Traefik annotation for Anubis query

[Nyanchovy]

Hi,

Newb question: I'm trying to add Anubis to my Immich instance (for fun, and learning!) on a rootless Docker host with Traefik. When following the documentation, I add the annotation - "traefik.http.routers.immich-server.middlewares=anubis@docker" to the immich-server container, to enable Anubis, my Immich instance returns 404 and I get the following error message in the Traefik log file:

{"level":"error","entryPointName":"websecure","routerName":"immich-server@docker","error":"middleware "anubis@docker" does not exist","time":"2026-01-17..........."}

If I remove the annotation it works, but obviously Anubis is bypassed.

Adding the following annotation to the immich-server does allow it to work, but contradicts the documentation:

immich-server:
  ... etc....
  labels:
      # Anubis middleware:
      - "traefik.http.routers.immich-server.middlewares=anubis@docker"
      - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/anubis/api/check"
      - "traefik.http.middlewares.anubis.forwardauth.authResponseHeaders=X-Forwarded-User" #testing
      - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true" #testing

...I thought the 'forwardauth.address' should go under Traefik's labels, according to the instructions?

Here is my compose file (sorry it's a bit long):

  traefik:
    container_name: "traefik"
    image: "traefik:v3.6.6@sha256:82d3d16dde0474a51fef00b28de143d48b67f7a27453224d5e7b5aaefff26a97"
    command:
      - "--api.dashboard=false"
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.watch=true"
      - "--providers.docker.network=web"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/traefik"
      - "--providers.file.watch=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http.tls=true"
      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=600s"
      - "--entrypoints.websecure.transport.respondingTimeouts.writeTimeout=600s"
      - "--log.filePath=/var/log/traefik.log"
      - "--accesslog.filePath=/var/log/access.log"
      - "--log.format=json"
      - "--log.level=DEBUG"
      - "--accesslog=true"
      - "--accessLog.bufferingSize=100"
      - "--global.checkNewVersion=false"
      - "--global.sendAnonymousUsage=false"
      - "--certificatesresolvers.myresolver.acme.dnschallenge=true"
      - "--certificatesresolvers.myresolver.acme.dnschallenge.provider=cloudflare"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1"
      - "--certificatesresolvers.myresolver.acme.email=webmastermydomain.com"
    ports:
      - "80:80"
      - "443:443"
    environment:
      - "CF_DNS_API_TOKEN_FILE=/run/secrets/CF_DNS_API_TOKEN"
    labels:
      # Anubis middleware
      - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/anubis/api/check"
      - "traefik.http.middlewares.anubis.forwardauth.authResponseHeaders=X-Real-IP" #added later just to try
      - "traefik.http.middlewares.anubis.forwardauth.authResponseHeaders=X-Forwarded-User" #added later just to try
      - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true" #added later just to try
      # global redirect to https
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
      - "traefik.http.routers.redirs.entrypoints=web"
      - "traefik.http.routers.redirs.middlewares=redirect-to-https"
    volumes:
      - "./traefik:/traefik:ro"
      - "./traefik/logs/:/var/log/:rw"
      - "./traefik/letsencrypt:/letsencrypt:rw"
    restart: always
    secrets:
      - "CF_DNS_API_TOKEN"
    security_opt:
      - "no-new-privileges=true"
    networks:
      - web

  anubis:
    container_name: anubis
    image: ghcr.io/techarohq/anubis:1.24.0@sha256:4bdf6ddd1a8dc8bfe7a33d823a1cb72157885ca4fd3ee749654b21cba732e439
    environment:
      - "BIND=:8080"
      - "TARGET= "
      - "REDIRECT_DOMAINS=myhost.mydomain.com,anubis.mydomain.com"
      - "PUBLIC_URL=https://anubis.mydomain.com"
      - "COOKIE_DOMAIN=mydomain.com"
      - "DIFFICULTY=4"
      - "SERVE_ROBOTS_TXT=false"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.anubis.rule=Host(`anubis.mydomain.com`)"
      - "traefik.http.routers.anubis.tls.certresolver=myresolver"
      - "traefik.http.routers.anubis.priority=1" # also added later, for testing
      - "traefik.http.routers.anubis.entrypoints=websecure"
      - "traefik.http.services.anubis.loadbalancer.server.port=8080"
      - "traefik.http.routers.anubis.service=anubis"
    healthcheck:
      test: ["CMD", "anubis", "--healthcheck"]
      interval: 5s
      timeout: 30s
      retries: 5
      start_period: 500ms
    cap_drop:
      - "ALL"
    security_opt:
      - "no-new-privileges=true"
    networks:
      - web

  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.immich-server.entrypoints=websecure"
      - "traefik.http.routers.immich-server.rule=Host(`myhost.mydomain.com`)"
      - "traefik.http.routers.immich-server.tls.certresolver=myresolver"
      - "traefik.http.services.immich-server.loadbalancer.server.port=2283"
      # Anubis middleware:
      - "traefik.http.routers.immich-server.middlewares=anubis@docker"
    volumes:
      - ${UPLOAD_LOCATION}:/data
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - "127.0.0.1:2283:2283"
    depends_on:
      - redis # trimmed from this output for clarity
      - database # trimmed from this output for clarity
      - traefik
    restart: always
    healthcheck:
      disable: false
    security_opt:
      - no-new-privileges:true
    networks:
      - web
  
  # rest of immich stack goes here, internal only. Removed from paste for length/clarity #

secrets:
  CF_DNS_API_TOKEN:
    file: ./secrets/secrets.file

networks:
    web:
      driver: bridge
      external: true

Containers seem to be up and running:

~/docker$ docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"
NAMES                     STATUS                    PORTS
immich_server             Up 12 minutes (healthy)   127.0.0.1:2283->2283/tcp
traefik                   Up 12 minutes             0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp
anubis                    Up 12 minutes (healthy)
immich_postgres           Up 12 minutes (healthy)   5432/tcp
immich_machine_learning   Up 12 minutes (healthy)
immich_redis              Up 12 minutes (healthy)   6379/tcp

I tried following the guide but I've obviously made a mistake somewhere, or the documentation is wrong/out of date? Any advice here would be appreciated. I'd like to make sure I'm doing this correctly.

[ismaildasci]

the issue is that traefik cant find the middleware because its defined on a different container. when you define middleware labels on traefik container itself, it needs traefik.enable=true on that container too.

try this - move the middleware definition to anubis container:

anubis:
  labels:
    - "traefik.enable=true"
    - "traefik.http.middlewares.anubis.forwardauth.address=http://anubis:8080/.within.website/x/anubis/api/check"
    - "traefik.http.middlewares.anubis.forwardauth.trustForwardHeader=true"

the middleware gets registered from whatever container has traefik.enable=true. since traefik itself doesnt have that label, the middleware definition on it gets ignored.

alternatively add traefik.enable=true to your traefik container labels and it should pick up the middleware.

[Nyanchovy]

Thanks. I'd stopped using the Traefik dashboard, so I'd failed to notice I'd removed 'traefik.enable=true' from there. I've placed the middleware as you suggested and now I can see Anubis logs filling up. Sorry this ended up being more of a docker question than an Anubis one; I appreciate the help!