982777addb
Migrate from homelab.fhirworx.io (LAN-only, IP allowlist) to fhirworx.io (public, Gitea SSO via oauth2-proxy). - Domain: homelab.fhirworx.io → fhirworx.io across all configs - SSO: oauth2-proxy (OIDC/Gitea) + auth-handler nginx for Traefik ForwardAuth (converts 401 → 302 redirect, same as corwins.media auth_request pattern) - Cloudflared: tunnel remote config with 20 hostnames → traefik, DNS CNAME records via CF API - Bootstrap: `docker compose run --rm wire` — idempotent cold-start that creates Gitea admin, OAuth2 app, oauth2-proxy credentials, clears Cloudflare Access apps, syncs tunnel config + DNS - Dashboard: rebranded FHIRWORX, HTTPS links, API tile added - Grafana/Woodpecker/Gitea ROOT_URLs updated to HTTPS
40 lines
1.2 KiB
Plaintext
40 lines
1.2 KiB
Plaintext
# Auth handler for Traefik ForwardAuth → oauth2-proxy.
|
|
#
|
|
# Traefik ForwardAuth sends the request here. nginx checks the session
|
|
# cookie via oauth2-proxy /oauth2/auth:
|
|
# - authenticated → 200 (Traefik grants access)
|
|
# - unauthenticated → 302 to oauth2-proxy sign_in (browser follows redirect)
|
|
#
|
|
# This is the Traefik equivalent of nginx auth_request + error_page 401.
|
|
|
|
resolver 127.0.0.11 valid=15s ipv6=off;
|
|
|
|
server {
|
|
listen 4181;
|
|
|
|
set $oauth2 http://oauth2-proxy:4180;
|
|
|
|
location / {
|
|
proxy_pass $oauth2/oauth2/auth;
|
|
proxy_set_header Host auth.$host_domain;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_set_header X-Forwarded-Host $http_x_forwarded_host;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
|
|
proxy_intercept_errors on;
|
|
error_page 401 = @signin;
|
|
}
|
|
|
|
location @signin {
|
|
return 302 https://auth.$host_domain/oauth2/start?rd=https://$http_x_forwarded_host$request_uri;
|
|
}
|
|
}
|
|
|
|
# Extract base domain from X-Forwarded-Host (e.g. docs.fhirworx.io → fhirworx.io)
|
|
map $http_x_forwarded_host $host_domain {
|
|
~^[^.]+\.(.+)$ $1;
|
|
default $http_x_forwarded_host;
|
|
}
|