# Storing & Forwarding "HTTP Basic Credentials" for Sonarr/Radarr/\*arr in Authentik and Traefik 3 on Unraid

**URL:** <https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356>\
**Category:** Guides & Tutorials\
**Tags:** unraid, traefik\
**Created:** [November 5, 2024, 9:09am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356 "2024-11-05T09:09:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alextrical](https://forum.hhf.technology/user_avatar/forum.hhf.technology/alextrical/32/523_2.png) [@alextrical](https://forum.hhf.technology/u/alextrical)\
**Post date:** [November 5, 2024, 9:09am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356/1 "2024-11-05T09:09:40Z")

</div>

A short guide to get Sonarr and Radarr working to pass “HTTP Basic credentials” working on my Unraid setup.

Asuming your setup was following the [Traefik Forward Auth - Single Applications](https://docs.ibracorp.io/authentik/authentik/unraid/traefik-forward-auth-single-applications) guide

the middleware in “fileConfig.yml” needs to be ammended to have “authorization” at the end of authResponseHeaders.

```auto
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version
          - authorization

```

Authentication setup was using [this guide](https://docs.goauthentik.io/integrations/services/sonarr/)

the second missing setp for me was adding group access to the application.

On the Admin page, under Applications\>Applications, click the Application name (NOT Edit)

 ![image](https://forum-cdn.hhf.technology/original/1X/58356e45fe8fcfe2ea7453c1c873028de4086ad1.png)  
Select “Policy/Group/User Bindings” tab

then “Bind exisiting policy/group/user” and select the group you created earlier containing your Radarr Users

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [November 5, 2024, 9:10am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356/2 "2024-11-05T09:10:19Z")

</div>

thanks for sharing the updates.

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [November 5, 2024, 9:14am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356/3 "2024-11-05T09:14:36Z")

</div>

To configure multiple middlewares in Traefik on Unraid, you can use a **chain middleware** approach.  
@alextrical

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [November 5, 2024, 9:49am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356/4 "2024-11-05T09:49:44Z")

</div>

To combine multiple middlewares in Traefik, you can use the **chain middleware** feature. This allows you to apply multiple middleware configurations to a single router.

## Syntax for Combining Multiple Middlewares

1. **Define Each Middleware** : First, define each middleware separately using labels in your Docker configuration. For example:

2. **Create a Chain Middleware** : Then, create a new chain middleware that includes the individual middlewares you want to combine. Use a comma to separate them:

3. **Apply the Chain Middleware to a Router** : Finally, apply this chain middleware to your router:

## Example Configuration

Here’s an example of how this might look in a Docker Compose file:

```yaml
version: '3'

services:
  my-service:
    image: my-image
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.my-router.rule=Host(`example.com`)"
      - "traefik.http.middlewares.auth.basicauth.users=user:password"
      - "traefik.http.middlewares.theme.customheader.X-Theme=dark"
      - "traefik.http.middlewares.my-chain.chain.middlewares=auth@file,theme@file"
      - "traefik.http.routers.my-router.middlewares=my-chain@file"

```

## Key Points

- **Comma Separation** : Ensure that you separate multiple middlewares with a comma within the chain definition.
- **Unique Names** : Each middleware should have a unique name to avoid conflicts.
- **Testing** : After setting up, verify that all middlewares are functioning correctly by checking the Traefik dashboard.

---

<div class="post-metadata">

**Author:** ![hhf.technoloy](https://forum.hhf.technology/user_avatar/forum.hhf.technology/hhf.technoloy/32/68_2.png) [@hhf.technoloy](https://forum.hhf.technology/u/hhf.technoloy)\
**Post date:** [November 5, 2024, 9:52am UTC](https://forum.hhf.technology/t/storing-forwarding-http-basic-credentials-for-sonarr-radarr-arr-in-authentik-and-traefik-3-on-unraid/356/5 "2024-11-05T09:52:36Z")

</div>

To set up Traefik to allow internal-only access to certain sites, you can use the IPWhitelist middleware (now known as IPAllowList). This middleware allows you to limit access based on client IP addresses.

1. **Define the IPAllowList Middleware** : Create a dynamic configuration file (e.g., `dynamic.yaml`) and define the IPAllowList middleware with the allowed IP ranges.

```yaml
http:
  middlewares:
    internal-only:
      ipAllowList:
        sourceRange:
          - "192.168.0.0/16" # Replace with your internal IP range
          - "10.0.0.0/8" # Replace with your internal IP range

```

1. **Apply the Middleware to Your Routers** : In your `docker-compose.yml` or Traefik configuration file, apply the middleware to the routers for the services you want to restrict to internal access.

```yaml
services:
  code:
    labels:
      - "traefik.http.routers.code.rule=Host(`code.domain.tld`)"
      - "traefik.http.routers.code.entrypoints=web"
      - "traefik.http.routers.code.middlewares=internal-only@file"

  traefik:
    labels:
      - "traefik.http.routers.traefik.rule=Host(`traefik.domain.tld`)"
      - "traefik.http.routers.traefik.entrypoints=web"
      - "traefik.http.routers.traefik.middlewares=internal-only@file"

  mariadb:
    labels:
      - "traefik.http.routers.mariadb.rule=Host(`mariadb.domain.tld`)"
      - "traefik.http.routers.mariadb.entrypoints=web"
      - "traefik.http.routers.mariadb.middlewares=internal-only@file"

```

1. **Mount the Dynamic Configuration File** : Ensure that the dynamic configuration file is mounted in your Traefik container.

```yaml
services:
  traefik:
    volumes:
      - "./dynamic.yaml:/etc/traefik/dynamic.yaml"

```

1. **Update Your Traefik Configuration** : Update your Traefik static configuration to include the dynamic configuration file.

```yaml
providers:
  file:
    filename: /etc/traefik/dynamic.yaml

```