Repository navigation
[FEATURE] Non-label based access control #356
Description
Is your feature request related to a problem? Please describe.
Access controls and other per-app features are seemingly only available via docker labels. But some of the apps I host are not docker containers, and some are on other machines. This makes it impossible to set up custom access control for them.
Describe the solution you'd like
There must be a way to do this without docker labels. Access control features should be set up in tinyauth's own config only. Perhaps a sensible solution is creating profiles. They would be used via their uri path.
Example profiles.json:
"profiles":
[
"/": {},
"/librechat": {"users": "user1", "allowed": "^\/api"}
]
After mounting profiles.json in tinyauth it would let me use these profiles in caddyfile:
(tinyauth_forwarder) {
forward_auth 127.0.0.1:3789 {
uri /api/auth/caddy
}
}
(tinyauth_forwarder_librechat) {
forward_auth 127.0.0.1:3789 {
uri /librechat/api/auth/caddy
}
}
whoami.example.com{
import tinyauth_forwarder
reverse_proxy 127.0.0.1:3000
}
librechat.example.com{
import tinyauth_forwarder_librechat
reverse_proxy 10.11.12.5:3000
}
Activity
steveiliop56 commentedon Sep 13, 2025
Hello,
While this would solve the issue it would break the project's base idea, (quoted from the documentation):
One way to configure ACLs would be with environment variables/CLI flags (e.g.
ACLS_FOO_CONFIG_DOMAIN) but I am not very sure if it would be that user friendly.rinseaid commentedon Sep 26, 2025
I would also love to see a similar feature - using TinyAuth to protect all my apps is my goal. I'd be ok with environment variables/CLI flags, since it would eliminate having to create an external configuration file - I don't think it's too alien a concept for users who would be needing such a feature.
raghuscsa316 commentedon Oct 9, 2025
+1
Would also love the ability for Tinyauth to support authentication to different apps based on profiles/groups.
pantherman594 commentedon Oct 10, 2025
I'm also using the binary, not docker, and would appreciate a way to configure access controls without docker labels.
I would also be ok with configuring with environment variables/CLI flags, and there's already a precedence for it with the multiple OAuth providers feature you recently added for v4.
purple-emily commentedon Oct 14, 2025
I don't use docker labels or caddy-docker-proxy. I use normal Caddy with a Caddyfile and I am wanting to allow a n8n instance to perform an API call on another service that is protected by TinyAuth. I am not sure how to allow this and can't find anything in the documentation to help.
chrellrich commentedon Oct 15, 2025
This would be a great feature allowing for more varied usecases. Might I ask why you are against using a config file? I think if done in a similar fashion to traefik (where you can enable a file provider) it would be pretty intuitive.
steveiliop56 commentedon Oct 15, 2025
Alright, let's add a simple yaml config file for storing ACLs. I will mark this issue as pinned so as it won't be closed by the stale bot.
steveiliop56 commentedon Oct 21, 2025
Added in #422! You will be able to use
TINYAUTH_APPS_WHATEVER_FOO=BARto configure ACLs using environment variables (and hopefully CLI flags)!