Nginx / Authelia / Cloudflared Issues
Posted by kiltmann
Hi there, Having trouble getting Nginx, Authelia, and Cloudflared to work together using my personal domain. I have Cloudflared running in a separate container and connected via sbproxy. I've been working with TomAI to fix things but had to turn to Claude. One thing it said was to add the following to all of the services in Nginx in the Custom Tab: Authelia forward auth location /authelia { internal; proxypass http://sb-authelia:9091/api/authz/forward-auth; proxypassrequestbody off; proxysetheader Content-Length ""; proxysetheader X-Original-URL $scheme://$httphost$requesturi; proxysetheader X-Forwarded-For $proxyaddxforwardedfor; proxysetheader X-Forwarded-Proto $scheme; proxysetheader X-Forwarded-Host $httphost; proxysetheader X-Forwarded-URI $requesturi; } authrequest /authelia; authrequestset $targeturl $scheme://$httphost$requesturi; authrequestset $user $upstreamhttpremoteuser; authrequestset $groups $upstreamhttpremotegroups; errorpage 401 =302 https://auth.celestialhub.net/?rd=$targeturl; proxysetheader Remote-User $user; proxysetheader Remote-Groups $groups; It also suggested to add the following to the Authelia Config, but TomAI said it would not persist. accesscontrol: defaultpolicy: deny rules: - domain: "auth.xxxxxx.xxx" ← ADD THIS — must be first (REDACTED) policy: bypass - domain: "vault.celestialhub.net" policy: bypass - domain: "nextcloud.celestialhub.net" policy: bypass - domain: "portainer.celestialhub.net" policy: twofactor - domain: "pihole.celestialhub.net" policy: twofactor - domain: ".celestialhub.net" policy: onefactor Thoughts? Thanks, Klint
1 replies
tomspark wrote:
TomAI is right — that file gets rebuilt from a template every time SparkBox starts, so manual edits don't stick. If celestialhub.net is your SBDOMAIN, the accesscontrol rules are actually already being generated for you (vault/nextcloud bypass, portainer/pihole two-factor, everything else one-factor) so you probably don't need to add them manually. The Nginx Custom Tab snippet looks correct for forward-auth. One thing to watch: don't add that forward-auth block to the auth.celestialhub.net proxy host itself — it creates a redirect loop. Add it to the services you want to protect, and leave the Authelia proxy host alone. Let me know if a particular service is still bouncing you back to login unexpectedly and I'll dig into it.