Cannot connect to caldav server in Docker behind tunnel

[daniellwdb]

I am trying to set up opencloud and radicale by following this repo: https://github.com/opencloud-eu/opencloud-compose. Unfortunately I can't seem to authenticate for calendars.

These are logs from both radicale and opencloud after trying to log in to https://cloud.domain.dev/caldav/

opencloud  | {"level":"info","service":"auth-app","pkg":"rgrpc","traceid":"b27c72dadee669ae88ce38274d6a0024","time":"2026-05-22T11:57:51Z","line":"github.com/opencloud-eu/reva/v2@v2.29.5/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"https://cloud.domain.dev\" opaque_id:\"815c3b66-021c-4f24-949e-9043741c0781\" type:USER_TYPE_PRIMARY authenticated"}
radicale   | [2026-05-22 11:57:51 +0000] [1/Thread-203 (process_request_thread)] [INFO] PROPFIND request for '/caldav/' with depth '0' received from 172.25.0.13 using 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Thunderbird/150.0.2'
radicale   | [2026-05-22 11:57:51 +0000] [1/Thread-203 (process_request_thread)] [DEBUG] Request header:
radicale   |  {'CONTENT_LENGTH': '203',
radicale   |   'CONTENT_TYPE': 'text/xml; charset=utf-8',
radicale   |   'GATEWAY_INTERFACE': 'CGI/1.1',
radicale   |   'HTTP_ACCEPT': 'text/xml',
radicale   |   'HTTP_ACCEPT_CHARSET': 'utf-8,*;q=0.1',
radicale   |   'HTTP_ACCEPT_ENCODING': 'gzip, deflate, br, zstd',
radicale   |   'HTTP_ACCEPT_LANGUAGE': 'en-US,en;q=0.9',
radicale   |   'HTTP_AUTHORIZATION': 'Basic **masked**',
radicale   |   'HTTP_CACHE_CONTROL': 'no-cache',
radicale   |   'HTTP_DEPTH': '0',
radicale   |   'HTTP_HOST': 'cloud.domain.dev',
radicale   |   'HTTP_ORIGIN': 'https://cloud.domain.dev',
radicale   |   'HTTP_PRAGMA': 'no-cache',
radicale   |   'HTTP_PRIORITY': 'u=4',
radicale   |   'HTTP_SEC_FETCH_DEST': 'empty',
radicale   |   'HTTP_SEC_FETCH_MODE': 'no-cors',
radicale   |   'HTTP_SEC_FETCH_SITE': 'same-origin',
radicale   |   'HTTP_TE': 'trailers',
radicale   |   'HTTP_TRACEPARENT': '00-b27c72dadee669ae88ce38274d6a0024-24ecd47f4e6aedaf-00',
radicale   |   'HTTP_USER_AGENT': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) '
radicale   |                      'Gecko/20100101 Thunderbird/150.0.2',
radicale   |   'HTTP_X_ACCESS_TOKEN': '<TOKEN>',
radicale   |   'HTTP_X_FORWARDED_HOST': 'cloud.domain.dev',
radicale   |   'HTTP_X_FORWARDED_PORT': '443',
radicale   |   'HTTP_X_FORWARDED_PROTO': 'http',
radicale   |   'HTTP_X_FORWARDED_SERVER': 'de6d5d2fb8af',
radicale   |   'HTTP_X_REAL_IP': '<IP>',
radicale   |   'PATH_INFO': '/caldav/',
radicale   |   'QUERY_STRING': '',
radicale   |   'REMOTE_ADDR': '172.25.0.13',
radicale   |   'REMOTE_HOST': '',
radicale   |   'REQUEST_METHOD': 'PROPFIND',
radicale   |   'SCRIPT_NAME': '',
radicale   |   'SERVER_NAME': '914c414a309a',
radicale   |   'SERVER_PORT': '5232',
radicale   |   'SERVER_PROTOCOL': 'HTTP/1.1',
radicale   |   'SERVER_SOFTWARE': 'WSGIServer/0.2',
radicale   |   'wsgi.errors': <_io.TextIOWrapper name='<stderr>' mode='w' encoding='utf-8'>,
radicale   |   'wsgi.file_wrapper': <class 'wsgiref.util.FileWrapper'>,
radicale   |   'wsgi.input': <_io.BufferedReader name=7>,
radicale   |   'wsgi.multiprocess': False,
radicale   |   'wsgi.multithread': True,
radicale   |   'wsgi.run_once': False,
radicale   |   'wsgi.url_scheme': 'http',
radicale   |   'wsgi.version': (1, 0)}
radicale   | [2026-05-22 11:57:51 +0000] [1/Thread-203 (process_request_thread)] [DEBUG] Sanitized path: '/caldav/'
radicale   | [2026-05-22 11:57:51 +0000] [1/Thread-203 (process_request_thread)] [NOTICE] Access to '/caldav/' denied for anonymous user

Compose:

services:
  opencloud:
    # renovate: depName=opencloudeu/opencloud-rolling
    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-6.2.0}
    container_name: opencloud
    # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
    # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
    user: ${OC_CONTAINER_UID_GID:-1000:1000}
    networks:
      - proxy_net
    entrypoint:
      - /bin/sh
    # run opencloud init to initialize a configuration file with random secrets
    # it will fail on subsequent runs, because the config file already exists
    # therefore we ignore the error and then start the opencloud server
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      # enable services that are not started automatically
      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}${TRAEFIK_PORT_HTTPS:+:}${TRAEFIK_PORT_HTTPS:-}
      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
      # do not use SSL between the reverse proxy and OpenCloud
      PROXY_TLS: "false"
      # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
      OC_INSECURE: "${INSECURE:-false}"
      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
      # demo users
      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
      # admin password
      IDM_ADMIN_PASSWORD: "${INITIAL_ADMIN_PASSWORD}"
      # email server (if configured)
      NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
      NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
      NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud Notifications <notifications@cloud.opencloud.test>}"
      NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
      NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
      NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE:-false}"
      NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
      NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
      FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
      FRONTEND_CHECK_FOR_UPDATES: "${CHECK_FOR_UPDATES:-true}"
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      # enable to allow using the banned passwords list
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      # control the password enforcement and policy for public shares
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-false}"
      OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}"
      OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}"
      OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
      OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
      # default language for services/WebUI; defaults to English, language code (ISO 639-1, e.g. de, en, fr)
      OC_DEFAULT_LANGUAGE: ${DEFAULT_LANGUAGE}
    volumes:
      - ${OC_CONFIG_DIR}/csp.yaml:/etc/opencloud/csp.yaml
      - ${OC_CONFIG_DIR}/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
      - ${OC_APPS_DIR:-./config/opencloud/apps}:/var/lib/opencloud/web/assets/apps
      # external sites needs to have additional routes configured in the proxy
      - ${OC_CONFIG_DIR}/proxy.yaml:/etc/opencloud/proxy.yaml
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
  radicale:
    image: ${RADICALE_DOCKER_IMAGE:-opencloudeu/radicale}:${RADICALE_DOCKER_TAG:-latest}
    container_name: radicale
    user: ${OC_CONTAINER_UID_GID:-1000:1000}
    networks:
      - proxy_net
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always
    volumes:
      - ${RADICALE_CONFIG_DIR}/config:/etc/radicale/config
      - ${RADICALE_DATA_DIR:-radicale-data}:/var/lib/radicale 

networks:
  proxy_net:
    external: true

This is the tunnel configuration:
.

I think the logs indicate that the x-remote-user header couldn't be found so the user I logged in with in opencloud is lost when trying to reach radicale.

[pbiering]

Looks like the reverse proxy is configured to pass the the credentials to Radicale:

'HTTP_AUTHORIZATION': 'Basic **masked**',

Therefore the x-remote-user header will not be set by reverse proxy I assume.