Initial setup behind reverse proxy?

[vromero]

Hi all,

I'm trying to install Authentik with docker compose behind Traefik from the get go.

Everything went smooth until I try to do the initial setup, for which I get this when visiting auth.mydomain.org/if/flow/initial-setup/:

In the logs I'm getting the following:

server              | {"auth_via": "unauthenticated", "event": "/if/flow/initial-setup/", "host": "XXXredactedXXXXXXX", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 30, "remote": "XXXredactedXXXXXXX", "request_id": "e2a9c982bd27438cbde3e24efcc4cd78", "runtime": 71, "scheme": "https", "status": 200, "timestamp": "2023-11-18T09:24:24.035327", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"}
server              | {"event": "/ws/client/", "level": "info", "logger": "authentik.asgi", "pid": 31, "remote": "XXXredactedXXXXXXX", "scheme": "ws", "timestamp": "2023-11-18T09:24:24.146283", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"}
server              | {"auth_via": "unauthenticated", "event": "f(exec): Flow not applicable to current user", "exc": "FlowNonApplicableException()", "flow_slug": "initial-setup", "host": "XXXredactedXXXXXXX", "level": "warning", "logger": "authentik.flows.views.executor", "pid": 30, "request_id": "4665786ef6db4fd4afb0c85d051f1819", "timestamp": "2023-11-18T09:24:24.206058"}
server              | {"auth_via": "unauthenticated", "event": "/api/v3/flows/executor/initial-setup/?query=", "host": "XXXredactedXXXXXXX", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 30, "remote": "XXXredactedXXXXXXX", "request_id": "4665786ef6db4fd4afb0c85d051f1819", "runtime": 76, "scheme": "https", "status": 200, "timestamp": "2023-11-18T09:24:24.214877", "user": "", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0"}

The only thing I have done differently from the docker compose install instructions is that I leverage traefik.

...

services:

   ...


  authentik-postgresql:
    image: docker.io/library/postgres:12-alpine
    container_name: postgresql
    networks:
      - traefik_viclab
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 5s
    volumes:
      - authentik-database:/var/lib/postgresql/data
    environment:
      POSTGRES_PASSWORD: ${PG_PASS:?database password required}
      POSTGRES_USER: ${PG_USER:-authentik}
      POSTGRES_DB: ${PG_DB:-authentik}
    env_file:
      - .env

  authentik-redis:
    image: docker.io/library/redis:alpine
    container_name: redis
    command: --save 60 1 --loglevel warning
    networks:
      - traefik_viclab
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
      start_period: 20s
      interval: 30s
      retries: 5
      timeout: 3s
    volumes:
      - authentik-redis:/data

  authentik-server:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.3}
    container_name: server
    restart: unless-stopped
    command: server
    networks:
      - traefik_viclab
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authentik.entrypoints=public-web-secure"
      - "traefik.http.routers.authentik.tls.certresolver=lets-encrypt"
      - "traefik.http.routers.authentik.rule=Host(`auth.$DOMAIN`)"
      - "traefik.http.services.authentik.loadbalancer.server.port=9000"
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    volumes:
      - authentik-media:/media
      - authentik-custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - authentik-postgresql
      - authentik-redis

  authentik-worker:
    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2023.10.3}
    container_name: worker
    restart: unless-stopped
    command: worker
    networks:
      - traefik_viclab
    environment:
      AUTHENTIK_REDIS__HOST: redis
      AUTHENTIK_POSTGRESQL__HOST: postgresql
      AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
      AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
      AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
    # `user: root` and the docker socket volume are optional.
    # See more for the docker socket integration here:
    # https://goauthentik.io/docs/outposts/integrations/docker
    # Removing `user: root` also prevents the worker from fixing the permissions
    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
    # (1000:1000 by default)
    #user: root
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - authentik-media:/media
      - authentik-certs:/certs
      - authentik-custom-templates:/templates
    env_file:
      - .env
    depends_on:
      - authentik-postgresql
      - authentik-redis

networks:

  traefik_viclab:
    external: true

volumes:

  authentik-certs:
    driver: local
    driver_opts:
       o: bind
       type: none
       device: ${VICLAB_HOME}/config/authentik/certs

  authentik-custom-templates:
    driver: local
    driver_opts:
       o: bind
       type: none
       device: ${VICLAB_HOME}/config/authentik/custom-templates

  authentik-media:
    driver: local
    driver_opts:
       o: bind
       type: none
       device: ${VICLAB_HOME}/config/authentik/media

  authentik-database:
    driver: local

  authentik-redis:
    driver: local

Do you have any hint around where to look at?

[vromero]

Nevermind. Deleting every single thing and restarting from scratch did the trick.