netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/caddy: Add authentik auth provider (#4104)

Browse Source
This commit is contained in:
Tim
2024-07-22 12:47:02 +02:00
committed by GitHub
parent 9a200512a1
commit 7d837d7f6d
5 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/caddy/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= caddy
PLUGIN_VERSION= 1.6.1
PLUGIN_VERSION= 1.6.2
PLUGIN_DEPENDS= caddy-custom
PLUGIN_COMMENT= Easy to configure Reverse Proxy with Automatic HTTPS and Dynamic DNS
PLUGIN_MAINTAINER= cedrik@pischem.com
www/caddy/pkg-descr
+4
View File
@@ -25,6 +25,10 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
Plugin Changelog
================
1.6.2
* Add Authentik as authentication provider (contributed by Tim-Sc)
1.6.1
Add: Run Caddy as "www" user and group, by enabling "Disable Superuser" in General Settings.
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/authprovider.xml
+1 -1
View File
@@ -3,7 +3,7 @@
<id>caddy.general.AuthProvider</id>
<label>Forward Auth Provider</label>
<type>dropdown</type>
<help><![CDATA[Select a Forward Auth Provider. It can be added inside a "Handler" by enabling the "Forward Auth" checkbox. For Authelia only the basic subdomain example is supported. More information: https://www.authelia.com/integration/proxies/caddy/#basic-examples]]></help>
<help><![CDATA[Select a Forward Auth Provider. It can be added inside a "Handler" by enabling the "Forward Auth" checkbox. For Authelia only the basic subdomain example is supported. More information: https://www.authelia.com/integration/proxies/caddy/#basic-examples. For Authentik custom headers are not supported. More information: https://docs.goauthentik.io/docs/providers/proxy/server_caddy]]></help>
</field>
<field>
<id>caddy.general.AuthToDomain</id>
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+1
View File
@@ -129,6 +129,7 @@
<BlankDesc>None (default)</BlankDesc>
<OptionValues>
<authelia>Authelia</authelia>
<authentik>Authentik</authentik>
</OptionValues>
</AuthProvider>
<AuthToDomain type="HostnameField"/>
www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeAuthProvider
+20 -4
View File
@@ -2,12 +2,28 @@
# This file gets imported to configure forward auth in handlers.
# - Section: Reverse Proxy Configurations
#}
{% if generalSettings.AuthProvider == 'authelia' %}
{% if generalSettings.AuthProvider %}
{# Check if the domain is IPv6 and wrap in square brackets if necessary #}
{% set is_ipv6 = (':' in generalSettings.AuthToDomain and generalSettings.AuthToDomain.count(':') >= 2) %}
forward_auth {% if generalSettings.AuthToTls|default("0") == "1" %}https://{% endif %}{{ '[' if is_ipv6 else '' }}{{ generalSettings.AuthToDomain|default("") }}{{ ']' if is_ipv6 else '' }}{% if generalSettings.AuthToPort %}:{{ generalSettings.AuthToPort }}{% endif %} {
{% if generalSettings.AuthToUri %}uri {{ generalSettings.AuthToUri|default("") }}{% endif %}
{% set auth_url = (generalSettings.AuthToTls|default("0") == "1" and 'https://' or 'http://') + (is_ipv6 and '[' or '') + generalSettings.AuthToDomain|default("") + (is_ipv6 and ']' or '') + (generalSettings.AuthToPort and ':' + generalSettings.AuthToPort or '') %}
{% endif %}
{% if generalSettings.AuthProvider == 'authelia' %}
forward_auth {{ auth_url }} {
{% if generalSettings.AuthToUri %}
uri {{ generalSettings.AuthToUri|default("") }}
{% endif %}
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
{% elif generalSettings.AuthProvider == 'authentik' %}
reverse_proxy /outpost.goauthentik.io/* {{ auth_url }} {
{% if generalSettings.AuthToTls|default("0") == "1" %}
header_up Host {http.reverse_proxy.upstream.hostport}
{% endif %}
}
forward_auth {{ auth_url }} {
{% if generalSettings.AuthToUri %}
uri {{ generalSettings.AuthToUri|default("") }}
{% endif %}
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
}
{% endif %}