Dokploy Access Control#

Dokploy uses a layered access-control model that operates at three distinct levels:

1. Network/routing layer — Traefik exposes (or hides) the Dokploy UI and user applications.
2. Authentication gate — enforceSSO controls who can log in to Dokploy itself; forward-auth (OAuth2 proxy) adds OIDC protection to deployed applications.
3. Deployment gate — remoteServersOnly controls where workloads can be deployed.

All three layers apply only to self-hosted installations. Cloud deployments ignore remoteServersOnly and enforceSSO entirely 1.

Traefik Exposure of the Dokploy UI#

On first boot, createDefaultServerTraefikConfig() writes dokploy.yml into the dynamic Traefik directory. It creates:

• Router dokploy-router-app — matches Host(\dokploy.docker.localhost`) && PathPrefix(`/`)on theweb` (HTTP) entry point.
• Service dokploy-service-app — load-balances to http://dokploy:<PORT> (default 3000) with passHostHeader: true.

This default config is unprotected (no authentication middleware). The Dokploy panel is exposed on HTTP port 80; HTTPS is added by updating the domain settings via the UI, which overwrites this config with a production router using the websecure entry point and a Let's Encrypt cert resolver 2.

Important: The Traefik API itself is configured with insecure: true 3, meaning it is accessible without authentication on its default port. In production, restrict access to this port at the firewall level.

enforceSSO — Restrict Login to SSO Only#

When enforceSSO = true:

• The login page (pages/index.tsx) fetches the setting via server-side props and passes it to the <SignInWithSSO enforce={true} /> component.
• The component hides the email/password form and renders the SSO button only 5.
• A public tRPC query sso.enforceSSO allows the frontend to check this flag before any authenticated session exists 6.

Enforcement is UI-only — the email/password API routes still exist. Pair with OIDC + forward-auth if you need hard network-layer enforcement.

remoteServersOnly — Block Local Deployments#

When remoteServersOnly = true, routers for applications, Compose stacks, and databases check (IS_CLOUD || webServerSettings?.remoteServersOnly) && !input.serverId and reject the mutation with a TRPCError if no serverId is provided. This forces all resources to be deployed on an explicitly designated remote server rather than the local Dokploy host. The check lives within each individual resource router — there is no central middleware for it.

Forward-Auth (SSO Gate for Deployed Applications)#

Forward-auth adds an OIDC authentication layer in front of user-deployed applications — it is separate from Dokploy's own login. It is implemented as a Docker Swarm service dokploy-forward-auth running oauth2-proxy v7.6.0 on port 4180, attached to dokploy-network.

Setup#

Configured via SetupForwardAuthOptions:

• oidc — clientId, clientSecret, issuer URL, optional scopes and skipDiscovery
• authDomain — the domain that hosts /oauth2/* endpoints
• cookieSecret — 16/24/32-byte HMAC-derived secret 7
• emailDomains — allowed email domains (default *)

Traefik Integration#

For each domain with forwardAuthEnabled = true, Dokploy writes two Traefik middlewares 8:

1. forward-auth-{appName}-{key} — forwardAuth middleware pointing to {scheme}://{authDomain}/oauth2/auth; forwards X-Auth-Request-User, X-Auth-Request-Email, X-Auth-Request-Preferred-Username, Authorization headers downstream.
2. forward-auth-{appName}-{key}-errors — intercepts 401–403 responses and redirects to /oauth2/sign_in?rd={url}.

A central router forward-auth-oauth on authDomain matches PathPrefix(\/oauth2/`)` with priority 1000 9 to handle the OAuth2 callback and sign-in flow.

The forwardAuthEnabled flag lives on each Domain record; it is toggled per-domain and is documented as part of the Traefik domain routing config.

API / tRPC Procedure Reference#

The enterpriseProcedure wrapper validates both role (owner/admin) and a valid enterprise license on every call 10. Read queries on cloud return null or "" for self-hosted-only fields.

Key Source Files#