Vaultwarden behind traefik - reverse-proxy

Question

For the 'demonstration' I'm using that 'all-in-one' file with nginx proxy
version: "3.9"
services:
proxy:
image: nginx:latest
container_name: proxy
restart: always
ports:
- "80:80"
environment:
- TZ=Europe/Brussels
volumes:
- ./config/nginx.conf:/etc/nginx/nginx.conf:ro
- ./config/conf.d:/etc/nginx/conf.d:ro
networks:
- proxy
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
- LOG_LEVEL=debug
volumes:
- "data:/data/"
networks:
- proxy
volumes:
data:
networks:
proxy:
name: proxy_network
and
server {
listen 80;
server_name 127.0.0.1;
resolver 127.0.0.11;
set $vaultwarden_upstream vaultwarden;
location /vaultwarden/ {
rewrite ^/vaultwarden/(.*) /$1 break;
proxy_pass http://$vaultwarden_upstream;
}
}
It is working fine. In my browser I can go to http://127.0.0.1/vaultwarden ans see the login page.
In the logs I can see
172.28.0.1 - - [08/Jan/2023:18:15:42 +0100] "127.0.0.1" "GET /vaultwarden/ HTTP/1.1" 200 628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" "-"
172.28.0.1 - - [08/Jan/2023:18:15:42 +0100] "127.0.0.1" "GET /vaultwarden/theme_head.5f24ba8d7aa944e6f52b.js HTTP/1.1" 200 474 "http://127.0.0.1/vaultwarden/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" "-"
...
and
[2023-01-08 17:15:42.693][request][INFO] GET /
[2023-01-08 17:15:42.693][response][INFO] (web_index) GET / => 200 OK
[2023-01-08 17:15:42.706][request][INFO] GET /theme_head.5f24ba8d7aa944e6f52b.js
...
Now I'm trying to migrate to traefik
version: "3.9"
services:
proxy:
image: traefik:v2.9
container_name: proxy
restart: unless-stopped
command:
- "--accesslog=true"
- "--log.level=INFO"
- "--api.insecure=true"
- "--entrypoints.web.address=:80"
- "--providers.docker=true"
- "--providers.docker.network=proxy_network"
- "--providers.docker.exposedbydefault=false"
ports:
- 80:80
- 8080:8080
volumes:
- /var/run/docker.sock:/var/run/docker.sock
networks:
- proxy
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
- LOG_LEVEL=debug
labels:
- "traefik.enable=true"
- "traefik.http.services.vaultwarden-service.loadbalancer.server.port=80"
- "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"
- "traefik.http.routers.vaultwarden.entrypoints=web"
- "traefik.http.routers.vaultwarden.rule=PathPrefix(`/vaultwarden`)"
- "traefik.http.routers.vaultwarden.middlewares=vaultwarden-strip-prefix#docker"
- "traefik.http.routers.vaultwarden.service=vaultwarden-service"
volumes:
- "data:/data/"
networks:
- proxy
volumes:
data:
networks:
proxy:
name: proxy_network
But it is not working anymore.
In the logs
172.30.0.1 - - [08/Jan/2023:17:36:01 +0000] "GET /vaultwarden HTTP/1.1" 200 1240 "-" "-" 105 "vaultwarden#docker" "http://172.30.0.2:80" 1ms
172.30.0.1 - - [08/Jan/2023:17:36:01 +0000] "GET /theme_head.5f24ba8d7aa944e6f52b.js HTTP/1.1" 404 19 "-" "-" 106 "-" "-" 0ms
...
and
[2023-01-08 17:36:01.836][request][INFO] GET /
[2023-01-08 17:36:01.836][response][INFO] (web_index) GET / => 200 OK
...
Of course nothing more in the traefik log because the GET on /theme_head.5f24ba8d7aa944e6f52b.js is not redirected to the container.
Why such a difference ? Why the /vaultwarden seems to be removed from the second (and all followings) GET ?
I don't understand. What am I missing ?
edit
With http://127.0.0.1/vaultwarden it is not working, with http://127.0.0.1/vaultwarden/
I also tried replacing vaultwarden image with other ones
image: containous/whoami
or
image: portainer/portainer-ce
And it is always working. Both with http://127.0.0.1/vaultwarden and http://127.0.0.1/vaultwarden/
But if vaultwarden is working with nginx, why it's not working with traefik without adding a trailing / ?

Answer 1

The easiest way to solve this is to add the trailing slash by redirecting requests for /vaultwarden to /vaultwarden/. We can do that with the redirectregex middleware.
The specific set of rules look like this:
- "traefik.http.routers.vaultwarden.middlewares=vaultwarden-add-slash,vaultwarden-strip-prefix"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.regex=/vaultwarden$$"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.replacement=/vaultwarden/"
- "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"
Here's a complete configuration that I used for testing:
services:
proxy:
image: traefik:v2.9
container_name: proxy
restart: unless-stopped
command:
- "--accesslog=true"
- "--log.level=INFO"
- "--api.insecure=true"
- "--entrypoints.web.address=:80"
- "--providers.docker=true"
- "--providers.docker.network=proxy_network"
- "--providers.docker.exposedbydefault=false"
ports:
- 80:80
- 8080:8080
volumes:
- /var/run/docker.sock:/var/run/docker.sock
networks:
- proxy
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
- LOG_LEVEL=debug
labels:
- "traefik.enable=true"
- "traefik.http.routers.vaultwarden.entrypoints=web"
- "traefik.http.routers.vaultwarden.rule=PathPrefix(`/vaultwarden`)"
- "traefik.http.routers.vaultwarden.middlewares=vaultwarden-add-slash,vaultwarden-strip-prefix"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.regex=/vaultwarden$$"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.replacement=/vaultwarden/"
- "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"
volumes:
- "data:/data/"
networks:
- proxy
volumes:
data:
networks:
proxy:
name: proxy_network
You're probably already aware of this, but it caught me by surprise: there is a healthcheck set on the vaultwarden image, so it takes a minute or so before it becomes "healthy". Traefik won't forward traffic to the container until it is healthy.