having problems getting it to work with NGINX Proxy Manager

[comet424]

so i have void auth setup running on Unraid Server..

if i type in 192.168.0.3:3009 i get a blank page.. but if i setup in nginx proxy manager to do

auth.mydoman.duckdns.org
http 192.168.0.3 3009

then i get the log in screen but not through the ip address

if i add the extra for the auth.mydomain....

location / {
  include /config/nginx/snippets/proxy.conf;
  proxy_pass $forward_scheme://$server:$port;
}

under the Gear and save.. i get a page not found

when i add

include /config/nginx/snippets/auth-location.conf;

location / {
  include /config/nginx/snippets/proxy.conf;
  # If your protected app uses websockets, un-comment the line below
  # include /config/nginx/snippets/websockets.conf;

  include /config/nginx/snippets/proxy-auth.conf;
  proxy_pass $forward_scheme://$server:$port;
}

to an app it also wont work
so my say Filebrower in unraid
if i dont add the extra advanced code
filebrowser.mydomain.duckdns.org
that works but once i add the extra code it doesnt work

so i could use some help how to set it up as i followed the docs guy but it didnt help

https://voidauth.app/#/ProxyAuth-and-Trusted-Header-SSO-Setup?id=nginx-proxy-manager

[comet424]

has anyone gotten this to work with ngix proxy manager.. so far i stuck and there is 0 videos i did what docs said for ngnix proxy manager but that doesnt work
even added like fb.example.duckdns.org/* in the proxyauth domain but nothing works

is thre a video on how to set this up working

so be nice

i use pfsense points to nginix proxy manager.. and then they point to the sites i use when i add the extra code nothing works.. so i could use help

[Stephan-P]

At least for the VoidAuth login page, I've discovered that the custom config

location / {
  include /config/nginx/snippets/proxy.conf;
  proxy_pass $forward_scheme://$server:$port;
}

should not be used.
Maybe NPM was upgraded to not need this anymore, or the docs are incorrect in this respect?

My experiences with VoidAuth quite fresh and my first OIDC App is next on my to do list.

[comet424]

@Stephan-P ah ok ya i have no and i trying to figure out this OIDC stuff
is it so that you login into to the voidauth and it automaticlly logs in to other apps like jellyfin joplin immich
or is it like 2 step auth.. if you dont log in to the voidauth u wont be able to log into the other sites... so its like a layer or protection so either website doesnt show up or you cant log in unless ur logged in to the void first..

is it one of those two options or both?

[Stephan-P]

It's my understanding that - once you've got jellyfin configured as a VoidAuth oidc app - when you visit your jellyfin website, you will be redirected to VoidAuth for authentication and then back to jellyfin again for access to your media without further auth.
But I'll keep you informed once I've made some progress there (first with Sync-in).

[comet424]

@Stephan-P sounds good.. as i not 100% sure and then there is authello but i cant get a true understanding of these cuz i wouldnt mind a 2nd authenticator like you have a dongle pluged into the computer if you dont have it plugged in you cant use the program..
i hoping this can be like you gotta log into the void before your allowed to be able to log into the jellyfin or any app so it makes things more secure..

but ya let me know how works out..

[Stephan-P]

@comet424 Did you follow the instructions re. NGINX Proxy Manager and NGINX Snippets?

• Use WinSCP to create NGINX conf snippet files: proxy.conf, websockets.conf, auth-location.conf and proxy-auth.conf
• and put these on your server so that they can be reached by NPM
• modify your NPM compose file with an extra volume bind
• modify the Proxy Host configuration for VoidAuth with the Custom config

See this thread: Where do the NGINX Snippets go?

[comet424]

@Stephan-P
so what i did was
i terminaled in unraid server
went to
/mnt/user/appdata/VoidAuth/config location
i created the nginx folder
i then nano the several files
i added

location / {
  include /config/nginx/snippets/proxy.conf;
  proxy_pass $forward_scheme://$server:$port;

to the auth.example.com for my voidauth

and for example my File browser link
i add

include /config/nginx/snippets/auth-location.conf;

location / {
  include /config/nginx/snippets/proxy.conf;
  # If your protected app uses websockets, un-comment the line below
  include /config/nginx/snippets/websockets.conf;

  include /config/nginx/snippets/proxy-auth.conf;
  proxy_pass $forward_scheme://$server:$port;

but all i get is

Congratulations!
You've successfully started the Nginx Proxy Manager.

If you're seeing this site then you're trying to access a host that isn't set up yet.

Log in to the Admin panel to get started.

but if i dont use the code it will work for me

[comet424]

and the void auth comes up with no page can be found and doing the ip address i just get a white screen

but if i dont have the extra code then void auth will display

[comet424]

i had also copied it to the folder

appdata\Nginx-Proxy-Manager-Official\data\nginx\snippets

[comet424]

@Stephan-P reading that last link you posted you fixed it with a compose file? what is this compose file i need to add you added services to?

[Stephan-P]

modify the Nginx Proxy Manager (NPM) Compose with an extra volume bind:

Not services: but just 1 extra line in volumes:

• Edit the Compose file for NPM
• Add the extra line in the section volumes:
• Down NPM and UP it again

[comet424]

@Stephan-P i looked under appdata\Nginx-Proxy-Manager-Official\ i dont have any file called compose which file did i miss to create?
i created
websockets.conf
proxy-auth.conf
proxy.conf
auth-location.conf

what is the compose file what do i need to call it and what should all be in it?

[Stephan-P]

What system are you on?
How did you install NPM?
If you installed NPM in docker, then I didn't you do so using a compose.yml?

[comet424]

@Stephan-P
im running Unraid Server i installed it through the community Apps
i mentioned it in the first line of my issue and above a few messages ago.. here is my settings

[Stephan-P]

I'm not familiar with unraid, but in that second picture there are some extra options in blue that can be opened. My guess is that there may be an option for additional volumes: where you can add that extra line.

[comet424]

yes and no the one extra was port 3000 but you can add extra settings with the last one

[comet424]

[Stephan-P]

If none of these extra config options refers to Volume, then I wouldn't know what to do next.
You'd need to ask at the Unraid user forum

[notquitenothing]

I don't know much about Unraid, but the snippets are just for convenience so you don't have to write the same stuff over and over; The idea is that you just put the snippet somewhere that the NPM container can see in a volume and then you reference it in the advanced section. If you want you can just put the snippet code directly inline where the snippet reference would be.

[comet424]

i did try adding a path if volumes means add a path? so that when you go into the container

cd /config/ngnix/snippets it will see the 4 config files that part is what above does i did so nginx sees the files

i cant tell in voidauth everytime you try to go into the container it kicks you out but this is what i did
i called it volumes but i could have called it snippets

[comet424]

this is what i have for
auth.mydomain.example.com
i get a page cant be reached

this is my file browswer i get congratulations for setting up nginx but not the actual program
fb.mydomain.example.com

this stuff gets frustrating i tell ya lol

[comet424]

maybe i did files wrong?
auth-location.conf

location /api/authz/auth-request {
  internal;

  include /config/nginx/snippets/proxy.conf;

  # extra settings, don't pass the entire body to auth_request
  proxy_set_header Content-Length "";
  proxy_set_header Connection "";
  proxy_pass_request_body off;

  # url to send auth_request
  proxy_pass http://voidauth:3000/api/authz/auth-request;
}

proxy.conf

proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $http_host;
proxy_set_header X-Forwarded-URI $request_uri;
proxy_set_header X-Forwarded-For $remote_addr;

proxy-auth.conf

auth_request /api/authz/auth-request;

auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name;
auth_request_set $email $upstream_http_remote_email;

proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
proxy_set_header Remote-Name $name;
proxy_set_header Remote-Email $email;

# If response 401 or 407 code, try to redirect to Location Header as if 302.
# NGINX auth_request cannot handle codes except 2xx and 4xx, this is a workaround
auth_request_set $redirection_url $upstream_http_location;
error_page 401 =302 $redirection_url;
error_page 407 =302 $redirection_url;

websockets.conf

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

maybe i forgot a step

[comet424]

i got the voidauth page to show had to disable the web socket toggle switch..

as for the file browser so far still congratulations
tried un toggling it and toggle it on as i have it un remarked in the advanced.. but cant get it to work yet

[comet424]

one line i did change was auth-location.conf

  # url to send auth_request
  proxy_pass http://192.168.0.3:3009/api/authz/auth-request

i changed it to my voidauth ip address and changed it to the ip address it uses

as i cant ping "voidauth" so used actual ip address

[comet424]

@Stephan-P maybe i have it working maybe reason file browser app shows congratulations is i dont have it setup inside authvoid?

do you have a screen shot of how you properly set it up the oidc? my file browser uses
http://192.168.0.3:8866
as the connection as i a visual learner so i learn from what i see not so good at words at times

for auth-domains i did

fb.mydomain.example.com/*

i used the /*
but that didnt help i still get congratulations

[Stephan-P]

About Congratulations:

By default, Nginx Proxy Manager will be showing a Congratulations page if a URL is requested for which no Proxy Host has been setup yet.
For instance, if I were to visit https://blabla.yourdomain.com and your NPM doesn't have a Proxy Host setup for blabla, then I will be shown the Congratulations page.
So, if you get a Congratulations page for File browser, then you didn't create a proper Proxy Host for it.

You're trying to learn multiple things at the same time and that is confusing things tremendously.
My suggestion would be to take a few steps back and focus on making small advances (and taking notes).

1. Forget about Authentication for now. It's overcomplicating things. So, remove these Custom configurations from your Proxy Hosts. You may leave the Snippet files in place. They won't do any harm if they're not used.
2. Try getting one Proxy Host right for one app, so that you can access that from the internet. My first proxy was npm.mydomain.tld and my second was nas-admin.mydomain.tld. Each have their own access control, so it's not like you're putting those apps wide open to the wide internet. (My first docker app was BentoPDF, a simple harmless little PDF tool. I never managed to get File Browser right with users and access rights, so I skipped that one.)
3. Join the Unraid user forum and ask for advise there. There's more people around that might be able to help you and they may be able to provide you with more detailed advise about how things are done within this OS. (It took me about 6 months of stumbling and learning before I felt somewhat confident in my openmediavault system with NPM and a handful of docker apps. At present I'm stumbling and learning about how to fit in VoidAuth for which I will definitely need some assistance from its maker as well as the one from Sync-in ;-)

See NPM Settings:

[comet424]

@Stephan-P ah ok
like all my apps work fine prior
so all my apps
like
joplin.mydomain.com
immich.mydomain.com
fb.mydomain.com
sftpgo.mydomain.com
and work as https://
work all totally fine but as soon as i add

include /config/nginx/snippets/auth-location.conf;

location / {
  include /config/nginx/snippets/proxy.conf;
  # If your protected app uses websockets, un-comment the line below
  include /config/nginx/snippets/websockets.conf;

  include /config/nginx/snippets/proxy-auth.conf;
  proxy_pass $forward_scheme://$server:$port;

once i add that then all the apps goto congratulations page

so i guessing the congrulations is fine cuz voidauth isnt setup for OICD app? since all my apps work fine its adding the authvoid that messes it up.. i tried to find a video but no ones made a video..

what is your settings for inside the voidauth the odic and the proxy domain auth

my proxyauth domain is
fb.exampl.com/* and user group is *

but nothing setup under OIDC app yet

[Stephan-P]

As you haven't been able to add the extra volume bind (as I described in the thread "Where do the Snippets go"), NPM has no way of knowing how to reach these snippets and thus all custom configurations calling them will fail.

As an alternative you could copy these snippets to the true root dir of your system, that is:
/config/nginx/snippets/
With the snippets here in place, the custom configurations in NPM will function.

[comet424]

@Stephan-P if Volumes and Paths same thing so if its called mapping a location ? then you seen in the screen shot serveral posts up i mapped /config/nginx/snippets for both you can see the files in npm but you cant do that with voidauth as you cant get in the console.. but you see npm sees the files.. so npm can see the files to read it i dunno if its reading it or if its cuz i havent setup any OICD things here is screen shot again

[Stephan-P]

I leave studying the inner details of unRAID to you.
But since you mentioned 'mapping', I did give the docs a quick glance and found this: https://docs.unraid.net/unraid-os/using-unraid-to/run-docker-containers/managing-and-customizing-containers/

[comet424]

@Stephan-P ah ok so ya volumes and mapping a path is the same thing.. you say volumes but in the unraid its just mapping a path

so that part is right as you can see nginx proxy manager sees the 4 files fine

i thought at first when you said volumes like was a drive pool or something something special but just a plain drive mapping use that appdata/nginx-proxy-manager/config/ngix/snippets folder and make it look like /config/ngix/snippets

so what was the next step you did to get it to work? as i still only get congratulations

[comet424]

and of course the support page in unraid just points to https://voidauth.app/#/Getting-Started?id=initial-setup
lol always something

[Stephan-P]

If the snippets can be found by NPM (through a volume bind in the Compose file, or a folder mapping in Unraid, or because the snippets actually exist at /config/...) then https://auth.yourdomain will open up the VoidAuth login page. Direct access via the ip-address:port is only possible by changing the the VoidAuth setup. It's either https://auth.domain or https://server-ip:port. I've never used the latter.

OIDC-complient apps do not require the snippets based custom config in NPM, BUT do require the ISSUER-URL, CLIENT-URL and CLIENT-SECRET from VoidAuth as specified in their SETUP. How this is done may be different per app; environment variables or environment file,..)
These three parameters are coming from the OIDC App setup within VoidAuth. This VoidAuth OIDC App setup requires you to tell the CALLBACK-URL as specified by the OIDC compliment app.

The apps that are not OIDC compatible will require the snippets. For this the VoidAuth Proxy Host definition in NPM needs to be enhanced with the small custom config. This won't hurt your regular access to https://auth...
These other apps do need the snippets based custom config in NPM and they need to be setup differently within VoidAuth.

I believe that File browser Quantum is OIDC complient, not? So no snippets based custom config there, but the exchange of config data ISSUER-URL, SERVICE-ID, SERVICE-SECRET, CALLBACK-URL. Make sure that both parties get these straight.
Make sure to log off from VoidAuth before you try to logon with File browser, otherwise VoidAuth will consider you logged on as its admin user, which may not be a known user for File browser.

Proceed with small steps

[comet424]

ah i havent figured out what you enter in the ocid app like how to fill out the fileds
the apps i wanna do is
Immich
Joplin Server
Linkwardern
Vaultwarden
sftpgo
file browser

so i dunno if file browser your talking about is the same as what i use
this is the one i use
https://filebrowser.org/
https://github.com/filebrowser/filebrowser

[Stephan-P]

Let's focus on Filebrowser.
Filebrowser.org is a project in maintenance mode.
Better switch over to its ascendant: Filebrowser Quantum, which supports OIDC.
Study this: https://filebrowserquantum.com/en/docs/getting-started/docker/
This: https://filebrowserquantum.com/en/docs/configuration/authentication/oidc/
And this: https://forums.unraid.net/topic/196447-filebrowser-quantum-plugin/
And study this: https://voidauth.app/#/OIDC-Setup

You will need to:

• Create an OIDC App configuration for FileBrowser in VoidAuth
  • This will generate a 'clientId' and a 'clientSecret' (necessary within the Filebrowser configuration)
  • Specify the Redirect-URL with 'https://filebrowser.your-domain.tld/api/auth/oidc/callback'
  • From the OIDC Information, you need to obtain the value for 'issueURL' (necessary in FB as well)
• Create a User in VoidAuth with username: bob and email address: bob@your-domain.tld
• Install Filebrowser
• Create a straight forward Proxy Host for FileBrowser in NPM, e.g. https://filebrowser.your-domain.tld
• Open Filebrowser and setup at least one user account with the same username bob and email address bob@your-domain.tld
• Adapt the installation of Filebrowser as shown on above Filebrowser OIDC documentation
  • The variable 'clientId' needs to be filled with a value coming from the OIDC App configuration you made in VoidAuth
  • The variable 'clientSecret' needs to be filled with a value coming from the OIDC App config you made in VoidAuth
  • The variable 'issuerUrl' needs to be filled with a value coming from the VoidAuth OIDC Information
  • The variables 'scopes' and 'userIdentifier' will be yours to find out. I have no experience with these.
• Log off from VoidAuth
• Access https://filebrowser.your-domain.tld and select the OIDC login option
• This will forward you to the VoidAuth login, enter the credentials for Bob
• And you will be sent to Filebrowser with account Bob

There's only so much that I can do to help form a distance. Experiment, try things out, stumble and fall, stand up again, learn, try again, etc.

[Stephan-P]

And - just discoeverd - did you see this Unraid section in the VoidAuth administration guide?

[comet424]

@Stephan-P havent played with it yet i seen i can install the filebrowswer quantum in unraid they have an app in the app store

as for that unraid section ya just looked at it i guess thats to just access the web login for unraid but not the apps itself right seems just for the unraid server itself.. but still learning this stuff.. its sure not plug and play lol