Calibre-web/Calibre on docker ignore traefik middlewares
reddit / selfhosted

----------------------------------------------------------------------
SomeBeerDrinker · 2023-10-08 13:31

I'm migrating from google oauth2 to authentik. In doing so I
discovered that calibre and calibre-web completely bypass any kind of
authentication (opening incognito takes me straight to their login
screens).

Looking at the traefik http routers, theses are also the only apps
that ignore the https redirect label and setup http routers (the https
routers don't attach any middleware which explains the authentication
problem).

I included another app on my stack that works as expected. What kind
of funny business are calibre and calibre-web up to? Something funky
with the headers?

Docker-compose.yml

      calibreweb:
        <<: *common-keys-media
        image: lscr.io/linuxserver/calibre-web:latest
        container_name: calibreweb
        profiles: ["media", "all"]
        ports:
          - "8083:8083"
        environment:
          <<: *default-tz-puid-pgid
        volumes:
          - $DOCKERDIR/appdata/calibreweb:/config
          - $DATADIR/media/library:/data/media
        networks:
          - t2_proxy
        labels:
          - "traefik.enable=true"
          ## HTTP Routers
          - "traefik.http.routers.calibreweb-rtr.tls=true"
          - "traefik.http.routers.calibreweb-rtr.entrypoints=https"
          - "traefik.http.routers.claibreweb-
rtr.rule=Host(`bookshelf.$DOMAINNAME`)"
          ## Middlewares
          - "traefik.http.routers.calibreweb-rtr.middlewares=chain-
oauth@file"
          ## HTTP Services
          - "traefik.http.routers.calibreweb-rtr.service=calibreweb-
svc"
          - "traefik.http.services.calibreweb-
svc.loadbalancer.server.port=8083"

      dokuwiki:
        <<: *common-keys-media
        container_name: dokuwiki
        profiles: ["web", "all"]
        image: lscr.io/linuxserver/dokuwiki:latest
        environment:
          <<: *default-tz-puid-pgid
        volumes:
          - $DOCKERDIR/appdata/dokuwiki:/config
        labels:
          - "traefik.enable=true"
          ## HTTP Routers
          - "traefik.http.routers.dokuwiki-rtr.entrypoints=https"
          - "traefik.http.routers.dokuwiki-
rtr.rule=Host(`wiki.$DOMAINNAME`)"
          ## Middlewares
          - "traefik.http.routers.dokuwiki-rtr.middlewares=chain-
oauth@file"
          ## HTTP Services
          - "traefik.http.routers.dokuwiki-rtr.service=dokuwiki-svc"
          - "traefik.http.services.dokuwiki-
svc.loadbalancer.server.port=80"

----------------------------------------------------------------------
TerminalFoo · 2023-10-08 15:14

Calibre is not up to any funny business. Calibre and Calibre-Web do
not have native SSO, so you have to put something that does in front
of them. Either you have a cookie set after SSO login and that allows
you to bypass SSO for Calibre. But, you said that incognito mode
doesn't take you to the SSO screen either. That means that your
"chain-oauth@file" is wrong. Check that.

----------------------------------------------------------------------
SomeBeerDrinker · 2023-10-08 16:46

Nothing to do with SSO. Just protecting the domain behind forward
authorization. ([Though calibre-web has supported SSO for quite some
time.](https://github.com/janeczku/calibre-web/pull/1107))

Out of 40 subdomains, the only two that are are ignoring the https
redirect and not attaching the middlewares are Calibre and Calibre-
Web. I'm trying to figure out why these two in particular are acting
this way.

----------------------------------------------------------------------
TerminalFoo · 2023-10-08 17:59

So, the issue is with your Traefik configuration. Replace Calibre with
any other service and keep the same configuration as you currently
have it. See if that shows the same issue.

----------------------------------------------------------------------
SomeBeerDrinker · 2023-10-08 18:15

That was the point of including the doku configuration.

With the exception of the tls label (which doesn't actually make a
diffrence), the subdomain, the service labels and the port there is no
difference. Doku (and 37 other services) hit the auth page first.

----------------------------------------------------------------------
TerminalFoo · 2023-10-08 18:33

Remove the port mapping and see if that works. I have a Calibre setup
with forward auth and it works fine for me. Only difference is that I
don't use labels and instead use a rules.yml file.

----------------------------------------------------------------------
SomeBeerDrinker · 2023-10-08 18:55

No dice. Still won't attach the middlewares. Still reachable outside
of forward auth.

The rules in the middleware chain that works with all my other
containers:

    middlewares-rate-limit:
      rateLimit:
        average: 100
        burst: 50

    middlewares-https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: true

    middlewares-secure-headers:
      headers:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
        accessControlMaxAge: 100
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        stsSeconds: 63072000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: "allow-from https:{{env
"DOMAINNAME"}}"
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "same-origin"
        permissionsPolicy: "camera=(), microphone=(), geolocation=(),
payment=(), usb=(), vr=()"
        customResponseHeaders:
          X-Robots-Tag:
"none,noarchive,nosnippet,notranslate,noimageindex,"
          server: ""


    middlewares-compress:
      compress: {}

    middlewares-oauth:
      forwardAuth:
        address: "http://oauth:4181" # Make sure you have the OAuth
service in docker-compose.yml
        trustForwardHeader: true
        authResponseHeaders:
          - "X-Forwarded-User"