Remsly/Remsly
2
0 Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

init simple Apache <-> Keycloak config (without FE & BE)

Browse Source
This commit is contained in:
Thomas Boksberger committed 2024-12-24 16:00:53 +01:00
1 parent a90bb172fe
commit b8a7116e9f
3 files changed
+59 -57
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/prod/config/frontend/app.boxi.ch.conf
+34 -3
View File
@@ -37,9 +37,7 @@
ServerName app.boxi.ch
#ServerAlias www.${server_name}
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
LogLevel debug
LogLevel info
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self' ; \
@@ -76,6 +74,30 @@
SetHandler server-status
</Location>
RequestHeader set X-Forwarded-User expr=%{REMOTE_USER}
RequestHeader set Authorization "Bearer %{oidc_access_token}e"
Header set User-Details "%{REMOTE_USER}e %{oidc_claim_email}e"
OIDCProviderMetadataURL ${KC_ADDR}/realms/${KC_REALM}/.well-known/openid-configuration
OIDCClientID ${OIDC_CLIENT_ID}
OIDCClientSecret ${OIDC_CLIENT_SECRET}
OIDCRefreshAccessTokenBeforeExpiry 10
OIDCRedirectURI ${OIDC_REDIRECT_URI}
OIDCCryptoPassphrase ${OIDC_CRYPTO_PASSPHRASE}
OIDCInfoHook ${OIDC_INFO_HOOK}
OIDCDefaultLoggedOutURL ${KC_ADDR}/realms/${KC_REALM}/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fapp.boxi.ch
OIDCRemoteUserClaim preferred_username
OIDCStateMaxNumberOfCookies 3 true
<Location /status >
SetHandler server-status
</Location>
<Location />
AuthType openid-connect
Require valid-user
</Location>
# If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance
# to check whether or not the user is even authenticated, leading to many failed requests.
# Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full
@@ -89,6 +111,15 @@
Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC"
</filesMatch>
#ProxyPass /ws ${FRONTEND_WS_URL}:${FRONTEND_PORT}/ws retry=0 timeout=86400
#ProxyPassReverse /ws ws://${FRONTEND_URL}:${FRONTEND_PORT}/ws
#ProxyPass /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/ retry=0
#ProxyPassReverse /api/ ${BACKEND_URL}:${BACKEND_PORT}/api/
#ProxyPass / ${FRONTEND_URL}:${FRONTEND_PORT}/ retry=0
#ProxyPassReverse / ${FRONTEND_URL}:${FRONTEND_PORT}
SSLEngine On
# SSLUseStapling On
SSLProtocol -all +TLSv1.2
deploy/prod/config/frontend/id.boxi.ch.conf
+11 -50
View File
@@ -32,20 +32,9 @@
ServerName id.boxi.ch
#ServerAlias www.${server_name}
#ErrorLog /var/log/apache2/error.log
#CustomLog /var/log/apache2/access.log combined
LogLevel info
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
#Header always set Content-Security-Policy "default-src 'self' ; \
# script-src 'self' 'unsafe-inline' 'unsafe-eval'; \
# style-src 'self' use.fontawesome.com 'unsafe-inline'; \
# font-src 'self' data: use.fontawesome.com; \
# base-uri 'self'; \
# form-action 'self'; \
# frame-ancestors 'none'; \
# img-src 'self' data:; \
# upgrade-insecure-requests" "expr=%{CONTENT_TYPE} =~ m#text\/(html|javascript)|application\/pdf|xml#i"
Header always set Content-Security-Policy "default-src 'self' ; \
style-src 'self' 'unsafe-inline'; \
script-src 'self' 'unsafe-inline'; \
@@ -57,9 +46,9 @@
object-src 'none'; \
upgrade-insecure-requests;"
ProxyRequests Off
ProxyPreserveHost On
ProxyAddHeaders On
#ProxyRequests Off
#ProxyPreserveHost On
#ProxyAddHeaders On
#SSLProxyEngine On
#SSLProxyVerify none
@@ -68,45 +57,17 @@
#SSLProxyCheckPeerName off
#SSLProxyCheckPeerExpire off
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
RequestHeader set X-Forwarded-Host "id.boxi.ch"
#RequestHeader set X-Forwarded-Proto "https"
#RequestHeader set X-Forwarded-Port "443"
#RequestHeader set X-Forwarded-Host "id.boxi.ch"
ProxyPass / http://keycloak:8080/ retry=0
ProxyPassReverse / http://keycloak:8080
#ProxyPass / http://keycloak:8080/ retry=0
#ProxyPassReverse / http://keycloak:8080
#<Directory />
# AllowOverride none
# Options -Indexes -Includes
# Require all granted
# <LimitExcept GET POST HEAD>
# deny from all
# </LimitExcept>
#</Directory>
#
#<Directory "/var/www/id">
# AllowOverride None
# Options -Indexes -Includes
# Require all granted
#</Directory>
#
#<Location /status >
# SetHandler server-status
#</Location>
<Location / >
Redirect / https://id.boxi.ch:8443/
</Location>
# If the browser is allowed to cache index.html, it starts loading assets/scripts/images before apache had a chance
# to check whether or not the user is even authenticated, leading to many failed requests.
# Disabling cache for index.html forces the browser to fetch it first, and therefore ensures that the full
# authentication mechanic is being run.
# See also https://github.com/zmartzone/mod_auth_openidc/issues/113
<filesMatch "index.html">
FileETag None
Header unset ETag
Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate"
Header set Pragma "no-cache"
Header set Expires "Mon, 21 Mar 1983 14:10:00 UTC"
</filesMatch>
SSLEngine On
SSLProtocol -all +TLSv1.2
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
deploy/prod/docker-compose.yml
+14 -4
View File
@@ -26,7 +26,7 @@ services:
environment:
KC_BOOTSTRAP_ADMIN_USERNAME: 'admin'
KC_BOOTSTRAP_ADMIN_PASSWORD: 'dzVTry4QhwKBnmM8X2PWZRZA'
KC_HTTPS_CERTIFICATE_FILE: '/opt/keycloak/certs/cert.pem'
KC_HTTPS_CERTIFICATE_FILE: '/opt/keycloak/certs/fullchain.pem'
KC_HTTPS_CERTIFICATE_KEY_FILE: '/opt/keycloak/certs/privkey.pem'
KC_DB: postgres
KC_DB_URL: 'jdbc:postgresql://postgres:5432/keycloak'
@@ -44,7 +44,7 @@ services:
volumes:
- ./config/keycloak/theme:/opt/keycloak/themes/boxit
- ./config/keycloak/theme.v2:/opt/keycloak/themes/boxit.v2
- ./certbot/etc/live/app.boxi.ch/cert.pem:/opt/keycloak/certs/cert.pem:ro
- ./certbot/etc/live/app.boxi.ch/fullchain.pem:/opt/keycloak/certs/fullchain.pem:ro
- ./certbot/etc/live/app.boxi.ch/privkey.pem:/opt/keycloak/certs/privkey.pem:ro
ports:
- '8443:8443'
@@ -59,10 +59,10 @@ services:
ipv4_address: 10.5.0.30
environment:
OIDC_CRYPTO_PASSPHRASE: '39938b0a-1bd2-4352-937d-3cf1e2023727'
KC_ADDR: 'https://id.boxi.ch'
KC_ADDR: 'https://id.boxi.ch:8443'
KC_REALM: 'boxit'
OIDC_CLIENT_ID: 'apacheOIDC'
OIDC_CLIENT_SECRET: 'ac1ef0e1-429a-4cce-92fe-c825e9bf3687'
OIDC_CLIENT_SECRET: 'Ymye3T55SnH1YfssvZZi6tRIIZ0PJTsK'
OIDC_REDIRECT_URI: 'https://app.boxi.ch/openidc'
APACHE_DEBUG_LEVEL: 'warn'
BACKEND_URL: 'backend'
@@ -79,6 +79,16 @@ services:
depends_on:
- keycloak
#backend:
#image: boxi.registry.jetbrains.space/p/boxit/containers/boxit-backend:2023.1.36
# restart: always
# networks:
# boxitNet:
# ipv4_address: 10.5.0.40
# depends_on:
# - postgres
# - keycloak
networks:
boxitNet:
driver: bridge
Reference in new issue
Remsly/Remsly
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.

The note is not visible to the blocked user.