diff --git a/.env.sample b/.env.sample
index 1cc2713..af6b7b2 100644
--- a/.env.sample
+++ b/.env.sample
@@ -4,3 +4,9 @@ DOMAIN=owncast.example.com
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.owncast.example.com`'
 LETS_ENCRYPT_ENV=production
+
+COMPOSE_FILE="compose.yml"
+
+# Single Sign-On using traefik-forward-auth
+#TFA_MIDDLEWARE_NAME="keycloak"
+#COMPOSE_FILE="$COMPOSE_FILE:compose.sso.yml"
diff --git a/compose.sso.yml b/compose.sso.yml
new file mode 100644
index 0000000..385457b
--- /dev/null
+++ b/compose.sso.yml
@@ -0,0 +1,8 @@
+version: "3.8"
+services:
+  app:
+    environment:
+      - TFA_MIDDLEWARE_NAME
+    deploy:
+      labels:
+        - "traefik.http.routers.${STACK_NAME}.middlewares=${TFA_MIDDLEWARE_NAME}@file"