coolify-sso

SSO protection for Coolify apps including preview deployments,
built on oauth2-proxy and Traefik
forward-auth.

Coolify regenerates container labels on every deployment and rebuilds them from scratch
for previews — so the usual “attach a middleware via a label” approach can never protect
preview URLs. coolify-sso works from outside the deploy pipeline instead: a small daemon
watches docker events and shadows each guarded container’s router with a higher-priority
Traefik file-provider router that requires login.

Next Installation