@@ -11,63 +11,63 @@ There are two recommended configurations.
1111
12121. Configure SSL Termination with OAuth2 Proxy by providing a `--tls-cert-file=/path/to/cert.pem` and `--tls-key-file=/path/to/cert.key`.
1313
14−The command line to run `oauth2_proxy` in this configuration would look like this:
14+ The command line to run `oauth2_proxy` in this configuration would look like this:
1515
16−```bash
17−./oauth2_proxy \
18− --email-domain="yourcompany.com" \
19− --upstream=http://127.0.0.1:8080/ \
20− --tls-cert-file=/path/to/cert.pem \
21− --tls-key-file=/path/to/cert.key \
22− --cookie-secret=... \
23− --cookie-secure=true \
24− --provider=... \
25− --client-id=... \
26− --client-secret=...
27−```
16+ ```bash
17+ ./oauth2_proxy \
18+ --email-domain="yourcompany.com" \
19+ --upstream=http://127.0.0.1:8080/ \
20+ --tls-cert-file=/path/to/cert.pem \
21+ --tls-key-file=/path/to/cert.key \
22+ --cookie-secret=... \
23+ --cookie-secure=true \
24+ --provider=... \
25+ --client-id=... \
26+ --client-secret=...
27+ ```
2828
29292. Configure SSL Termination with [Nginx](http://nginx.org/) (example config below), Amazon ELB, Google Cloud Platform Load Balancing, or ....
3030
31−Because `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
32−external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
33−`--http-address="http://:4180"`.
31+ Because `oauth2_proxy` listens on `127.0.0.1:4180` by default, to listen on all interfaces (needed when using an
32+ external load balancer like Amazon ELB or Google Platform Load Balancing) use `--http-address="0.0.0.0:4180"` or
33+ `--http-address="http://:4180"`.
3434
35−Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`.
36−`oauth2_proxy` will then authenticate requests for an upstream application. The external endpoint for this example
37−would be `https://internal.yourcompany.com/`.
35+ Nginx will listen on port `443` and handle SSL connections while proxying to `oauth2_proxy` on port `4180`.
36+ `oauth2_proxy` will then authenticate requests for an upstream application. The external endpoint for this example
37+ would be `https://internal.yourcompany.com/`.
3838
39−An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
40−via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
39+ An example Nginx config follows. Note the use of `Strict-Transport-Security` header to pin requests to SSL
40+ via [HSTS](http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security):
4141
42−```
43−server {
44− listen 443 default ssl;
45− server_name internal.yourcompany.com;
46− ssl_certificate /path/to/cert.pem;
47− ssl_certificate_key /path/to/cert.key;
48− add_header Strict-Transport-Security max-age=2592000;
42+ ```
43+ server {
44+ listen 443 default ssl;
45+ server_name internal.yourcompany.com;
46+ ssl_certificate /path/to/cert.pem;
47+ ssl_certificate_key /path/to/cert.key;
48+ add_header Strict-Transport-Security max-age=2592000;
4949
50− location / {
51− proxy_pass http://127.0.0.1:4180;
52− proxy_set_header Host $host;
53− proxy_set_header X-Real-IP $remote_addr;
54− proxy_set_header X-Scheme $scheme;
55− proxy_connect_timeout 1;
56− proxy_send_timeout 30;
57− proxy_read_timeout 30;
50+ location / {
51+ proxy_pass http://127.0.0.1:4180;
52+ proxy_set_header Host $host;
53+ proxy_set_header X-Real-IP $remote_addr;
54+ proxy_set_header X-Scheme $scheme;
55+ proxy_connect_timeout 1;
56+ proxy_send_timeout 30;
57+ proxy_read_timeout 30;
58+ }
5859 }
59−}
60−```
60+ ```
6161
62−The command line to run `oauth2_proxy` in this configuration would look like this:
62+ The command line to run `oauth2_proxy` in this configuration would look like this:
6363
64−```bash
65−./oauth2_proxy \
66− --email-domain="yourcompany.com" \
67− --upstream=http://127.0.0.1:8080/ \
68− --cookie-secret=... \
69− --cookie-secure=true \
70− --provider=... \
71− --client-id=... \
72− --client-secret=...
73−```
64+ ```bash
65+ ./oauth2_proxy \
66+ --email-domain="yourcompany.com" \
67+ --upstream=http://127.0.0.1:8080/ \
68+ --cookie-secret=... \
69+ --cookie-secure=true \
70+ --provider=... \
71+ --client-id=... \
72+ --client-secret=...
73+ ```