NGiNX as reverse proxy and bcrypt

[lsergei]

According to documentation, Radicale supports plain auth (which is highly insecure) or bcrypt-ed passwords. NGiNX doesn't support bcrypt-ed passwords, therefore I can't use the same passwords file for nginx and Radicale.

[felixfontein]

By using auth type http_x_remote_user, there's no need to give Radicale any passwords at all. With that you only need to set up authentication for nginx, and only need one password file (for nginx).

[lsergei]

I see now, thank you for the hint :) Works properly now.

Another problem - I can't figure out why NGiNX returns blank page. Browser is redirected properly to /.web, but only blank page is shown. No errors on nginx.

Radicale web interface works properly, if accessed directly.

[felixfontein]

I haven't used the web interface, so I'm not sure I can help with it. Is it accepting connections from everywhere, i.e. could it be that it doesn't accept connections from the address/port nginx is using to connect to it? And what do the nginx logs say? And do you see something in the Radicale logs?

[MacLemon]

Looks more like a support request than a bug report.

For the record: I'm running Radicale 2.1.8 behind nginx 1.13.9 configured as reverse proxy. Radicale is doing the authentication and is using bcrypted passwords to store credentials in the backend. This works properly with my client applications. (Mostly macOS and iOS.)

@lsergei Could you maybe post your nginx server{} context?

[djmattyg007]

Radicale supports plain auth (which is highly insecure)

This is only the case if you're transmitting the credentials over insecure HTTP. I highly recommend using HTTPS for your radicale server - all personal information should always be transmitted only over secure channels.

[AiyionPrime]

Wow, this took me a while to figure out -.-'

[DavidKi]

Hi there,

I know this is quite an old thread, but perhaps still active?

I've installed radicale 2.1 and configured it with nginx. Authentication is done by radicale with bcrypt. But this leads to an 401 Error in the WebUI, no matter with what account I login.
When setting the encryption method in radicale/config to md5 it is working.

@MacLemon could you describe in detail how you set up radicale with nginx and bcrypt?

I'm on raspberrypi with rasbian stretch and nginx 1.10.3

(Part of) NGINX-Config:

location / {
            proxy_pass         http://localhost:5232/;
             proxy_pass_header Authorization;
            access_log      /var/log/nginx/radicale.access.log;
            error_log       /var/log/nginx/radicale.error.log;
        }

location /radicale/ {
                proxy_set_header  X-Script-Name /radicale;
                proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_pass_header Authorization;
                proxy_pass       http://localhost:5232/;
        }

If radicale+bcrypt+nginx is not working a note in the docs would be helpful!

[pbiering]

still existing with latest 3.1.x? If not, please close this issue.