From 2ebbe5e5295afd348bcdc9e02eec83124ac6b77e Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 21:06:06 +0000 Subject: [PATCH] Hardcode X-Forwarded-Host in remote-Authelia forward_auth, not {host} MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix used the {host} Caddy placeholder for X-Forwarded-Host, but confirmed live it still evaluated to the upstream Authelia's own hostname rather than the original site's — Caddy appears to rewrite the outgoing request's Host to the upstream target before header_up placeholders resolve for a scheme-qualified remote upstream, so {host} echoed back the already-rewritten value. Since this site block only ever serves one domain, hardcode it instead of depending on placeholder timing. --- services/asterisk-digital-ocean.sh | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/services/asterisk-digital-ocean.sh b/services/asterisk-digital-ocean.sh index 235c85d..9a30bb2 100755 --- a/services/asterisk-digital-ocean.sh +++ b/services/asterisk-digital-ocean.sh @@ -598,12 +598,25 @@ ENV # silently passed through with no 2FA prompt regardless of # its own policy. Pinning these to the original request's # values fixes it regardless of hop count. + # + # X-Forwarded-Host uses a literal domain, NOT the {host} + # placeholder. Confirmed live: {host} still evaluated to + # the upstream's own hostname (auth.example.com) rather + # than the original site's — Caddy appears to rewrite the + # outgoing request's Host to the upstream target before + # header_up placeholders are resolved for a scheme- + # qualified upstream, so {host} echoes back the already- + # rewritten value instead of the original client-facing + # host. Since this site block only ever serves one domain + # (DOMAIN_NAME), hardcoding it sidesteps the ambiguity + # entirely instead of depending on Caddy's internal + # header-mutation ordering. EXTRA_BLOCK=" forward_auth ${_remote_authelia} { uri /api/authz/forward-auth copy_headers Remote-User Remote-Groups Remote-Name Remote-Email header_up X-Forwarded-Method {method} header_up X-Forwarded-Proto {scheme} - header_up X-Forwarded-Host {host} + header_up X-Forwarded-Host ${DOMAIN_NAME} header_up X-Forwarded-Uri {uri} }" sed -i "s/^WEB_ADMIN_AUTH_DISABLED=.*/WEB_ADMIN_AUTH_DISABLED=true/" .env