I have been adding more and more services to my home lab. and with my most recent addition I decided that I should have some kind of SSO that can protect them all and make it to have less passwords to store in my password manager. I didn't do a ton of searching as I had read a lot of information over on r/selfhosted subreddit about one called Authentik. With this in mind, I decided that any private public facing services will be behind it first, this will help protect them more than their default password security.

I use Nginx Proxy Manager behind a cloudflare tunnel, turns out this combination made things a little more difficult than I originally thought it would be. However now that I have it figured out, replicating it to other services is quite easy. The start of this was after I found Lube Logger, I wanted to set this up so I could use Lube Logger outside of my house. This meant that I needed Authentik to work behind my proxy manager. It took me a while to figure out that DNS was the cause of my problems. I had found this post on Geek's Circuit that I found and it worked when testing using local IP addresses, however I need it to work outside of the local network.

The part from the post that made it work locally was the nginx config addition I have below.

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;

    # authentik-specific config
    auth_request        /outpost.goauthentik.io/auth/nginx;
    error_page          401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    proxy_pass          http://auth.example.com/outpost.goauthentik.io;
    # ensure the host of this vserver matches your external URL you've configured
    # in authentik
    proxy_set_header    Host $host;
    proxy_set_header    X-Original-URL $scheme://$http_host$request_uri;
    add_header          Set-Cookie $auth_cookie;
    auth_request_set    $auth_cookie $upstream_http_set_cookie;

    # required for POST requests to work
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

I put that code block in my Nginx proxy manager under the advanced section and modified the auth.example.com to use my home network domain.

I gave it 30 minutes for all of the DNS to flow from my cloudflare tunnel, but it was still failing. By this point it was 2 am and I decided to call it for the night, disabling the NPM on the domains before heading to bed. I didn't get back to it for another two days, when I did I enabled the domains again but still had no luck. I tried to see if any changes to the auth domain proxy was the issue, however nothing I tried worked. In the process of trying all of this I found out that I had set my DNS config in cloudflare was wrong. I had just manually added the entries in DNS and not added them to the tunnel. I reset all of my proxy files, then correctly set DNS by adding the domains to my cloudflare tunnel. After doing this and using the config above on my site, it worked without any issue after DNS flushed. With it now working I started to add other services behind it, I have an instance of Stable Diffusion that I can now use outside the network along with a sharing it with a friend to use as well. This was a successful implementation, and I now have an OAuth I can use with Portainer and TrueNAS.

Adding SSO to Public facing sites