Spottr sign-in with Authentik

Spottr has no accounts of its own. On a network other people share, put it behind a proxy that signs people in, such as Authentik's forward auth in Traefik, and let Spottr trust that proxy: AUTH_MODE=proxy.

What Spottr expects

• The proxy is the only way in. With AUTH_MODE=proxy Spottr does not ask anyone to sign in: whoever reaches the pages is taken to be signed in already. Do not publish the container's port where anything but the proxy and your own download clients can reach it.
• TRUSTED_PROXIES names the proxy as Spottr sees it: the address its requests arrive from. That is not always the proxy's own address. In our setup Traefik runs on another host and reaches Spottr over a VPN whose subnet routing rewrites the source to the host Spottr runs on, so that host's address is the one to list. Find yours in Spottr's request log (ip=), with the setting empty, before setting it. Never list a whole network your clients are on: any address in the list may set the headers below.
• The proxy sets X-authentik-username on a request from a signed-in user, and replaces whatever the client sent. Authentik's Traefik middleware does this when that header is among its authResponseHeaders. Spottr believes it only from TRUSTED_PROXIES, and then lets that user download NZBs (/v1/spots/{id}/nzb). Another proxy, another header: PROXY_AUTH_HEADER.

1. Application and provider in Authentik

Admin interface → Applications → Applications → Create with provider.

Application

Provider: type Proxy Provider, mode Forward auth (single application), external host https://<spottr-host>.

Bind the application to who may use it (Policy / Group / User Bindings), and add the provider to the outpost that serves your Traefik (Applications → Outposts, the embedded outpost unless you run your own).

2. Traefik

A forward-auth middleware pointing at the outpost, with the user headers passed on:

http:
  middlewares:
    authentik:
      forwardAuth:
        address: "http://<authentik-server>:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email

and the router for <spottr-host> using it, with Spottr's port 8080 as the service.

3. Spottr

environment:
  - AUTH_MODE=proxy
  - TRUSTED_PROXIES=<address the proxy's requests arrive from>/32
  - SECURE_COOKIE=true
  # - PROXY_AUTH_HEADER=X-authentik-username   (the default)

Spottr logs a warning at every start in this mode, as a reminder that the proxy carries the sign-in.

Checking it

• Through the proxy, signed in: the pages work, and Download NZB on a spot downloads the file.
• On Spottr's own address, from another machine on the network: the pages answer (that is what proxy mode means, hence "the proxy is the only way in"), but an NZB without the API key is refused with 401.
• Spottr's request log shows each visitor's own address, not the proxy's. If it shows the proxy's address for every request, TRUSTED_PROXIES does not match where the proxy's requests come from.

Without a proxy

AUTH_MODE=password with APP_PASSWORD: one shared password for everything that changes something (sending to SABnzbd, the download queue) and for downloading NZBs. Reading the list stays open to whoever reaches the port.