@@ -44,3 +44,41 @@ Usage of ./google_auth_proxy:
4444```
4545
4646Unauthenticated requests will be redirected to `/oauth2/sign_in` to start the sign-in process.
47+
48+
49+## Example
50+
51+To run a proxy on port 4180 authenticating requests for an application running
52+on port 8080 at internal.yourcompany.com you would use
53+
54+```bash
55+./google_auth_proxy \
56+ --redirect-url="https://internal.yourcompany.com/oauth2/callback" \
57+ --google-apps-domain="yourcompany.com" \
58+ --upstream=http://127.0.0.1:8080/ \
59+ --cookie-secret=... \
60+ --client-id=... \
61+ --client-secret=...
62+```
63+
64+An example Nginx config to listen on ssl (port 443) and forward requests to port 4180 would be
65+
66+```
67+server {
68+ listen 443 default ssl;
69+ server_name internal.yourcompany.com;
70+ ssl_certificate /path/to/cert.pem;
71+ ssl_certificate_key /path/to/cert.key;
72+ add_header Strict-Transport-Security max-age=1209600;
73+
74+ location / {
75+ proxy_pass http://127.0.0.1:4180;
76+ proxy_set_header Host $host;
77+ proxy_set_header X-Real-IP $remote_addr;
78+ proxy_set_header X-Scheme $scheme;
79+ proxy_connect_timeout 1;
80+ proxy_send_timeout 30;
81+ proxy_read_timeout 30;
82+ }
83+}
84+```