How to setup OIDC with dex from yunohost

[protonaut]

I like to setup HabitSync on https://habits.domain2.de via docker-compose with OIDC-Support from yunohost's dex-server which is installed in domain https://dex.domain1.de

My compose.yaml looks like this:

services:
web:
image: ghcr.io/jofoerster/habitsync:latest
environment:
- BASE_URL=https://habits.domains2.de/
- APP_SECURITY_ISSUERS_DEX_URL=https://dex.domain1.de/
- APP_SECURITY_ISSUERS_DEX_CLIENT-ID=habitsync
- APP_SECURITY_ISSUERS_DEX_NEEDS-CONFIRMATION=true # New users need to to be 'let in' by other user, default: true
- JWT_SECRET=v2G+DZTX7YCXf0ZWbmV5lSlX7yLiknU82WFR7aRzGBk=
volumes:
- /opt/synchabit:/data #optional for direct access to database, user 6842:6842 needs access
user: 6842:6842 # optional, run as user with id 6842, same as the application user in the container
ports:
- 6842:6842 # Application accessible under this port
- 9092:9092 # For database access, optional
networks: {}

Within dex I created habitsync

• id: habitsync
  redirectURIs:
  • https://habits.domain2.de/auth-callback
    name: habitsync
    secret: v2G+DZTX7YCXf0ZWbmV5lSlX7yLiknU82WFR7aRzGBk=

Unfortunately after starting the container changes to unhealthy.

When I enter the page https://habits.domains2.de I get a wordpress-Welcome Page without access-controll or any login.

The terminal says this:
web-1 |
web-1 | . ____ _ __ _ _
web-1 | /\ / ' __ _ () __ __ _ \ \ \
web-1 | ( ( )__ | '_ | '| | ' / ` | \ \ \
web-1 | \/ )| |)| | | | | || (| | ) ) ) )
web-1 | ' || .__|| ||| |_, | / / / /
web-1 | =========||==============|/=////
web-1 |
web-1 | :: Spring Boot :: (v3.4.4)
web-1 |
web-1 | 2025-11-02T12:10:02.716Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : Starting SyncserverApplication v0.16.3 using Java 21.0.8 with PID 7 (/app/app.jar started by appuser in /)
web-1 | 2025-11-02T12:10:02.732Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : No active profile set, falling back to 1 default profile: "default"
web-1 | 2025-11-02T12:10:12.401Z INFO 7 --- [syncserver] [ main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
web-1 | 2025-11-02T12:10:12.811Z INFO 7 --- [syncserver] [ main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 349 ms. Found 16 JPA repository interfaces.
web-1 | 2025-11-02T12:10:17.341Z INFO 7 --- [syncserver] [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port 6842 (http)
web-1 | 2025-11-02T12:10:17.371Z INFO 7 --- [syncserver] [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat]
web-1 | 2025-11-02T12:10:17.372Z INFO 7 --- [syncserver] [ main] o.apache.catalina.core.StandardEngine : Starting Servlet engine: [Apache Tomcat/10.1.39]
web-1 | 2025-11-02T12:10:17.437Z INFO 7 --- [syncserver] [ main] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring embedded WebApplicationContext
web-1 | 2025-11-02T12:10:17.440Z INFO 7 --- [syncserver] [ main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 12177 ms
web-1 | 2025-11-02T12:10:20.013Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Starting...
web-1 | 2025-11-02T12:10:20.569Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.pool.HikariPool : HikariPool-1 - Added connection conn1: url=jdbc:h2:file:/data/habittracker-db user=SA
web-1 | 2025-11-02T12:10:20.574Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Start completed.
web-1 | 2025-11-02T12:10:21.257Z INFO 7 --- [syncserver] [ main] org.flywaydb.core.FlywayExecutor : Database: jdbc:h2:file:/data/habittracker-db (H2 2.3)
web-1 | 2025-11-02T12:10:21.494Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbValidate : Successfully validated 10 migrations (execution time 00:00.147s)
web-1 | 2025-11-02T12:10:21.516Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbMigrate : Current version of schema "PUBLIC": 0.15.0
web-1 | 2025-11-02T12:10:21.526Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbMigrate : Schema "PUBLIC" is up to date. No migration necessary.
web-1 | 2025-11-02T12:10:22.024Z INFO 7 --- [syncserver] [ main] o.hibernate.jpa.internal.util.LogHelper : HHH000204: Processing PersistenceUnitInfo [name: default]
web-1 | 2025-11-02T12:10:22.241Z INFO 7 --- [syncserver] [ main] org.hibernate.Version : HHH000412: Hibernate ORM core version 6.6.11.Final
web-1 | 2025-11-02T12:10:22.383Z INFO 7 --- [syncserver] [ main] o.h.c.internal.RegionFactoryInitiator : HHH000026: Second-level cache disabled
web-1 | 2025-11-02T12:10:23.345Z INFO 7 --- [syncserver] [ main] o.s.o.j.p.SpringPersistenceUnitInfo : No LoadTimeWeaver setup: ignoring JPA class transformer
web-1 | 2025-11-02T12:10:23.676Z INFO 7 --- [syncserver] [ main] org.hibernate.orm.connections.pooling : HHH10001005: Database info:
web-1 | Database JDBC URL [Connecting through datasource 'HikariDataSource (HikariPool-1)']
web-1 | Database driver: undefined/unknown
web-1 | Database version: 2.3.232
web-1 | Autocommit mode: undefined/unknown
web-1 | Isolation level: undefined/unknown
web-1 | Minimum pool size: undefined/unknown
web-1 | Maximum pool size: undefined/unknown
web-1 | 2025-11-02T12:10:28.113Z INFO 7 --- [syncserver] [ main] o.h.e.t.j.p.i.JtaPlatformInitiator : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
web-1 | 2025-11-02T12:10:28.147Z INFO 7 --- [syncserver] [ main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
web-1 | 2025-11-02T12:10:30.637Z INFO 7 --- [syncserver] [ main] o.s.d.j.r.query.QueryEnhancerFactory : Hibernate is in classpath; If applicable, HQL parser will be used.
web-1 | 2025-11-02T12:10:33.319Z INFO 7 --- [syncserver] [ main] org.quartz.impl.StdSchedulerFactory : Using default implementation for ThreadExecutor
web-1 | 2025-11-02T12:10:33.356Z INFO 7 --- [syncserver] [ main] org.quartz.core.SchedulerSignalerImpl : Initialized Scheduler Signaller of type: class org.quartz.core.SchedulerSignalerImpl
web-1 | 2025-11-02T12:10:33.358Z INFO 7 --- [syncserver] [ main] org.quartz.core.QuartzScheduler : Quartz Scheduler v.2.3.2 created.
web-1 | 2025-11-02T12:10:33.362Z INFO 7 --- [syncserver] [ main] o.s.s.quartz.LocalDataSourceJobStore : Using db table-based data access locking (synchronization).
web-1 | 2025-11-02T12:10:33.366Z INFO 7 --- [syncserver] [ main] o.s.s.quartz.LocalDataSourceJobStore : JobStoreCMT initialized.
web-1 | 2025-11-02T12:10:33.367Z INFO 7 --- [syncserver] [ main] org.quartz.core.QuartzScheduler : Scheduler meta-data: Quartz Scheduler (v2.3.2) 'schedulerFactoryBean' with instanceId 'NON_CLUSTERED'
web-1 | Scheduler class: 'org.quartz.core.QuartzScheduler' - running locally.
web-1 | NOT STARTED.
web-1 | Currently in standby mode.
web-1 | Number of jobs executed: 0
web-1 | Using thread pool 'org.quartz.simpl.SimpleThreadPool' - with 10 threads.

[jofoerster]

Your logs seem to be either cut off, or the application did not start yet. Could you send the last part of the logs after it finished starting? There should either be Started SyncserverApplication in x seconds or a (long) error message.

Unfortunately the app seems to have an issue with the health checks in certain configurations. I will fix them with the next release (this does not affect the app, but only the status reports in docker, so please ignore the unhealthy status for now)

[protonaut]

Here are the logs:

2025-11-02T11:58:39.858Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : Started SyncserverApplication in 40.604 seconds (process running for 44.747)
2025-11-02T11:58:59.776Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.SchedulerFactoryBean : Starting Quartz Scheduler now, after delay of 20 seconds
2025-11-02T11:58:59.877Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Freed 0 triggers from 'acquired' / 'blocked' state.
2025-11-02T11:58:59.885Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Recovering 0 jobs that were in-progress at the time of the last shut-down.
2025-11-02T11:58:59.886Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Recovery complete.
2025-11-02T11:58:59.887Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Removed 0 'complete' triggers.
2025-11-02T11:58:59.892Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Removed 0 stale fired job entries.
2025-11-02T11:58:59.899Z INFO 7 --- [syncserver] [lerFactoryBean]] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean_$NON_CLUSTERED started.
2025-11-02T11:59:00.770Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring DispatcherServlet 'dispatcherServlet'
2025-11-02T11:59:00.774Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet'
2025-11-02T11:59:00.784Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 8 ms
2025-11-02T12:09:54.695Z INFO 7 --- [syncserver] [ionShutdownHook] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean$NON_CLUSTERED paused.
2025-11-02T12:09:54.713Z INFO 7 --- [syncserver] [ionShutdownHook] o.s.b.w.e.tomcat.GracefulShutdown : Commencing graceful shutdown. Waiting for active requests to complete
2025-11-02T12:09:54.734Z INFO 7 --- [syncserver] [tomcat-shutdown] o.s.b.w.e.tomcat.GracefulShutdown : Graceful shutdown complete
2025-11-02T12:09:54.822Z INFO 7 --- [syncserver] [ionShutdownHook] o.s.s.quartz.SchedulerFactoryBean : Shutting down Quartz Scheduler
2025-11-02T12:09:54.827Z INFO 7 --- [syncserver] [ionShutdownHook] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean$NON_CLUSTERED shutting down.
2025-11-02T12:09:54.828Z INFO 7 --- [syncserver] [ionShutdownHook] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean$NON_CLUSTERED paused.
2025-11-02T12:09:54.833Z INFO 7 --- [syncserver] [ionShutdownHook] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean$_NON_CLUSTERED shutdown complete.
2025-11-02T12:09:54.844Z INFO 7 --- [syncserver] [ionShutdownHook] j.LocalContainerEntityManagerFactoryBean : Closing JPA EntityManagerFactory for persistence unit 'default'
2025-11-02T12:09:54.859Z INFO 7 --- [syncserver] [ionShutdownHook] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown initiated...
2025-11-02T12:09:54.870Z INFO 7 --- [syncserver] [ionShutdownHook] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Shutdown completed.

025-11-02T12:10:02.716Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : Starting SyncserverApplication v0.16.3 using Java 21.0.8 with PID 7 (/app/app.jar started by appuser in /)
2025-11-02T12:10:02.732Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : No active profile set, falling back to 1 default profile: "default"
2025-11-02T12:10:12.401Z INFO 7 --- [syncserver] [ main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
2025-11-02T12:10:12.811Z INFO 7 --- [syncserver] [ main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 349 ms. Found 16 JPA repository interfaces.
2025-11-02T12:10:17.341Z INFO 7 --- [syncserver] [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port 6842 (http)
2025-11-02T12:10:17.371Z INFO 7 --- [syncserver] [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat]
2025-11-02T12:10:17.372Z INFO 7 --- [syncserver] [ main] o.apache.catalina.core.StandardEngine : Starting Servlet engine: [Apache Tomcat/10.1.39]
2025-11-02T12:10:17.437Z INFO 7 --- [syncserver] [ main] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring embedded WebApplicationContext
2025-11-02T12:10:17.440Z INFO 7 --- [syncserver] [ main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 12177 ms
2025-11-02T12:10:20.013Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Starting...
2025-11-02T12:10:20.569Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.pool.HikariPool : HikariPool-1 - Added connection conn1: url=jdbc:h2:file:/data/habittracker-db user=SA
2025-11-02T12:10:20.574Z INFO 7 --- [syncserver] [ main] com.zaxxer.hikari.HikariDataSource : HikariPool-1 - Start completed.
2025-11-02T12:10:21.257Z INFO 7 --- [syncserver] [ main] org.flywaydb.core.FlywayExecutor : Database: jdbc:h2:file:/data/habittracker-db (H2 2.3)
2025-11-02T12:10:21.494Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbValidate : Successfully validated 10 migrations (execution time 00:00.147s)
2025-11-02T12:10:21.516Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbMigrate : Current version of schema "PUBLIC": 0.15.0
2025-11-02T12:10:21.526Z INFO 7 --- [syncserver] [ main] o.f.core.internal.command.DbMigrate : Schema "PUBLIC" is up to date. No migration necessary.
2025-11-02T12:10:22.024Z INFO 7 --- [syncserver] [ main] o.hibernate.jpa.internal.util.LogHelper : HHH000204: Processing PersistenceUnitInfo [name: default]
2025-11-02T12:10:22.241Z INFO 7 --- [syncserver] [ main] org.hibernate.Version : HHH000412: Hibernate ORM core version 6.6.11.Final
2025-11-02T12:10:22.383Z INFO 7 --- [syncserver] [ main] o.h.c.internal.RegionFactoryInitiator : HHH000026: Second-level cache disabled
2025-11-02T12:10:23.345Z INFO 7 --- [syncserver] [ main] o.s.o.j.p.SpringPersistenceUnitInfo : No LoadTimeWeaver setup: ignoring JPA class transformer
2025-11-02T12:10:23.676Z INFO 7 --- [syncserver] [ main] org.hibernate.orm.connections.pooling : HHH10001005: Database info:
Database JDBC URL [Connecting through datasource 'HikariDataSource (HikariPool-1)']
Database driver: undefined/unknown
Database version: 2.3.232
Autocommit mode: undefined/unknown
Isolation level: undefined/unknown
Minimum pool size: undefined/unknown
Maximum pool size: undefined/unknown
2025-11-02T12:10:28.113Z INFO 7 --- [syncserver] [ main] o.h.e.t.j.p.i.JtaPlatformInitiator : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2025-11-02T12:10:28.147Z INFO 7 --- [syncserver] [ main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2025-11-02T12:10:30.637Z INFO 7 --- [syncserver] [ main] o.s.d.j.r.query.QueryEnhancerFactory : Hibernate is in classpath; If applicable, HQL parser will be used.
2025-11-02T12:10:33.319Z INFO 7 --- [syncserver] [ main] org.quartz.impl.StdSchedulerFactory : Using default implementation for ThreadExecutor
2025-11-02T12:10:33.356Z INFO 7 --- [syncserver] [ main] org.quartz.core.SchedulerSignalerImpl : Initialized Scheduler Signaller of type: class org.quartz.core.SchedulerSignalerImpl
2025-11-02T12:10:33.358Z INFO 7 --- [syncserver] [ main] org.quartz.core.QuartzScheduler : Quartz Scheduler v.2.3.2 created.
2025-11-02T12:10:33.362Z INFO 7 --- [syncserver] [ main] o.s.s.quartz.LocalDataSourceJobStore : Using db table-based data access locking (synchronization).
2025-11-02T12:10:33.366Z INFO 7 --- [syncserver] [ main] o.s.s.quartz.LocalDataSourceJobStore : JobStoreCMT initialized.
2025-11-02T12:10:33.367Z INFO 7 --- [syncserver] [ main] org.quartz.core.QuartzScheduler : Scheduler meta-data: Quartz Scheduler (v2.3.2) 'schedulerFactoryBean' with instanceId 'NON_CLUSTERED'
Scheduler class: 'org.quartz.core.QuartzScheduler' - running locally.
NOT STARTED.
Currently in standby mode.
Number of jobs executed: 0
Using thread pool 'org.quartz.simpl.SimpleThreadPool' - with 10 threads.
Using job-store 'org.springframework.scheduling.quartz.LocalDataSourceJobStore' - which supports persistence. and is not clustered.

2025-11-02T12:10:33.369Z INFO 7 --- [syncserver] [ main] org.quartz.impl.StdSchedulerFactory : Quartz scheduler 'schedulerFactoryBean' initialized from an externally provided properties instance.
2025-11-02T12:10:33.369Z INFO 7 --- [syncserver] [ main] org.quartz.impl.StdSchedulerFactory : Quartz scheduler version: 2.3.2
2025-11-02T12:10:33.370Z INFO 7 --- [syncserver] [ main] org.quartz.core.QuartzScheduler : JobFactory set to: de.jofoerster.habitsync.config.AutowiringSpringBeanJobFactory@6b16aa6f
2025-11-02T12:10:33.993Z INFO 7 --- [syncserver] [ main] d.j.h.s.n.NotificationService : Scheduling user notification jobs
2025-11-02T12:10:34.904Z INFO 7 --- [syncserver] [ main] r$InitializeUserDetailsManagerConfigurer : Global AuthenticationManager configured with UserDetailsService bean with name userDetailsService
2025-11-02T12:10:35.219Z INFO 7 --- [syncserver] [ main] o.s.b.a.w.s.WelcomePageHandlerMapping : Adding welcome page: class path resource [static/index.html]
2025-11-02T12:10:36.902Z INFO 7 --- [syncserver] [ main] o.s.b.a.e.web.EndpointLinksResolver : Exposing 1 endpoint beneath base path '/actuator'
2025-11-02T12:10:42.318Z INFO 7 --- [syncserver] [ main] o.s.b.a.h2.H2ConsoleAutoConfiguration : H2 console available at '/h2-console'. Database available at 'jdbc:h2:file:/data/habittracker-db'
2025-11-02T12:10:43.474Z INFO 7 --- [syncserver] [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port 6842 (http) with context path '/'
2025-11-02T12:10:43.481Z INFO 7 --- [syncserver] [ main] o.s.s.quartz.SchedulerFactoryBean : Will start Quartz Scheduler [schedulerFactoryBean] in 20 seconds
2025-11-02T12:10:43.518Z INFO 7 --- [syncserver] [ main] d.j.habitsync.SyncserverApplication : Started SyncserverApplication in 43.001 seconds (process running for 47.372)
2025-11-02T12:11:01.685Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring DispatcherServlet 'dispatcherServlet'
2025-11-02T12:11:01.686Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.s.web.servlet.DispatcherServlet : Initializing Servlet 'dispatcherServlet'
2025-11-02T12:11:01.700Z INFO 7 --- [syncserver] [nio-6842-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 13 ms
2025-11-02T12:11:03.486Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.SchedulerFactoryBean : Starting Quartz Scheduler now, after delay of 20 seconds
2025-11-02T12:11:03.575Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Freed 0 triggers from 'acquired' / 'blocked' state.
2025-11-02T12:11:03.584Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Recovering 0 jobs that were in-progress at the time of the last shut-down.
2025-11-02T12:11:03.586Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Recovery complete.
2025-11-02T12:11:03.587Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Removed 0 'complete' triggers.
2025-11-02T12:11:03.587Z INFO 7 --- [syncserver] [lerFactoryBean]] o.s.s.quartz.LocalDataSourceJobStore : Removed 0 stale fired job entries.
2025-11-02T12:11:03.596Z INFO 7 --- [syncserver] [lerFactoryBean]] org.quartz.core.QuartzScheduler : Scheduler schedulerFactoryBean_$_NON_CLUSTERED started.

[jofoerster]

There are no errors. You should be able to access the server. Did you try to ping it locally? Or just fetch your-ip:6842 using curl/another browser? What do you mean by that: I get a wordpress-Welcome Page without access-controll or any login.? Maybe there is an error with your reverse proxy setup?

[protonaut]

Yeah, you are right. I had a misconfiguration of the DNS-settings. Thanks for figuring that out.
Now I'm landing on the loginpage.

There seems to be a NetworkError.

I should say that dex is on a different server than habitsync.
The https://habits.domain2.de is behind a proxymanager.
https://dex.domain1.de is not.
Maybe that's the problem.
Just a guess: Actually the server on which is dex has no direct connection to the docker-container of habitsync. I though the connection via domain (through the proxymanage) is possible.
If needed I could connect them via tailscale.

[jofoerster]

This shouldn't be a problem. Could you send your browser logs (f12) ?

[protonaut]

Here are the logs the firefox browser reported:

Die Ressource von "https://habits.domain2.de/config.js" wurde wegen eines MIME-Typ-Konfliktes ("text/html") blockiert (X-Content-Type-Options: nosniff).
Laden fehlgeschlagen für das <script> mit der Quelle "https://habits.domain2.de/config.js". habits.domain2.de:1:302
unreachable code after return statement
Initializing auth service entry-0fec404bc0ab037c708bc8b51e27c81f.js:762:915
No refresh token found entry-0fec404bc0ab037c708bc8b51e27c81f.js:762:1231
not authenticated, redirecting to login entry-0fec404bc0ab037c708bc8b51e27c81f.js:760:866
[OAuth] Using web-specific implementation entry-0fec404bc0ab037c708bc8b51e27c81f.js:763:742
[WebOAuth] Starting OAuth login with provider: dex entry-0fec404bc0ab037c708bc8b51e27c81f.js:787:2383
[WebOAuth] Fetching discovery document from: https://dex.domain1.de//.well-known/openid-configuration

Quellübergreifende (Cross-Origin) Anfrage blockiert: Die Gleiche-Quelle-Regel verbietet das Lesen der externen Ressource auf https://dex.domain1.de//.well-known/openid-configuration. (Grund: CORS-Kopfzeile 'Access-Control-Allow-Origin' fehlt). Statuscode: 404.

[WebOAuth] Failed to fetch discovery document: TypeError: NetworkError when attempting to fetch resource. entry-0fec404bc0ab037c708bc8b51e27c81f.js:787:2152

OAuth login completed entry-0fec404bc0ab037c708bc8b51e27c81f.js:966:4162
Die Ressource unter "https://habits.domain2.de/assets/assets/fonts/SpaceMono-Regular.49a79d66bdea2debf1832bf4d7aca127.ttf" wurde vorab geladen ("link-preload"), aber nicht innerhalb der ersten Sekunden verwendet. Es wird eine Überprüfung empfohlen, ob alle preload-Attribute korrekt gesetzt sind. login
[OAuth] Using web-specific implementation entry-0fec404bc0ab037c708bc8b51e27c81f.js:763:742
[WebOAuth] Starting OAuth login with provider: dex entry-0fec404bc0ab037c708bc8b51e27c81f.js:787:2383
[WebOAuth] Fetching discovery document from: https://dex.domain1.de//.well-known/openid-configuration

[jofoerster]

The first issue here is that the domain dex.domain1.de// (there shouldn't be 2 slashes). Could you remove the trailing / from your issuer url (I will improve the handling of this in the next version, sorry)

[protonaut]

Okay, done.

I added the slash in the docker-compose file before because I got an error massage that the URL don't match.
Now I get the previous error massage again:

web-1 | Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterChain' defined in class path resource [de/jofoerster/habitsync/config/SecurityConfig.class]: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method 'filterChain' threw exception with message: The Issuer "https://dex.domain1.de/" provided in the configuration did not match the requested issuer "https://dex.domain1.de"

Either the URL nor IP:6842 are accessible now. I get an "502 Bad Gateway openresty" error in the browser.

[jofoerster]

Your auth provider (dex) is configured to announce himself with the trailing /, which is rather unconventional (it is needed to match exactly and normally it is configured without the /. You should not change this as it might break other apps of yours). I created a hotfix 0.16.4 (available in ~25min), that handles this case. Could you add the / again to your docker compose and test with the new version?

[protonaut]

Thanks.
I just used in the compose file:

services:
web:
image: ghcr.io/jofoerster/habitsync:0.16.4
environment:
- BASE_URL=https://habits.domain2.de
- APP_SECURITY_ISSUERS_DEX_URL=https://dex.domain1.de/
- APP_SECURITY_ISSUERS_DEX_CLIENT-ID=habitsync
- APP_SECURITY_ISSUERS_DEX_NEEDS-CONFIRMATION=true #

The NetworkError remains.
The logs of the browser say:

Die Ressource von "https://habits.domain2.de/config.js" wurde wegen eines MIME-Typ-Konfliktes ("text/html") blockiert (X-Content-Type-Options: nosniff).
Laden fehlgeschlagen für das <script> mit der Quelle "https://habits.domain1.de/config.js".
unreachable code after return statement

Quellübergreifende (Cross-Origin) Anfrage blockiert: Die Gleiche-Quelle-Regel verbietet das Lesen der externen Ressource auf https://dex.domain1.de/.well-known/openid-configuration. (Grund: CORS-Kopfzeile 'Access-Control-Allow-Origin' fehlt). Statuscode: 200

I assume there are some issues with missing permissions.
Couldn't find an easy solution searching the
dex Documentation on https://dexidp.io/docs/
for "Access-Control-Allow-Origin".

[jofoerster]

You are missing some cors config probably. I found this issue: dexidp/dex#1024 where config options are mentioned.

You essentially need to tell dex that it should add these cors headers so that your browser does not block the request to fetch the token from dex

Also this thread is about the support for pkce (public client oidc) that is used in this app: dexidp/dex#1784

[jofoerster]

Also look here. This could be a fitting example configuration: dexidp/dex#2253

Especially the web:allowed-origins part

[protonaut]

Thanks a lot. I will go through your considered threads and post the solution once I found it.