kevinveenbirkenbachandClaude Opus 4.8
fc9d8b3b54
Baserow's native SSO is Enterprise-only, so gate the community image with the shared Keycloak oauth2-proxy and patch urls.py (via a custom Dockerfile) with a trusted-header bridge. The bridge provisions/repairs a local Baserow user from the oauth2-proxy identity headers and mints native refresh/access/user_session tokens, mirroring Baserow's own SSO redirect contract (?token=&user_session=). proxy.conf.j2 performs the nginx handoff: an authenticated browser without a jwt_token cookie is 302'd to /api/infinito/sso/login/, which redirects back to /?token=&user_session= for the frontend middleware to consume. bootstrap_admin marks the superuser email_verified + completed_onboarding to skip onboarding. Replace the LDAP service/variant with proxy-gating and rewrite the seaweedfs + persona Playwright tests to drive Baserow through its API using the SSO-minted JWT. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
NGINX Docker Reverse Proxy
Description
This Ansible role deploys NGINX as a high-performance reverse proxy in front of Docker-hosted services.
It provides automatic TLS integration, WebSocket support, and a flexible templating system for per-application configuration.
Overview
Optimised for Arch Linux, the role installs NGINX, prepares opinionated configuration snippets and exposes a simple interface for other roles to drop in new virtual-hosts.
It plays well with Let’s Encrypt, OAuth2 Proxy, and your existing Docker stack.
Purpose
The goal of this role is to deliver a hassle-free, production-ready reverse proxy for self-hosted containers, suitable for homelabs and small-scale production workloads.
Features
- Automatic TLS & HSTS: integrates with the sys-svc-webserver-https role for certificate management.
- Flexible vHost templates: basic and ws_generic flavours cover standard HTTP and WebSocket applications.
- Security headers: sensible defaults plus optional X-Frame-Options / CSP based on application settings.
- WebSocket & HTTP/2 aware: upgrades, keep-alive tuning, and gzip already configured.
- OAuth2 gating: drop-in support when web-app-keycloak's SSO-proxy sidecar is present.
- Modular includes: headers, locations, and global snippets are factored for easy extension.
Credits
Developed and maintained by Kevin Veen-Birkenbach. Learn more at veen.world. Part of the Infinito.Nexus Project. Licensed under the Infinito.Nexus Community License (Non-Commercial).