Adding SSO to Apps Without Built-in Login, with Keycloak and Traefik forwardAuth
How I put Keycloak login in front of Prometheus, Alertmanager, the Traefik dashboard and other UIs with no login of their own: what Traefik's forwardAuth sends and does with the answer, the Middleware and annotation that make up the integration, and the ClusterRoles of URL patterns that decide which group sees which hostname.