LN apps with SSO using traefik as reverse proxy

.env

RTL_IMAGE=shahanafarooqui/rtl:0.12.3
THUNDERHUB_IMAGE=apotdevin/thunderhub:base-v0.13.13
TOR_IMAGE=lncm/tor:0.4.7.7
TOR_IP=10.21.21.11
LND_IMAGE=lightninglabs/lnd:v0.14.3-beta
LND_DATADIR=/home/umbrel/umbrel/app-data/lightning/data/lnd/
LND_IP=10.21.21.9
BITCOIND_IMAGE=lncm/bitcoind:v22.0
BITCOIND_DATADIR=/home/umbrel/umbrel/app-data/bitcoin/data/bitcoin/
BITCOIN_IP=10.21.21.8
BITCOIND_RPC_USER=umbrel
BITCOIND_RPC_PASSWORD=abcdefg
ELECTRS_DATADIR=/home/umbrel/umbrel/app-data/electrs/data/electrs/
TOR_DATADIR=/home/umbrel/umbrel/tor
LNSHELL_IMAGE=ghcr.io/nodi-gg/lightning-shell:bos-v12.13.1-buster
LNSHELL_PASSWORD=abcdefg
LNDG_PASSWORD=abcdefg
LNDG_IMAGE=ghcr.io/cryptosharks131/lndg:v1.1.1
RTL_PASSWORD=abcdefg
TIME_ZONE=Europe/Amsterdam
THUNDERHUB_IP=10.21.21.50
RTL_IP=10.21.21.51

configuration.yml

# authelia config for SSO
---
theme: auto
jwt_secret: besmartandchangethis

server:
  host: 0.0.0.0
  port: 9091
  path: "login"
  asset_path: "/config/assets"
log:
  level: debug

totp:
  disable: false
  issuer: unbrel
  algorithm: sha1
  digits: 6
  period: 30
  skew: 1
  secret_size: 32

authentication_backend:
  disable_reset_password: false
  file:
    path: /config/users_database.yml

password_policy:
  standard:
    enabled: false
    min_length: 8
    max_length: 0
    require_uppercase: true
    require_lowercase: true
    require_number: true
    require_special: true
  zxcvbn:
    enabled: false
    min_score: 3

access_control:
  default_policy: deny

  rules:
    - domain: 'umbrel'
      policy: two_factor
    - domain: 'umbrel'
      policy: two_factor

session:
  name: authelia_session
  domain: "umbrel"
  same_site: lax
  secret: besmartandchangethis
  expiration: 1h
  inactivity: 15m
  remember_me_duration: 14d

regulation:
  max_retries: 3
  find_time: 2m
  ban_time: 5m

storage:
  encryption_key: you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this
  local:
     path: /config/db.sqlite3

notifier:
  disable_startup_check: false
  filesystem:
    filename: /config/notification.txt

docker-compose.yml

version: "3.7"

services:
  traefik:
    image: "traefik:v2.7"
    container_name: "traefik"
    command:
      #- "--log.level=DEBUG"
      - "--providers.docker=true"
      - "--providers.file.directory=/traefik"
      - "--providers.file.watch=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.middlewares=lanwhitelist"
      - "--entrypoints.websecure.http.middlewares=lanwhitelist"
      - "--entrypoints.websecure.http.tls=true"
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.lanwhitelist.ipwhitelist.sourcerange=127.0.0.1/32, 192.168.10.0/22"
      - "traefik.http.middlewares.secured.chain.middlewares=authelia"
    networks:
      umbrel: {}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - './traefik:/traefik'
  rtl:
    image: ${RTL_IMAGE}
    depends_on: [ lnd ]
    volumes:
      - "shared_data:/shared_data"
      - ./rtl:/shared
      - ${LND_DATADIR}/tls.cert:/lnd/tls.cert:ro
      - ${LND_DATADIR}/data/chain/bitcoin/mainnet/admin.macaroon:/lnd/admin.macaroon:ro
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.rtl.rule=PathPrefix(`/rtl`)
      - traefik.http.routers.rtl.middlewares=secured
    networks:
      umbrel:
        ipv4_address: ${RTL_IP}
    environment:
      PORT: 3000
      HOST: ${RTL_IP}
      RTL_SSO: 0
      RTL_COOKIE_PATH: '/shared_data/.cookie'
      LOGOUT_REDIRECT_LINK: '/login/logout'
      RTL_CONFIG_PATH: /shared/config
      BITCOIND_CONFIG_PATH: ''
      CHANNEL_BACKUP_PATH: /shared/backup
      LN_IMPLEMENTATION: "LND"
      LN_SERVER_URL: "https://${LND_IP}:8080"
      MACAROON_PATH: "/lnd"
      CONFIG_PATH: "/lnd/lnd.conf"
  authelia:
    image: authelia/authelia
    container_name: authelia
    volumes:
      - ./authelia:/config
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.authelia.rule=PathPrefix(`/login`)'
      - 'traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/verify?rd=https://umbrel/login/'
      - 'traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true'
      - 'traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User, Remote-Groups'
    restart: unless-stopped
    networks:
      umbrel: {}
    environment:
      - TZ=${TIME_ZONE}      
  lndg:
    image: ${LNDG_IMAGE}
    restart: on-failure
    stop_grace_period: 1m
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.lndg.rule=PathPrefix(`/lndg`)
      - "traefik.http.middlewares.lndg-stripprefix.stripprefix.prefixes=/lndg"
      - traefik.http.routers.lndg.middlewares=secured,lndg-stripprefix
    volumes:
      - ${LND_DATADIR}:/root/.lnd:ro
      - ./lndg:/lndg/data
    command:
      - sh
      - -c
      - python initialize.py -net 'mainnet' -server '${LND_IP}:10009' -pw '${LNDG_PASSWORD}' -d && supervisord && python manage.py runserver 0.0.0.0:8889
    networks:
      umbrel: {}
  thunderhub:
    image: ${THUNDERHUB_IMAGE}
    depends_on: [ lnd ]
    volumes:
      - ./thunderhub:/data
      - ${LND_DATADIR}:/lnd:ro
      - "shared_data:/shared_data"
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.thunderhub.rule=PathPrefix(`/thub`) || PathPrefix(`/fonts`)
      - "traefik.http.middlewares.redirectfonts.replacepathregex.regex=^/fonts/(.*)"
      - "traefik.http.middlewares.redirectfonts.replacepathregex.replacement=/thub/fonts/$$1"
      - traefik.http.routers.thunderhub.middlewares=secured,redirectfonts
    networks:
      umbrel:
        ipv4_address: ${THUNDERHUB_IP}
    environment:
      PORT: 3000
      DANGEROUS_NO_SSO_AUTH: true
      HOST: ${THUNDERHUB_IP}
      SSO_SERVER_URL: "${LND_IP}:10009"
      SSO_MACAROON_PATH: "/lnd/data/chain/bitcoin/mainnet"
      SSO_CERT_PATH: "/lnd/tls.cert"
      COOKIE_PATH: "/shared_data/.cookie"
      NO_CLIENT_ACCOUNTS: "true"
      NO_VERSION_CHECK: "true"
      ACCOUNT_CONFIG_PATH: "/data/thubConfig.yaml"
      TOR_PROXY_SERVER: "socks://tor:9050"
      BASE_PATH: "/thub" 
  lnshell:
    image: ${LNSHELL_IMAGE}
    restart: on-failure
    stop_grace_period: 1m

    volumes:
      - ${LND_DATADIR}:/lnd:ro
      - ./lightningshell:/data
    networks:
      umbrel: {}
    labels:
      - "traefik.enable=true"
      - traefik.http.routers.lnshell.rule=PathPrefix(`/lnshell`)
      - "traefik.http.routers.lnshell.middlewares=secured,lnshell-stripprefix"
      - "traefik.http.middlewares.lnshell-stripprefix.stripprefix.prefixes=/lnshell"

    environment:
        USERNAME: admin
        APP_PASSWORD: ${LNSHELL_PASSWORD}
        BITCOIN_IP: ${BITCOIN_IP}
        BITCOIN_RPC_PORT: "8332"
        BITCOIN_RPC_USER: ${BITCOIND_RPC_USER}
        BITCOIN_RPC_PASS: ${BITCOIND_RPC_PASSWORD}
        LND_IP: ${LND_IP}
        LND_GRPC_PORT: 10009
  lnd:
    container_name: lnd
    image: ${LND_IMAGE}
    user: 1000:1000
    restart: unless-stopped
    depends_on: [ tor ]
    ports:
      - 9735:9735
      - 10009:10009
      - 8080:8080
    volumes:
      - ${LND_DATADIR}:/data/.lnd
    labels:
      - unbrel.coreapp=true
    environment:
      HOME: /data
    networks:
      umbrel:
        ipv4_address: 10.21.21.9
  bitcoin:
    container_name: bitcoin
    image: ${BITCOIND_IMAGE}
    restart: unless-stopped
    depends_on: [ tor ]
    volumes:
    - ./bitcoind/bitcoin.conf:/data/.bitcoin/bitcoin.conf
    - ${BITCOIND_DATADIR}:/data/.bitcoin
    ports:
      - 8333:8333
      - 8332:8332
    stop_grace_period: 15m30s
    labels:
      - unbrel.coreapp=true
    networks:
      umbrel:
        ipv4_address: 10.21.21.8
  tor:
    container_name: tor
    image: ${TOR_IMAGE}
    user: toruser
    labels:
      - unbrel.coreapp=true
    restart: unless-stopped
    volumes:
      - ${TOR_DATADIR}/torrc:/etc/tor/torrc
      - ${TOR_DATADIR}:/var/lib/tor
    networks:
      umbrel:
        ipv4_address: 10.21.21.11
volumes:
  shared_data:
networks:
  umbrel:
    name: umbrel_main_network
    ipam:
      driver: default
      config:
        - subnet: "10.21.0.0/16"