# Struggling to exclude a path from Authentik middleware

**URL:** <https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199>\
**Category:** Traefik v3 (latest)\
**Tags:** middleware\
**Created:** [November 17, 2024, 5:27am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199 "2024-11-17T05:27:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![zodac](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zodac/32/9562_2.png) [@zodac](https://community.traefik.io/u/zodac)\
**Post date:** [November 17, 2024, 5:27am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/1 "2024-11-17T05:27:38Z")

</div>

Hi,

I'm using Uptime-Kuma for some monitoring, and I'm using Authentik to put some authentication in front of it. I've got it all working fine for normal flows. But now I'd like to be able to exclude a specific path from authentication (a status page which I would like to make public). The path is:

**[https://monitor.domain.tld/status/main](https://monitor.domain.tld/status/main)**

I've set up the docker labels as follows:

```auto
labels:
      # Reverse proxy config
      traefik.enable: "true"
      traefik.http.routers.uptime-kuma.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`) && !PathPrefix(`/status/`)"
      traefik.http.routers.uptime-kuma.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma.priority: "1"
      traefik.http.routers.uptime-kuma.tls: "true"
      traefik.http.services.uptime-kuma.loadbalancer.server.port: "${UPTIME_KUMA_PORT:?[uptime-kuma] Port missing}"
      traefik.http.routers.uptime-kuma.middlewares: "authentik@file"
----> # Config below added to exclude path
      # Router for /status/main (this excludes authentik middleware)
      traefik.http.routers.uptime-kuma-status.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`) && PathPrefix(`/status/`)"
      traefik.http.routers.uptime-kuma-status.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma-status.priority: "99"
      traefik.http.routers.uptime-kuma-status.tls: "true"
      traefik.http.routers.uptime-kuma-status.middlewares: "" # I've also tried removing this line completely

```

However, when I try to access the URL with /status/main, I get a blank white page. In the Chrome dev tools\> Network tab I see some calls to my Authentik URL (they fail with a CORS error, but they are attempting to load).

Any advice on how I can update my config to remove the middleware correctly?

Thanks!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 17, 2024, 9:55am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/2 "2024-11-17T09:55:00Z")

</div>

Not sure if `middlewares: ""` is valid, I would remove it.

You don’t set the `port` for the second router, Traefik might use the first from Dockerfile `EXPOSE`, which might be wrong, or not exist.

Enable and check Traefik debug log and Traefik access log in JSON format.

---

<div class="post-metadata">

**Author:** ![zodac](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zodac/32/9562_2.png) [@zodac](https://community.traefik.io/u/zodac)\
**Post date:** [November 17, 2024, 10:22am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/3 "2024-11-17T10:22:50Z")

</div>

Hi, thanks for the reply. 🙂

Yeah, I wasn't sure about the middlewares line either. For the record, I tested both with and without it.

I did add the port back in, but I'm getting a weird conflict error. I add this line (similar to the line I use to define the port for the main 'uptime-kuma' service):

```auto
traefik.http.services.uptime-kuma-status.loadbalancer.server.port: "${UPTIME_KUMA_PORT:?[uptime-kuma] Port missing}"

```

But then I get this error in the Traefik logs:

```auto
2024-11-17T10:08:35Z ERR github.com/traefik/traefik/v3/pkg/provider/configuration.go:497 > Router uptime-kuma-status cannot be linked automatically with multiple Services: ["uptime-kuma-status" "uptime-kuma"] providerName=docker routerName=uptime-kuma-status
2024-11-17T10:08:35Z ERR github.com/traefik/traefik/v3/pkg/provider/configuration.go:497 > Router uptime-kuma cannot be linked automatically with multiple Services: ["uptime-kuma-status" "uptime-kuma"] providerName=docker routerName=uptime-kuma

```

I try to specify the services explicitly by adding:

```auto
traefik.http.routers.uptime-kuma.service: "uptime-kuma"
traefik.http.routers.uptime-kuma-status.service: "uptime-kuma-status"

```

This removes the errors in the logs, but doesn't fix the /status/main link, which still has the original issue.

Updating with the current labels, after consolidating the services and reusing the main one (still failing as in the OP):

```auto
labels:
      # Reverse proxy config
      traefik.enable: "true"
      traefik.http.routers.uptime-kuma.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`) && !PathPrefix(`/status/`)"
      traefik.http.routers.uptime-kuma.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma.priority: "1"
      traefik.http.routers.uptime-kuma.tls: "true"
      traefik.http.routers.uptime-kuma.middlewares: "authentik@file"
      traefik.http.routers.uptime-kuma.service: "uptime-kuma"
      traefik.http.services.uptime-kuma.loadbalancer.server.port: "${UPTIME_KUMA_PORT:?[uptime-kuma] Port missing}"
      # Router for /status/main (this excludes authentik middleware)
      traefik.http.routers.uptime-kuma-status.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`) && PathPrefix(`/status/`)"
      traefik.http.routers.uptime-kuma-status.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma-status.priority: "99"
      traefik.http.routers.uptime-kuma-status.tls: "true"
      traefik.http.routers.uptime-kuma-status.service: "uptime-kuma"

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 17, 2024, 11:57am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/4 "2024-11-17T11:57:03Z")

</div>

You are right, you can use one `service` and assign it to both `routers`.

Enable and check Traefik debug log and Traefik access log in JSON format.

---

<div class="post-metadata">

**Author:** ![zodac](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zodac/32/9562_2.png) [@zodac](https://community.traefik.io/u/zodac)\
**Post date:** [November 17, 2024, 10:11pm UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/5 "2024-11-17T22:11:55Z")

</div>

Ok, just to confirm, I added this this to enable access logging to STDOUT

```auto
accessLog:
  format: json

```

Link to the log after I made the request:

> **[{"level":"debug","time":"2024-11-17T22:06:27Z","caller":"github.com/traefik/trae...](https://pastebin.com/VvdK6yUH)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

It looks like it goes straight to Authentik, but perhaps I'm missing something.

---

<div class="post-metadata">

**Author:** ![zodac](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/zodac/32/9562_2.png) [@zodac](https://community.traefik.io/u/zodac)\
**Post date:** [November 19, 2024, 4:42am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/6 "2024-11-19T04:42:09Z")

</div>

I found the problem, quite obvious in the end. My Traefik configuration was fine, but in order to load the page I needed, I needed some assets from the site, which was what triggered the authentication middleware. 🤦‍♂️

I updated my config to the following, and things all look fine. 🙂

```auto
  labels:
      # Reverse proxy config
      traefik.enable: "true"
      traefik.http.routers.uptime-kuma.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`)"
      traefik.http.routers.uptime-kuma.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma.tls: "true"
      traefik.http.routers.uptime-kuma.middlewares: "authentik@file"
      traefik.http.routers.uptime-kuma.service: "uptime-kuma"
      traefik.http.services.uptime-kuma.loadbalancer.server.port: "${UPTIME_KUMA_PORT:?[uptime-kuma] Port missing}"
      # Disable authentication for '/status/' path and subpaths
      # Also including '/assets/', '/upload/' and '/api/' to allow the page to load required information
      traefik.http.routers.uptime-kuma-status.rule: "Host(`monitor.${PUBLIC_DOMAIN_NAME}`) && (PathPrefix(`/status/`) || PathPrefix(`/assets/`) || PathPrefix(`/upload/`) || PathPrefix(`/api/`))"
      traefik.http.routers.uptime-kuma-status.entrypoints: "websecure"
      traefik.http.routers.uptime-kuma-status.tls: "true"
      traefik.http.routers.uptime-kuma-status.service: "uptime-kuma"

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [November 22, 2024, 4:42am UTC](https://community.traefik.io/t/struggling-to-exclude-a-path-from-authentik-middleware/25199/7 "2024-11-22T04:42:31Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.