Nginx Proxy Manager - Proxy Host Custom Locations

[pr0nstache]

Hello, I'm tyring to get "Custom Locations" working in NPM and I can't find much info for setting them up with Authentik. Most help seems to be aimed at subdomain.domain.tld instead of domain.tld/service when using Authentik.

I've made my setup using a sub-domain scheme and it works fine, but I'd like to duplicate the scheme I use in my local setup: http://host/service.

When I setup a cutom location scheme, I get an "offline" notice from NPM if I put the NGINX Proxy Manager snippet for Authentik in Edit Proxy Host>custom location>gear>custom nginx configuration, which I'm assuming is not a correct usage for the snippet.

I tried configuring it several other ways to get "/service" custom locations working, but reading the other discussion here is says it's better to put Authentik behind a reverse proxy, than to use it directly as the reverse proxy.

What I'm wondering is if there is a place I can read to figure out what the changes needed to NGINX Proxy Manager snippet to make it work for custom locations scheme.

[KejjRod]

Did you solve this? I have the exact same problem.

[pr0nstache]

No, I've just stayed with the subdomain.domain.tld scheme with a wildcard certificate, and cloudflare tunnels from anything that doesn't recognize sso.

[KejjRod]

Okey, thanks for the reply!

[ALFREDYTX]

I just encountered the same problem, were you able to solve it, or what did you do?

[KejjRod]

I encountered an issue where I needed to protect certain specific subdirectories with Authentik, but not the root directory of the subdomain. Additionally, I wanted to set another subdirectory as the root of the subdomain. My solution involved adding a 301 redirect from the root directory to the specific subdirectory. This was done in the "advanced" section of NPM. Then, I added the subdirectories that didn't require Authentik's protection under "Unauthenticated paths" in the Proxy Provider settings in Authentik.

If you have any more questions or need further assistance, please feel free to ask. I apologize if my explanation is a bit difficult to understand as English is not my native language.

[ALFREDYTX]

English
Don't worry, my native language isn't English, it's Spanish. I need to protect each subdirectory, and each of those subdirectories would have different accounts, but I don't want to create subdomains for each server. I more or less understood what's needed, but I didn't grasp the part about redirection.

Español
Tranquilo, mi idioma nativo no es el inglés, sino el español. Necesito proteger cada subdirectorio, y cada uno de esos subdirectorios tendría cuentas diferentes, pero no quiero crear subdominios para cada servidor. Más o menos entendí lo que se necesita, pero no comprendo la parte del redireccionamiento.

[jcv8-dev]

Got the same error, found this in /var/log/nginx/error.log: 2024/02/12 13:53:22 [emerg] 430#430: "map" directive is not allowed here in /data/nginx/proxy_host/6.conf:59
So it seems to be a syntax error of the generated config file nginx proxy manager creates?

[blade10101]

npm cant rewrite url's as far as I ever seen

[blade10101]

Use can't use container names, it has to be a resolveable domain or ip. I've had the same issue...

[hezsel]

it can use the service name of a container if it is in the network created in the nginx proxy manager container (in the example is the npm_default, but you can check the name created with docker network list)

example with docker compose:

networks:
  npm_default:
    external: true
    
services:
   sonarr:
      networks:
        - npm_default

[tobymills]

I had this issue with Nginx & Authetix because authentik template for Nginx is trying to map a header in the wrong place.
I did the following to fix this for those that also get this issue.

Create http_top.conf in data/nginx/custom (create custom folder in data/nginx/ if it doesn't exist). Note this was location in my docker, so location may vary.

Add following code to the file:

map $http_upgrade $connection_upgrade {
		default upgrade;
		  ''      close;
}

restart nginx

remove the lines from top of the suggested authentik Nginx template that have this code

# Upgrade WebSocket if requested, otherwise use keepalive
map $http_upgrade $connection_upgrade_keepalive {
    default upgrade;
    ''      '';
}

Update the line in the authentik Nginx template that reads:
proxy_set_header Connection $connection_upgrade_keepalive;

To
proxy_set_header Connection $connection_upgrade;
remember to set proxy_pass to local IP address of Authentix server, not Nginx DNS as this caused me issues....

[teacup-wolf]

Thank you. Your solution worked for me.
I also tested 'proxy_pass' using both local IP and local (pi hole) DNS and it worked.
Example: proxy_pass http://myauthentik.server.local:8080/outpost.goauthentik.io;

[repolife]

Are you able to share the config that worked for you?

[tobymills]

Here you go:

`
proxy_buffers 8 16k;
proxy_buffer_size 32k;

Make sure not to redirect traffic to a port 4443

port_in_redirect off;

location / {
# Put your proxy_pass to your application here
proxy_pass $forward_scheme://$server:$port;
# Set any other headers your application might need
proxy_set_header Host $host;
# proxy_set_header ...
# Support for websocket
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
# proxy_set_header Connection $connection_upgrade;

##############################
# authentik-specific config
##############################
auth_request     /outpost.goauthentik.io/auth/nginx;
error_page       401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header       Set-Cookie $auth_cookie;

# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;

}

all requests to /outpost.goauthentik.io must be accessible without authentication

location /outpost.goauthentik.io {
proxy_pass https://X.X.X.X:1443/outpost.goauthentik.io;
# ensure the host of this vserver matches your external URL you've configured
# in authentik
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}

Special location for when the /auth endpoint returns a 401,

redirect to the /start URL which initiates SSO

location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
} `

[repolife]

Thank you for sharing but it seems something is invalid with this configuration. Not sure if it's syntax or not.

The Proxy host status goes offline in NPM when added it.

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;


port_in_redirect off;

location / {
# Put your proxy_pass to your application here
proxy_pass $forward_scheme://$server:$port;
# Set any other headers your application might need
proxy_set_header Host $host;
# proxy_set_header ...
# Support for websocket
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
# proxy_set_header Connection $connection_upgrade;

##############################
# authentik-specific config
##############################
auth_request     /outpost.goauthentik.io/auth/nginx;
error_page       401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header       Set-Cookie $auth_cookie;

# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
}

location /outpost.goauthentik.io {
proxy_pass https://auth.domain.com:1443/outpost.goauthentik.io;
# ensure the host of this vserver matches your external URL you've configured
# in authentik
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}

location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
} 

[tarocjsu]

Also not work for me.

NPM v2.11.3
Authentik 2024.8.2

[SpiderUnderUrBed]

Does anyone know of a version of nginx proxy manager i can rollback to, so this works? also i am considering filing a bug about this, the documentation needs to be updated, and I tried tobymills suggestion but i imagine it works with bare metal nginx, not NPM

[tarocjsu]

Same symptom here....

No matter use new or above setup in NPM.

[tarocjsu]

Check the URL => #10010 (comment)

Work for my NPM v2.11.3 and Authentik 2024.8.2

[Anexgohan]

Solution:
#10010 (comment)