1amends "../../config/Service.pkl"
2
3import "../../config/site.pkl" as site
4import "../keycloak/service.pkl" as keycloak
5
6meta { name = "Forward Auth" }
7rollout = "overlapped"
8
9requirements {
10 new keycloak.OpenIDClient {
11 clientId = module.id
12 name = module.meta.name
13 }
14}
15
16secrets {
17 ["cookie"] { bytes = 16 }
18}
19
20container {
21 image = "quay.io/oauth2-proxy/oauth2-proxy@sha256:56e3daedf765c7a1eea6e366fbe684be7d3084830ade14b6174570d3c7960954"
22 cpu = 100
23 memory = 256
24 extraHosts { "\(keycloak.container.http.hostname):host-gateway" }
25
26 http {
27 containerPort = 4180
28 checkPath = "/ping"
29 }
30
31 volumes {
32 ["/etc/ssl/certs/ca-certificates.crt"] {
33 src = "/var/lib/studio/ca-bundle.crt"
34 readOnly = true
35 }
36 }
37
38 env {
39 ["OAUTH2_PROXY_CLIENT_ID"] = "${secret.oidc.clientId}"
40 ["OAUTH2_PROXY_CLIENT_SECRET"] = "${secret.oidc.clientSecret}"
41 ["OAUTH2_PROXY_COOKIE_SECRET"] = "${secret.own.cookie}"
42 ["OAUTH2_PROXY_PROVIDER"] = "keycloak-oidc"
43 ["OAUTH2_PROXY_OIDC_ISSUER_URL"] = "https://\(keycloak.container.http.hostname)/realms/master"
44 // OAuth2 Proxy requires this claim even when Keycloak accounts have no email.
45 ["OAUTH2_PROXY_OIDC_EMAIL_CLAIM"] = "preferred_username"
46 ["OAUTH2_PROXY_CODE_CHALLENGE_METHOD"] = "S256"
47 ["OAUTH2_PROXY_EMAIL_DOMAINS"] = "*"
48 ["OAUTH2_PROXY_HTTP_ADDRESS"] = "0.0.0.0:4180"
49 ["OAUTH2_PROXY_PROXY_PREFIX"] = "/snow.oauth2"
50 ["OAUTH2_PROXY_SKIP_PROVIDER_BUTTON"] = "true"
51 ["OAUTH2_PROXY_REVERSE_PROXY"] = "true"
52 ["OAUTH2_PROXY_WHITELIST_DOMAINS"] = "*.\(site.domain)"
53 ["OAUTH2_PROXY_COOKIE_DOMAINS"] = ".\(site.domain)"
54 ["OAUTH2_PROXY_SET_XAUTHREQUEST"] = "true"
55 ["OAUTH2_PROXY_PASS_USER_HEADERS"] = "true"
56 ["OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL"] = "true"
57 ["OAUTH2_PROXY_UPSTREAMS"] = "static://202"
58 }
59}