Skip to content

Navigation Menu

Sign in
Sign up

Rackula does not redirect to OIDC provider when unauthorized #1386

BRShadow19 started this conversation in Report a problem
Discussion options

Hello,

I have been trying to set up OIDC authentication with Authentik on a persistent instance of Rackula. I believe I have set the proper environment variables for Rackula, but whenever I try to access the app it simply says "Unauthorized" and never tries to sign me in with Authentik.
image

Upon being unauthorized, I would expect Rackula to either show a button to log in with OIDC or automatically redirect to my configured provider to obtain an access token. Perhaps I am doing something wrong with my config? Below is my docker-compose.yml with relevant variables redacted/changed for security:

services:
 rackula:
 image: ghcr.io/rackulalives/rackula:persist
 container_name: rackula
 ports:
 - "${RACKULA_PORT:-8080}:${RACKULA_LISTEN_PORT:-8080}"
 environment:
 - API_HOST=rackula-api
 - API_PORT=${RACKULA_API_PORT:-3001}
 - RACKULA_LISTEN_PORT=${RACKULA_LISTEN_PORT:-8080}
 # Optional: token forwarded to API for PUT/DELETE route auth
 - API_WRITE_TOKEN=${RACKULA_API_WRITE_TOKEN:-}
 - RACKULA_AUTH_MODE=oidc
 - RACKULA_BASE_URL=https://rackula.company.com
 restart: unless-stopped
 stop_grace_period: 10s
 depends_on:
 rackula-api:
 condition: service_healthy
 deploy:
 resources:
 limits:
 cpus: "0.50"
 memory: 128M
 reservations:
 cpus: "0.10"
 memory: 16M
 # Security hardening (optional but recommended)
 security_opt:
 - no-new-privileges:true
 cap_drop:
 - ALL
 read_only: true
 tmpfs:
 - /var/cache/nginx:size=10M
 - /var/run:size=1M
 - /tmp:size=5M
 - /etc/nginx/conf.d:size=1M,uid=101,gid=101
 logging:
 driver: json-file
 options:
 max-size: "10m"
 max-file: "3"
 rackula-api:
 image: ghcr.io/rackulalives/rackula-api:latest
 container_name: rackula-api
 restart: unless-stopped
 stop_grace_period: 10s
 volumes:
 - ./data:/data
 environment:
 - DATA_DIR=/data
 - RACKULA_API_PORT=${RACKULA_API_PORT:-3001}
 - RACKULA_BASE_URL=https://rackula.company.com
 - CORS_ORIGIN=https://rackula.company.com
 # Auth mode model: none | oidc | local
 - RACKULA_AUTH_MODE=oidc
 # Required when auth mode is enabled (oidc/local)
 # API startup validation fails fast if this is missing/short (minimum 32 chars).
 - RACKULA_AUTH_SESSION_SECRET=LONG_SECRET_HERE
 # OIDC configuration
 - RACKULA_OIDC_ISSUER=https://auth.company.com/application/o/rackula/
 - RACKULA_OIDC_CLIENT_ID=CLIENT_ID_HERE
 - RACKULA_OIDC_CLIENT_SECRET=OIDC_SECRET_HERE
 - RACKULA_OIDC_REDIRECT_URI=https://rackula.company.com/auth/callback
 # Explicit insecure fallback (use only for isolated/local testing)
 - ALLOW_INSECURE_CORS=${ALLOW_INSECURE_CORS:-false}
 deploy:
 resources:
 limits:
 cpus: "0.25"
 memory: 64M
 reservations:
 cpus: "0.05"
 memory: 16M
 # Security hardening
 security_opt:
 - no-new-privileges:true
 cap_drop:
 - ALL
 read_only: true
 tmpfs:
 - /tmp:size=5M
 healthcheck:
 test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:${RACKULA_API_PORT:-3001}/health"]
 interval: 30s
 timeout: 10s
 start_period: 5s
 retries: 3
 logging:
 driver: json-file
 options:
 max-size: "5m"
 max-file: "2"
 expose:
 - "${RACKULA_API_PORT:-3001}"

I am also using Caddy as my reverse proxy with a TLS certificate rather than Nginx. Other applications that run behind Caddy do not have this issue, but perhaps there is some additional proxy configuration I need to add in order to use Caddy with Rackula?

Any advice or assistance is appreciated. I have otherwise been enjoying Rackula very much, it's a great tool!
You must be logged in to vote

Replies: 1 comment 1 reply

Comment options

Thanks for the detailed report. Two things are going on here.

First, the bare "Unauthorized" with no login prompt was a bug behind reverse proxies that has since been fixed. Please pull the latest :persist image. On a current build, an unauthenticated request in OIDC mode redirects you to your IdP.

Second, with Caddy terminating TLS in front, the API needs a couple of proxy settings to build the redirect correctly:

  • Set RACKULA_TRUST_PROXY=1 on the container. Without it, the app can't tell it's behind HTTPS and the OIDC redirect URL comes out with the wrong scheme.
  • Make sure Caddy forwards Host, X-Forwarded-Proto, X-Forwarded-For, X-Real-IP, and Cookie. Caddy sets the X-Forwarded-* headers by default; just confirm Host is preserved.
  • Keep RACKULA_OIDC_REDIRECT_URI=https://rackula.company.com/auth/callback and confirm that exact URI is registered in Authentik.

After updating and adding RACKULA_TRUST_PROXY=1, hitting the app unauthenticated should bounce you to Authentik. If it still doesn't, share your Caddyfile block and I'll take a look.

I've opened #1832 to add proper reverse-proxy documentation (Caddy and Traefik) and verify this end to end.
You must be logged in to vote
1 reply
Comment options

hey @BRShadow19 were you able to find time to take another shot at this? we have some RP docs now that should hopefully help here
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area:docs waiting-for-response For issues that were submitted externally and we are waiting on a response from the submitter area:authentication

AltStyle によって変換されたページ (->オリジナル) /