2FA (one time passwd) won't register

[gemorgan]

2FA (one time passwd) won't register

[james-d-elliott]

Can you show some detail about how you've configured traefik? This issue doesn't occur with our examples but I wonder if maybe it's communicating over IPv6 and we've not accounted for this somehow.

Also can you show the output of the traefik/whoami container when running it behind your traefik install with the same middlewares, specifically we're looking for the X-Forwarded-For header.

[gemorgan]

I don't have the traefik/whoami container spun up on this unraid system. I'll see if I can figure out how to get it running in unraid. Or maybe the traefik conf files will tell you what you need to know. FYI This was all working until a system rebuild with a move from 192.168.0.0/24 subnet to 192.168.1.0/24.

traefik.yml

global:
  checkNewVersion: true
  sendAnonymousUsage: false
serversTransport:
  insecureSkipVerify: true

entryPoints:
  # Not used in apps, but redirect everything from HTTP to HTTPS
  http:
    address: :80
    # forwardedHeaders:
    #   trustedIPs: &trustedIps
    #     # Start of Clouflare public IP list for HTTP requests, remove this if you don't use it
    #     - 173.245.48.0/20

    http:
      redirections:
        entryPoint:
          to: https
          scheme: https

  # HTTPS endpoint, with domain wildcard
  https:
    address: :443
    # forwardedHeaders:
    #   # Reuse list of Cloudflare Trusted IP's above for HTTPS requests
    #   trustedIPs: *trustedIps
    http:
      tls:
        # Generate a wildcard domain certificate
        certResolver: letsencrypt
        domains:
          - main: somedomain.com
            sans:
              - '*.somedomain.com'
      middlewares:
        - securityHeaders@file

providers:
  providersThrottleDuration: 2s

  # File provider for connecting things that are outside of docker / defining middleware
  file:
    filename: /etc/traefik/fileConfig.yml
    watch: true

  # Docker provider for connecting all apps that are inside of the docker network
  docker:
    watch: true
    network: custom    # Add Your Docker Network Name Here
    # Default host rule to containername.domain.example
    defaultRule: "Host(`{{ lower (trimPrefix `/` .Name )}}.somedomain.com`)"    # Replace with your domain
    swarmModeRefreshSeconds: 15s
    exposedByDefault: false
    endpoint: "tcp://dockersocket:2375"

# Enable traefik ui
api:
  dashboard: true
  insecure: true

# Log level INFO|DEBUG|ERROR
log:
  level: INFO

# Use letsencrypt to generate ssl certificates
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /etc/traefik/acme.json
      dnsChallenge:
        provider: cloudflare
        # Used to make sure the dns challenge is propagated to the rights dns servers
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

fileConfig.yml

http:
    ## EXTERNAL ROUTING ##
  routers:
  ## SERVICES ##
  services:

  ## MIDDLEWARES ##
  middlewares:
    # Only Allow Local networks
    local-ipwhitelist:
      ipWhiteList:
        sourceRange: 
          - 127.0.0.1/32 # localhost
          - 192.168.1.1/24 # LAN Subnet
    auth:
      forwardauth:
        address: http://authelia:9091/api/verify?rd=https://authelia.somedomain.com/
        trustForwardHeader: true
        authResponseHeaders:
          - Remote-User
          - Remote-Groups
          - Remote-Name
          - Remote-Email
    # Authelia basic auth guard
    auth-basic:
      forwardauth:
        address: http://authelia:9091/api/verify?auth=basic
        trustForwardHeader: true
        authResponseHeaders:
          - Remote-User
          - Remote-Groups
          - Remote-Name
          - Remote-EmailHeaders
    # Security headers
    securityHeaders:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,none,noarchive,nosnippet,notranslate,noimageindex"
          X-Forwarded-Proto: "https"
          server: ""
        customRequestHeaders:
          X-Forwarded-Proto: "https"
          X-Forwarded-For: "${clientip}"
        sslProxyHeaders:
          X-Forwarded-Proto: "https"
        referrerPolicy: "same-origin"
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        contentTypeNosniff: true
        browserXssFilter: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsSeconds: 63072000
        stsPreload: true

[james-d-elliott]

Try commenting X-Forwarded-For: "${clientip}". I suspect this is sending an empty header which is likely the cause. The whoami container is super easy to setup btw.

[gemorgan]

Thanks James. That allowed the registration to continue and I feel bad now. For the life of me I couldn't track down any reason for it failing with the relatively light configs I have. Sorry to "bug" you with this non-bug.
Now I need to re-test my other proxied apps. I put that line there for something and naturally didn't think to document it so I have no idea why now.

[james-d-elliott]

No drama! Glad we figured it out.