Update go1.12 -> go1.13 + update dependencies + mod tidy

Simplify oauth server testing
Multiple provider support + OIDC provider
2020-01-27 12:19:29 +00:00 · 2020-01-27 12:19:29 +00:00 · 2020-01-27 12:19:29 +00:00 · 2019-09-30 10:53:01 +01:00 · 2019-09-30 10:44:46 +01:00 · 2019-09-20 16:28:11 +01:00
34 changed files with 3932 additions and 1049 deletions
--- a/.dockerignore
+++ b/.dockerignore
@ -0,0 +1,2 @@
+example
+.travis.yml
--- a/.travis.yml
+++ b/.travis.yml
@ -1,7 +1,5 @@
 language: go
 sudo: false
 go:
-  - "1.10"
-install:
-  - go get github.com/namsral/flag
-  - go get github.com/op/go-logging
+  - "1.12"
+script: env GO111MODULE=on go test -v ./...
--- a/15
+++ b/15
@ -1,18 +1,15 @@
-FROM golang:1.10-alpine as builder
+FROM golang:1.13-alpine as builder

 # Setup
-RUN mkdir /app
-WORKDIR /app
+RUN mkdir -p /go/src/github.com/thomseddon/traefik-forward-auth
+WORKDIR /go/src/github.com/thomseddon/traefik-forward-auth

 # Add libraries
-RUN apk add --no-cache git && \
-  go get "github.com/namsral/flag" && \
-  go get "github.com/op/go-logging" && \
-  apk del git
+RUN apk add --no-cache git

 # Copy & build
-ADD . /app/
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix nocgo -o /traefik-forward-auth .
+ADD . /go/src/github.com/thomseddon/traefik-forward-auth/
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -installsuffix nocgo -o /traefik-forward-auth github.com/thomseddon/traefik-forward-auth/cmd

 # Copy into scratch container
 FROM scratch
--- a/Dockerfile.arm
+++ b/Dockerfile.arm
@ -0,0 +1,18 @@
+FROM golang:1.12-alpine as builder
+
+# Setup
+RUN mkdir -p /go/src/github.com/thomseddon/traefik-forward-auth
+WORKDIR /go/src/github.com/thomseddon/traefik-forward-auth
+
+# Add libraries
+RUN apk add --no-cache git
+
+# Copy & build
+ADD . /go/src/github.com/thomseddon/traefik-forward-auth/
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm GO111MODULE=on go build -a -installsuffix nocgo -o /traefik-forward-auth github.com/thomseddon/traefik-forward-auth/cmd
+
+# Copy into scratch container
+FROM scratch
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /traefik-forward-auth ./
+ENTRYPOINT ["./traefik-forward-auth"]
--- a/Dockerfile.arm64
+++ b/Dockerfile.arm64
@ -0,0 +1,18 @@
+FROM golang:1.12-alpine as builder
+
+# Setup
+RUN mkdir -p /go/src/github.com/thomseddon/traefik-forward-auth
+WORKDIR /go/src/github.com/thomseddon/traefik-forward-auth
+
+# Add libraries
+RUN apk add --no-cache git
+
+# Copy & build
+ADD . /go/src/github.com/thomseddon/traefik-forward-auth/
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=arm64 GO111MODULE=on go build -a -installsuffix nocgo -o /traefik-forward-auth github.com/thomseddon/traefik-forward-auth/cmd
+
+# Copy into scratch container
+FROM scratch
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /traefik-forward-auth ./
+ENTRYPOINT ["./traefik-forward-auth"]
--- a/5
+++ b/5
@ -0,0 +1,5 @@
+
+format:
+	gofmt -w -s internal/*.go internal/provider/*.go cmd/*.go
+
+.PHONY: format
--- a/README.md
+++ b/README.md
@ -1,59 +1,335 @@

-# Traefik Forward Auth [![Build Status](https://travis-ci.org/thomseddon/traefik-forward-auth.svg?branch=master)](https://travis-ci.org/thomseddon/traefik-forward-auth)
+# Traefik Forward Auth [![Build Status](https://travis-ci.org/thomseddon/traefik-forward-auth.svg?branch=master)](https://travis-ci.org/thomseddon/traefik-forward-auth) [![Go Report Card](https://goreportcard.com/badge/github.com/thomseddon/traefik-forward-auth)](https://goreportcard.com/report/github.com/thomseddon/traefik-forward-auth) ![Docker Pulls](https://img.shields.io/docker/pulls/thomseddon/traefik-forward-auth.svg) [![GitHub release](https://img.shields.io/github/release/thomseddon/traefik-forward-auth.svg)](https://GitHub.com/thomseddon/traefik-forward-auth/releases/)

-A minimal forward authentication service that provides Google oauth based login and authentication for the traefik reverse proxy.

+A minimal forward authentication service that provides Google oauth based login and authentication for the [traefik](https://github.com/containous/traefik) reverse proxy/load balancer.

 ## Why?

- Seamlessly overlays any http service with a single endpoint (see: `-url-path` in [Configuration](#configuration))
+- Seamlessly overlays any http service with a single endpoint (see: `url-path` in [Configuration](#configuration))
 - Supports multiple domains/subdomains by dynamically generating redirect_uri's
+- Allows authentication to be selectively applied/bypassed based on request parameters (see `rules` in [Configuration](#configuration)))
+- Supports use of centralised authentication host/redirect_uri (see `auth-host` in [Configuration](#configuration)))
 - Allows authentication to persist across multiple domains (see [Cookie Domains](#cookie-domains))
- Supports extended authentication beyond Google token lifetime (see: `-lifetime` in [Configuration](#configuration))
+- Supports extended authentication beyond Google token lifetime (see: `lifetime` in [Configuration](#configuration))

-## Quick Start
+# Contents

-See the (examples) directory for example docker compose and traefik configuration files that demonstrates the forward authentication configuration for traefik and passing required configuration values to traefik-forward-auth.
+- [Releases](#releases)
+- [Usage](#usage)
+  - [Simple](#simple)
+  - [Advanced](#advanced)
+  - [OAuth Configuration](#oauth-configuration)
+- [Configuration](#configuration)
+  - [Overview](#overview)
+  - [Option Details](#option-details)
+- [Concepts](#concepts)
+  - [Forwarded Headers](#forwarded-headers)
+  - [User Restriction](#user-restriction)
+  - [Operation Modes](#operation-modes)
+    - [Overlay Mode](#overlay-mode)
+    - [Auth Host Mode](#auth-host-mode)
+- [Copyright](#copyright)
+- [License](#license)

-## Configuration
+## Releases

-The following configuration is supported:
+We recommend using the `2` tag on docker hub.

+You can also use the latest incremental releases found on [docker hub](https://hub.docker.com/r/thomseddon/traefik-forward-auth/tags) and [github](https://github.com/thomseddon/traefik-forward-auth/releases).

-|Flag                   |Type  |Description|
-|-----------------------|------|-----------|
-|-client-id|string|*Google Client ID (required)|
-|-client-secret|string|*Google Client Secret (required)|
-|-config|string|Path to config file|
-|-cookie-domains|string|Comma separated list of cookie domains|
-|-cookie-name|string|Cookie Name (default "_forward_auth")|
-|-cookie-secret|string|*Cookie secret (required)|
-|-cookie-secure|bool|Use secure cookies (default true)|
-|-csrf-cookie-name|string|CSRF Cookie Name (default "_forward_auth_csrf")|
-|-direct|bool|Run in direct mode (use own hostname as oppose to <br>X-Forwarded-Host, used for testing/development)
-|-domain|string|Comma separated list of email domains to allow|
-|-lifetime|int|Session length in seconds (default 43200)|
-|-url-path|string|Callback URL (default "_oauth")|
+#### Upgrade Guide

-Configuration can also be supplied as environment variables (use upper case and swap `-`'s for `_`'s e.g. `-client-id` becomes `CLIENT_ID`)
+v2 was released in June 2019, whilst this is fully backwards compatible, a number of configuration options were modified, please see the [upgrade guide](https://github.com/thomseddon/traefik-forward-auth/wiki/v2-Upgrade-Guide) to prevent warnings on startup and ensure you are using the current configuration.

-Configuration can also be supplied via a file, you can specify the location with `-config` flag, the format is `flag value` one per line, e.g. `client-id your-client-id`)
+## Usage

-## OAuth Configuration
+#### Simple:

-Head to https://console.developers.google.com & make sure you've switched to the correct email account.
+See below for instructions on how to setup your [OAuth Configuration](#oauth-configuration).
+
+docker-compose.yml:
+
+```yaml
+version: '3'
+
+services:
+  traefik:
+    image: traefik:1.7
+    ports:
+      - "8085:80"
+    volumes:
+      - ./traefik.toml:/traefik.toml
+      - /var/run/docker.sock:/var/run/docker.sock
+
+  traefik-forward-auth:
+    image: thomseddon/traefik-forward-auth:2
+    environment:
+      - CLIENT_ID=your-client-id
+      - CLIENT_SECRET=your-client-secret
+      - SECRET=something-random
+      - INSECURE_COOKIE=true # Example assumes no https, do not use in production
+
+  whoami:
+    image: emilevauge/whoami:latest
+    labels:
+      - "traefik.frontend.rule=Host:whoami.mycompany.com"
+```
+
+traefik.toml:
+
+```toml
+[entryPoints]
+    [entryPoints.http]
+    address = ":80"
+
+    [entryPoints.http.auth.forward]
+    address = "http://traefik-forward-auth:4181"
+    authResponseHeaders = ["X-Forwarded-User"]
+
+[docker]
+endpoint = "unix:///var/run/docker.sock"
+network = "traefik"
+```
+
+#### Advanced:
+
+Please see the examples directory for a more complete [docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose.yml) and full [traefik.toml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/traefik.toml).
+
+Also in the examples directory is [docker-compose-auth-host.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml) which shows how to configure a central auth host, along with some other options.
+
+#### OAuth Configuration
+
+Head to https://console.developers.google.com and make sure you've switched to the correct email account.

 Create a new project then search for and select "Credentials" in the search bar. Fill out the "OAuth Consent Screen" tab.

-Click, "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth)
+Click "Create Credentials" > "OAuth client ID". Select "Web Application", fill in the name of your app, skip "Authorized JavaScript origins" and fill "Authorized redirect URIs" with all the domains you will allow authentication from, appended with the `url-path` (e.g. https://app.test.com/_oauth)

-## Cookie Domains
+## Configuration

-You can supply a comma separated list of cookie domains, if the host of the original request is a subdomain of any given cookie domain, the authentication cookie will set with the given domain.
+### Overview

-For example, if cookie domain is `test.com` and a request comes in on `app1.test.com`, the cookie will be set for the whole `test.com` domain. As such, if another request is forwarded for authentication from `app2.test.com`, the original cookie will be sent and so the request will be allowed without further authentication.
+The following configuration options are supported:

-Beware however, if using cookie domains whilst running multiple instances of traefik/traefik-forward-auth for the same domain, the cookies will clash. You can fix this by using the same `cookie-secret` in both instances, or using a different `cookie-name` on each.
+```
+Usage:
+  traefik-forward-auth [OPTIONS]
+
+Application Options:
+  --log-level=[trace|debug|info|warn|error|fatal|panic] Log level (default: warn) [$LOG_LEVEL]
+  --log-format=[text|json|pretty]                       Log format (default: text) [$LOG_FORMAT]
+  --auth-host=                                          Single host to use when returning from 3rd party auth [$AUTH_HOST]
+  --config=                                             Path to config file [$CONFIG]
+  --cookie-domain=                                      Domain to set auth cookie on, can be set multiple times [$COOKIE_DOMAIN]
+  --insecure-cookie                                     Use insecure cookies [$INSECURE_COOKIE]
+  --cookie-name=                                        Cookie Name (default: _forward_auth) [$COOKIE_NAME]
+  --csrf-cookie-name=                                   CSRF Cookie Name (default: _forward_auth_csrf) [$CSRF_COOKIE_NAME]
+  --default-action=[auth|allow]                         Default action (default: auth) [$DEFAULT_ACTION]
+  --domain=                                             Only allow given email domains, can be set multiple times [$DOMAIN]
+  --lifetime=                                           Lifetime in seconds (default: 43200) [$LIFETIME]
+  --url-path=                                           Callback URL Path (default: /_oauth) [$URL_PATH]
+  --secret=                                             Secret used for signing (required) [$SECRET]
+  --whitelist=                                          Only allow given email addresses, can be set multiple times [$WHITELIST]
+  --rule.<name>.<param>=                               Rule definitions, param can be: "action" or "rule"
+
+Google Provider:
+  --providers.google.client-id=                         Client ID [$PROVIDERS_GOOGLE_CLIENT_ID]
+  --providers.google.client-secret=                     Client Secret [$PROVIDERS_GOOGLE_CLIENT_SECRET]
+  --providers.google.prompt=                            Space separated list of OpenID prompt options [$PROVIDERS_GOOGLE_PROMPT]
+
+Help Options:
+  -h, --help                                            Show this help message
+```
+
+All options can be supplied in any of the following ways, in the following precedence (first is highest precedence):
+
+1. **Command Arguments/Flags** - As shown above
+2. **Environment Variables** - As shown in square brackets above
+3. **File**
+    1. Use INI format (e.g. `url-path = _oauthpath`)
+    2. Specify the file location via the `--config` flag or `$CONFIG` environment variable
+    3. Can be specified multiple times, each file will be read in the order they are passed
+
+### Option Details
+
+- `auth-host`
+
+  When set, when a user returns from authentication with a 3rd party provider they will always be forwarded to this host. By using one central host, this means you only need to add this `auth-host` as a valid redirect uri to your 3rd party provider.
+
+  The host should be specified without protocol or path, for example:
+
+   ```
+   --auth-host="auth.example.com"
+   ```
+
+   For more details, please also read the [Auth Host Mode](#auth-host-mode), operation mode in the concepts section.
+
+   Please Note - this should be considered advanced usage, if you are having problems please try disabling this option and then re-read the [Auth Host Mode](#auth-host-mode) section.
+
+- `config`
+
+   Used to specify the path to a configuration file, can be set multiple times, each file will be read in the order they are passed. Options should be set in an INI format, for example:
+
+   ```
+   url-path = _oauthpath
+   ```
+
+- `cookie-domain`
+
+  When set, if a user successfully completes authentication, then if the host of the original request requiring authentication is a subdomain of a given cookie domain, then the authentication cookie will be set for the higher level cookie domain. This means that a cookie can allow access to multiple subdomains without re-authentication. Can be specificed multiple times.
+
+   For example:
+   ```
+   --cookie-domain="example.com"  --cookie-domain="test.org"
+   ```
+
+   For example, if the cookie domain `test.com` has been set, and a request comes in on `app1.test.com`, following authentication the auth cookie will be set for the whole `test.com` domain. As such, if another request is forwarded for authentication from `app2.test.com`, the original cookie will be sent and so the request will be allowed without further authentication.
+
+   Beware however, if using cookie domains whilst running multiple instances of traefik/traefik-forward-auth for the same domain, the cookies will clash. You can fix this by using a different `cookie-name` in each host/cluster or by using the same `cookie-secret` in both instances.
+
+- `insecure-cookie`
+
+   If you are not using HTTPS between the client and traefik, you will need to pass the `insecure-cookie` option which will mean the `Secure` attribute on the cookie will not be set.
+
+- `cookie-name`
+
+   Set the name of the cookie set following successful authentication.
+
+   Default: `_forward_auth`
+
+- `csrf-cookie-name`
+
+   Set the name of the temporary CSRF cookie set during authentication.
+
+   Default: `_forward_auth_csrf`
+
+- `default-action`
+
+   Specifies the behavior when a request does not match any [rules](#rules). Valid options are `auth` or `allow`.
+
+   Default: `auth` (i.e. all requests require authentication)
+
+- `domain`
+
+   When set, only users matching a given domain will be permitted to access.
+
+   For example, setting `--domain=example.com --domain=test.org` would mean that only users from example.com or test.org will be permitted. So thom@example.com would be allowed but thom@another.com would not.
+
+   For more details, please also read [User Restriction](#user-restriction) in the concepts section.
+
+- `lifetime`
+
+   How long a successful authentication session should last, in seconds.
+
+   Default: `43200` (12 hours)
+
+- `url-path`
+
+   Customise the path that this service uses to handle the callback following authentication.
+
+   Default: `/_oauth`
+
+   Please note that when using the default [Overlay Mode](#overlay-mode) requests to this exact path will be intercepted by this service and not forwarded to your application. Use this option (or [Auth Host Mode](#auth-host-mode)) if the default `/_oauth` path will collide with an existing route in your application.
+
+- `secret`
+
+   Used to sign cookies authentication, should be a random (e.g. `openssl rand -hex 16`)
+
+- `whitelist`
+
+   When set, only specified users will be permitted.
+
+   For example, setting `--whitelist=thom@example.com --whitelist=alice@example.com` would mean that only those two exact users will be permitted. So thom@example.com would be allowed but john@example.com would not.
+
+   For more details, please also read [User Restriction](#user-restriction) in the concepts section.
+
+- `rule`
+
+   Specify selective authentication rules. Rules are specified in the following format: `rule.<name>.<param>=<value>`
+
+   - `<name>` can be any string and is only used to group rules together
+   - `<param>` can be:
+       - `action` - same usage as [`default-action`](#default-action), supported values:
+           - `auth` (default)
+           - `allow`
+       - `rule` - a rule to match a request, this uses traefik's v2 rule parser for which you can find the documentation here: https://docs.traefik.io/v2.0/routing/routers/#rule, supported values are summarised here:
+           - ``Headers(`key`, `value`)``
+           - ``HeadersRegexp(`key`, `regexp`)``
+           - ``Host(`example.com`, ...)``
+           - ``HostRegexp(`example.com`, `{subdomain:[a-z]+}.example.com`, ...)``
+           - ``Method(methods, ...)``
+           - ``Path(`path`, `/articles/{category}/{id:[0-9]+}`, ...)``
+           - ``PathPrefix(`/products/`, `/articles/{category}/{id:[0-9]+}`)``
+           - ``Query(`foo=bar`, `bar=baz`)``
+
+   For example:
+   ```
+   rule.1.action = allow
+   rule.1.rule = PathPrefix(`/api/public`) && Headers(`Content-Type`, `application/json`)
+
+   rule.two.action = allow
+   rule.two.rule = Path(`/public`)
+   ```
+
+   In the above example, the first rule would allow requests that begin with `/api/public` and contain the `Content-Type` header with a value of `application/json`. It would also allow requests that had the exact path `/public`.
+
+## Concepts
+
+### User Restriction
+
+You can restrict who can login with the following parameters:
+
+* `domain` - Use this to limit logins to a specific domain, e.g. test.com only
+* `whitelist` - Use this to only allow specific users to login e.g. thom@test.com only
+
+Note, if you pass `whitelist` then only this is checked and `domain` is effectively ignored.
+
+### Forwarded Headers
+
+The authenticated user is set in the `X-Forwarded-User` header, to pass this on add this to the `authResponseHeaders` config option in traefik, as shown [here](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-dev.yml).
+
+### Operation Modes
+
+#### Overlay Mode
+
+Overlay is the default operation mode, in this mode the authorisation endpoint is overlaid onto any domain. By default the `/_oauth` path is used, this can be customised using the `url-path` option.
+
+The user flow will be:
+
+1. Request to `www.myapp.com/home`
+2. User redirected to Google login
+3. After Google login, user is redirected to `www.myapp.com/_oauth`
+4. Token, user and CSRF cookie is validated (this request in intercepted and is never passed to your application)
+5. User is redirected to `www.myapp.com/home`
+6. Request is allowed
+
+As the hostname in the `redirect_uri` is dynamically generated based on the original request, every hostname must be permitted in the Google OAuth console (e.g. `www.myappp.com` would need to be added in the above example)
+
+#### Auth Host Mode
+
+This is an optional mode of operation that is useful when dealing with a large number of subdomains, it is activated by using the `auth-host` config option (see [this example docker-compose.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml)).
+
+For example, if you have a few applications: `app1.test.com`, `app2.test.com`, `appN.test.com`, adding every domain to Google's console can become laborious.
+To utilise an auth host, permit domain level cookies by setting the cookie domain to `test.com` then set the `auth-host` to: `auth.test.com`.
+
+The user flow will then be:
+
+1. Request to `app10.test.com/home/page`
+2. User redirected to Google login
+3. After Google login, user is redirected to `auth.test.com/_oauth`
+4. Token, user and CSRF cookie is validated, auth cookie is set to `test.com`
+5. User is redirected to `app10.test.com/home/page`
+6. Request is allowed
+
+With this setup, only `auth.test.com` must be permitted in the Google console.
+
+Two criteria must be met for an `auth-host` to be used:
+
+1. Request matches given `cookie-domain`
+2. `auth-host` is also subdomain of same `cookie-domain`
+
+Please note: For Auth Host mode to work, you must ensure that requests to your auth-host are routed to the traefik-forward-auth container, as demonstrated with the service labels in the [docker-compose-auth.yml](https://github.com/thomseddon/traefik-forward-auth/blob/master/examples/docker-compose-auth-host.yml) example.

 ## Copyright

--- a/cmd/main.go
+++ b/cmd/main.go
@ -0,0 +1,30 @@
+package main
+
+import (
+	"net/http"
+
+	internal "github.com/thomseddon/traefik-forward-auth/internal"
+)
+
+// Main
+func main() {
+	// Parse options
+	config := internal.NewGlobalConfig()
+
+	// Setup logger
+	log := internal.NewDefaultLogger()
+
+	// Perform config validation
+	config.Validate()
+
+	// Build server
+	server := internal.NewServer()
+
+	// Attach router to default server
+	http.HandleFunc("/", server.RootHandler)
+
+	// Start
+	log.Debugf("Starting with options: %s", config)
+	log.Info("Listening on :4181")
+	log.Info(http.ListenAndServe(":4181", nil))
+}
--- a/examples/docker-compose-auth-host.yml
+++ b/examples/docker-compose-auth-host.yml
@ -0,0 +1,44 @@
+version: '3'
+
+services:
+  traefik:
+    image: traefik
+    command: -c /traefik.toml --logLevel=DEBUG
+    ports:
+      - "8085:80"
+      - "8086:8080"
+    networks:
+      - traefik
+    volumes:
+      - ./traefik.toml:/traefik.toml
+      - /var/run/docker.sock:/var/run/docker.sock
+
+  whoami1:
+    image: emilevauge/whoami
+    networks:
+      - traefik
+    labels:
+      - "traefik.backend=whoami"
+      - "traefik.enable=true"
+      - "traefik.frontend.rule=Host:whoami.yourdomain.com"
+
+  traefik-forward-auth:
+    image: thomseddon/traefik-forward-auth
+    environment:
+      - PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
+      - PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
+      - SECRET=something-random
+      - INSECURE_COOKIE=true
+      - DOMAIN=yourcompany.com
+      - AUTH_HOST=auth.yourdomain.com
+    networks:
+      - traefik
+    # When using an auth host, the below must be added
+    labels:
+      - traefik.enable=true
+      - traefik.port=4181
+      - traefik.backend=traefik-forward-auth
+      - traefik.frontend.rule=Host:auth.yourdomain.com
+
+networks:
+  traefik:
--- a/examples/docker-compose-dev.yml
+++ b/examples/docker-compose-dev.yml
@ -0,0 +1,48 @@
+version: '3'
+
+services:
+  traefik:
+    image: traefik
+    command: -c /traefik.toml
+    # command: -c /traefik.toml --logLevel=DEBUG
+    ports:
+      - "8085:80"
+      - "8086:8080"
+    networks:
+      - traefik
+    volumes:
+      - ./traefik.toml:/traefik.toml
+      - /var/run/docker.sock:/var/run/docker.sock
+
+  whoami1:
+    image: emilevauge/whoami
+    networks:
+      - traefik
+    labels:
+      - "traefik.backend=whoami1"
+      - "traefik.enable=true"
+      - "traefik.frontend.rule=Host:whoami.localhost.com"
+
+  whoami2:
+    image: emilevauge/whoami
+    networks:
+      - traefik
+    labels:
+      - "traefik.backend=whoami2"
+      - "traefik.enable=true"
+      - "traefik.frontend.rule=Host:whoami.localhost.org"
+
+  traefik-forward-auth:
+    build: ../
+    environment:
+      - PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
+      - PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
+      - SECRET=something-random
+      - INSECURE_COOKIE=true
+      - COOKIE_DOMAIN=localhost.com
+      - AUTH_HOST=auth.localhost.com
+    networks:
+      - traefik
+
+networks:
+  traefik:
--- a/examples/docker-compose.yml
+++ b/examples/docker-compose.yml
@ -22,14 +22,16 @@ services:
      - "traefik.enable=true"
      - "traefik.frontend.rule=Host:whoami.localhost.com"

-  forward-oauth:
-    image: thomseddon/traefik-forward-auth
+  traefik-forward-auth:
+    build: ../
+    command: ./traefik-forward-auth --rule.1.action=allow --rule.1.rule="Path(`/`)"
    environment:
-      - CLIENT_ID=your-client-id
-      - CLIENT_SECRET=your-client-secret
-      - COOKIE_SECRET=something-random
-      - COOKIE_SECURE=false
+      - PROVIDERS_GOOGLE_CLIENT_ID=your-client-id
+      - PROVIDERS_GOOGLE_CLIENT_SECRET=your-client-secret
+      - SECRET=something-random
+      - INSECURE_COOKIE=true
      - DOMAIN=yourcompany.com
+      - LOG_LEVEL=debug
    networks:
      - traefik

--- a/examples/traefik.toml
+++ b/examples/traefik.toml
@ -37,7 +37,8 @@
    address = ":80"

    [entryPoints.http.auth.forward]
-    address = "http://forward-oauth:4181"
+    address = "http://traefik-forward-auth:4181"
+    authResponseHeaders = ["X-Forwarded-User"]

 ################################################################
 # Traefik logs configuration
--- a/forwardauth.go
+++ b/forwardauth.go
@ -1,358 +0,0 @@
-
-package main
-
-import (
-  "fmt"
-  "time"
-  "errors"
-  "strings"
-  "strconv"
-  "net/url"
-  "net/http"
-  "crypto/hmac"
-  "crypto/rand"
-  "crypto/sha256"
-  "encoding/json"
-  "encoding/base64"
-)
-
-// Forward Auth
-type ForwardAuth struct {
-  Path string
-  Lifetime time.Duration
-
-  ClientId string
-  ClientSecret string
-  Scope string
-
-  LoginURL *url.URL
-  TokenURL *url.URL
-  UserURL *url.URL
-
-  CookieName string
-  CookieDomains []CookieDomain
-  CSRFCookieName string
-  CookieSecret []byte
-  CookieSecure bool
-
-  Domain []string
-
-  Direct bool
-}
-
-// Request Validation
-
-// Cookie = hash(secret, cookie domain, email, expires)|expires|email
-func (f *ForwardAuth) ValidateCookie(r *http.Request, c *http.Cookie) (bool, string, error) {
-  parts := strings.Split(c.Value, "|")
-
-  if len(parts) != 3 {
-    return false, "", errors.New("Invalid cookie format")
-  }
-
-  mac, err := base64.URLEncoding.DecodeString(parts[0])
-  if err != nil {
-    return false, "", errors.New("Unable to decode cookie mac")
-  }
-
-  expectedSignature := f.cookieSignature(r, parts[2], parts[1])
-  expected, err := base64.URLEncoding.DecodeString(expectedSignature)
-  if err != nil {
-    return false, "", errors.New("Unable to generate mac")
-  }
-
-  // Valid token?
-  if !hmac.Equal(mac, expected) {
-    return false, "", errors.New("Invalid cookie mac")
-  }
-
-  expires, err := strconv.ParseInt(parts[1], 10, 64)
-  if err != nil {
-    return false, "", errors.New("Unable to parse cookie expiry")
-  }
-
-  // Has it expired?
-  if time.Unix(expires, 0).Before(time.Now()) {
-    return false, "", errors.New("Cookie has expired")
-  }
-
-  // Looks valid
-  return true, parts[2], nil
-}
-
-// Validate email
-func (f *ForwardAuth) ValidateEmail(email string) bool {
-  if len(f.Domain) > 0 {
-    parts := strings.Split(email, "@")
-    if len(parts) < 2 {
-      return false
-    }
-    found := false
-    for _, domain := range f.Domain {
-      if domain == parts[1] {
-        found = true
-      }
-    }
-    if !found {
-      return false
-    }
-  }
-
-  return true
-}
-
-
-// OAuth Methods
-
-// Get login url
-func (f *ForwardAuth) GetLoginURL(r *http.Request, nonce string) string {
-  state := fmt.Sprintf("%s:%s", nonce, f.returnUrl(r))
-
-  q := url.Values{}
-  q.Set("client_id", fw.ClientId)
-  q.Set("response_type", "code")
-  q.Set("scope", fw.Scope)
-  // q.Set("approval_prompt", fw.ClientId)
-  q.Set("redirect_uri", f.redirectUri(r))
-  q.Set("state", state)
-
-  var u url.URL
-  u = *fw.LoginURL
-  u.RawQuery = q.Encode()
-
-  return u.String()
-}
-
-// Exchange code for token
-
-type Token struct {
-  Token string `json:"access_token"`
-}
-
-func (f *ForwardAuth) ExchangeCode(r *http.Request, code string) (string, error) {
-  form := url.Values{}
-  form.Set("client_id", fw.ClientId)
-  form.Set("client_secret", fw.ClientSecret)
-  form.Set("grant_type", "authorization_code")
-  form.Set("redirect_uri", f.redirectUri(r))
-  form.Set("code", code)
-
-
-  res, err := http.PostForm(fw.TokenURL.String(), form)
-  if err != nil {
-    return "", err
-  }
-
-  var token Token
-  defer res.Body.Close()
-  err = json.NewDecoder(res.Body).Decode(&token)
-
-  return token.Token, err
-}
-
-// Get user with token
-
-type User struct {
-  Id string `json:"id"`
-  Email string `json:"email"`
-  Verified bool `json:"verified_email"`
-  Hd string `json:"hd"`
-}
-
-func (f *ForwardAuth) GetUser(token string) (User, error) {
-  var user User
-
-  client := &http.Client{}
-  req, err := http.NewRequest("GET", fw.UserURL.String(), nil)
-  if err != nil {
-    return user, err
-  }
-
-  req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
-  res, err := client.Do(req)
-  if err != nil {
-    return user, err
-  }
-
-  defer res.Body.Close()
-  err = json.NewDecoder(res.Body).Decode(&user)
-
-  return user, err
-}
-
-// Utility methods
-
-// Get the redirect base
-func (f *ForwardAuth) redirectBase(r *http.Request) string {
-  proto := r.Header.Get("X-Forwarded-Proto")
-  host := r.Header.Get("X-Forwarded-Host")
-
-  // Direct mode
-  if f.Direct {
-    proto = "http"
-    host = r.Host
-  }
-
-  return fmt.Sprintf("%s://%s", proto, host)
-}
-
-// Return url
-func (f *ForwardAuth) returnUrl(r *http.Request) string {
-  path := r.Header.Get("X-Forwarded-Uri")
-
-  // Testing
-  if f.Direct {
-    path = r.URL.String()
-  }
-
-  return fmt.Sprintf("%s%s", f.redirectBase(r), path)
-}
-
-// Get oauth redirect uri
-func (f *ForwardAuth) redirectUri(r *http.Request) string {
-  return fmt.Sprintf("%s%s", f.redirectBase(r), f.Path)
-}
-
-// Cookie methods
-
-// Create an auth cookie
-func (f *ForwardAuth) MakeCookie(r *http.Request, email string) *http.Cookie {
-  expires := f.cookieExpiry()
-  mac := f.cookieSignature(r, email, fmt.Sprintf("%d", expires.Unix()))
-  value := fmt.Sprintf("%s|%d|%s", mac, expires.Unix(), email)
-
-  return &http.Cookie{
-    Name: f.CookieName,
-    Value: value,
-    Path: "/",
-    Domain: f.cookieDomain(r),
-    HttpOnly: true,
-    Secure: f.CookieSecure,
-    Expires: expires,
-  }
-}
-
-// Make a CSRF cookie (used during login only)
-func (f *ForwardAuth) MakeCSRFCookie(r *http.Request, nonce string) *http.Cookie {
-  return &http.Cookie{
-    Name: f.CSRFCookieName,
-    Value: nonce,
-    Path: "/",
-    Domain: f.cookieDomain(r),
-    HttpOnly: true,
-    Secure: f.CookieSecure,
-    Expires: f.cookieExpiry(),
-  }
-}
-
-// Create a cookie to clear csrf cookie
-func (f *ForwardAuth) ClearCSRFCookie(r *http.Request) *http.Cookie {
-  return &http.Cookie{
-    Name: f.CSRFCookieName,
-    Value: "",
-    Path: "/",
-    Domain: f.cookieDomain(r),
-    HttpOnly: true,
-    Secure: f.CookieSecure,
-    Expires: time.Now().Local().Add(time.Hour * -1),
-  }
-}
-
-// Validate the csrf cookie against state
-func (f *ForwardAuth) ValidateCSRFCookie(c *http.Cookie, state string) (bool, string, error) {
-  if len(c.Value) != 32 {
-    return false, "", errors.New("Invalid CSRF cookie value")
-  }
-
-  if len(state) < 34 {
-    return false, "", errors.New("Invalid CSRF state value")
-  }
-
-  // Check nonce match
-  if c.Value != state[:32] {
-    return false, "", errors.New("CSRF cookie does not match state")
-  }
-
-  // Valid, return redirect
-  return true, state[33:], nil
-}
-
-func (f *ForwardAuth) Nonce() (error, string) {
-  // Make nonce
-  nonce := make([]byte, 16)
-  _, err := rand.Read(nonce)
-  if err != nil {
-    return err, ""
-  }
-
-  return nil, fmt.Sprintf("%x", nonce)
-}
-
-// Cookie domain
-func (f *ForwardAuth) cookieDomain(r *http.Request) string {
-  host := r.Header.Get("X-Forwarded-Host")
-
-  // Direct mode
-  if f.Direct {
-    host = r.Host
-  }
-
-  // Remove port for matching
-  p := strings.Split(host, ":")
-
-  // Check if any of the given cookie domains matches
-  for _, domain := range f.CookieDomains {
-    if domain.Match(p[0]) {
-      return domain.Domain
-    }
-  }
-
-  return p[0]
-}
-
-// Create cookie hmac
-func (f *ForwardAuth) cookieSignature(r *http.Request, email, expires string) string {
-  hash := hmac.New(sha256.New, f.CookieSecret)
-  hash.Write([]byte(f.cookieDomain(r)))
-  hash.Write([]byte(email))
-  hash.Write([]byte(expires))
-  return base64.URLEncoding.EncodeToString(hash.Sum(nil))
-}
-
-// Get cookie expirary
-func (f *ForwardAuth) cookieExpiry() time.Time {
-  return time.Now().Local().Add(f.Lifetime)
-}
-
-// Cookie Domain
-
-// Cookie Domain
-type CookieDomain struct {
-  Domain string
-  DomainLen int
-  SubDomain string
-  SubDomainLen int
-}
-
-func NewCookieDomain(domain string) *CookieDomain {
-  return &CookieDomain{
-    Domain: domain,
-    DomainLen: len(domain),
-    SubDomain: fmt.Sprintf(".%s", domain),
-    SubDomainLen: len(domain) + 1,
-  }
-}
-
-func (c *CookieDomain) Match(host string) bool {
-  // Exact domain match?
-  if host == c.Domain {
-    return true
-  }
-
-  // Subdomain match?
-  if len(host) >= c.SubDomainLen && host[len(host) - c.SubDomainLen:] == c.SubDomain {
-    return true
-  }
-
-  return false
-}
--- a/forwardauth_test.go
+++ b/forwardauth_test.go
@ -1,242 +0,0 @@
-
-package main
-
-import (
-  // "fmt"
-  "time"
-  "reflect"
-  "testing"
-  "net/url"
-  "net/http"
-)
-
-func TestValidateCookie(t *testing.T) {
-  fw = &ForwardAuth{}
-  r, _ := http.NewRequest("GET", "http://example.com", nil)
-  c := &http.Cookie{}
-
-  // Should require 3 parts
-  c.Value = ""
-  valid, _, err := fw.ValidateCookie(r, c)
-  if valid || err.Error() != "Invalid cookie format" {
-    t.Error("Should get \"Invalid cookie format\", got:", err)
-  }
-  c.Value = "1|2"
-  valid, _, err = fw.ValidateCookie(r, c)
-  if valid || err.Error() != "Invalid cookie format" {
-    t.Error("Should get \"Invalid cookie format\", got:", err)
-  }
-  c.Value = "1|2|3|4"
-  valid, _, err = fw.ValidateCookie(r, c)
-  if valid || err.Error() != "Invalid cookie format" {
-    t.Error("Should get \"Invalid cookie format\", got:", err)
-  }
-
-  // Should catch invalid mac
-  c.Value = "MQ==|2|3"
-  valid, _, err = fw.ValidateCookie(r, c)
-  if valid || err.Error() != "Invalid cookie mac" {
-    t.Error("Should get \"Invalid cookie mac\", got:", err)
-  }
-
-  // Should catch expired
-  fw.Lifetime = time.Second * time.Duration(-1)
-  c = fw.MakeCookie(r, "test@test.com")
-  valid, _, err = fw.ValidateCookie(r, c)
-  if valid || err.Error() != "Cookie has expired" {
-    t.Error("Should get \"Cookie has expired\", got:", err)
-  }
-
-  // Should accept valid cookie
-  fw.Lifetime = time.Second * time.Duration(10)
-  c = fw.MakeCookie(r, "test@test.com")
-  valid, email, err := fw.ValidateCookie(r, c)
-  if !valid {
-    t.Error("Valid request should return as valid")
-  }
-  if err != nil {
-    t.Error("Valid request should not return error, got:", err)
-  }
-  if email != "test@test.com" {
-    t.Error("Valid request should return user email")
-  }
-}
-
-func TestValidateEmail(t *testing.T) {
-  fw = &ForwardAuth{}
-
-  // Should allow any
-  if !fw.ValidateEmail("test@test.com") || !fw.ValidateEmail("one@two.com") {
-    t.Error("Should allow any domain if email domain is not defined")
-  }
-
-  // Should block non matching domain
-  fw.Domain = []string{"test.com"}
-  if fw.ValidateEmail("one@two.com") {
-    t.Error("Should not allow user from another domain")
-  }
-
-  // Should allow matching domain
-  fw.Domain = []string{"test.com"}
-  if !fw.ValidateEmail("test@test.com") {
-    t.Error("Should allow user from allowed domain")
-  }
-}
-
-func TestGetLoginURL(t *testing.T) {
-  fw = &ForwardAuth{
-    Path: "/_oauth",
-    ClientId: "idtest",
-    ClientSecret: "sectest",
-    Scope: "scopetest",
-    LoginURL: &url.URL{
-      Scheme: "https",
-      Host: "test.com",
-      Path: "/auth",
-    },
-  }
-  r, _ := http.NewRequest("GET", "http://example.com", nil)
-  r.Header.Add("X-Forwarded-Proto", "http")
-  r.Header.Add("X-Forwarded-Host", "example.com")
-  r.Header.Add("X-Forwarded-Uri", "/hello")
-
-  // Check url
-  uri, err := url.Parse(fw.GetLoginURL(r, "nonce"))
-  if err != nil {
-    t.Error("Error parsing login url:", err)
-  }
-  if uri.Scheme != "https" {
-    t.Error("Expected login Scheme to be \"https\", got:", uri.Scheme)
-  }
-  if uri.Host != "test.com" {
-    t.Error("Expected login Host to be \"test.com\", got:", uri.Host)
-  }
-  if uri.Path != "/auth" {
-    t.Error("Expected login Path to be \"/auth\", got:", uri.Path)
-  }
-
-  // Check query string
-  qs := uri.Query()
-  expectedQs := url.Values{
-    "client_id": []string{"idtest"},
-    "redirect_uri": []string{"http://example.com/_oauth"},
-    "response_type": []string{"code"},
-    "scope": []string{"scopetest"},
-    "state": []string{"nonce:http://example.com/hello"},
-  }
-  if !reflect.DeepEqual(qs, expectedQs) {
-    t.Error("Incorrect login query string, expected:")
-    t.Error(expectedQs)
-    t.Error("Got:")
-    t.Error(qs)
-  }
-}
-
-
-// TODO
-// func TestExchangeCode(t *testing.T) {
-// }
-
-// TODO
-// func TestGetUser(t *testing.T) {
-// }
-
-// TODO? Tested in TestValidateCookie
-// func TestMakeCookie(t *testing.T) {
-// }
-
-// func TestMakeCSRFCookie(t *testing.T) {
-//   t.Log("TODO")
-// }
-
-func TestClearCSRFCookie(t *testing.T) {
-  fw = &ForwardAuth{}
-  r, _ := http.NewRequest("GET", "http://example.com", nil)
-
-  c := fw.ClearCSRFCookie(r)
-  if c.Value != "" {
-    t.Error("ClearCSRFCookie should create cookie with empty value")
-  }
-}
-
-func TestValidateCSRFCookie(t *testing.T) {
-  fw = &ForwardAuth{}
-  c := &http.Cookie{}
-
-  // Should require 32 char string
-  c.Value = ""
-  valid, _, err := fw.ValidateCSRFCookie(c, "")
-  if valid || err.Error() != "Invalid CSRF cookie value" {
-    t.Error("Should get \"Invalid CSRF cookie value\", got:", err)
-  }
-  c.Value = "123456789012345678901234567890123"
-  valid, _, err = fw.ValidateCSRFCookie(c, "")
-  if valid || err.Error() != "Invalid CSRF cookie value" {
-    t.Error("Should get \"Invalid CSRF cookie value\", got:", err)
-  }
-
-  // Should require valid state
-  c.Value = "12345678901234567890123456789012"
-  valid, _, err = fw.ValidateCSRFCookie(c, "12345678901234567890123456789012:")
-  if valid || err.Error() != "Invalid CSRF state value" {
-    t.Error("Should get \"Invalid CSRF state value\", got:", err)
-  }
-
-  // Should allow valid state
-  c.Value = "12345678901234567890123456789012"
-  valid, state, err := fw.ValidateCSRFCookie(c, "12345678901234567890123456789012:99")
-  if !valid {
-    t.Error("Valid request should return as valid")
-  }
-  if err != nil {
-    t.Error("Valid request should not return error, got:", err)
-  }
-  if state != "99" {
-    t.Error("Valid request should return correct state, got:", state)
-  }
-}
-
-func TestNonce(t *testing.T) {
-  fw = &ForwardAuth{}
-
-  err, nonce1 := fw.Nonce()
-  if err != nil {
-    t.Error("Error generation nonce:", err)
-  }
-
-  err, nonce2 := fw.Nonce()
-  if err != nil {
-    t.Error("Error generation nonce:", err)
-  }
-
-  if len(nonce1) != 32 || len(nonce2) != 32 {
-    t.Error("Nonce should be 32 chars")
-  }
-  if nonce1 == nonce2 {
-    t.Error("Nonce should not be equal")
-  }
-}
-
-func TestCookieDomainMatch(t *testing.T) {
-  cd := NewCookieDomain("example.com")
-
-  // Exact should match
-  if !cd.Match("example.com") {
-    t.Error("Exact domain should match")
-  }
-
-  // Subdomain should match
-  if !cd.Match("test.example.com") {
-    t.Error("Subdomain should match")
-  }
-
-  // Derived domain should not match
-  if cd.Match("testexample.com") {
-    t.Error("Derived domain should not match")
-  }
-
-  // Other domain should not match
-  if cd.Match("test.com") {
-    t.Error("Other domain should not match")
-  }
-}
--- a/go.mod
+++ b/go.mod
@ -0,0 +1,26 @@
+module github.com/thomseddon/traefik-forward-auth
+
+go 1.13
+
+require (
+	github.com/containous/traefik/v2 v2.1.2
+	github.com/coreos/go-oidc v2.1.0+incompatible
+	github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
+	github.com/sirupsen/logrus v1.4.2
+	github.com/stretchr/testify v1.4.0
+	github.com/thomseddon/go-flags v1.4.1-0.20190507184247-a3629c504486
+	golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45
+	gopkg.in/square/go-jose.v2 v2.3.1
+)
+
+// From traefik
+replace (
+	github.com/Azure/go-autorest => github.com/Azure/go-autorest v12.4.1+incompatible
+	github.com/abbot/go-http-auth => github.com/containous/go-http-auth v0.4.1-0.20180112153951-65b0cdae8d7f
+	github.com/docker/docker => github.com/docker/engine v1.4.2-0.20191113042239-ea84732a7725
+	github.com/go-check/check => github.com/containous/check v0.0.0-20170915194414-ca0bf163426a
+	github.com/gorilla/mux => github.com/containous/mux v0.0.0-20181024131434-c33f32e26898
+	github.com/mailgun/minheap => github.com/containous/minheap v0.0.0-20190809180810-6e71eb837595
+	github.com/mailgun/multibuf => github.com/containous/multibuf v0.0.0-20190809014333-8b6c9a7e6bba
+	github.com/rancher/go-rancher-metadata => github.com/containous/go-rancher-metadata v0.0.0-20190402144056-c6a65f8b7a28
+)
--- a/go.sum
+++ b/go.sum
@ -0,0 +1,570 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+contrib.go.opencensus.io/exporter/ocagent v0.4.12/go.mod h1:450APlNTSR6FrvC3CTRqYosuDstRB9un7SOx2k/9ckA=
+github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-autorest v12.4.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest v0.1.0/go.mod h1:AKyIcETwSUFxIcs/Wnq/C+kwCtlEYGUVd7FPNb2slmg=
+github.com/Azure/go-autorest/autorest v0.5.0/go.mod h1:9HLKlQjVBH6U3oDfsXOeVc56THsLPw1L03yban4xThw=
+github.com/Azure/go-autorest/autorest/adal v0.1.0/go.mod h1:MeS4XhScH55IST095THyTxElntu7WqB7pNbZo8Q5G3E=
+github.com/Azure/go-autorest/autorest/adal v0.2.0/go.mod h1:MeS4XhScH55IST095THyTxElntu7WqB7pNbZo8Q5G3E=
+github.com/Azure/go-autorest/autorest/azure/auth v0.1.0/go.mod h1:Gf7/i2FUpyb/sGBLIFxTBzrNzBo7aPXXE3ZVeDRwdpM=
+github.com/Azure/go-autorest/autorest/azure/cli v0.1.0/go.mod h1:Dk8CUAt/b/PzkfeRsWzVG9Yj3ps8mS8ECztu43rdU8U=
+github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
+github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/to v0.2.0/go.mod h1:GunWKJp1AEqgMaGLV+iocmRAJWqST1wQYhyyjXJ3SJc=
+github.com/Azure/go-autorest/autorest/validation v0.1.0/go.mod h1:Ha3z/SqBeaalWQvokg3NZAlQTalVMtOIAs1aGK7G6u8=
+github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
+github.com/Azure/go-autorest/tracing v0.1.0/go.mod h1:ROEEAFwXycQw7Sn3DXNtEedEvdeRAgDr0izn4z5Ij88=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/DataDog/datadog-go v2.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
+github.com/DataDog/zstd v1.3.6-0.20190409195224-796139022798/go.mod h1:1jcaCB/ufaK+sKp1NBhlGmpz41jOoPQ35bpF36t7BBo=
+github.com/ExpediaDotCom/haystack-client-go v0.0.0-20190315171017-e7edbdf53a61/go.mod h1:62qWSDaEI0BLykU+zQza5CAKgW0lOy9oBSz3/DvYz4w=
+github.com/Masterminds/goutils v1.1.0/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/sprig v2.20.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuNhlNS5hqE0NB0E6fgfo2Br3o=
+github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
+github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
+github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
+github.com/OpenDNS/vegadns2client v0.0.0-20180418235048-a3fa4a771d87/go.mod h1:iGLljf5n9GjT6kc0HBvyI1nOKnGQbNB66VzSNbK5iks=
+github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
+github.com/Shopify/sarama v1.23.1/go.mod h1:XLH1GYJnLVE0XCr6KdJGVJRTwY30moWNJ4sERjXX6fs=
+github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
+github.com/VividCortex/gohistogram v1.0.0 h1:6+hBz+qvs0JOrrNhhmR7lFxo5sINxBCGXrdtl/UvroE=
+github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g=
+github.com/abronan/valkeyrie v0.0.0-20190822142731-f2e1850dc905/go.mod h1:hTreU6x9m2IP2h8e0TGrSzAXSCI3lxic8/JT5CMknjY=
+github.com/akamai/AkamaiOPEN-edgegrid-golang v0.9.0/go.mod h1:zpDJeKyp9ScW4NNrbdr+Eyxvry3ilGPewKoXw3XGN1k=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/aliyun/alibaba-cloud-sdk-go v0.0.0-20190808125512-07798873deee/go.mod h1:myCDvQSzCW+wB1WAlocEru4wMGJxy+vlxHdhegi1CDQ=
+github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
+github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
+github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/armon/go-metrics v0.0.0-20190430140413-ec5e00d3c878/go.mod h1:3AMJUQhVx52RsWOnlkpikZr01T/yAVN2gn0861vByNg=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/aws/aws-sdk-go v1.16.23/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/aws/aws-sdk-go v1.23.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/c0va23/go-proxyprotocol v0.9.1/go.mod h1:TNjUV+llvk8TvWJxlPYAeAYZgSzT/iicNr3nWBWX320=
+github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
+github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
+github.com/census-instrumentation/opencensus-proto v0.2.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
+github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/cloudflare-go v0.10.2/go.mod h1:qhVI5MKwBGhdNU89ZRz2plgYutcJ5PCekLxXn56w6SY=
+github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
+github.com/codegangsta/negroni v1.0.0/go.mod h1:v0y3T5G7Y1UlFfyxFn/QLRU4a2EuNau2iZY63YTKWo0=
+github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containous/alice v0.0.0-20181107144136-d83ebdd94cbd h1:0n+lFLh5zU0l6KSk3KpnDwfbPGAR44aRLgTbCnhRBHU=
+github.com/containous/alice v0.0.0-20181107144136-d83ebdd94cbd/go.mod h1:BbQgeDS5i0tNvypwEoF1oNjOJw8knRAE1DnVvjDstcQ=
+github.com/containous/check v0.0.0-20170915194414-ca0bf163426a/go.mod h1:eQOqZ7GoFsLxI7jFKLs7+Nv2Rm1x4FyK8d2NV+yGjwQ=
+github.com/containous/go-http-auth v0.4.1-0.20180112153951-65b0cdae8d7f/go.mod h1:dCmRGidPSLagL8D/2u7yIO6Y/8D/yuYX9EdKrnrhpCA=
+github.com/containous/go-rancher-metadata v0.0.0-20190402144056-c6a65f8b7a28/go.mod h1:YTAhdMF+tmHPGF7v0uZJ22+XNY/jz1ZYdBCeTZnsrYU=
+github.com/containous/minheap v0.0.0-20190809180810-6e71eb837595/go.mod h1:+lHFbEasIiQVGzhVDVw/cn0ZaOzde2OwNncp1NhXV4c=
+github.com/containous/multibuf v0.0.0-20190809014333-8b6c9a7e6bba/go.mod h1:zkWcASFUJEst6QwCrxLdkuw1gvaKqmflEipm+iecV5M=
+github.com/containous/mux v0.0.0-20181024131434-c33f32e26898 h1:1srn9voikJGofblBhWy3WuZWqo14Ou7NaswNG/I2yWc=
+github.com/containous/mux v0.0.0-20181024131434-c33f32e26898/go.mod h1:z8WW7n06n8/1xF9Jl9WmuDeZuHAhfL+bwarNjsciwwg=
+github.com/containous/traefik/v2 v2.1.2 h1:x5lmYFR1LjfBYxiFGKqtvwFmbNtQ91DI1nOTVVEb/bQ=
+github.com/containous/traefik/v2 v2.1.2/go.mod h1:hMgdOHkPB7H/EaBqejJMwo/OZE4PYpWeHBaHVKmOQqY=
+github.com/coreos/bbolt v1.3.3/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-oidc v2.1.0+incompatible h1:sdJrfw8akMnCuUlaZU3tE/uYXFgfqom8DBE9so9EBsM=
+github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpu/goacmedns v0.0.1/go.mod h1:sesf/pNnCYwUevQEQfEwY0Y3DydlQWSGZbaMElOWxok=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decker502/dnspod-go v0.2.0/go.mod h1:qsurYu1FgxcDwfSwXJdLt4kRsBLZeosEb9uq4Sy+08g=
+github.com/dgrijalva/jwt-go v0.0.0-20160705203006-01aeca54ebda/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
+github.com/dnaeon/go-vcr v0.0.0-20180814043457-aafff18a5cc2/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
+github.com/dnsimple/dnsimple-go v0.30.0/go.mod h1:O5TJ0/U6r7AfT8niYNlmohpLbCSG+c71tQlGr9SeGrg=
+github.com/docker/cli v0.0.0-20190711175710-5b38d82aa076/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/engine v1.4.2-0.20191113042239-ea84732a7725/go.mod h1:3CPr2caMgTHxxIAZgEMd3uLYPDlRvPqCpyeRf6ncPcY=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-metrics v0.0.0-20181218153428-b84716841b82/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
+github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libcompose v0.0.0-20190805081528-eac9fe1b8b03/go.mod h1:EyqDS+Iyca0hS44T7qIMTeO1EOYWWWNOGpufHu9R8cs=
+github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/donovanhide/eventsource v0.0.0-20170630084216-b8f31a59085e/go.mod h1:56wL82FO0bfMU5RvfXoIwSOP2ggqqxT+tAfNEIyxuHw=
+github.com/eapache/channels v1.1.0/go.mod h1:jMm2qB5Ubtg9zLd+inMZd2/NUvXgzmWXsDaLyQIGfH0=
+github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
+github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
+github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
+github.com/eknkc/amber v0.0.0-20171010120322-cdade1c07385/go.mod h1:0vRUJqYpeSZifjYj7uP3BG/gKcuzL9xWVV/Y+cK33KM=
+github.com/elazarl/go-bindata-assetfs v1.0.0/go.mod h1:v+YaWX3bdea5J/mo8dSETolEo7R71Vk1u8bnjau5yw4=
+github.com/elazarl/goproxy v0.0.0-20170405201442-c4fc26588b6e/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/envoyproxy/go-control-plane v0.6.9/go.mod h1:SBwIajubJHhxtWwsL9s8ss4safvEdbitLhGGK48rN6g=
+github.com/evanphx/json-patch v0.0.0-20190203023257-5858425f7550/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.5.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/exoscale/egoscale v0.18.1/go.mod h1:Z7OOdzzTOz1Q1PjQXumlz9Wn/CddH0zSYdCF3rnBKXE=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
+github.com/felixge/httpsnoop v1.0.0/go.mod h1:3+D9sFq0ahK/JeJPhCBUV1xlf4/eIYrUQaxulT0VzX8=
+github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/gambol99/go-marathon v0.0.0-20180614232016-99a156b96fb2/go.mod h1:GLyXJD41gBO/NPKVPGQbhyyC06eugGy15QEZyUkE2/s=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-acme/lego/v3 v3.2.0 h1:z0zvNlL1niv/1qA06V5X1BRC5PeLoGKAlVaWthXQz9c=
+github.com/go-acme/lego/v3 v3.2.0/go.mod h1:074uqt+JS6plx+c9Xaiz6+L+GBb+7itGtzfcDM2AhEE=
+github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW4s=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-ini/ini v1.44.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-kit/kit v0.8.0 h1:Wz+5lgoB0kkuqLEc6NVmwRknTKP6dTGbSqvhZtBI/j0=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0 h1:wDJmvq38kDhkVxi50ni9ykkdUr1PKgqKOoi01fa0Mdk=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gogo/googleapis v1.1.0/go.mod h1:gf4bu3Q80BeJ6H1S1vYPm8/ELATdvryBaNFGgqEef3s=
+github.com/gogo/protobuf v0.0.0-20171007142547-342cbe0a0415/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2 h1:6nsPYzhq5kReh6QImI3k5qWzO4PEbvbIW2cwSfR/6xs=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v0.0.0-20160524151835-7d79101e329e/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-github/v28 v28.0.0/go.mod h1:+5GboIspo7F0NG2qsvfYh7en6F3EK37uyqv+c35AR3s=
+github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/gofuzz v0.0.0-20170612174753-24818f796faf/go.mod h1:HP5RmnzzSNb993RKQDq4+1A4ia9nllfqcQFTQJedwGI=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/gophercloud/gophercloud v0.0.0-20190126172459-c818fa66e4c8/go.mod h1:3WdhXV3rUYy9p6AUW8d94kr+HS62Y4VL9mBnFxsD8q4=
+github.com/gophercloud/gophercloud v0.3.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/context v1.1.1 h1:AWwleXJkX/nhcU9bZSnZoi3h/qGYqQAGhq6zZe/aQW8=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gravitational/trace v0.0.0-20190726142706-a535a178675f h1:68WxnfBzJRYktZ30fmIjGQ74RsXYLoeH2/NITPktTMY=
+github.com/gravitational/trace v0.0.0-20190726142706-a535a178675f/go.mod h1:RvdOUHE4SHqR3oXlFFKnGzms8a5dugHygGw1bqDstYI=
+github.com/gregjones/httpcache v0.0.0-20170728041850-787624de3eb7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.8.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
+github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
+github.com/hashicorp/consul/api v1.2.0/go.mod h1:1SIkFYi2ZTXUE5Kgt179+4hH33djo11+0Eo2XgTAtkw=
+github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/hashicorp/consul/sdk v0.2.0/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
+github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
+github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
+github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
+github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
+github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.2.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.3/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
+github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
+github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
+github.com/hashicorp/memberlist v0.1.4/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
+github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/huandu/xstrings v1.2.0/go.mod h1:DvyZB1rfVYsBIigL8HwpZgxHwXozlTgGqn63UyNX5k4=
+github.com/iij/doapi v0.0.0-20190504054126-0bbf12d6d7df/go.mod h1:QMZY7/J/KSQEhKWFeDesPjMj+wCHReeknARU3wqlyN4=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/influxdata/influxdb1-client v0.0.0-20190402204710-8ff2fc3824fc/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
+github.com/instana/go-sensor v1.4.17-0.20190515112224-78c14625025a/go.mod h1:P1ynE0u78bUBZ2GkWewRpAO1/w1oW9CKDozeueH6QSg=
+github.com/jcmturner/gofork v0.0.0-20190328161633-dc7c13fece03/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
+github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jonboulle/clockwork v0.1.0 h1:VKV+ZcuP6l3yW9doeqz6ziZGgcynBVQO+obU0+0hcPo=
+github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
+github.com/json-iterator/go v0.0.0-20180701071628-ab8a2e0c74be/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kolo/xmlrpc v0.0.0-20190717152603-07c4ee3fd181/go.mod h1:o03bZfuBwAXHetKXuInt4S7omeXUu62/A845kiycsSQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2 h1:DB17ag19krx9CFsz4o3enTrPXyIXCl+2iCXH/aMAp9s=
+github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/labbsr0x/bindman-dns-webhook v1.0.2/go.mod h1:p6b+VCXIR8NYKpDr8/dg1HKfQoRHCdcsROXKvmoehKA=
+github.com/labbsr0x/goh v1.0.1/go.mod h1:8K2UhVoaWXcCU7Lxoa2omWnC8gyW8px7/lmO61c027w=
+github.com/libkermit/compose v0.0.0-20171122111507-c04e39c026ad/go.mod h1:GyCk/ifDcqsU1tsRMMWqXANnTtxzcwEWscb7j5qmblM=
+github.com/libkermit/docker v0.0.0-20171122101128-e6674d32b807/go.mod h1:std11u6pTaNwryy0Hy1dTQNdHKka1jNpflEieKtv5VE=
+github.com/libkermit/docker-check v0.0.0-20171122104347-1113af38e591/go.mod h1:EBQ0jeOrBpOTkquwjmJl4W6z5xqlf5oA2LZfTqRNcO0=
+github.com/linode/linodego v0.10.0/go.mod h1:cziNP7pbvE3mXIPneHj0oRY8L1WtGEIKlZ8LANE4eXA=
+github.com/liquidweb/liquidweb-go v1.6.0/go.mod h1:UDcVnAMDkZxpw4Y7NOHkqoeiGacVLEIG/i5J9cyixzQ=
+github.com/looplab/fsm v0.1.0/go.mod h1:m2VaOfDHxqXBBMgc26m6yUOwkFn8H2AlJDE+jd/uafI=
+github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
+github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailgun/timetools v0.0.0-20141028012446-7e6055773c51/go.mod h1:RYmqHbhWwIz3z9eVmQ2rx82rulEMG0t+Q1bzfc9DYN4=
+github.com/mailgun/ttlmap v0.0.0-20170619185759-c1c17f74874f/go.mod h1:8heskWJ5c0v5J9WH89ADhyal1DOZcayll8fSbhB+/9A=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-tty v0.0.0-20180219170247-931426f7535a/go.mod h1:XPvLUNfbS4fJH25nqRHfWLMa1ONC8Amw+mIA639KxkE=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/miekg/dns v1.1.15 h1:CSSIDtllwGLMoA6zjdKnaE6Tx6eVUxQ29LUgGetiDCI=
+github.com/miekg/dns v1.1.15/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/go-vnc v0.0.0-20150629162542-723ed9867aed/go.mod h1:3rdaFaCv4AyBgu5ALFM0+tSuHrBh6v692nyQe3ikrq0=
+github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
+github.com/mitchellh/hashstructure v1.0.0/go.mod h1:QjSHrPWS+BGUVBYkbTZWEnOh3G1DutKwClXU/ABz6AQ=
+github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
+github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/morikuni/aec v0.0.0-20170113033406-39771216ff4c/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/namedotcom/go v0.0.0-20180403034216-08470befbe04/go.mod h1:5sN+Lt1CaY4wsPvgQH/jsuJi4XO2ssZbdsIizr4CVC8=
+github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
+github.com/nrdcg/auroradns v1.0.0/go.mod h1:6JPXKzIRzZzMqtTDgueIhTi6rFf1QvYE/HzqidhOhjw=
+github.com/nrdcg/goinwx v0.6.1/go.mod h1:XPiut7enlbEdntAqalBIqcYcTEVhpv/dKWgDCX2SwKQ=
+github.com/nrdcg/namesilo v0.2.1/go.mod h1:lwMvfQTyYq+BbjJd30ylEG4GPSS6PII0Tia4rRpRiyw=
+github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v0.0.0-20190113212917-5533ce8a0da3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/runc v1.0.0-rc8/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
+github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/openzipkin-contrib/zipkin-go-opentracing v0.4.5/go.mod h1:/wsWhb9smxSfWAKL3wpBW7V8scJMt8N8gnaMCS9E/cA=
+github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
+github.com/openzipkin/zipkin-go v0.2.1/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
+github.com/oracle/oci-go-sdk v7.0.0+incompatible/go.mod h1:VQb79nF8Z2cwLkLS35ukwStZIg5F66tcBccjip/j888=
+github.com/ovh/go-ovh v0.0.0-20181109152953-ba5adb4cf014/go.mod h1:joRatxRJaZBsY3JAOEMcoOp05CnZzsx4scTxi95DHyQ=
+github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
+github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
+github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/philhofer/fwd v1.0.0/go.mod h1:gk3iGcWd9+svBvR0sR+KPcfE+RNWozjowpeBVG3ZVNU=
+github.com/pierrec/lz4 v0.0.0-20190327172049-315a67e90e41/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
+github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
+github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU=
+github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
+github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/rainycape/memcache v0.0.0-20150622160815-1031fa0ce2f2/go.mod h1:7tZKcyumwBO6qip7RNQ5r77yrssm9bfCowcLEBcU5IA=
+github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446/go.mod h1:uYEyJGbgTkfkS4+E/PavXkNJcbFIpEtjt2B0KDQ5+9M=
+github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/sacloud/libsacloud v1.26.1/go.mod h1:79ZwATmHLIFZIMd7sxA3LwzVy/B77uj3LDoToVTxDoQ=
+github.com/samuel/go-zookeeper v0.0.0-20180130194729-c4fab1ac1bec/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
+github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.1 h1:GL2rEmy6nsikmW0r8opw9JIRScdMF5hA8cOYLH7In1k=
+github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/spf13/pflag v1.0.1 h1:aCvUg6QPl3ibpQUxyLkrEkCHtPqYJL4x9AuhqVqFis4=
+github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stvp/go-udp-testing v0.0.0-20171104055251-c4434f09ec13/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
+github.com/thomseddon/go-flags v1.4.1-0.20190507184247-a3629c504486 h1:hk17f4niAl4e6viTj2uf/fpfACa6QPmrtMDAo+1tifE=
+github.com/thomseddon/go-flags v1.4.1-0.20190507184247-a3629c504486/go.mod h1:NK9eZpNBmSKVxvyB/MExg6jW0Bo9hQyAuCP+b8MJFow=
+github.com/timewasted/linode v0.0.0-20160829202747-37e84520dcf7/go.mod h1:imsgLplxEC/etjIhdr3dNzV3JeT27LbVu5pYWm0JCBY=
+github.com/tinylib/msgp v1.0.2/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDWklFE=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/transip/gotransip v0.0.0-20190812104329-6d8d9179b66f/go.mod h1:i0f4R4o2HM0m3DZYQWsj6/MEowD57VzoH0v3d7igeFY=
+github.com/transip/gotransip v5.8.2+incompatible/go.mod h1:uacMoJVmrfOcscM4Bi5NVg708b7c6rz2oDTWqa7i2Ic=
+github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
+github.com/uber-go/atomic v1.3.2/go.mod h1:/Ct5t2lcmbJ4OSe/waGBoaVvVqtO0bmtfVNex1PFV8g=
+github.com/uber/jaeger-client-go v2.21.1+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
+github.com/uber/jaeger-lib v2.2.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
+github.com/unrolled/render v1.0.1/go.mod h1:gN9T0NhL4Bfbwu8ann7Ry/TGHYfosul+J0obPf6NBdM=
+github.com/unrolled/secure v1.0.5/go.mod h1:R6rugAuzh4TQpbFAq69oqZggyBQxFRFQIewtz5z7Jsc=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/vdemeester/shakers v0.1.0/go.mod h1:IZ1HHynUOQt32iQ3rvAeVddXLd19h/6LWiKsh9RZtAQ=
+github.com/vulcand/oxy v1.0.0/go.mod h1:6EXgOAl6CRa46/2ZGcDJKf3ywJUp5WtT7vSlGSkvecI=
+github.com/vulcand/predicate v1.1.0 h1:Gq/uWopa4rx/tnZu2opOSBqHK63Yqlou/SzrbwdJiNg=
+github.com/vulcand/predicate v1.1.0/go.mod h1:mlccC5IRBoc2cIFmCB8ZM62I3VDb6p2GXESMHa3CnZg=
+github.com/vultr/govultr v0.1.4/go.mod h1:9H008Uxr/C4vFNGLqKx232C206GL0PBHzOP0809bGNA=
+github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
+github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.1.0/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
+github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+go.etcd.io/bbolt v1.3.1-etcd.8/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.etcd.io/etcd v3.3.13+incompatible/go.mod h1:yaeTdrJi5lOmYerz05bd8+V7KubZs8YSFZfzsF9A6aI=
+go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
+go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/ratelimit v0.0.0-20180316092928-c15da0234277/go.mod h1:2X8KaoNd1J0lZV+PxJk/5+DGbO/tpwLR1m++a7FnB/Y=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180621125126-a49355c7e3f8/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181025213731-e84da0312774/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190404164418-38d8ce5564a5/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 h1:HuIa8hRrWRSrqYzx1qI49NNxhdi2PrY7gxVSq1JjLDc=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190312203227-4b39c73a6495/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/net v0.0.0-20180611182652-db08ff08e862/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190206173232-65e2d4e15006/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190930134127-c5a3c61f89f3 h1:6KET3Sqa7fkVfD63QnAM81ZeYg5n4HwApOJkufONnHA=
+golang.org/x/net v0.0.0-20190930134127-c5a3c61f89f3/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190402181905-9f3314589c9a/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58 h1:8gQV6CLnAEikrhgkHFbMAEhagSSnXWGV915qUMm9mrU=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180622082034-63fc586f45fe/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33 h1:I6FyU15t786LL7oL/hn43zqTuEGr4PN7F4XJ1p4E3Y8=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80affTUvO9UxmJRx8K0gsfABByQ=
+golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20161028155119-f51c12702a4d/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190921001708-c4c64cad1fd0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135 h1:5Beo0mZN8dRzgrMMkDp0jc8YXQKx9DiJ2k1dkvGsn5A=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485 h1:OB/uP/Puiu5vS5QMRPrXCDWUPb+kt8f1KW8oQzFejQw=
+gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0=
+gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
+gonum.org/v1/netlib v0.0.0-20190331212654-76723241ea4e/go.mod h1:kS+toOQn6AQKjmKJ7gzohV1XkqsFehRA2FbsbkopSuQ=
+google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.19.1/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.0/go.mod h1:chYK+tFQF0nDUGJgXMSgLCQk3phJEuONr2DCgLDdAQM=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.22.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+gopkg.in/DataDog/dd-trace-go.v1 v1.16.1/go.mod h1:DVp8HmDh8PuTu2Z0fVVlBsyWaC++fzwVCaGWylTe3tg=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/h2non/gock.v1 v1.0.15/go.mod h1:sX4zAkdYX1TRGJ2JY156cFspQn4yRWn6p9EMdODlynE=
+gopkg.in/inf.v0 v0.9.0/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.44.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/jcmturner/aescts.v1 v1.0.1/go.mod h1:nsR8qBOg+OucoIW+WMhB3GspUQXq9XorLnQb9XtvcOo=
+gopkg.in/jcmturner/dnsutils.v1 v1.0.1/go.mod h1:m3v+5svpVOhtFAP/wSz+yzh4Mc0Fg7eRhxkJMWSIz9Q=
+gopkg.in/jcmturner/goidentity.v3 v3.0.0/go.mod h1:oG2kH0IvSYNIu80dVAyu/yoefjq1mNfM5bm88whjWx4=
+gopkg.in/jcmturner/gokrb5.v7 v7.2.3/go.mod h1:l8VISx+WGYp+Fp7KRbsiUuXTTOnxIc3Tuvyavf11/WM=
+gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=
+gopkg.in/ns1/ns1-go.v2 v2.0.0-20190730140822-b51389932cbc/go.mod h1:VV+3haRsgDiVLxyifmMBrBIuCWFBPYKbRssXB9z67Hw=
+gopkg.in/redis.v5 v5.2.9/go.mod h1:6gtv0/+A4iM08kdRfocWYB3bLX2tebpNtfKlFT6H4mY=
+gopkg.in/resty.v1 v1.9.1/go.mod h1:vo52Hzryw9PnPHcJfPsBiFW62XhNx5OczbV9y+IMpgc=
+gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/square/go-jose.v2 v2.3.1 h1:SK5KegNXmKmqE342YYN2qPHEnUYeoMiXXl1poUlI+o4=
+gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.0.0-20190718183219-b59d8169aab5/go.mod h1:TBhBqb1AWbBQbW3XRusr7n7E4v2+5ZY8r8sAMnyFC5A=
+k8s.io/apimachinery v0.0.0-20190612205821-1799e75a0719/go.mod h1:I4A+glKBHiTgiEjQiCCQfCAIcIMFGt291SmsvcrFzJA=
+k8s.io/client-go v0.0.0-20190718183610-8e956561bbf5/go.mod h1:ozblAqkW495yoAX60QZyxQBq5W0YixE9Ffn4F91RO0g=
+k8s.io/code-generator v0.0.0-20190612205613-18da4a14b22b h1:p+PRuwXWwk5e+UYvicGiavEupapqM5NOxUl3y1GkD6c=
+k8s.io/code-generator v0.0.0-20190612205613-18da4a14b22b/go.mod h1:G8bQwmHm2eafm5bgtX67XDZQ8CWKSGu9DekI+yN4Y5I=
+k8s.io/gengo v0.0.0-20190116091435-f8a0810f38af h1:SwjZbO0u5ZuaV6TRMWOGB40iaycX8sbdMQHtjNZ19dk=
+k8s.io/gengo v0.0.0-20190116091435-f8a0810f38af/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.3.1 h1:RVgyDHY/kFKtLqh67NvEWIgkMneNoIrdkN0CxDSQc68=
+k8s.io/klog v0.3.1/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/kube-openapi v0.0.0-20190228160746-b3a7cee44a30/go.mod h1:BXM9ceUBTj2QnfH2MK1odQs778ajze1RxcmP6S8RVVc=
+k8s.io/utils v0.0.0-20190221042446-c2654d5206da/go.mod h1:8k8uAuAQ0rXslZKaEWd0c3oVhZz7sSzSiPnVZayjIX0=
+modernc.org/cc v1.0.0/go.mod h1:1Sk4//wdnYJiUIxnW8ddKpaOJCF37yAdqYnkxUpaYxw=
+modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
+modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
+modernc.org/strutil v1.0.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
+modernc.org/xc v1.0.0/go.mod h1:mRNCo0bvLjGhHO9WsyuKVU4q0ceiDDDoEeWDJHrNx8I=
+mvdan.cc/xurls/v2 v2.0.0/go.mod h1:2/webFPYOXN9jp/lzuj0zuAVlF+9g4KPFJANH1oJhRU=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
--- a/internal/auth.go
+++ b/internal/auth.go
@ -0,0 +1,328 @@
+package tfa
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/thomseddon/traefik-forward-auth/internal/provider"
+)
+
+// Request Validation
+
+// Cookie = hash(secret, cookie domain, email, expires)|expires|email
+func ValidateCookie(r *http.Request, c *http.Cookie) (string, error) {
+	parts := strings.Split(c.Value, "|")
+
+	if len(parts) != 3 {
+		return "", errors.New("Invalid cookie format")
+	}
+
+	mac, err := base64.URLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return "", errors.New("Unable to decode cookie mac")
+	}
+
+	expectedSignature := cookieSignature(r, parts[2], parts[1])
+	expected, err := base64.URLEncoding.DecodeString(expectedSignature)
+	if err != nil {
+		return "", errors.New("Unable to generate mac")
+	}
+
+	// Valid token?
+	if !hmac.Equal(mac, expected) {
+		return "", errors.New("Invalid cookie mac")
+	}
+
+	expires, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return "", errors.New("Unable to parse cookie expiry")
+	}
+
+	// Has it expired?
+	if time.Unix(expires, 0).Before(time.Now()) {
+		return "", errors.New("Cookie has expired")
+	}
+
+	// Looks valid
+	return parts[2], nil
+}
+
+// Validate email
+func ValidateEmail(email string) bool {
+	found := false
+	if len(config.Whitelist) > 0 {
+		for _, whitelist := range config.Whitelist {
+			if email == whitelist {
+				found = true
+			}
+		}
+	} else if len(config.Domains) > 0 {
+		parts := strings.Split(email, "@")
+		if len(parts) < 2 {
+			return false
+		}
+		for _, domain := range config.Domains {
+			if domain == parts[1] {
+				found = true
+			}
+		}
+	} else {
+		return true
+	}
+
+	return found
+}
+
+// Utility methods
+
+// Get the redirect base
+func redirectBase(r *http.Request) string {
+	proto := r.Header.Get("X-Forwarded-Proto")
+	host := r.Header.Get("X-Forwarded-Host")
+
+	return fmt.Sprintf("%s://%s", proto, host)
+}
+
+// Return url
+func returnUrl(r *http.Request) string {
+	path := r.Header.Get("X-Forwarded-Uri")
+
+	return fmt.Sprintf("%s%s", redirectBase(r), path)
+}
+
+// Get oauth redirect uri
+func redirectUri(r *http.Request) string {
+	if use, _ := useAuthDomain(r); use {
+		proto := r.Header.Get("X-Forwarded-Proto")
+		return fmt.Sprintf("%s://%s%s", proto, config.AuthHost, config.Path)
+	}
+
+	return fmt.Sprintf("%s%s", redirectBase(r), config.Path)
+}
+
+// Should we use auth host + what it is
+func useAuthDomain(r *http.Request) (bool, string) {
+	if config.AuthHost == "" {
+		return false, ""
+	}
+
+	// Does the request match a given cookie domain?
+	reqMatch, reqHost := matchCookieDomains(r.Header.Get("X-Forwarded-Host"))
+
+	// Do any of the auth hosts match a cookie domain?
+	authMatch, authHost := matchCookieDomains(config.AuthHost)
+
+	// We need both to match the same domain
+	return reqMatch && authMatch && reqHost == authHost, reqHost
+}
+
+// Cookie methods
+
+// Create an auth cookie
+func MakeCookie(r *http.Request, email string) *http.Cookie {
+	expires := cookieExpiry()
+	mac := cookieSignature(r, email, fmt.Sprintf("%d", expires.Unix()))
+	value := fmt.Sprintf("%s|%d|%s", mac, expires.Unix(), email)
+
+	return &http.Cookie{
+		Name:     config.CookieName,
+		Value:    value,
+		Path:     "/",
+		Domain:   cookieDomain(r),
+		HttpOnly: true,
+		Secure:   !config.InsecureCookie,
+		Expires:  expires,
+	}
+}
+
+// Make a CSRF cookie (used during login only)
+func MakeCSRFCookie(r *http.Request, nonce string) *http.Cookie {
+	return &http.Cookie{
+		Name:     config.CSRFCookieName,
+		Value:    nonce,
+		Path:     "/",
+		Domain:   csrfCookieDomain(r),
+		HttpOnly: true,
+		Secure:   !config.InsecureCookie,
+		Expires:  cookieExpiry(),
+	}
+}
+
+// Create a cookie to clear csrf cookie
+func ClearCSRFCookie(r *http.Request) *http.Cookie {
+	return &http.Cookie{
+		Name:     config.CSRFCookieName,
+		Value:    "",
+		Path:     "/",
+		Domain:   csrfCookieDomain(r),
+		HttpOnly: true,
+		Secure:   !config.InsecureCookie,
+		Expires:  time.Now().Local().Add(time.Hour * -1),
+	}
+}
+
+// Validate the csrf cookie against state
+func ValidateCSRFCookie(r *http.Request, c *http.Cookie) (valid bool, provider string, redirect string, err error) {
+	state := r.URL.Query().Get("state")
+
+	if len(c.Value) != 32 {
+		return false, "", "", errors.New("Invalid CSRF cookie value")
+	}
+
+	if len(state) < 34 {
+		return false, "", "", errors.New("Invalid CSRF state value")
+	}
+
+	// Check nonce match
+	if c.Value != state[:32] {
+		return false, "", "", errors.New("CSRF cookie does not match state")
+	}
+
+	// Extract provider
+	params := state[33:]
+	split := strings.Index(params, ":")
+	if split == -1 {
+		return false, "", "", errors.New("Invalid CSRF state format")
+	}
+
+	// Valid, return provider and redirect
+	return true, params[:split], params[split+1:], nil
+}
+
+func MakeState(r *http.Request, p provider.Provider, nonce string) string {
+	return fmt.Sprintf("%s:%s:%s", nonce, p.Name(), returnUrl(r))
+}
+
+func Nonce() (error, string) {
+	// Make nonce
+	nonce := make([]byte, 16)
+	_, err := rand.Read(nonce)
+	if err != nil {
+		return err, ""
+	}
+
+	return nil, fmt.Sprintf("%x", nonce)
+}
+
+// Cookie domain
+func cookieDomain(r *http.Request) string {
+	host := r.Header.Get("X-Forwarded-Host")
+
+	// Check if any of the given cookie domains matches
+	_, domain := matchCookieDomains(host)
+	return domain
+}
+
+// Cookie domain
+func csrfCookieDomain(r *http.Request) string {
+	var host string
+	if use, domain := useAuthDomain(r); use {
+		host = domain
+	} else {
+		host = r.Header.Get("X-Forwarded-Host")
+	}
+
+	// Remove port
+	p := strings.Split(host, ":")
+	return p[0]
+}
+
+// Return matching cookie domain if exists
+func matchCookieDomains(domain string) (bool, string) {
+	// Remove port
+	p := strings.Split(domain, ":")
+
+	for _, d := range config.CookieDomains {
+		if d.Match(p[0]) {
+			return true, d.Domain
+		}
+	}
+
+	return false, p[0]
+}
+
+// Create cookie hmac
+func cookieSignature(r *http.Request, email, expires string) string {
+	hash := hmac.New(sha256.New, config.Secret)
+	hash.Write([]byte(cookieDomain(r)))
+	hash.Write([]byte(email))
+	hash.Write([]byte(expires))
+	return base64.URLEncoding.EncodeToString(hash.Sum(nil))
+}
+
+// Get cookie expiry
+func cookieExpiry() time.Time {
+	return time.Now().Local().Add(config.Lifetime)
+}
+
+// Cookie Domain
+
+// Cookie Domain
+type CookieDomain struct {
+	Domain       string
+	DomainLen    int
+	SubDomain    string
+	SubDomainLen int
+}
+
+func NewCookieDomain(domain string) *CookieDomain {
+	return &CookieDomain{
+		Domain:       domain,
+		DomainLen:    len(domain),
+		SubDomain:    fmt.Sprintf(".%s", domain),
+		SubDomainLen: len(domain) + 1,
+	}
+}
+
+func (c *CookieDomain) Match(host string) bool {
+	// Exact domain match?
+	if host == c.Domain {
+		return true
+	}
+
+	// Subdomain match?
+	if len(host) >= c.SubDomainLen && host[len(host)-c.SubDomainLen:] == c.SubDomain {
+		return true
+	}
+
+	return false
+}
+
+func (c *CookieDomain) UnmarshalFlag(value string) error {
+	*c = *NewCookieDomain(value)
+	return nil
+}
+
+func (c *CookieDomain) MarshalFlag() (string, error) {
+	return c.Domain, nil
+}
+
+// Legacy support for comma separated list of cookie domains
+
+type CookieDomains []CookieDomain
+
+func (c *CookieDomains) UnmarshalFlag(value string) error {
+	if len(value) > 0 {
+		for _, d := range strings.Split(value, ",") {
+			cookieDomain := NewCookieDomain(d)
+			*c = append(*c, *cookieDomain)
+		}
+	}
+	return nil
+}
+
+func (c *CookieDomains) MarshalFlag() (string, error) {
+	var domains []string
+	for _, d := range *c {
+		domains = append(domains, d.Domain)
+	}
+	return strings.Join(domains, ","), nil
+}
--- a/internal/auth_test.go
+++ b/internal/auth_test.go
@ -0,0 +1,354 @@
+package tfa
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/thomseddon/traefik-forward-auth/internal/provider"
+)
+
+/**
+ * Tests
+ */
+
+func TestAuthValidateCookie(t *testing.T) {
+	assert := assert.New(t)
+	config, _ = NewConfig([]string{})
+	r, _ := http.NewRequest("GET", "http://example.com", nil)
+	c := &http.Cookie{}
+
+	// Should require 3 parts
+	c.Value = ""
+	_, err := ValidateCookie(r, c)
+	if assert.Error(err) {
+		assert.Equal("Invalid cookie format", err.Error())
+	}
+	c.Value = "1|2"
+	_, err = ValidateCookie(r, c)
+	if assert.Error(err) {
+		assert.Equal("Invalid cookie format", err.Error())
+	}
+	c.Value = "1|2|3|4"
+	_, err = ValidateCookie(r, c)
+	if assert.Error(err) {
+		assert.Equal("Invalid cookie format", err.Error())
+	}
+
+	// Should catch invalid mac
+	c.Value = "MQ==|2|3"
+	_, err = ValidateCookie(r, c)
+	if assert.Error(err) {
+		assert.Equal("Invalid cookie mac", err.Error())
+	}
+
+	// Should catch expired
+	config.Lifetime = time.Second * time.Duration(-1)
+	c = MakeCookie(r, "test@test.com")
+	_, err = ValidateCookie(r, c)
+	if assert.Error(err) {
+		assert.Equal("Cookie has expired", err.Error())
+	}
+
+	// Should accept valid cookie
+	config.Lifetime = time.Second * time.Duration(10)
+	c = MakeCookie(r, "test@test.com")
+	email, err := ValidateCookie(r, c)
+	assert.Nil(err, "valid request should not return an error")
+	assert.Equal("test@test.com", email, "valid request should return user email")
+}
+
+func TestAuthValidateEmail(t *testing.T) {
+	assert := assert.New(t)
+	config, _ = NewConfig([]string{})
+
+	// Should allow any
+	v := ValidateEmail("test@test.com")
+	assert.True(v, "should allow any domain if email domain is not defined")
+	v = ValidateEmail("one@two.com")
+	assert.True(v, "should allow any domain if email domain is not defined")
+
+	// Should block non matching domain
+	config.Domains = []string{"test.com"}
+	v = ValidateEmail("one@two.com")
+	assert.False(v, "should not allow user from another domain")
+
+	// Should allow matching domain
+	config.Domains = []string{"test.com"}
+	v = ValidateEmail("test@test.com")
+	assert.True(v, "should allow user from allowed domain")
+
+	// Should block non whitelisted email address
+	config.Domains = []string{}
+	config.Whitelist = []string{"test@test.com"}
+	v = ValidateEmail("one@two.com")
+	assert.False(v, "should not allow user not in whitelist")
+
+	// Should allow matching whitelisted email address
+	config.Domains = []string{}
+	config.Whitelist = []string{"test@test.com"}
+	v = ValidateEmail("test@test.com")
+	assert.True(v, "should allow user in whitelist")
+}
+
+func TestRedirectUri(t *testing.T) {
+	assert := assert.New(t)
+
+	r, _ := http.NewRequest("GET", "http://example.com", nil)
+	r.Header.Add("X-Forwarded-Proto", "http")
+	r.Header.Add("X-Forwarded-Host", "app.example.com")
+	r.Header.Add("X-Forwarded-Uri", "/hello")
+
+	//
+	// No Auth Host
+	//
+	config, _ = NewConfig([]string{})
+
+	uri, err := url.Parse(redirectUri(r))
+	assert.Nil(err)
+	assert.Equal("http", uri.Scheme)
+	assert.Equal("app.example.com", uri.Host)
+	assert.Equal("/_oauth", uri.Path)
+
+	//
+	// With Auth URL but no matching cookie domain
+	// - will not use auth host
+	//
+	config.AuthHost = "auth.example.com"
+
+	uri, err = url.Parse(redirectUri(r))
+	assert.Nil(err)
+	assert.Equal("http", uri.Scheme)
+	assert.Equal("app.example.com", uri.Host)
+	assert.Equal("/_oauth", uri.Path)
+
+	//
+	// With correct Auth URL + cookie domain
+	//
+	config.AuthHost = "auth.example.com"
+	config.CookieDomains = []CookieDomain{*NewCookieDomain("example.com")}
+
+	// Check url
+	uri, err = url.Parse(redirectUri(r))
+	assert.Nil(err)
+	assert.Equal("http", uri.Scheme)
+	assert.Equal("auth.example.com", uri.Host)
+	assert.Equal("/_oauth", uri.Path)
+
+	//
+	// With Auth URL + cookie domain, but from different domain
+	// - will not use auth host
+	//
+	r, _ = http.NewRequest("GET", "http://another.com", nil)
+	r.Header.Add("X-Forwarded-Proto", "https")
+	r.Header.Add("X-Forwarded-Host", "another.com")
+	r.Header.Add("X-Forwarded-Uri", "/hello")
+
+	config.AuthHost = "auth.example.com"
+	config.CookieDomains = []CookieDomain{*NewCookieDomain("example.com")}
+
+	// Check url
+	uri, err = url.Parse(redirectUri(r))
+	assert.Nil(err)
+	assert.Equal("https", uri.Scheme)
+	assert.Equal("another.com", uri.Host)
+	assert.Equal("/_oauth", uri.Path)
+}
+
+func TestAuthMakeCookie(t *testing.T) {
+	assert := assert.New(t)
+	config, _ = NewConfig([]string{})
+	r, _ := http.NewRequest("GET", "http://app.example.com", nil)
+	r.Header.Add("X-Forwarded-Host", "app.example.com")
+
+	c := MakeCookie(r, "test@example.com")
+	assert.Equal("_forward_auth", c.Name)
+	parts := strings.Split(c.Value, "|")
+	assert.Len(parts, 3, "cookie should be 3 parts")
+	_, err := ValidateCookie(r, c)
+	assert.Nil(err, "should generate valid cookie")
+	assert.Equal("/", c.Path)
+	assert.Equal("app.example.com", c.Domain)
+	assert.True(c.Secure)
+
+	expires := time.Now().Local().Add(config.Lifetime)
+	assert.WithinDuration(expires, c.Expires, 10*time.Second)
+
+	config.CookieName = "testname"
+	config.InsecureCookie = true
+	c = MakeCookie(r, "test@example.com")
+	assert.Equal("testname", c.Name)
+	assert.False(c.Secure)
+}
+
+func TestAuthMakeCSRFCookie(t *testing.T) {
+	assert := assert.New(t)
+	config, _ = NewConfig([]string{})
+	r, _ := http.NewRequest("GET", "http://app.example.com", nil)
+	r.Header.Add("X-Forwarded-Host", "app.example.com")
+
+	// No cookie domain or auth url
+	c := MakeCSRFCookie(r, "12345678901234567890123456789012")
+	assert.Equal("app.example.com", c.Domain)
+
+	// With cookie domain but no auth url
+	config = &Config{
+		CookieDomains: []CookieDomain{*NewCookieDomain("example.com")},
+	}
+	c = MakeCSRFCookie(r, "12345678901234567890123456789012")
+	assert.Equal("app.example.com", c.Domain)
+
+	// With cookie domain and auth url
+	config = &Config{
+		AuthHost:      "auth.example.com",
+		CookieDomains: []CookieDomain{*NewCookieDomain("example.com")},
+	}
+	c = MakeCSRFCookie(r, "12345678901234567890123456789012")
+	assert.Equal("example.com", c.Domain)
+}
+
+func TestAuthClearCSRFCookie(t *testing.T) {
+	config, _ = NewConfig([]string{})
+	r, _ := http.NewRequest("GET", "http://example.com", nil)
+
+	c := ClearCSRFCookie(r)
+	if c.Value != "" {
+		t.Error("ClearCSRFCookie should create cookie with empty value")
+	}
+}
+
+func TestAuthValidateCSRFCookie(t *testing.T) {
+	assert := assert.New(t)
+	config, _ = NewConfig([]string{})
+	c := &http.Cookie{}
+
+	newCsrfRequest := func(state string) *http.Request {
+		u := fmt.Sprintf("http://example.com?state=%s", state)
+		r, _ := http.NewRequest("GET", u, nil)
+		return r
+	}
+
+	// Should require 32 char string
+	r := newCsrfRequest("")
+	c.Value = ""
+	valid, _, _, err := ValidateCSRFCookie(r, c)
+	assert.False(valid)
+	if assert.Error(err) {
+		assert.Equal("Invalid CSRF cookie value", err.Error())
+	}
+	c.Value = "123456789012345678901234567890123"
+	valid, _, _, err = ValidateCSRFCookie(r, c)
+	assert.False(valid)
+	if assert.Error(err) {
+		assert.Equal("Invalid CSRF cookie value", err.Error())
+	}
+
+	// Should require valid state
+	r = newCsrfRequest("12345678901234567890123456789012:")
+	c.Value = "12345678901234567890123456789012"
+	valid, _, _, err = ValidateCSRFCookie(r, c)
+	assert.False(valid)
+	if assert.Error(err) {
+		assert.Equal("Invalid CSRF state value", err.Error())
+	}
+
+	// Should require provider
+	r = newCsrfRequest("12345678901234567890123456789012:99")
+	c.Value = "12345678901234567890123456789012"
+	valid, _, _, err = ValidateCSRFCookie(r, c)
+	assert.False(valid)
+	if assert.Error(err) {
+		assert.Equal("Invalid CSRF state format", err.Error())
+	}
+
+	// Should allow valid state
+	r = newCsrfRequest("12345678901234567890123456789012:p99:url123")
+	c.Value = "12345678901234567890123456789012"
+	valid, provider, redirect, err := ValidateCSRFCookie(r, c)
+	assert.True(valid, "valid request should return valid")
+	assert.Nil(err, "valid request should not return an error")
+	assert.Equal("p99", provider, "valid request should return correct provider")
+	assert.Equal("url123", redirect, "valid request should return correct redirect")
+}
+
+func TestMakeState(t *testing.T) {
+	assert := assert.New(t)
+
+	r, _ := http.NewRequest("GET", "http://example.com", nil)
+	r.Header.Add("X-Forwarded-Proto", "http")
+	r.Header.Add("X-Forwarded-Host", "example.com")
+	r.Header.Add("X-Forwarded-Uri", "/hello")
+
+	// Test with google
+	p := provider.Google{}
+	state := MakeState(r, &p, "nonce")
+	assert.Equal("nonce:google:http://example.com/hello", state)
+
+	// Test with OIDC
+	p2 := provider.OIDC{}
+	state = MakeState(r, &p2, "nonce")
+	assert.Equal("nonce:oidc:http://example.com/hello", state)
+}
+
+func TestAuthNonce(t *testing.T) {
+	assert := assert.New(t)
+	err, nonce1 := Nonce()
+	assert.Nil(err, "error generating nonce")
+	assert.Len(nonce1, 32, "length should be 32 chars")
+
+	err, nonce2 := Nonce()
+	assert.Nil(err, "error generating nonce")
+	assert.Len(nonce2, 32, "length should be 32 chars")
+
+	assert.NotEqual(nonce1, nonce2, "nonce should not be equal")
+}
+
+func TestAuthCookieDomainMatch(t *testing.T) {
+	assert := assert.New(t)
+	cd := NewCookieDomain("example.com")
+
+	// Exact should match
+	assert.True(cd.Match("example.com"), "exact domain should match")
+
+	// Subdomain should match
+	assert.True(cd.Match("test.example.com"), "subdomain should match")
+	assert.True(cd.Match("twolevels.test.example.com"), "subdomain should match")
+	assert.True(cd.Match("many.many.levels.test.example.com"), "subdomain should match")
+
+	// Derived domain should not match
+	assert.False(cd.Match("testexample.com"), "derived domain should not match")
+
+	// Other domain should not match
+	assert.False(cd.Match("test.com"), "other domain should not match")
+}
+
+func TestAuthCookieDomains(t *testing.T) {
+	assert := assert.New(t)
+	cds := CookieDomains{}
+
+	err := cds.UnmarshalFlag("one.com,two.org")
+	assert.Nil(err)
+	expected := CookieDomains{
+		CookieDomain{
+			Domain:       "one.com",
+			DomainLen:    7,
+			SubDomain:    ".one.com",
+			SubDomainLen: 8,
+		},
+		CookieDomain{
+			Domain:       "two.org",
+			DomainLen:    7,
+			SubDomain:    ".two.org",
+			SubDomainLen: 8,
+		},
+	}
+	assert.Equal(expected, cds)
+
+	marshal, err := cds.MarshalFlag()
+	assert.Nil(err)
+	assert.Equal("one.com,two.org", marshal)
+}
--- a/internal/config.go
+++ b/internal/config.go
@ -0,0 +1,357 @@
+package tfa
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/thomseddon/go-flags"
+	"github.com/thomseddon/traefik-forward-auth/internal/provider"
+)
+
+var config *Config
+
+type Config struct {
+	LogLevel  string `long:"log-level" env:"LOG_LEVEL" default:"warn" choice:"trace" choice:"debug" choice:"info" choice:"warn" choice:"error" choice:"fatal" choice:"panic" description:"Log level"`
+	LogFormat string `long:"log-format"  env:"LOG_FORMAT" default:"text" choice:"text" choice:"json" choice:"pretty" description:"Log format"`
+
+	AuthHost        string               `long:"auth-host" env:"AUTH_HOST" description:"Single host to use when returning from 3rd party auth"`
+	Config          func(s string) error `long:"config" env:"CONFIG" description:"Path to config file" json:"-"`
+	CookieDomains   []CookieDomain       `long:"cookie-domain" env:"COOKIE_DOMAIN" description:"Domain to set auth cookie on, can be set multiple times"`
+	InsecureCookie  bool                 `long:"insecure-cookie" env:"INSECURE_COOKIE" description:"Use insecure cookies"`
+	CookieName      string               `long:"cookie-name" env:"COOKIE_NAME" default:"_forward_auth" description:"Cookie Name"`
+	CSRFCookieName  string               `long:"csrf-cookie-name" env:"CSRF_COOKIE_NAME" default:"_forward_auth_csrf" description:"CSRF Cookie Name"`
+	DefaultAction   string               `long:"default-action" env:"DEFAULT_ACTION" default:"auth" choice:"auth" choice:"allow" description:"Default action"`
+	DefaultProvider string               `long:"default-provider" env:"DEFAULT_PROVIDER" default:"google" choice:"google" choice:"oidc" description:"Default provider"`
+	Domains         CommaSeparatedList   `long:"domain" env:"DOMAIN" description:"Only allow given email domains, can be set multiple times"`
+	LifetimeString  int                  `long:"lifetime" env:"LIFETIME" default:"43200" description:"Lifetime in seconds"`
+	Path            string               `long:"url-path" env:"URL_PATH" default:"/_oauth" description:"Callback URL Path"`
+	SecretString    string               `long:"secret" env:"SECRET" description:"Secret used for signing (required)" json:"-"`
+	Whitelist       CommaSeparatedList   `long:"whitelist" env:"WHITELIST" description:"Only allow given email addresses, can be set multiple times"`
+
+	Providers provider.Providers `group:"providers" namespace:"providers" env-namespace:"PROVIDERS"`
+	Rules     map[string]*Rule   `long:"rule.<name>.<param>" description:"Rule definitions, param can be: \"action\" or \"rule\""`
+
+	// Filled during transformations
+	Secret   []byte `json:"-"`
+	Lifetime time.Duration
+
+	// Legacy
+	CookieDomainsLegacy CookieDomains `long:"cookie-domains" env:"COOKIE_DOMAINS" description:"DEPRECATED - Use \"cookie-domain\""`
+	CookieSecretLegacy  string        `long:"cookie-secret" env:"COOKIE_SECRET" description:"DEPRECATED - Use \"secret\""  json:"-"`
+	CookieSecureLegacy  string        `long:"cookie-secure" env:"COOKIE_SECURE" description:"DEPRECATED - Use \"insecure-cookie\""`
+	ClientIdLegacy      string        `long:"client-id" env:"CLIENT_ID" description:"DEPRECATED - Use \"providers.google.client-id\""`
+	ClientSecretLegacy  string        `long:"client-secret" env:"CLIENT_SECRET" description:"DEPRECATED - Use \"providers.google.client-id\""  json:"-"`
+	PromptLegacy        string        `long:"prompt" env:"PROMPT" description:"DEPRECATED - Use \"providers.google.prompt\""`
+}
+
+func NewGlobalConfig() *Config {
+	var err error
+	config, err = NewConfig(os.Args[1:])
+	if err != nil {
+		fmt.Printf("%+v\n", err)
+		os.Exit(1)
+	}
+
+	return config
+}
+
+// TODO: move config parsing into new func "NewParsedConfig"
+
+func NewConfig(args []string) (*Config, error) {
+	c := &Config{
+		Rules: map[string]*Rule{},
+	}
+
+	err := c.parseFlags(args)
+	if err != nil {
+		return c, err
+	}
+
+	// TODO: as log flags have now been parsed maybe we should return here so
+	// any further errors can be logged via logrus instead of printed?
+
+	// TODO: Rename "Validate" method to "Setup" and move all below logic
+
+	// Setup
+	// Set default provider on any rules where it's not specified
+	for _, rule := range c.Rules {
+		if rule.Provider == "" {
+			rule.Provider = c.DefaultProvider
+		}
+	}
+
+	// Backwards compatability
+	if c.CookieSecretLegacy != "" && c.SecretString == "" {
+		fmt.Println("cookie-secret config option is deprecated, please use secret")
+		c.SecretString = c.CookieSecretLegacy
+	}
+	if c.ClientIdLegacy != "" {
+		c.Providers.Google.ClientID = c.ClientIdLegacy
+	}
+	if c.ClientSecretLegacy != "" {
+		c.Providers.Google.ClientSecret = c.ClientSecretLegacy
+	}
+	if c.PromptLegacy != "" {
+		fmt.Println("prompt config option is deprecated, please use providers.google.prompt")
+		c.Providers.Google.Prompt = c.PromptLegacy
+	}
+	if c.CookieSecureLegacy != "" {
+		fmt.Println("cookie-secure config option is deprecated, please use insecure-cookie")
+		secure, err := strconv.ParseBool(c.CookieSecureLegacy)
+		if err != nil {
+			return c, err
+		}
+		c.InsecureCookie = !secure
+	}
+	if len(c.CookieDomainsLegacy) > 0 {
+		fmt.Println("cookie-domains config option is deprecated, please use cookie-domain")
+		c.CookieDomains = append(c.CookieDomains, c.CookieDomainsLegacy...)
+	}
+
+	// Transformations
+	if len(c.Path) > 0 && c.Path[0] != '/' {
+		c.Path = "/" + c.Path
+	}
+	c.Secret = []byte(c.SecretString)
+	c.Lifetime = time.Second * time.Duration(c.LifetimeString)
+
+	return c, nil
+}
+
+func (c *Config) parseFlags(args []string) error {
+	p := flags.NewParser(c, flags.Default|flags.IniUnknownOptionHandler)
+	p.UnknownOptionHandler = c.parseUnknownFlag
+
+	i := flags.NewIniParser(p)
+	c.Config = func(s string) error {
+		// Try parsing at as an ini
+		err := i.ParseFile(s)
+
+		// If it fails with a syntax error, try converting legacy to ini
+		if err != nil && strings.Contains(err.Error(), "malformed key=value") {
+			converted, convertErr := convertLegacyToIni(s)
+			if convertErr != nil {
+				// If conversion fails, return the original error
+				return err
+			}
+
+			fmt.Println("config format deprecated, please use ini format")
+			return i.Parse(converted)
+		}
+
+		return err
+	}
+
+	_, err := p.ParseArgs(args)
+	if err != nil {
+		return handleFlagError(err)
+	}
+
+	return nil
+}
+
+func (c *Config) parseUnknownFlag(option string, arg flags.SplitArgument, args []string) ([]string, error) {
+	// Parse rules in the format "rule.<name>.<param>"
+	parts := strings.Split(option, ".")
+	if len(parts) == 3 && parts[0] == "rule" {
+		// Ensure there is a name
+		name := parts[1]
+		if len(name) == 0 {
+			return args, errors.New("route name is required")
+		}
+
+		// Get value, or pop the next arg
+		val, ok := arg.Value()
+		if !ok && len(args) > 1 {
+			val = args[0]
+			args = args[1:]
+		}
+
+		// Check value
+		if len(val) == 0 {
+			return args, errors.New("route param value is required")
+		}
+
+		// Unquote if required
+		if val[0] == '"' {
+			var err error
+			val, err = strconv.Unquote(val)
+			if err != nil {
+				return args, err
+			}
+		}
+
+		// Get or create rule
+		rule, ok := c.Rules[name]
+		if !ok {
+			rule = NewRule()
+			c.Rules[name] = rule
+		}
+
+		// Add param value to rule
+		switch parts[2] {
+		case "action":
+			rule.Action = val
+		case "rule":
+			rule.Rule = val
+		case "provider":
+			rule.Provider = val
+		default:
+			return args, fmt.Errorf("invalid route param: %v", option)
+		}
+	} else {
+		return args, fmt.Errorf("unknown flag: %v", option)
+	}
+
+	return args, nil
+}
+
+func handleFlagError(err error) error {
+	flagsErr, ok := err.(*flags.Error)
+	if ok && flagsErr.Type == flags.ErrHelp {
+		// Library has just printed cli help
+		os.Exit(0)
+	}
+
+	return err
+}
+
+var legacyFileFormat = regexp.MustCompile(`(?m)^([a-z-]+) (.*)$`)
+
+func convertLegacyToIni(name string) (io.Reader, error) {
+	b, err := ioutil.ReadFile(name)
+	if err != nil {
+		return nil, err
+	}
+
+	return bytes.NewReader(legacyFileFormat.ReplaceAll(b, []byte("$1=$2"))), nil
+}
+
+func (c *Config) Validate() {
+	// Check for show stopper errors
+	if len(c.Secret) == 0 {
+		log.Fatal("\"secret\" option must be set")
+	}
+
+	// Setup default provider
+	err := c.setupProvider(c.DefaultProvider)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Check rules (validates the rule and the rule provider)
+	for _, rule := range c.Rules {
+		err = rule.Validate(c)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+}
+
+func (c Config) String() string {
+	jsonConf, _ := json.Marshal(c)
+	return string(jsonConf)
+}
+
+// GetProvider returns the provider of the given name
+func (c *Config) GetProvider(name string) (provider.Provider, error) {
+	switch name {
+	case "google":
+		return &c.Providers.Google, nil
+	case "oidc":
+		return &c.Providers.OIDC, nil
+	}
+
+	return nil, fmt.Errorf("Unknown provider: %s", name)
+}
+
+// GetConfiguredProvider returns the provider of the given name, if it has been
+// configured. Returns an error if the provider is unknown, or hasn't been configured
+func (c *Config) GetConfiguredProvider(name string) (provider.Provider, error) {
+	// Check the provider has been configured
+	if !c.providerConfigured(name) {
+		return nil, fmt.Errorf("Unconfigured provider: %s", name)
+	}
+
+	return c.GetProvider(name)
+}
+
+func (c *Config) providerConfigured(name string) bool {
+	// Check default provider
+	if name == c.DefaultProvider {
+		return true
+	}
+
+	// Check rule providers
+	for _, rule := range c.Rules {
+		if name == rule.Provider {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (c *Config) setupProvider(name string) error {
+	// Check provider exists
+	p, err := c.GetProvider(name)
+	if err != nil {
+		return err
+	}
+
+	// Setup
+	err = p.Setup()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+type Rule struct {
+	Action   string
+	Rule     string
+	Provider string
+}
+
+func NewRule() *Rule {
+	return &Rule{
+		Action: "auth",
+	}
+}
+
+func (r *Rule) formattedRule() string {
+	// Traefik implements their own "Host" matcher and then offers "HostRegexp"
+	// to invoke the mux "Host" matcher. This ensures the mux version is used
+	return strings.ReplaceAll(r.Rule, "Host(", "HostRegexp(")
+}
+
+func (r *Rule) Validate(c *Config) error {
+	if r.Action != "auth" && r.Action != "allow" {
+		return errors.New("invalid rule action, must be \"auth\" or \"allow\"")
+	}
+
+	return c.setupProvider(r.Provider)
+}
+
+// Legacy support for comma separated lists
+
+type CommaSeparatedList []string
+
+func (c *CommaSeparatedList) UnmarshalFlag(value string) error {
+	*c = append(*c, strings.Split(value, ",")...)
+	return nil
+}
+
+func (c *CommaSeparatedList) MarshalFlag() (string, error) {
+	return strings.Join(*c, ","), nil
+}
--- a/internal/config_test.go
+++ b/internal/config_test.go
@ -0,0 +1,386 @@
+package tfa
+
+import (
+	// "fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/sirupsen/logrus"
+	"github.com/sirupsen/logrus/hooks/test"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+/**
+ * Tests
+ */
+
+func TestConfigDefaults(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{})
+	assert.Nil(err)
+
+	assert.Equal("warn", c.LogLevel)
+	assert.Equal("text", c.LogFormat)
+
+	assert.Equal("", c.AuthHost)
+	assert.Len(c.CookieDomains, 0)
+	assert.False(c.InsecureCookie)
+	assert.Equal("_forward_auth", c.CookieName)
+	assert.Equal("_forward_auth_csrf", c.CSRFCookieName)
+	assert.Equal("auth", c.DefaultAction)
+	assert.Equal("google", c.DefaultProvider)
+	assert.Len(c.Domains, 0)
+	assert.Equal(time.Second*time.Duration(43200), c.Lifetime)
+	assert.Equal("/_oauth", c.Path)
+	assert.Len(c.Whitelist, 0)
+}
+
+func TestConfigParseArgs(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{
+		"--cookie-name=cookiename",
+		"--csrf-cookie-name", "\"csrfcookiename\"",
+		"--default-provider", "\"oidc\"",
+		"--rule.1.action=allow",
+		"--rule.1.rule=PathPrefix(`/one`)",
+		"--rule.two.action=auth",
+		"--rule.two.rule=\"Host(`two.com`) && Path(`/two`)\"",
+	})
+	require.Nil(t, err)
+
+	// Check normal flags
+	assert.Equal("cookiename", c.CookieName)
+	assert.Equal("csrfcookiename", c.CSRFCookieName)
+	assert.Equal("oidc", c.DefaultProvider)
+
+	// Check rules
+	assert.Equal(map[string]*Rule{
+		"1": {
+			Action:   "allow",
+			Rule:     "PathPrefix(`/one`)",
+			Provider: "oidc",
+		},
+		"two": {
+			Action:   "auth",
+			Rule:     "Host(`two.com`) && Path(`/two`)",
+			Provider: "oidc",
+		},
+	}, c.Rules)
+}
+
+func TestConfigParseUnknownFlags(t *testing.T) {
+	_, err := NewConfig([]string{
+		"--unknown=_oauthpath2",
+	})
+	if assert.Error(t, err) {
+		assert.Equal(t, "unknown flag: unknown", err.Error())
+	}
+}
+
+func TestConfigParseRuleError(t *testing.T) {
+	assert := assert.New(t)
+
+	// Rule without name
+	_, err := NewConfig([]string{
+		"--rule..action=auth",
+	})
+	if assert.Error(err) {
+		assert.Equal("route name is required", err.Error())
+	}
+
+	// Rule without value
+	c, err := NewConfig([]string{
+		"--rule.one.action=",
+	})
+	if assert.Error(err) {
+		assert.Equal("route param value is required", err.Error())
+	}
+	// Check rules
+	assert.Equal(map[string]*Rule{}, c.Rules)
+}
+
+func TestConfigFlagBackwardsCompatability(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{
+		"--client-id=clientid",
+		"--client-secret=verysecret",
+		"--prompt=prompt",
+		"--cookie-secret=veryverysecret",
+		"--lifetime=200",
+		"--cookie-secure=false",
+		"--cookie-domains=test1.com,example.org",
+		"--cookie-domain=another1.net",
+		"--domain=test2.com,example.org",
+		"--domain=another2.net",
+		"--whitelist=test3.com,example.org",
+		"--whitelist=another3.net",
+	})
+	require.Nil(t, err)
+
+	// The following used to be passed as comma separated list
+	expected1 := []CookieDomain{
+		*NewCookieDomain("another1.net"),
+		*NewCookieDomain("test1.com"),
+		*NewCookieDomain("example.org"),
+	}
+	assert.Equal(expected1, c.CookieDomains, "should read legacy comma separated list cookie-domains")
+
+	expected2 := CommaSeparatedList{"test2.com", "example.org", "another2.net"}
+	assert.Equal(expected2, c.Domains, "should read legacy comma separated list domains")
+
+	expected3 := CommaSeparatedList{"test3.com", "example.org", "another3.net"}
+	assert.Equal(expected3, c.Whitelist, "should read legacy comma separated list whitelist")
+
+	// Name changed
+	assert.Equal([]byte("veryverysecret"), c.Secret)
+
+	// Google provider params used to be top level
+	assert.Equal("clientid", c.ClientIdLegacy)
+	assert.Equal("clientid", c.Providers.Google.ClientID, "--client-id should set providers.google.client-id")
+	assert.Equal("verysecret", c.ClientSecretLegacy)
+	assert.Equal("verysecret", c.Providers.Google.ClientSecret, "--client-secret should set providers.google.client-secret")
+	assert.Equal("prompt", c.PromptLegacy)
+	assert.Equal("prompt", c.Providers.Google.Prompt, "--prompt should set providers.google.promot")
+
+	// "cookie-secure" used to be a standard go bool flag that could take
+	// true, TRUE, 1, false, FALSE, 0 etc. values.
+	// Here we're checking that format is still suppoted
+	assert.Equal("false", c.CookieSecureLegacy)
+	assert.True(c.InsecureCookie, "--cookie-secure=false should set insecure-cookie true")
+
+	c, err = NewConfig([]string{"--cookie-secure=TRUE"})
+	assert.Nil(err)
+	assert.Equal("TRUE", c.CookieSecureLegacy)
+	assert.False(c.InsecureCookie, "--cookie-secure=TRUE should set insecure-cookie false")
+}
+
+func TestConfigParseIni(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{
+		"--config=../test/config0",
+		"--config=../test/config1",
+		"--csrf-cookie-name=csrfcookiename",
+	})
+	require.Nil(t, err)
+
+	assert.Equal("inicookiename", c.CookieName, "should be read from ini file")
+	assert.Equal("csrfcookiename", c.CSRFCookieName, "should be read from ini file")
+	assert.Equal("/two", c.Path, "variable in second ini file should override first ini file")
+	assert.Equal(map[string]*Rule{
+		"1": {
+			Action:   "allow",
+			Rule:     "PathPrefix(`/one`)",
+			Provider: "google",
+		},
+		"two": {
+			Action:   "auth",
+			Rule:     "Host(`two.com`) && Path(`/two`)",
+			Provider: "google",
+		},
+	}, c.Rules)
+}
+
+func TestConfigFileBackwardsCompatability(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{
+		"--config=../test/config-legacy",
+	})
+	require.Nil(t, err)
+
+	assert.Equal("/two", c.Path, "variable in legacy config file should be read")
+	assert.Equal("auth.legacy.com", c.AuthHost, "variable in legacy config file should be read")
+}
+
+func TestConfigParseEnvironment(t *testing.T) {
+	assert := assert.New(t)
+	os.Setenv("COOKIE_NAME", "env_cookie_name")
+	os.Setenv("PROVIDERS_GOOGLE_CLIENT_ID", "env_client_id")
+	c, err := NewConfig([]string{})
+	assert.Nil(err)
+
+	assert.Equal("env_cookie_name", c.CookieName, "variable should be read from environment")
+	assert.Equal("env_client_id", c.Providers.Google.ClientID, "namespace variable should be read from environment")
+
+	os.Unsetenv("COOKIE_NAME")
+	os.Unsetenv("PROVIDERS_GOOGLE_CLIENT_ID")
+}
+
+func TestConfigParseEnvironmentBackwardsCompatability(t *testing.T) {
+	assert := assert.New(t)
+	vars := map[string]string{
+		"CLIENT_ID":      "clientid",
+		"CLIENT_SECRET":  "verysecret",
+		"PROMPT":         "prompt",
+		"COOKIE_SECRET":  "veryverysecret",
+		"LIFETIME":       "200",
+		"COOKIE_SECURE":  "false",
+		"COOKIE_DOMAINS": "test1.com,example.org",
+		"COOKIE_DOMAIN":  "another1.net",
+		"DOMAIN":         "test2.com,example.org",
+		"WHITELIST":      "test3.com,example.org",
+	}
+	for k, v := range vars {
+		os.Setenv(k, v)
+	}
+	c, err := NewConfig([]string{})
+	require.Nil(t, err)
+
+	// The following used to be passed as comma separated list
+	expected1 := []CookieDomain{
+		*NewCookieDomain("another1.net"),
+		*NewCookieDomain("test1.com"),
+		*NewCookieDomain("example.org"),
+	}
+	assert.Equal(expected1, c.CookieDomains, "should read legacy comma separated list cookie-domains")
+
+	expected2 := CommaSeparatedList{"test2.com", "example.org"}
+	assert.Equal(expected2, c.Domains, "should read legacy comma separated list domains")
+
+	expected3 := CommaSeparatedList{"test3.com", "example.org"}
+	assert.Equal(expected3, c.Whitelist, "should read legacy comma separated list whitelist")
+
+	// Name changed
+	assert.Equal([]byte("veryverysecret"), c.Secret)
+
+	// Google provider params used to be top level
+	assert.Equal("clientid", c.ClientIdLegacy)
+	assert.Equal("clientid", c.Providers.Google.ClientID, "--client-id should set providers.google.client-id")
+	assert.Equal("verysecret", c.ClientSecretLegacy)
+	assert.Equal("verysecret", c.Providers.Google.ClientSecret, "--client-secret should set providers.google.client-secret")
+	assert.Equal("prompt", c.PromptLegacy)
+	assert.Equal("prompt", c.Providers.Google.Prompt, "--prompt should set providers.google.promot")
+
+	// "cookie-secure" used to be a standard go bool flag that could take
+	// true, TRUE, 1, false, FALSE, 0 etc. values.
+	// Here we're checking that format is still supported
+	assert.Equal("false", c.CookieSecureLegacy)
+	assert.True(c.InsecureCookie, "--cookie-secure=false should set insecure-cookie true")
+
+	c, err = NewConfig([]string{"--cookie-secure=TRUE"})
+	assert.Nil(err)
+	assert.Equal("TRUE", c.CookieSecureLegacy)
+	assert.False(c.InsecureCookie, "--cookie-secure=TRUE should set insecure-cookie false")
+
+	for k := range vars {
+		os.Unsetenv(k)
+	}
+}
+
+func TestConfigTransformation(t *testing.T) {
+	assert := assert.New(t)
+	c, err := NewConfig([]string{
+		"--url-path=_oauthpath",
+		"--secret=verysecret",
+		"--lifetime=200",
+	})
+	require.Nil(t, err)
+
+	assert.Equal("/_oauthpath", c.Path, "path should add slash to front")
+
+	assert.Equal("verysecret", c.SecretString)
+	assert.Equal([]byte("verysecret"), c.Secret, "secret should be converted to byte array")
+
+	assert.Equal(200, c.LifetimeString)
+	assert.Equal(time.Second*time.Duration(200), c.Lifetime, "lifetime should be read and converted to duration")
+}
+
+func TestConfigValidate(t *testing.T) {
+	assert := assert.New(t)
+
+	// Install new logger + hook
+	var hook *test.Hook
+	log, hook = test.NewNullLogger()
+	log.ExitFunc = func(code int) {}
+
+	// Validate defualt config + rule error
+	c, _ := NewConfig([]string{
+		"--rule.1.action=bad",
+	})
+	c.Validate()
+
+	logs := hook.AllEntries()
+	assert.Len(logs, 3)
+
+	// Should have fatal error requiring secret
+	assert.Equal("\"secret\" option must be set", logs[0].Message)
+	assert.Equal(logrus.FatalLevel, logs[0].Level)
+
+	// Should also have default provider (google) error
+	assert.Equal("providers.google.client-id, providers.google.client-secret must be set", logs[1].Message)
+	assert.Equal(logrus.FatalLevel, logs[1].Level)
+
+	// Should validate rule
+	assert.Equal("invalid rule action, must be \"auth\" or \"allow\"", logs[2].Message)
+	assert.Equal(logrus.FatalLevel, logs[2].Level)
+
+	hook.Reset()
+
+	// Validate with invalid providers
+	c, _ = NewConfig([]string{
+		"--secret=veryverysecret",
+		"--providers.google.client-id=id",
+		"--providers.google.client-secret=secret",
+		"--rule.1.action=auth",
+		"--rule.1.provider=bad2",
+	})
+	c.Validate()
+
+	logs = hook.AllEntries()
+	assert.Len(logs, 1)
+
+	// Should have error for rule provider
+	assert.Equal("Unknown provider: bad2", logs[0].Message)
+	assert.Equal(logrus.FatalLevel, logs[0].Level)
+}
+
+func TestConfigGetProvider(t *testing.T) {
+	assert := assert.New(t)
+	c, _ := NewConfig([]string{})
+
+	// Should be able to get "google" provider
+	p, err := c.GetProvider("google")
+	assert.Nil(err)
+	assert.Equal(&c.Providers.Google, p)
+
+	// Should be able to get "oidc" provider
+	p, err = c.GetProvider("oidc")
+	assert.Nil(err)
+	assert.Equal(&c.Providers.OIDC, p)
+
+	// Should catch unknown provider
+	p, err = c.GetProvider("bad")
+	if assert.Error(err) {
+		assert.Equal("Unknown provider: bad", err.Error())
+	}
+}
+
+func TestConfigGetConfiguredProvider(t *testing.T) {
+	assert := assert.New(t)
+	c, _ := NewConfig([]string{})
+
+	// Should be able to get "google" default provider
+	p, err := c.GetConfiguredProvider("google")
+	assert.Nil(err)
+	assert.Equal(&c.Providers.Google, p)
+
+	// Should fail to get valid "oidc" provider as it's not configured
+	p, err = c.GetConfiguredProvider("oidc")
+	if assert.Error(err) {
+		assert.Equal("Unconfigured provider: oidc", err.Error())
+	}
+}
+
+func TestConfigCommaSeparatedList(t *testing.T) {
+	assert := assert.New(t)
+	list := CommaSeparatedList{}
+
+	err := list.UnmarshalFlag("one,two")
+	assert.Nil(err)
+	assert.Equal(CommaSeparatedList{"one", "two"}, list, "should parse comma sepearated list")
+
+	marshal, err := list.MarshalFlag()
+	assert.Nil(err)
+	assert.Equal("one,two", marshal, "should marshal back to comma sepearated list")
+}
--- a/internal/log.go
+++ b/internal/log.go
@ -0,0 +1,50 @@
+package tfa
+
+import (
+	"os"
+
+	"github.com/sirupsen/logrus"
+)
+
+var log *logrus.Logger
+
+func NewDefaultLogger() *logrus.Logger {
+	// Setup logger
+	log = logrus.StandardLogger()
+	logrus.SetOutput(os.Stdout)
+
+	// Set logger format
+	switch config.LogFormat {
+	case "pretty":
+		break
+	case "json":
+		logrus.SetFormatter(&logrus.JSONFormatter{})
+	// "text" is the default
+	default:
+		logrus.SetFormatter(&logrus.TextFormatter{
+			DisableColors: true,
+			FullTimestamp: true,
+		})
+	}
+
+	// Set logger level
+	switch config.LogLevel {
+	case "trace":
+		logrus.SetLevel(logrus.TraceLevel)
+	case "debug":
+		logrus.SetLevel(logrus.DebugLevel)
+	case "info":
+		logrus.SetLevel(logrus.InfoLevel)
+	case "error":
+		logrus.SetLevel(logrus.ErrorLevel)
+	case "fatal":
+		logrus.SetLevel(logrus.FatalLevel)
+	case "panic":
+		logrus.SetLevel(logrus.PanicLevel)
+	// warn is the default
+	default:
+		logrus.SetLevel(logrus.WarnLevel)
+	}
+
+	return log
+}
--- a/internal/provider/google.go
+++ b/internal/provider/google.go
@ -0,0 +1,115 @@
+package provider
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+)
+
+// Google provider
+type Google struct {
+	ClientID     string `long:"client-id" env:"CLIENT_ID" description:"Client ID"`
+	ClientSecret string `long:"client-secret" env:"CLIENT_SECRET" description:"Client Secret" json:"-"`
+	Scope        string
+	Prompt       string `long:"prompt" env:"PROMPT" description:"Space separated list of OpenID prompt options"`
+
+	LoginURL *url.URL
+	TokenURL *url.URL
+	UserURL  *url.URL
+}
+
+// Name returns the name of the provider
+func (g *Google) Name() string {
+	return "google"
+}
+
+// Setup performs validation and setup
+func (g *Google) Setup() error {
+	if g.ClientID == "" || g.ClientSecret == "" {
+		return errors.New("providers.google.client-id, providers.google.client-secret must be set")
+	}
+
+	// Set static values
+	g.Scope = "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email"
+	g.LoginURL = &url.URL{
+		Scheme: "https",
+		Host:   "accounts.google.com",
+		Path:   "/o/oauth2/auth",
+	}
+	g.TokenURL = &url.URL{
+		Scheme: "https",
+		Host:   "www.googleapis.com",
+		Path:   "/oauth2/v3/token",
+	}
+	g.UserURL = &url.URL{
+		Scheme: "https",
+		Host:   "www.googleapis.com",
+		Path:   "/oauth2/v2/userinfo",
+	}
+
+	return nil
+}
+
+// GetLoginURL provides the login url for the given redirect uri and state
+func (g *Google) GetLoginURL(redirectURI, state string) string {
+	q := url.Values{}
+	q.Set("client_id", g.ClientID)
+	q.Set("response_type", "code")
+	q.Set("scope", g.Scope)
+	if g.Prompt != "" {
+		q.Set("prompt", g.Prompt)
+	}
+	q.Set("redirect_uri", redirectURI)
+	q.Set("state", state)
+
+	var u url.URL
+	u = *g.LoginURL
+	u.RawQuery = q.Encode()
+
+	return u.String()
+}
+
+// ExchangeCode exchanges the given redirect uri and code for a token
+func (g *Google) ExchangeCode(redirectURI, code string) (string, error) {
+	form := url.Values{}
+	form.Set("client_id", g.ClientID)
+	form.Set("client_secret", g.ClientSecret)
+	form.Set("grant_type", "authorization_code")
+	form.Set("redirect_uri", redirectURI)
+	form.Set("code", code)
+
+	res, err := http.PostForm(g.TokenURL.String(), form)
+	if err != nil {
+		return "", err
+	}
+
+	var token token
+	defer res.Body.Close()
+	err = json.NewDecoder(res.Body).Decode(&token)
+
+	return token.Token, err
+}
+
+// GetUser uses the given token and returns a complete provider.User object
+func (g *Google) GetUser(token string) (User, error) {
+	var user User
+
+	client := &http.Client{}
+	req, err := http.NewRequest("GET", g.UserURL.String(), nil)
+	if err != nil {
+		return user, err
+	}
+
+	req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token))
+	res, err := client.Do(req)
+	if err != nil {
+		return user, err
+	}
+
+	defer res.Body.Close()
+	err = json.NewDecoder(res.Body).Decode(&user)
+
+	return user, err
+}
--- a/internal/provider/google_test.go
+++ b/internal/provider/google_test.go
@ -0,0 +1,151 @@
+package provider
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Tests
+
+func TestGoogleName(t *testing.T) {
+	p := Google{}
+	assert.Equal(t, "google", p.Name())
+}
+
+func TestGoogleSetup(t *testing.T) {
+	assert := assert.New(t)
+	p := Google{}
+
+	// Check validation
+	err := p.Setup()
+	if assert.Error(err) {
+		assert.Equal("providers.google.client-id, providers.google.client-secret must be set", err.Error())
+	}
+
+	// Check setup
+	p = Google{
+		ClientID:     "id",
+		ClientSecret: "secret",
+	}
+	err = p.Setup()
+	assert.Nil(err)
+	assert.Equal("https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email", p.Scope)
+	assert.Equal("", p.Prompt)
+
+	assert.Equal(&url.URL{
+		Scheme: "https",
+		Host:   "accounts.google.com",
+		Path:   "/o/oauth2/auth",
+	}, p.LoginURL)
+
+	assert.Equal(&url.URL{
+		Scheme: "https",
+		Host:   "www.googleapis.com",
+		Path:   "/oauth2/v3/token",
+	}, p.TokenURL)
+
+	assert.Equal(&url.URL{
+		Scheme: "https",
+		Host:   "www.googleapis.com",
+		Path:   "/oauth2/v2/userinfo",
+	}, p.UserURL)
+}
+
+func TestGoogleGetLoginURL(t *testing.T) {
+	assert := assert.New(t)
+	p := Google{
+		ClientID:     "idtest",
+		ClientSecret: "sectest",
+		Scope:        "scopetest",
+		Prompt:       "consent select_account",
+		LoginURL: &url.URL{
+			Scheme: "https",
+			Host:   "google.com",
+			Path:   "/auth",
+		},
+	}
+
+	// Check url
+	uri, err := url.Parse(p.GetLoginURL("http://example.com/_oauth", "state"))
+	assert.Nil(err)
+	assert.Equal("https", uri.Scheme)
+	assert.Equal("google.com", uri.Host)
+	assert.Equal("/auth", uri.Path)
+
+	// Check query string
+	qs := uri.Query()
+	expectedQs := url.Values{
+		"client_id":     []string{"idtest"},
+		"redirect_uri":  []string{"http://example.com/_oauth"},
+		"response_type": []string{"code"},
+		"scope":         []string{"scopetest"},
+		"prompt":        []string{"consent select_account"},
+		"state":         []string{"state"},
+	}
+	assert.Equal(expectedQs, qs)
+}
+
+func TestGoogleExchangeCode(t *testing.T) {
+	assert := assert.New(t)
+
+	// Setup server
+	expected := url.Values{
+		"client_id":     []string{"idtest"},
+		"client_secret": []string{"sectest"},
+		"code":          []string{"code"},
+		"grant_type":    []string{"authorization_code"},
+		"redirect_uri":  []string{"http://example.com/_oauth"},
+	}
+	server, serverURL := NewOAuthServer(t, map[string]string{
+		"token": expected.Encode(),
+	})
+	defer server.Close()
+
+	// Setup provider
+	p := Google{
+		ClientID:     "idtest",
+		ClientSecret: "sectest",
+		Scope:        "scopetest",
+		Prompt:       "consent select_account",
+		TokenURL: &url.URL{
+			Scheme: serverURL.Scheme,
+			Host:   serverURL.Host,
+			Path:   "/token",
+		},
+	}
+
+	token, err := p.ExchangeCode("http://example.com/_oauth", "code")
+	assert.Nil(err)
+	assert.Equal("123456789", token)
+}
+
+func TestGoogleGetUser(t *testing.T) {
+	assert := assert.New(t)
+
+	// Setup server
+	server, serverURL := NewOAuthServer(t, nil)
+	defer server.Close()
+
+	// Setup provider
+	p := Google{
+		ClientID:     "idtest",
+		ClientSecret: "sectest",
+		Scope:        "scopetest",
+		Prompt:       "consent select_account",
+		UserURL: &url.URL{
+			Scheme: serverURL.Scheme,
+			Host:   serverURL.Host,
+			Path:   "/userinfo",
+		},
+	}
+
+	user, err := p.GetUser("123456789")
+	assert.Nil(err)
+
+	assert.Equal("1", user.ID)
+	assert.Equal("example@example.com", user.Email)
+	assert.True(user.Verified)
+	assert.Equal("example.com", user.Hd)
+}
--- a/internal/provider/oidc.go
+++ b/internal/provider/oidc.go
@ -0,0 +1,108 @@
+package provider
+
+import (
+	"context"
+	"errors"
+
+	"github.com/coreos/go-oidc"
+	"golang.org/x/oauth2"
+)
+
+// OIDC provider
+type OIDC struct {
+	OAuthProvider
+
+	IssuerURL    string `long:"issuer-url" env:"ISSUER_URL" description:"Issuer URL"`
+	ClientID     string `long:"client-id" env:"CLIENT_ID" description:"Client ID"`
+	ClientSecret string `long:"client-secret" env:"CLIENT_SECRET" description:"Client Secret" json:"-"`
+
+	provider *oidc.Provider
+	verifier *oidc.IDTokenVerifier
+}
+
+// Name returns the name of the provider
+func (o *OIDC) Name() string {
+	return "oidc"
+}
+
+// Setup performs validation and setup
+func (o *OIDC) Setup() error {
+	// Check parms
+	if o.IssuerURL == "" || o.ClientID == "" || o.ClientSecret == "" {
+		return errors.New("providers.oidc.issuer-url, providers.oidc.client-id, providers.oidc.client-secret must be set")
+	}
+
+	var err error
+	o.ctx = context.Background()
+
+	// Try to initiate provider
+	o.provider, err = oidc.NewProvider(o.ctx, o.IssuerURL)
+	if err != nil {
+		return err
+	}
+
+	// Create oauth2 config
+	o.Config = &oauth2.Config{
+		ClientID:     o.ClientID,
+		ClientSecret: o.ClientSecret,
+		Endpoint:     o.provider.Endpoint(),
+
+		// "openid" is a required scope for OpenID Connect flows.
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	// Create OIDC verifier
+	o.verifier = o.provider.Verifier(&oidc.Config{
+		ClientID: o.ClientID,
+	})
+
+	return nil
+}
+
+// GetLoginURL provides the login url for the given redirect uri and state
+func (o *OIDC) GetLoginURL(redirectURI, state string) string {
+	return o.OAuthGetLoginURL(redirectURI, state)
+}
+
+// ExchangeCode exchanges the given redirect uri and code for a token
+func (o *OIDC) ExchangeCode(redirectURI, code string) (string, error) {
+	token, err := o.OAuthExchangeCode(redirectURI, code)
+	if err != nil {
+		return "", err
+	}
+
+	// Extract ID token
+	rawIDToken, ok := token.Extra("id_token").(string)
+	if !ok {
+		return "", errors.New("Missing id_token")
+	}
+
+	return rawIDToken, nil
+}
+
+// GetUser uses the given token and returns a complete provider.User object
+func (o *OIDC) GetUser(token string) (User, error) {
+	var user User
+
+	// Parse & Verify ID Token
+	idToken, err := o.verifier.Verify(o.ctx, token)
+	if err != nil {
+		return user, err
+	}
+
+	// Extract custom claims
+	var claims struct {
+		ID       string `json:"sub"`
+		Email    string `json:"email"`
+		Verified bool   `json:"email_verified"`
+	}
+	if err := idToken.Claims(&claims); err != nil {
+		return user, err
+	}
+
+	user.ID = claims.ID
+	user.Email = claims.Email
+	user.Verified = claims.Verified
+
+	return user, nil
+}
--- a/internal/provider/oidc_test.go
+++ b/internal/provider/oidc_test.go
@ -0,0 +1,252 @@
+package provider
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	jose "gopkg.in/square/go-jose.v2"
+)
+
+// Tests
+
+func TestOIDCName(t *testing.T) {
+	p := OIDC{}
+	assert.Equal(t, "oidc", p.Name())
+}
+
+func TestOIDCSetup(t *testing.T) {
+	assert := assert.New(t)
+	p := OIDC{}
+
+	err := p.Setup()
+	if assert.Error(err) {
+		assert.Equal("providers.oidc.issuer-url, providers.oidc.client-id, providers.oidc.client-secret must be set", err.Error())
+	}
+}
+
+func TestOIDCGetLoginURL(t *testing.T) {
+	assert := assert.New(t)
+
+	provider, server, serverURL, _ := setupOIDCTest(t, nil)
+	defer server.Close()
+
+	// Check url
+	uri, err := url.Parse(provider.GetLoginURL("http://example.com/_oauth", "state"))
+	assert.Nil(err)
+	assert.Equal(serverURL.Scheme, uri.Scheme)
+	assert.Equal(serverURL.Host, uri.Host)
+	assert.Equal("/auth", uri.Path)
+
+	// Check query string
+	qs := uri.Query()
+	expectedQs := url.Values{
+		"client_id":     []string{"idtest"},
+		"redirect_uri":  []string{"http://example.com/_oauth"},
+		"response_type": []string{"code"},
+		"scope":         []string{"openid profile email"},
+		"state":         []string{"state"},
+	}
+	assert.Equal(expectedQs, qs)
+
+	// Calling the method should not modify the underlying config
+	assert.Equal("", provider.Config.RedirectURL)
+}
+
+func TestOIDCExchangeCode(t *testing.T) {
+	assert := assert.New(t)
+
+	provider, server, _, _ := setupOIDCTest(t, map[string]map[string]string{
+		"token": {
+			"code":         "code",
+			"grant_type":   "authorization_code",
+			"redirect_uri": "http://example.com/_oauth",
+		},
+	})
+	defer server.Close()
+
+	token, err := provider.ExchangeCode("http://example.com/_oauth", "code")
+	assert.Nil(err)
+	assert.Equal("id_123456789", token)
+}
+
+func TestOIDCGetUser(t *testing.T) {
+	assert := assert.New(t)
+
+	provider, server, serverURL, key := setupOIDCTest(t, nil)
+	defer server.Close()
+
+	// Generate JWT
+	token := key.sign(t, []byte(`{
+		"iss": "`+serverURL.String()+`",
+		"exp":`+strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)+`,
+		"aud": "idtest",
+		"sub": "1",
+		"email": "example@example.com",
+		"email_verified": true
+	}`))
+
+	// Get user
+	user, err := provider.GetUser(token)
+	assert.Nil(err)
+	assert.Equal("1", user.ID)
+	assert.Equal("example@example.com", user.Email)
+	assert.True(user.Verified)
+}
+
+// Utils
+
+// setOIDCTest creates a key, OIDCServer and initilises an OIDC provider
+func setupOIDCTest(t *testing.T, bodyValues map[string]map[string]string) (*OIDC, *httptest.Server, *url.URL, *rsaKey) {
+	// Generate key
+	key, err := newRSAKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	body := make(map[string]string)
+	if bodyValues != nil {
+		// URL encode bodyValues into body
+		for method, values := range bodyValues {
+			q := url.Values{}
+			for k, v := range values {
+				q.Set(k, v)
+			}
+			body[method] = q.Encode()
+		}
+	}
+
+	// Set up oidc server
+	server, serverURL := NewOIDCServer(t, key, body)
+
+	// Setup provider
+	p := OIDC{
+		ClientID:     "idtest",
+		ClientSecret: "sectest",
+		IssuerURL:    serverURL.String(),
+	}
+
+	// Initialise config/verifier
+	err = p.Setup()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return &p, server, serverURL, key
+}
+
+// OIDCServer is used in the OIDC Tests to mock an OIDC server
+type OIDCServer struct {
+	t    *testing.T
+	url  *url.URL
+	body map[string]string // method -> body
+	key  *rsaKey
+}
+
+func NewOIDCServer(t *testing.T, key *rsaKey, body map[string]string) (*httptest.Server, *url.URL) {
+	handler := &OIDCServer{t: t, key: key, body: body}
+	server := httptest.NewServer(handler)
+	handler.url, _ = url.Parse(server.URL)
+	return server, handler.url
+}
+
+func (s *OIDCServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	body, _ := ioutil.ReadAll(r.Body)
+
+	if r.URL.Path == "/.well-known/openid-configuration" {
+		// Open id config
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{
+			"issuer":"`+s.url.String()+`",
+			"authorization_endpoint":"`+s.url.String()+`/auth",
+			"token_endpoint":"`+s.url.String()+`/token",
+			"jwks_uri":"`+s.url.String()+`/jwks"
+		}`)
+	} else if r.URL.Path == "/token" {
+		// Token request
+		// Check body
+		if b, ok := s.body["token"]; ok {
+			if b != string(body) {
+				s.t.Fatal("Unexpected request body, expected", b, "got", string(body))
+			}
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{
+			"access_token":"123456789",
+			"id_token":"id_123456789"
+		}`)
+	} else if r.URL.Path == "/jwks" {
+		// Key request
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprint(w, `{"keys":[`+s.key.publicJWK(s.t)+`]}`)
+	} else {
+		s.t.Fatal("Unrecognised request: ", r.URL, string(body))
+	}
+}
+
+// rsaKey is used in the OIDCServer tests to sign and verify requests
+type rsaKey struct {
+	key     *rsa.PrivateKey
+	alg     jose.SignatureAlgorithm
+	jwkPub  *jose.JSONWebKey
+	jwkPriv *jose.JSONWebKey
+}
+
+func newRSAKey() (*rsaKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, 1028)
+	if err != nil {
+		return nil, err
+	}
+
+	return &rsaKey{
+		key: key,
+		alg: jose.RS256,
+		jwkPub: &jose.JSONWebKey{
+			Key:       key.Public(),
+			Algorithm: string(jose.RS256),
+		},
+		jwkPriv: &jose.JSONWebKey{
+			Key:       key,
+			Algorithm: string(jose.RS256),
+		},
+	}, nil
+}
+
+func (k *rsaKey) publicJWK(t *testing.T) string {
+	b, err := k.jwkPub.MarshalJSON()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return string(b)
+}
+
+// sign creates a JWS using the private key from the provided payload.
+func (k *rsaKey) sign(t *testing.T, payload []byte) string {
+	signer, err := jose.NewSigner(jose.SigningKey{
+		Algorithm: k.alg,
+		Key:       k.key,
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	jws, err := signer.Sign(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	data, err := jws.CompactSerialize()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return data
+}
--- a/internal/provider/providers.go
+++ b/internal/provider/providers.go
@ -0,0 +1,61 @@
+package provider
+
+import (
+	"context"
+	// "net/url"
+
+	"golang.org/x/oauth2"
+)
+
+// Providers contains all the implemented providers
+type Providers struct {
+	Google Google `group:"Google Provider" namespace:"google" env-namespace:"GOOGLE"`
+	OIDC   OIDC   `group:"OIDC Provider" namespace:"oidc" env-namespace:"OIDC"`
+}
+
+// Provider is used to authenticate users
+type Provider interface {
+	Name() string
+	GetLoginURL(redirectURI, state string) string
+	ExchangeCode(redirectURI, code string) (string, error)
+	GetUser(token string) (User, error)
+	Setup() error
+}
+
+type token struct {
+	Token string `json:"access_token"`
+}
+
+// User is the authenticated user
+type User struct {
+	ID       string `json:"id"`
+	Email    string `json:"email"`
+	Verified bool   `json:"verified_email"`
+	Hd       string `json:"hd"`
+}
+
+// OAuthProvider is a provider using the oauth2 library
+type OAuthProvider struct {
+	Config *oauth2.Config
+	ctx    context.Context
+}
+
+// ConfigCopy returns a copy of the oauth2 config with the given redirectURI
+// which ensures the underlying config is not modified
+func (p *OAuthProvider) ConfigCopy(redirectURI string) oauth2.Config {
+	config := *p.Config
+	config.RedirectURL = redirectURI
+	return config
+}
+
+// OAuthGetLoginURL provides a base "GetLoginURL" for proiders using OAauth2
+func (p *OAuthProvider) OAuthGetLoginURL(redirectURI, state string) string {
+	config := p.ConfigCopy(redirectURI)
+	return config.AuthCodeURL(state)
+}
+
+// OAuthExchangeCode provides a base "ExchangeCode" for proiders using OAauth2
+func (p *OAuthProvider) OAuthExchangeCode(redirectURI, code string) (*oauth2.Token, error) {
+	config := p.ConfigCopy(redirectURI)
+	return config.Exchange(p.ctx, code)
+}
--- a/internal/provider/providers_test.go
+++ b/internal/provider/providers_test.go
@ -0,0 +1,48 @@
+package provider
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+// Utilities
+
+type OAuthServer struct {
+	t    *testing.T
+	url  *url.URL
+	body map[string]string // method -> body
+}
+
+func NewOAuthServer(t *testing.T, body map[string]string) (*httptest.Server, *url.URL) {
+	handler := &OAuthServer{t: t, body: body}
+	server := httptest.NewServer(handler)
+	handler.url, _ = url.Parse(server.URL)
+	return server, handler.url
+}
+
+func (s *OAuthServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	body, _ := ioutil.ReadAll(r.Body)
+	// fmt.Println("Got request:", r.URL, r.Method, string(body))
+
+	if r.Method == "POST" && r.URL.Path == "/token" {
+		if s.body["token"] != string(body) {
+			s.t.Fatal("Unexpected request body, expected", s.body["token"], "got", string(body))
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"access_token":"123456789"}`)
+	} else if r.Method == "GET" && r.URL.Path == "/userinfo" {
+		fmt.Fprint(w, `{
+			"id":"1",
+			"email":"example@example.com",
+			"verified_email":true,
+			"hd":"example.com"
+		}`)
+	} else {
+		s.t.Fatal("Unrecognised request: ", r.Method, r.URL, string(body))
+	}
+}
--- a/internal/server.go
+++ b/internal/server.go
@ -0,0 +1,206 @@
+package tfa
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/containous/traefik/v2/pkg/rules"
+	"github.com/sirupsen/logrus"
+	"github.com/thomseddon/traefik-forward-auth/internal/provider"
+)
+
+type Server struct {
+	router *rules.Router
+}
+
+func NewServer() *Server {
+	s := &Server{}
+	s.buildRoutes()
+	return s
+}
+
+func (s *Server) buildRoutes() {
+	var err error
+	s.router, err = rules.NewRouter()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Let's build a router
+	for name, rule := range config.Rules {
+		matchRule := rule.formattedRule()
+		if rule.Action == "allow" {
+			s.router.AddRoute(matchRule, 1, s.AllowHandler(name))
+		} else {
+			s.router.AddRoute(matchRule, 1, s.AuthHandler(rule.Provider, name))
+		}
+	}
+
+	// Add callback handler
+	s.router.Handle(config.Path, s.AuthCallbackHandler())
+
+	// Add a default handler
+	if config.DefaultAction == "allow" {
+		s.router.NewRoute().Handler(s.AllowHandler("default"))
+	} else {
+		s.router.NewRoute().Handler(s.AuthHandler(config.DefaultProvider, "default"))
+	}
+}
+
+func (s *Server) RootHandler(w http.ResponseWriter, r *http.Request) {
+	// Modify request
+	r.Method = r.Header.Get("X-Forwarded-Method")
+	r.Host = r.Header.Get("X-Forwarded-Host")
+	r.URL, _ = url.Parse(r.Header.Get("X-Forwarded-Uri"))
+
+	// Pass to mux
+	s.router.ServeHTTP(w, r)
+}
+
+// Handler that allows requests
+func (s *Server) AllowHandler(rule string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		s.logger(r, rule, "Allowing request")
+		w.WriteHeader(200)
+	}
+}
+
+// Authenticate requests
+func (s *Server) AuthHandler(providerName, rule string) http.HandlerFunc {
+	p, _ := config.GetConfiguredProvider(providerName)
+
+	return func(w http.ResponseWriter, r *http.Request) {
+		// Logging setup
+		logger := s.logger(r, rule, "Authenticating request")
+
+		// Get auth cookie
+		c, err := r.Cookie(config.CookieName)
+		if err != nil {
+			s.authRedirect(logger, w, r, p)
+			return
+		}
+
+		// Validate cookie
+		email, err := ValidateCookie(r, c)
+		if err != nil {
+			if err.Error() == "Cookie has expired" {
+				logger.Info("Cookie has expired")
+				s.authRedirect(logger, w, r, p)
+			} else {
+				logger.Errorf("Invalid cookie: %v", err)
+				http.Error(w, "Not authorized", 401)
+			}
+			return
+		}
+
+		// Validate user
+		valid := ValidateEmail(email)
+		if !valid {
+			logger.WithFields(logrus.Fields{
+				"email": email,
+			}).Errorf("Invalid email")
+			http.Error(w, "Not authorized", 401)
+			return
+		}
+
+		// Valid request
+		logger.Debugf("Allowing valid request ")
+		w.Header().Set("X-Forwarded-User", email)
+		w.WriteHeader(200)
+	}
+}
+
+// Handle auth callback
+func (s *Server) AuthCallbackHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// Logging setup
+		logger := s.logger(r, "default", "Handling callback")
+
+		// Check for CSRF cookie
+		c, err := r.Cookie(config.CSRFCookieName)
+		if err != nil {
+			logger.Warn("Missing csrf cookie")
+			http.Error(w, "Not authorized", 401)
+			return
+		}
+
+		// Validate state
+		valid, providerName, redirect, err := ValidateCSRFCookie(r, c)
+		if !valid {
+			logger.Warnf("Error validating csrf cookie: %v", err)
+			http.Error(w, "Not authorized", 401)
+			return
+		}
+
+		// Get provider
+		p, err := config.GetConfiguredProvider(providerName)
+		if err != nil {
+			logger.Warnf("Invalid provider in csrf cookie: %s, %v", providerName, err)
+			http.Error(w, "Not authorized", 401)
+			return
+		}
+
+		// Clear CSRF cookie
+		http.SetCookie(w, ClearCSRFCookie(r))
+
+		// Exchange code for token
+		token, err := p.ExchangeCode(redirectUri(r), r.URL.Query().Get("code"))
+		if err != nil {
+			logger.Errorf("Code exchange failed with: %v", err)
+			http.Error(w, "Service unavailable", 503)
+			return
+		}
+
+		// Get user
+		user, err := p.GetUser(token)
+		if err != nil {
+			logger.Errorf("Error getting user: %s", err)
+			return
+		}
+
+		// Generate cookie
+		http.SetCookie(w, MakeCookie(r, user.Email))
+		logger.WithFields(logrus.Fields{
+			"user": user.Email,
+		}).Infof("Generated auth cookie")
+
+		// Redirect
+		http.Redirect(w, r, redirect, http.StatusTemporaryRedirect)
+	}
+}
+
+func (s *Server) authRedirect(logger *logrus.Entry, w http.ResponseWriter, r *http.Request, p provider.Provider) {
+	// Error indicates no cookie, generate nonce
+	err, nonce := Nonce()
+	if err != nil {
+		logger.Errorf("Error generating nonce, %v", err)
+		http.Error(w, "Service unavailable", 503)
+		return
+	}
+
+	// Set the CSRF cookie
+	http.SetCookie(w, MakeCSRFCookie(r, nonce))
+	logger.Debug("Set CSRF cookie and redirecting to google login")
+
+	// Forward them on
+	loginUrl := p.GetLoginURL(redirectUri(r), MakeState(r, p, nonce))
+	http.Redirect(w, r, loginUrl, http.StatusTemporaryRedirect)
+
+	logger.Debug("Done")
+	return
+}
+
+func (s *Server) logger(r *http.Request, rule, msg string) *logrus.Entry {
+	// Create logger
+	logger := log.WithFields(logrus.Fields{
+		"source_ip": r.Header.Get("X-Forwarded-For"),
+	})
+
+	// Log request
+	logger.WithFields(logrus.Fields{
+		"rule":    rule,
+		"headers": r.Header,
+	}).Debug(msg)
+
+	return logger
+}
--- a/internal/server_test.go
+++ b/internal/server_test.go
@ -0,0 +1,420 @@
+package tfa
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+/**
+ * Setup
+ */
+
+func init() {
+	config = newDefaultConfig()
+	config.LogLevel = "panic"
+	log = NewDefaultLogger()
+}
+
+/**
+ * Tests
+ */
+
+func TestServerAuthHandlerInvalid(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+
+	// Should redirect vanilla request to login url
+	req := newDefaultHttpRequest("/foo")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "vanilla request should be redirected")
+
+	fwd, _ := res.Location()
+	assert.Equal("https", fwd.Scheme, "vanilla request should be redirected to google")
+	assert.Equal("accounts.google.com", fwd.Host, "vanilla request should be redirected to google")
+	assert.Equal("/o/oauth2/auth", fwd.Path, "vanilla request should be redirected to google")
+
+	// Check state string
+	qs := fwd.Query()
+	state, exists := qs["state"]
+	require.True(t, exists)
+	require.Len(t, state, 1)
+	parts := strings.SplitN(state[0], ":", 3)
+	require.Len(t, parts, 3)
+	assert.Equal("google", parts[1])
+	assert.Equal("http://example.com/foo", parts[2])
+
+	// Should catch invalid cookie
+	req = newDefaultHttpRequest("/foo")
+	c := MakeCookie(req, "test@example.com")
+	parts = strings.Split(c.Value, "|")
+	c.Value = fmt.Sprintf("bad|%s|%s", parts[1], parts[2])
+
+	res, _ = doHttpRequest(req, c)
+	assert.Equal(401, res.StatusCode, "invalid cookie should not be authorised")
+
+	// Should validate email
+	req = newDefaultHttpRequest("/foo")
+	c = MakeCookie(req, "test@example.com")
+	config.Domains = []string{"test.com"}
+
+	res, _ = doHttpRequest(req, c)
+	assert.Equal(401, res.StatusCode, "invalid email should not be authorised")
+}
+
+func TestServerAuthHandlerExpired(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Lifetime = time.Second * time.Duration(-1)
+	config.Domains = []string{"test.com"}
+
+	// Should redirect expired cookie
+	req := newDefaultHttpRequest("/foo")
+	c := MakeCookie(req, "test@example.com")
+	res, _ := doHttpRequest(req, c)
+	assert.Equal(307, res.StatusCode, "request with expired cookie should be redirected")
+
+	// Check for CSRF cookie
+	var cookie *http.Cookie
+	for _, c := range res.Cookies() {
+		if c.Name == config.CSRFCookieName {
+			cookie = c
+		}
+	}
+	assert.NotNil(cookie)
+
+	// Check redirection location
+	fwd, _ := res.Location()
+	assert.Equal("https", fwd.Scheme, "request with expired cookie should be redirected to google")
+	assert.Equal("accounts.google.com", fwd.Host, "request with expired cookie should be redirected to google")
+	assert.Equal("/o/oauth2/auth", fwd.Path, "request with expired cookie should be redirected to google")
+}
+
+func TestServerAuthHandlerValid(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+
+	// Should allow valid request email
+	req := newDefaultHttpRequest("/foo")
+	c := MakeCookie(req, "test@example.com")
+	config.Domains = []string{}
+
+	res, _ := doHttpRequest(req, c)
+	assert.Equal(200, res.StatusCode, "valid request should be allowed")
+
+	// Should pass through user
+	users := res.Header["X-Forwarded-User"]
+	assert.Len(users, 1, "valid request should have X-Forwarded-User header")
+	assert.Equal([]string{"test@example.com"}, users, "X-Forwarded-User header should match user")
+}
+
+func TestServerAuthCallback(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+
+	// Setup OAuth server
+	server, serverURL := NewOAuthServer(t)
+	defer server.Close()
+	config.Providers.Google.TokenURL = &url.URL{
+		Scheme: serverURL.Scheme,
+		Host:   serverURL.Host,
+		Path:   "/token",
+	}
+	config.Providers.Google.UserURL = &url.URL{
+		Scheme: serverURL.Scheme,
+		Host:   serverURL.Host,
+		Path:   "/userinfo",
+	}
+
+	// Should pass auth response request to callback
+	req := newDefaultHttpRequest("/_oauth")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(401, res.StatusCode, "auth callback without cookie shouldn't be authorised")
+
+	// Should catch invalid csrf cookie
+	req = newDefaultHttpRequest("/_oauth?state=12345678901234567890123456789012:http://redirect")
+	c := MakeCSRFCookie(req, "nononononononononononononononono")
+	res, _ = doHttpRequest(req, c)
+	assert.Equal(401, res.StatusCode, "auth callback with invalid cookie shouldn't be authorised")
+
+	// Should redirect valid request
+	req = newDefaultHttpRequest("/_oauth?state=12345678901234567890123456789012:google:http://redirect")
+	c = MakeCSRFCookie(req, "12345678901234567890123456789012")
+	res, _ = doHttpRequest(req, c)
+	assert.Equal(307, res.StatusCode, "valid auth callback should be allowed")
+
+	fwd, _ := res.Location()
+	assert.Equal("http", fwd.Scheme, "valid request should be redirected to return url")
+	assert.Equal("redirect", fwd.Host, "valid request should be redirected to return url")
+	assert.Equal("", fwd.Path, "valid request should be redirected to return url")
+}
+
+func TestServerDefaultAction(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+
+	req := newDefaultHttpRequest("/random")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request should require auth with auth default handler")
+
+	config.DefaultAction = "allow"
+	req = newDefaultHttpRequest("/random")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request should be allowed with default handler")
+}
+
+func TestServerDefaultProvider(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+
+	// Should use "google" as default provider when not specified
+	req := newDefaultHttpRequest("/random")
+	res, _ := doHttpRequest(req, nil)
+	fwd, _ := res.Location()
+	assert.Equal("https", fwd.Scheme, "request with expired cookie should be redirected to google")
+	assert.Equal("accounts.google.com", fwd.Host, "request with expired cookie should be redirected to google")
+	assert.Equal("/o/oauth2/auth", fwd.Path, "request with expired cookie should be redirected to google")
+
+	// Should use alternative default provider when set
+	config.DefaultProvider = "oidc"
+	config.Providers.OIDC.OAuthProvider.Config = &oauth2.Config{
+		Endpoint: oauth2.Endpoint{
+			AuthURL: "https://oidc.com/oidcauth",
+		},
+	}
+
+	res, _ = doHttpRequest(req, nil)
+	fwd, _ = res.Location()
+	assert.Equal("https", fwd.Scheme, "request with expired cookie should be redirected to oidc")
+	assert.Equal("oidc.com", fwd.Host, "request with expired cookie should be redirected to oidc")
+	assert.Equal("/oidcauth", fwd.Path, "request with expired cookie should be redirected to oidc")
+}
+
+func TestServerRouteHeaders(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Rules = map[string]*Rule{
+		"1": {
+			Action: "allow",
+			Rule:   "Headers(`X-Test`, `test123`)",
+		},
+		"2": {
+			Action: "allow",
+			Rule:   "HeadersRegexp(`X-Test`, `test(456|789)`)",
+		},
+	}
+
+	// Should block any request
+	req := newDefaultHttpRequest("/random")
+	req.Header.Add("X-Random", "hello")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request not matching any rule should require auth")
+
+	// Should allow matching
+	req = newDefaultHttpRequest("/api")
+	req.Header.Add("X-Test", "test123")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+
+	// Should allow matching
+	req = newDefaultHttpRequest("/api")
+	req.Header.Add("X-Test", "test789")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+}
+
+func TestServerRouteHost(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Rules = map[string]*Rule{
+		"1": {
+			Action: "allow",
+			Rule:   "Host(`api.example.com`)",
+		},
+		"2": {
+			Action: "allow",
+			Rule:   "HostRegexp(`sub{num:[0-9]}.example.com`)",
+		},
+	}
+
+	// Should block any request
+	req := newHttpRequest("GET", "https://example.com/", "/")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request not matching any rule should require auth")
+
+	// Should allow matching request
+	req = newHttpRequest("GET", "https://api.example.com/", "/")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+
+	// Should allow matching request
+	req = newHttpRequest("GET", "https://sub8.example.com/", "/")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+}
+
+func TestServerRouteMethod(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Rules = map[string]*Rule{
+		"1": {
+			Action: "allow",
+			Rule:   "Method(`PUT`)",
+		},
+	}
+
+	// Should block any request
+	req := newHttpRequest("GET", "https://example.com/", "/")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request not matching any rule should require auth")
+
+	// Should allow matching request
+	req = newHttpRequest("PUT", "https://example.com/", "/")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+}
+
+func TestServerRoutePath(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Rules = map[string]*Rule{
+		"1": {
+			Action: "allow",
+			Rule:   "Path(`/api`)",
+		},
+		"2": {
+			Action: "allow",
+			Rule:   "PathPrefix(`/private`)",
+		},
+	}
+
+	// Should block any request
+	req := newDefaultHttpRequest("/random")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request not matching any rule should require auth")
+
+	// Should allow /api request
+	req = newDefaultHttpRequest("/api")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+
+	// Should allow /private request
+	req = newDefaultHttpRequest("/private")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+
+	req = newDefaultHttpRequest("/private/path")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+}
+
+func TestServerRouteQuery(t *testing.T) {
+	assert := assert.New(t)
+	config = newDefaultConfig()
+	config.Rules = map[string]*Rule{
+		"1": {
+			Action: "allow",
+			Rule:   "Query(`q=test123`)",
+		},
+	}
+
+	// Should block any request
+	req := newHttpRequest("GET", "https://example.com/", "/?q=no")
+	res, _ := doHttpRequest(req, nil)
+	assert.Equal(307, res.StatusCode, "request not matching any rule should require auth")
+
+	// Should allow matching request
+	req = newHttpRequest("GET", "https://api.example.com/", "/?q=test123")
+	res, _ = doHttpRequest(req, nil)
+	assert.Equal(200, res.StatusCode, "request matching allow rule should be allowed")
+}
+
+/**
+ * Utilities
+ */
+
+type OAuthServer struct {
+	t *testing.T
+}
+
+func (s *OAuthServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/token" {
+		fmt.Fprintf(w, `{"access_token":"123456789"}`)
+	} else if r.URL.Path == "/userinfo" {
+		fmt.Fprint(w, `{
+			"id":"1",
+			"email":"example@example.com",
+			"verified_email":true,
+			"hd":"example.com"
+		}`)
+	} else {
+		s.t.Fatal("Unrecognised request: ", r.Method, r.URL)
+	}
+}
+
+func NewOAuthServer(t *testing.T) (*httptest.Server, *url.URL) {
+	handler := &OAuthServer{}
+	server := httptest.NewServer(handler)
+	serverURL, _ := url.Parse(server.URL)
+	return server, serverURL
+}
+
+func doHttpRequest(r *http.Request, c *http.Cookie) (*http.Response, string) {
+	w := httptest.NewRecorder()
+
+	// Set cookies on recorder
+	if c != nil {
+		http.SetCookie(w, c)
+	}
+
+	// Copy into request
+	for _, c := range w.HeaderMap["Set-Cookie"] {
+		r.Header.Add("Cookie", c)
+	}
+
+	NewServer().RootHandler(w, r)
+
+	res := w.Result()
+	body, _ := ioutil.ReadAll(res.Body)
+
+	// if res.StatusCode > 300 && res.StatusCode < 400 {
+	// 	fmt.Printf("%#v", res.Header)
+	// }
+
+	return res, string(body)
+}
+
+func newDefaultConfig() *Config {
+	config, _ = NewConfig([]string{
+		"--providers.google.client-id=id",
+		"--providers.google.client-secret=secret",
+	})
+
+	// Setup the google providers without running all the config validation
+	config.Providers.Google.Setup()
+
+	return config
+}
+
+func newDefaultHttpRequest(uri string) *http.Request {
+	return newHttpRequest("", "http://example.com/", uri)
+}
+
+func newHttpRequest(method, dest, uri string) *http.Request {
+	r := httptest.NewRequest("", "http://should-use-x-forwarded.com", nil)
+	p, _ := url.Parse(dest)
+	r.Header.Add("X-Forwarded-Method", method)
+	r.Header.Add("X-Forwarded-Proto", p.Scheme)
+	r.Header.Add("X-Forwarded-Host", p.Host)
+	r.Header.Add("X-Forwarded-Uri", uri)
+	return r
+}
--- a/main.go
+++ b/main.go
@ -1,217 +0,0 @@
-
-package main
-
-import (
-  "fmt"
-  "time"
-  "strings"
-  "net/url"
-  "net/http"
-
-  "github.com/namsral/flag"
-  "github.com/op/go-logging"
-)
-
-// Vars
-var fw *ForwardAuth;
-var log = logging.MustGetLogger("traefik-forward-auth")
-
-// Primary handler
-func handler(w http.ResponseWriter, r *http.Request) {
-  // Parse uri
-  uri, err := url.Parse(r.Header.Get("X-Forwarded-Uri"))
-  if err != nil {
-    log.Error("Error parsing url")
-    http.Error(w, "Service unavailable", 503)
-    return
-  }
-
-  // Direct mode
-  if fw.Direct {
-    uri = r.URL
-  }
-
-  // Handle callback
-  if uri.Path == fw.Path {
-    handleCallback(w, r, uri.Query())
-    return
-  }
-
-  c, err := r.Cookie(fw.CookieName)
-  if err != nil {
-    // Error indicates no cookie, generate nonce
-    err, nonce := fw.Nonce()
-    if err != nil {
-      log.Error("Error generating nonce")
-      http.Error(w, "Service unavailable", 503)
-      return
-    }
-
-    // Set the CSRF cookie
-    http.SetCookie(w, fw.MakeCSRFCookie(r, nonce))
-    log.Debug("Set CSRF cookie and redirecting to google login")
-
-    // Forward them on
-    http.Redirect(w, r, fw.GetLoginURL(r, nonce), http.StatusTemporaryRedirect)
-
-    return
-  }
-
-  // Validate cookie
-  valid, email, err := fw.ValidateCookie(r, c)
-  if !valid {
-    log.Debugf("Invlaid cookie: %s", err)
-    http.Error(w, "Not authorized", 401)
-    return
-  }
-
-  // Validate user
-  valid = fw.ValidateEmail(email)
-  if !valid {
-    log.Debugf("Invalid email: %s", email)
-    http.Error(w, "Not authorized", 401)
-    return
-  }
-
-  // Valid request
-  w.WriteHeader(200)
-}
-
-
-// Authenticate user after they have come back from google
-func handleCallback(w http.ResponseWriter, r *http.Request, qs url.Values) {
-  // Check for CSRF cookie
-  csrfCookie, err := r.Cookie(fw.CSRFCookieName)
-  if err != nil {
-    log.Debug("Missing csrf cookie")
-    http.Error(w, "Not authorized", 401)
-    return
-  }
-
-  // Validate state
-  state := qs.Get("state")
-  valid, redirect, err := fw.ValidateCSRFCookie(csrfCookie, state)
-  if !valid {
-    log.Debugf("Invalid oauth state, expected '%s', got '%s'\n", csrfCookie.Value, state)
-    http.Error(w, "Not authorized", 401)
-    return
-  }
-
-  // Clear CSRF cookie
-  http.SetCookie(w, fw.ClearCSRFCookie(r))
-
-  // Exchange code for token
-  token, err := fw.ExchangeCode(r, qs.Get("code"))
-  if err != nil {
-    log.Debugf("Code exchange failed with: %s\n", err)
-    http.Error(w, "Service unavailable", 503)
-    return
-  }
-
-  // Get user
-  user, err := fw.GetUser(token)
-  if err != nil {
-    log.Debugf("Error getting user: %s\n", err)
-    return
-  }
-
-  // Generate cookie
-  http.SetCookie(w, fw.MakeCookie(r, user.Email))
-  log.Debugf("Generated auth cookie for %s\n", user.Email)
-
-  // Redirect
-  http.Redirect(w, r, redirect, http.StatusTemporaryRedirect)
-}
-
-
-// Main
-func main() {
-  // Parse options
-  flag.String(flag.DefaultConfigFlagname, "", "Path to config file")
-  path := flag.String("url-path", "_oauth", "Callback URL")
-  lifetime := flag.Int("lifetime", 43200, "Session length in seconds")
-  clientId := flag.String("client-id", "", "*Google Client ID (required)")
-  clientSecret := flag.String("client-secret", "", "*Google Client Secret (required)")
-  cookieName := flag.String("cookie-name", "_forward_auth", "Cookie Name")
-  cSRFCookieName := flag.String("csrf-cookie-name", "_forward_auth_csrf", "CSRF Cookie Name")
-  cookieDomainList := flag.String("cookie-domains", "", "Comma separated list of cookie domains") //todo
-  cookieSecret := flag.String("cookie-secret", "", "*Cookie secret (required)")
-  cookieSecure := flag.Bool("cookie-secure", true, "Use secure cookies")
-  domainList := flag.String("domain", "", "Comma separated list of email domains to allow")
-  direct := flag.Bool("direct", false, "Run in direct mode (use own hostname as oppose to X-Forwarded-Host, used for testing/development)")
-
-  flag.Parse()
-
-  // Check for show stopper errors
-  err := false
-  if *clientId == "" {
-    err = true
-    log.Critical("client-id must be set")
-  }
-  if *clientSecret == "" {
-    err = true
-    log.Critical("client-secret must be set")
-  }
-  if *cookieSecret == "" {
-    err = true
-    log.Critical("cookie-secret must be set")
-  }
-  if err {
-    return
-  }
-
-  // Parse lists
-  var cookieDomains []CookieDomain
-  if *cookieDomainList != "" {
-    for _, d := range strings.Split(*cookieDomainList, ",") {
-      cookieDomain := NewCookieDomain(d)
-      cookieDomains = append(cookieDomains, *cookieDomain)
-    }
-  }
-
-  var domain []string
-  if *domainList != "" {
-    domain = strings.Split(*domainList, ",")
-  }
-
-  // Setup
-  fw = &ForwardAuth{
-    Path: fmt.Sprintf("/%s", *path),
-    Lifetime: time.Second * time.Duration(*lifetime),
-
-    ClientId: *clientId,
-    ClientSecret: *clientSecret,
-    Scope: "https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email",
-    LoginURL: &url.URL{
-      Scheme: "https",
-      Host: "accounts.google.com",
-      Path: "/o/oauth2/auth",
-    },
-    TokenURL: &url.URL{
-      Scheme: "https",
-      Host: "www.googleapis.com",
-      Path: "/oauth2/v3/token",
-    },
-    UserURL: &url.URL{
-      Scheme: "https",
-      Host: "www.googleapis.com",
-      Path: "/oauth2/v2/userinfo",
-    },
-
-    CookieName: *cookieName,
-    CSRFCookieName: *cSRFCookieName,
-    CookieDomains: cookieDomains,
-    CookieSecret: []byte(*cookieSecret),
-    CookieSecure: *cookieSecure,
-
-    Domain: domain,
-
-    Direct: *direct,
-  }
-
-  // Attach handler
-  http.HandleFunc("/", handler)
-
-  log.Notice("Litening on :4181")
-  log.Notice(http.ListenAndServe(":4181", nil))
-}
--- a/main_test.go
+++ b/main_test.go
@ -1,181 +0,0 @@
-
-package main
-
-import (
-  "fmt"
-  "time"
-  // "reflect"
-  "strings"
-  "testing"
-  "net/url"
-  "net/http"
-  "io/ioutil"
-  "net/http/httptest"
-
-  "github.com/op/go-logging"
-)
-
-
-type TokenServerHandler struct {}
-func (t *TokenServerHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-  fmt.Fprint(w, `{"access_token":"123456789"}`)
-}
-
-type UserServerHandler struct {}
-func (t *UserServerHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-  fmt.Fprint(w, `{
-    "id":"1",
-    "email":"example@example.com",
-    "verified_email":true,
-    "hd":"example.com"
-  }`)
-}
-
-func init() {
-  // Remove for debugging
-  logging.SetLevel(logging.INFO, "traefik-forward-auth")
-}
-
-func httpRequest(r *http.Request, c *http.Cookie) (*http.Response, string) {
-  w := httptest.NewRecorder()
-
-  // Set cookies on recorder
-  if c != nil {
-    http.SetCookie(w, c)
-  }
-
-  // Copy into request
-  for _, c := range w.HeaderMap["Set-Cookie"] {
-    r.Header.Add("Cookie", c)
-  }
-
-  handler(w, r)
-
-  res := w.Result()
-  body, _ := ioutil.ReadAll(res.Body)
-
-  return res, string(body)
-}
-
-func newHttpRequest(uri string) *http.Request {
-  r := httptest.NewRequest("", "http://example.com", nil)
-  r.Header.Add("X-Forwarded-Uri", uri)
-  return r
-}
-
-func TestHandler(t *testing.T) {
-  fw = &ForwardAuth{
-    Path: "_oauth",
-    ClientId: "idtest",
-    ClientSecret: "sectest",
-    Scope: "scopetest",
-    LoginURL: &url.URL{
-      Scheme: "http",
-      Host: "test.com",
-      Path: "/auth",
-    },
-    CookieName: "cookie_test",
-    Lifetime: time.Second * time.Duration(10),
-  }
-
-  // Should redirect vanilla request to login url
-  req := newHttpRequest("foo")
-  res, _ := httpRequest(req, nil)
-  if res.StatusCode != 307 {
-    t.Error("Vanilla request should be redirected with 307, got:", res.StatusCode)
-  }
-  fwd, _ := res.Location()
-  if fwd.Scheme != "http" || fwd.Host != "test.com" || fwd.Path != "/auth" {
-    t.Error("Vanilla request should be redirected to login url, got:", fwd)
-  }
-
-  // Should catch invalid cookie
-  req = newHttpRequest("foo")
-
-  c := fw.MakeCookie(req, "test@example.com")
-  parts := strings.Split(c.Value, "|")
-  c.Value = fmt.Sprintf("bad|%s|%s", parts[1], parts[2])
-
-  res, _ = httpRequest(req, c)
-  if res.StatusCode != 401 {
-    t.Error("Request with invalid cookie shound't be authorised", res.StatusCode)
-  }
-
-  // Should validate email
-  req = newHttpRequest("foo")
-
-  c = fw.MakeCookie(req, "test@example.com")
-  fw.Domain = []string{"test.com"}
-
-  res, _ = httpRequest(req, c)
-  if res.StatusCode != 401 {
-    t.Error("Request with invalid cookie shound't be authorised", res.StatusCode)
-  }
-
-  // Should allow valid request email
-  req = newHttpRequest("foo")
-
-  c = fw.MakeCookie(req, "test@example.com")
-  fw.Domain = []string{}
-
-  res, _ = httpRequest(req, c)
-  if res.StatusCode != 200 {
-    t.Error("Valid request should be allowed, got:", res.StatusCode)
-  }
-}
-
-func TestCallback(t *testing.T) {
-  fw = &ForwardAuth{
-    Path: "_oauth",
-    ClientId: "idtest",
-    ClientSecret: "sectest",
-    Scope: "scopetest",
-    LoginURL: &url.URL{
-      Scheme: "http",
-      Host: "test.com",
-      Path: "/auth",
-    },
-    CSRFCookieName: "csrf_test",
-  }
-
-  // Setup token server
-  tokenServerHandler := &TokenServerHandler{}
-  tokenServer := httptest.NewServer(tokenServerHandler)
-  defer tokenServer.Close()
-  tokenUrl, _ := url.Parse(tokenServer.URL)
-  fw.TokenURL = tokenUrl
-
-  // Setup user server
-  userServerHandler := &UserServerHandler{}
-  userServer := httptest.NewServer(userServerHandler)
-  defer userServer.Close()
-  userUrl, _ := url.Parse(userServer.URL)
-  fw.UserURL = userUrl
-
-  // Should pass auth response request to callback
-  req := newHttpRequest("_oauth")
-  res, _ := httpRequest(req, nil)
-  if res.StatusCode != 401 {
-    t.Error("Auth callback without cookie shound't be authorised, got:", res.StatusCode)
-  }
-
-  // Should catch invalid csrf cookie
-  req = newHttpRequest("_oauth?state=12345678901234567890123456789012:http://redirect")
-  c := fw.MakeCSRFCookie(req, "nononononononononononononononono")
-  res, _ = httpRequest(req, c)
-  if res.StatusCode != 401 {
-    t.Error("Auth callback with invalid cookie shound't be authorised, got:", res.StatusCode)
-  }
-
-  // Should redirect valid request
-  req = newHttpRequest("_oauth?state=12345678901234567890123456789012:http://redirect")
-  c = fw.MakeCSRFCookie(req, "12345678901234567890123456789012")
-  res, _ = httpRequest(req, c)
-  if res.StatusCode != 307 {
-    t.Error("Valid callback should be allowed, got:", res.StatusCode)
-  }
-  fwd, _ := res.Location()
-  if fwd.Scheme != "http" || fwd.Host != "redirect" || fwd.Path != "" {
-    t.Error("Valid request should be redirected to return url, got:", fwd)
-  }
-}
--- a/test/config-legacy
+++ b/test/config-legacy
@ -0,0 +1,2 @@
+url-path two
+auth-host auth.legacy.com
--- a/test/config0
+++ b/test/config0
@ -0,0 +1,5 @@
+cookie-name=inicookiename
+csrf-cookie-name=inicsrfcookiename
+url-path=one
+rule.1.action=allow
+rule.1.rule=PathPrefix(`/one`)
--- a/test/config1
+++ b/test/config1
@ -0,0 +1,3 @@
+url-path=two
+rule.two.action=auth
+rule.two.rule=Host(`two.com`) && Path(`/two`)
Author	SHA1	Message	Date
Thom Seddon	d0b48f58d4	Update go1.12 -> go1.13 + update dependencies + mod tidy	2020-01-27 12:19:29 +00:00
Thom Seddon	391793b220	Simplify oauth server testing	2020-01-27 12:19:29 +00:00
Thom Seddon	c9289d6fc1	Multiple provider support + OIDC provider	2020-01-27 12:19:29 +00:00
Thom Seddon	5dfd4f2878	Add arm builds. Fixes #38	2019-09-30 10:53:01 +01:00
Thom Seddon	a99330e6b2	Fix typos	2019-09-30 10:44:46 +01:00
Sandro	5a676f3068	Fix rules argument (#71 )	2019-09-20 16:28:11 +01:00
Thom Seddon	3e6ccc8f45	Redirect to login on cookie expiry + simplify ValidateCookie function Possible fix for #31	2019-06-13 15:13:52 +01:00
Thom Seddon	3e92400202	Fix backwards compat on "domain" config + remove "domains" config Fixes #48	2019-06-11 13:14:29 +01:00
Thom Seddon	72fc88a82b	Add extra tests for env var backwards compat	2019-06-11 10:08:47 +01:00
Thom Seddon	2c148d3a23	Add releases info to README	2019-06-10 12:19:53 +01:00
Thom Seddon	d33ecc0654	Make rule parsing more robust - check args length before popping - ensure rule has name	2019-06-10 11:38:50 +01:00
Thom Seddon	41a3f2a5a9	Fix missing client id/secret log message	2019-06-10 11:24:14 +01:00
Thom Seddon	5a17187855	Fix go-flags dep + formatting	2019-05-13 11:56:43 +01:00
Thom Seddon	e7b567bc92	Fix typos. Inspired by #43	2019-05-13 11:27:31 +01:00
Thom Seddon	a4a34dcd76	Handle unknown ini options	2019-05-07 19:17:42 +01:00
Thom Seddon	d1b12e4ffb	Fix host/method rule matching + tests	2019-05-07 14:16:38 +01:00
Thom Seddon	6f3ac5efe5	pre-release logging + docs improvements and fixes	2019-05-07 12:05:47 +01:00
Thom Seddon	b0e4b6333d	Use updated go-flags version for env-namespace support + fix docs	2019-05-07 10:39:29 +01:00
Thom Seddon	dd13f42ddf	Update README + examples for v2	2019-04-24 10:09:35 +01:00
Thom Seddon	8f6e911045	Backwards compatability fixes	2019-04-23 19:16:24 +01:00
Thom Seddon	fa61c84373	Fix, improve + test google provider initiation	2019-04-23 18:48:18 +01:00
Thom Seddon	3cc9cd13e1	Update option descriptions + prefer multiple singular options Plus backwards compatability for legacy comma separated list options	2019-04-23 18:26:56 +01:00
Thom Seddon	93912f4a6e	Overhaul testing to use testify	2019-04-23 17:49:16 +01:00
Thom Seddon	2074bc7727	Import `f1ba9b5`	2019-04-18 16:37:41 +01:00
Thom Seddon	6968f6181b	Add more v2 tests + fixes + improve legacy config parsing	2019-04-18 16:37:41 +01:00
Thom Seddon	5597b7268b	Use new rule config + tidy ups	2019-04-18 16:37:41 +01:00
Thom Seddon	e057f2d63a	Improve qsdiff error reporting	2019-04-18 16:37:41 +01:00
Thom Seddon	9abe509f66	Refactor progress - move directory structure - string based rule definition - use traefik rule parsing - drop toml config - new flag library - implement go dep	2019-04-18 16:37:55 +01:00
Thom Seddon	d51b93d4b0	Begin refactor + selective auth	2019-04-18 16:37:41 +01:00
Thom Seddon	f1ba9b5ac4	Update default request logger to include original source IP	2019-04-18 16:05:03 +01:00
Thom Seddon	5c800a0170	Remove old logger from tests	2019-01-22 14:19:17 +00:00
Thom Seddon	b1fdcc7f56	Fix travis build	2019-01-22 13:55:49 +00:00
Thom Seddon	db31b09a72	Add report card to README	2019-01-22 13:12:25 +00:00
Thom Seddon	e1d518db11	Minor logging + comment fix	2019-01-22 13:10:03 +00:00
Thom Seddon	67339ae79a	Include logrus in docker build	2019-01-22 12:59:29 +00:00
Thom Seddon	0b2889935e	Log all request headers at debug level	2019-01-22 12:58:24 +00:00
Thom Seddon	b3b31e2193	Refactor logging Fixes #18	2019-01-22 12:46:58 +00:00
Thom Seddon	1a3a099ac1	use gofmt to simplify code	2019-01-22 10:51:41 +00:00
Thom Seddon	afd8878188	use gofmt to update styling	2019-01-22 10:50:55 +00:00
Thom Seddon	6ccd1c6dfc	Add documentation for X-Forwarded-User	2018-12-10 12:48:45 +00:00
Thom Seddon	df81be1147	Pass on authenticated user via X-Forwarded-User header Fixes #13	2018-12-10 12:44:13 +00:00
Thom Seddon	5dcf889efe	Merge pull request #16 from nicoulaj/patch-1 Fix some typos in logs	2018-12-04 13:32:36 +00:00
nicoulaj	92d72dcdd2	Fix some typos in logs	2018-12-02 19:09:49 +01:00
Thom Seddon	4c1874b786	add auth host example + update examples	2018-11-06 14:45:56 +00:00
Thom Seddon	dcf4f6574d	remove direct mode + add example development compose	2018-11-06 14:17:40 +00:00
Thom Seddon	91775ff0a8	Merge branch 'lammensj-whitelist'	2018-11-06 14:04:07 +00:00
Thom Seddon	1832672f5e	Modify whitelist implementation + expand docs Closes #4	2018-11-06 14:02:18 +00:00
Jasper Lammens	eaad0a9054	Allow a whitelist of email addresses	2018-11-06 14:02:18 +00:00
Mathieu Cantin	36fffd2382	Fix demo config COOKIE_SECRET was renamed SECRET	2018-11-06 14:02:18 +00:00
Thom Seddon	ccbda4ec8c	Merge pull request #10 from mathcantin/master Fix demo config	2018-11-06 13:45:21 +00:00
Thom Seddon	b014c5638a	Merge pull request #12 from forMetris/master Add -prompt flag	2018-11-06 13:44:01 +00:00
Thomas Vaillant	c897bc8387	Add -prompt flag Space separated list of OpenID prompt options (https://developers.google.com/identity/protocols/OpenIDConnect#prompt)	2018-11-05 16:43:30 +01:00
Mathieu Cantin	96f9469abd	Fix demo config COOKIE_SECRET was renamed SECRET	2018-10-29 14:21:29 -04:00
Louis Laugesen	b54871391f	Add example dir to dockerignore	2018-10-29 17:52:04 +00:00
Thom Seddon	d230572879	Add auth host feature Allow central host for use as base for redirect_uri Closes #3	2018-10-29 17:42:13 +00:00