Issues with caddy as reverse proxy

[Mirodin]

For some time I am trying to use Caddy as my reverse proxy server for a radicale docker container. Since there are only example configs for Apache and Nginx I tried to adapt those to caddy. However when I have following config file I get a HTTP Basic Auth request: Radicale - Password Required and after entering my credentials Radicale flashes me Access to the requested resource forbidden.

proxy /radicale radicale:5232/ {
  header_upstream X-Script-Name /radicale
  transparent
}

Documentation says the server has to remove location from the path but adding a without directive causes Caddy to throw a 404 on me as there is no location /.web.

proxy /radicale radicale:5232/ {
  header_upstream X-Script-Name /radicale
  transparent
  without /radicale
}

[skorokithakis]

This stanza worked for me when I was using auth in Caddy (I now switched to using Radicale auth):

proxy / http://localhost:5232/ {
    header_upstream Authorization "{>Authorization}"
    header_upstream X-remote-user "{user}"
    transparent
}

[Mirodin]

Thanks for your hint but unfortunately this still does not work as I serve Radicale via a location /radicale which it seems to interprete even though I pass the X-Script-Name header down. So I still get the Access to the requested resource forbidden response.

[skorokithakis]

Oh, I think you need to rewrite the URL to remove that path component.

[Mirodin]

Well if I rewrite the URL the proxy part would not trigger anymore if I am not mistaken as it will match against the rewritten URL. The easiest solution would be for Radicale to support some "baseurl" but I could not find anything in the documentation.
My poor man's rewrite was the without directive from above which had said effect. Did not expect for Radicale to be that stubborn as I had good experience for years :(

[skorokithakis]

My experience with Radicale is that it works very well if you can get it working, but that it takes many hours of effort to do that. I think your best bet would be to rewrite the URL while sending upstream, it shouldn't match the rewritten URL if you do it after the match has occurred.

[Mirodin]

I think your best bet would be to rewrite the URL while sending upstream, it shouldn't match the rewritten URL if you do it after the match has occurred.

I am not sure I quite understand what you mean. I can not rewrite the URL after a proxy triggers, can I? How would caddy know to add the /radicale part to a response (especially the body)?

[skorokithakis]

Ahh, that's what you meant. Sorry, I thought you needed to strip the /radicale part from the URL you sent upstream. I agree, this would need a Radicale change...

[A6GibKm]

I am unable to make any of these work with 2.0. I am trying with

:80/radicale/ {
        reverse_proxy localhost:5232 {
                      header_up X-Script-Name /radicale
                      header_up Host {http.reverse_proxy.upstream.hostport}
                      header_up Authorization "{>Authorization}"
                      header_up X-remote-user "{user}" 
                    } 
}

[A6GibKm]

:80 {
        redir /radicale /radicale/

        handle /radicale/* {
                uri strip_prefix /radicale

        basicauth {
            USER PASSWORD_HASH
        }

        reverse_proxy localhost:5232 {
                        header_up X-Script-Name /radicale
                }
}

Does the work for me.

[pbiering]

looks like fixed since long time