"Unauthorized" if I try to proxy my Channels DVR

[Hagary]

Hi all -

So I just found this last night and I am excited to set it up. I was able to get the container up on my Unraid server, access the dashboard, setup sources and media folders, etc. I use an nginx proxy internally so I can hit my containers via containername.mydomain.me instead of using the IP and port combo for everything, but when I try that I get an Unauthorized error. I used the /auth/logout method I saw elsewhere on this forum and when I try again via the proxy it tells me to make the intial connection via my local network. When I click on that link I get the dash but then I try the proxy method again and it give the same error as before.

Any ideas? FWIW, I have like 20 other containers proxied just fine so it's set up on that end okay I think.

[Hagary]

Okay, I fixed it. I clicked the link to get an authorization code and copied that to a note. I logged out with the /auth/logout method and used the proxy again and this time it asked for an authorization code. I pasted the one I'd copied and it is accessing via the proxied name now.

[tmm1]

See:

@tmm1

Note that the DVR server detects the client ip and forces authentication when it is not in your local network. By using a reverse proxy, all requests will appear local which breaks the authentication mechanism.

@tmm1

Note that if you use nginx or other reverse proxy, you will need to implement your own authentication as the built-in auth will no longer work.

@tmm1

One option is to have nginx add the header “X-DVR-ForceAuth: true” to the proxied request. Then you can remove the htpasswd (which the app has no idea how to deal with). You will be presented with an authorization form and will need to login using the authorization code from your dvr subscription account when accessing the web UI.

[Hagary]

Thanks. I'll keep that in mind. One thing I should clarify is that this is internal-only. I don't use the proxy for external network access, though I will say the proxy and the container are on two different /32 networks in this case.