From fb022a345e1a0fef30e4f351fae97ee3dabb0744 Mon Sep 17 00:00:00 2001 From: zino Date: Tue, 5 Dec 2023 18:53:10 +0100 Subject: [PATCH] m --- docker-compose.yml | 1 + volumes/conf.d/code.zinomedia.de.conf | 26 ------------------- .../validate.vouch.armos.zinomedia.de.conf | 6 +---- volumes/snippets/.gitkeep | 0 volumes/snippets/enable-vouch.conf | 14 ++++++++++ 5 files changed, 16 insertions(+), 31 deletions(-) create mode 100644 volumes/snippets/.gitkeep create mode 100644 volumes/snippets/enable-vouch.conf diff --git a/docker-compose.yml b/docker-compose.yml index 94388c8..e13bb60 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -13,6 +13,7 @@ services: - 443:443 volumes: - ./volumes/conf.d:/etc/nginx/conf.d + - ./volumes/snippets:/etc/nginx/snippets - ./volumes/html:/usr/share/nginx/html - ./volumes/nginx.conf:/etc/nginx/nginx.conf - ./volumes/logs:/var/log/nginx diff --git a/volumes/conf.d/code.zinomedia.de.conf b/volumes/conf.d/code.zinomedia.de.conf index d4efb4d..31aaeee 100644 --- a/volumes/conf.d/code.zinomedia.de.conf +++ b/volumes/conf.d/code.zinomedia.de.conf @@ -22,36 +22,11 @@ server { add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; font-src 'self' data:;" always; - # Vouch # send all requests to the `/validate` endpoint for authorization auth_request /validate; location = /validate { proxy_pass https://validate.vouch.armos.zinomedia.de; - - # forward the /validate request to Vouch Proxy - #proxy_pass http://127.0.0.1:9090/validate; - - # forward the /validate request to Vouch Proxy - #proxy_pass http://vouch:9090/validate; - #resolver 127.0.0.11; - #set $upstream "http://vouch:9090"; - #proxy_pass $upstream; - - # be sure to pass the original host header - #proxy_set_header Host $http_host; - - # Vouch Proxy only acts on the request headers - #proxy_pass_request_body off; - #proxy_set_header Content-Length ""; - - # optionally add X-Vouch-User as returned by Vouch Proxy along with the request - #auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user; - - # these return values are used by the @error401 call - #auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt; - #auth_request_set $auth_resp_err $upstream_http_x_vouch_err; - #auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; } # if validate returns `401 not authorized` then forward the request to the error401block @@ -62,7 +37,6 @@ server { return 302 https://vouch.armos.zinomedia.de/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err; } - location / { resolver 127.0.0.11; set $upstream "code-server:8443"; diff --git a/volumes/conf.d/validate.vouch.armos.zinomedia.de.conf b/volumes/conf.d/validate.vouch.armos.zinomedia.de.conf index 5d57b05..de70f58 100644 --- a/volumes/conf.d/validate.vouch.armos.zinomedia.de.conf +++ b/volumes/conf.d/validate.vouch.armos.zinomedia.de.conf @@ -17,11 +17,6 @@ server { add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; location = /validate { - # forward the /validate request to Vouch Proxy - #proxy_pass http://vouch:9090; - - - # be sure to pass the original host header proxy_set_header Host $http_host; @@ -37,6 +32,7 @@ server { auth_request_set $auth_resp_err $upstream_http_x_vouch_err; auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; + # forward the /validate request to Vouch Proxy resolver 127.0.0.11; set $upstream "http://vouch:9090"; proxy_pass $upstream; diff --git a/volumes/snippets/.gitkeep b/volumes/snippets/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/volumes/snippets/enable-vouch.conf b/volumes/snippets/enable-vouch.conf new file mode 100644 index 0000000..f5c15d9 --- /dev/null +++ b/volumes/snippets/enable-vouch.conf @@ -0,0 +1,14 @@ +# send all requests to the `/validate` endpoint for authorization +auth_request /validate; + +location = /validate { + proxy_pass https://validate.vouch.armos.zinomedia.de; +} + +# if validate returns `401 not authorized` then forward the request to the error401block +error_page 401 = @error401; + +location @error401 { + # redirect to Vouch Proxy for login + return 302 https://vouch.armos.zinomedia.de/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err; +} \ No newline at end of file