How to use when OIDC provider (pocket-id) is behind traefik itself #185

bphenriques · 2025-07-22T13:11:34Z

bphenriques
Jul 22, 2025

Hi,

Was anyone able to have this plugin working when the OIDC provider is behind trafiek itself? I am getting the following error which I believe is b/c traefik tries to access http://pocket-id.${HOME_SERVER_BASE_URL} but it does not have access to it. I am getting a timeout rather than a connection issue which is interesting. I am a bit stuck on this for the past hours and I might revisit this later today. Maybe this is useful for others:

2025-07-22 13:04:32 [INFO] [traefik-oidc-auth] Getting OIDC discovery document...
2025-07-22 13:06:48 [ERROR] [traefik-oidc-auth] http-get discovery endpoints - Err: Get "http://pocket-id.<redacted>/.well-known/openid-configuration": dial tcp 192.168.1.121:80: connect: connection timed out
2025-07-22 13:06:48 [ERROR] [traefik-oidc-auth] Error while retrieving discovery document: HTTP GET error
2025-07-22 13:06:48 [ERROR] [traefik-oidc-auth] Error getting oidc discovery: HTTP GET error

Follows my compose files. I own a domain that points to a local address. Therefore HOME_SERVER_BASE_URL is local.my-domain.com when running locally, that in turn, resolves to my machine's IP address.

services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy:0.3
    container_name: socket-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - traefik-internal

  traefik:
    image: traefik:v3.4.4
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    depends_on:
      - socket-proxy
    env_file:
      - "${HOME_SERVER_SECRETS_DIR}/traefik/traefik.env"
    command:
      - "--log.level=DEBUG"

      # Providers
      - "--providers.docker=true"
      - "--providers.docker.endpoint=tcp://socket-proxy:2375"
      - "--providers.docker.exposedByDefault=false"

      # Entrypoints
      - "--entryPoints.web.address=:80"
      - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
      - "--entryPoints.websecure.address=:443"

      # Set the default cert resolver to this entrypoint. This removes the need to have the `tls.certresolver` per router.
      # Given that we are using a DNS Challenge, we need to set the domains and the wildcard.
      - "--entryPoints.websecure.http.tls.certResolver=default"
      - "--entryPoints.websecure.http.tls.domains[0].main=${HOME_SERVER_CNAME}"
      - "--entryPoints.websecure.http.tls.domains[0].sans=*.${HOME_SERVER_CNAME}"

      # Certificate resolver
      - "--certificatesresolvers.default.acme.email=${HOME_SERVER_ACME_EMAIL}"
      - "--certificatesresolvers.default.acme.dnschallenge=true"
      - "--certificatesresolvers.default.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.default.acme.storage=/data/letsencrypt/acme.json"

      # Proxy for the services that do not support OIDC
      - "--experimental.plugins.traefik-oidc-auth.moduleName=github.com/sevensolutions/traefik-oidc-auth"
      - "--experimental.plugins.traefik-oidc-auth.version=v0.13.0"
    volumes:
      - "${DATA_DIR}/traefik/letsencrypt/acme.json:/data/letsencrypt/acme.json" # Recommended to avoid re-issuing.
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    secrets:
      - "cf_api_email_file"
      - "cf_dns_api_token"
    environment:
      - "CF_API_EMAIL_FILE=/run/secrets/cf_api_email_file"
      - "CF_DNS_API_TOKEN_FILE=/run/secrets/cf_dns_api_token"
    networks:
      - traefik-internal
      - traefik-external
      - whoami
      - pocket-id

  whoami:
    image: traefik/whoami
    container_name: whoami
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.whoami.rule=Host("whoami.${HOME_SERVER_CNAME}")' 
      - "traefik.http.services.whoami-websecure.loadbalancer.server.port=80"
      - 'traefik.docker.network=whoami'

      # Setting the OIDC
      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.loglevel=debug'
      - 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.scopes=openid,profile,email,groups'
      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.url=http://pocket-id.${HOME_SERVER_BASE_URL}"
      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.usepkce=false"
      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.secret=MLFs4TT99kOOq8h3UAVRtYoCTDYXiRcZ" # the default one
      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.clientid=<from-pocket-id>"
      - "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.clientsecret=<from-pocket-id>"

      # Assigning the list
      - 'traefik.http.routers.whoami.middlewares=whoami-oidc-auth'
    networks:
      - whoami

networks:
  traefik-internal:
    external: true
  traefik-external:
    external: true
  whoami:
    external: true
  pocket-id:
    external: true

And:

secrets:
  pocket_id_encryption_key:
    file: "${HOME_SERVER_SECRETS_DIR}/pocket-id/pocket_id_encryption_key.secret"

services:
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:v1.6.4
    container_name: pocket-id
    hostname: homepage
    user: "${PUID}:${PGID}"
    restart: unless-stopped
    environment:
      APP_URL: "https://pocket-id.${HOME_SERVER_BASE_URL}"
      TRUST_PROXY: true
      PUID: "${PUID}"
      PGID: "${PGID}"
      ENCRYPTION_KEY_FILE: "/run/secrets/pocket_id_encryption_key"
      ANALYTICS_DISABLED: true
    volumes:
      - "${DATA_DIR}/pocket-id/data:/app/data"
    secrets:
      - "pocket_id_encryption_key"
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
    labels:
      - 'traefik.enable=true'
      - 'traefik.http.routers.pocket-id.rule=Host("pocket-id.${HOME_SERVER_CNAME}")'
      - "traefik.http.routers.pocket-id.entrypoints=websecure"
      - "traefik.http.services.pocket-id-websecure.loadbalancer.server.port=1411"
      - 'traefik.docker.network=pocket-id'
    networks:
      - pocket-id

networks:
  pocket-id:
    name: pocket-id
    external: true

The issue happens before I face anything to do with the OIDC client as far as I understand. To be clear, I added the client and the callback URL as expected in pocket-id.

Note: considered #133 but this is a proxy for all external requests which is not something I want.

Edit: I might need to change the callback url as well given that the plugin will be instantiated multiple times. Need to read more about that but is unrelated with this.

bphenriques · 2025-07-22T14:46:02Z

bphenriques
Jul 22, 2025
Author

Managed to move a bit forward but it is getting to the point where I dont feel very confident about the approach:

The provider url points directly to the service

- "traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.provider.url=http://pocket-id:1411"

But then, I need to change the callback URLto be fixed as follows:

- 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.callbackuri=https://whoami.${HOME_SERVER_BASE_URL}'

Getting a login loop but couldnt fix even after setting the cookie (I can see the logs saying that the named cookie is not present:

- 'traefik.http.middlewares.whoami-oidc-auth.plugin.traefik-oidc-auth.sessioncookie.domain=.${HOME_SERVER_BASE_URL}'  # prevents redirect

Which doesn't seem right.

Edit: I am using https for the callback, so this is odd.

Edit2: Ah, but I can't use the provider url as I am doing as the services exposes a http endpoint and not https:

2025-07-22 14:42:32 [DEBUG] [traefik-oidc-auth] AuthorizationEndPoint: https://pocket-id.local.domain.com/authorize

0 replies

sevensolutions · 2025-07-22T18:39:00Z

sevensolutions
Jul 22, 2025
Maintainer

I remember i also had some issues when setting up PocketID and the plugin. You can check this file:
https://github.com/sevensolutions/traefik-oidc-auth/blob/main/workspaces/pocket-id/docker-compose.yml
I needed to add an extra_host because PocketId was always returning the wrong URLs in the discovery document.
But this case I'am running them side by side.

From your error it looks like the plugin isn't able to contact the PocketId to get the discovery document. This is the very first call which happens before anything else.

Maybe you can run curl within the container to check if it's reachable?
Also inspect the result of the document and check the returned URLs. They need to be the respective public urls.

Second thing:
Do you really need to make the callback url absolute? For basic scenarios the relative default value /oidc/callback should be fine.
You can read about the differences here: https://traefik-oidc-auth.sevensolutions.cc/docs/getting-started/callback-uri

3 replies

bphenriques Jul 22, 2025
Author

Thanks! Yeah I saw the example but was a bit confusing as it was referring to the container URL and not the ip of the host. I think it would be fine, maybe?

My brain is a bit scrambled and need to resume this later this weekend.

Maybe you can run curl within the container to check if it's reachable?
Also inspect the result of the document and check the returned URLs. They need to be the respective public urls.

Would help. The whoami does not ship with shell but I can try a image that ships with sh.

I managed to make it work by using the hostname but as I described above,it was a deadend as I was contacting a http endpoint.

Do you really need to make the callback url absolute? For basic scenarios the relative default value /oidc/callback should be fine.
You can read about the differences here:

Last resort. I really dont like it and was me exploring. My intent was to have a router for each service as I might want to fine tune conditions accordingly. I have the vague memory that for this to work, the callback had to be absolute.

What is the callback URL in the OIDC client you used?

sevensolutions Jul 22, 2025
Maintainer

What is the callback URL in the OIDC client you used?

In PocketId you need to configure the full public callback url.

Lets say you have an app running over traefik on the domain myapp.domain.com and you are using the default /oidc/callback url in the plugin, then this is overlaying your app.
So your full redirect url is https://myapp.domain.com/oidc/callback. This is what you need to configure (allowlist) in PocketId.

I'am also playing around with your setup but it's not that easy because i need a secure context (HTTPS) to make PocketId work.

bphenriques Jul 22, 2025
Author

That's what I used as callback. In my case, https://whoami.local.mydomain.com

Used cloudflare and created wildcards (*.local.mydomain.com) to set up the DNS challenge.

edit: bad example

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

How to use when OIDC provider (pocket-id) is behind traefik itself #185

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

How to use when OIDC provider (pocket-id) is behind traefik itself #185

Uh oh!

Uh oh!

bphenriques Jul 22, 2025

Replies: 2 comments · 3 replies

Uh oh!

Uh oh!

bphenriques Jul 22, 2025 Author

Uh oh!

sevensolutions Jul 22, 2025 Maintainer

Uh oh!

bphenriques Jul 22, 2025 Author

Uh oh!

sevensolutions Jul 22, 2025 Maintainer

Uh oh!

Uh oh!

bphenriques Jul 22, 2025 Author

bphenriques
Jul 22, 2025

Replies: 2 comments 3 replies

bphenriques
Jul 22, 2025
Author

sevensolutions
Jul 22, 2025
Maintainer

bphenriques Jul 22, 2025
Author

sevensolutions Jul 22, 2025
Maintainer

bphenriques Jul 22, 2025
Author