proxy authentik and dav with sso

1 files changed, 21 insertions, 9 deletions

diff --git a/hosts/cloud/proxy/auth.nix b/hosts/cloud/proxy/auth.nix
index b8e10d5..6aa22e3 100644
--- a/hosts/cloud/proxy/auth.nix
+++ b/hosts/cloud/proxy/auth.nix
@@ -1,23 +1,35 @@
 { ... }:
 {
-  services.nginx.upstreams.keycloak = {
+  services.nginx.upstreams.authentik = {
     servers = {
-      "10.89.88.11:38080" = { };
-      "[fd31:185d:722f::11]:38080" = { };
+      "10.89.88.11:9000" = { };
+      "[fd31:185d:722f::11]:9000" = { };
     };
+    extraConfig = ''
+      keepalive 10;
+    '';
   };
 
   services.nginx.virtualHosts."auth.oxapentane.com" = {
     forceSSL = true;
     enableACME = true;
     locations."/" = {
-      proxyPass = "http://keycloak";
+      proxyPass = "http://authentik";
       extraConfig = ''
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Port 433;
+        # general proxy settings
+	    proxy_connect_timeout   60s;
+	    proxy_send_timeout      60s;
+	    proxy_read_timeout      60s;
+	    proxy_http_version      1.1;
+        proxy_set_header        Host $host;
+        proxy_set_header        X-Real-IP $remote_addr;
+        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header        X-Forwarded-Proto $scheme;
+        proxy_set_header        X-Forwarded-Host $host;
+        proxy_set_header        X-Forwarded-Server $host;
+        # authentik specifik
+        proxy_set_header        Upgrade $http_upgrade;
+        proxy_set_header        Connection $connection_upgrade_keepalive;
       '';
     };
   };