Skip to content

Commit d8f6170

Browse files
SubvSubv
committed
Use OpenResty instead of plain nginx to support OpenID Connect authorization.
1 parent f357ad2 commit d8f6170

File tree

5 files changed

+130
-0
lines changed

5 files changed

+130
-0
lines changed

‎backend/templates/_openid_connect.conf

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{% if openidc_enabled -%}
2+
access_by_lua_block {
3+
local openidc = require("resty.openidc")
4+
local opts = {
5+
redirect_uri = "{{- openidc_redirect_uri -}}",
6+
discovery = "{{- openidc_discovery -}}",
7+
token_endpoint_auth_method = "{{- openidc_auth_method -}}",
8+
client_id = "{{- openidc_client_id -}}",
9+
client_secret = "{{- openidc_client_secret -}}",
10+
scope = "openid email profile"
11+
}
12+
13+
local res, err = openidc.authenticate(opts)
14+
15+
if err then
16+
ngx.status = 500
17+
ngx.say(err)
18+
ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
19+
end
20+
21+
22+
ngx.req.set_header("X-OIDC-SUB", res.id_token.sub)
23+
ngx.req.set_header("X-OIDC-EMAIL", res.id_token.email)
24+
ngx.req.set_header("X-OIDC-NAME", res.id_token.name)
25+
}
26+
{% endif %}

‎backend/templates/proxy_host.conf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ server {
3737

3838
{% endif %}
3939

40+
{% include "_openid_connect.conf" %}
41+
4042
{% include "_forced_ssl.conf" %}
4143
{% include "_hsts.conf" %}
4244

‎docker/Dockerfile

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,52 @@ RUN yarn install
4141
# Remove frontend service not required for prod, dev nginx config as well
4242
RUN rm -rf /etc/services.d/frontend RUN rm -f /etc/nginx/conf.d/dev.conf
4343

44+
RUN mkdir -p /opt/luarocks-build && cd /opt/luarocks-build && apk add readline-dev perl pcre-dev openssl-dev zlib-dev
45+
RUN wget -O /opt/luarocks-build/luarocks-3.3.1.tar.gz http://luarocks.github.io/luarocks/releases/luarocks-3.3.1.tar.gz && wget -O /opt/luarocks-build/lua-5.1.5.tar.gz http://www.lua.org/ftp/lua-5.1.5.tar.gz
46+
RUN mkdir -p /opt/openresty-build && cd /opt/openresty-build && wget -O /opt/openresty-build/openresty-1.15.8.3.tar.gz https://openresty.org/download/openresty-1.15.8.3.tar.gz
47+
RUN cd /opt/openresty-build && tar -xvf openresty-1.15.8.3.tar.gz && cd /opt/openresty-build/openresty-1.15.8.3 && ./configure --prefix=/etc/nginx \
48+
--sbin-path=/usr/sbin/nginx \
49+
--modules-path=/usr/lib/nginx/modules \
50+
--conf-path=/etc/nginx/nginx.conf \
51+
--error-log-path=/var/log/nginx/error.log \
52+
--http-log-path=/var/log/nginx/access.log \
53+
--pid-path=/var/run/nginx.pid \
54+
--lock-path=/var/run/nginx.lock \
55+
--http-client-body-temp-path=/var/cache/nginx/client_temp \
56+
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
57+
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
58+
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
59+
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
60+
--user=nginx \
61+
--group=nginx \
62+
--with-compat \
63+
--with-threads \
64+
--with-http_addition_module \
65+
--with-http_auth_request_module \
66+
--with-http_dav_module \
67+
--with-http_flv_module \
68+
--with-http_gunzip_module \
69+
--with-http_gzip_static_module \
70+
--with-http_mp4_module \
71+
--with-http_random_index_module \
72+
--with-http_realip_module \
73+
--with-http_secure_link_module \
74+
--with-http_slice_module \
75+
--with-http_ssl_module \
76+
--with-http_stub_status_module \
77+
--with-http_sub_module \
78+
--with-http_v2_module \
79+
--with-mail \
80+
--with-mail_ssl_module \
81+
--with-stream \
82+
--with-stream_realip_module \
83+
--with-stream_ssl_module \
84+
--with-stream_ssl_preread_module -j2 && make -j2 && make install
85+
RUN cd /opt/luarocks-build && tar -zxf lua-5.1.5.tar.gz && tar zxpf luarocks-3.3.1.tar.gz
86+
RUN cd /opt/luarocks-build/lua-5.1.5 && make linux test && make install
87+
RUN cd /opt/luarocks-build/luarocks-3.3.1 && ./configure && make && make install
88+
RUN apk add unzip && luarocks install lua-resty-openidc && luarocks install lua-cjson
89+
4490
VOLUME [ "/data", "/etc/letsencrypt" ]
4591
CMD [ "/init" ]
4692

‎docker/dev/Dockerfile

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,52 @@ RUN rm -f /etc/nginx/conf.d/production.conf
2323
RUN curl -L -o /tmp/s6-overlay-amd64.tar.gz "https://github.com/just-containers/s6-overlay/releases/download/v1.22.1.0/s6-overlay-amd64.tar.gz" \
2424
&& tar -xzf /tmp/s6-overlay-amd64.tar.gz -C /
2525

26+
RUN mkdir -p /opt/luarocks-build && cd /opt/luarocks-build && apk add readline-dev perl pcre-dev openssl-dev zlib-dev
27+
RUN wget -O /opt/luarocks-build/luarocks-3.3.1.tar.gz http://luarocks.github.io/luarocks/releases/luarocks-3.3.1.tar.gz && wget -O /opt/luarocks-build/lua-5.1.5.tar.gz http://www.lua.org/ftp/lua-5.1.5.tar.gz
28+
RUN mkdir -p /opt/openresty-build && cd /opt/openresty-build && wget -O /opt/openresty-build/openresty-1.15.8.3.tar.gz https://openresty.org/download/openresty-1.15.8.3.tar.gz
29+
RUN cd /opt/openresty-build && tar -xvf openresty-1.15.8.3.tar.gz && cd /opt/openresty-build/openresty-1.15.8.3 && ./configure --prefix=/etc/nginx \
30+
--sbin-path=/usr/sbin/nginx \
31+
--modules-path=/usr/lib/nginx/modules \
32+
--conf-path=/etc/nginx/nginx.conf \
33+
--error-log-path=/var/log/nginx/error.log \
34+
--http-log-path=/var/log/nginx/access.log \
35+
--pid-path=/var/run/nginx.pid \
36+
--lock-path=/var/run/nginx.lock \
37+
--http-client-body-temp-path=/var/cache/nginx/client_temp \
38+
--http-proxy-temp-path=/var/cache/nginx/proxy_temp \
39+
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
40+
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
41+
--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
42+
--user=nginx \
43+
--group=nginx \
44+
--with-compat \
45+
--with-threads \
46+
--with-http_addition_module \
47+
--with-http_auth_request_module \
48+
--with-http_dav_module \
49+
--with-http_flv_module \
50+
--with-http_gunzip_module \
51+
--with-http_gzip_static_module \
52+
--with-http_mp4_module \
53+
--with-http_random_index_module \
54+
--with-http_realip_module \
55+
--with-http_secure_link_module \
56+
--with-http_slice_module \
57+
--with-http_ssl_module \
58+
--with-http_stub_status_module \
59+
--with-http_sub_module \
60+
--with-http_v2_module \
61+
--with-mail \
62+
--with-mail_ssl_module \
63+
--with-stream \
64+
--with-stream_realip_module \
65+
--with-stream_ssl_module \
66+
--with-stream_ssl_preread_module -j2 && make -j2 && make install
67+
RUN cd /opt/luarocks-build && tar -zxf lua-5.1.5.tar.gz && tar zxpf luarocks-3.3.1.tar.gz
68+
RUN cd /opt/luarocks-build/lua-5.1.5 && make linux test && make install
69+
RUN cd /opt/luarocks-build/luarocks-3.3.1 && ./configure && make && make install
70+
RUN apk add unzip && luarocks install lua-resty-openidc && luarocks install lua-cjson
71+
2672
EXPOSE 80
2773
EXPOSE 81
2874
EXPOSE 443

‎docker/rootfs/etc/nginx/nginx.conf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,16 @@ http {
4040
proxy_cache_path /var/lib/nginx/cache/public levels=1:2 keys_zone=public-cache:30m max_size=192m;
4141
proxy_cache_path /var/lib/nginx/cache/private levels=1:2 keys_zone=private-cache:5m max_size=1024m;
4242

43+
lua_package_path '~/lua/?.lua;;';
44+
45+
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
46+
lua_ssl_verify_depth 5;
47+
48+
# cache for discovery metadata documents
49+
lua_shared_dict discovery 1m;
50+
# cache for JWKs
51+
lua_shared_dict jwks 1m;
52+
4353
log_format proxy '[$time_local] $upstream_cache_status $upstream_status $status - $request_method $scheme $host "$request_uri" [Client $remote_addr] [Length $body_bytes_sent] [Gzip $gzip_ratio] [Sent-to $server] "$http_user_agent" "$http_referer"';
4454
log_format standard '[$time_local] $status - $request_method $scheme $host "$request_uri" [Client $remote_addr] [Length $body_bytes_sent] [Gzip $gzip_ratio] "$http_user_agent" "$http_referer"';
4555

0 commit comments

Comments
 (0)