diff options
| -rw-r--r-- | authelia/config/configuration.yml | 10 | ||||
| -rw-r--r-- | nginx/nginx.conf | 47 |
2 files changed, 8 insertions, 49 deletions
diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml index ace649e..4223001 100644 --- a/authelia/config/configuration.yml +++ b/authelia/config/configuration.yml @@ -94,17 +94,17 @@ access_control: - domain: jenkins.swave.lol policy: one_factor - # Nexus — requires login + # Nexus — bypass; Nexus handles its own authentication - domain: nexus.swave.lol - policy: one_factor + policy: bypass - domain: swave.lol resources: - '^/nexus(/.*)?$' - policy: one_factor + policy: bypass - # Docker registry — requires login + # Docker registry — bypass; Nexus handles its own Basic Auth for docker login - domain: registry.swave.lol - policy: one_factor + policy: bypass # OIDC provider — used by Jenkins for true SSO identity_providers: diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 7ac081c..181a4cc 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -132,10 +132,8 @@ server { return 301 https://jenkins.swave.lol/$1; } - # Nexus via path prefix on main domain + # Nexus — no auth_request, Nexus handles its own authentication location /nexus { - auth_request /_authelia-auth; - auth_request_set $authelia_user $upstream_http_remote_user; proxy_pass http://nexus:8081/nexus; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -401,36 +399,14 @@ server { return 302 https://$host/nexus/; } + # No auth_request — Nexus handles its own authentication location /nexus { - auth_request /_authelia-auth; - auth_request_set $authelia_user $upstream_http_remote_user; proxy_pass http://nexus:8081/nexus; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - - # Authelia forward-auth subrequest endpoint - location = /_authelia-auth { - internal; - resolver 127.0.0.11 valid=30s; - set $authelia_upstream http://authelia:9091/api/verify; - proxy_pass $authelia_upstream; - proxy_pass_request_body off; - proxy_set_header Content-Length ""; - proxy_set_header X-Original-URL $scheme://$http_host$request_uri; - proxy_set_header X-Forwarded-Method $request_method; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $http_host; - proxy_set_header X-Forwarded-Uri $request_uri; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } - - error_page 401 = @authelia_login_redirect; - location @authelia_login_redirect { - return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri; - } } # Docker Registry — registry.swave.lol @@ -466,9 +442,8 @@ server { client_max_body_size 2G; chunked_transfer_encoding on; + # No auth_request — Nexus handles Docker Basic Auth directly location / { - auth_request /_authelia-auth; - auth_request_set $authelia_user $upstream_http_remote_user; proxy_pass http://nexus:5000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; @@ -476,22 +451,6 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } - # Authelia forward-auth subrequest endpoint - location = /_authelia-auth { - internal; - resolver 127.0.0.11 valid=30s; - set $authelia_upstream http://authelia:9091/api/verify; - proxy_pass $authelia_upstream; - proxy_pass_request_body off; - proxy_set_header Content-Length ""; - proxy_set_header X-Original-URL $scheme://$http_host$request_uri; - proxy_set_header X-Forwarded-Method $request_method; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $http_host; - proxy_set_header X-Forwarded-Uri $request_uri; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - } - error_page 401 = @authelia_login_redirect; location @authelia_login_redirect { return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri; |