diff options
| -rw-r--r-- | authelia/config/configuration.yml | 27 | ||||
| -rw-r--r-- | nginx/nginx.conf | 25 |
2 files changed, 40 insertions, 12 deletions
diff --git a/authelia/config/configuration.yml b/authelia/config/configuration.yml index 4223001..494b4c4 100644 --- a/authelia/config/configuration.yml +++ b/authelia/config/configuration.yml @@ -51,33 +51,36 @@ access_control: - domain: auth.swave.lol policy: bypass - # Public services — no auth required + # blog/ghost subdomains — fully public - domain: - - swave.lol - blog.swave.lol - ghost.swave.lol policy: bypass - # Cgit — public read-only git browser - - domain: cgit.swave.lol - policy: bypass - - domain: swave.lol - resources: - - '^/cgit(/.*)?$' - policy: bypass - - # Netdata — requires login + # Netdata — requires login (must be before the general swave.lol bypass) - domain: swave.lol resources: - '^/netdata(/.*)?$' policy: one_factor - # Cockpit — requires login + # Cockpit — requires login (must be before the general swave.lol bypass) - domain: swave.lol resources: - '^/cockpit(/.*)?$' policy: one_factor + # Cgit — public read-only git browser + - domain: cgit.swave.lol + policy: bypass + - domain: swave.lol + resources: + - '^/cgit(/.*)?$' + policy: bypass + + # swave.lol main domain — public (Ghost blog), catch-all after protected resources above + - domain: swave.lol + policy: bypass + # Gerrit login — auth_request on /login/ injects X-Forwarded-User once, Gerrit # maintains its own session from there; anonymous users never hit /login/ directly - domain: gerrit.swave.lol diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 181a4cc..2c9f4cf 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -132,6 +132,28 @@ server { return 301 https://jenkins.swave.lol/$1; } + # Netdata — requires Authelia login + location = /netdata { + return 301 /netdata/; + } + + location /netdata/ { + auth_request /_authelia-auth; + auth_request_set $authelia_user $upstream_http_remote_user; + proxy_pass http://172.24.0.2:19999/; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Server $host; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_read_timeout 86400; + # Prevent browser caching — ensures fresh requests always hit auth_request + add_header Cache-Control "no-store" always; + } + # Nexus — no auth_request, Nexus handles its own authentication location /nexus { proxy_pass http://nexus:8081/nexus; @@ -159,6 +181,7 @@ server { proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; + proxy_set_header Cookie $http_cookie; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Forwarded-Method $request_method; proxy_set_header X-Forwarded-Proto $scheme; @@ -231,6 +254,7 @@ server { proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; + proxy_set_header Cookie $http_cookie; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Forwarded-Method $request_method; proxy_set_header X-Forwarded-Proto $scheme; @@ -349,6 +373,7 @@ server { proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; + proxy_set_header Cookie $http_cookie; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Forwarded-Method $request_method; proxy_set_header X-Forwarded-Proto $scheme; |