# Implementing External Authentication in Pangolin Using Tinyauth and the Middleware Manager **URL:** \ **Category:** Networking\ **Tags:** traefik, pangolin\ **Created:** [April 17, 2025, 8:51am UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398 "2025-04-17T08:51:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\ **Post date:** [April 17, 2025, 8:51am UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/1 "2025-04-17T08:51:57Z")
# Implementing External Authentication in Pangolin Using Tinyauth and the Middleware Manager ![tinyauth login](https://forum-cdn.hhf.technology/original/2X/f/fefa28b939546741a3cd88008072fe9203e1f9f8.png) Pangolin now supports flexible authentication options through the Middleware-manager. While [Authentik](https://goauthentik.io/) and [Authelia](https://www.authelia.com/) are popular options, this guide shows how to implement external authentication using [Tinyauth](https://tinyauth.app) — a lightweight, rising middleware project. 🎉 > 🧩 **Prerequisite:** This article assumes you’ve already implemented [Pangolin’s Middleware Manager](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324). If not, go through that guide first. * * * ## 🛠 Prerequisites - Pangolin deployed with the Middleware Manager - Docker and Docker Compose set up on your VPS - A registered domain (e.g. `mydomain.com`) with a subdomain for Tinyauth (e.g. `tinyauth.mydomain.com`) pointing to your VPS - Basic familiarity with managing Docker and editing YAML files * * * ## 🐳 Step 1: Add Tinyauth to Docker Compose In your existing Docker Compose setup, add the following service: ```yaml tinyauth: image: ghcr.io/steveiliop56/tinyauth:v3 container_name: tinyauth restart: unless-stopped environment: - PORT=10000 - SECRET=${TINYAUTH_SECRET_KEY} - APP_URL=https://tinyauth.mydomain.com - LOG_LEVEL=0 - USERS_FILE=users_file volumes: - ./config/tinyauth/users:/tinyauth/users_file ``` * * * ## 📁 Step 2: Create the Secret Key Create a `.env` file in the same folder as your docker-compose.yml file with this line: ```env TINYAUTH_SECRET_KEY=your-generated-secret-key ``` You can generate the key using: ```bash openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32 ``` * * * ## 👤 Step 3: Create User Credentials Create a new folder in the pangolin config folder called tinyauth Inside `./config/tinyauth/`, create a `users` file with the login credentials. Use the `htpasswd` tool to generate secure bcrypt hashes. Note: escape `$` characters as `$$`. ```bash echo $(htpasswd -nB test) | sed -e s/\\$/\\$\\$/g ``` Example content for a `test/test` login: ```txt test:$$2y$$05$$BsP6eSe4FIAqhhtGO8EUEuZWkdgWtU9NdqrJopxicTVvqxMQZ6BYu ``` > ⚠ Alternatively, credentials can be passed directly via the `USERS` environment variable You can get more info on the Tinyauth set up including integration of OAuth to Github in [this Jim’s garage video](https://www.youtube.com/watch?v=qmlHirOpzpc)). * * * NOTE: THE FOLLOWING CHANGES COULD RESULT IN BREAKING CHANGES. PLEASE BE CAREFUL. ## 🧪 Step 4: Expose the Tinyauth Port Update your `gerbil` service in Docker Compose to expose the Tinyauth port: ```yaml ports: - 10000:10000 # Exposes Tinyauth ``` * * * ## ⚙ Step 5: Add Traefik Routing Rules Edit your Traefik dynamic configuration file (e.g., `dynamic_config.yml`) to include Tinyauth routes. ### 🟢 HTTP Redirect Router ```yaml tinyauth-router-redirect: rule: "Host(`tinyauth.mydomain.com`)" service: tinyauth-service entryPoints: - web middlewares: - redirect-to-https ``` ### 🔐 HTTPS Router ```yaml tinyauth: rule: "Host(`tinyauth.mydomain.com`)" service: tinyauth-service entryPoints: - websecure tls: certResolver: letsencrypt ``` ### 🚪 Service Entry ```yaml tinyauth-service: loadBalancer: servers: - url: "http://tinyauth:10000" ``` * * * ## 🧱 Step 6: Define Middleware Template In your Middleware Manager templates file (`middleware/templates.yml`), add a new entry: ```yaml - id: tinyauth name: Tiny Auth type: forwardAuth config: address: http://tinyauth:10000/api/auth/traefik ``` * * * ## 🚀 Step 7: Start Services Start everything: ```bash docker compose up -d ``` Check services are running: ```bash sudo lsof -i -P -n | grep LISTEN ``` > 🔍 **Screenshot:** this is the command and the result with `:10000` showing in the list. ![port listen](https://forum-cdn.hhf.technology/original/2X/5/5e41f901b8b042c2e0b46163769c22220b6b312e.png) In your browser, open an incognito tab and visit: ```auto https://tinyauth.mydomain.com ``` You should see the Tinyauth login page. * * * ## 🧪 Step 8: Test with a Simple App Set up a basic app (like a Python web server): ```bash python3 -m http.server 8000 ``` Expose it with Pangolin as a resource, e.g.: ```auto https://helloworld.mydomain.com ``` Verify it works without authentication first. > 📸 **Screenshot** Here’s my URL unauthenticated. > > ![HelloWorldUnauthenticated](https://forum-cdn.hhf.technology/original/2X/9/95caf21e92f6a0b799ccb4845ac8038ee6fa5c91.png) * * * ## 🛡 Step 9: Attach Middleware in Pangolin 1. Open the Pangolin Middleware Manager UI. 2. Navigate to the **Middlewares** tab. - Confirm you see `Tinyauth` listed. 3. Return to the **Dashboard** and click **Manage** next to the resource you want to protect. 4. Under **Attached Middlewares** , click **Add Middleware**. 5. Select **Tinyauth (forwardAuth)** and click **Add Middlewares**. > 📸 **Screenshot:** Here’s the middleware list and the form where you attach Tinyauth. > > ![Tinyauth-middleware-select](https://forum-cdn.hhf.technology/original/2X/0/09a2fce3236c47f869f0e02583247d20fe43bd35.png) ## ![middleware-attach](https://forum-cdn.hhf.technology/original/2X/3/300d2e5f594b4798a2eef80577eab8de04c18a67.png) ## ✅ Step 10: Final Test Open your protected resource in an incognito window: ```auto https://resourcename.mydomain.com ``` You should be redirected to `https://tinyauth.mydomain.com` for login. After authenticating, you’ll return to the protected app. ![tinyauth login](https://forum-cdn.hhf.technology/original/2X/f/fefa28b939546741a3cd88008072fe9203e1f9f8.png) * * * ## 📌 Summary In this article, we walked through how to set up the blazing fast, minimalist [Tinyauth](https://tinyauth.app) as a forward auth provider for Pangolin. With just a few steps and clever integration using the Middleware Manager, you now have a lightweight and secure authentication layer protecting your self-hosted apps. There are more integrations to come!!! * * * ## 🙏 Thanks for Reading! Tinyauth is a fantastic project from an incredibly talented young developer — it’s inspiring to see such innovation in the open-source space. If you found this guide helpful, consider exploring more of what Pangolin has to offer, and feel free to share your feedback or improvements in the [Pangolin forum](https://forum.hhf.technology/). Happy self-hosting! 💻🔒 ```auto ``` ---
**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\ **Post date:** [June 3, 2025, 6:07pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/3 "2025-06-03T18:07:48Z")
---
**Author:** ![kebel87](https://forum.hhf.technology/user_avatar/forum.hhf.technology/kebel87/32/2047_2.png) [@kebel87](https://forum.hhf.technology/u/kebel87)\ **Post date:** [June 15, 2025, 1:13pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/4 "2025-06-15T13:13:17Z")
Thanks a lot! Is there a step by step guide like this for Authelia? I have a hard time setting it. ---
**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\ **Post date:** [June 15, 2025, 1:44pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/5 "2025-06-15T13:44:26Z")
Hi. I thought we had one. But can’t see to find it. Looking back on my notes it’s very straightforward 1. deploy Authelia docker container ```auto authelia: image: authelia/authelia container_name: authelia volumes: - ./config:/config - /etc/letsencrypt:/certs:ro ports: - "9091:9091" expose: - 9091 labels: - "traefik.enable=true" - "traefik.http.routers.authelia.entrypoints=websecure" - "traefik.http.routers.authelia.rule=Host(`authelia.yourdomain.com`)" - "traefik.http.routers.authelia.tls=true" - "traefik.http.routers.authelia.tls.certresolver=myresolver" - "traefik.http.routers.authelia.service=authelia" - "traefik.http.services.authelia.loadbalancer.server.port=9091" - "traefik.http.routers.authelia.middlewares=redirect-to-https" - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https" restart: unless-stopped environment: - TZ=Europe/London ``` 1. apply the middleware to your protected resource ````auto authelia: forwardAuth: address: "https://authelia.yourdomain.com/api/verify?rd=https://authelia.yourdomain.com" authResponseHeaders: - Remote-User - Remote-Groups - Remote-Name - Remote-Email trustForwardHeader: true ``` ```` ---
**Author:** ![kebel87](https://forum.hhf.technology/user_avatar/forum.hhf.technology/kebel87/32/2047_2.png) [@kebel87](https://forum.hhf.technology/u/kebel87)\ **Post date:** [June 16, 2025, 1:40am UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/6 "2025-06-16T01:40:18Z")
Thanks! What about the files mentioned there : ### Standalone Example The following examples are [Docker Compose](https://docs.docker.com/compose/) deployments with just _Authelia_ and no bundled applications or proxies. It expects the following: - The file `data/authelia/config/configuration.yml` is present and the configuration file. - The directory `data/authelia/secrets/` exists and contain the relevant [secret](https://www.authelia.com/configuration/methods/secrets/) files: - A file named `JWT_SECRET` for the [jwt\_secret](https://www.authelia.com/configuration/identity-validation/reset-password/#jwt_secret) - A file named `SESSION_SECRET` for the [session secret](https://www.authelia.com/configuration/session/introduction/#secret) - A file named `STORAGE_PASSWORD` for the [PostgreSQL password secret](https://www.authelia.com/configuration/storage/postgres/#password) - A file named `STORAGE_ENCRYPTION_KEY` for the [storage encryption\_key secret](https://www.authelia.com/configuration/storage/introduction/#encryption_key) They don’t seem to autogenerate. I should create them? ---
**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\ **Post date:** [June 16, 2025, 12:57pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/7 "2025-06-16T12:57:40Z")
Do you use AWS? Here’s a guide for setting up auth servers on AWS. > [@Using AWS CloudFormation to Create Test Authentication Servers for Pangolin and the Middleware Manager](https://forum.hhf.technology/t/using-aws-cloudformation-to-create-test-authentication-servers-for-pangolin-and-the-middleware-manager/1961): > > This guide walks you through using AWS CloudFormation to create test-ready authentication servers like Authelia, Authentik, PocketID and Zitadel to integrate with [Pangolin’s Middleware Manager](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324). These preconfigured stacks make it easy to stand up external auth services for testing. Please note, these are purely for testing!! [[Deploy Authorization Servers Fast - using AWS Cloudformation] ](https://www.youtube.com/watch?v=ViPKzHwkZjM) Github Repo here: [GitHub - oidebrett/auth-servers-on-aws-ec2: Cloudformation Templates to quickl…](https://github.com/oidebrett/auth-servers-on-aws-ec2) ---
**Author:** ![kebel87](https://forum.hhf.technology/user_avatar/forum.hhf.technology/kebel87/32/2047_2.png) [@kebel87](https://forum.hhf.technology/u/kebel87)\ **Post date:** [June 17, 2025, 7:30pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1398/8 "2025-06-17T19:30:10Z")
Oracle free tier. But I’ll try to infer from thee AWS guide. Thanks!