[Docs] Clarify how ACL block/allow work

[andreasntr]

Preface: I read the docs, I know allow should skip auth on given paths and block should do the opposite. I've read other discussions/issues as well but no luck.

The docs do not specify how block works in depth, or maybe the functionality is broken.

I was trying to block only the path ^\/admin$ for my vaultwarden app (I decided then to remove labels, as vaultwarden integrates OIDC natively, but still) but it seems that the block directive is ignored and tinyauth redirect is performed anyway on all pats (for example /). I'm using traefik as reverse proxy.

Is there something more we need to know about these 2 acl settings?

[steveiliop56]

You are using the block statement correctly. Tinyauth is probably not detecting the ACLs, can't know for sure without the logs. Try using tinyauth.apps.vaultwarden.config.domain: vaultwarden.yourdomain.com.

[andreasntr]

that's exactly what i did, here is the complete list of labels for the vaultwarden container:

labels:
      - traefik.enable=true
      - traefik.http.routers.vaultwarden.entrypoints=https
      - traefik.http.routers.vaultwarden.rule=Host(`vaultwarden.domain.com`)
      - traefik.http.routers.vaultwarden.tls=true
      - traefik.http.routers.vaultwarden.service=vaultwarden
      - traefik.http.services.vaultwarden.loadbalancer.server.port=80
      - traefik.docker.network=proxy
      # tinyauth
      - traefik.http.routers.vaultwarden.middlewares=tinyauth
      - tinyauth.apps.vaultwarden.config.domain=vaultwarden.domain.com
      - tinyauth.apps.vaultwarden.users.allow=my_username
      - tinyauth.apps.vaultwarden.path.block=^\/admin$

FYI i'm using the tinyauth:v5 docker image