Create Authelia and Caddy Docker Compose setup #36

New issue

Closed

opened 2026-07-24 10:36:45 +00:00 by frank · 1 comment

frank commented

2026-07-24 10:36:45 +00:00

Owner

Goal

Create a reproducible Docker Compose setup for Caddy, Authelia, Ghost and NiceOAuthForwardAuth.

Requirements

Protect /ghost through Caddy and Authelia.
Forward the required identity headers.
Strip client-supplied identity headers.
~~Prevent public access to Ghost that bypasses Caddy.~~
Use local test users and non-production secrets.
Keep the setup usable manually and from automated tests.

Acceptance criteria

The setup starts with Docker Compose.
All services become healthy.
Authorized users can reach Ghost Admin.
~~Unauthorized users are rejected.~~
~~Ghost is not exposed through a bypass route.~~
No real credentials are committed.

The striked requirements and acceptance criterias have been diverted to #47

## Goal Create a reproducible Docker Compose setup for Caddy, Authelia, Ghost and `NiceOAuthForwardAuth`. ## Requirements * Protect `/ghost` through Caddy and Authelia. * Forward the required identity headers. * Strip client-supplied identity headers. * ~~Prevent public access to Ghost that bypasses Caddy.~~ * Use local test users and non-production secrets. * Keep the setup usable manually and from automated tests. ## Acceptance criteria * [x] The setup starts with Docker Compose. * [x] All services become healthy. * [x] Authorized users can reach Ghost Admin. * [ ] ~~Unauthorized users are rejected.~~ * [ ] ~~Ghost is not exposed through a bypass route.~~ * [x] No real credentials are committed. The striked requirements and acceptance criterias have been diverted to #47

frank added a new dependency

2026-07-24 10:38:10 +00:00

#35 Exemplary setup via Authelia + Caddy

frank removed a dependency

2026-07-24 10:40:09 +00:00

#35 Exemplary setup via Authelia + Caddy

frank referenced this issue

2026-07-24 10:40:53 +00:00

Exemplary setup via Authelia + Caddy #35

frank added a new dependency

2026-07-24 10:48:53 +00:00

#35 Exemplary setup via Authelia + Caddy

frank added this to the Forward Auth mode milestone

2026-07-24 10:52:51 +00:00

frank added the

type/feature

area/integration

security

labels

2026-07-24 11:21:59 +00:00

frank commented

2026-07-24 20:20:06 +00:00

Author

Owner

Status-update:

Login with valid admin user works as intended (User visits /ghost and gets redirected by caddy to authelia)
Logging out from valid session automatically logs user back in -> That kinda makes sense since Ghost does not communicate with Authelia
If I then manually log out in Authelia, I correctly get redirected to Authelia by Caddy when visiting /ghost
However if I then log back in as another user which exists in authelia but not in Ghost then I get logged into Ghost with the old user (Medium security flaw - I assume it is due to the browser cookie being still valid)
Only if I then log out manually from Ghost I get logged out of the sessions and being presented with the Ghost login screen -> That also makes sense as Caddy considers the user validated by Auth but Ghost does not recognize that user

I assume the main issue here is that Ghost only calls the SSO when logging in. Thus, once logged in it distributes a browser cookie independent from Authelia's cookie. In practice this might be OK as long as not two members share the same browser with the same cookies

Status-update: * Login with valid admin user works as intended (User visits /ghost and gets redirected by caddy to authelia) * Logging out from valid session automatically logs user back in -> That kinda makes sense since Ghost does not communicate with Authelia * If I then manually log out in Authelia, I correctly get redirected to Authelia by Caddy when visiting /ghost * However if I then log back in as another user which exists in authelia but not in Ghost then I get logged into Ghost with the old user (Medium security flaw - I assume it is due to the browser cookie being still valid) * Only if I then log out manually from Ghost I get logged out of the sessions and being presented with the Ghost login screen -> That also makes sense as Caddy considers the user validated by Auth but Ghost does not recognize that user I assume the main issue here is that Ghost only calls the SSO when logging in. Thus, once logged in it distributes a browser cookie independent from Authelia's cookie. In practice this might be OK as long as not two members share the same browser with the same cookies

frank referenced this issue from a pull request that will close it,

2026-07-24 22:57:49 +00:00

feat/forward-auth-adapter #46

frank closed this issue

2026-07-24 22:58:07 +00:00