Skip to content

add oauth2-proxy #583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

add oauth2-proxy #583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions root/defaults/nginx/oauth2-proxy-location.conf.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
## Version 2025/08/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/oauth2-proxy-location.conf.sample
# Make sure that your oauth2-proxy container is in the same user defined bridge network and is named oauth2-proxy

auth_request /oauth2/auth;
error_page 401 =302 /oauth2/sign_in;

# pass information via X-User and X-Email headers to backend,
# requires running with --set-xauthrequest flag
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
auth_request_set $groups $upstream_http_x_auth_request_groups;
proxy_set_header X-User $user;
proxy_set_header X-Email $email;
proxy_set_header X-Groups $groups;

# if you enabled --pass-access-token, this will pass the token to the backend
auth_request_set $token $upstream_http_x_auth_request_access_token;
proxy_set_header X-Access-Token $token;

# if you enabled --cookie-refresh, this is needed for it to work with auth_request
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;

# When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
# limit and so the OAuth2 Proxy splits these into multiple parts.
# Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
# so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

# Extract the Cookie attributes from the first Set-Cookie header and append them
# to the second part ($upstream_cookie_* variables only contain the raw cookie content)
if ($auth_cookie ~* "(; .*)") {
set $auth_cookie_name_0 $auth_cookie;
set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
}

# Send both Set-Cookie headers now if there was a second part
if ($auth_cookie_name_upstream_1) {
add_header Set-Cookie $auth_cookie_name_0;
add_header Set-Cookie $auth_cookie_name_1;
}
29 changes: 29 additions & 0 deletions root/defaults/nginx/oauth2-proxy-server.conf.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
## Version 2025/08/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/oauth2-proxy-server.conf.sample
# Make sure that your oauth2-proxy container is in the same user defined bridge network and is named oauth2-proxy

location /oauth2/ {
include /config/nginx/resolver.conf;
set $upstream_oauth2_proxy oauth2-proxy;
proxy_pass http://$upstream_oauth2_proxy:4180;

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Auth-Request-Redirect $request_uri;
# or, if you are handling multiple domains:
# proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}

location = /oauth2/auth {
internal;

include /config/nginx/resolver.conf;
set $upstream_oauth2_proxy oauth2-proxy;
proxy_pass http://$upstream_oauth2_proxy:4180;

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Uri $request_uri;
# nginx auth_request includes headers but not body
proxy_set_header Content-Length "";
proxy_pass_request_body off;
}
20 changes: 19 additions & 1 deletion root/defaults/nginx/site-confs/default.conf.sample
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
## Version 2025/07/18 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample
## Version 2025/08/23 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/site-confs/default.conf.sample

# redirect all traffic to https
server {
Expand Down Expand Up @@ -36,6 +36,12 @@ server {
# enable for Authentik (requires authentik-location.conf in the location block)
#include /config/nginx/authentik-server.conf;

# enable for OAuth2 Proxy (requires oauth2-proxy-location.conf in the location block)
#include /config/nginx/oauth2-proxy-server.conf;

# enable for Tinyauth (requires tinyauth-location.conf in the location block)
#include /config/nginx/tinyauth-server.conf;

location / {
# enable for basic auth
#auth_basic "Restricted";
Expand All @@ -50,6 +56,12 @@ server {
# enable for Authentik (requires authentik-server.conf in the server block)
#include /config/nginx/authentik-location.conf;

# enable for OAuth2 Proxy (requires oauth2-proxy-server.conf in the server block)
#include /config/nginx/oauth2-proxy-location.conf;

# enable for Tinyauth (requires tinyauth-server.conf in the server block)
#include /config/nginx/tinyauth-location.conf;

try_files $uri $uri/ /index.html /index.htm /index.php$is_args$args;
}

Expand All @@ -67,6 +79,12 @@ server {
# enable for Authentik (requires authentik-server.conf in the server block)
#include /config/nginx/authentik-location.conf;

# enable for OAuth2 Proxy (requires oauth2-proxy-server.conf in the server block)
#include /config/nginx/oauth2-proxy-location.conf;

# enable for Tinyauth (requires tinyauth-server.conf in the server block)
#include /config/nginx/tinyauth-location.conf;

fastcgi_split_path_info ^(.+\.php)(.*)$;
if (!-f $document_root$fastcgi_script_name) { return 404; }
fastcgi_pass 127.0.0.1:9000;
Expand Down
8 changes: 8 additions & 0 deletions root/etc/s6-overlay/s6-rc.d/init-swag-config/run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,14 @@ if [[ ! -f /config/nginx/tinyauth-server.conf ]]; then
cp /defaults/nginx/tinyauth-server.conf.sample /config/nginx/tinyauth-server.conf
fi

# copy oauth2-proxy config files if they don't exist
if [[ ! -f /config/nginx/oauth2-proxy-location.conf ]]; then
cp /defaults/nginx/oauth2-proxy-location.conf.sample /config/nginx/oauth2-proxy-location.conf
fi
if [[ ! -f /config/nginx/oauth2-proxy-server.conf ]]; then
cp /defaults/nginx/oauth2-proxy-server.conf.sample /config/nginx/oauth2-proxy-server.conf
fi

# copy old ldap config file to new location
if [[ -f /config/nginx/ldap.conf ]] && [[ ! -f /config/nginx/ldap-server.conf ]]; then
cp /config/nginx/ldap.conf /config/nginx/ldap-server.conf
Expand Down