Proxy authenticationCopy Anchor Link

With proxy authentication, a reverse proxy that already signs people in, such as Authelia, Authentik or nginx with basic auth, tells Northplane who each request is from through a header. People then sign in once, at the proxy.

Setting it upCopy Anchor Link

Proxy authentication needs headscale.api_key, which Northplane uses on behalf of signed-in people:

headscale:
  api_key: "<key>"

server:
  proxy_auth:
    enabled: true
    user_header: "Remote-User"
    email_header: "Remote-Email"
    name_header: "Remote-Name"
    allowed_cidrs:
      - "127.0.0.1/32"
      - "::1/128"

Each request needs user_header, Remote-User by default. Its value becomes the account's identity in Northplane, as proxy:<value>, so it has to stay the same for each person. The email, name and picture_header headers are optional and fill in the profile.

Roles and account linking work as described in Users & roles.

Which requests are trustedCopy Anchor Link

Northplane only reads the identity headers on requests from allowed_cidrs, which defaults to localhost. It checks the address of the connection itself, not X-Forwarded-For or similar headers, so set allowed_cidrs to the addresses the proxy connects from.

When another proxy sits in front, and the check should use the original client's address instead, set ip_header to a header the trusted proxy sets or overwrites, such as X-Forwarded-For. Northplane then reads it only on connections from trusted_proxy_cidrs, also localhost by default, and checks the first address in it against allowed_cidrs:

server:
  proxy_auth:
    enabled: true
    ip_header: "X-Forwarded-For"
    trusted_proxy_cidrs:
      - "127.0.0.1/32"
    allowed_cidrs:
      - "10.0.0.0/8"

OptionsCopy Anchor Link

All options sit under server.proxy_auth.