Auth.nurd.space

Server Setup

Caddy

• https://authp.github.io/docs/authenticate/oauth/backend-oauth2-0011-keycloak

Caddyfile

{
        http_port 80
        https_port 443
        #debug

        order authenticate before respond
        order authorize before basicauth

        security {
                oauth identity provider keycloak {
                        driver generic
                        realm keycloak
                        client_id {env.KEYCLOAK_CLIENT_ID}
                        client_secret {env.KEYCLOAK_CLIENT_SECRET}
                        scopes openid email profile
                        metadata_url https://auth.nurd.space/realms/NURDspace/.well-known/openid-configuration
                }

                authentication portal myportal {
                        crypto default token lifetime 3600
                        crypto key sign-verify {env.JWT_SHARED_KEY}
                        enable identity provider keycloak
                        cookie domain nurd.space
                        ui {
                                links {
                                        "My Identity" "/authzproxy/whoami" icon "las la-user"
                                }
                        }
                        transform user {
                                match origin keycloak
                                action add role authp/user
                        }
                }

                authorization policy mypolicy {
                        set auth url /authzproxy/oauth2/keycloak/
                        allow roles authp/user
                        bypass uri prefix /authzproxy/
                        crypto key verify {env.JWT_SHARED_KEY}
                }
        }
        log {
                output discard
                level ERROR
        }
}

(tls_config) {
        tls /etc/caddy/https.crt /etc/caddy/https.key
}

https://<hostname> {
    import tls_config
    authorize with mypolicy
    route /authzproxy* {
            authenticate with myportal
    }
    reverse_proxy 127.0.0.1:8080
}

Dockerfile

FROM caddy:2.6.3-builder AS builder

RUN xcaddy build \
    --with github.com/greenpau/caddy-security@v1.1.18

FROM caddy:2.6.3

COPY --from=builder /usr/bin/caddy /usr/bin/caddy

.env

JWT_SHARED_KEY=<some token> KEYCLOAK_CLIENT_ID=<client name> KEYCLOAK_CLIENT_SECRET=<client key/cert password>

start.sh

#!/bin/bash
if [ ! -f "https.crt" ]; then
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout https.key -out https.crt -subj "/CN=gpu.vm.nurd.space" \
  -addext "subjectAltName=DNS:<hostname>,IP:<ip>"
fi

docker run -d -p 80:8080 -p 443:8443 \
    -v $PWD/Caddyfile:/etc/caddy/Caddyfile \
    -v $PWD/https.key:/etc/caddy/https.key \
    -v $PWD/https.crt:/etc/caddy/https.crt \
    -v $PWD/caddy_data:/data \
    --network host \
    --env-file ./.env \
    --restart=always \
    nurdscaddy:latest