From 71d5804eaff8e5c2533729ca7dfc7104d2f8d9fb Mon Sep 17 00:00:00 2001 From: Frank Date: Tue, 3 Nov 2026 01:17:12 -0800 Subject: [PATCH] docs(caddy): put both auth walls in the guard-a-new-vhost procedure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Step 1 gains the closing sentence the abs-proxy incident demands: the ak-shell snippet that creates a ProxyProvider with objects.create() must be followed by scripts/authentik-proxy-provider-defaults.sh, or the guard fails before any credential. Step 2 gains the forwarded-scheme clause for any app that derives its own origin from the request. Each fact keeps one owner — the laws stay on [[Authentik Outpost Reference]] (provisioning rule 3) and [[Audiobookshelf]]; this page only says where in the procedure they bite. Outpost page timestamp bumped to match its substantive edit. --- .../Infrastructure/Authentik Outpost Reference.md | 2 +- serverAppConfigs-docs/Infrastructure/Caddy.md | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/serverAppConfigs-docs/Infrastructure/Authentik Outpost Reference.md b/serverAppConfigs-docs/Infrastructure/Authentik Outpost Reference.md index da56f5f..fd4d2b7 100644 --- a/serverAppConfigs-docs/Infrastructure/Authentik Outpost Reference.md +++ b/serverAppConfigs-docs/Infrastructure/Authentik Outpost Reference.md @@ -4,7 +4,7 @@ description: "Outpost, proxy-provider, OAuth2, LDAP and flow configuration for t tags: - infrastructure - authentik -timestamp: 2026-10-19 +timestamp: 2026-11-03 --- # Authentik Outpost Reference diff --git a/serverAppConfigs-docs/Infrastructure/Caddy.md b/serverAppConfigs-docs/Infrastructure/Caddy.md index 06ed99b..0780a66 100644 --- a/serverAppConfigs-docs/Infrastructure/Caddy.md +++ b/serverAppConfigs-docs/Infrastructure/Caddy.md @@ -125,10 +125,24 @@ authentik's error page instead of the app. outpost routes on the ORIGINAL `Host` header alone, so anything else matches zero providers. Never print a provider's fields wholesale — a proxy provider carries a client secret, and it lands in whatever transcript the command runs in. + + `ProxyProvider.objects.create()` is not the API: the serializer's + `set_oauth_defaults()` never runs, so the row lands with `redirect_uris` and + `grant_types` empty, and the guard fails *before* any credential — authentik's + "Redirect URI Error" page, then a bodiless HTTP 400 once the URIs are filled + by hand. Run `scripts/authentik-proxy-provider-defaults.sh` after the snippet + (idempotent, covers every provider; `--check` is the census); law and failure + signatures in [[Authentik Outpost Reference]]. 2. **Then the route.** The public site block proxies the whole request to `anubis:8923` with `header_up X-Real-Ip {remote_host}`, and the post-auth `http://:8017` listener gains a `@ host ` handler pointing at the app — copy `romm`/`files`, which are the same shape including a Dankserver LAN-port upstream. + An app that derives its own origin from the request needs the scheme pinned: + Audiobookshelf checks every OIDC callback against `x-forwarded-proto://Host`; this + listener is fed over plain http so Caddy's own `X-Forwarded-Proto` is `http`, and the + app answers a 400 "Invalid callback URL - must be same-origin" for its own https + callback. The edge for a guarded name is TLS-only, so `header_up X-Forwarded-Proto + https` is the truthful value ([[Audiobookshelf]]). 3. **Then the name and the audit.** A `dankclaw/pihole/addn-hosts` line (the `pihole` seam fails the build if a Caddyfile vhost has no record), a Porkbun A record if the name must resolve off-LAN ([[LAN-DNS]]), and the subdomain added to `GUARDED` in