Traefik
Reverse Proxy & GatewaysCloud-native reverse proxy and load balancer
Replaces HAProxy, AWS ELB
TLS termination and routing
Reverse Proxy & SSO Stack
One domain, valid TLS, single sign-on for every service.
Traefik terminates TLS and routes every service through one entry point with automatic Let's Encrypt certificates and Docker label configuration. Authentik puts real single sign-on (OIDC, SAML, LDAP, forward-auth) in front of apps that have weak or no authentication of their own, and CrowdSec watches the logs to ban the internet's background noise of scanners and brute-forcers. This trio is the difference between exposing services and running them properly.
The apps and their roles
Last reviewed Oct 11, 2026 · 657 words
Build this stack in layers and test each one before adding the next: Traefik with working certificates, then authentik in front of a single app, then CrowdSec reading Traefik's logs. The combined floor is about 1,408 MB of RAM by the directory's estimates, and authentik is most of it at 1,024 MB; Traefik is listed at 128 MB and CrowdSec at 256 MB. All three are rated Medium, and debugging all three at once is how a weekend disappears.
What talks to what
Traefik is the only thing exposed to the internet. It terminates TLS with Let's Encrypt certificates, discovers services from Docker labels, and routes each hostname to its container.
authentik plugs in two ways. For apps that speak OIDC or SAML, the app redirects to authentik for login and gets back a signed identity; the app knows who you are. For apps with weak or no authentication, Traefik's forwardAuth middleware asks authentik's outpost whether each request is allowed before passing it on; the app never sees the login at all. authentik can also act as an LDAP provider for apps that only understand that.
CrowdSec reads Traefik's access logs, detects scanning and brute-force patterns, and makes ban decisions. It does not block anything by itself. A separately installed bouncer enforces the decisions, either inside Traefik as a middleware or at the host firewall.
| Layer | App | Integration point | Directory RAM estimate |
|---|---|---|---|
| Routing and TLS | Traefik | Docker labels, ports 80 and 443 | 128 MB |
| Identity | authentik | OIDC, SAML, LDAP, forwardAuth | 1,024 MB |
| Intrusion prevention | CrowdSec | Traefik access log, bouncer | 256 MB |
Deploy in this order
Traefik first. Get one service answering on its hostname with a valid certificate, and make sure the access log is written to a file or volume, because CrowdSec will need it later. If Traefik reads the Docker socket for discovery, mount it read-only or through a socket proxy; it is root-equivalent access.
authentik second. Protect one low-stakes app with forwardAuth, confirm the redirect loop works, then move on to OIDC for apps that support it natively. Set up MFA for your own account before protecting anything important. Keep a way into Traefik's config that does not go through authentik, or one bad policy locks you out of everything.
CrowdSec third, once logs exist. Give it the Traefik log path, install the collection that parses it, add a bouncer, and whitelist your own LAN and VPN ranges before the first false positive bans you from your own house.
Should every app go behind forward-auth?
No, and doing so is the most common mistake with this stack. Forward-auth works for anything you use in a browser, but it breaks any client that is not a browser: mobile apps, desktop sync clients, API integrations and media players expect to talk to the app's own login or API, and receive an authentik redirect page instead. Jellyfin's TV apps, Bitwarden clients against Vaultwarden, and Nextcloud's desktop client are typical casualties. Use OIDC where the app supports it, forward-auth only for browser-only admin tools, and leave apps with good built-in auth and native clients alone.
Backups
Traefik's state is its config files and the certificate store; losing the store means reissuing every certificate. authentik's state is its Postgres database, which holds every user, flow and provider; dump it nightly. CrowdSec's local decisions can be rebuilt, but its config and whitelists should be in version control.
What I'd do
Traefik with one app this weekend, authentik protecting your admin dashboards next, CrowdSec once you can see real traffic in the logs. If authentik's 1 GB floor is more than you want, the authentik vs Authelia guide covers the lighter option, and Caddy vs Traefik covers the proxy choice.