diff --git a/SwarselSystems.org b/SwarselSystems.org index 41a67b2..0147772 100644 --- a/SwarselSystems.org +++ b/SwarselSystems.org @@ -7221,6 +7221,8 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t ScanSchedule = "@every 24h"; MPVPath = "${pkgs.mpv}/bin/mpv"; MPVCommandTemplate = "mpv --audio-device=%d --no-audio-display --pause %f"; + ReverseProxyWhitelist = "0.0.0.0/0"; + ReverseProxyUserHeader = "X-User"; Jukebox = { Enabled = true; Default = "default"; @@ -7253,6 +7255,23 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t proxyPass = "http://localhost:4040"; proxyWebsockets = true; extraConfig = '' + auth_request /oauth2/auth; + error_page 401 = /oauth2/sign_in; + + # pass information via X-User and X-Email headers to backend, + # requires running with --set-xauthrequest flag (done by NixOS) + auth_request_set $user $upstream_http_x_auth_request_user; + auth_request_set $email $upstream_http_x_auth_request_email; + proxy_set_header X-User $user; + proxy_set_header X-Email $email; + + # if you enabled --pass-access-token, this will pass the token to the backend + auth_request_set $token $upstream_http_x_auth_request_access_token; + proxy_set_header X-Access-Token $token; + + # if you enabled --cookie-refresh, this is needed for it to work with auth_request + auth_request_set $auth_cookie $upstream_http_set_cookie; + add_header Set-Cookie $auth_cookie; proxy_redirect http:// https://; proxy_read_timeout 600s; proxy_send_timeout 600s; @@ -7261,6 +7280,52 @@ Here I am forcing =startWhenNeeded= to false so that the value will not be set t client_max_body_size 0; ''; }; + "/oauth2/" = { + proxyPass = "http://oauth2-proxy"; + extraConfig = '' + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri; + ''; + }; + "= /oauth2/auth" = { + proxyPass = "http://oauth2-proxy/oauth2/auth"; + extraConfig = '' + internal; + + proxy_set_header X-Scheme $scheme; + # nginx auth_request includes headers but not body + proxy_set_header Content-Length ""; + proxy_pass_request_body off; + ''; + }; + "/share" = { + proxyPass = "http://localhost:4040"; + proxyWebsockets = true; + extraConfig = '' + proxy_redirect http:// https://; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 0; + proxy_set_header X-User ""; + proxy_set_header X-Email ""; + ''; + }; + "/rest" = { + proxyPass = "http://localhost:4040"; + proxyWebsockets = true; + extraConfig = '' + proxy_redirect http:// https://; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 0; + proxy_set_header X-User ""; + proxy_set_header X-Email ""; + ''; + }; }; }; }; @@ -8601,6 +8666,8 @@ It serves both a Greader API at https://signpost.swarsel.win/api/greader.php, as I am using this with CapyReader on my phone, set it up as a FreshRSS account with Server URL =https://signpost.swarsel.win/api/greader.php +FreshRSS claims to support HTTP header auth, but at least it does not work with my oauth2-proxy setup. Until this is fixed, I resorted to the "form" login, since I mostly do not use the web version anyways. + #+begin_src nix :tangle modules/nixos/server/freshrss.nix { lib, config, ... }: { @@ -9009,24 +9076,9 @@ To get other URLs (token, etc.), use https:///oauth2/openid/ - + SwarselSystems: NixOS + Emacs Configuration @@ -263,9 +263,9 @@
  • 3.1.4.3. Home-manager only (default non-NixOS)
  • 3.1.4.4. ChaosTheatre (Demo Physical/VM)
    • @@ -305,8 +305,8 @@
  • 3.2.1.27. fhs
  • 3.2.1.28. swarsel-displaypower
  • 3.2.1.29. swarsel-mgba
    • -
  • 3.2.1.30. swarsel-deploy
    • -
  • 3.2.1.31. sshrm
    • +
  • 3.2.1.30. swarsel-deploy
    • +
  • 3.2.1.31. sshrm
  • 3.2.2. Overlays (additions, overrides, nixpkgs-stable)
    • @@ -314,37 +314,37 @@
  • 3.2.4. Library functions
    • -
  • 3.2.5. Auxiliary files +
  • 3.2.5. Auxiliary files
    • @@ -369,9 +369,9 @@
  • 3.3.1.14. Pipewire
  • 3.3.1.15. Common network settings
  • 3.3.1.16. Time, locale settings
    • -
  • 3.3.1.17. Meta options
    • +
  • 3.3.1.17. Meta options
  • 3.3.1.18. sops
    • -
  • 3.3.1.19. PII management
    • +
  • 3.3.1.19. PII management
  • 3.3.1.20. Theme (stylix)
  • 3.3.1.21. Programs (including zsh setup)
  • 3.3.1.23. Hardware compatibility settings (Yubikey, Ledger, Keyboards) - udev rules @@ -438,8 +438,8 @@
  • 3.3.2.24. FreshRSS
  • 3.3.2.25. forgejo (git server)
  • 3.3.2.26. Anki Sync Server
    • -
  • 3.3.2.27. IDM (kanidm + oauth2-proxy)
    • -
  • 3.3.2.28. Firefly-III
    • +
  • 3.3.2.27. IDM (kanidm + oauth2-proxy)
    • +
  • 3.3.2.28. Firefly-III
  • 3.3.3. Darwin @@ -454,11 +454,11 @@
  • 3.3.4.3. VmWare
  • 3.3.4.4. Auto-login
  • 3.3.4.5. nswitch-rcm
    • -
  • 3.3.4.6. Framework
    • -
  • 3.3.4.7. AMD CPU
    • -
  • 3.3.4.8. AMD GPU
    • -
  • 3.3.4.9. Hibernation
    • -
  • 3.3.4.10. BTRFS
    • +
  • 3.3.4.6. Framework
    • +
  • 3.3.4.7. AMD CPU
    • +
  • 3.3.4.8. AMD GPU
    • +
  • 3.3.4.9. Hibernation
    • +
  • 3.3.4.10. BTRFS
  • 3.3.4.11. work
  • 3.3.4.12. Minimal Install
    • @@ -507,7 +507,7 @@
  • 3.4.1.29.1. gnome-keyring
  • 3.4.1.29.2. KDE Connect
  • 3.4.1.29.3. Mako
    • -
  • 3.4.1.29.4. SwayOSD
    • +
  • 3.4.1.29.4. SwayOSD
  • 3.4.1.29.5. yubikey-touch-detector
    • @@ -532,7 +532,7 @@ @@ -710,7 +710,7 @@ @@ -719,7 +719,7 @@

    -This file has 66782 words spanning 17613 lines and was last revised on 2025-06-13 02:34:40 +0200. +This file has 67098 words spanning 17669 lines and was last revised on 2025-06-13 03:31:20 +0200.

    @@ -772,7 +772,7 @@ This section defines my Emacs configuration. For a while, I considered to use ry

    -My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-13 02:34:40 +0200) +My emacs is built using the emacs-overlay nix flake, which builds a bleeding edge emacs on wayland (pgtk) with utilities like treesitter support. By executing the below source block, the current build setting can be updated at any time, and you can see my most up-to-date build options (last updated: 2025-06-13 03:31:20 +0200)

    @@ -2908,8 +2908,8 @@ This is just a demo host. It applies all the configuration found in the common p I also set the WLR_RENDERER_ALLOW_SOFTWARE=1 to allow this configuration to run in a virtualized environment. I also enable qemuGuest for a smoother experience when testing on QEMU.

    -
    -
    3.1.4.4.1. Main configuration
    +
    +
    3.1.4.4.1. Main configuration
    { self, inputs, config, pkgs, lib, primaryUser, ... }:
@@ -2988,8 +2988,8 @@ in
    -
    -
    3.1.4.4.2. NixOS dummy options configuration
    +
    +
    3.1.4.4.2. NixOS dummy options configuration
    _:
@@ -2999,8 +2999,8 @@ in
    -
    -
    3.1.4.4.3. home-manager dummy options configuration
    +
    +
    3.1.4.4.3. home-manager dummy options configuration
    _:
@@ -4781,8 +4781,8 @@ appimageTools.wrapType2 {
    -
    -
    3.2.1.30. swarsel-deploy
    +
    +
    3.2.1.30. swarsel-deploy
    # heavily inspired from https://github.com/oddlama/nix-config/blob/d42cbde676001a7ad8a3cace156e050933a4dcc3/pkgs/deploy.nix
@@ -4913,8 +4913,8 @@ writeShellApplication {
    -
    -
    3.2.1.31. sshrm
    +
    +
    3.2.1.31. sshrm

    This programs simply runs ssh-keygen on the last host that I tried to ssh into. I need this frequently when working with cloud-init usually. @@ -5071,8 +5071,8 @@ in

    -
    -
    3.2.3.1.1. Personal
    +
    +
    3.2.3.1.1. Personal
    { lib, config, ... }:
@@ -5142,8 +5142,8 @@ in
    -
    -
    3.2.3.1.2. Chaostheatre
    +
    +
    3.2.3.1.2. Chaostheatre
    { lib, config, ... }:
@@ -5205,8 +5205,8 @@ in
    -
    -
    3.2.3.1.3. toto
    +
    +
    3.2.3.1.3. toto
    { lib, config, ... }:
@@ -5238,8 +5238,8 @@ in
    -
    -
    3.2.3.1.4. Work
    +
    +
    3.2.3.1.4. Work
    { lib, config, ... }:
@@ -5260,8 +5260,8 @@ in
    -
    -
    3.2.3.1.5. Framework
    +
    +
    3.2.3.1.5. Framework
    { lib, config, ... }:
@@ -5282,8 +5282,8 @@ in
    -
    -
    3.2.3.1.6. AMD CPU
    +
    +
    3.2.3.1.6. AMD CPU
    { lib, config, ... }:
@@ -5304,8 +5304,8 @@ in
    -
    -
    3.2.3.1.7. AMD GPU
    +
    +
    3.2.3.1.7. AMD GPU
    { lib, config, ... }:
@@ -5326,8 +5326,8 @@ in
    -
    -
    3.2.3.1.8. Hibernation
    +
    +
    3.2.3.1.8. Hibernation
    { lib, config, ... }:
@@ -5348,8 +5348,8 @@ in
    -
    -
    3.2.3.1.9. BTRFS
    +
    +
    3.2.3.1.9. BTRFS
    { lib, config, ... }:
@@ -5370,8 +5370,8 @@ in
    -
    -
    3.2.3.1.10. Local Server
    +
    +
    3.2.3.1.10. Local Server
    { lib, config, ... }:
@@ -5424,8 +5424,8 @@ in
    -
    -
    3.2.3.1.11. OCI Sync Server
    +
    +
    3.2.3.1.11. OCI Sync Server
    { lib, config, ... }:
@@ -5481,8 +5481,8 @@ in
    -
    -
    3.2.3.2.1. Personal
    +
    +
    3.2.3.2.1. Personal
    { lib, config, ... }:
@@ -5539,8 +5539,8 @@ in
    -
    -
    3.2.3.2.2. Chaostheatre
    +
    +
    3.2.3.2.2. Chaostheatre
    { lib, config, ... }:
@@ -5592,8 +5592,8 @@ in
    -
    -
    3.2.3.2.3. toto
    +
    +
    3.2.3.2.3. toto
    { lib, config, ... }:
@@ -5613,8 +5613,8 @@ in
    -
    -
    3.2.3.2.4. Work
    +
    +
    3.2.3.2.4. Work
    { lib, config, ... }:
@@ -5634,8 +5634,8 @@ in
    -
    -
    3.2.3.2.5. Framework
    +
    +
    3.2.3.2.5. Framework
    { lib, config, ... }:
@@ -5656,8 +5656,8 @@ in
    -
    -
    3.2.3.2.6. Darwin
    +
    +
    3.2.3.2.6. Darwin
    { lib, config, ... }:
@@ -5675,8 +5675,8 @@ in
    -
    -
    3.2.3.2.7. Local Server
    +
    +
    3.2.3.2.7. Local Server
    { lib, config, ... }:
@@ -5916,12 +5916,12 @@ in
    -
    -

    3.2.5. Auxiliary files

    +
    +

    3.2.5. Auxiliary files

    -
    -
    3.2.5.1. extra-builtins
    +
    +
    3.2.5.1. extra-builtins
    @@ -5956,8 +5956,8 @@ in
    -
    -
    3.2.5.2. sops-decrypt-and-cache
    +
    +
    3.2.5.2. sops-decrypt-and-cache
    #!/usr/bin/env bash
@@ -6936,8 +6936,8 @@ Setup timezone and locale. I want to use the US layout, but have the rest adapte
    -
    -
    3.3.1.17. Meta options
    +
    +
    3.3.1.17. Meta options
    { lib, ... }:
@@ -7025,8 +7025,8 @@ in
    -
    -
    3.3.1.19. PII management
    +
    +
    3.3.1.19. PII management
    { config, inputs, lib, ... }:
@@ -7418,8 +7418,8 @@ Most of the time I am using power-saver, however, it is good to be
    -
    -
    3.3.1.22.6. SwayOSD
    +
    +
    3.3.1.22.6. SwayOSD
    { lib, pkgs, config, ... }:
@@ -8547,6 +8547,8 @@ Here I am forcing startWhenNeeded to false so that the value will n
         ScanSchedule = "@every 24h";
         MPVPath = "${pkgs.mpv}/bin/mpv";
         MPVCommandTemplate = "mpv --audio-device=%d --no-audio-display --pause %f";
+        ReverseProxyWhitelist = "0.0.0.0/0";
+        ReverseProxyUserHeader = "X-User";
         Jukebox = {
           Enabled = true;
           Default = "default";
@@ -8579,6 +8581,23 @@ Here I am forcing startWhenNeeded to false so that the value will n
               proxyPass = "http://localhost:4040";
               proxyWebsockets = true;
               extraConfig = ''
+                auth_request /oauth2/auth;
+                error_page 401 = /oauth2/sign_in;
+
+                # pass information via X-User and X-Email headers to backend,
+                # requires running with --set-xauthrequest flag (done by NixOS)
+                auth_request_set $user   $upstream_http_x_auth_request_user;
+                auth_request_set $email  $upstream_http_x_auth_request_email;
+                proxy_set_header X-User  $user;
+                proxy_set_header X-Email $email;
+
+                # if you enabled --pass-access-token, this will pass the token to the backend
+                auth_request_set $token  $upstream_http_x_auth_request_access_token;
+                proxy_set_header X-Access-Token $token;
+
+                # if you enabled --cookie-refresh, this is needed for it to work with auth_request
+                auth_request_set $auth_cookie $upstream_http_set_cookie;
+                add_header Set-Cookie $auth_cookie;
                 proxy_redirect          http:// https://;
                 proxy_read_timeout      600s;
                 proxy_send_timeout      600s;
@@ -8587,6 +8606,52 @@ Here I am forcing startWhenNeeded to false so that the value will n
                 client_max_body_size    0;
               '';
             };
+            "/oauth2/" = {
+              proxyPass = "http://oauth2-proxy";
+              extraConfig = ''
+                proxy_set_header X-Scheme                $scheme;
+                proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
+              '';
+            };
+            "= /oauth2/auth" = {
+              proxyPass = "http://oauth2-proxy/oauth2/auth";
+              extraConfig = ''
+                internal;
+
+                proxy_set_header X-Scheme         $scheme;
+                # nginx auth_request includes headers but not body
+                proxy_set_header Content-Length   "";
+                proxy_pass_request_body           off;
+              '';
+            };
+            "/share" = {
+              proxyPass = "http://localhost:4040";
+              proxyWebsockets = true;
+              extraConfig = ''
+                proxy_redirect          http:// https://;
+                proxy_read_timeout      600s;
+                proxy_send_timeout      600s;
+                proxy_buffering         off;
+                proxy_request_buffering off;
+                client_max_body_size    0;
+                proxy_set_header X-User  "";
+                proxy_set_header X-Email "";
+              '';
+            };
+            "/rest" = {
+              proxyPass = "http://localhost:4040";
+              proxyWebsockets = true;
+              extraConfig = ''
+                proxy_redirect          http:// https://;
+                proxy_read_timeout      600s;
+                proxy_send_timeout      600s;
+                proxy_buffering         off;
+                proxy_request_buffering off;
+                client_max_body_size    0;
+                proxy_set_header X-User  "";
+                proxy_set_header X-Email "";
+              '';
+            };
           };
         };
       };
@@ -9945,6 +10010,10 @@ It serves both a Greader API at https://signpost.swarsel.win/api/greader.php
 
    
 
+
    
+FreshRSS claims to support HTTP header auth, but at least it does not work with my oauth2-proxy setup. Until this is fixed, I resorted to the "form" login, since I mostly do not use the web version anyways.
+
    
+
 
    
 
    { lib, config, ... }:
 {
@@ -9990,7 +10059,7 @@ I am using this with CapyReader on my phone, set it up as a FreshRSS account wit
       enable = true;
       virtualHost = "signpost.swarsel.win";
       baseUrl = "https://signpost.swarsel.win";
-      authType = "none";
+      authType = "form";
       dataDir = "/Vault/data/tt-rss";
       defaultUser = "Swarsel";
       passwordFile = config.sops.secrets.fresh.path;
@@ -10014,11 +10083,15 @@ I am using this with CapyReader on my phone, set it up as a FreshRSS account wit
 
                 # pass information via X-User and X-Email headers to backend,
                 # requires running with --set-xauthrequest flag (done by NixOS)
-                auth_request_set $user   $upstream_http_x_auth_request_preferred_username;
-                # Set the email to our own domain in case user change their mail
-                auth_request_set $email  "''${upstream_http_x_auth_request_preferred_username}@swarsel.win";
+                auth_request_set $user   $upstream_http_x_auth_request_user;
+                auth_request_set $email  $upstream_http_x_auth_request_email;
                 proxy_set_header X-User  $user;
                 proxy_set_header X-Email $email;
+                proxy_set_header Remote-User  $user;
+
+                # if you enabled --pass-access-token, this will pass the token to the backend
+                auth_request_set $token  $upstream_http_x_auth_request_access_token;
+                proxy_set_header X-Access-Token $token;
 
                 # if you enabled --cookie-refresh, this is needed for it to work with auth_request
                 auth_request_set $auth_cookie $upstream_http_set_cookie;
@@ -10255,8 +10328,8 @@ in
    -
    -
    3.3.2.27. IDM (kanidm + oauth2-proxy)
    +
    +
    3.3.2.27. IDM (kanidm + oauth2-proxy)

    The forgejo configuration is a little broken and will show a 500 error when signing in through kanidm. However, when pressing back and refreshing the page, I am logged in. Currently I cannot be bothered to fix this. @@ -10358,24 +10431,9 @@ in "freshrss.access" = { }; "firefly.access" = { }; }; - persons = { - swarsel = { - present = true; - mailAddresses = [ "leon@swarsel.win" ]; - legalName = "Leon Schwarzäugl"; - groups = [ - "immich.access" - "paperless.access" - "grafana.access" - "forgejo.access" - "nextcloud.access" - "freshrss.access" - "navidrome.access" - "firefly.access" - ]; - displayName = "Swarsel"; - }; - }; + + inherit (config.repo.secrets.local) persons; + systems = { oauth2 = { immich = { @@ -10613,8 +10671,8 @@ in

    -
    -
    3.3.2.28. Firefly-III
    +
    +
    3.3.2.28. Firefly-III
    { lib, config, ... }:
@@ -10939,8 +10997,8 @@ This smashes Atmosphere 1.3.2 on the switch, which is what I am currenty using.
    -
    -
    3.3.4.6. Framework
    +
    +
    3.3.4.6. Framework

    This holds configuration that is specific to framework laptops. @@ -10978,8 +11036,8 @@ This holds configuration that is specific to framework laptops.

    -
    -
    3.3.4.7. AMD CPU
    +
    +
    3.3.4.7. AMD CPU
    { lib, config, ... }:
@@ -10995,8 +11053,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.8. AMD GPU
    +
    +
    3.3.4.8. AMD GPU
    { lib, config, ... }:
@@ -11018,8 +11076,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.9. Hibernation
    +
    +
    3.3.4.9. Hibernation
    { lib, config, ... }:
@@ -11050,8 +11108,8 @@ This holds configuration that is specific to framework laptops.
    -
    -
    3.3.4.10. BTRFS
    +
    +
    3.3.4.10. BTRFS
    { lib, config, ... }:
@@ -13989,8 +14047,8 @@ The `extraConfig` section here CANNOT be reindented. This has something to do wi
    -
    -
    3.4.1.29.4. SwayOSD
    +
    +
    3.4.1.29.4. SwayOSD
    { lib, config, ... }:
@@ -15236,8 +15294,8 @@ in
    -
    -
    3.4.4.3. Framework
    +
    +
    3.4.4.3. Framework

    This holds configuration that is specific to framework laptops. @@ -19077,8 +19135,8 @@ autocmd DocStart vc-impimba-1.m.imp.ac.at/ui/webconsole mode ignore

    -
    -

    6.3. tridactyl theme

    +
    +

    6.3. tridactyl theme

    @@ -19575,7 +19633,7 @@ sync USER HOST:

    Author: Leon Schwarzäugl

    -

    Created: 2025-06-13 Fr 02:34

    +

    Created: 2025-06-13 Fr 03:31

    Validate

    diff --git a/modules/nixos/server/freshrss.nix b/modules/nixos/server/freshrss.nix index 3f5c946..9076e1b 100644 --- a/modules/nixos/server/freshrss.nix +++ b/modules/nixos/server/freshrss.nix @@ -42,7 +42,7 @@ enable = true; virtualHost = "signpost.swarsel.win"; baseUrl = "https://signpost.swarsel.win"; - authType = "none"; + authType = "form"; dataDir = "/Vault/data/tt-rss"; defaultUser = "Swarsel"; passwordFile = config.sops.secrets.fresh.path; @@ -66,11 +66,15 @@ # pass information via X-User and X-Email headers to backend, # requires running with --set-xauthrequest flag (done by NixOS) - auth_request_set $user $upstream_http_x_auth_request_preferred_username; - # Set the email to our own domain in case user change their mail - auth_request_set $email "''${upstream_http_x_auth_request_preferred_username}@swarsel.win"; + auth_request_set $user $upstream_http_x_auth_request_user; + auth_request_set $email $upstream_http_x_auth_request_email; proxy_set_header X-User $user; proxy_set_header X-Email $email; + proxy_set_header Remote-User $user; + + # if you enabled --pass-access-token, this will pass the token to the backend + auth_request_set $token $upstream_http_x_auth_request_access_token; + proxy_set_header X-Access-Token $token; # if you enabled --cookie-refresh, this is needed for it to work with auth_request auth_request_set $auth_cookie $upstream_http_set_cookie; diff --git a/modules/nixos/server/kanidm.nix b/modules/nixos/server/kanidm.nix index f0da1dd..353d7c6 100644 --- a/modules/nixos/server/kanidm.nix +++ b/modules/nixos/server/kanidm.nix @@ -84,24 +84,9 @@ in "freshrss.access" = { }; "firefly.access" = { }; }; - persons = { - swarsel = { - present = true; - mailAddresses = [ "leon@swarsel.win" ]; - legalName = "Leon Schwarzäugl"; - groups = [ - "immich.access" - "paperless.access" - "grafana.access" - "forgejo.access" - "nextcloud.access" - "freshrss.access" - "navidrome.access" - "firefly.access" - ]; - displayName = "Swarsel"; - }; - }; + + inherit (config.repo.secrets.local) persons; + systems = { oauth2 = { immich = { diff --git a/modules/nixos/server/navidrome.nix b/modules/nixos/server/navidrome.nix index 029729d..3c97a50 100644 --- a/modules/nixos/server/navidrome.nix +++ b/modules/nixos/server/navidrome.nix @@ -47,6 +47,8 @@ ScanSchedule = "@every 24h"; MPVPath = "${pkgs.mpv}/bin/mpv"; MPVCommandTemplate = "mpv --audio-device=%d --no-audio-display --pause %f"; + ReverseProxyWhitelist = "0.0.0.0/0"; + ReverseProxyUserHeader = "X-User"; Jukebox = { Enabled = true; Default = "default"; @@ -79,6 +81,23 @@ proxyPass = "http://localhost:4040"; proxyWebsockets = true; extraConfig = '' + auth_request /oauth2/auth; + error_page 401 = /oauth2/sign_in; + + # pass information via X-User and X-Email headers to backend, + # requires running with --set-xauthrequest flag (done by NixOS) + auth_request_set $user $upstream_http_x_auth_request_user; + auth_request_set $email $upstream_http_x_auth_request_email; + proxy_set_header X-User $user; + proxy_set_header X-Email $email; + + # if you enabled --pass-access-token, this will pass the token to the backend + auth_request_set $token $upstream_http_x_auth_request_access_token; + proxy_set_header X-Access-Token $token; + + # if you enabled --cookie-refresh, this is needed for it to work with auth_request + auth_request_set $auth_cookie $upstream_http_set_cookie; + add_header Set-Cookie $auth_cookie; proxy_redirect http:// https://; proxy_read_timeout 600s; proxy_send_timeout 600s; @@ -87,6 +106,52 @@ client_max_body_size 0; ''; }; + "/oauth2/" = { + proxyPass = "http://oauth2-proxy"; + extraConfig = '' + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri; + ''; + }; + "= /oauth2/auth" = { + proxyPass = "http://oauth2-proxy/oauth2/auth"; + extraConfig = '' + internal; + + proxy_set_header X-Scheme $scheme; + # nginx auth_request includes headers but not body + proxy_set_header Content-Length ""; + proxy_pass_request_body off; + ''; + }; + "/share" = { + proxyPass = "http://localhost:4040"; + proxyWebsockets = true; + extraConfig = '' + proxy_redirect http:// https://; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 0; + proxy_set_header X-User ""; + proxy_set_header X-Email ""; + ''; + }; + "/rest" = { + proxyPass = "http://localhost:4040"; + proxyWebsockets = true; + extraConfig = '' + proxy_redirect http:// https://; + proxy_read_timeout 600s; + proxy_send_timeout 600s; + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 0; + proxy_set_header X-User ""; + proxy_set_header X-Email ""; + ''; + }; }; }; };