Livebook auth module for forwarded auth headers behind a reverse proxy.

README.md

This is an extremely simply identity provider module for Livebook when running Livebook behind a reverse proxy with forwarded authentication, such as when using Tailscale. For more information, see https://github.com/tailscale/tailscale/tree/main/cmd/nginx-auth and https://caddyserver.com/docs/caddyfile/directives/forward_auth#tailscale.

To use this, just stick webauth.exs in /app/user/extensions or, if using a Docker container for Livebook, stick it somewhere else and mount it into the Docker container via -v /path/to/webauth.exs:/app/user/extensions/webauth.exs:ro. Then, just set LIVEBOOK_IDENTITY_PROVIDER=custom:Webauth when running the Livebook server.

webauth.exs

defmodule Webauth do
  @behaviour Livebook.ZTA

  use GenServer

  def start_link(opts) do
    GenServer.start_link(__MODULE__, :no_state, Keyword.take(opts, [:name]))
  end

  @impl true
  def init(:no_state) do
    {:ok, :no_state}
  end

  @impl true
  def authenticate(_server, conn, _opts \\ []) do
    import Plug.Conn

    user =
      %{
        id: get_req_header(conn, "x-webauth-user") |> only(),
        name: get_req_header(conn, "x-webauth-name") |> only(),
        email: get_req_header(conn, "x-webauth-user") |> only()
      }

    {conn, user}
  end

  defp only([val]), do: val
end