Traefik Setup

[typhooncarr]

I see that the documentation has changed for Traefik setup and needing CORS to be turned off for the mobile app to work or it will generate an Unknown Error on login. I have found that the following setup for Traefik will work with CORS enabled.

http:
  middlewares:
    rate-limit:
      rateLimit:
        average: 100
        burst: 50

http:
  middlewares:
    https-redirectscheme:
      redirectScheme:
        scheme: https
        permanent: true

http:
  middlewares:
    secure-headers:
      headers:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
          - POST
          - PATCH
          - DELETE
        accessControlMaxAge: 100
        accessControlAllowHeaders: X-Requested-With, X-Auth-Token, Content-Type, Content-Length, Authorization, Origin, Accept
        accessControlAllowOriginList: '*'
        accessControlAllowCredentials: true
        accessControlExposeHeaders: '*, Authorization'
        addVaryHeader: true
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        sslProxyHeaders: 
          X-Forwarded-Proto: "https"
        stsSeconds: 315360000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: 'allow-from https:example.com'
        contentTypeNosniff: true
        browserXssFilter: true
        referrerPolicy: "strict-origin-when-cross-origin"
        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), xr-spatial-tracking=()"
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nofollow,noimageindex,noindex,nosnippet,notranslate"
          server: ""
        customRequestHeaders:
          X-Forwarded-Proto: "https"

http:
  middlewares:
    compress:
      compress: {}

http:
  middlewares:
    nofloc:
      headers:
        customResponseHeaders:
          Permissions-Policy: "interest-cohort=()"

If this can be confirmed then the Traefik setup documentation can be adjusted.

[advplyr]

@BeastleeUK

[typhooncarr]

If the commit for Basic SSO support (openid connect) is completed, this would provide better security than just straight opening the abs server directly to the internet. The services that I have exposed to the internet all funnel thru authelia first before access is granted. But that is outside the scope of Traefik and NGINX, SWAG, and APACHE would suffer the same security concerns.

[typhooncarr]

The other thing is that by removing the following values from the Traefik configuration

• accessControlAllowMethods
• accessControlAllowOriginList
• accessControlMaxAge

you would technically allow everything. Adding these items limits Traefik to what is specified, finer grain control over what is allowed.

[typhooncarr]

@BeastleeUK Have you had a chance to review the changes proposed above?

[BeastleeUK]

@BeastleeUK Have you had a chance to review the changes proposed above?

Sorry, I didn't realise you were waiting on me. I've not been able to do any personal stuff recently due to .

I too use Authelia, however I didn't think the app would work if Authelia was inline so mine is public for now. Also my Mum would have no idea how to work the Authelia log in :)

Your suggestions make perfect sense to me. Certainly having entries in place allows us control rather than omitting them.

[typhooncarr]

If you're in agreement, then I would suggest those changes be made to the Traefik setup in the Readme.md as apposed to what is in there, which has CORS wide open.

[gbakeman]

I don't mean to hijack this, but I'd like to add that I'm trying to setup on Traefik v2 as well and having a difficult time getting the service accessible at all.

My Traefik structure is based on subdirectories, i.e host.domain.com/service/. Issue #385 is tracking a feature to allow specifying subdirectories, but in the meantime, Traefik has the ability to strip a prefix from a request and forward it as if the service was at the root of the path. Adding the above setting to my Labels now lets me get to the index of the service, but all content (mainly scripts) fail to load with a 404 error.

My question basically is, does this CORS issue have anything to do with my problem? It doesn't seem to match OP's issue, but seems close to me?

[typhooncarr]

If you have Traefik setup with the items mentioned in the ReadMe which essentially turns off CORS, or you have the settings for the middleware secure-headers in the above writeup in your setup then it shouldn't have anything to do with your setup. My guess is that the stripping of the prefix is not exactly working as intended with the API calls

[ashanrath]

@gbakeman Did you ever get that working via prefix stripping? At the moment I'm just using a the FQDN:port address for the same reasons.

[gbakeman]

@gbakeman Did you ever get that working via prefix stripping? At the moment I'm just using a the FQDN:port address for the same reasons.

@ashanrath I'm afraid I can't recall, I'm sorry. It may have been audiobookshelf when I decided it wasn't worth getting PathPrefixes configured for every single unique service. I've been using subdomains for service routing ever since, and it's been a breeze. I highly recommend switching your services over to subdomain routing.