[bug]: the auth/login system doens't work on the docker image

[moheladwy]

Describe the bug

When I try to login using the PGADMIN_DEFAULT_EMAIL and PGADMIN_DEFAULT_PASSWORD I get redirected to the following page:

To Reproduce

Steps to reproduce the behavior:
0. Use the pgadmin setup using docker-compose like the following yaml file:

services:
  postgres:
    image: pgvector/pgvector:pg18
    container_name: postgres
    env_file:
      - .env
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - target: 5432
        published: 5432
        protocol: tcp
    volumes:
      - postgres_data:/var/lib/postgresql
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 1m30s
      timeout: 30s
      retries: 5
      start_period: 3s
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 4G 
    networks:
      - postgresql
      - shared
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: pgadmin
    env_file:
      - .env
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
      PGADMIN_CONFIG_FORCE_SSL: "True"
      PGADMIN_CONFIG_ENHANCED_COOKIE_PROTECTION: "False"
      PGADMIN_CONFIG_WTF_CSRF_CHECK_DEFAULT: "False"
      PGADMIN_CONFIG_WTF_CSRF_ENABLED: "False"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    ports:
      - target: 80
        published: 5050
    depends_on:
      - postgres
    restart: unless-stopped
    networks:
      - postgresql
      - shared
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 256M

volumes:
  postgres_data:
    name: postgres_data
    driver: local
    driver_opts:
      type: none
      device: ./data
      o: bind
  pgadmin_data:
    name: pgadmin_data
    driver: local
    driver_opts:
      type: none
      device: ./pgadmin-data
      o: bind

networks:
  postgresql:
    name: postgresql
    driver: bridge
  shared:
    name: shared
    external: true

1. Go to main page
2. type the default email and password
3. Click on login
4. See the error

Expected behavior

to should take me to the main dashboard after login

Error message

it redirects me to https://pgadmin.domainname/authenticate/login and gives me 502 Bad Gateway

Screenshots

Desktop (please complete the following information):

• OS: Ubuntu
• pgAdmin version: dpage/pgadmin4:latest docker image
• Mode: Server
• Browser (if running in server mode): zen-browser [Firefox based]
• Package type: Container

Additional context

it's deployed on Ubuntu server and set behind nginx proxy manager as a reverse proxy for the dns access.

docker container logs:

email config is {'CHECK_EMAIL_DELIVERABILITY': False, 'ALLOW_SPECIAL_EMAIL_DOMAINS': [], 'GLOBALLY_DELIVERABLE': True}

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block

  return (ssh_host,

NOTE: Configuring authentication for SERVER mode.

pgAdmin 4 - Application Initialisation

======================================

postfix/postlog: starting the Postfix mail system

[2025-12-11 16:08:59 +0000] [1] [INFO] Starting gunicorn 23.0.0

[2025-12-11 16:08:59 +0000] [1] [INFO] Listening at: http://[::]:80 (1)

[2025-12-11 16:08:59 +0000] [1] [INFO] Using worker: gthread

[2025-12-11 16:08:59 +0000] [127] [INFO] Booting worker with pid: 127

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block

  return (ssh_host,

197.49.7.40 - - [11/Dec/2025:16:09:53 +0000] "GET / HTTP/1.1" 302 213 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"

197.49.7.40 - - [11/Dec/2025:16:09:54 +0000] "GET /login?next=/ HTTP/1.1" 200 2494 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"

[2025-12-11 16:09:56 +0000] [1] [ERROR] Worker (pid:127) was sent SIGKILL! Perhaps out of memory?

[2025-12-11 16:09:56 +0000] [161] [INFO] Booting worker with pid: 161

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block

  return (ssh_host,

197.49.7.40 - - [11/Dec/2025:16:10:15 +0000] "GET /login?next=/ HTTP/1.1" 200 2493 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"

197.49.7.40 - - [11/Dec/2025:16:10:18 +0000] "GET / HTTP/1.1" 302 213 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"

197.49.7.40 - - [11/Dec/2025:16:10:18 +0000] "GET /login?next=/ HTTP/1.1" 200 2491 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0"

[2025-12-11 16:10:23 +0000] [1] [ERROR] Worker (pid:161) was sent SIGKILL! Perhaps out of memory?

[2025-12-11 16:10:23 +0000] [194] [INFO] Booting worker with pid: 194

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block

  return (ssh_host,

[2025-12-11 16:10:39 +0000] [1] [ERROR] Worker (pid:194) was sent SIGKILL! Perhaps out of memory?

[2025-12-11 16:10:39 +0000] [227] [INFO] Booting worker with pid: 227

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block

  return (ssh_host,

[pravesh-sharma]

Hi @moheladwy,

It seems that there is some issue with your nginx configuration. Can you please share the nginx configuration details?

[moheladwy]

Hi @moheladwy,

It seems that there is some issue with your nginx configuration. Can you please share the nginx configuration details?

I use Nginx Proxy Manager to manage my reverse proxy:

and this is the ssl info:

[impcyber]

Same problem

postfix/postlog: starting the Postfix mail system
[2025-12-25 02:03:40 +0300] [1] [INFO] Starting gunicorn 23.0.0
[2025-12-25 02:03:40 +0300] [1] [INFO] Listening at: http://[::]:80 (1)
[2025-12-25 02:03:40 +0300] [1] [INFO] Using worker: gthread
[2025-12-25 02:03:40 +0300] [126] [INFO] Booting worker with pid: 126
/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block
  return (ssh_host,
::1 - - [25/Dec/2025:02:04:01 +0300] "GET /misc/ping HTTP/1.1" 200 4 "-" "Wget"

traefik config:

  labels:
        - "traefik.enable=true"
        - "traefik.http.routers.pgadmin.rule=Host(`db.***`)"
        - "traefik.http.routers.pgadmin.entrypoints=websecure"
        - "traefik.http.routers.pgadmin.service=pgadmin"
        - "traefik.http.routers.pgadmin.tls=true"
        - "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
        - "traefik.http.services.pgadmin.loadbalancer.server.port=80"
        - "traefik.http.middlewares.authentik.forwardauth.address=http://sso_authentik:9000/outpost.goauthentik.io/auth/traefik"
        - "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader=true"
        - "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders=X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version"
        - "traefik.http.routers.pgadmin.middlewares=authentik@swarm"
```

pgAdmin version: dpage/pgadmin4:latest docker image

[impcyber]

After some experimentation, I was able to get it working. The problem was that I was copying the code for the .env file from https://integrations.goauthentik.io/infrastructure/pgadmin/#using-environment-variables-for-containerized-deployments

However, if I remove the quotation marks, it works:

PGADMIN_CONFIG_AUTHENTICATION_SOURCES=['oauth2', 'internal']
PGADMIN_CONFIG_OAUTH2_CONFIG=[{'OAUTH2_NAME':'authentik',...,'OAUTH2_ICON':'fas fa-key','OAUTH2_BUTTON_COLOR':'#0000aa'}]

[impcyber]

After some experimentation, I was able to get it working. The problem was that I was copying the code for the .env file from https://integrations.goauthentik.io/infrastructure/pgadmin/#using-environment-variables-for-containerized-deployments

However, if I remove the quotation marks, it works:

PGADMIN_CONFIG_AUTHENTICATION_SOURCES=['oauth2', 'internal']
PGADMIN_CONFIG_OAUTH2_CONFIG=[{'OAUTH2_NAME':'authentik',...,'OAUTH2_ICON':'fas fa-key','OAUTH2_BUTTON_COLOR':'#0000aa'}]

Strange behavior, it seems like it was related to a completely different error.
Since I ran pgadmin4:latest locally, without any additional environment variables, I got the error again:

/venv/lib/python3.14/site-packages/sshtunnel.py:1040: SyntaxWarning: 'return' in a 'finally' block
return (ssh_host,

But version pgadmin4:9.10 started successfully.

[anilsahoo20]

Hi @moheladwy
Can you please provide us the ngnix config file?

[moheladwy]

Hi @moheladwy Can you please provide us the ngnix config file?

I don't use custom nginx config files, I use nginx proxy manager, and I provided the screenshots above.

do you need more? I really don't know what else would you need, but feel free to share, and I'd do my best on finding them