Gate any app in one line

Empire Access is a Traefik forwardAuth middleware. Attach it to a router and every request is verified before it reaches the app.

1. Reference the middleware

The gate u7-empire-access-auth already runs. Point any router at it:

http:
  routers:
    my-app:
      rule: "Host(`app.example.com`)"
      middlewares: [u7-empire-access-auth]   # <- the whole integration
      service: my-app-svc

2. What the gate does

Request state	Result
Valid `empire_sso` cookie	200 + `X-Empire-User` / `X-Empire-Owner` headers passed to app
No / invalid identity	302 → hosted login page, back to original URL after sign-in

3. Harden it (Team & up)

Chain the included WAF-lite middlewares — mined from the retired EmpireCDN nginx+ModSec edge, reborn as Traefik-native:

middlewares: [empire-access-ratelimit, empire-access-secheaders, u7-empire-access-auth]

empire-access-ratelimit — per-client average/burst request cap (abuse / credential-stuffing brake).
empire-access-secheaders — HSTS, X-Frame-Options DENY, no-sniff, referrer policy.

4. Turn on the free CDN & DNS (bundled)

The CDN and DNS layers are free. Add the CDN with one label; DNS is managed for you.

middlewares: [empire-edge-cdn]                 # FREE: cache + compression + headers
# or the whole stack in one label:
middlewares: [empire-edge-full]                # CDN + WAF-lite + access gate

empire-edge-compress — gzip / brotli response compression (bandwidth cut).
empire-edge-cache — emits Cache-Control: public, max-age=300, stale-while-revalidate=86400 so the CF edge (or any downstream proxy) serves static assets from cache.
empire-edge-cdn — the free chain: compression + edge cache + hardened headers. The former EmpireCDN, reborn Traefik-native.
Managed DNS — DNS records live on Cloudflare (or self-hosted CoreDNS = EmpireDNS); zone/record CRUD + LetsEncrypt TLS are included free.

Get started