90 lines
2.8 KiB
Plaintext
90 lines
2.8 KiB
Plaintext
# OIDC Identity Provider - Nginx Configuration Snippet
|
|
# Add this to your existing Nginx configuration
|
|
|
|
# Upstream definition
|
|
upstream oidc_backend {
|
|
server 127.0.0.1:5000;
|
|
keepalive 32;
|
|
}
|
|
|
|
# Rate limiting zones (add to http block)
|
|
limit_req_zone $binary_remote_addr zone=oidc_login_limit:10m rate=10r/m;
|
|
limit_req_zone $binary_remote_addr zone=oidc_general_limit:10m rate=100r/m;
|
|
|
|
# Server block for OIDC (HTTPS)
|
|
# Option 1: Dedicated subdomain
|
|
server {
|
|
listen 443 ssl http2;
|
|
server_name auth.yourdomain.com; # Change to your domain
|
|
|
|
# Your existing SSL configuration
|
|
# ssl_certificate /path/to/your/fullchain.pem;
|
|
# ssl_certificate_key /path/to/your/privkey.pem;
|
|
|
|
# Security headers
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
|
|
# Logging
|
|
access_log /var/log/nginx/oidc_access.log;
|
|
error_log /var/log/nginx/oidc_error.log;
|
|
|
|
# Max upload size
|
|
client_max_body_size 10M;
|
|
|
|
# Proxy settings
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Connection "";
|
|
proxy_redirect off;
|
|
|
|
# Health check endpoint (no rate limit)
|
|
location /health {
|
|
proxy_pass http://oidc_backend;
|
|
}
|
|
|
|
# Login endpoints with strict rate limiting
|
|
location ~ ^/(login|admin/login|authorize|token)$ {
|
|
limit_req zone=oidc_login_limit burst=5 nodelay;
|
|
proxy_pass http://oidc_backend;
|
|
}
|
|
|
|
# All other locations
|
|
location / {
|
|
limit_req zone=oidc_general_limit burst=20 nodelay;
|
|
proxy_pass http://oidc_backend;
|
|
}
|
|
}
|
|
|
|
# HTTP to HTTPS redirect
|
|
server {
|
|
listen 80;
|
|
server_name auth.yourdomain.com; # Change to your domain
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# -----------------------------------------------------------
|
|
# Option 2: Path-based (if you prefer /auth/* instead of subdomain)
|
|
# -----------------------------------------------------------
|
|
# Add this to your existing server block instead:
|
|
#
|
|
# location /auth/ {
|
|
# # Rewrite to remove /auth prefix
|
|
# rewrite ^/auth/(.*) /$1 break;
|
|
#
|
|
# proxy_pass http://oidc_backend;
|
|
# proxy_set_header Host $host;
|
|
# proxy_set_header X-Real-IP $remote_addr;
|
|
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
# proxy_set_header X-Forwarded-Proto $scheme;
|
|
# proxy_redirect off;
|
|
# }
|
|
#
|
|
# Note: If using path-based, set OIDC_ISSUER=https://yourdomain.com/auth
|