Real-IP With Caddy in front | authentik | Page 1

cold frost Jul 12, 2023, 2:06 AM

#

my caddy compose is as such

    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:latest
    restart: unless-stopped
    container_name: authentik-server
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: authentik-redis
      AUTHENTIK_POSTGRESQL__HOST: authentik-postgres
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "true"
    volumes:
      #- /mnt/user/appdata/authentik/media:/media
      - /mnt/user/appdata/authentik/custom-templates:/templates
      - /mnt/user/appdata/authentik/geoip:/geoip
    env_file:
      - .env
    ports:
      - "0.0.0.0:${AUTHENTIK_PORT_HTTP:-9000}:9000"
      - "0.0.0.0:${AUTHENTIK_PORT_HTTPS:-9443}:9443"
    networks:
      - proxynet
    labels:
      com.centurylinklabs.watchtower.enable: true
      traefik.enable: true
      traefik.http.routers.authentik.entryPoints: https
      traefik.http.routers.authentik.rule: Host(`https://auth.example.com`) || HostRegexp(`{subdomain:[a-z0-9]+}.example.com`) && PathPrefix(`/outpost.goauthentik.io/`)

cold frost Jul 12, 2023, 2:42 AM

#

I just tried the caddy config from the caddy config from the installation instructions and forward_auth sends me into a redirect loop can we copy the authenik headers with reverse_proxy

#

        header {
                header_up X-Real-IP {remote_host}
                server #anonymizes Caddy
                # disable FLoC tracking
                Permissions-Policy interest-cohort=()
                # enable HSTS
                Strict-Transport-Security max-age=31536000;
                # disable clients from sniffing the media type
                X-Content-Type-Options nosniff
                # clickjacking protection
                X-Frame-Options DENY
                # keep referrer data off of HTTP connections
                Referrer-Policy no-referrer-when-downgrade
        }
        reverse_proxy /outpost.goauthentik.io/* http://auth.xyz.io
        reverse_proxy 10.16.1.100:9000
}```

cold frost Sep 13, 2023, 6:00 AM

#

If anyone findn this the issue was i was using the wireguard network of 172.69 this is not automatically private so when aithentik sees it it just shows the ip. Or caddy is not ignoreing it since it is not a normal private ip you need to is 172. 16-32 all always private

#Real-IP With Caddy in front