Caddy basic auth only from wan

[at3]

I don't know if anyone is able to help me.

I'm using caddy as reverse proxy. This works fine.
Only 1 issue I have is: I can enable basic auth. But this is for all ip's

I want to do basic auth only from wan and not from local ip's
I know this is possible but I can't figure out how to implement this in caddy in Opnsense.
It's not possible in the gui and I don't want to edit the Caddyfile because of upgrade persistence.

I can use extra imported .conf files but I don't understand any of that. I tried to use a .conf file and it just adds it to the bottom of the caddyfile so I cannot edit(?) a host entry already in the Caddyfile.

[Monviech (Cedrik)]

It would probably make more sense to use forward auth if you need to realize complex authentication scenarios, its offered for exactly that reason.

Another solution is that the reverse proxied app itself handles authentication.

A third solution is using two domains, one has the access list for only internal requests, the other basuc auth for external requests. Both have a handler pointing to the same internal upstream. External users would then use the external domain name.

The GUI can only do simple access lists and basic auth for all requests.

Making it more complex is not the goal of the plugin.

[at3]

Thanks for your help.
I went with the Authelia forward auth and this works like a charm.

This topic can be closed