Traefik + Tinyauth: no headers coming through in Proxmox LXC

[cottinghamk]

I'm using Tinyauth with Traefik. I think I have everything right, but the protected service behind Tinyauth states "Authentication required. Proxy header not set." I am running Traefik, Tinyauth, and the protected service all as LXCs in Proxmox, set up using the community scripts. PocketID too, in case that matters, but that doesn't seem to be giving me any grief.

Traefik static:

entryPoints:
  websecure:
    address: ':443'
    http:
      tls:
        certResolver: letsencrypt
        domains:
          - main: domain.tld
            sans:
              - '*.domain.tld'
    forwardedHeaders:
      trustedIPs:
        - 192.168.1.0/24
      insecure: true

Traefik dynamic:

http:
 routers:
   app:
     entryPoints:
       - "websecure"
     middlewares:
       - "tinyauth-auth"
     rule: "Host(`app.domain.tld`)"
     service: app
     tls:
       certResolver: letsencrypt
   tinyauth:
     entryPoints:
       - "websecure"
     rule: "Host(`tinyauth.domain.tld`)"
     service: tinyauth
     tls:
       certResolver: letsencrypt
 services:
   app:
     loadBalancer:
       servers:
         - url: "http://[app IP]:[app port]"
       passHostHeader: true
   tinyauth:
     loadBalancer:
       servers:
         - url: "http://[tinyauth IP]:3000"
       passHostHeader: true

 middlewares:
   tinyauth-auth:
     forwardAuth:
       address: "http://[tinyauth IP]:3000/api/auth/traefik"
       trustForwardHeader: true
       authResponseHeaders:
         - Remote-User
         - Remote-Groups
         - Remote-Name
         - Remote-Email

Tinyauth .env file:

TINYAUTH_DATABASE_PATH=/opt/tinyauth/database.db
TINYAUTH_APPURL='https://tinyauth.domain.tld'

TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTID='id'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTSECRET='secret'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_AUTHURL='https://pocketid.domain.tld/authorize'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_TOKENURL='https://pocketid.domain.tld/api/oidc/token'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_USERINFOURL='https://pocketid.domain.tld/api/oidc/userinfo'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_REDIRECTURL='https://tinyauth.domain.tld/api/oauth/callback/pocketid'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_SCOPES='openid email profile groups'
TINYAUTH_OAUTH_PROVIDERS_POCKETID_NAME='Pocket ID'
TINYAUTH_OAUTH_AUTOREDIRECT='pocketid'

TINYAUTH_AUTH_TRUSTEDPROXIES='192.168.1.0/24'
TINYAUTH_AUTH_IP_ALLOW='192.168.1.0/24'

#App
TINYAUTH_APPS_APP_CONFIG_DOMAIN='app.domain.tld'
TINYAUTH_APPS_SHELFMARK_RESPONSE_HEADERS='Remote-User,Remote-Email,Remote-Groups,Remote-Name'

Tinyauth logging is set to trace. It shows:

Request identified as coming from a browser log_stream=app
Got proxy context ctx={"Host":"app.domain.tld","IsBrowser":true,"Method":"GET","Path":"/favicon.ico","Proto":"https","Type":2} log_stream=app
Found matching container by domain log_stream=app name=app
Using ACls from static configuration log_stream=app
ACLs for resource acls={"Config":{"Domain":"app.domain.tld"},"IP":{"Allow":null,"Block":null,"Bypass":null},"LDAP":{"Groups":""},"OAuth":{"Groups":"","Whitelist":""},"Path":{"Allow":>
IP not in bypass list, continuing with authentication ip=[client IP] log_stream=app
IP is in allowed list, allowing access ip=[client IP] item=192.168.1.0/24 log_stream=app
No user context found in request, treating as not logged in log_stream=app
User context from request context={"Email":"","IsBasicAuth":false,"IsLoggedIn":false,"LdapGroups":"","Name":"","OAuth":false,"OAuthGroups":"","OAuthName":"","OAuthSub":"","Provider":"","TotpEnabled":false,"TotpPending":false,"Username":""} log_stream=app
Request address=[traefik IP]:56292 client_ip=[client IP] latency="187.873µs" log_stream=http method=GET path=/api/auth/traefik status=307

[steveiliop56]

Well from the logs it seems like you are not logged in. What version of Tinyauth are you running? Also mind sharing the application you are trying to forward headers to?

[cottinghamk]

Yeah, I saw that line as well, but Tinyauth is properly sending me over to PocketID to log in

As I posted this, I upgraded to 5.0.6, but was on 5.0.5 previously. and the app is Shelfmark.

[steveiliop56]

Try removing these lines entirely from your configuration:

TINYAUTH_APPS_APP_CONFIG_DOMAIN='app.domain.tld'
TINYAUTH_APPS_SHELFMARK_RESPONSE_HEADERS='Remote-User,Remote-Email,Remote-Groups,Remote-Name'

Tinyauth automatically sets the headers, I believe that by setting them in the response ACLs you are actually overwriting the value with an empty one.

[cottinghamk]

Unfortunately, still nothing.

Request identified as coming from a browser log_stream=app
Got proxy context ctx={"Host":"app.domain.tld","IsBrowser":true,"Method":"GET","Path":"/favicon.ico","Proto":"https","ProxyType":0,"Type":2} log_stream=app
Falling back to Docker labels for ACLs log_stream=app
Docker not connected, returning empty labels log_stream=app
ACLs for resource acls={"Config":{"Domain":""},"IP":{"Allow":null,"Block":null,"Bypass":null},"LDAP":{"Groups":""},"OAuth":{"Groups":"","Whitelist":""},"Path":{"Allow":"","Block":""},"Response":{"BasicAuth":{"Password":"","PasswordFile":"","Username":""},"Headers":null},"Users":{"Allow":"","Block":""}} log_stream=app
IP not in bypass list, continuing with authentication ip=192.168.1.101 log_stream=app
IP is in allowed list, allowing access ip=192.168.1.101 item=192.168.1.0/24 log_stream=app
No user context found in request, treating as not logged in log_stream=app
User context from request context={"Email":"","IsBasicAuth":false,"IsLoggedIn":false,"LdapGroups":"","Name":"","OAuth":false,"OAuthGroups":"","OAuthName":"","OAuthSub":"","Provider":"","TotpEnabled":false,"TotpPending":false,"Username":""} log_stream=app
Request address=192.168.1.112:60656 client_ip=192.168.1.101 latency="192.172µs" log_stream=http method=GET path=/api/auth/traefik status=307

[cottinghamk]

There must be something wrong with Traefik or Shelfmark. I set up Authelia to test and it's giving me the same message. I'm going to mark this closed and nuke my Shelfmark LXC. Thanks so much for your help here.