Infra-Mirrors/docker-swag
1
0
Fork 0
mirror of https://github.com/linuxserver/docker-swag.git synced 2025-01-22 20:51:11 -05:00
Code Issues Packages Projects Releases Wiki Activity

Prevent auth_request on auth subfolder

Browse Source 
adjust dates and comments
This commit is contained in:
Eric Nemchik 2023-02-09 18:19:50 -06:00
parent 5683a3f232
commit 79f6dd4cb1
4 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
readme-vars.yml
View File

@ -154,7 +154,7 @@ app_setup_block: |
# changelog
changelogs:
- { date: "05.02.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Add includable confs for authentik" }
- { date: "09.02.23:", desc: "[Existing users should update:](https://github.com/linuxserver/docker-swag/blob/master/README.md#updating-configs) proxy.conf - Add includable confs for authentik" }
- { date: "21.01.23:", desc: "Unpin certbot version (allow certbot 2.x). !!BREAKING CHANGE!! We are temporarily removing the certbot porkbun plugin until a new version is released that is compatible with certbot 2.x." }
- { date: "20.01.23:", desc: "Rebase to alpine 3.17 with php8.1." }
- { date: "16.01.23:", desc: "Remove nchan module because it keeps causing crashes." }

6
root/defaults/nginx/authentik-location.conf.sample
View File

@ -1,4 +1,4 @@
## Version 2023/02/05 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
## Send a subrequest to Authentik to verify if the user is authenticated and has permission to access the resource.
@ -6,14 +6,14 @@ auth_request /outpost.goauthentik.io/auth/nginx;
## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal.
error_page 401 = @goauthentik_proxy_signin;
## Save the upstream metadata response headers from Authentik to variables.
## Translate response headers from Authentik into variables
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
## Inject the metadata response headers from the variables into the request made to the backend.
## Inject the response header variables into the request made to the actual upstream
proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;

3
root/defaults/nginx/authentik-server.conf.sample
View File

@ -1,8 +1,9 @@
## Version 2023/02/05 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
# location for authentik subfolder requests
location ^~ /outpost.goauthentik.io {
auth_request off; # requests to this subfolder must be accessible without authentication
include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
set $upstream_authentik authentik-server;

2
root/defaults/nginx/proxy.conf.sample
View File

@ -1,4 +1,4 @@
## Version 2023/02/05 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample
# Timeout if the real server is dead
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;