Nginx + OIDC
==================

.. toctree::
   :maxdepth: 2

.. note:: Servidor web con authenticación externa

**Instalación desde repositorios de Github**

.. code-block:: bash
   :linenos:

   wget -c https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.9.0
   tar xvfz oauth2-proxy-v7.9.0.linux-amd64.tar.gz
   cp oauth2-proxy /usr/local/bin

**Fichero de configuracion /etc/oauth2-proxy.cfg**

   .. code-block:: cfg

      provider = "oidc"
      client_id = "nginx-access"
      client_secret = "l3Gd40pFVIXAh2YewzFy4w6NflaqxVDX"
      redirect_url = "https://dtremino.ddns.net/oauth2/callback"
      oidc_issuer_url = "https://keycloak.dominio.com:8443/realms/TFG-ACCESS"
      cookie_secret = "Zmu6Ise1FMoi4q6rsNO6TBOIvmFngzVJvoEHziIWRvA=" # head -c 32 /dev/urandom | base64 -w 0
      email_domains = [ "*" ]
      http_address = "0.0.0.0:4180"

**Servicio /etc/systemd/system/oauth2-proxy.service**

   .. code-block:: cfg

      [Unit]
      Description=OAuth2 Proxy
      After=network.target
      [Service]
      ExecStart=/usr/local/bin/oauth2-proxy --config /etc/oauth2-proxy.cfg
      Restart=on-failure
      [Install]
      WantedBy=multi-user.target

**Fichero de configuracion /etc/nginx/nginx.conf**

   .. code-block:: cfg

      server {
          listen 443 ssl http2;
          server_name  dominio.com;

          root /opt/html;
          index tfg.html;

          access_log  /var/log/nginx/access_dominio.log  custom;
          error_log   /var/log/nginx/error_dominio.log;

          ssl_dhparam             /etc/letsencrypt/ssl-dhparams.pem;
          ssl_certificate         /etc/letsencrypt/live/dominio.com/fullchain.pem;
          ssl_certificate_key     /etc/letsencrypt/live/dominio.com/privkey.pem;

          location ^~ /oauth2/ {
              proxy_pass       http://127.0.0.1:4180;
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_set_header X-Scheme $scheme;
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          }

          location /emisor/ {
                include /etc/nginx/default.d/oauth2-protect.conf;
                proxy_pass http://10.10.1.25:8081/emisor/;
          }
      }

**Fichero de configuracion /etc/nginx/default.d/oauth2-protect.conf**

   .. code-block:: cfg

      auth_request /oauth2/auth;
      error_page 401 = /oauth2/start;

      # Cabeceras opcionales que tu backend puede usar
      auth_request_set $user        $upstream_http_x_auth_request_user;
      auth_request_set $email       $upstream_http_x_auth_request_email;
      auth_request_set $access_token $upstream_http_x_auth_request_access_token;

      proxy_set_header X-User         $user;
      proxy_set_header X-Email        $email;
      proxy_set_header Authorization  "Bearer $access_token";