsencrypt: acme: email: "your@email.com" storage: "/etc/traefik/acme.json" httpChallenge: entryPoint: "web"

性能优化参数：

serversTransport: maxIdleConnsPerHost: 200 forwardingTimeouts: dialTimeout: 30s responseHeaderTimeout: 0s log: level: INFO format: json

5. 部署与测试流程

启动服务栈

docker-compose up -d

验证服务状态

docker-compose ps

测试访问流程

直接访问https://app.yourdomain.com应跳转到Authelia登录页
使用users_database.yml中的凭证登录
成功认证后应返回Whoami服务页面

管理界面

Traefik仪表板:https://traefik.yourdomain.com
Authelia管理API:https://auth.yourdomain.com/api/

常见问题排查：

# 查看Authelia日志 docker logs authelia # 检查Redis连接 docker exec -it redis redis-cli ping # 验证Traefik配置 docker exec traefik traefik check-config

6. 生产环境增强建议

安全加固措施：

替换所有示例中的密钥和密码
启用数据库存储替代SQLite
配置SMTP通知服务
设置适当的备份策略

性能扩展方案：

# 在docker-compose.yml中添加 authelia: deploy: resources: limits: cpus: '1' memory: 512M reservations: memory: 256M healthcheck: test: ["CMD", "authelia", "healthcheck"] interval: 30s timeout: 5s retries: 3

监控集成：