Authentik proxy in front of Traefik on separate server.

[CommittotheIndian]

I have Authentik installed on server 1. I have a Traefik instance on server 1 and server 2. I want to put Authentik in front of both Traefik-dashboards, via proxy provider.

The Server 1 Traefik instance is protected and works fine. Server 2 however gives a Not Found page with partial Authentik pieces.

Configs for both are the same except for the forwardAuth address.

Server 1 (which works): address: http://authentik_server:9000/outpost.goauthentik.io/auth/traefik
Server 2 (results in the pic above): address: https://auth.server1.url.com/outpost.goauthentik.io/auth/traefik

Does anyone have any ideas of what I should change? I have changed the Server 2 address multiple different ways (server 1 IP, http/https, port after the URL) but nothing seems to work, the other changes just result in black 404 not found pages.

[acleitao-projects]

did you ever find a solution for this?

[dierochade]

Did you try to setup a dedicated outpost on server 2 for this?

[GKG-ctrl]

I have a similar issue.

[carsten-re]

Hi, I had the same challenge but I think I can provide the solution for it (it's working for me).
I have also 1 VM which is runnting Authentik Server / Worker behind a Traefik Reverse Proxy.
I have a 2nd VM where I like to include some applications for additional auhentication.

I had to create the Authentik Proxy container on the 2nd VM:

services:
  redis:
    image: docker.io/library/redis:alpine
    container_name: authentik-redis
    command: --save 60 1 --loglevel warning --maxmemory 500mb --maxmemory-policy allkeys-lru
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    networks:
      - database
    volumes:
      - authentik-redis:/data
    labels:
      traefik.enable: false

  authentik-proxy:
    image: ghcr.io/goauthentik/proxy:${AUTHENTIK_VERSION}
    container_name: authentik-proxy
    networks:
      - proxy
      - database
    environment:
      AUTHENTIK_REDIS__HOST: $AUTHENTIK_REDIS__HOST
      AUTHENTIK_HOST: $AUTHENTIK_HOST
      AUTHENTIK_TOKEN: $AUTHENTIK_TOKEN
      AUTHENTIK_INSECURE: false
      AUTHENTIK_DEBUG: true
      TZ: Europe/Berlin
    depends_on:
      - redis
    labels:
      traefik.enable: true
      traefik.http.routers.app-auth.rule: Host(`yourApp.domain.tld`) && PathPrefix(`/outpost.goauthentik.io/`)
      traefik.http.routers.app-auth.priority: 1
      traefik.http.routers.app-auth.middlewares: authentik-proxy@docker
      traefik.http.middlewares.authentik-proxy.forwardauth.address: http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
      traefik.http.middlewares.authentik-proxy.forwardauth.trustForwardHeader: true
      traefik.http.middlewares.authentik-proxy.forwardauth.authResponseHeaders: X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version
      traefik.docker.network: proxy
    restart: unless-stopped

volumes:
  authentik-redis:
    driver: local

networks:
  proxy:
    external: true
  database:
    external: true

Environment:

AUTHENTIK_REDIS__HOST=authentik-redis
AUTHENTIK_HOST=https://authentikFQDN-1stVM
AUTHENTIK_TOKEN=<generate an API user account and copy the Token>
AUTHENTIK_VERSION=2024.10.4

Define your application for Proxy purposes, add it to the pre-defined Outpost:

Go now to your app which you'd like to protect on the 2nd VM.
Here is my example for simple Whoami service:

services:
  whoami:
    image: traefik/whoami
    container_name: whoami
    networks:
      - proxy
    labels:
      traefik.enable: true
      traefik.http.routers.whoami.rule: Host(`yourApp.domain.tld`)
      traefik.http.routers.whoami.tls: true
      traefik.http.routers.whoami.middlewares: authentik-proxy@docker

    restart: unless-stopped

networks:
  proxy:
    external: true

All should be fine now.
Once you open the App (like whoami) you'll be redirected to Authentik.
In Whoami, you will see some X-Authentik headers....

[GKG-ctrl]

Thank you very much for the guide. I will try it out, for now I managed to get the forward auth, single application working. But I really wanted the domain level forward auth.

[skamotive]

@carsten-re Hello, thanks for the suggested option.
Please tell, which network is used in dockers between two VMs? Overlay network via docker swarm?

[skamotive]

I tested it, and it works well! Great solution without swarm/k8s

[carsten-re]

@carsten-re Hello, thanks for the suggested option.

Please tell, which network is used in dockers between two VMs? Overlay network via docker swarm?

Sorry for this late response @skamotive - each VM is using it's own docker setup. The authentik "Main" VM is running in Public Cloud VM and the Authentik Proxy in a VM in my local Home lab.