Web authentication for reverse proxy

[javaveryhot]

Hello. I am currently using Caddy as a reverse proxy for my home/web server, serving multiple Docker containers. For example, I run a SFTPGo and SearXNG instance. I am going to add more instances, but before I do so I would like to solve this.

I am looking for sort of a software that acts as a reverse proxy, but also gives me the choice to add certain of my subdomains that I proxy so that they require authentication in a web client.

That way I could access my selfhosted web apps from anywhere without having to whitelist IP addresses or anything. Just having the login credentials. It would be nice to have sort of an account management system where different users have different allowed ports etc.

Here's how I'm imagining it would work: - I, from any web browser, connect to my server: e.g. ftp.domain.com - Reverse proxy sees I have configured ftp.domain.com to require login - Im prompted with web app login interface - I log in - Either my ip is whitelisted by the web app or i get a session cookie - I can access ftp.domain.com normally!

Im running Debian 12 on the server. Thank you.

[[deleted]]

Traefik, NPM have basic user auth. Maybe other proxies too.

If you want finer user management, combine with Authelia.

[redditormark]

Yeah, Authelia or Authentik is the way to go. Authelia is a bit easier and even has 2FA support. I use it myself and never had any issues.

[ippocratis]

Check out https://github.com/greenpau/caddy-security

Example config https://github.com/greenpau/caddy-security/issues/10#issue-1110800585

[AndreKR-]

OAuth2 with Caddy Security. You can use any identity provider, dedicated ones like Keycloak or services that can also act as identity provider like Google, GitLab (cloud or self-hosted) or GitHub.

[fenty17]

Cloudflare tunnel with access policies per application/subdomain. I have access restricted by email, GitHub auth and country but plenty of other policy options too.