f7ae0ae · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

test: update traefik setup and use in-memory for all dex instances instead of etcd

Signed-off-by: Jan Larwig <jan@larwig.com>

commitf7ae0ae81e0d9e89fdb8f6ef7103547406057e15 authorJan Larwig <jan@larwig.com> dateTue 18 Aug 2026, 09:59 (1 month ago) parentff9b942

10 files changed+89−87

compare with master

unifiedsplit

contrib/local-environment/Makefile+2−2

@@ -49,8 +49,8 @@ kubernetes-down:

4949

5050.PHONY: traefik-up

5151traefik-up:

52− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml up -d

52+ docker compose -f docker-compose-traefik.yaml up -d

5353

5454.PHONY: traefik-%

5555traefik-%:

56− docker compose -f docker-compose.yaml -f docker-compose-traefik.yaml $*

56+ docker compose -f docker-compose-traefik.yaml $*

contrib/local-environment/dex-traefik.yamlnew file+25

@@ -0,0 +1,25 @@

1+# This configuration is intended to be used with the Traefik local environment.

2+# Dex uses in-memory storage because this environment is disposable.

3+issuer: http://dex.localtest.me/dex

4+storage:

5+ type: memory

6+web:

7+ http: 0.0.0.0:5556

8+oauth2:

9+ skipApprovalScreen: true

10+expiry:

11+ signingKeys: "4h"

12+ idTokens: "1h"

13+staticClients:

14+ - id: oauth2-proxy

15+ redirectURIs:

16+ - "http://oauth2-proxy.localtest.me/oauth2/callback"

17+ name: "OAuth2 Proxy"

18+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

19+enablePasswordDB: true

20+staticPasswords:

21+ - email: "admin@example.com"

22+ # bcrypt hash of the string "password"

23+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

24+ username: "admin"

25+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

contrib/local-environment/dex.yaml+1−6

@@ -3,11 +3,7 @@

33# This should configure Dex to run on port 5556 and provides a static login

44issuer: http://dex.localtest.me:5556/dex

55storage:

6− type: etcd

7− config:

8− endpoints:

9− - http://etcd:2379

10− namespace: dex/

6+ type: memory

117web:

128 http: 0.0.0.0:5556

139oauth2:

@@ -21,7 +17,6 @@ staticClients:

2117 # These redirect URIs point to the `--redirect-url` for OAuth2 proxy.

2218 - "http://oauth2-proxy.localtest.me:4180/oauth2/callback" # For basic proxy example.

2319 - "http://oauth2-proxy.localtest.me:8080/oauth2/callback" # For nginx example.

24− - "http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback" # For traefik example.

2520 name: "OAuth2 Proxy"

2621 secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK

2722enablePasswordDB: true

contrib/local-environment/docker-compose-alpha-config.yaml+1−14

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55# This file also uses alpha configuration when configuring OAuth2 Proxy.

66#

77# This file is an extension of the main compose file and must be used with it

@@ -43,25 +43,12 @@ services:

4343 dex:

4444 aliases:

4545 - dex.localtest.me

46− etcd: {}

47− depends_on:

48− - etcd

4946 httpbin:

5047 container_name: httpbin

5148 image: kennethreitz/httpbin

5249 ports: []

5350 networks:

5451 httpbin: {}

55− etcd:

56− container_name: etcd

57− image: gcr.io/etcd-development/etcd:v3.7.1

58− entrypoint: /usr/local/bin/etcd

59− command:

60− - --listen-client-urls=http://0.0.0.0:2379

61− - --advertise-client-urls=http://etcd:2379

62− networks:

63− etcd: {}

6452networks:

6553 dex: {}

66− etcd: {}

6754 httpbin: {}

contrib/local-environment/docker-compose-nginx.yaml+2−27

@@ -1,24 +1,14 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex, nginx as a reverse proxy and other http services for upstreams

4+# nginx as a reverse proxy and other HTTP services for upstreams.

55#

66# This file is an extension of the main compose file and must be used with it

77# docker-compose -f docker-compose.yaml -f docker-compose-nginx.yaml <command>

88# Alternatively:

99# make nginx-<command> (eg make nginx-up, make nginx-down)

1010#

11−# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

14−#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

11+# Access http://oauth2-proxy.localtest.me:8080 to initiate a login flow.

2212version: "3.0"

2313services:

2414 oauth2-proxy:

@@ -33,7 +23,6 @@ services:

3323 networks:

3424 oauth2-proxy: {}

3525 dex: {}

36− etcd: {}

3726 httpbin: {}

3827 depends_on:

3928 - dex

@@ -52,7 +41,6 @@ services:

5241 networks:

5342 oauth2-proxy: {}

5443 dex: {}

55− etcd: {}

5644 httpbin: {}

5745 dex:

5846 container_name: dex

@@ -68,26 +56,13 @@ services:

6856 dex:

6957 aliases:

7058 - dex.localtest.me

71− etcd: {}

72− depends_on:

73− - etcd

7459 httpbin:

7560 container_name: httpbin

7661 image: kennethreitz/httpbin

7762 ports: []

7863 networks:

7964 httpbin: {}

80− etcd:

81− container_name: etcd

82− image: gcr.io/etcd-development/etcd:v3.7.1

83− entrypoint: /usr/local/bin/etcd

84− command:

85− - --listen-client-urls=http://0.0.0.0:2379

86− - --advertise-client-urls=http://etcd:2379

87− networks:

88− etcd: {}

8965networks:

9066 dex: {}

91− etcd: {}

9267 httpbin: {}

9368 oauth2-proxy: {}

contrib/local-environment/docker-compose-traefik.yaml+40−16

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

3−# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# HTTPBin as an example upstream.

3+# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider

4+# and HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose-traefik.yaml <command>

@@ -9,27 +9,46 @@

99# make traefik-<command> (eg. make traefik-up, make traefik-down)

1010#

1111# Access one of the following URLs to initiate a login flow:

12−# - http://oauth2-proxy.localhost

13−# - http://httpbin.oauth2-proxy.localhost

12+# - http://oauth2-proxy.localtest.me

13+# - http://httpbin.localtest.me

14+# - http://dex.localtest.me/dex

1415#

15−# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.oauth2-proxy.localhost

16−#

17−# Note, the above URLs should work with Chrome, but you may need to add hosts

18−# entries for other browsers

19−# 127.0.0.1 oauth2-proxy.localhost

20−# 127.0.0.1 httpbin.oauth2-proxy.localhost

21−# 127.0.0.1 oauth2-proxy.oauth2-proxy.localhost

22−version: '3.0'

16+# The OAuth2 Proxy itself is hosted at http://oauth2-proxy.localtest.me

2317services:

2418

2519 oauth2-proxy:

20+ container_name: oauth2-proxy

2621 image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3

22+ command: --config /oauth2-proxy.cfg

2723 ports: []

2824 hostname: oauth2-proxy

2925 volumes:

3026 - "./oauth2-proxy-traefik.cfg:/oauth2-proxy.cfg"

27+ restart: unless-stopped

28+ networks:

29+ oauth2-proxy: {}

30+ dex: {}

31+ depends_on:

32+ - dex

33+ - httpbin

34+

35+ dex:

36+ container_name: dex

37+ image: ghcr.io/dexidp/dex:v2.45.1

38+ command: dex serve /dex.yaml

39+ hostname: dex

40+ volumes:

41+ - "./dex-traefik.yaml:/dex.yaml"

42+ restart: unless-stopped

3143 networks:

32− oauth2-proxy:

44+ dex: {}

45+

46+ httpbin:

47+ container_name: httpbin

48+ image: kennethreitz/httpbin

49+ ports: []

50+ networks:

51+ httpbin: {}

3352

3453 # Reverse proxy

3554 gateway:

@@ -43,8 +62,13 @@ services:

4362 depends_on:

4463 - oauth2-proxy

4564 networks:

46− oauth2-proxy:

47− httpbin:

65+ oauth2-proxy: {}

66+ httpbin: {}

67+ dex:

68+ aliases:

69+ - dex.localtest.me

4870

4971networks:

50− oauth2-proxy:

72+ dex: {}

73+ httpbin: {}

74+ oauth2-proxy: {}

contrib/local-environment/docker-compose.yaml+1−14

@@ -1,7 +1,7 @@

11# This docker-compose file can be used to bring up an example instance of oauth2-proxy

22# for manual testing and exploration of features.

33# Alongside OAuth2-Proxy, this file also starts Dex to act as the identity provider,

4−# etcd for storage for Dex and HTTPBin as an example upstream.

4+# HTTPBin as an example upstream.

55#

66# This can either be created using docker-compose

77# docker-compose -f docker-compose.yaml <command>

@@ -41,25 +41,12 @@ services:

4141 dex:

4242 aliases:

4343 - dex.localtest.me

44− etcd: {}

45− depends_on:

46− - etcd

4744 httpbin:

4845 container_name: httpbin

4946 image: kennethreitz/httpbin

5047 ports: []

5148 networks:

5249 httpbin: {}

53− etcd:

54− container_name: etcd

55− image: gcr.io/etcd-development/etcd:v3.7.1

56− entrypoint: /usr/local/bin/etcd

57− command:

58− - --listen-client-urls=http://0.0.0.0:2379

59− - --advertise-client-urls=http://etcd:2379

60− networks:

61− etcd: {}

6250networks:

6351 dex: {}

64− etcd: {}

6552 httpbin: {}

contrib/local-environment/oauth2-proxy-traefik.cfg+4−4

@@ -2,14 +2,14 @@ http_address="0.0.0.0:4180"

22cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

33provider="oidc"

44email_domains=["example.com"]

5−oidc_issuer_url="http://dex.localhost:5556/dex"

5+oidc_issuer_url="http://dex.localtest.me/dex"

66client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

77client_id="oauth2-proxy"

88cookie_secure="false"

10−redirect_url="http://oauth2-proxy.oauth2-proxy.localhost/oauth2/callback"

11−cookie_domains=".oauth2-proxy.localhost" # Required so cookie can be read on all subdomains.

12−whitelist_domains=".oauth2-proxy.localhost" # Required to allow redirection back to original requested target.

10+redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

11+cookie_domains=".localtest.me" # Required so cookie can be read on all subdomains.

12+whitelist_domains=".localtest.me" # Required to allow redirection back to original requested target.

1313

1414# Mandatory option when using oauth2-proxy with traefik

1515reverse_proxy="true"

contrib/local-environment/traefik/dynamic.yaml+11−4

@@ -1,22 +1,25 @@

11http:

22 routers:

33 oauth2-proxy-route:

4− rule: "Host(`oauth2-proxy.oauth2-proxy.localhost`)"

4+ rule: "Host(`oauth2-proxy.localtest.me`)"

55 middlewares:

66 - auth-headers

77 service: oauth-backend

8+ dex-route:

9+ rule: "Host(`dex.localtest.me`)"

10+ service: dex-service

811 httpbin-route:

9− rule: "Host(`httpbin.oauth2-proxy.localhost`)"

12+ rule: "Host(`httpbin.localtest.me`)"

1013 service: httpbin-service

1114 middlewares:

1215 - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin

1316 httpbin-route-2:

14− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/no-auto-redirect`)"

17+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/no-auto-redirect`)"

1518 service: httpbin-service

1619 middlewares:

1720 - oauth-auth-wo-redirect # unauthenticated session will return a 401

1821 services-oauth2-route:

19− rule: "Host(`httpbin.oauth2-proxy.localhost`) && PathPrefix(`/oauth2/`)"

22+ rule: "Host(`httpbin.localtest.me`) && PathPrefix(`/oauth2/`)"

2023 middlewares:

2124 - auth-headers

2225 service: oauth-backend

@@ -30,6 +33,10 @@ http:

3033 loadBalancer:

3134 servers:

3235 - url: http://oauth2-proxy:4180

36+ dex-service:

37+ loadBalancer:

38+ servers:

39+ - url: http://dex:5556

3340

3441 middlewares:

3542 auth-headers:

contrib/local-environment/traefik/traefik.yaml+2

@@ -5,3 +5,5 @@ log:

55providers:

66 file:

77 filename: /etc/traefik/dynamic.yaml

8+ # Routes are static for this example; disabling watch avoids host inotify limits.

9+ watch: false