Skip to content

Instantly share code, notes, and snippets.

@mrtc0

mrtc0/Dockerfile Secret

Last active May 11, 2020
Embed
What would you like to do?
version: '2.1'
services:
app:
build: app/
oauth2-proxy:
build: .
ports:
- '44180:4180'
command: >
'--http-address=0.0.0.0:4180'
'--cookie-secure=true'
'--cookie-expire=24h'
'--cookie-httponly=true'
'--cookie-domain=app.example.com'
'--cookie-name=_oauth2_proxy'
'--cookie-secret=0123456789abcdef' # REPLACE!
'--upstream=http://app:80'
'--email-domain=ssrf.in'
'--extra-jwt-issuers=https://accounts.google.com=XXXX.apps.googleusercontent.com' # replace your CLIENT_ID
'--client-id=AAAA.apps.googleusercontent.com' # replace your CLIENT_ID
'--client-secret=BBBB' # replace your CLIENT_SECRET
'--skip-jwt-bearer-tokens=true'
nginx:
image: 'nginx:1.13.5'
links:
- 'app'
- 'oauth2-proxy'
volumes:
- './nginx.conf:/etc/nginx/nginx.conf'
command: 'nginx'
depends_on:
- oauth2-proxy
links:
- oauth2-proxy
https-portal:
image: 'steveltn/https-portal:1'
ports:
- '80:80'
- '443:443'
links:
- 'nginx'
restart: 'always'
environment:
DOMAINS: 'app.example.com -> http://nginx'
STAGE: 'local'
FROM debian:jessie
RUN apt update -y
RUN apt-get install ca-certificates -y
COPY oauth2_proxy /bin/
RUN chmod +x /bin/oauth2_proxy
ENTRYPOINT ["/bin/oauth2_proxy"]
user nginx;
pid /var/run/nginx.pid;
worker_processes auto;
events {
use epoll;
}
http {
server {
listen 80;
ignore_invalid_headers off;
location /oauth2/ {
proxy_pass http://oauth2-proxy:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri;
# or, if you are handling multiple domains:
# proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}
location = /oauth2/auth {
proxy_pass http://oauth2-proxy:4180;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme;
# nginx auth_request includes headers but not body
proxy_set_header Content-Length "";
proxy_pass_request_body off;
}
location / {
auth_request /oauth2/auth;
error_page 401 = /oauth2/start?rd=$uri;
# pass information via X-User and X-Email headers to backend,
# requires running with --set-xauthrequest flag
auth_request_set $user $upstream_http_x_auth_request_user;
auth_request_set $email $upstream_http_x_auth_request_email;
proxy_set_header X-User $user;
proxy_set_header X-Email $email;
# if you enabled --pass-access-token, this will pass the token to the backend
auth_request_set $token $upstream_http_x_auth_request_access_token;
proxy_set_header X-Access-Token $token;
# if you enabled --cookie-refresh, this is needed for it to work with auth_request
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
# When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
# limit and so the OAuth2 Proxy splits these into multiple parts.
# Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
# so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;
# Extract the Cookie attributes from the first Set-Cookie header and append them
# to the second part ($upstream_cookie_* variables only contain the raw cookie content)
if ($auth_cookie ~* "(; .*)") {
set $auth_cookie_name_0 $auth_cookie;
set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
}
# Send both Set-Cookie headers now if there was a second part
if ($auth_cookie_name_upstream_1) {
add_header Set-Cookie $auth_cookie_name_0;
add_header Set-Cookie $auth_cookie_name_1;
}
proxy_pass http://app:80/;
# or "root /path/to/site;" or "fastcgi_pass ..." etc
}
}
}
daemon off;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.