Site custom configuration for Lazytainer, Webtop, Authentik, and NGINX assistance request [SOLVED] #5721

karmadelic702 · 2026-07-19T17:32:45Z

karmadelic702
Jul 19, 2026

Hi! I'm requesting some assistance as I'm struggling to get my NGINX code to function. I've spent a few days trying to figure this out and any assistance or suggestions are appreciated in advance.

Background:
Servers:

Host server is MacOS.
NGINX, Authentik, Webtop, and Lazytainer all operate within Docker containers.
All docker containers can successfully communicate with each other and with the host machine.
Both sets of code provided below work correctly on their own.

What I'm trying to accomplish:
I am stuck trying to figure out how to combine the two below sets of code and/or create a similar solution which hits the Lazytainer with packets until it wakes up and then authenticates the user with Authentik.

I have several Webtop containers that I do not want to run all the time as they will consume too much resources on my server.
I incorporated Lazytainer into my stack. This will automatically start and stop my Webtop container based upon network traffic.
Lazytainer usually takes about 5 packets to wake up a given user's Webtop container.
I wrote a script that refreshes and provides a loading message to the user. It refreshes every second until the container loads.

# 1. Intercept the 502/504 errors
error_page 502 504 =200 @refresh_page;

# 2. Define the behavior when a 502 occurs
location @refresh_page {
    return 200 '<!DOCTYPE html>
    <html>
    <head>
        <title>Waking up container...</title>
        <meta http-equiv="refresh" content="1">
        <style>
            body { font-family: sans-serif; text-align: center; padding-top: 50px; background: #1a1a1a; color: #fff; }
            .spinner { border: 4px solid rgba(255,255,255,0.1); width: 36px; height: 36px; border-radius: 50%; border-left-color: #09f; animation: spin 1s linear infinite; margin: 20px auto; }
            @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } }
        </style>
    </head>
    <body>
        <div class="spinner"></div>
        <h2>Application is starting up...</h2>
        <p>Lazytainer is waking up the remote environment. This page will auto-refresh to wake up the remote environment.</p>
    </body>
    </html>';
    
    add_header Content-Type text/html;
}

I want my Lazytainer containers to be secure. I used Authentik for prompting for user authentication for insecure pages prior to loading the page.

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# Make sure not to redirect traffic to a port 4443
port_in_redirect off;

location / {
    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;
    # Set any other headers your application might need
    # proxy_set_header Host $host;
    # proxy_set_header ...
    # Support for websocket
        # Correct external host/URL forwarding (required for Sonarr v4)
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    ##############################
    # authentik-specific config
    ##############################
    auth_request     /outpost.goauthentik.io/auth/nginx;
    error_page       401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header       Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-entitlements $authentik_entitlements;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;

    # This section should be uncommented when the "Send HTTP Basic authentication" option
    # is enabled in the proxy provider
    # auth_request_set $authentik_auth $upstream_http_authorization;
    # proxy_set_header Authorization $authentik_auth;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    # When using the embedded outpost, use:
    proxy_pass              http://authentik-server-1:9000/outpost.goauthentik.io;
    # For manual outpost deployments:
    # proxy_pass              http://outpost.company:9000;

    # Note: ensure the Host header matches your external authentik URL:
    proxy_set_header        Host $host;

    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;

}

Both of these codes work correctly when used separately. I'm trying to figure out how to combine them so that NGINX proxy manager can determine if the site is up, hit the site with packets so that the container wakes up, and finally require authentication.

karmadelic702 · 2026-07-19T23:30:13Z

karmadelic702
Jul 19, 2026
Author

Hi again. It's nice to troubleshoot the hell out of something and figure out a solution. :)

I resolved this by not trying to combine the two scripts.

To my site, I added a custom location with the following properties:

Location: /lazytainer-waking.html
scheme: http
forward hostname/IP: 127.0.0.1
Port: 80

Custom code added to location:

internal;

default_type text/html;

return 200 '
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="refresh" content="2">

<title>Starting Webtop</title>

<style>
body {
background:#111;
color:white;
font-family:Arial;
text-align:center;
padding-top:80px;
}

.spinner {
margin:auto;
width:40px;
height:40px;
border:5px solid #333;
border-top-color:#09f;
border-radius:50%;
animation:spin 1s linear infinite;
}

@keyframes spin {
100% {
transform:rotate(360deg);
}
}
</style>

</head>

<body>

<div class="spinner"></div>

<h2>Starting your desktop...</h2>

<p>Lazytainer is waking Webtop.</p>

</body>
</html>';

Add custom code to my site:

# Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;

# Make sure not to redirect traffic to a port 4443
port_in_redirect off;

location / {



    **error_page 502 504 =200 /lazytainer-waking.html;**

    # Put your proxy_pass to your application here
    proxy_pass          $forward_scheme://$server:$port;
    # Set any other headers your application might need
    # proxy_set_header Host $host;
    # proxy_set_header ...
    # Support for websocket
        # Correct external host/URL forwarding (required for Sonarr v4)
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

    ##############################
    # authentik-specific config
    ##############################
    auth_request     /outpost.goauthentik.io/auth/nginx;
    error_page       401 = @goauthentik_proxy_signin;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header       Set-Cookie $auth_cookie;

    # translate headers from the outposts back to the actual upstream
    auth_request_set $authentik_username $upstream_http_x_authentik_username;
    auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
    auth_request_set $authentik_entitlements $upstream_http_x_authentik_entitlements;
    auth_request_set $authentik_email $upstream_http_x_authentik_email;
    auth_request_set $authentik_name $upstream_http_x_authentik_name;
    auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

    proxy_set_header X-authentik-username $authentik_username;
    proxy_set_header X-authentik-groups $authentik_groups;
    proxy_set_header X-authentik-entitlements $authentik_entitlements;
    proxy_set_header X-authentik-email $authentik_email;
    proxy_set_header X-authentik-name $authentik_name;
    proxy_set_header X-authentik-uid $authentik_uid;

    # This section should be uncommented when the "Send HTTP Basic authentication" option
    # is enabled in the proxy provider
    # auth_request_set $authentik_auth $upstream_http_authorization;
    # proxy_set_header Authorization $authentik_auth;
}

# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
    # When using the embedded outpost, use:
    proxy_pass              http://authentik-server-1:9000/outpost.goauthentik.io;
    # For manual outpost deployments:
    # proxy_pass              http://outpost.company:9000;

    # Note: ensure the Host header matches your external authentik URL:
    proxy_set_header        Host $host;

    proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
    add_header              Set-Cookie $auth_cookie;
    auth_request_set        $auth_cookie $upstream_http_set_cookie;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
}

# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
    internal;
    add_header Set-Cookie $auth_cookie;
    return 302 /outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
    # For domain level, use the below error_page to redirect to your authentik server with the full redirect path
    # return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;

}

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Site custom configuration for Lazytainer, Webtop, Authentik, and NGINX assistance request [SOLVED] #5721

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Site custom configuration for Lazytainer, Webtop, Authentik, and NGINX assistance request [SOLVED] #5721

Uh oh!

karmadelic702 Jul 19, 2026

Replies: 1 comment

Uh oh!

karmadelic702 Jul 19, 2026 Author

karmadelic702
Jul 19, 2026

karmadelic702
Jul 19, 2026
Author