Cannot Get Tinyauth Redirection Working with NPM

[torquilcorkerton]

Good morning, all.

Over the last few weeks of holidays, I have gone from running a bare metal Home Assistant server on a NUC, to a number of self-hosted Docker hosted Apps, to a Proxmox VE host and my Docker in a VM, but none of these upgrades has baffled me for as long as trying to get TinyAuth working!

I tried Tinyauth originally in its own Arcane project (like a Portainer stack) and when I didn't have any joy, I tried the following options in turn without success:

• a shared Docker network between containers
• putting the test Apps (IT-Tools, Traefik/whoami) in the same project/stack as Tinyauth
• putting Tinyauth and the test App in the same project/stack as NPM
• trying both SSL/HTTPS and no SSL/HTTP in the proxy hosts for Tinyauth and the app

I eventually ended up with exactly the example from Tinyauth's website with NPM, a minimal NginX container and Tinyauth in the same project, but still no luck. My App and Tinyauth are both on the same domain in their proxy hosts (app.mydomain.net and tinyauth.mydomain.net) and both work independently, but when I put the NPM configuration in the Advanced tab of the App's proxy host entry, I get a "500 Internal Server Error" message when trying to open app.mydomain.net. I have tried this in a private window in my browser (Safari) so I know it's not a cache issue.

The only things I'm changing at all in the NPM configuration from the example, during my testing, are:

• proxy_pass http://tinyauth:3000/api/auth/<my_container_name>;
• return 302 http://tinyauth.mydomain.net/login?redirect_uri=$scheme://$http_host$request_uri;

I'm stuck with NPM over other reverse proxies like Caddy or Traefik because I'm using DNS challenge to a cPanel server to get my wildcard SSL cert, which only NPM seems to support. I've searched for similar issues and have tried their suggested solutions ("Block Common Exploits" option disabled in the Tinyauth proxy host entry, caching issues, etc), so I'm baffled and spending more time on this than my wife is happy with! Any suggestions would be gratefully received.

[steveiliop56]

This usually suggests that either Tinyauth is not running correctly or NPM cannot reach it. You can start debugging by entering into the NPM container with docker exec npm_container_name sh and then trying curl http://tinyauth:3000/api/healthz (iirc you may need to install curl with apk add curl), if it cannot reach it then your issue is networking. You should also confirm Tinyauth is running with docker logs tinyauth_container_name.

[torquilcorkerton]

Good afternoon, and thank you for your response. I have had an issue with IPv6 networking which I presumed was unrelated, but after I worked on that, flattened my NPM project and recreated it, I got my NginX proxy host to redirect to Tinyauth. I even got the NPM, NGinX and Tinyauth containers in different projects/stacks/compose files still working using a shared docker network (called 'proxy').

However.... :)

When I tried adapting everything to protect a different container that is also on the same shared 'proxy' docker network (Icontainer name 'T-Tools'), I have tried changing the following section of the NPM config in various ways, but I'm back to getting a '500 Internal Server Error':

# Tinyauth auth request
location /tinyauth {
  # Pass request to Tinyauth
  proxy_pass http://tinyauth:3000/api/auth/IT-Tools;

Many thanks for your help (and patience)!

[steveiliop56]

You should not modify the advanced config proxy pass. You should have:

# Tinyauth auth request
location /tinyauth {
  # Pass request to Tinyauth
  proxy_pass http://tinyauth:3000/api/auth/nginx;

[torquilcorkerton]

I think I'd figured it out at just the same time you replied!

So I keep the barebones 'nginx' container along with the NPM and Tinyauth ones in the same project/stack, and the same NPM config for the Advanced section of the new container's proxy host entry, whilst all I change is the 'Forward Hostname/IP' and 'Forward Port' to point to the new container.

Brilliantt; thank you so much for your help.

T.

[torquilcorkerton]

Out of curiosity, what is the reason the barebones NginX package is required in order to make Tinyauth work with NPM, when it isn't required for integration with other reverse proxies such as Caddy or Traefik? I understand that the full NginX web server can be used as a reverse proxy itself so, once I'm more comfortable with what I'm doing, could I take NPM out of the equation altogether?

[steveiliop56]

I don't understand. You don't need both NPM and nginx, they both do the same job. If you know how to configure nginx correctly you don't need NPM as it's just a frontend.

[torquilcorkerton]

I have only just started using NPM and don't know how to configure NginX itself, but I had NPM working as a reverse proxy on its own before starting to try Tinyauth. Does this mean I could get rid of the bare bones NginX and use just NPM instead?

I have tried taking the bare bones NginX out of the project and kept just NPM, and Tinyauth isn't working again, so what do I have to change? to use my existing NPM container instead of NginX?

Apologies for seeming stupid, but I have obviously been confused by the NPM instructions on the Tinyauth website.