Bypass authentic for local IP?

Traefik Traefik v3 (latest)
,
1

Hi,

I do have a traefik +authentik instance.

On another server, I’ve an home-assistant server, which needs to connect to one of the docker image using authentik. It’s a specific service(EVCC) and a specific home-assistant integration, that doesn’t support auth.

Here is the relevant configuration:

http:
  routers:
    evcc:
      rule: Host(`evcc.xxx.yyy`)
      entrypoints: websecure
      service: evcc
      middlewares:
      - force-secure
      - middlewares-authentik
  services:
    evcc:
      loadbalancer:
        servers:
          - url: http://192.168.0.30:7070
  middlewares:
    force-secure:
      redirectscheme:
        scheme: https
        permanent: true
    middlewares-authentik:
      forwardAuth:
        address: "http://192.168.0.30:7080/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

My wish is that every connection that comes from my local network(and not my router which is on 192.168.0.1) should bypass the authentik middleware.

The thing is that I still need to access through evcc.xxx.yyy, so I’m not sure it’s really possible?

2

Create another router with rule Host() && ClientIP() without auth middleware.

3

hi @bluepuma77

I tried the following:

    evcc:
      rule: Host(`evcc.redacted.xyz`)
      entrypoints: websecure
      service: evcc
      middlewares:
      - force-secure
      - middlewares-authentik
    evcc-local:
      rule: Host(`evcc.redacted.xyz`) && ClientIP(`192.168.0.0/24`)
      entrypoints: websecure
      service: evcc
      middlewares:
      - force-secure

Is that what you meant?

Because now if I’m on my local network, I still get the authentik login.

The thing is that I’m still reaching evcc through my evcc.redacted.xyz, so basically from a network perspective, I guess I still go to my ISP, then back to my router, then to my docker host, so I’m not sure it would know that I’m originally from the same network?

4

I see two options:

  • Overwrite domain IP with hosts file, local router, Pi-Hole.
  • Use separate domain, pointing to your local IP.
5

So the behavior I’m getting seems logical to you?

Ok, the issue with the first option is that my ISP doesn’t allow to overwrite the DNS Server in my router, so that’s something I would have to do on every device, and that’s painful, especially on phones.

The issue with the second option is that I’ve several PWA configured, and then I would need to duplicate each app on my phones and the GF phone and use different apps depending on if I’m connected or not.

I’ve tried to set a local DNS rule on my router, but it doesn’t seems to work, even if I cached my DNS, not sure the router use it the right way.