In case you want to disable the DQL query interface all together (to rely only on GraphQL @auth rules),
you can do this with a rather simple traefik config in docker-compose:
traefik.disabled.frontend.rule: Host:your.dgraph.url;PathStrip:/query
traefik.disabled.port: 666 # a port destined for failure
traefik.dghttp.frontend.rule: Host:your.dgraph.url
traefik.dghttp.port: 8080 # the internal port to be exposed on https://your.dgraph.url