Nginx proxy manager + Authelia + Sonarr/Radarr/Lidarr/Bazarr (websockets)

authelia+npm.md

When using Nginx proxy manager with Authelia (specifically the location block) the checkboxes under Details are ignored so we need to enable websockets manually where needed.

💡 On Unraid, I've placed the snippets in /mnt/user/appdata/NginxProxyManager/nginx/snippets

Advanced settings

# Authelia https://www.authelia.com/integration/proxies/nginx-proxy-manager/
include /config/nginx/snippets/authelia-location.conf;

location / {
    include /config/nginx/snippets/proxy.conf;
    include /config/nginx/snippets/authelia-authrequest.conf;
    include /config/nginx/snippets/hsts.conf;
    proxy_pass $forward_scheme://$server:$port;
}

location /sonarr {
    # Authelia https://www.authelia.com/integration/proxies/nginx-proxy-manager/
    include /config/nginx/snippets/proxy.conf;
    include /config/nginx/snippets/authelia-authrequest.conf;
    # Security Headers https://securityheaders.com/
    include /config/nginx/snippets/hsts.conf;
    proxy_pass http://sonarr:8989;
    # If you use "Basic auth" on the service, see below
    proxy_set_header Authorization "Basic dGVzdDp0ZXN0";
    # Upgrade websockets
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

Basic auth

If you want to enable basic auth on for example Sonarr, but not have to enter the credentials when Authelia is protecting access, we can set an Authorization header to send to the application. This would mean that no one can be on your local network and access your Sonarr instance.

You can generate the hash by running btoa("test:test123") in the browser console. This would mean the username is test and the password is test123. It has to match whatever you inputed into Sonarr.

hsts.conf

# From https://gist.github.com/R0GGER/916183fca41f02df1471a6f455e5869f
# HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
add_header Strict-Transport-Security "max-age=63072000; preload" always;
add_header Referrer-Policy strict-origin-when-cross-origin; 
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Frame-Options SAMEORIGIN;
add_header Content-Security-Policy upgrade-insecure-requests;
add_header Permissions-Policy interest-cohort=();
add_header Expect-CT 'enforce; max-age=604800';
more_set_headers 'Server: Proxy';
more_clear_headers 'X-Powered-By';