title: Traefik+Docker Reverse Proxy - Different Auth For Different Paths?
body: <p>I'm running a Docker service (OwnTracks Recorder), using Traefik as a reverse proxy for authentication.  It's setup is via docker-compose; here are the labels on the service:</p>
  <pre><code>  labels:
      - traefik.enable=true
      - traefik.frontend.rule=PathPrefixStrip:/owntracks
      - traefik.frontend.auth.basic=user1:hash1,user2:hash2
  </code></pre>
  <p>This works as intended.  The problem I'm trying to solve is that Owntracks actually has two elements: a dashboard, which would be at <a href="https://example.com/owntracks" rel="nofollow noreferrer">https://example.com/owntracks</a>, and an api, at <a href="https://example.com/owntracks/pub" rel="nofollow noreferrer">https://example.com/owntracks/pub</a>.  Although owntracks itself has no built-in authentication, I'd like to limit the dashboard to only user1, while allowing all authenticated users to reach the api. Owntrack's <a href="https://github.com/owntracks/recorder#nginx" rel="nofollow noreferrer">documentation</a> uses ngnix as an example, which I think in my case might look something like:</p>
  <pre><code>location /owntracks/dashboard/ {
       auth_basic              ....;
       proxy_pass              http://127.0.0.1:8083/;
       proxy_http_version      1.1;
       proxy_set_header        Host $host;
       proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header        X-Real-IP $remote_addr;
  }
  location /owntracks/pub/ {
       auth_basic              ....;
       proxy_pass              http://127.0.0.1:8083/pub/;
       proxy_http_version      1.1;
       proxy_set_header        Host $host;
       proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header        X-Real-IP $remote_addr;
  }
  </code></pre>
  <p>The problem is, I can't figure out how to configure something like this in Traefik.  As I understand it, you get one traefik.frontend.auth.basic &quot;label&quot; for this whole container?  Ideally, I'd prefer to set this up via labels in Owntracks' docker-compose file, to avoid the need for custom per-service config in Traefik itself (i.e. so I could rely on Traefik's automatic discovery of the service).</p>
  <p>Any pointers would be appreciated.</p>