Unsure how to set up Forward Auth (Domain Level) proxy

[DaveTSG]

Hello.

I was following Jim's Garage's YouTube videos about setting up Authentik (with Traefik and docker-compose).

I have been able to create a single OAuth app and provider to allow logging into Portainer using Authentik. That was explained in this video.
The problem is, those videos are fairly old, and are based on Authentik 2023.8.3. I am trying to use 2024.6.1 instead, and ended up following Authentik's instructions for setting up Portainer in the end. That works.

I'm now working my way through this more recent video, which aims to set up a proxy... I think this means it's configuring things so that Authentik will cover all of my various Docker services, not just the one service (in the previous example, Portainer). (Please correct me if I have misunderstood this)

Due to the different versions involved, I am a bit unclear of the exact steps required, and was hoping someone here could help please.

I found this documentation, and this example docker-compose file for Traefik specifically.

I modified my own files to suit, as explained below.

Some notes:

• My Docker host is a spare Apple Mac Mini 18,1, running Debian v12.6 (Bookworm). (It is not running MacOS at all)
• I am using docker-compose files.
• I have a Pi-Hole instance on the Docker host, which I use primarily for DNS.
• The Docker host's IP address on my internal network is 192.168.4.7.
• Authentik, Traefik, and several other Docker containers are connected to a Docker bridge network called "proxy".
• I have a domain name set up, domain.com. I have various services configured in Pi-Hole, e.g. traefik-dashboard.domain.com, authentik.domain.com, homepage.domain.com, portainer.homepage.com, and so on... These all work at the moment.

docker-compose-authentik.yml:

---

services:
  postgresql:
    image: docker.io/library/postgres:16-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    env_file:
      - .env
    networks:
      proxy:
  redis:
    image: docker.io/library/redis:alpine
    command: --save 60 1 --loglevel warning
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - redis:/data
    networks:
      proxy:
  server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.1}
    container_name: authentik_server
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - ./media:/media
      - ./custom-templates:/templates
    env_file:
      - .env
    ports:
      - "${COMPOSE_PORT_HTTP:-9000}:9000"
      - "${COMPOSE_PORT_HTTPS:-9443}:9443"
    networks:
      proxy:
    depends_on:
      - postgresql
      - redis
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authentik.entrypoints=http"
      - "traefik.http.routers.authentik.rule=Host(`authentik.domain.com`)"
      - "traefik.http.middlewares.authentik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.routers.authentik.middlewares=authentik-https-redirect"
      - "traefik.http.routers.authentik-secure.entrypoints=https"
      - "traefik.http.routers.authentik-secure.rule=Host(`authentik.domain.com`)"
      - "traefik.http.routers.authentik-secure.tls=true"
      - "traefik.http.routers.authentik-secure.service=authentik"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
      - "traefik.docker.network=proxy"
      - homepage.group=Docker admin
      - homepage.name=Authentik SSO
      - homepage.icon=authentik
      - homepage.href=https://authentik.domain.com/
      - homepage.description=Single sign-on
      - homepage.statusStyle=dot
      - homepage.showStats=true
  worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.1}
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    # `user: root` and the docker socket volume are optional.
    # See more for the docker socket integration here:
    # https://goauthentik.io/docs/outposts/integrations/docker
    # Removing `user: root` also prevents the worker from fixing the permissions
    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
    # (1000:1000 by default)
    user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./media:/media
      - ./certs:/certs
      - ./custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - postgresql
      - redis
    networks:
      proxy:

volumes:
  database:
    driver: local
  redis:
    driver: local

networks:
  proxy:
    external: true

docker-compose-traefik.yml:

services:
  traefik:
    image: traefik:v3.0.4
    container_name: traefik
    command:
      - "--api"
      - "--providers.docker=true"
      - "--providers.docker.exposedByDefault=false"
      - "--entrypoints.web.address=:80"
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80 #For internal services
      - 81:81 #For external services
      - 443:443 #For internal services
      - 444:444 #For external services
      # - 443:443/tcp # Uncomment if you want HTTP3
      # - 443:443/udp # Uncomment if you want HTTP3
    environment:
      CF_DNS_API_TOKEN_FILE: /run/secrets/cf_api_token # note using _FILE for docker secrets
      # CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN} # if using .env
      TRAEFIK_DASHBOARD_CREDENTIALS: ${TRAEFIK_DASHBOARD_CREDENTIALS}
    secrets:
      - cf_api_token
    env_file: .env # use .env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik.yml:/traefik.yml:ro
      - ./data/acme.json:/acme.json
      - ./data/config.yml:/config.yml:ro
      - ./logs:/var/log/traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.domain.com`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_DASHBOARD_CREDENTIALS}"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.domain.com`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=domain.com"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.domain.com"
      - "traefik.http.routers.traefik-secure.service=api@internal"
      - "traefik.http.services.traefik-secure.loadbalancer.server.port=9000"
      - homepage.group=Network admin
      - homepage.name=Traefik
      - homepage.icon=traefik
      - homepage.href=https://traefik-dashboard.domain.com
      - homepage.description=HTTP reverse proxy and load balancer.
      - homepage.statusStyle=dot
      - homepage.widget.type=traefik
      - homepage.widget.url=https://traefik-dashboard.domain.com
      - homepage.widget.username=dave
      - homepage.widget.password=passwordhere
      - homepage.showStats=true

  authentik-proxy:
    image: ghcr.io/goauthentik/proxy
    ports:
        - 9000:9000
        - 9443:9443
    environment:
        AUTHENTIK_HOST: https://authentik-domain.com
        AUTHENTIK_INSECURE: "false"
        AUTHENTIK_TOKEN: token-generated-by-authentik
        # Starting with 2021.9, you can optionally set this too
        # when authentik_host for internal communication doesn't match the public URL
        # AUTHENTIK_HOST_BROWSER: https://external-domain.tld
    labels:
        traefik.enable: true
        traefik.port: 9000
        traefik.http.routers.authentik.rule: Host(`domain.com`) && PathPrefix(`/outpost.goauthentik.io/`)
        # `authentik-proxy` refers to the service name in the compose file.
        traefik.http.middlewares.authentik.forwardauth.address: http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
        traefik.http.middlewares.authentik.forwardauth.trustForwardHeader: true
        traefik.http.middlewares.authentik.forwardauth.authResponseHeaders: X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
    restart: unless-stopped


secrets:
  cf_api_token:
    file: ./cf_api_token.txt

networks:
  proxy:
    external: true

1. When I try to docker compose up the Traefik compose file, I get an error about port 9000 already being in use. I note that the Authentik server (in the Authentik docker-compose.yml) has port 9000 defined. Is this the correct way of doing things? Or can I change this so that Traefik can use port 9000 instead? If so, how can I do this?
2. The authentik-proxy service (within the Traefik docker-compose.yml) has a line "AUTHENTIK_TOKEN: token-generated-by-authentik". Where can I find this token? I was able to find a token by going into Authentik > Applications > Outposts, and then clicking on "View Deployment Info" next to "Domain Forward Auth Provider", and then clicking the "Click to copy token" button. Is this the correct token to use or is it meant to be retrieved from elsewhere?
3. Is this the correct way of proceeding to achieve this goal (having Authentik enabled for all of my services, using Traefik as a proxy)? Or am I going down the wrong path?

Thank you in advance.

[DaveTSG]

Somewhat related to the OP issue, I've tried to go ahead with setting up Netbird as well. I used Authentik's application creation wizard to create an OAuth2 application and provider. However, when clicking the submit button to actually create it, I received a fairly vague error message:

`Authentik was unable to save this application:
There was an error in the application.

Review the application.`

Clicking "Review the application" takes you back to step 1 of the wizard, with the options I filled in the first time around still present (e.g. the name and slug are still there).

It's not obvious what the problem is at this stage.

I found this troubleshooting guide.

I did both adding AUTHENTIK_LOG_LEVEL=trace to my .env file and setting log_level: trace in the proxy outpost (just in case that revealed issues with both).

Nothing obvious is to be found in the log files for the four Authentik services. (Searching each log file for "ERR", for instance, finds nothing)

That troubleshooting guide also suggests that I ensure /outpost.goauthentik.io is accessible.

I ran curl -v https://authentik.domain.com/outpost.goauthentik.io/ping

"A correct setup should contain output looking like this:"

[...]
< HTTP/2 204
[...]

...in my case, I saw < HTTP/2 404.

...and if I load https://authentik.domain.com/outpost.goauthentik.io/ping in a web browser, I get an Authentik-branded "not found" page.

I'm not sure if that not working correctly has anything to do with either the issue in the OP or this new issue I'm detailing in this comment, but I thought I ought to include it here in case it helps anyone diagnose the issues...

Any ideas, please?

Edit: in case this isn't relevant to the OP, I have made a separate issue for this comment.