# nginx-sso - example nginx config
#
# (c) 2015 by Johannes Gilger <heipei@hackvalue.de>
#
# This is an example config for using nginx with the nginx-sso cookie system.
# For simplicity, this config sets up two fictional vhosts that you can use to
# test against both components of the nginx-sso system: ssoauth & ssologin.
# In a real deployment, these vhosts would be separate hosts.

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}


http {
    server {
        listen 443 ssl;
        server_name     auth.test.local localhost;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location / {
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  Host $http_host;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;

            proxy_pass        http://authelia/;

            proxy_intercept_errors on;

            if ($request_method !~ ^(POST)$){
              error_page 401 = /error/401;
              error_page 403 = /error/403;
              error_page 404 = /error/404;
            }
        }
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/home.test.local;
 
        server_name     home.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/public.test.local;
 
        server_name     public.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location /auth_verify {
            internal;
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_set_header  Content-Length "";

            proxy_pass        http://authelia/verify;
        }

        location / {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;
            
            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header X-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Remote-Groups $groups;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        }

        location /headers {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;

            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header Custom-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Custom-Forwarded-Groups $groups;

            proxy_pass        http://httpbin:8000/headers;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        } 
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/admin.test.local;
 
        server_name     admin.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location /auth_verify {
            internal;
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_set_header  Content-Length "";

            proxy_pass        http://authelia/verify;
        }

        location / {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;

            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header X-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Remote-Groups $groups;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        }
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/dev.test.local;
 
        server_name     dev.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location /auth_verify {
            internal;
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_set_header  Content-Length "";

            proxy_pass        http://authelia/verify;
        }

        location / {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;

            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header X-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Remote-Groups $groups;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        }
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/mail.test.local;
 
        server_name     mx1.mail.test.local mx2.mail.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location /auth_verify {
            internal;
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_set_header  Content-Length "";

            proxy_pass        http://authelia/verify;
        }

        location / {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;

            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header X-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Remote-Groups $groups;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        }
    }

    server {
        listen 443 ssl;
        root /usr/share/nginx/html/basicauth.test.local;
 
        server_name     basicauth.test.local;

        ssl on;
        ssl_certificate     /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;

        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        location /auth_verify {
            internal;
            proxy_set_header  X-Original-URI $request_uri;
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_set_header  Host $http_host;
            proxy_set_header  Content-Length "";

            proxy_pass        http://authelia/verify;
        }

        location / {
            auth_request /auth_verify;

            auth_request_set $redirect $upstream_http_redirect;

            auth_request_set $user $upstream_http_remote_user;
            proxy_set_header X-Forwarded-User $user;
            
            auth_request_set $groups $upstream_http_remote_groups;
            proxy_set_header Remote-Groups $groups;

            error_page 401 =302 https://auth.test.local:8080?redirect=$redirect;
            error_page 403 = https://auth.test.local:8080/error/403;
        }
    }
}