Traefik

Traefik is the ingress router for the Lounge (Zone 4) — the reverse proxy that receives outside traffic and routes it to the right Commons service. It also enforces forward authentication: before a request reaches a protected service, Traefik hands it to an Authentik outpost to verify who is asking.

That makes Traefik the front of the gate that lets certified members operate on Range forks. The gate as a whole — Traefik, the Authentik outpost, and the Guacamole session broker — is described as a system in Systems (guard); here it is just the router and its forward-auth role. Ordinary public-read access to the forge’s projects also passes through Traefik, without the gate.