oidc / oauth2-proxy as default in LXC scripts

[jsapede]

It's quite easy to do this on docker, building a simple stack but what about adding oauth2-proxy as default in LXC without athentification (like zigbee2mqtt, esphome, ...) ?

oauth2-proxy is available as prebuilt binary or GO source :

https://oauth2-proxy.github.io/oauth2-proxy/installation/

and option could be selected during installation script, setting App to be served on 127.0.0.1 and only access from exposed oaut2-proxy

[MickLesk]

Download tarball into usr/local/bin, chmod this enter an config in /etc/oauth2-proxy.cfg and an systemd service after all? its quite easy

[jsapede]

i know its quite easy, its only a suggestion to input basic security for the lxc exposure.
as its easy, wouldnt it be a good idea to propose it in default for scripts ?

[MickLesk]

for default scripts - no.

maybe as addon script for known users, I would say that most helper script users are happy when the LXC's run like this and don't bother with them that much.

[jsapede]

yep maybe addon would be ok

[tremor021]

We really don't want to make "default" assumptions for the user. We do install only the apps inside the LXC, but how they wanna secure it or what additional packages/addon's they want, its up to them.

If we start making default decisions instead of the user, its gonna be a nightmare pretty quick.

Addon script sounds good, but a default not so much.

[jsapede]

just made a try with libretranslate and works perfectly in 5 min