From 3328fb6ca7be89483900fa002498ba7730e55bba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20Mass=C3=A9?= <nicolas.masse@itix.fr>
Date: Thu, 23 Jul 2026 10:36:41 +0000
Subject: [PATCH] enable apikey auth in traefik

---
 cookbooks/traefik/README.md                    | 17 +++++++++++++++++
 cookbooks/traefik/config/examples/traefik.yaml | 13 +++++++++++++
 cookbooks/traefik/traefik.container            |  5 +++++
 3 files changed, 35 insertions(+)

diff --git a/cookbooks/traefik/README.md b/cookbooks/traefik/README.md
index 097be77..d7d1570 100644
--- a/cookbooks/traefik/README.md
+++ b/cookbooks/traefik/README.md
@@ -37,6 +37,23 @@ EntryPoint=/usr/local/bin/traefik
 Exec=--foo=bar --baz=qux ...
 ```
 
+## Community plugins
+
+Hosted (community) plugins are declared in the static configuration under
+`experimental.plugins` in `traefik.yaml`. They **cannot** be declared from the
+per-application dynamic configuration (`conf.d/`), so the declaration must live in
+`traefik.yaml` even when the middleware is only consumed by another cookbook.
+
+Traefik downloads and compiles plugins at startup into a `plugins-storage`
+directory **relative to its working directory**. Since the image `WORKDIR` is `/`
+(not writable by the unprivileged `traefik` user), the container sets
+`WorkingDir=/var/lib/traefik` so plugins land in the persistent, writable state
+volume.
+
+The example configuration ships the
+[`api-key-and-token-middleware`](https://plugins.traefik.io/plugins/66f6ac697dd5a6c3095befd3/api-key-and-token-middleware)
+plugin, used by the `vllm` cookbook to enforce Bearer/API-key authentication.
+
 ## Usage
 
 In a separate terminal, follow the logs.
diff --git a/cookbooks/traefik/config/examples/traefik.yaml b/cookbooks/traefik/config/examples/traefik.yaml
index e6e8fea..ad83654 100644
--- a/cookbooks/traefik/config/examples/traefik.yaml
+++ b/cookbooks/traefik/config/examples/traefik.yaml
@@ -24,6 +24,19 @@ providers:
     directory: /etc/traefik/conf.d/
     watch: true
 
+# Hosted (community) plugins. Static plugin declarations MUST live here — they
+# cannot be declared from the per-application dynamic configuration (conf.d/).
+# Traefik downloads and compiles them at startup into ./plugins-storage (hence
+# the WorkingDir in traefik.container).
+#
+# api-key-and-token-middleware: Bearer/API-key authentication middleware, used
+# e.g. by the vLLM cookbook (see its conf.d/vllm.yaml).
+experimental:
+  plugins:
+    traefik-api-token-middleware:
+      moduleName: "github.com/Aetherinox/traefik-api-token-middleware"
+      version: "v0.1.4"
+
 # certificatesResolvers:
 #   le:
 #     acme:
diff --git a/cookbooks/traefik/traefik.container b/cookbooks/traefik/traefik.container
index 4180219..3295f63 100644
--- a/cookbooks/traefik/traefik.container
+++ b/cookbooks/traefik/traefik.container
@@ -23,6 +23,11 @@ AddCapability=CAP_NET_BIND_SERVICE
 Volume=/var/lib/quadlets/traefik:/var/lib/traefik:z
 Volume=/etc/quadlets/traefik:/etc/traefik:z
 
+# Run from the persistent, writable state directory so that hosted plugins
+# (experimental.plugins) can be downloaded and compiled into ./plugins-storage.
+# The image WORKDIR is "/", which is not writable by the unprivileged user.
+WorkingDir=/var/lib/traefik
+
 # Network
 Network=host