Update Reverse Proxy Documentation due to CORS Changes in PR #1450

[luckylinux]

Is there an existing issue for this?

• I have searched the existing open and closed issues

What document or section does this relate to?

Reverse Proxy Documentation needs to be updated due to changes made in #1450

Outside Access is now only allowed on Port 20211 (originally WebUI) while previous Access to GraphQL Endpoint via Port 20212 is only allowed now via Port 20211 on a /server/ Sub-Path.

Everything impacted in REVERSE_PROXY.md needs to be updated accordingly.

Describe the issue

Reverse Proxy Documentation needs to be updated due to changes made in #1450

Your suggestion or proposed solution

Quick Changes in the Flow Diagram

Everything else needs to be updated accordingly, including but not limited to:

• Flow Description: Change Port 20212 to Port 20211 with /server/ Path
• Caddyfile: Remove Port 20212 -> 20219 reverse_proxy Directive
• Firewall: Remove Port 20212 Rule
• BACKEND_API_URL to be updated accordingly
• (anything else - I will try to add here if/when I see it)

It seems "only" my Recent new Addition (Caddy + Authentik) had this Access to/via GraphQL API, so it seems the other Instructions (e.g. nginx or traefik) don't need to be updated due to this change.

As said previously though I believe the nginx Instructions are very deprecated anyways.

What type of issue is this?

• Missing information
• Inaccurate or outdated information
• Unclear or confusing content
• Structure or organization improvements
• Other (explain in issue)

Anything else?

No response

Can I help implement this? 👩‍💻👨‍💻

• Yes, I’d like to help implement the improvement
• No, I’m just suggesting the idea

[luckylinux]

@adamoutler: one big Change, which can be a good or bad Thing depending how you look at it (better Security, but unsure about external unattended Access via Authentik SSO, I never tried it so far) is that now BOTH "old" Endpoints (WebUI + GraphQL) will be authenticated.

It should work via authentik as I mentioned in one of the previous Issues/PR via the Applications Tokens or the "other Way" (too tired to remember right now), but have you considered it ?

In case Authentik SSO is enabled and we have a single EXTERNAL Endpoint (Port 20211 via NGINX, in my Case Reverse-Proxied via Caddy on Port 443), then EVERYTHING will need to be authenticated.

As I said, in Terms of Security this will be better (and it shouldn't have an Impact via Browser Access), but just a point to check for what concerns unattended Access (curl, Python requests, etc).

[adamoutler]

That's a good point. We won't be turning off 20212. But the method of disablement will be to restrict it from 0.0.0.0 to 127.0.0.1 eventually. Maybe an in-app setting or just a docker compose could be used to disable. Either way we would need to figure out how to disable 20212 externally. This is really for enabling those who use proxies and simplifying access.

[jokob-sk]

HI @luckylinux - please submit a PR if you can.

[luckylinux]

@jokob-sk: I cannot make it with the 48 Hours Deadline mentioned when opening this Issue.

Earliest I can do is somewhere next Week (hopefully).

It would be good however to have some Feedback about the Flow Diagram from @jokob-sk and @adamoutler first though.

According to what @adamoutler said though, I could actually put back Port 8443 or whatever for direct external access (Option) to GraphQL Endpoint, which would ALSO be available via /server though.

Not sure if it would be better to be "more complete" or to be "simpler" though 😕.

[jokob-sk]

All good - I can wait longer @luckylinux - I don't use this setup so leaning on the community to provide the docs.

[jokob-sk]

New Release and no activity for a week -> Closing