first login failed - docker compose

[cdalexndr]

Login admin/admin not working:

docker compose:

services:
  gotify:
    container_name: gotify
    image: gotify/server
    environment:
      - GOTIFY_DEFAULTUSER_NAME=admin
      - GOTIFY_DEFAULTUSER_PASS=admin
    volumes:
      - './data:/app/data'
    networks:
      - gotify_net
      - proxy_net
networks:
  gotify_net:
    name: gotify_net
  proxy_net:
    external: true 

Using behind reverse proxy nginx (lscr.io/linuxserver/swag)
gotify.subdomain.conf:

## Version 2024/07/16
# make sure that your gotify container is named gotify
# make sure that your dns has a cname set for gotify

server {
    listen 8091 ssl;
    listen [::]:8091 ssl;

    server_name gotify.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app gotify;
        set $upstream_port 80;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

[cdalexndr]

Exposing the port in the docker container and accessing directly (bypassing reverse proxy) works.

[cdalexndr]

Adding env variable GOTIFY_SERVER_CORS_ALLOWORIGINS to [.*] resolves this issue. (this should be set to another value for security purposes)
Maybe this needs to be added in documentation

[jmattheis]

You are probably missing some headers that are documented here: https://gotify.net/docs/nginx

[lordcheeto]

In case someone else stumbles on this, I encountered a similar issue with Traefik as my reverse proxy. I had the route configured to use the Authelia middleware. I was able to navigate to the reverse proxy entry point, which redirected me to the Authelia 1FA. I then logged into that and loaded successfully to the Gotify login screen.

When I logged in with my Gotify username and password, the browser popped up a basic auth modal asking for another username and password, which didn't accept either the Authelia or Gotify credentials.

Looking in the Authelia logs, it's reading the Basic Authorization request header that Gotify is sending to /client on logon and thinks it's an Authelia auth header, failing because that user doesn't exist on the Authelia side.

    time="2026-03-09T22:52:14-05:00" level=debug msg="Check authorization of subject username= groups= ip=[ip_address] and object https://gotify.[example.com]/client (method POST)."
    time="2026-03-09T22:52:14-05:00" level=debug msg="Error occurred while attempting to authenticate a request but the matched rule was a bypass rule" error="failed to validate Authorization header with basic scheme: failed to validate the credentials of user '[gotify_username]' parsed from the Authorization header: user not found" method=GET path=/api/authz/forward-auth remote_ip=[ip_address]
    time="2026-03-09T22:52:14-05:00" level=debug msg="Responding 401 WWW-Authenticate" method=GET path=/api/authz/forward-auth remote_ip=[ip_address]

I just disabled Authelia for my Gotify endpoint and used an IP allowlist. I don't know if something needs to be changed in the Authelia or Traefik config, but I don't think it's an issue on the Gotify side.

[Lebowski89]

@lordcheeto thanks. Fixed it for me. I assume we don't even need Authelia in front with the Gotify login screen there, anyway.

[lordcheeto]

@lordcheeto thanks. Fixed it for me. I assume we don't even need Authelia in front with the Gotify login screen there, anyway.

Authelia can allow for more granular access control, 2FA, SSO, etc. It wasn't critical to my use case, but I think someone with a better grasp of reverse proxies than I could come up with a configuration that works.