# Implementing External Authentication in Pangolin Using Tinyauth and the Middleware Manager

**URL:** <https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417>\
**Category:** Networking\
**Tags:** tinyauth, middleware-manager, pangolin\
**Created:** [April 18, 2025, 12:30pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417 "2025-04-18T12:30:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mattercoder](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/m/54ee81/32.png) [@Mattercoder](https://forum.hhf.technology/u/Mattercoder)\
**Post date:** [April 18, 2025, 12:30pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/1 "2025-04-18T12:30:15Z")

</div>

# Implementing External Authentication in Pangolin Using Tinyauth and the Middleware Manager

 ![tinyauth login](https://forum-cdn.hhf.technology/original/2X/f/fefa28b939546741a3cd88008072fe9203e1f9f8.png)

Pangolin now supports flexible authentication options through the Middleware-manager. While [Authentik](https://goauthentik.io/) and [Authelia](https://www.authelia.com/) are popular options, this guide shows how to implement external authentication using [Tinyauth](https://tinyauth.app) — a lightweight, rising middleware project. 🎉

> 🧩 **Prerequisite:** This article assumes you’ve already implemented [Pangolin’s Middleware Manager](https://forum.hhf.technology/t/enhancing-your-pangolin-deployment-with-middleware-manager/1324). If not, go through that guide first.

* * *

## 🛠 Prerequisites

- Pangolin deployed with the Middleware Manager
- Docker and Docker Compose set up on your VPS
- A registered domain (e.g. `mydomain.com`) with a subdomain for Tinyauth (e.g. `tinyauth.mydomain.com`) pointing to your VPS
- Basic familiarity with managing Docker and editing YAML files

* * *

## 🐳 Step 1: Add Tinyauth to Docker Compose

In your existing Docker Compose setup, add the following service:

```yaml
  tinyauth:
    image: ghcr.io/steveiliop56/tinyauth:v3
    container_name: tinyauth
    restart: unless-stopped
    environment:
      - PORT=10000
      - SECRET=${TINYAUTH_SECRET_KEY}
      - APP_URL=https://tinyauth.mydomain.com
      - LOG_LEVEL=0
      - USERS_FILE=users_file
    volumes:
      - ./config/tinyauth/users:/tinyauth/users_file

```

* * *

## 📁 Step 2: Create the Secret Key

Create a `.env` file in the same folder as your docker-compose.yml file with this line:

```env
TINYAUTH_SECRET_KEY=your-generated-secret-key

```

You can generate the key using:

```bash
openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32

```

* * *

## 👤 Step 3: Create User Credentials

Create a new folder in the pangolin config folder called tinyauth  
Inside `./config/tinyauth/`, create a `users` file with the login credentials.

Use the `htpasswd` tool to generate secure bcrypt hashes. Note: escape `$` characters as `$$`.

```bash
echo $(htpasswd -nB test) | sed -e s/\\$/\\$\\$/g

```

Example content for a `test/test` login:

```txt
test:$$2y$$05$$BsP6eSe4FIAqhhtGO8EUEuZWkdgWtU9NdqrJopxicTVvqxMQZ6BYu

```

> ⚠ Alternatively, credentials can be passed directly via the `USERS` environment variable

You can get more info on the Tinyauth set up including integration of OAuth to Github in [this Jim’s garage video](https://www.youtube.com/watch?v=qmlHirOpzpc)).

* * *

NOTE: THE FOLLOWING CHANGES COULD RESULT IN BREAKING CHANGES. PLEASE BE CAREFUL.

## 🧪 Step 4: Expose the Tinyauth Port

Update your `gerbil` service in Docker Compose to expose the Tinyauth port:

```yaml
    ports:
      - 10000:10000 # Exposes Tinyauth

```

* * *

## ⚙ Step 5: Add Traefik Routing Rules

Edit your Traefik dynamic configuration file (e.g., `dynamic_config.yml`) to include Tinyauth routes.

### 🟢 HTTP Redirect Router

```yaml
  tinyauth-router-redirect:
    rule: "Host(`tinyauth.mydomain.com`)"
    service: tinyauth-service
    entryPoints:
      - web
    middlewares:
      - redirect-to-https

```

### 🔐 HTTPS Router

```yaml
  tinyauth:
    rule: "Host(`tinyauth.mydomain.com`)"
    service: tinyauth-service
    entryPoints:
      - websecure
    tls:
      certResolver: letsencrypt

```

### 🚪 Service Entry

```yaml
  tinyauth-service:
    loadBalancer:
      servers:
        - url: "http://tinyauth:10000"

```

* * *

## 🧱 Step 6: Define Middleware Template

In your Middleware Manager templates file (`middleware/templates.yml`), add a new entry:

```yaml
  - id: tinyauth
    name: Tiny Auth
    type: forwardAuth
    config:
      address: http://tinyauth:10000/api/auth/traefik

```

* * *

## 🚀 Step 7: Start Services

Start everything:

```bash
docker compose up -d

```

Check services are running:

```bash
sudo lsof -i -P -n | grep LISTEN

```

> 🔍 **Screenshot:** this is the command and the result with `:10000` showing in the list.

 ![port listen](https://forum-cdn.hhf.technology/original/2X/5/5e41f901b8b042c2e0b46163769c22220b6b312e.png)

In your browser, open an incognito tab and visit:

```auto
https://tinyauth.mydomain.com

```

You should see the Tinyauth login page.

* * *

## 🧪 Step 8: Test with a Simple App

Set up a basic app (like a Python web server):

```bash
python3 -m http.server 8000

```

Expose it with Pangolin as a resource, e.g.:

```auto
https://helloworld.mydomain.com

```

Verify it works without authentication first.

> 📸 **Screenshot** Here’s my URL unauthenticated.
> 
> ![HelloWorldUnauthenticated](https://forum-cdn.hhf.technology/original/2X/9/95caf21e92f6a0b799ccb4845ac8038ee6fa5c91.png)

* * *

## 🛡 Step 9: Attach Middleware in Pangolin

1. Open the Pangolin Middleware Manager UI.
2. Navigate to the **Middlewares** tab.
  - Confirm you see `Tinyauth` listed.

3. Return to the **Dashboard** and click **Manage** next to the resource you want to protect.
4. Under **Attached Middlewares** , click **Add Middleware**.
5. Select **Tinyauth (forwardAuth)** and click **Add Middlewares**.

> 📸 **Screenshot:** Here’s the middleware list and the form where you attach Tinyauth.
> 
> ![Tinyauth-middleware-select](https://forum-cdn.hhf.technology/original/2X/0/09a2fce3236c47f869f0e02583247d20fe43bd35.png)

## ![middleware-attach](https://forum-cdn.hhf.technology/original/2X/3/300d2e5f594b4798a2eef80577eab8de04c18a67.png)

## ✅ Step 10: Final Test

Open your protected resource in an incognito window:

```auto
https://resourcename.mydomain.com

```

You should be redirected to `https://tinyauth.mydomain.com` for login. After authenticating, you’ll return to the protected app.

 ![tinyauth login](https://forum-cdn.hhf.technology/original/2X/f/fefa28b939546741a3cd88008072fe9203e1f9f8.png)

* * *

## 📌 Summary

In this article, we walked through how to set up the blazing fast, minimalist [Tinyauth](https://tinyauth.app) as a forward auth provider for Pangolin. With just a few steps and clever integration using the Middleware Manager, you now have a lightweight and secure authentication layer protecting your self-hosted apps. There are more integrations to come!!!

* * *

## 🙏 Thanks for Reading!

Tinyauth is a fantastic project from an incredibly talented young developer — it’s inspiring to see such innovation in the open-source space. If you found this guide helpful, consider exploring more of what Pangolin has to offer, and feel free to share your feedback or improvements in the [Pangolin forum](https://forum.hhf.technology/).

Happy self-hosting! 💻🔒

```auto

```

---

<div class="post-metadata">

**Author:** ![hdsplus](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hdsplus/32/1548_2.png) [@hdsplus](https://forum.hhf.technology/u/hdsplus)\
**Post date:** [April 19, 2025, 10:22am UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/2 "2025-04-19T10:22:32Z")

</div>

In my case it does not work. This part in the dynamic\_config.yml, when I enable it, in all the URL of Pangolin it comes out “error 404 not found”. If I disable only this block, if the rest works (No tinyauth).  
The rest of the tutorial I have followed as you indicate and it is working.

 ![Screenshot 2025-04-19 at 9.57.23 AM](https://forum-cdn.hhf.technology/original/2X/c/cbb2c17f91d8dc0669bf394f71a84218aeb1e10c.png)

**Tinyauth logs**

 ![Screenshot 2025-04-19 at 9.53.21 AM](https://forum-cdn.hhf.technology/original/2X/3/3c9ab8f0b837bcb42370c85e34fc1d3cb48b6d6f.png)

**Docker Compose (part modified)**

 ![Screenshot 2025-04-19 at 9.58.18 AM](https://forum-cdn.hhf.technology/original/2X/5/58863e59541a1ebf6fb91e276e7fcb16109a886b.png)

 ![Screenshot 2025-04-19 at 9.58.54 AM](https://forum-cdn.hhf.technology/original/2X/3/3b9a6ae34207a582e7f4740ca3abc7664d81d0bf.png)

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [April 19, 2025, 10:24am UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/3 "2025-04-19T10:24:49Z")

</div>

```yaml
http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https

  routers:
    # HTTP to HTTPS redirect router
    main-app-router-redirect:
      rule: "Host(`pangolin.development.hhf.technology`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    # tinyauth router
    tinyauth-router-redirect:
      rule: "Host(`tinyauth.development.hhf.technology`)"
      service: tinyauth-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "Host(`pangolin.development.hhf.technology`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    # API router (handles /api/v1 paths)
    api-router:
      rule: "Host(`pangolin.development.hhf.technology`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    # WebSocket router
    ws-router:
      rule: "Host(`pangolin.development.hhf.technology`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

    # tinyauth router
    tinyauth:
      rule: "Host(`tinyauth.development.hhf.technology`)"
      service: tinyauth-service
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt

  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002" # Next.js server

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000" # API/WebSocket server

    tinyauth-service:
      loadBalancer:
        servers:
          - url: "http://tinyauth:10000"

```

---

<div class="post-metadata">

**Author:** ![hdsplus](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hdsplus/32/1548_2.png) [@hdsplus](https://forum.hhf.technology/u/hdsplus)\
**Post date:** [April 19, 2025, 4:02pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/4 "2025-04-19T16:02:57Z")

</div>

Now yes! Thank you so much ! 😄

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [April 20, 2025, 5:58pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/5 "2025-04-20T17:58:24Z")

</div>



---

<div class="post-metadata">

**Author:** ![Astral](https://forum.hhf.technology/letter_avatar_proxy/v4/letter/a/a698b9/32.png) [@Astral](https://forum.hhf.technology/u/Astral)\
**Post date:** [June 22, 2026, 10:35pm UTC](https://forum.hhf.technology/t/implementing-external-authentication-in-pangolin-using-tinyauth-and-the-middleware-manager/1417/6 "2026-06-22T22:35:54Z")

</div>

The gerbil 10000 does nothing you never wired it to anything so not sure why that even exists? As unless you make a traefik entrypoint to listen on 10000 it’ll do nothing, If it’s to allow cross talk, All ports are opened between containers regardless of what’s defined.