134 lines
5.0 KiB
Plaintext
134 lines
5.0 KiB
Plaintext
# NPM Forward Auth Configuration for Organizr (home.schweitz.net)
|
|
# Test deployment - single service only
|
|
# Date: 2025-11-21
|
|
# Authentik Version: 2024.8.4
|
|
# Standalone Outpost: authentik-proxy (port 9445)
|
|
|
|
# ===================================================================
|
|
# IMPORTANT: Apply this ONLY to home.schweitz.net proxy host
|
|
# DO NOT apply to other services until this is proven stable
|
|
# ===================================================================
|
|
|
|
# Increase buffer size for large headers from Authentik
|
|
proxy_buffers 8 16k;
|
|
proxy_buffer_size 32k;
|
|
|
|
# Forward authentication via standalone outpost
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
|
|
# Capture auth response headers
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
auth_request_set $authentik_username $upstream_http_x_authentik_username;
|
|
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
|
|
auth_request_set $authentik_email $upstream_http_x_authentik_email;
|
|
auth_request_set $authentik_name $upstream_http_x_authentik_name;
|
|
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
|
|
|
|
# Forward auth headers to application
|
|
add_header Set-Cookie $auth_cookie;
|
|
proxy_set_header X-authentik-username $authentik_username;
|
|
proxy_set_header X-authentik-groups $authentik_groups;
|
|
proxy_set_header X-authentik-email $authentik_email;
|
|
proxy_set_header X-authentik-name $authentik_name;
|
|
proxy_set_header X-authentik-uid $authentik_uid;
|
|
|
|
# Outpost proxy location
|
|
location /outpost.goauthentik.io {
|
|
proxy_pass https://localhost:9445/outpost.goauthentik.io;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $http_host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
|
|
# WebSocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
}
|
|
|
|
# Signin redirect handler
|
|
location @goauthentik_proxy_signin {
|
|
internal;
|
|
return 302 https://auth.schweitz.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
|
|
}
|
|
|
|
# ===================================================================
|
|
# DEPLOYMENT INSTRUCTIONS:
|
|
# ===================================================================
|
|
#
|
|
# 1. Open NPM UI: http://192.168.86.149:8000
|
|
# 2. Navigate to: Hosts → Proxy Hosts
|
|
# 3. Find "home.schweitz.net" and click Edit
|
|
# 4. Go to the "Advanced" tab
|
|
# 5. PASTE THIS ENTIRE CONFIGURATION (lines 11-56) into the text box
|
|
# 6. Go to the "SSL" tab
|
|
# 7. Ensure "WebSockets Support" is ENABLED
|
|
# 8. Click "Save"
|
|
#
|
|
# ===================================================================
|
|
# TESTING PROCEDURE:
|
|
# ===================================================================
|
|
#
|
|
# Step 1: Test in Incognito Window
|
|
# - Open incognito/private browsing window
|
|
# - Navigate to: https://home.schweitz.net
|
|
# - Expected: Redirect to https://auth.schweitz.net
|
|
# - Login with Google OAuth
|
|
# - Expected: Redirect back to https://home.schweitz.net
|
|
# - Expected: Organizr loads successfully
|
|
#
|
|
# Step 2: Verify SSO Persistence
|
|
# - Close incognito window
|
|
# - Open new incognito window
|
|
# - Navigate to: https://home.schweitz.net
|
|
# - Expected: Still logged in (cookie persists)
|
|
#
|
|
# Step 3: Check Logs for Errors
|
|
# docker logs authentik-proxy 2>&1 | tail -50
|
|
# - Look for any errors or warnings
|
|
# - Should see successful auth requests
|
|
#
|
|
# Step 4: Test Logout
|
|
# - Navigate to: https://auth.schweitz.net/if/flow/default-invalidation-flow/
|
|
# - Should log out
|
|
# - Try accessing https://home.schweitz.net again
|
|
# - Expected: Redirect to login page
|
|
#
|
|
# ===================================================================
|
|
# ROLLBACK PROCEDURE (if issues occur):
|
|
# ===================================================================
|
|
#
|
|
# 1. Open NPM UI
|
|
# 2. Edit home.schweitz.net proxy host
|
|
# 3. Go to "Advanced" tab
|
|
# 4. DELETE all the configuration
|
|
# 5. Save
|
|
# 6. Organizr will be accessible without authentication again
|
|
#
|
|
# ===================================================================
|
|
# TROUBLESHOOTING:
|
|
# ===================================================================
|
|
#
|
|
# Issue: Redirect loop
|
|
# - Check that auth.schweitz.net does NOT have forward auth enabled
|
|
# - Verify AUTHENTIK_COOKIE_DOMAIN=.schweitz.net in provider settings
|
|
#
|
|
# Issue: 502 Bad Gateway
|
|
# - Check authentik-proxy container is running: docker ps | grep authentik-proxy
|
|
# - Check NPM can reach authentik-proxy: docker exec npm ping authentik-proxy
|
|
#
|
|
# Issue: 500 Internal Server Error
|
|
# - Check authentik-proxy logs: docker logs authentik-proxy
|
|
# - Verify Redis connection is working
|
|
# - Restart authentik-proxy: docker restart authentik-proxy
|
|
#
|
|
# Issue: Authentication works but Organizr doesn't load
|
|
# - Check buffer sizes are set correctly (lines 13-14)
|
|
# - Check WebSocket support is enabled in NPM SSL tab
|
|
#
|
|
# ===================================================================
|