Configuring multi-user support for godoxy

[jerryjedi]

I’ve successfully installed and configured GoDoxy, and it works great. Now, I’d like to add multi-user support. Specifically to configure a user and grant them access to a particular application. I checked the documentation, it requires OIDC configuration and the installation of the Pocket-ID application, which seems a bit complex. Since my setup is for a small personal application, is there a simpler way to achieve this—perhaps via a configuration file?

[yusing]

I’m currently on my phone, so I’ll respond briefly and elaborate later.

Multi-user auth should be handled by the Identity Provider (IdP), not by GoDoxy.

You can configure allowed_users or allowed_groups to achieve this.

For instance, if OIDC is enabled globally, these overrides only apply to the specified route.

It's just one line like this: proxy.#1.middlewares.oidc.allowed_groups: me,friends

[yusing]

GoDoxy does not keep a user database. GODOXY_API_USER / GODOXY_API_PASSWORD is a single WebUI login, not per-app access.

Pocket ID is only an example in the docs. Any OpenID Connect provider works (Authentik, Authelia, Keycloak, Pocket ID, and similar). You need that provider so there is a real user identity. After that, granting access is one allow list on the route.

What you configure where

Place	Job
Identity provider	Create users and groups
GODOXY_OIDC_* in .env	Connect GoDoxy to that provider (issuer, client id/secret, default allow list)
Route labels / route file	Narrow who may use that app

Global OIDC env vars log people into the WebUI. They do not lock every proxied app. An app stays public until you put oidc on it, or on the entrypoint.

Grant one person (or group) one app

Username must match the ID token claim preferred_username. Groups must match the groups claim. Keep the groups scope enabled (it is in the default GODOXY_OIDC_SCOPES).

A user is allowed if they match either allowed_users or allowed_groups.

If a route sets only allowed_groups, empty allowed_users still inherits GODOXY_OIDC_ALLOWED_USERS. If you want the route list to be the whole rule, set both fields on the route, or keep the env user list empty and use groups.

Docker label (issuer and client inherit from .env):

labels:
  proxy.#1.middlewares.oidc.allowed_groups: me,friends

Or a YAML block:

labels:
  proxy.#1.middlewares.oidc: |
    allowed_users:
      - alice
    allowed_groups:
      - family

Route file:

photos:
  host: 192.168.1.20
  port: 8080
  middlewares:
    oidc:
      allowed_users:
        - alice
      allowed_groups:
        - family

At least one of allowed_users or allowed_groups must be non-empty after inheritance.

Two common layouts

1. Lock selected apps only

Leave the entrypoint open. Add oidc only on private apps, as above.

2. Lock everything, then carve out public apps

entrypoint:
  middlewares:
    - use: oidc
      bypass:
        - route pocket-id   # the IdP itself must stay reachable

A route that adds only bypass is merged into that entrypoint rule. A route that also sets allowed_users / allowed_groups is a second check: the visitor must pass the entrypoint list and the route list.

# public health endpoint on an otherwise private app
proxy.myapp.middlewares.oidc.bypass: |
  - path /health

If you want users in a file, not OIDC

Use forward auth to something like TinyAuth, and keep users there. GoDoxy still does not store those users.

OIDC callback to add in the provider:

https://*.yourdomain.com/auth/callback

The oidc middleware authenticates browser GETs. Other methods and WebSockets get 403 unless you add a bypass for those paths.

Docs: OIDC setup, OIDC middleware.