Setup ArchiveBox authentication with oauth2-proxy #101

New issue

Open

opened 2026-07-20 05:14:08 +00:00 by mcp-bot · 0 comments

mcp-bot commented

2026-07-20 05:14:08 +00:00

Member

Goal

Enable authentication for ArchiveBox using oauth2-proxy as a reverse proxy auth provider.

Background

ArchiveBox supports reverse proxy authentication via headers from upstream auth providers like oauth2-proxy, Cloudflare Zero Trust, and Authentik.

Reference: ArchiveBox Wiki - Setting up Authentication

Required Configuration

These ArchiveBox environment variables need to be set:

Variable	Description	Example
`REVERSE_PROXY_USER_HEADER`	The header where the upstream proxy places the authenticated user's username/email	`X-Remote-User`
`REVERSE_PROXY_WHITELIST`	The IP/CIDR of the upstream reverse proxy server (only the proxy itself!)	`192.168.1.10/32`
`LOGOUT_REDIRECT_URL`	(Optional) Redirect URL after logout	`https://auth.example.com/after/logout`

Tasks

Deploy oauth2-proxy alongside ArchiveBox (or as a sidecar) to handle OAuth2/OIDC authentication
Configure oauth2-proxy with the appropriate OAuth provider (e.g. Authentik, which is already in use in the homelab)
Set ArchiveBox config:
- REVERSE_PROXY_USER_HEADER=X-Remote-User
- REVERSE_PROXY_WHITELIST = oauth2-proxy container IP
- REVERSE_PROXY_AUTH_HEADER=True (to enable the feature)
Verify that ArchiveBox correctly reads the authenticated user from the proxy header
Test login/logout flow through oauth2-proxy

Notes

Authentik is already part of the homelab stack and can act as the OIDC provider for oauth2-proxy
The REVERSE_PROXY_WHITELIST must only contain the reverse proxy's IP — ArchiveBox fully trusts this range for authentication
ArchiveBox does not natively support SAML/OAuth2/OpenID; oauth2-proxy bridges this gap by converting OIDC to reverse proxy headers

## Goal Enable authentication for ArchiveBox using oauth2-proxy as a reverse proxy auth provider. ## Background ArchiveBox supports reverse proxy authentication via headers from upstream auth providers like oauth2-proxy, Cloudflare Zero Trust, and Authentik. Reference: [ArchiveBox Wiki - Setting up Authentication](https://github.com/ArchiveBox/ArchiveBox/wiki/Setting-up-Authentication#reverse-proxy-authentication) ## Required Configuration These ArchiveBox environment variables need to be set: | Variable | Description | Example | |---|---|---| | `REVERSE_PROXY_USER_HEADER` | The header where the upstream proxy places the authenticated user's username/email | `X-Remote-User` | | `REVERSE_PROXY_WHITELIST` | The IP/CIDR of the upstream reverse proxy server (only the proxy itself!) | `192.168.1.10/32` | | `LOGOUT_REDIRECT_URL` | *(Optional)* Redirect URL after logout | `https://auth.example.com/after/logout` | ## Tasks 1. **Deploy oauth2-proxy** alongside ArchiveBox (or as a sidecar) to handle OAuth2/OIDC authentication 2. **Configure oauth2-proxy** with the appropriate OAuth provider (e.g. Authentik, which is already in use in the homelab) 3. **Set ArchiveBox config**: - `REVERSE_PROXY_USER_HEADER=X-Remote-User` - `REVERSE_PROXY_WHITELIST` = oauth2-proxy container IP - `REVERSE_PROXY_AUTH_HEADER=True` (to enable the feature) 4. **Verify** that ArchiveBox correctly reads the authenticated user from the proxy header 5. **Test** login/logout flow through oauth2-proxy ## Notes - Authentik is already part of the homelab stack and can act as the OIDC provider for oauth2-proxy - The `REVERSE_PROXY_WHITELIST` must only contain the reverse proxy's IP — ArchiveBox fully trusts this range for authentication - ArchiveBox does not natively support SAML/OAuth2/OpenID; oauth2-proxy bridges this gap by converting OIDC to reverse proxy headers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ops/homelab#101

No description provided.

Rows
Columns