Vaultwarden behind traefik

Question

For the 'demonstration' I'm using that 'all-in-one' file with nginx proxy

version: "3.9"

services:

    proxy:
        image: nginx:latest
        container_name: proxy
        restart: always
        ports:
            - "80:80"
        environment:
            - TZ=Europe/Brussels
        volumes:
            - ./config/nginx.conf:/etc/nginx/nginx.conf:ro
            - ./config/conf.d:/etc/nginx/conf.d:ro
        networks:
            - proxy

    vaultwarden:
        image: vaultwarden/server:latest
        container_name: vaultwarden
        restart: unless-stopped
        environment:
            - LOG_LEVEL=debug
        volumes:
            - "data:/data/"
        networks:
           - proxy

volumes:
    data:
networks:
    proxy:
        name: proxy_network

and

server {
    listen 80;
    server_name 127.0.0.1;

    resolver 127.0.0.11;

    set $vaultwarden_upstream vaultwarden;
    location /vaultwarden/ {
        rewrite ^/vaultwarden/(.*) /$1 break;
        proxy_pass http://$vaultwarden_upstream;

    }

}

It is working fine. In my browser I can go to http://127.0.0.1/vaultwarden ans see the login page. In the logs I can see

172.28.0.1 - - [08/Jan/2023:18:15:42 +0100] "127.0.0.1" "GET /vaultwarden/ HTTP/1.1" 200 628 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" "-"
172.28.0.1 - - [08/Jan/2023:18:15:42 +0100] "127.0.0.1" "GET /vaultwarden/theme_head.5f24ba8d7aa944e6f52b.js HTTP/1.1" 200 474 "http://127.0.0.1/vaultwarden/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" "-"
...

and

[2023-01-08 17:15:42.693][request][INFO] GET /
[2023-01-08 17:15:42.693][response][INFO] (web_index) GET / => 200 OK
[2023-01-08 17:15:42.706][request][INFO] GET /theme_head.5f24ba8d7aa944e6f52b.js
...

Now I'm trying to migrate to traefik

version: "3.9"

services:

    proxy:
        image: traefik:v2.9
        container_name: proxy
        restart: unless-stopped
        command:
            - "--accesslog=true"
            - "--log.level=INFO"
            - "--api.insecure=true"
            - "--entrypoints.web.address=:80"
            - "--providers.docker=true"
            - "--providers.docker.network=proxy_network"
            - "--providers.docker.exposedbydefault=false"
        ports:
            - 80:80
            - 8080:8080
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        networks:
            - proxy

    vaultwarden:
        image: vaultwarden/server:latest
        container_name: vaultwarden
        restart: unless-stopped
        environment:
            - LOG_LEVEL=debug
        labels:
            - "traefik.enable=true"
            - "traefik.http.services.vaultwarden-service.loadbalancer.server.port=80"
            - "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"
            - "traefik.http.routers.vaultwarden.entrypoints=web"
            - "traefik.http.routers.vaultwarden.rule=PathPrefix(`/vaultwarden`)"
            - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-strip-prefix@docker"
            - "traefik.http.routers.vaultwarden.service=vaultwarden-service"
        volumes:
            - "data:/data/"
        networks:
           - proxy

volumes:
    data:
networks:
    proxy:
        name: proxy_network

But it is not working anymore.

In the logs

172.30.0.1 - - [08/Jan/2023:17:36:01 +0000] "GET /vaultwarden HTTP/1.1" 200 1240 "-" "-" 105 "vaultwarden@docker" "http://172.30.0.2:80" 1ms
172.30.0.1 - - [08/Jan/2023:17:36:01 +0000] "GET /theme_head.5f24ba8d7aa944e6f52b.js HTTP/1.1" 404 19 "-" "-" 106 "-" "-" 0ms
...

and

[2023-01-08 17:36:01.836][request][INFO] GET /
[2023-01-08 17:36:01.836][response][INFO] (web_index) GET / => 200 OK
...

Of course nothing more in the traefik log because the GET on /theme_head.5f24ba8d7aa944e6f52b.js is not redirected to the container.

Why such a difference? Why the /vaultwarden seems to be removed from the second (and all followings) GET?

I don't understand. What am I missing?

edit

With http://127.0.0.1/vaultwarden it is not working, with http://127.0.0.1/vaultwarden/

I also tried replacing vaultwarden image with other ones

image: containous/whoami

or

image: portainer/portainer-ce

And it is always working. Both with http://127.0.0.1/vaultwarden and http://127.0.0.1/vaultwarden/

But if vaultwarden is working with nginx, why it's not working with traefik without adding a trailing /?

Answer 1

The easiest way to solve this is to add the trailing slash by redirecting requests for /vaultwarden to /vaultwarden/ . We can do that with the redirectregex middleware.

The specific set of rules look like this:

- "traefik.http.routers.vaultwarden.middlewares=vaultwarden-add-slash,vaultwarden-strip-prefix"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.regex=/vaultwarden$$"
- "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.replacement=/vaultwarden/"
- "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"

Here's a complete configuration that I used for testing:

services:
    proxy:
        image: traefik:v2.9
        container_name: proxy
        restart: unless-stopped
        command:
            - "--accesslog=true"
            - "--log.level=INFO"
            - "--api.insecure=true"
            - "--entrypoints.web.address=:80"
            - "--providers.docker=true"
            - "--providers.docker.network=proxy_network"
            - "--providers.docker.exposedbydefault=false"
        ports:
          - 80:80
          - 8080:8080
        volumes:
          - /var/run/docker.sock:/var/run/docker.sock
        networks:
          - proxy

    vaultwarden:
        image: vaultwarden/server:latest
        container_name: vaultwarden
        restart: unless-stopped
        environment:
            - LOG_LEVEL=debug
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.vaultwarden.entrypoints=web"
            - "traefik.http.routers.vaultwarden.rule=PathPrefix(`/vaultwarden`)"
            - "traefik.http.routers.vaultwarden.middlewares=vaultwarden-add-slash,vaultwarden-strip-prefix"
            - "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.regex=/vaultwarden$$"
            - "traefik.http.middlewares.vaultwarden-add-slash.redirectregex.replacement=/vaultwarden/"
            - "traefik.http.middlewares.vaultwarden-strip-prefix.stripprefix.prefixes=/vaultwarden"
        volumes:
            - "data:/data/"
        networks:
           - proxy

volumes:
    data:
networks:
    proxy:
        name: proxy_network

You're probably already aware of this, but it caught me by surprise: there is a healthcheck set on the vaultwarden image, so it takes a minute or so before it becomes "healthy". Traefik won't forward traffic to the container until it is healthy.