lasso:
  domains:
    - [domain].com
  whiteList:
    - [my gmail address]
  jwt:
    secret: [secret]
    maxAge: 10080
oauth:
  provider: google
  client_id: [google oauth2 client id]
  client_secret: [google oauth2 client secret]
  callback_urls:
    - https://lasso.[domain].com/auth

# vouch config
# bare minimum to get vouch running with OpenID Connect (such as okta)

lasso:
  logLevel: debug
  # domains:
  # valid domains that the jwt cookies can be set into
  # the callback_urls will be to these domains
  domains:
    - se.domain.com
    - login.se.domain.com
    - domain.com

  # - OR -
  # instead of setting specific domains you may prefer to allow all users...
  # set allowAllUsers: true to use Vouch Proxy to just accept anyone who can authenticate at the configured provider
  allowAllUsers: true

oauth:
  # Generic OpenID Connect
  # including okta
  provider: oidc
  client_id: CLIENT_ID
  client_secret: SECRET
  auth_url: https://dev-123456.oktapreview.com/oauth2/default/v1/authorize
  token_url: https://dev-123456.oktapreview.com/oauth2/default/v1/token
  user_info_url: https://dev-123456.oktapreview.com/oauth2/default/v1/userinfo
  scopes:
    - openid
    - email
  callback_url: https://login.se.domain.com/auth

log_format hostcombo '$remote_addr - $host - $remote_user [$time_local] '
                '"$request" $status $body_bytes_sent '
                '"$http_referer" "$http_user_agent"';

server {
    listen 80 ssl http2 default_server;
    server_name se.domain.com;

    access_log  /var/log/nginx/access.log hostcombo;
    error_log /var/log/nginx/error.log debug;

    ssl_certificate /certs/localhost.pem;
    ssl_certificate_key /certs/localhost.key;

    root /usr/share/nginx/html;

    index index.html;

    # send all requests to the `/validate` endpoint for authorization
    auth_request /validate;

    location = /validate {
        internal;

        # Vouch Proxy can run behind the same nginx-revproxy
        # May need to add "internal", and comply to "upstream" server naming
        proxy_pass http://vouch:9090;

        # Vouch Proxy only acts on the request headers
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";

        # pass X-Vouch-User along with the request
        auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;

        # these return values are used by the @error401 call
        auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
        auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
        auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
    }

    # if validate returns `401 not authorized` then forward the request to the error401block
    error_page 401 = @error401;

    location @error401 {
        # redirect to Vouch Proxy for login
        return 302 https://login.se.domain.com/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
    }

    # proxy pass authorized requests to your service
    location / {
        proxy_pass http://www.comain.com;
        #  may need to set
        auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
        #  in this bock as per https://github.com/vouch/vouch-proxy/issues/26#issuecomment-425215810
        # set user header (usually an email)
        proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
    }
}

# forwards to vouch
server {
    access_log  /var/log/nginx/access.log hostcombo;

    listen 80 ssl;
    server_name login.se.domain.com;

    ssl_certificate /certs/localhost.pem;
    ssl_certificate_key /certs/localhost.key;

    location / {
       proxy_set_header Host login.se.domain.com;
       proxy_pass http://vouch:9090;
    }
}