diff options
Diffstat (limited to 'nginx/nginx.conf')
| -rw-r--r-- | nginx/nginx.conf | 147 |
1 files changed, 116 insertions, 31 deletions
diff --git a/nginx/nginx.conf b/nginx/nginx.conf index 382ee62..7ac081c 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -115,27 +115,21 @@ server { proxy_redirect / /cgit/; } - # Gerrit via path prefix on main domain - location /gerrit { - auth_request /_authelia-auth; - auth_request_set $authelia_user $upstream_http_remote_user; - proxy_pass http://gerrit:8080/gerrit; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-User $authelia_user; + + # Gerrit — redirect to subdomain (Gerrit doesn't support subpath proxying) + location = /gerrit { + return 301 https://gerrit.swave.lol/; + } + location ~ ^/gerrit/(.*)$ { + return 301 https://gerrit.swave.lol/$1; } - # Jenkins via path prefix on main domain - location /jenkins { - auth_request /_authelia-auth; - auth_request_set $authelia_user $upstream_http_remote_user; - proxy_pass http://jenkins:8080/jenkins; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; + # Jenkins — redirect to subdomain (strips /jenkins prefix) + location = /jenkins { + return 301 https://jenkins.swave.lol/; + } + location ~ ^/jenkins/(.*)$ { + return 301 https://jenkins.swave.lol/$1; } # Nexus via path prefix on main domain @@ -162,7 +156,9 @@ server { # Authelia forward-auth subrequest endpoint location = /_authelia-auth { internal; - proxy_pass http://authelia:9091/api/verify; + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091/api/verify; + proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; @@ -210,16 +206,19 @@ server { charset utf-8; - # Jenkins requires --prefix=/jenkins, so all URLs must go through /jenkins - # Redirect root to /jenkins, then proxy /jenkins to Jenkins - location = / { - return 302 https://$host/jenkins/; + # OIDC callback — must bypass auth_request so Jenkins can process the code/state + location = /securityRealm/finishLogin { + proxy_pass http://jenkins:8080/securityRealm/finishLogin; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; } - location /jenkins { + location / { auth_request /_authelia-auth; auth_request_set $authelia_user $upstream_http_remote_user; - proxy_pass http://jenkins:8080/jenkins; + proxy_pass http://jenkins:8080; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; @@ -229,7 +228,9 @@ server { # Authelia forward-auth subrequest endpoint location = /_authelia-auth { internal; - proxy_pass http://authelia:9091/api/verify; + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091/api/verify; + proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; @@ -317,21 +318,37 @@ server { charset utf-8; - location / { + # /login/ — auth_request fires here, X-Forwarded-User injected, Gerrit creates session + location /login { auth_request /_authelia-auth; auth_request_set $authelia_user $upstream_http_remote_user; - proxy_pass http://gerrit:8080; + proxy_pass http://gerrit:8080/login; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-User $authelia_user; + proxy_redirect http://gerrit:8080/ https://gerrit.swave.lol/; + proxy_redirect ~^http://[^/]+/(.*)$ https://gerrit.swave.lol/$1; + } + + # All other paths — no auth_request, anonymous access allowed, Gerrit session cookie handles login state + location / { + proxy_pass http://gerrit:8080; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_redirect http://gerrit:8080/ https://gerrit.swave.lol/; + proxy_redirect ~^http://[^/]+/(.*)$ https://gerrit.swave.lol/$1; } # Authelia forward-auth subrequest endpoint location = /_authelia-auth { internal; - proxy_pass http://authelia:9091/api/verify; + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091/api/verify; + proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; @@ -397,7 +414,9 @@ server { # Authelia forward-auth subrequest endpoint location = /_authelia-auth { internal; - proxy_pass http://authelia:9091/api/verify; + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091/api/verify; + proxy_pass $authelia_upstream; proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URL $scheme://$http_host$request_uri; @@ -448,10 +467,76 @@ server { chunked_transfer_encoding on; location / { + auth_request /_authelia-auth; + auth_request_set $authelia_user $upstream_http_remote_user; proxy_pass http://nexus:5000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } + + # Authelia forward-auth subrequest endpoint + location = /_authelia-auth { + internal; + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091/api/verify; + proxy_pass $authelia_upstream; + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Forwarded-Method $request_method; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + proxy_set_header X-Forwarded-Uri $request_uri; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } + + error_page 401 = @authelia_login_redirect; + location @authelia_login_redirect { + return 302 https://auth.swave.lol/?rd=$scheme://$http_host$request_uri; + } +} + +# Authelia — auth.swave.lol +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + + server_name auth.swave.lol; + + server_tokens off; + + ssl_certificate /var/letsencrypt/etc/live/swave.lol/fullchain.pem; + ssl_certificate_key /var/letsencrypt/etc/live/swave.lol/privkey.pem; + + ssl_buffer_size 8k; + + ssl_dhparam /etc/ssl/certs/dhparam-2048.pem; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers on; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + + ssl_ecdh_curve secp384r1; + ssl_session_tickets off; + + # OCSP stapling + ssl_stapling on; + ssl_stapling_verify on; + resolver 8.8.8.8; + + charset utf-8; + + location / { + resolver 127.0.0.11 valid=30s; + set $authelia_upstream http://authelia:9091; + proxy_pass $authelia_upstream; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $http_host; + } } |