does anybody have reverse nginx with auth inside radicale working out there? Please share a working config

[hanscees]

Hi,

it seems the nginx reverse proxy in the docs does not work. I have only seen examples of people that use authentication via nginx, but no working examples where nginx sites in front of radicale and where radicale handles authentication.

see

https://github.com/Kozea/Radicale/issues/1255
https://github.com/tomsquest/docker-radicale/issues/138
if there is anybody out there that has this config working? Please do share how.
Its a great little server solution, but I'd like to let nginx protect it .

[pbiering]

relates to #1255

[pbiering]

see #1255 (comment) - cannot replicate

[hanscees]

Thank you for the trouble of trying to replicate.
I have found the cause in my setup: I was blocking the post method. So I too now can confirm a working config with an nginx reverse proxy.
My conclusion above was wrong!

For future people trying such a setup my config is below.
At the nginx side the config is like this

#agenda server cal.hanscees.con
server {
#    listen 80;
    listen 443 ssl http2;
    server_name cal.hanscees.con;
    ssl_certificate /etc/letsencrypt/live/cal.hanscees.con/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/cal.hanscees.con/privkey.pem;
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }



    location / {
    #add_header Permissions-Policy interest-cohort=();
    #add_header X-XSS-Protection "1; mode=block";
    #add_header Referrer-Policy "no-referrer";
    #add_header X-Frame-Options "SAMEORIGIN";
    #add_header X-Content-Type-Options nosniff;
    #add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
      proxy_pass http://192.168.0.24:5232;
#      proxy_set_header  X-Script-Name /cal;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;
    proxy_pass_header Authorization;
    }

so in this case nginx is not at the same host as the radicale server.
I am using the docker solution of radicale like so

version: '3.7'                                                                                                                                    
                                                                                                                                                  
services:                                                                                                                                         
  radicale:                                                                                                                                       
    image: tomsquest/docker-radicale                                                                                                              
    container_name: radicale                                                                                                                      
    ports:                                                                                                                                        
      - 0.0.0.0:5232:5232                                                                                                                         
    init: true                                                                                                                                    
    read_only: true                                                                                                                               
    security_opt:                                                                                                                                 
      - no-new-privileges:true                                                                                                                    
    cap_drop:                                                                                                                                     
      - ALL                                                                                                                                       
    cap_add:                                                                                                                                      
      - SETUID                                                                                                                                    
      - SETGID                                                                                                                                    
      - CHOWN                                                                                                                                     
      - KILL                                                                                                                                      
    deploy:                                                                                                                                       
      resources:                                                                                                                                  
        limits:                                                                                                                                   
          memory: 256M                                                                                                                            
          pids: 50                                                                                                                                
    healthcheck:                                                                                                                                  
      test: curl -f http://127.0.0.1:5232 || exit 1                                                                                               
      interval: 3000s                                                                                                                             
      retries: 3                                                                                                                                  
    restart: unless-stopped                                                                                                                       
    volumes:                                                                                                                                      
      - ./data:/data                                                                                                                              
      - ./config:/config                                                                                                                          
                     

For the config and encryption of password files I used this guide:
https://github.com/JPDVM2014/radicale/blob/main/README.md

The config of my remote radicale server which works with the nginx config above is:

## config

[server]
hosts = 0.0.0.0:5232
[encoding]
[auth]
type = htpasswd
htpasswd_filename = /config/users
htpasswd_encryption = bcrypt
realm = Radicale - Password Required
[rights]
type = owner_write
[storage]
filesystem_folder = /data/collections
[web]
[logging]
level = info
mask_passwords = True
[headers]