I’m currently beating my head up against Authentik. What I’m trying to do is to use Authentik to secure an unsecured service, like VS-Code server. Supposedly I can do this by pointing the domain to the Authentik server and then Authentik’s proxy points to the Code Server, but everything that I try either redirects back to Authentik or just gives me a blank screen.

Authentik and VS-Code are both running on the same system in docker, with my reverse proxy on another system.

The DNS (pihole) for both code.test and auth.test point to my reverse proxy running Caddy, and all of this is running local network only.

Any ideas what I am missing? Any help would be appreciated.


Caddyfile:

code.test.example.com {
    tls internal
    reverse_proxy auth.test.example.com
}
auth.test.example.com {
    tls internal
    reverse_proxy 192.168.1.110:9000
}

Authentik Proxy Provider:

External host: https://code.test.example.com
Internal host: http://192.168.1.110:8443
Internal host SSL Validation = false

VS-Code Server docker-compose.yaml:

version: "2.1"
services:
  code-server:
    image: lscr.io/linuxserver/code-server:latest
    container_name: code-server
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      #- PASSWORD= #optional
      #- HASHED_PASSWORD= #optional
      - SUDO_PASSWORD=Password #optional
      #- SUDO_PASSWORD_HASH= #optional
      - PROXY_DOMAIN=code.test.example.com #optional
      - DEFAULT_WORKSPACE=/config/workspace #optional
    volumes:
      - ./config:/config
    ports:
      - 8443:8443
    restart: unless-stopped

Authentik docker-compose.yaml:

---
version: "3.4"

services:
  postgresql:
    image: docker.io/library/postgres:12-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    env_file:
      - .env
  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - redis:/data
  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - ./media:/media
      - ./custom-templates:/templates
    env_file:
      - .env
    ports:
      - "${COMPOSE_PORT_HTTP:-9000}:9000"
      - "${COMPOSE_PORT_HTTPS:-9443}:9443"
    depends_on:
      - postgresql
      - redis
  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.8.3}
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    # `user: root` and the docker socket volume are optional.
    # See more for the docker socket integration here:
    # https://goauthentik.io/docs/outposts/integrations/docker
    # Removing `user: root` also prevents the worker from fixing the permissions
    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
    # (1000:1000 by default)
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./media:/media
      - ./certs:/certs
      - ./custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - postgresql
      - redis

volumes:
  database:
    driver: local
  redis:
    driver: local
  • chandz05@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    If you’re trying to use pihole as a local DNS, you’ll still have to add your application port to the end of the URL if you’re not doing that already. So like if you’ve assigned server.local to your host server in pihole, to get to your app you would have to do http://server.local:1234, where 1234 is your app port number.

    Otherwise, I have this all working with a code-server instance behind SWAG reverse proxy and Authelia authentication over the internet, if you need further help with that.

      • chandz05@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        And in general :) hopefully that helps. Can you hit the site directly (without caddy etc) after setting up the DNS name in pihole?

  • antsu@lemmy.wtf
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    This looks about right, I have a similar setup for unauthenticated services here, with the difference that I’m using NGINX Proxy Manager instead of Caddy. The things I would try/check are:

    • Make sure you’ve enabled the proxy provider in the local outpost config in Authentik.
    • Declare a common network between the two containers, so that they can communicate without having to go out through the host’s IP. This way you can reference the VS Code container directly by its service name in Authentik.
    • I’m not familiar with Caddy, but I would also try changing the code.test.example.com entry to point directly to Authentik’s IP and port (in other words, both entries would look the same). In the config your posted, it seems like Caddy is redirecting through itself.
  • Decronym@lemmy.decronym.xyzB
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 year ago

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

    Fewer Letters More Letters
    DNS Domain Name Service/System
    IP Internet Protocol
    VPN Virtual Private Network

    3 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

    [Thread #242 for this sub, first seen 26th Oct 2023, 05:35] [FAQ] [Full list] [Contact] [Source code]

    • StrawberryPigtails@lemmy.sdf.orgOP
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      My goal is not so much to add authentication to VS Code ( I agree it’s built in function is fine for local network use and I likely would not be putting it on the open net), but rather to learn to use Authentik. In the end I would like all of my services (or rather, as many as possible) using a single login provider.

      Right now, I have 15 services running, each of which have their own authentication system with their own user names and passwords. It gets annoying, especially when my family members also use many of the services I run. I wanted a single place I could go to add and administer user accounts.

      I could do this many ways, (LDAP, Authelia, KeyCloak) but I chose Authentik because it appeares to support everything I currently run, with the possible exception of Home Assistant and Jellyfin.