git.iko.soy/typeable/oauth2-proxy
on master help sign in
Add example local environment with traefik (#1091)

* Add example with traefik and keycloak * Switch to dex * Remove unneeded change in keycloak settings * Taken into account review comments * Add changelog entry Co-authored-by: Frédéric Collonval <frederic.collonval@ariadnext.com> Co-authored-by: Joel Speed <Joel.speed@hotmail.co.uk>

commit5788bebfeebaa1155536eee634fa15c7d4c7e5de authorFrédéric Collonval <fcollonval@gmail.com> dateMon 22 Mar 2021, 14:55 (6 years ago) parent7262945
7 files changed+145−1
compare with master
unifiedsplit
CHANGELOG.md+1 contrib/local-environment/Makefile+8 contrib/local-environment/dex.yaml+1−1 contrib/local-environment/docker-compose-traefik.yaml+49 contrib/local-environment/oauth2-proxy-traefik.cfg+22 contrib/local-environment/traefik/dynamic.yaml+57 contrib/local-environment/traefik/traefik.yaml+7
CHANGELOG.md+1
@@ -36,6 +36,7 @@
3636- [#1039](https://github.com/oauth2-proxy/oauth2-proxy/pull/1039) Ensure errors in tests are logged to the GinkgoWriter (@JoelSpeed)
3737- [#980](https://github.com/oauth2-proxy/oauth2-proxy/pull/980) Add Prometheus metrics endpoint
3838- [#1023](https://github.com/oauth2-proxy/oauth2-proxy/pull/1023) Update docs on Traefik ForwardAuth support without the use of Traefik 'errors' middleware
39+- [#1091](https://github.com/oauth2-proxy/oauth2-proxy/pull/1091) Add an example with Traefik (configuration without Traefik 'errors' middleware)
3940
4041# V7.0.1
4142
contrib/local-environment/Makefile+8
@@ -38,3 +38,11 @@ kubernetes-up:
3838.PHONY: kubernetes-down
3939kubernetes-down:
4040 make -C kubernetes delete-cluster
41+
42+.PHONY: traefik-up
43+traefik-up:
44+ docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d
45+
46+.PHONY: traefik-%
47+traefik-%:
48+ docker-compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*
contrib/local-environment/dex.yaml+1−1
@@ -20,7 +20,7 @@ staticClients:
2020 redirectURIs:
2121 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.
2222 - 'http://localhost:4180/oauth2/callback' # For basic proxy example.
23− - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx example.
23+ - 'http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback' # For nginx and traefik example.
2424 name: 'OAuth2 Proxy'
2525 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
2626enablePasswordDB: true
contrib/local-environment/docker-compose-traefik.yamlnew file+49
@@ -0,0 +1,49 @@
1+# This docker-compose file can be used to bring up an example instance of oauth2-proxy
2+# for manual testing and exploration of features.
3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,
4+# HTTPBin as an example upstream.
5+#
6+# This can either be created using docker-compose
7+# docker-compose -f docker-compose-traefik.yaml <command>
8+# Or:
9+# make traefik-<command> (eg. make traefik-up, make traefik-down)
10+#
11+# Access one of the following URLs to initiate a login flow:
12+# - http://oauth2-proxy.localhost
13+# - http://httpbin.oauth2-proxy.localhost
14+#
15+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost
16+#
17+# Note, the above URLs should work with Chrome, but you may need to add hosts
18+# entries for other browsers
19+# 127.0.0.1 oauth2-proxy.localhost
20+# 127.0.0.1 httpbin.oauth2-proxy.localhost
21+# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost
22+version: '3.0'
23+services:
24+
25+ oauth2-proxy:
26+ ports: []
27+ hostname: oauth2-proxy
28+ volumes:
29+ - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"
30+ networks:
31+ oauth2-proxy:
32+
33+ # Reverse proxy
34+ gateway:
35+ container_name: traefik
36+ image: traefik:2.4.2
37+ volumes:
38+ - "./traefik:/etc/traefik"
39+ ports:
40+ - "80:80"
41+ - "9090:8080"
42+ depends_on:
43+ - oauth2-proxy
44+ networks:
45+ oauth2-proxy:
46+ httpbin:
47+
48+networks:
49+ oauth2-proxy:
contrib/local-environment/oauth2-proxy-traefik.cfgnew file+22
@@ -0,0 +1,22 @@
1+http_address="0.0.0.0:4180"
2+cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
3+provider="oidc"
4+email_domains=["example.com"]
5+oidc_issuer_url="http://dex.localhost:4190/dex"
6+client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
7+client_id="oauth2-proxy"
8+cookie_secure="false"
9+
10+redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"
11+cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.
12+whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.
13+
14+# Mandatory option when using oauth2-proxy with traefik
15+reverse_proxy="true"
16+# Required for traefik with ForwardAuth and static upstream configuration
17+upstreams="static://202"
18+# The following option skip the page requesting the user
19+# to click on a button to be redirected to the identity provider
20+# It can be activated only when traefik is not configure with
21+# the error redirection middleware as this example.
22+skip_provider_button="true"
contrib/local-environment/traefik/dynamic.yamlnew file+57
@@ -0,0 +1,57 @@
1+http:
2+ routers:
3+ oauth2-proxy-route:
4+ rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"
5+ middlewares:
6+ - auth-headers
7+ service: oauth-backend
8+ httpbin-route:
9+ rule: "Host(`httpbin.oauth2-proxy.localhost`)"
10+ service: httpbin-service
11+ middlewares:
12+ - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin
13+ httpbin-route-2:
14+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"
15+ service: httpbin-service
16+ middlewares:
17+ - oauth-auth-wo-redirect # unauthenticated session will return a 401
18+ services-oauth2-route:
19+ rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"
20+ middlewares:
21+ - auth-headers
22+ service: oauth-backend
23+
24+ services:
25+ httpbin-service:
26+ loadBalancer:
27+ servers:
28+ - url: http://httpbin
29+ oauth-backend:
30+ loadBalancer:
31+ servers:
32+ - url: http://oauth2-proxy:4180
33+
34+ middlewares:
35+ auth-headers:
36+ headers:
37+ stsSeconds: 315360000
38+ browserXssFilter: true
39+ contentTypeNosniff: true
40+ forceSTSHeader: true
41+ stsIncludeSubdomains: true
42+ stsPreload: true
43+ frameDeny: true
44+ oauth-auth-redirect:
45+ forwardAuth:
46+ address: http://oauth2-proxy:4180
47+ trustForwardHeader: true
48+ authResponseHeaders:
49+ - X-Auth-Request-Access-Token
50+ - Authorization
51+ oauth-auth-wo-redirect:
52+ forwardAuth:
53+ address: http://oauth2-proxy:4180/oauth2/auth
54+ trustForwardHeader: true
55+ authResponseHeaders:
56+ - X-Auth-Request-Access-Token
57+ - Authorization
contrib/local-environment/traefik/traefik.yamlnew file+7
@@ -0,0 +1,7 @@
1+api:
2+ insecure: true
3+log:
4+ level: INFO
5+providers:
6+ file:
7+ filename: /etc/traefik/dynamic.yaml