nixos/oauth2-proxy-nginx: lift auth_request to http block
With this change now all location blocks are protected by oauth2-proxy and not only /
This commit is contained in:
parent
3814255973
commit
a911604762
|
@ -28,7 +28,8 @@ in
|
||||||
type = types.listOf types.str;
|
type = types.listOf types.str;
|
||||||
default = [];
|
default = [];
|
||||||
description = ''
|
description = ''
|
||||||
A list of nginx virtual hosts to put behind the oauth2 proxy
|
A list of nginx virtual hosts to put behind the oauth2 proxy.
|
||||||
|
You can exclude specific locations by setting `auth_request off;` in the locations extraConfig setting.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -50,18 +51,27 @@ in
|
||||||
] ++ optional (cfg.virtualHosts != []) {
|
] ++ optional (cfg.virtualHosts != []) {
|
||||||
recommendedProxySettings = true; # needed because duplicate headers
|
recommendedProxySettings = true; # needed because duplicate headers
|
||||||
} ++ (map (vhost: {
|
} ++ (map (vhost: {
|
||||||
virtualHosts.${vhost}.locations = {
|
virtualHosts.${vhost} = {
|
||||||
"/oauth2/auth" = {
|
locations = {
|
||||||
proxyPass = cfg.proxy;
|
"/oauth2/auth" = {
|
||||||
extraConfig = ''
|
proxyPass = cfg.proxy;
|
||||||
proxy_set_header X-Scheme $scheme;
|
extraConfig = ''
|
||||||
# nginx auth_request includes headers but not body
|
auth_request off;
|
||||||
proxy_set_header Content-Length "";
|
proxy_set_header X-Scheme $scheme;
|
||||||
proxy_pass_request_body off;
|
# nginx auth_request includes headers but not body
|
||||||
'';
|
proxy_set_header Content-Length "";
|
||||||
|
proxy_pass_request_body off;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"@redirectToAuth2ProxyLogin" = {
|
||||||
|
return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
|
||||||
|
extraConfig = ''
|
||||||
|
auth_request off;
|
||||||
|
'';
|
||||||
|
};
|
||||||
};
|
};
|
||||||
"@redirectToAuth2ProxyLogin".return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
|
|
||||||
"/".extraConfig = ''
|
extraConfig = ''
|
||||||
auth_request /oauth2/auth;
|
auth_request /oauth2/auth;
|
||||||
error_page 401 = @redirectToAuth2ProxyLogin;
|
error_page 401 = @redirectToAuth2ProxyLogin;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user