Has anyone had any success setting Authentik up behind Caddy for a
reverse proxy?
reddit / selfhosted

----------------------------------------------------------------------
RoseBailey · 2023-12-08 12:36

I'm working on the initial setup of an Authentik instance. I set up
Authentik using docker-compose, and specifically used the official
docker-compose.yml when setting up. I can connect to the IP/port where
Authentik is being hosted just fine.

I've looked at the documentation and help threads for setting up
Authentik behind Caddy as a reverse proxy, but so far, all I'm getting
through the reverse proxy is a 502 error.

Here's my Caddyfile for reference, based on [https://goauthentik.io/do
cs/providers/proxy/server\_caddy:](https://goauthentik.io/docs/provide
rs/proxy/server_caddy:)

    auth.local {
        reverse_proxy /outpost.goauthentik.io/*
https://192.168.50.11:9443

        forward_auth https://192.168.50.11:9443 {
            uri /outpost.goauthentik.io/auth/caddy
            copy_headers X-Authentik-Username X-Authentik-Groups
X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt
X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-
Provider X-Authentik-Meta-App X-Authentik-Meta-Version
            trusted_proxies private_ranges
        }

        reverse_proxy https://192.168.50.11:9443
    }

I'm not sure what is wrong, but the documentation says little more
than "use this configuration"

I've tried the http port instead of the https port. I've tried
stripping this down to just the final reverse proxy. I've looked for
any other configs out there that might offer some help and nothing. No
matter what I try, Authentik gives a 502 through Caddy.

----------------------------------------------------------------------
Simplixt · 2023-12-08 12:42

Look in the caddy logs. I assume you must say caddy that it should
accept the untrusted certificate of :9443

----------------------------------------------------------------------
thekrautboy · 2023-12-08 12:49

Try turning

        }

        reverse_proxy https://192.168.50.11:9443
    }

into

        }

        reverse_proxy https://192.168.50.11:9443
                        transport http {
                                tls_insecure_skip_verify
                        }
    }

Thats what i use to proxy Caddy to my Proxmox web UI. And im no Caddy
expert but your setup with two reverse_proxy lines seems odd.

If it doesnt work, look at the Caddy and Authelia log files, possibly
enable debug output for more details.

Ask in the correct places for support:
https://github.com/goauthentik/authentik/discussions and
https://github.com/caddyserver/caddy/issues