@@ -0,0 +1,84 @@
1+# Reverse proxy to oauth2-proxy
2+server {
3+ listen 80;
4+ server_name oauth2-proxy.oauth2-proxy.localhost;
5+
6+ location / {
7+ proxy_set_header Host $host;
8+ proxy_set_header X-Real-IP $remote_addr;
9+
10+ proxy_pass http://oauth2-proxy:4180/;
11+ }
12+}
13+
14+# Reverse proxy to httpbin
15+server {
16+ listen 80;
17+ server_name httpbin.oauth2-proxy.localhost;
18+
19+ auth_request /internal-auth/oauth2/auth;
20+
21+ # If the auth_request denies the request (401), redirect to the sign_in page
22+ # and include the final rd URL back to the user's original request.
23+ error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
24+
25+ # Alternatively send the request to `start` to skip the provider button
26+ # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
27+
28+ location / {
29+ proxy_pass http://httpbin/;
30+ }
31+
32+ # auth_request must be a URI so this allows an internal path to then proxy to
33+ # the real auth_request path.
34+ # The trailing /'s are required so that nginx strips the prefix before proxying.
35+ location /internal-auth/ {
36+ internal; # Ensure external users can't access this path
37+
38+ # Make sure the OAuth2 Proxy knows where the original request came from.
39+ proxy_set_header Host $host;
40+ proxy_set_header X-Real-IP $remote_addr;
41+
42+ proxy_pass http://oauth2-proxy:4180/;
43+ }
44+}
45+
46+# Statically serve the nginx welcome
47+server {
48+ listen 80;
49+ server_name oauth2-proxy.localhost;
50+
51+ location / {
52+ auth_request /internal-auth/oauth2/auth;
53+
54+ # If the auth_request denies the request (401), redirect to the sign_in page
55+ # and include the final rd URL back to the user's original request.
56+ error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/sign_in?rd=$scheme://$host$request_uri;
57+
58+ # Alternatively send the request to `start` to skip the provider button
59+ # error_page 401 = http://oauth2-proxy.oauth2-proxy.localhost/oauth2/start?rd=$scheme://$host$request_uri;
60+
61+
62+ root /usr/share/nginx/html;
63+ index index.html index.htm;
64+ }
65+
66+ # redirect server error pages to the static page /50x.html
67+ error_page 500 502 503 504 /50x.html;
68+ location = /50x.html {
69+ root /usr/share/nginx/html;
70+ }
71+
72+ # auth_request must be a URI so this allows an internal path to then proxy to
73+ # the real auth_request path.
74+ # The trailing /'s are required so that nginx strips the prefix before proxying.
75+ location /internal-auth/ {
76+ internal; # Ensure external users can't access this path
77+
78+ # Make sure the OAuth2 Proxy knows where the original request came from.
79+ proxy_set_header Host $host;
80+ proxy_set_header X-Real-IP $remote_addr;
81+
82+ proxy_pass http://oauth2-proxy:4180/;
83+ }
84+}