1. The problem I’m having:
Hi, I am already using forward_auth to forward auth to my apps (like Radarr or WLED) to an Authentik authentication server that is running on the same machine, using the following configuration:
app.maindomain.com {
reverse_proxy app:8080
reverse_proxy /outpost.goauthentik.io/* authentik-server:9000
forward_auth authentik-server:9000 {
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
uri /outpost.goauthentik.io/auth/caddy
}
}
This configuration is from Caddy | authentik , and it works perfectly locally.
Now, I have a new server, with a different IP. I am trying to do the same thing with forward_auth, but instead of reaching an Authentik server on the same machine, it is on a remote machine. So I am trying with this configuration:
app.maindomain.com {
reverse_proxy app:8080
reverse_proxy /outpost.goauthentik.io/* https://auth.maindomain.com {
header_up Host {http.reverse_proxy.upstream.hostport}
} # This part is added according to Authentik documentation as it is https
forward_auth https://auth.maindomain.com {
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
uri /outpost.goauthentik.io/auth/caddy
}
}
To sum up, forward_auth on server 1 works but forward_auth on server 2 doesn’t.
But this doesn’t work. To me, it appears to be a Caddy problem and not an Authentik issue. What is happening is that caddy let me access the app directly, without even forwarding the auth to Authentik. There is no auth at all. The distant Authentik server (and the associated caddy reverse proxy) are not receiving any input, which means caddy is not sending anything. It looks like as soon the forward auth address is distant and no longer local, it completely ignores it. There is no error in my caddy log.
The problem could be because Authentik itself is reverse-proxied by Caddy on server 1, and that additional layer may be the problem of forward_auth. But I’m not sure what to do with this.
Any answer, any help is welcome.
Have a great day.
2. Error messages and/or full log output:
My logs are accessible here : Hostux PrivateBin
I am not noticing any particular error.
3. Caddy version:
v2.7.4 h1:J8nisjdOxnYHXlorUKXY75Gr6iBfudfoGhrJ8t7/flI=
4. How I installed and ran Caddy:
Caddy Docker Proxy, Docker Compose
a. System environment:
Odroid N2+ 2Gb
ARM64v8
b. Command:
PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.
c. Service/unit/compose file:
PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.
d. My complete Caddy config:
PASTE OVER THIS, BETWEEN THE ``` LINES.
Please use the preview pane to ensure it looks nice.