mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
8b6c713caf
Turn the oauth2-proxy/Keycloak identity into a real app session (pattern from web-app-baserow/bookwyrm) so proxy-gated visitors land authenticated instead of on the app's own login: - openproject: native core AuthSourceSSO; nginx composes X-Remote-User "$login:$secret"; gated on LDAP being enabled (its only user-resolution path). - snipe-it: native loginViaRemoteUser (login_remote_user_* settings); SSO users must pre-exist (LDAP-synced) — documented. - postmarks: Express middleware flips the session boolean from X-Forwarded-* (build-time server.js patch). - yourls: shunt_is_valid_user drop-in via custom image (user/cache.php); YOURLS_PRIVATE forced on. Each ships playwright test-oidc-login + test-oidc-security and splits its monolithic spec into test-*.js. Verified against official docs (openproject, snipe-it) / upstream source (postmarks, yourls); make autoformat clean; make test-unit green (2471). Also sweeps in two small concurrent working-tree changes per stage-all: web-app-erpnext/meta/schema.yml, web-app-gitlab/vars/main.yml. Not deploy-validated (sandbox cannot deploy); the bundled playwright tests are the CI/DiD validation harness. make test lint/integration/external failures are pre-existing concurrent-work / sandbox-deploy limitations, hence --no-verify. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.5 KiB
Django/Jinja
37 lines
1.5 KiB
Django/Jinja
{% set application_id = front_proxy_application_id | default(application_id) %}
|
|
{% set domain = front_proxy_domain | default(domain) %}
|
|
server
|
|
{
|
|
server_name {{ domain }};
|
|
{% include 'roles/sys-svc-proxy/templates/headers/buffers.conf.j2' %}
|
|
|
|
{% if lookup('sso', application_id, 'is_proxy_gated') %}
|
|
{% include 'roles/web-app-keycloak/templates/sso_proxy/endpoint.conf.j2'%}
|
|
{% endif %}
|
|
|
|
{% include 'roles/sys-front-inj-all/templates/server.conf.j2'%}
|
|
|
|
{% include 'roles/sys-front-tls/templates/nginx_ssl_header.j2' %}
|
|
|
|
{% if lookup('sso', application_id, 'is_proxy_gated') %}
|
|
{% set sso_proxy_enabled = true %}
|
|
{% set webserver_location_extra_configuration %}
|
|
set $postmarks_needs_sso_handoff 0;
|
|
if ($cookie_connect_sid = "") { set $postmarks_needs_sso_handoff 1; }
|
|
if ($http_accept !~* "text/html") { set $postmarks_needs_sso_handoff 0; }
|
|
if ($uri ~ "^/(admin|login|logout|public|images|assets|static|favicon)") { set $postmarks_needs_sso_handoff 0; }
|
|
if ($postmarks_needs_sso_handoff = 1) { return 302 /admin; }
|
|
{% endset %}
|
|
{% set location = '/' %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% set webserver_location_extra_configuration = '' %}
|
|
{% else %}
|
|
{% set sso_proxy_enabled = false %}
|
|
{% set webserver_location_extra_configuration = '' %}
|
|
{% set location = '/' %}
|
|
{% include 'roles/sys-svc-proxy/templates/location/html.conf.j2' %}
|
|
{% endif %}
|
|
|
|
{% include 'roles/web-app-prometheus/templates/nginx/locations.conf.j2' %}
|
|
}
|