the middleware is being ignored

[Rihan9]

hi,
I'm using pangolin almost as default and I set up one of my resource with authelia middleware, but it is being ignored. Do I need to edit in some way traefik_config.yml or dynamic_config.yml?

My docker-compose.yml:

name: pangolin
services:
  beszel-agent:
    image: "henrygd/beszel-agent"
    container_name: "beszel-agent"
    restart: unless-stopped
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # monitor other disks / partitions by mounting a folder in /extra-filesystems
      # - /mnt/disk/.beszel:/extra-filesystems/sda1:ro
    environment:
      LISTEN: 45876
      KEY: "{{OMITTED}}"
  middleware-manager:
    image: hhftechnology/middleware-manager:latest
    container_name: middleware-manager
    restart: unless-stopped
    depends_on:
      - gerbil
    volumes:
      - ./data:/data
      - ./config/traefik/rules:/conf
      - ./config/middleware-manager/templates.yaml:/app/config/templates.yaml  # Optional for custom templates
    environment:
      - PANGOLIN_API_URL=http://pangolin:3001/api/v1
      - TRAEFIK_CONF_DIR=/conf
      - DB_PATH=/data/middleware.db
      - PORT=3456
#    ports:
#      - "3456:3456"
  pangolin:
    image: fosrl/pangolin:1.2.0
    container_name: pangolin
    restart: unless-stopped
    volumes:
      - ./config:/app/config
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: "3s"
      timeout: "3s"
      retries: 5

  gerbil:
    image: fosrl/gerbil:1.0.0
    container_name: gerbil
    restart: unless-stopped
    depends_on:
      pangolin:
        condition: service_healthy
    command:
      - --reachableAt=http://gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - 51820:51820/udp
      - 443:443 # Port for traefik because of the network_mode
      - 80:80 # Port for traefik because of the network_mode

  traefik:
    image: traefik:v3.3.3
    container_name: traefik
    restart: unless-stopped

    network_mode: service:gerbil # Ports appear on the gerbil service

    depends_on:
      pangolin:
        condition: service_healthy
    environment:
      - IONOS_API_KEY={{OMITTED}}
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
      - ./config/ionos:/ionos # Volume to store the Let's Encrypt certificates
      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs

networks:
  default:
    driver: bridge
    name: pangolin

my traefik_config.yml:

api:
  insecure: true
  dashboard: true

providers:
  http:
    endpoint: "http://pangolin:3001/api/v1/traefik-config"
    pollInterval: "5s"
  file:
    filename: "/etc/traefik/dynamic_config.yml"

experimental:
  plugins:
    badger:
      moduleName: "github.com/fosrl/badger"
      version: "v1.1.0"

log:
  level: "INFO"
  format: "common"

certificatesResolvers:
  ionos:
    acme:
      email: {{OMITTED}}
      storage: "/ionos/acme.new.json"
      dnsChallenge:
        provider: ionos
        resolvers:
         - "ns1064.ui-dns.org"
         - "ns1032.ui-dns.com"
         - "ns1109.ui-dns.biz"
         - "ns1119.ui-dns.de"
#  letsencrypt:
#    acme:
#      httpChallenge:
#        entryPoint: web
#      dnsChallenge:
#        provider: ionos
#        resolvers:
#         - "ns1064.ui-dns.org"
#         - "ns1032.ui-dns.com"
#         - "ns1109.ui-dns.biz"
#         - "ns1119.ui-dns.de"
#      email: "aleatza@gmail.com"
##      storage: "/ionos/acme.json"
#      storage: "/letsencrypt/acme.json"
##      caServer: "https://acme-v02.api.letsencrypt.org/directory"

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: "30m"
    http:
      tls:
        certResolver: "ionos"

serversTransport:
  insecureSkipVerify: true

my dynamic_config.yml

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https
    authelia:
      forwardAuth:
        address: "https://{{OMITTED}}/api/authz/forward-auth"
        authResponseHeaders:
          - Remote-User
          - Remote-Groups
          - Remote-Name
          - Remote-Email
        trustForwardHeader: true
  routers:
    # HTTP to HTTPS redirect router
    main-app-router-redirect:
      rule: "Host(`{{OMITTED}}`)"
      service: next-service
      entryPoints:
        - web
      middlewares:
        - redirect-to-https

    # Next.js router (handles everything except API and WebSocket paths)
    next-router:
      rule: "Host(`{{OMITTED}}`) && !PathPrefix(`/api/v1`)"
      service: next-service
      entryPoints:
        - websecure
      tls:
        certResolver: ionos
        domains:
          - main: "{{OMITTED}}"
            sans:
              - "*.{{OMITTED}}"

    # API router (handles /api/v1 paths)
    api-router:
      rule: "Host(`{{OMITTED}}}`) && PathPrefix(`/api/v1`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: ionos
        domains:
          - main: "{{OMITTED}}"
            sans:
              - "*.{{OMITTED}}"

    # WebSocket router
    ws-router:
      rule: "Host(`{{OMITTED}}`)"
      service: api-service
      entryPoints:
        - websecure
      tls:
        certResolver: ionos
        domains:
          - main: "{{OMITTED}}"
            sans:
              - "*.{{OMITTED}}"

  services:
    next-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3002"  # Next.js server

    api-service:
      loadBalancer:
        servers:
          - url: "http://pangolin:3000"  # API/WebSocket server

from authelia configuration (authelia works correctly on caddy from another configuration):

.....
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: 'deny'
  .....
  rules:
    - domain:
        - "auth.{{OMITTED}}"
      policy: bypass
    - domain:
        - "auth.{{OMITTED}}"
      policy: bypass
    - domain:
        - "*.{{OMITTED}}"
      subject:
        - ['group:local']
      policy: one_factor
    

no custom rules for the resources in the test.

Can you please help me and add, in case the configurations need anything, some more information in the readme.md file?

[hhftechnology]

this is yours

this is how it should be

[Rihan9]

Ok, now I have:

• 400 - bad request if I use the public url of my authelia server
  there is an error on authelia log:

time="2025-04-29T17:00:38Z" level=error msg="Error getting Target URL and Request Method" error="header 'X-Forwarded-Method' is empty" method=GET path=/api/authz/forward-auth remote_ip=172.18.0.1

I'll dig more about it

• 500 - internal server error if I use the internal hostname of my authelia. It is on my local machine, not in the VPS so I tried to add:

network_mode: service:gerbil

in the docker-compose.yaml, but I don't think it's working. No error is displayed in the docker logs:

[hhftechnology]

middleware-manager is running fine. its networking issue. because traefik is routed through gerbil. please check traefik logs.

[Rihan9]

Hi,
no files are present in ./config/traefik/logs

no revelant logs with the command docker logs traefik:

the previous screenshot was the output of "docker compose up", so all the container logs where written in the output

[oidebrett]

Have you tried accessing the Traefik dashboard so that you can see if there are any errors in how the middlewares are being applied? Traefik dashboard is on port localhost:8080 and if you set it up as an authenticated pangolin resource you will be able to access it securely. Very helpful for checking if middlewares applied properly.

[Roving-Ronin]

@oidebrett how do you do this? I already have a second site that is 'Local' and publish the Middleware Manager to myself this way.
Trying to access Traefik, given its via Gerbil, I've got the target as Hostname = gerbil and Port = 8080 and when trying to access the page comes up with 'Bad Gateway' ?

[Rihan9]

Here:

I tried to add one of the X-Forwarded headers, but no canghe has been detected afterwards.

@oidebrett how do you do this? I already have a second site that is 'Local' and publish the Middleware Manager to myself this way. Trying to access Traefik, given its via Gerbil, I've got the target as Hostname = gerbil and Port = 8080 and when trying to access the page comes up with 'Bad Gateway' ?

For me the configuration worked at first try. Do you have the following code in your traefik_config.yml?

api:
  insecure: true
  dashboard: true

For me these are the very first rows

[Rihan9]

You know, @oidebrett, now the middleware is being loaded correctly, so I don't think this is an issue for middleware-manager anymore.

Can I just ask you to update the README.md to add a section related to how to modify the traefik configuration?
I came from another reverse proxy so that wasn't clear for me at all

[oidebrett]

You may have to add headers as a middleware. I havent tried authelia but I needed to do this for other Idps

  - id: cors-headers
    name: CORS Headers
    type: headers
    config:
      accessControlAllowMethods:
        - GET
        - POST
        - OPTIONS
      accessControlAllowOriginList:
        - "*"
      accessControlAllowHeaders:
        - Authorization
        - Content-Type
        - mcp-protocol-version
      accessControlMaxAge: 86400
      accessControlAllowCredentials: true
      addVaryHeader: true

[Rihan9]

But if I use the Ip retrieved from the traefik dashboard the authentication works fine and I don't see any CORS errors in the authelia logs (you can see my latest comment onthe issue opened in pangolin).
Maybe it's because for some endpoints authelia apply some cors rules by default