Traefik, authelia, kobosync

[tomdh76]

I am trying to use kobo sync with calibre web that is behind a traefik reverse proxy with authelia authentication. I followed this guide https://github.com/janeczku/calibre-web/wiki/Setup-Reverse-Proxy/#traefik--241-with-authelia-forward-auth.

When I do not use authelia I can sync normally. But with authelia I get a sync error. In the authelia docker I see

Access to https://calibre.xxx.com/kobo/xxxx/v1/initialization (method GET) is not authorized to user , responding with status code 401 with location redirect to https://authelia.xxx.com?=https%3A%2F%2Fcalibre.xxxx.comxxxx=GET" method=GET path=/api/verify remote_ip=xxxx

But the kobo does not display the login page of authelia of course. Is what I am trying to do even possible? I see something on the same wiki page that headers are used as authentication but the kobo is an anomymous user.

[OzzieIsaacs]

...but the kobo is an anomymous user.

I'm not sure if this is a statement or a question. The kobo sync is not done by anoymous user, the xxx string is used to identify the user, I think it is also saved in a cookie. So if this is not working you are missing/loosing some of the cookies/headers. You could debug this with e.g. wireshark and log the traffic between your proxy and calibre-web. Then you should be able to find the differences.

[tomdh76]

Thx for your answer. Yeah it was a question, maybe someone with a similar setup could point me to a right direction. Your point about cookies is probably the way to go. I will try using wireshark to see what is going on.

[tomdh76]

Maybe someone with a working setup could give their list in traefik what kind of headers are added.

[tomdh76]

I found the problem checking the headers.
There is one header named: X-Kobo-Synctoken which has above 3500 characters. Authelia by default has a read-buffer of 4096 bytes (authelia/authelia#518) so I got a 431 error code. By increasing the read-buffer to 10485760 (just a guess...) I can sync normally using Traefik and authelia (in Authelia I use a bypass for internal networks and going to try to bypass it using an api criterion)