80 lines
2.9 KiB
Python
80 lines
2.9 KiB
Python
import sqlite3
|
|
import datetime
|
|
|
|
conn = sqlite3.connect('/var/lib/docker/volumes/nginx-proxy-manager_nginx-data/_data/database.sqlite')
|
|
now = datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')
|
|
|
|
conn.execute('DELETE FROM proxy_host WHERE id=56;')
|
|
|
|
adv = """# Buffer tuning for Authentik headers
|
|
proxy_buffers 8 16k;
|
|
proxy_buffer_size 32k;
|
|
|
|
# Outpost verification route - plain HTTP to internal VIP
|
|
location /outpost.goauthentik.io {
|
|
auth_request off;
|
|
proxy_pass http://140.44.4.29:9000/outpost.goauthentik.io;
|
|
proxy_set_header Host authentik.snarfnet.net;
|
|
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
|
add_header Set-Cookie $auth_cookie;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
}
|
|
|
|
# Main reverse proxy protected by Forward Auth
|
|
location / {
|
|
proxy_pass http://140.44.4.70:8085;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Websocket support
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $http_connection;
|
|
|
|
# Forward Authentication against Authentik
|
|
auth_request /outpost.goauthentik.io/auth/nginx;
|
|
error_page 401 = @goauthentik_proxy_signin;
|
|
auth_request_set $auth_cookie $upstream_http_set_cookie;
|
|
add_header Set-Cookie $auth_cookie;
|
|
|
|
# Inject Authentik user headers
|
|
auth_request_set $authentik_username $upstream_http_x_authentik_username;
|
|
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
|
|
auth_request_set $authentik_email $upstream_http_x_authentik_email;
|
|
proxy_set_header X-authentik-username $authentik_username;
|
|
proxy_set_header X-authentik-groups $authentik_groups;
|
|
proxy_set_header X-authentik-email $authentik_email;
|
|
}
|
|
|
|
# Redirect to Authentik when unauthenticated
|
|
location @goauthentik_proxy_signin {
|
|
internal;
|
|
auth_request off;
|
|
add_header Set-Cookie $auth_cookie;
|
|
return 302 https://authentik.snarfnet.net/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
|
|
}
|
|
"""
|
|
|
|
conn.execute('''
|
|
INSERT INTO proxy_host (
|
|
id, created_on, modified_on, owner_user_id, is_deleted,
|
|
domain_names, forward_host, forward_port, access_list_id, certificate_id,
|
|
ssl_forced, caching_enabled, block_exploits, advanced_config, meta,
|
|
allow_websocket_upgrade, http2_support, forward_scheme, enabled, locations,
|
|
hsts_enabled, hsts_subdomains, trust_forwarded_proto
|
|
) VALUES (
|
|
56, ?, ?, 1, 0,
|
|
?, '140.44.4.70', 8085, 0, 1,
|
|
1, 1, 1, ?, '{"letsencrypt_agree":false,"dns_challenge":false,"nginx_online":true,"nginx_err":null}',
|
|
1, 0, 'http', 1, '[]',
|
|
1, 1, 0
|
|
)
|
|
''', (now, now, '["vault.snarfnet.net"]', adv))
|
|
conn.commit()
|
|
print("Successfully inserted proxy_host 56")
|
|
conn.close()
|