Auth.nurd.space
Jump to navigation
Jump to search
Server Setup
Caddy
Caddyfile
{
http_port 80
https_port 443
#debug
order authenticate before respond
order authorize before basicauth
security {
oauth identity provider keycloak {
driver generic
realm keycloak
client_id {env.KEYCLOAK_CLIENT_ID}
client_secret {env.KEYCLOAK_CLIENT_SECRET}
scopes openid email profile
metadata_url https://auth.nurd.space/realms/NURDspace/.well-known/openid-configuration
}
authentication portal myportal {
crypto default token lifetime 3600
crypto key sign-verify {env.JWT_SHARED_KEY}
enable identity provider keycloak
cookie domain nurd.space
ui {
links {
"My Identity" "/authzproxy/whoami" icon "las la-user"
}
}
transform user {
match origin keycloak
action add role authp/user
}
}
authorization policy mypolicy {
set auth url /authzproxy/oauth2/keycloak/
allow roles authp/user
bypass uri prefix /authzproxy/
crypto key verify {env.JWT_SHARED_KEY}
}
}
log {
output discard
level ERROR
}
}
(tls_config) {
tls /etc/caddy/https.crt /etc/caddy/https.key
}
https://<hostname> {
import tls_config
authorize with mypolicy
route /authzproxy* {
authenticate with myportal
}
reverse_proxy 127.0.0.1:8080
}
Dockerfile
FROM caddy:2.6.3-builder AS builder
RUN xcaddy build \
--with github.com/greenpau/caddy-security@v1.1.18
FROM caddy:2.6.3
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
.env
JWT_SHARED_KEY=<some token> KEYCLOAK_CLIENT_ID=<client name> KEYCLOAK_CLIENT_SECRET=<client key/cert password>
start.sh
#!/bin/bash
if [ ! -f "https.crt" ]; then
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-keyout https.key -out https.crt -subj "/CN=gpu.vm.nurd.space" \
-addext "subjectAltName=DNS:<hostname>,IP:<ip>"
fi
docker run -d -p 80:8080 -p 443:8443 \
-v $PWD/Caddyfile:/etc/caddy/Caddyfile \
-v $PWD/https.key:/etc/caddy/https.key \
-v $PWD/https.crt:/etc/caddy/https.crt \
-v $PWD/caddy_data:/data \
--network host \
--env-file ./.env \
--restart=always \
nurdscaddy:latest