nzbget with authelia and NZB360/NZBDonkey

[grasshide]

Hey, this took me a while to figure out, so I wanted to just leave this here.

My goal was to use nzbget with NZB360 (https://nzb360.com/) and NZBDonkey (https://github.com/Tensai75/NZBDonkey) without having nzbget exposed directly to the internet, but rather keep authelia for extra protection as middleware.

Here is my simplified docker-compose with traefik labels:

services:
  nzbget:
    image: linuxserver/nzbget
    …
    labels:
      - traefik.enable=true
      - traefik.http.routers.nzbget.entrypoints=https
      - traefik.http.routers.nzbget.rule=Host(`nzbget.example.com`)
      - traefik.http.routers.nzbget.middlewares=authelia@docker
      - traefik.http.services.nzbget.loadbalancer.server.port=6789

And here is the important part of the authelia config:

access_control:
  default_policy: deny
  rules:
    # NZBGet bypass for NZBDonkey and NZB360
    - domain:
        - nzbget.example.com
      policy: bypass
      resources:
        # NZBDonkey uses jsonrpc
        # NZB360 uses xmlrpc
        - "^/(?:jsonrpc|xmlrpc)"

So whenever nzbget.example.com is accessed via browser, authelia will ask for whatever authentication is configured there (e.g. two-factor authentication).
If any of the two apps call nzbget.example.com, they bypass the authelia page.

Note that the nzbget basic authentication is still in place for both of the above mentioned calls. I haven't figured out how to add a basic authentication request header in authelia. But I don't mind the additional login.

[dnzbk]

Thanks, very useful.