www/caddy: Add forward_auth functionality, auth provider Authelia added. (#4063)

* Add forward_auth functionality, Provider Authelia added. * www/caddy: Change position of forward auth in dialogHandle, add ForwardAuth to bootgrid. * www/caddy: Add IPv6 detection logic to the Forward Auth Domain. * Disallow wildcards in hostnames. * Disallow wildcards in hostnames. Fixed spot where it applies. * Remove keys that are already defaults. * Allowing WellKnown is wrong in this context.
2026-05-22 18:44:07 -07:00 · 2024-07-03 14:05:30 +02:00
parent 2705ed9293
commit 7d1f448c21
8 changed files with 80 additions and 0 deletions
@@ -42,6 +42,7 @@ class GeneralController extends IndexController
        $this->view->generalForm = $this->getForm("general");
        $this->view->dnsproviderForm = $this->getForm("dnsprovider");
        $this->view->dynamicdnsForm = $this->getForm("dynamicdns");
+        $this->view->authproviderForm = $this->getForm("authprovider");
        $this->view->logsettingsForm = $this->getForm("logsettings");
    }
 }
@@ -0,0 +1,32 @@
+<form>
+    <field>
+        <id>caddy.general.AuthProvider</id>
+        <label>Forward Auth Provider</label>
+        <type>dropdown</type>
+        <help><![CDATA[Select a Forward Auth Provider. It can be added inside a "Handler" by enabling the "Forward Auth" checkbox. For Authelia only the basic subdomain example is supported. More information: https://www.authelia.com/integration/proxies/caddy/#basic-examples]]></help>
+    </field>
+    <field>
+        <id>caddy.general.AuthToDomain</id>
+        <label>Forward Auth Domain</label>
+        <type>text</type>
+        <help><![CDATA[Enter the domain name or IP address of the chosen Forward Auth Provider.]]></help>
+    </field>
+    <field>
+        <id>caddy.general.AuthToPort</id>
+        <label>Forward Auth Port</label>
+        <type>text</type>
+        <help><![CDATA[Enter the listen port of the chosen Forward Auth Provider.]]></help>
+    </field>
+    <field>
+        <id>caddy.general.AuthToTls</id>
+        <label>TLS</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable or disable HTTP over TLS (HTTPS) to communicate with the Forward Auth Provider.]]></help>
+    </field>
+    <field>
+        <id>caddy.general.AuthToUri</id>
+        <label>Forward Auth URI</label>
+        <type>text</type>
+        <help><![CDATA[Enter the URI of the authz api endpoint.]]></help>
+    </field>
+</form>
@@ -36,6 +36,17 @@
        <type>text</type>
        <help><![CDATA[Enter a description for this handler.]]></help>
    </field>
+    <field>
+        <type>header</type>
+        <label>Access</label>
+        <collapse>true</collapse>
+    </field>
+    <field>
+        <id>handle.ForwardAuth</id>
+        <label>Forward Auth</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable or disable Forward Auth. Requires an "Auth Provider" in "General Settings". Headers are set automatically to the standard of the chosen provider. Enabling this option will additionally generate the forward_auth directive in front of the reverse_proxy directive inside the scope of this handler.]]></help>
+    </field>
    <field>
        <type>header</type>
        <label>Header</label>
@@ -126,6 +126,19 @@
                <ValidationMessage>Please enter a valid number from 0 to 2147483647 seconds or leave empty for default.</ValidationMessage>
            </DynDnsTtl>
            <DynDnsUpdateOnly type="BooleanField"/>
+            <AuthProvider type="OptionField">
+                <BlankDesc>None (default)</BlankDesc>
+                <OptionValues>
+                    <authelia>Authelia</authelia>
+                </OptionValues>
+            </AuthProvider>
+            <AuthToDomain type="HostnameField"/>
+            <AuthToPort type="PortField"/>
+            <AuthToTls type="BooleanField"/>
+            <AuthToUri type="TextField">
+                <Mask>/^(\/.*)?$/u</Mask>
+                <ValidationMessage>Please enter a valid 'URI' that starts with '/'.</ValidationMessage>
+            </AuthToUri>
        </general>
        <reverseproxy>
            <reverse type="ArrayField">
@@ -300,6 +313,7 @@
                    <MaximumValue>100</MaximumValue>
                    <ValidationMessage>Please enter a value between 1 to 100.</ValidationMessage>
                </PassiveHealthFailDuration>
+                <ForwardAuth type="BooleanField"/>
                <HttpTls type="BooleanField">
                    <Constraints>
                        <check001>
@@ -137,6 +137,7 @@
    <li class="active"><a data-toggle="tab" href="#generalTab">{{ lang._('General') }}</a></li>
    <li><a data-toggle="tab" href="#dnsProviderTab">{{ lang._('DNS Provider') }}</a></li>
    <li><a data-toggle="tab" href="#dynamicDnsTab">{{ lang._('Dynamic DNS') }}</a></li>
+    <li><a data-toggle="tab" href="#authProviderTab">{{ lang._('Auth Provider') }}</a></li>
    <li><a data-toggle="tab" href="#logSettingsTab">{{ lang._('Log Settings') }}</a></li>
 </ul>

@@ -154,6 +155,10 @@
    <div id="dynamicDnsTab" class="tab-pane fade">
        {{ partial("layout_partials/base_form", ['fields': dynamicdnsForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }}
    </div>
+    <!-- Auth Provider Tab -->
+    <div id="authProviderTab" class="tab-pane fade">
+        {{ partial("layout_partials/base_form", ['fields': authproviderForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }}
+    </div>
    <!-- Log Settings Tab -->
    <div id="logSettingsTab" class="tab-pane fade">
        {{ partial("layout_partials/base_form", ['fields': logsettingsForm, 'action': '/ui/caddy/general', 'id': 'frm_GeneralSettings']) }}
@@ -334,6 +334,7 @@
                            <th data-column-id="ToPort" data-type="string">{{ lang._('Upstream Port') }}</th>
                            <th data-column-id="ToPath" data-type="string" data-visible="false">{{ lang._('Upstream Path') }}</th>
                            <th data-column-id="PassiveHealthFailDuration" data-type="string" data-visible="false">{{ lang._('Fail Duration') }}</th>
+                            <th data-column-id="ForwardAuth" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('Forward Auth') }}</th>
                            <th data-column-id="HttpTls" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('TLS') }}</th>
                            <th data-column-id="HttpTlsTrustedCaCerts" data-type="string" data-visible="false">{{ lang._('TLS CA') }}</th>
                            <th data-column-id="HttpTlsServerName" data-type="string" data-visible="false">{{ lang._('TLS Server Name') }}</th>
@@ -346,6 +346,9 @@
 #}
 {% macro reverse_proxy_configuration(handle) %}
    {{ handle.HandleType }} {{ handle.HandlePath|default("") }} {
+        {% if handle.ForwardAuth|default("0") == "1" %}
+            {% include "OPNsense/Caddy/includeAuthProvider" %}
+        {% endif %}
        {% if handle.ToPath|default("") != "" %}
        rewrite * {{ handle.ToPath }}{uri}
        {% endif %}
@@ -0,0 +1,13 @@
+{#
+# This file gets imported to configure forward auth in handlers.
+# - Section: Reverse Proxy Configurations
+#}
+{% if generalSettings.AuthProvider == 'authelia' %}
+    {# Check if the domain is IPv6 and wrap in square brackets if necessary #}
+    {% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %}
+    forward_auth {% if generalSettings.AuthToTls|default("0") == "1" %}https://{% endif %}{{ '[' if is_ipv6 else '' }}{{ generalSettings.AuthToDomain|default("") }}{{ ']' if is_ipv6 else '' }}{% if generalSettings.AuthToPort %}:{{ generalSettings.AuthToPort }}{% endif %} {
+    {% if generalSettings.AuthToUri %}uri {{ generalSettings.AuthToUri|default("") }}{% endif %}
+
+    copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+    }
+{% endif %}