🐛 Bug Report: Caddy, caddy-security and Pocket-ID not working? #342

New Issue

OVERLORD · 2025-10-08T00:04:15+03:00

OVERLORD commented

2025-10-08 00:04:15 +03:00

Originally created by @web-josh on GitHub.

Reproduction steps

Hey guys,
I tried to protect a docker service pointed to a subdomain with pocket-id, caddy reverse proxy and the caddy-security plugin(caddy add-package github.com/greenpau/caddy-security).
Sadly this doesn't seem to work. I know from reddit that there are a couple of open threads that also struggle with this.
The plugin is installed, pocket-id runs correct (and is working for other services already) this is the Caddyfile:

{
	email blub@myDomain.dev
  	# Port to listen on
	http_port 443

  	# Configure caddy-security.
	order authenticate before respond
	security {
		oauth identity provider generic {
			delay_start 3
			realm generic
			driver generic
			client_id <CLIENT-ID>
			client_secret <CLIENT-SECRET>
			scopes openid email profile
			base_auth_url http://localhost
			metadata_url http://localhost/.well-known/openid-configuration
		}

		authentication portal myportal {
			crypto default token lifetime 3600 # Seconds until you have to re-authenticate
			enable identity provider generic
			cookie insecure off # Set to "on" if you're not using HTTPS

			transform user {
				match realm generic
				action add role user
			}
		}

		authorization policy mypolicy {
			set auth url /caddy-security/oauth2/generic
			allow roles user
			inject headers with claims
		}
	}
}

subdomain.myDomain.dev {
	@auth {
		path /caddy-security/*
	}

	route @auth {
		authenticate with myportal
	}

	route /* {
		authorize with mypolicy
		reverse_proxy myDockerService:3000 # Replace with your own service
	}
}

# Other stuff that doesn't need to be protected by pocket-id
ai.myDomain.dev {
	reverse_proxy open-webui:8080
}

git.myDomain.dev {
	reverse_proxy gitea:3000
}

This gives me the following error:
docker logs caddy-caddy-1
{"level":"info","ts":1739791363.5531156,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
Error: adapting config using caddyfile: parsing caddyfile tokens for 'order': authenticate is not a registered directive, at /etc/caddy/Caddyfile:7

I'm thankful for every help!

Expected behavior

Subdomain should be protected by pocket-id

Actual Behavior

Caddy reverse proxy throws error

Version and Environment

v 0.33

All in Docker compose environments

Log Output

No response

Originally created by @web-josh on GitHub. ### Reproduction steps Hey guys, I tried to protect a docker service pointed to a subdomain with pocket-id, caddy reverse proxy and the caddy-security plugin(caddy add-package github.com/greenpau/caddy-security). Sadly this doesn't seem to work. I know from reddit that there are a couple of open threads that also struggle with this. The plugin is installed, pocket-id runs correct (and is working for other services already) this is the Caddyfile: ``` { email blub@myDomain.dev # Port to listen on http_port 443 # Configure caddy-security. order authenticate before respond security { oauth identity provider generic { delay_start 3 realm generic driver generic client_id <CLIENT-ID> client_secret <CLIENT-SECRET> scopes openid email profile base_auth_url http://localhost metadata_url http://localhost/.well-known/openid-configuration } authentication portal myportal { crypto default token lifetime 3600 # Seconds until you have to re-authenticate enable identity provider generic cookie insecure off # Set to "on" if you're not using HTTPS transform user { match realm generic action add role user } } authorization policy mypolicy { set auth url /caddy-security/oauth2/generic allow roles user inject headers with claims } } } subdomain.myDomain.dev { @auth { path /caddy-security/* } route @auth { authenticate with myportal } route /* { authorize with mypolicy reverse_proxy myDockerService:3000 # Replace with your own service } } # Other stuff that doesn't need to be protected by pocket-id ai.myDomain.dev { reverse_proxy open-webui:8080 } git.myDomain.dev { reverse_proxy gitea:3000 } ``` This gives me the following error: docker logs caddy-caddy-1 {"level":"info","ts":1739791363.5531156,"msg":"using config from file","file":"/etc/caddy/Caddyfile"} Error: adapting config using caddyfile: parsing caddyfile tokens for 'order': authenticate is not a registered directive, at /etc/caddy/Caddyfile:7 I'm thankful for every help! ### Expected behavior Subdomain should be protected by pocket-id ### Actual Behavior Caddy reverse proxy throws error ### Version and Environment v 0.33 All in Docker compose environments ### Log Output _No response_

OVERLORD added the bug label 2025-10-08 00:04:15 +03:00

OVERLORD closed this issue

2025-10-08 00:04:16 +03:00

OVERLORD referenced this issue

2025-10-08 00:18:37 +03:00

[PR #353] [CLOSED] fix: update profile picture URL to use dynamic user ID (#342) #863

Sign in to join this conversation.