Compare commits
2 Commits
7ec83f72c0
...
bebf2739ef
| Author | SHA1 | Date | |
|---|---|---|---|
|
bebf2739ef
|
|||
|
e8d45bbc33
|
17
Dockerfile
17
Dockerfile
@@ -1,3 +1,18 @@
|
|||||||
FROM ghcr.io/authcrunch/authcrunch:latest
|
FROM caddy/caddy:2.9.1-builder-alpine AS builder
|
||||||
|
|
||||||
|
RUN xcaddy build \
|
||||||
|
--with github.com/caddy-dns/cloudflare
|
||||||
|
|
||||||
|
# ==================================================
|
||||||
|
# Run image
|
||||||
|
# ==================================================
|
||||||
|
|
||||||
|
#FROM ghcr.io/authcrunch/authcrunch:latest
|
||||||
|
FROM caddy/caddy:2.9.1-alpine
|
||||||
|
|
||||||
|
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
|
||||||
COPY ./config /etc/caddy
|
COPY ./config /etc/caddy
|
||||||
|
|
||||||
RUN /usr/bin/caddy fmt --overwrite /etc/caddy/Caddyfile
|
RUN /usr/bin/caddy fmt --overwrite /etc/caddy/Caddyfile
|
||||||
|
|
||||||
|
CMD ["/usr/bin/caddy", "run", "--config", "/etc/caddy/Caddyfile"]
|
||||||
|
|||||||
@@ -1,38 +1,5 @@
|
|||||||
{
|
{
|
||||||
email {env.ACME_EMAIL}
|
email {env.ACME_EMAIL}
|
||||||
|
|
||||||
# Configure caddy-security.
|
|
||||||
order authenticate before respond
|
|
||||||
|
|
||||||
security {
|
|
||||||
oauth identity provider generic {
|
|
||||||
delay_start 3
|
|
||||||
realm generic
|
|
||||||
driver generic
|
|
||||||
client_id {env.OAUTH_CLIENT_ID}
|
|
||||||
client_secret {env.OAUTH_CLIENT_SECRET}
|
|
||||||
scopes openid email profile
|
|
||||||
base_auth_url https://id.housh.dev
|
|
||||||
metadata_url https://id.housh.dev/.well-known/openid-configuration
|
|
||||||
}
|
|
||||||
|
|
||||||
authentication portal myportal {
|
|
||||||
crypto default token lifetime 3600 # Seconds until you have to re-authenticate
|
|
||||||
enable identity provider generic
|
|
||||||
cookie insecure off # Set to "on" if you're not using HTTPS
|
|
||||||
|
|
||||||
transform user {
|
|
||||||
match realm generic
|
|
||||||
action add role user
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
authorization policy mypolicy {
|
|
||||||
set auth url /caddy-security/oauth2/generic
|
|
||||||
allow roles user
|
|
||||||
inject headers with claims
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
# Subdomains
|
# Subdomains
|
||||||
@@ -98,19 +65,8 @@
|
|||||||
|
|
||||||
@docs host docs.housh.dev
|
@docs host docs.housh.dev
|
||||||
handle @docs {
|
handle @docs {
|
||||||
@auth {
|
|
||||||
path /caddy-security/*
|
|
||||||
}
|
|
||||||
|
|
||||||
route @auth {
|
|
||||||
authenticate with myportal
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
route /* {
|
|
||||||
reverse_proxy docs:80
|
reverse_proxy docs:80
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
|
||||||
@pocket_id host id.housh.dev
|
@pocket_id host id.housh.dev
|
||||||
handle @pocket_id {
|
handle @pocket_id {
|
||||||
|
|||||||
Reference in New Issue
Block a user