3ac834d · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Fix local-environment ports (#3136)

* Change Dex port in local-environment from 4190 to 5556 Port 4190 is blocked by standards-compliant browsers (e.g. Firefox), as per https://fetch.spec.whatwg.org/#port-blocking. Port 5556 is used by Dex in its example config files: https://github.com/dexidp/dex/blob/745e1114f341e849f3b0edde45b39c14017deaf8/examples/config-dev.yaml#L50 * Fix upstream in local-environment/oauth2-proxy.cfg http://httpbin.localtest.me:8080 is only exposed to the host, not to httpbin Docker network. Causes Bad Gateway before. * Do not expose unauthenticated httpbin service in local-environment This defeats the point of having oauth2-proxy. It has already been misleading by causing the bug fixed in cafc6af48fc38f6fe4395fb0c7e2638bc84e6091. It serves as a bad example: users might accidentally expose the service they're trying to protect in the first place. * Remove unnecessary httpbin.localtest.me alias from local-environment

commit3ac834dbcfbb06de1b5168eb6397835f6f6538bb authorSimmo Saan <simmo.saan@gmail.com> dateSun 20 Jul 2025, 21:32 (1 year ago) parent5e7f14b

12 files changed+22−34

compare with master

unifiedsplit

contrib/local-environment/dex.yaml+3−3

@@ -1,7 +1,7 @@

11# This configuration is intended to be used with the docker-compose testing

22# environment.

3−# This should configure Dex to run on port 4190 and provides a static login

4−issuer: http://dex.localtest.me:4190/dex

3+# This should configure Dex to run on port 5556 and provides a static login

4+issuer: http://dex.localtest.me:5556/dex

55storage:

66 type: etcd

77 config:

@@ -9,7 +9,7 @@ storage:

99 - http://etcd:2379

1010 namespace: dex/

1111web:

12− http: 0.0.0.0:4190

12+ http: 0.0.0.0:5556

1313oauth2:

1414 skipApprovalScreen: true

1515expiry:

contrib/local-environment/docker-compose-gitea.yaml+2−5

@@ -34,12 +34,9 @@ services:

3434 container_name: httpbin

3535 image: kennethreitz/httpbin:latest

3636 hostname: httpbin

37− ports:

38− - 8080:80

37+ ports: []

3938 networks:

40− httpbin:

41− aliases:

42− - httpbin.localtest.me

39+ httpbin: {}

4340

4441 gitea:

4542 image: gitea/gitea:1.24.3

contrib/local-environment/docker-compose-keycloak.yaml+2−5

@@ -34,12 +34,9 @@ services:

3434 container_name: httpbin

3535 image: kennethreitz/httpbin:latest

3636 hostname: httpbin

37− ports:

38− - 8080:80/tcp

37+ ports: []

3938 networks:

40− httpbin:

41− aliases:

42− - httpbin.localtest.me

39+ httpbin: {}

4340

4441 keycloak:

4542 container_name: keycloak

contrib/local-environment/docker-compose-nginx.yaml+3−6

@@ -62,7 +62,7 @@ services:

6262 - "./dex.yaml:/dex.yaml"

6363 restart: unless-stopped

6464 ports:

65− - 4190:4190/tcp

65+ - 5556:4181/tcp

6666 networks:

6767 dex:

6868 aliases:

@@ -73,12 +73,9 @@ services:

7373 httpbin:

7474 container_name: httpbin

7575 image: kennethreitz/httpbin

76− ports:

77− - 8080:80/tcp

76+ ports: []

7877 networks:

79− httpbin:

80− aliases:

81− - httpbin.localtest.me

78+ httpbin: {}

8279 etcd:

8380 container_name: etcd

8481 image: gcr.io/etcd-development/etcd:v3.6.2

contrib/local-environment/docker-compose.yaml+3−6

@@ -36,7 +36,7 @@ services:

3636 - "./dex.yaml:/dex.yaml"

3737 restart: unless-stopped

3838 ports:

39− - 4190:4190/tcp

39+ - 5556:4181/tcp

4040 networks:

4141 dex:

4242 aliases:

@@ -47,12 +47,9 @@ services:

4747 httpbin:

4848 container_name: httpbin

4949 image: kennethreitz/httpbin

50− ports:

51− - 8080:80/tcp

50+ ports: []

5251 networks:

53− httpbin:

54− aliases:

55− - httpbin.localtest.me

52+ httpbin: {}

5653 etcd:

5754 container_name: etcd

5855 image: gcr.io/etcd-development/etcd:v3.6.2

contrib/local-environment/oauth2-proxy-alpha-config.yaml+1−1

@@ -20,4 +20,4 @@ providers:

2020 clientSecret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2121 clientID: oauth2-proxy

2222 oidcConfig:

23− issuerURL: http://dex.localhost:4190/dex

23+ issuerURL: http://dex.localhost:5556/dex

contrib/local-environment/oauth2-proxy-keycloak.cfg+1−1

@@ -3,7 +3,7 @@ cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33email_domains="example.com"

44cookie_secure="false"

55upstreams="http://httpbin"

6−cookie_domains=["oauth2-proxy.localtest.me:4080", "httpbin.localtest.me:8080", "keycloak.localtest.me:9080"] # Required so cookie can be read on all subdomains.

6+cookie_domains=["oauth2-proxy.localtest.me:4080", "keycloak.localtest.me:9080"] # Required so cookie can be read on all subdomains.

77whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.

99# keycloak provider

contrib/local-environment/oauth2-proxy-nginx.cfg+1−1

@@ -2,7 +2,7 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains="example.com"

5−oidc_issuer_url="http://dex.localtest.me:4190/dex"

5+oidc_issuer_url="http://dex.localtest.me:5556/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

contrib/local-environment/oauth2-proxy-traefik.cfg+2−2

@@ -2,7 +2,7 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localhost:4190/dex"

5+oidc_issuer_url="http://dex.localhost:5556/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

@@ -13,7 +13,7 @@ whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

16−# Required for traefik with ForwardAuth and static upstream configuration

16+# Required for traefik with ForwardAuth and static upstream configuration

1717upstreams="static://202"

1818# The following option skip the page requesting the user

1919# to click on a button to be redirected to the identity provider

contrib/local-environment/oauth2-proxy.cfg+2−2

@@ -2,7 +2,7 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33email_domains="example.com"

44cookie_secure="false"

5−upstreams="http://httpbin.localtest.me:8080"

5+upstreams="http://httpbin"

66cookie_domains=[".localtest.me"] # Required so cookie can be read on all subdomains.

77whitelist_domains=[".localtest.me"] # Required to allow redirection back to original requested target.

@@ -11,6 +11,6 @@ client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

1111client_id="oauth2-proxy"

1212redirect_url="http://oauth2-proxy.localtest.me:4180/oauth2/callback"

1313

14−oidc_issuer_url="http://dex.localtest.me:4190/dex"

14+oidc_issuer_url="http://dex.localtest.me:5556/dex"

1515provider="oidc"

1616provider_display_name="Dex"

docs/docs/community/contribution.md+1−1

@@ -85,5 +85,5 @@ The docker compose setups expose the services with a dynamic reverse DNS resolve

8585

8686- OAuth2-Proxy: http://oauth2-proxy.localtest.me:4180

8787- Upstream: http://httpbin.localtest.me:8080

88−- Dex: http://dex.localtest.me:4190

88+- Dex: http://dex.localtest.me:5556

8989

docs/versioned_docs/version-7.10.x/community/contribution.md+1−1

@@ -85,5 +85,5 @@ The docker compose setups expose the services with a dynamic reverse DNS resolve

8585

8686- OAuth2-Proxy: http://oauth2-proxy.localtest.me:4180

8787- Upstream: http://httpbin.localtest.me:8080

88−- Dex: http://dex.localtest.me:4190

88+- Dex: http://dex.localtest.me:5556

8989