https://blog.ssrf.in/post/protect-the-api-with-oauth2-proxy-and-access-it-with-curl/

docker-compose.yml

version: '2.1'
services:
  app:
    build: app/

  oauth2-proxy:
    build: .
    ports:
      - '44180:4180'
    command: >
      '--http-address=0.0.0.0:4180'
      '--cookie-secure=true'
      '--cookie-expire=24h'
      '--cookie-httponly=true'
      '--cookie-domain=app.example.com'
      '--cookie-name=_oauth2_proxy'
      '--cookie-secret=0123456789abcdef' # REPLACE!
      '--upstream=http://app:80'
      '--email-domain=ssrf.in'
      '--extra-jwt-issuers=https://accounts.google.com=XXXX.apps.googleusercontent.com' # replace your CLIENT_ID
      '--client-id=AAAA.apps.googleusercontent.com' # replace your CLIENT_ID
      '--client-secret=BBBB' # replace your CLIENT_SECRET
      '--skip-jwt-bearer-tokens=true'

  nginx:
    image: 'nginx:1.13.5'
    links:
      - 'app'
      - 'oauth2-proxy'
    volumes:
      - './nginx.conf:/etc/nginx/nginx.conf'
    command: 'nginx'
    depends_on:
      - oauth2-proxy
    links:
      - oauth2-proxy

  https-portal:
    image: 'steveltn/https-portal:1'
    ports:
      - '80:80'
      - '443:443'
    links:
      - 'nginx'
    restart: 'always'
    environment:
      DOMAINS: 'app.example.com -> http://nginx'
      STAGE: 'local'

Dockerfile

FROM debian:jessie

RUN apt update -y
RUN apt-get install ca-certificates -y

COPY oauth2_proxy /bin/

RUN chmod +x /bin/oauth2_proxy

ENTRYPOINT ["/bin/oauth2_proxy"]

gistfile1.txt

user nginx;

pid /var/run/nginx.pid;

worker_processes auto;

events {
    use epoll;
}

http {
  server {
    listen 80;

    ignore_invalid_headers off;

    location /oauth2/ {
      proxy_pass       http://oauth2-proxy:4180;
      proxy_set_header Host                    $host;
      proxy_set_header X-Real-IP               $remote_addr;
      proxy_set_header X-Scheme                $scheme;
      proxy_set_header X-Auth-Request-Redirect $request_uri;
      # or, if you are handling multiple domains:
      # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
    }
    location = /oauth2/auth {
      proxy_pass       http://oauth2-proxy:4180;
      proxy_set_header Host             $host;
      proxy_set_header X-Real-IP        $remote_addr;
      proxy_set_header X-Scheme         $scheme;
      # nginx auth_request includes headers but not body
      proxy_set_header Content-Length   "";
      proxy_pass_request_body           off;
    }

    location / {
      auth_request /oauth2/auth;
      error_page 401 = /oauth2/start?rd=$uri;

      # pass information via X-User and X-Email headers to backend,
      # requires running with --set-xauthrequest flag
      auth_request_set $user   $upstream_http_x_auth_request_user;
      auth_request_set $email  $upstream_http_x_auth_request_email;
      proxy_set_header X-User  $user;
      proxy_set_header X-Email $email;

      # if you enabled --pass-access-token, this will pass the token to the backend
      auth_request_set $token  $upstream_http_x_auth_request_access_token;
      proxy_set_header X-Access-Token $token;

      # if you enabled --cookie-refresh, this is needed for it to work with auth_request
      auth_request_set $auth_cookie $upstream_http_set_cookie;
      add_header Set-Cookie $auth_cookie;

      # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
      # limit and so the OAuth2 Proxy splits these into multiple parts.
      # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
      # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
      auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

      # Extract the Cookie attributes from the first Set-Cookie header and append them
      # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
      if ($auth_cookie ~* "(; .*)") {
          set $auth_cookie_name_0 $auth_cookie;
          set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
      }

      # Send both Set-Cookie headers now if there was a second part
      if ($auth_cookie_name_upstream_1) {
          add_header Set-Cookie $auth_cookie_name_0;
          add_header Set-Cookie $auth_cookie_name_1;
      }

      proxy_pass http://app:80/;
      # or "root /path/to/site;" or "fastcgi_pass ..." etc
    }
  }
}

daemon off;