outurnate / ruuth Goto Github PK

worker_processes 1;

error_log  /var/log/nginx/error.log;
error_log  /var/log/nginx/error.log notice;
error_log  /var/log/nginx/error.log info;

events { worker_connections 1024; }

# We define a shared backend definition that refers
# to the local/remote instance of ruuth.  Update this
# to match your config file
upstream ruuth
{
  server 127.0.0.1:3000;
}

http
{
  include            mime.types;
  default_type       application/octet-stream;
  sendfile           on;
  keepalive_timeout  65;

  # This server block represents the resource we wish
  # to secure.  We define an internal-only validate
  # route for NGINX to reach our auth server.  We can
  # define any number of these for different applications
  server
  {
    listen       443 ssl http2;
    server_name  example.com;

    ssl_certificate      cert.pem;
    ssl_certificate_key  key.pem;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location /validate
    {
      # We wish to ensure we do not unnecessarily expose ruuth to the internet
      internal;
      # Pass the validate path to the backend
      proxy_pass              http://ruuth/validate;
      proxy_set_header        Host $http_host;
      # ruuth ignores the body, so we should discard it
      proxy_pass_request_body off;
      proxy_set_header        Content-Length "";
      # We include the original IP for rate-limiting and blacklisting
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      # Lastly, we need to pass through cookies to ensure the validation
      # handler is able to see the user's session cookie
      auth_request_set        $saved_set_cookie $upstream_http_set_cookie;
      proxy_set_header        Set-Cookie $saved_set_cookie;
    }

    # Setup auth_request and define the 401 handler
    auth_request /validate;
    error_page 401 @error401;
    location @error401
    {
      # In place of a 401 error, we rewrite to a 302 that shows the login page
      return 302 https://auth.example.com/?url=$scheme://$http_host$request_uri;
    }

    # Here's our dummy content
    location /
    {
      root  /usr/share/nginx/html;
      index index.html index.htm;
    }
  }

  # We define a single authentication server for serving
  # the login/logout pages and handlers
  server
  {
    listen 443 ssl http2;
    server_name auth.example.com;

    ssl_certificate      cert.pem;
    ssl_certificate_key  key.pem;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;

    location /
    {
      # Pass the validate path to the backend
      proxy_pass                       http://ruuth;
      proxy_set_header Host            $http_host;
      # We include the original IP for rate-limiting and blacklisting
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
  }
}

ruuth --config /etc/ruuth.toml add-user --username hblue

ruuth --config /etc/ruuth.toml add-user --username hblue --show-qr-code

ruuth --config /etc/ruuth.toml delete-user --username hblue

ruuth --config /etc/ruuth.toml reset-password --username hblue

ruuth --config /etc/ruuth.toml reset-mfa --username hblue