@@ -1,49 +1,44 @@
1−# Reverse proxy to oauth2-proxy
2−server {
3− listen 8080;
4− server_name oauth2-proxy.localtest.me;
5−
6− location / {
7− proxy_set_header Host $host;
8− proxy_set_header X-Real-IP $remote_addr;
9− proxy_set_header X-Forwarded-Uri $request_uri;
10−
11− proxy_pass http://oauth2-proxy:4180/;
12− }
13−}
14−
151# Reverse proxy to httpbin
162server {
173 listen 8080;
18− server_name httpbin.localtest.me;
19−
20− auth_request /internal-auth/oauth2/auth;
4+ server_name oauth2-proxy.localtest.me;
5+
6+ location /oauth2/ {
7+ proxy_pass http://oauth2-proxy:4180;
8+ proxy_set_header Host $host;
9+ proxy_set_header X-Real-IP $remote_addr;
10+ proxy_set_header X-Forwarded-Uri $request_uri;
11+ proxy_set_header X-Auth-Request-Redirect $request_uri;
12+ }
2113
22− # On 401, redirect to the sign_in page via a named location
23− # This ensures a proper 302 redirect that browsers will follow
24− error_page 401 = @oauth2_signin;
14+ location = /oauth2/auth {
15+ proxy_pass http://oauth2-proxy:4180;
16+ proxy_set_header Host $host;
17+ proxy_set_header X-Real-IP $remote_addr;
18+ proxy_set_header X-Forwarded-Uri $request_uri;
19+ # nginx auth_request includes headers but not body
20+ proxy_set_header Content-Length "";
21+ proxy_pass_request_body off;
22+ }
2523
2624 location / {
25+ auth_request /oauth2/auth;
26+ error_page 401 = @oauth2_signin;
27+
28+ # pass information via X-User and X-Email headers to backend,
29+ # requires running with --set-xauthrequest flag
30+ auth_request_set $user $upstream_http_x_auth_request_user;
31+ auth_request_set $email $upstream_http_x_auth_request_email;
32+ proxy_set_header X-User $user;
33+ proxy_set_header X-Email $email;
34+
2735 proxy_pass http://httpbin/;
36+ # or "root /path/to/site;" or "fastcgi_pass ..." etc
2837 }
2938
30− # Named location for OAuth2 sign-in redirect
31− # Returns a proper 302 that works with --skip-provider-button
39+ # Named location for handling OAuth2 sign-in redirects
40+ # This ensures the browser receives a proper 302 redirect that it will follow
3241 location @oauth2_signin {
33− return 302 http://oauth2-proxy.localtest.me:8080/oauth2/sign_in?rd=$scheme://$host$request_uri;
34− }
35−
36− # auth_request must be a URI so this allows an internal path to then proxy to
37− # the real auth_request path.
38− # The trailing /'s are required so that nginx strips the prefix before proxying.
39− location /internal-auth/ {
40− internal; # Ensure external users can't access this path
41−
42− # Make sure the OAuth2 Proxy knows where the original request came from.
43− proxy_set_header Host $host;
44− proxy_set_header X-Real-IP $remote_addr;
45− proxy_set_header X-Forwarded-Uri $request_uri;
46−
47− proxy_pass http://oauth2-proxy:4180/;
42+ return 302 /oauth2/sign_in?rd=$scheme://$http_host$request_uri;
4843 }
4944}