the middleware is being ignored

[Rihan9]

hi,
I'm using pangolin almost as default and I set up one of my resource with authelia middleware, but it is being ignored. Do I need to edit in some way traefik_config.yml or dynamic_config.yml?

My docker-compose.yml:

name: pangolin services: beszel-agent: image: "henrygd/beszel-agent" container_name: "beszel-agent" restart: unless-stopped network_mode: host volumes: - /var/run/docker.sock:/var/run/docker.sock:ro # monitor other disks / partitions by mounting a folder in /extra-filesystems # - /mnt/disk/.beszel:/extra-filesystems/sda1:ro environment: LISTEN: 45876 KEY: "{{OMITTED}}" middleware-manager: image: hhftechnology/middleware-manager:latest container_name: middleware-manager restart: unless-stopped depends_on: - gerbil volumes: - ./data:/data - ./config/traefik/rules:/conf - ./config/middleware-manager/templates.yaml:/app/config/templates.yaml # Optional for custom templates environment: - PANGOLIN_API_URL=http://pangolin:3001/api/v1 - TRAEFIK_CONF_DIR=/conf - DB_PATH=/data/middleware.db - PORT=3456 # ports: # - "3456:3456" pangolin: image: fosrl/pangolin:1.2.0 container_name: pangolin restart: unless-stopped volumes: - ./config:/app/config healthcheck: test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"] interval: "3s" timeout: "3s" retries: 5 gerbil: image: fosrl/gerbil:1.0.0 container_name: gerbil restart: unless-stopped depends_on: pangolin: condition: service_healthy command: - --reachableAt=http://gerbil:3003 - --generateAndSaveKeyTo=/var/config/key - --remoteConfig=http://pangolin:3001/api/v1/gerbil/get-config - --reportBandwidthTo=http://pangolin:3001/api/v1/gerbil/receive-bandwidth volumes: - ./config/:/var/config cap_add: - NET_ADMIN - SYS_MODULE ports: - 51820:51820/udp - 443:443 # Port for traefik because of the network_mode - 80:80 # Port for traefik because of the network_mode traefik: image: traefik:v3.3.3 container_name: traefik restart: unless-stopped network_mode: service:gerbil # Ports appear on the gerbil service depends_on: pangolin: condition: service_healthy environment: - IONOS_API_KEY={{OMITTED}} command: - --configFile=/etc/traefik/traefik_config.yml volumes: - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates - ./config/ionos:/ionos # Volume to store the Let's Encrypt certificates - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs networks: default: driver: bridge name: pangolin 

my traefik_config.yml:

api: insecure: true dashboard: true providers: http: endpoint: "http://pangolin:3001/api/v1/traefik-config" pollInterval: "5s" file: filename: "/etc/traefik/dynamic_config.yml" experimental: plugins: badger: moduleName: "github.com/fosrl/badger" version: "v1.1.0" log: level: "INFO" format: "common" certificatesResolvers: ionos: acme: email: {{OMITTED}} storage: "/ionos/acme.new.json" dnsChallenge: provider: ionos resolvers: - "ns1064.ui-dns.org" - "ns1032.ui-dns.com" - "ns1109.ui-dns.biz" - "ns1119.ui-dns.de" # letsencrypt: # acme: # httpChallenge: # entryPoint: web # dnsChallenge: # provider: ionos # resolvers: # - "ns1064.ui-dns.org" # - "ns1032.ui-dns.com" # - "ns1109.ui-dns.biz" # - "ns1119.ui-dns.de" # email: "aleatza@gmail.com" ## storage: "/ionos/acme.json" # storage: "/letsencrypt/acme.json" ## caServer: "https://acme-v02.api.letsencrypt.org/directory" entryPoints: web: address: ":80" websecure: address: ":443" transport: respondingTimeouts: readTimeout: "30m" http: tls: certResolver: "ionos" serversTransport: insecureSkipVerify: true 

my dynamic_config.yml

http: middlewares: redirect-to-https: redirectScheme: scheme: https authelia: forwardAuth: address: "https://{{OMITTED}}/api/authz/forward-auth" authResponseHeaders: - Remote-User - Remote-Groups - Remote-Name - Remote-Email trustForwardHeader: true routers: # HTTP to HTTPS redirect router main-app-router-redirect: rule: "Host(`{{OMITTED}}`)" service: next-service entryPoints: - web middlewares: - redirect-to-https # Next.js router (handles everything except API and WebSocket paths) next-router: rule: "Host(`{{OMITTED}}`) && !PathPrefix(`/api/v1`)" service: next-service entryPoints: - websecure tls: certResolver: ionos domains: - main: "{{OMITTED}}" sans: - "*.{{OMITTED}}" # API router (handles /api/v1 paths) api-router: rule: "Host(`{{OMITTED}}}`) && PathPrefix(`/api/v1`)" service: api-service entryPoints: - websecure tls: certResolver: ionos domains: - main: "{{OMITTED}}" sans: - "*.{{OMITTED}}" # WebSocket router ws-router: rule: "Host(`{{OMITTED}}`)" service: api-service entryPoints: - websecure tls: certResolver: ionos domains: - main: "{{OMITTED}}" sans: - "*.{{OMITTED}}" services: next-service: loadBalancer: servers: - url: "http://pangolin:3002" # Next.js server api-service: loadBalancer: servers: - url: "http://pangolin:3000" # API/WebSocket server 

from authelia configuration (authelia works correctly on caddy from another configuration):

..... access_control: ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any ## resource if there is no policy to be applied to the user. default_policy: 'deny' ..... rules: - domain: - "auth.{{OMITTED}}" policy: bypass - domain: - "auth.{{OMITTED}}" policy: bypass - domain: - "*.{{OMITTED}}" subject: - ['group:local'] policy: one_factor 

no custom rules for the resources in the test.

Can you please help me and add, in case the configurations need anything, some more information in the readme.md file?

[hhftechnology]

this is yours

this is how it should be

[Rihan9]

Ok, now I have:

• 400 - bad request if I use the public url of my authelia server
  there is an error on authelia log:

time="2025-04-29T17:00:38Z" level=error msg="Error getting Target URL and Request Method" error="header 'X-Forwarded-Method' is empty" method=GET path=/api/authz/forward-auth remote_ip=172.18.0.1 

I'll dig more about it

• 500 - internal server error if I use the internal hostname of my authelia. It is on my local machine, not in the VPS so I tried to add:

network_mode: service:gerbil 

in the docker-compose.yaml, but I don't think it's working. No error is displayed in the docker logs:

[hhftechnology]

middleware-manager is running fine. its networking issue. because traefik is routed through gerbil. please check traefik logs.

[Rihan9]

Hi,
no files are present in ./config/traefik/logs

no revelant logs with the command docker logs traefik:

the previous screenshot was the output of "docker compose up", so all the container logs where written in the output

[oidebrett]

Have you tried accessing the Traefik dashboard so that you can see if there are any errors in how the middlewares are being applied? Traefik dashboard is on port localhost:8080 and if you set it up as an authenticated pangolin resource you will be able to access it securely. Very helpful for checking if middlewares applied properly.

[Roving-Ronin]

@oidebrett how do you do this? I already have a second site that is 'Local' and publish the Middleware Manager to myself this way.
Trying to access Traefik, given its via Gerbil, I've got the target as Hostname = gerbil and Port = 8080 and when trying to access the page comes up with 'Bad Gateway' ?

[Rihan9]

Here:

I tried to add one of the X-Forwarded headers, but no canghe has been detected afterwards.

@oidebrett how do you do this? I already have a second site that is 'Local' and publish the Middleware Manager to myself this way. Trying to access Traefik, given its via Gerbil, I've got the target as Hostname = gerbil and Port = 8080 and when trying to access the page comes up with 'Bad Gateway' ?

For me the configuration worked at first try. Do you have the following code in your traefik_config.yml?

api: insecure: true dashboard: true 

For me these are the very first rows

[Rihan9]

You know, @oidebrett, now the middleware is being loaded correctly, so I don't think this is an issue for middleware-manager anymore.

Can I just ask you to update the README.md to add a section related to how to modify the traefik configuration?
I came from another reverse proxy so that wasn't clear for me at all

[oidebrett]

You may have to add headers as a middleware. I havent tried authelia but I needed to do this for other Idps

 - id: cors-headers name: CORS Headers type: headers config: accessControlAllowMethods: - GET - POST - OPTIONS accessControlAllowOriginList: - "*" accessControlAllowHeaders: - Authorization - Content-Type - mcp-protocol-version accessControlMaxAge: 86400 accessControlAllowCredentials: true addVaryHeader: true 

[Rihan9]

But if I use the Ip retrieved from the traefik dashboard the authentication works fine and I don't see any CORS errors in the authelia logs (you can see my latest comment onthe issue opened in pangolin).
Maybe it's because for some endpoints authelia apply some cors rules by default