nginx-proxy-manager setup on authentik & other apps #18445

Eandy11 · 2025-11-28T18:30:28Z

Eandy11
Nov 28, 2025

I am lost. Spent probably 24 hours collectively trying to figure this out & I can't. I'm trying to have NPM in front of all my apps(including authentik) & configure forward auth for each of my apps. I am stuck where authentik is giving 404 Not Found but when I perform curl on the same request forcing Host header to be my TLD for my test app, it works as expected. However, using the same routing by passing X-Original-URI & X-Forwarded-Host in the location /outpost.goauthentik.io block has no effect.

My network has multiple VMs & each VM has their own instance of nginx-proxy-manager. NPM is responsible for forwarding the port for each docker service on each VM to a common domain with Let's Encrypt certificates on my TLD. The same goes for authentik, I have a proxy host on the NPM instance for authentik that forwards http, server & 9443 to the domain I specified for authentik's IP(see screenshot)

This is not a normal reverse proxy setup where all apps are on the same docker container with authentik. Each VM is on a different IP thus none of them share the same docker network. The goal is to have SSL between each request from the app to authentik but still have authentik route to the correct outpost for authentication.

My test app is homepage so I am forwarding http, homepage & 3000 in NPM for homepage VM. Here's the advanced NPM configuration I have for this:

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# Make sure not to redirect traffic to a port 4443
port_in_redirect off;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;
    # Set any other headers your application might need
    proxy_set_header Host $host;
    # proxy_set_header ...
    # Support for websocket
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    ##############################
    # authentik-specific config
    ##############################
    auth_request     /outpost.goauthentik.io/auth/nginx;
    error_page       401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header       Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-entitlements $authentik_entitlements;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;

    # This section should be uncommented when the "Send HTTP Basic authentication" option
    # is enabled in the proxy provider
    # auth_request_set $authentik_auth $upstream_http_authorization;
    # proxy_set_header Authorization $authentik_auth;
}


# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    #internal;
    proxy_pass http://<authentik-vm-ip>:9000/outpost.goauthentik.io;
   
    # Note: ensure the Host header matches your external authentik URL:
    proxy_set_header        Host $host;
    proxy_set_header        X-Forwarded-Host $http_host;
    proxy_set_header        X-Original-URI $scheme://$http_host/$request_uri;
    #proxy_set_header        X-Original-URL $scheme://$http_host/$request_uri;

    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}


# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    #internal;
    add_header              Set-Cookie $auth_cookie;
    return 302 https://authentik.<domain-name>/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

I've tried...

Created domain name that is handled by authentik's NPM to only forward port 9000 on authentik IP(http, & 9000 in NPM proxy host config) & used this in app's NPM config
Set Host, X-Forwarded-Host & X-Original-URI headers in location /outpost.goauthentik.io to app domain name or $forward_scheme + app domain name

I mentioned this before, but if I run a curl command to http://:9000/outpost.goauthentik.io/start & pass Host header as the app's domain name, the correct response is returned but online told me that authentik finds the correct outpost based on X-Original-URI, this still doesn't work after having this set as stated above.

Here are the logs from "server" docker container on authentik when accessing my test app with hostname "apps"

[
  {
    "cidr": "192.168.0.0/16",
    "event": "Using remote IP from proxy protocol",
    "level": "trace",
    "remoteAddr": "<test-app-ip>",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "cidr": "192.168.0.0/16",
    "event": "Setting proxy headers",
    "level": "trace",
    "remoteAddr": "<test-app-ip>",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "app": "apps",
    "event": "Found app based direct host match",
    "host": "apps.<domain-name>",
    "level": "trace",
    "logger": "authentik.outpost.proxyv2",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "app": "apps",
    "event": "Found app based direct host match",
    "host": "apps.<domain-name>",
    "level": "trace",
    "logger": "authentik.outpost.proxyv2",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "event": "passing to application mux",
    "host": "apps.<domain-name>",
    "level": "trace",
    "logger": "authentik.outpost.proxyv2",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "event": "tracing headers for debug",
    "header": {
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
      ],
      "Accept-Language": [
        "en-US,en;q=0.5"
      ],
      "Connection": [
        "close"
      ],
      "Cookie": [
        "authentik_proxy_84ece62a=authentik_proxy_session_74f694cc-1421-49b3-8e0c-d54164d4afbe"
      ],
      "Priority": [
        "u=0, i"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"
      ],
      "X-Forwarded-Host": [
        "apps.<domain-name>"
      ],
      "X-Original-Uri": [
        "https://apps.<domain-name>//"
      ]
    },
    "level": "trace",
    "logger": "authentik.outpost.proxyv2.application",
    "name": "apps",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "event": "building forward URL from X-Original-URI",
    "level": "info",
    "logger": "authentik.outpost.proxyv2.application",
    "name": "apps",
    "timestamp": "2025-11-28T18:27:05Z",
    "url": "./https://apps.<domain-name>//"
  },
  {
    "event": "/outpost.goauthentik.io/auth/nginx",
    "host": "apps.<domain-name>",
    "level": "info",
    "logger": "authentik.outpost.proxyv2.application",
    "method": "GET",
    "name": "apps",
    "remote": "<test-app-ip>:44650",
    "runtime": "0.684",
    "scheme": "http",
    "size": 21,
    "status": 401,
    "timestamp": "2025-11-28T18:27:05Z",
    "user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"
  },
  {
    "cidr": "172.16.0.0/12",
    "event": "Using remote IP from proxy protocol",
    "level": "trace",
    "remoteAddr": "172.18.0.3",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "cidr": "172.16.0.0/12",
    "event": "Setting proxy headers",
    "level": "trace",
    "remoteAddr": "172.18.0.3",
    "timestamp": "2025-11-28T18:27:05Z"
  },
  {
    "event": "tracing request to backend",
    "headers": {
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
      ],
      "Accept-Language": [
        "en-US,en;q=0.5"
      ],
      "Cookie": [
        "authentik_device=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxZTRhY2JhMmE4ZDlhNWI0ZWNiMzQxODAxNmI3N2MwMmI3Y2M1NTJlYTFkODEzZWRhMDRjMmI2MjMxMjFlMjUxIiwiZXhwIjoxNzY2ODU2NzcxLjIyMTYxMX0.E6u0NIWKo6Tn2iTFUTn1fJgvjffqGGmlEGQgaVOIA4s; authentik_csrf=4nOim86ogADsQQAB2aHqhzMARZqI2kdh; authentik_session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJxNWxvY2ExMHBvZGp6dXltYmtsMWFpeHdkOWRjbTdwcCIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.A8AM_H_0XGsR4c0j2vPRDd24Uj1pNmwa29HMS3ipTSo"
      ],
      "Priority": [
        "u=0, i"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"
      ],
      "X-Forwarded-For": [
        "<client-ip>"
      ],
      "X-Forwarded-Proto": [
        "https"
      ],
      "X-Forwarded-Scheme": [
        "https"
      ],
      "X-Real-Ip": [
        "<client-ip>"
      ]
    },
    "level": "trace",
    "logger": "authentik.router",
    "timestamp": "2025-11-28T18:27:05Z",
    "url": "http://localhost:8000/outpost.goauthentik.io/start?rd=https://apps.<domain-name>/"
  },
  {
    "auth_via": "unauthenticated",
    "domain_url": "authentik.<domain-name>",
    "event": "/outpost.goauthentik.io/start?rd=https://apps.<domain-name>/",
    "host": "authentik.<domain-name>",
    "level": "info",
    "logger": "authentik.asgi",
    "method": "GET",
    "pid": 63,
    "remote": "<client-ip>",
    "request_id": "ee97b46a575e4bd093e9470fbc3c280d",
    "runtime": 9,
    "schema_name": "public",
    "scheme": "https",
    "status": 404,
    "timestamp": "2025-11-28T18:27:05.707099",
    "user": "",
    "user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"
  }
]

Need to figure out why I am getting a 404 when the logs show that I'm getting a correct match for my test app application in authentik

Answered by CrazyWolf13

Dec 2, 2025

Heya,
This config worked for my use case, though I'm not sure how much this helps in your custom config, but possibly it can serve you as inspiration.

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;

    # CUSTOM - Websocket behind authenticated proxy
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header …

View full answer

CrazyWolf13 · 2025-12-02T10:02:35Z

CrazyWolf13
Dec 2, 2025

Heya,
This config worked for my use case, though I'm not sure how much this helps in your custom config, but possibly it can serve you as inspiration.

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;

    # CUSTOM - Websocket behind authenticated proxy
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;

    # authentik-specific config
    auth_request        /outpost.goauthentik.io/auth/nginx;
    error_page          401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    proxy_pass          http://10.10.20.213:9000/outpost.goauthentik.io;
    # ensure the host of this vserver matches your external URL you've configured
    # in authentik
    proxy_set_header    Host $host;
    proxy_set_header    X-Original-URL $scheme://$http_host$request_uri;
    add_header          Set-Cookie $auth_cookie;
    auth_request_set    $auth_cookie $upstream_http_set_cookie;

    # required for POST requests to work
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
}

2 replies

Eandy11 Dec 2, 2025
Author

Thanks! Do you have authentik behind NPM too? Is this NPM config for one of your apps? Is that app in a reverse proxy with authentik or it’s own app with it’s own reverse proxy?

CrazyWolf13 Dec 2, 2025

Yes authentik is behind NPM, but only for the user. For the forward auth I use the direct IP:Port, I think that's how it's supposed to be but I'm not sure abt that.

Yes this is an NPM config for an app that uses forward auth. You need to create a new forward auth app, enter the public url and assign the provider to the default outpost, that's it.

I'm unsure what you mean with the last question, I have one single NPM instance that has all my reverse proxy entries, the "normal" ones which I just use with OIDC. If they don't have OIDC SSO integration I run them with forward auth. Yes each app has it's own nginxproxymanager "reverse-proxy-entry", I run everything like this: https://{app}.mydomain.tld

Hope that helps ^^

Eandy11 · 2025-12-05T03:59:16Z

Eandy11
Dec 5, 2025
Author

This worked! Can you explain how authentik knows how to display the domain name I have for authentik's web UI? I have a proxy host on NPM's instance of authentik that exposes the HTTPS port & that's not defined anywhere in the NPM proxy host for my app yet it still redirects to that domain name. I am happy that it does this, but I don't understand why.

Also, I want to force a certain user to be logged into authentik. For example, user A can be logged into authentik which is used for configuration but user B will be used to authenticate for all my other apps that use similar forward auth. Do you know if this is possible? I configured a passwordless flow but I'm seeing this message, probably because it thinks that I am trying to sign in as akadmin?

2 replies

CrazyWolf13 Dec 5, 2025

For Flows I've personally never yet really customized them, so I can't really help here, maybe this is helpful? https://blog.joshuastock.net/authentik-passwordless-authentication-integrating-social-login-and-yubikey

Regarding how authentik knows your domain name, this is set up on the outpost afaik:

Eandy11 Dec 5, 2025
Author

Gotcha. Thank you so much for everything! I’ll try to figure out somewhere else on how to force login for a specific user on authentik

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

nginx-proxy-manager setup on authentik & other apps #18445

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 4 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

nginx-proxy-manager setup on authentik & other apps #18445

Uh oh!

Uh oh!

Eandy11 Nov 28, 2025

Replies: 2 comments · 4 replies

Uh oh!

CrazyWolf13 Dec 2, 2025

Uh oh!

Eandy11 Dec 2, 2025 Author

Uh oh!

CrazyWolf13 Dec 2, 2025

Uh oh!

Eandy11 Dec 5, 2025 Author

Uh oh!

CrazyWolf13 Dec 5, 2025

Uh oh!

Eandy11 Dec 5, 2025 Author

Eandy11
Nov 28, 2025

Replies: 2 comments 4 replies

CrazyWolf13
Dec 2, 2025

Eandy11 Dec 2, 2025
Author

Eandy11
Dec 5, 2025
Author

Eandy11 Dec 5, 2025
Author