diff options
| author | Grigory Shipunov | 2025-01-13 22:39:06 +0000 |
|---|---|---|
| committer | Grigory Shipunov | 2025-01-14 00:13:08 +0000 |
| commit | 9e256920bb728efc83dc556f7b5249104e2a1dc7 (patch) | |
| tree | 1e11eaa3b90ab17ea8b475d81e2ae70a61da6dec /hosts/cloud/proxy/default.nix | |
| parent | 1d55b0facf46881e3b5f09d90ae2414fc6131bf3 (diff) | |
proxy authentik
Diffstat (limited to 'hosts/cloud/proxy/default.nix')
| -rw-r--r-- | hosts/cloud/proxy/default.nix | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 6d58845..046c807 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -1,7 +1,7 @@ { config, ... }: { imports = [ - ./proxy.nix + ./authentik.nix ]; networking.firewall.allowedTCPPorts = [ 80 443 ]; @@ -11,12 +11,26 @@ recommendedGzipSettings = true; recommendedOptimisation = true; - recommendedProxySettings = true; recommendedTlsSettings = true; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; appendHttpConfig = '' + ### recommendedProxySettings minus proxy_redirect (breaks authentik) + # proxy_redirect off; + proxy_connect_timeout 60s; + proxy_send_timeout 60s; + proxy_read_timeout 60s; + proxy_http_version 1.1; + proxy_set_header "Connection" ""; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Server $host; + + ### TLS # Add HSTS header with preloading to HTTPS requests. # Adding this header to HTTP requests is discouraged map $scheme $hsts_header { |