backup-sentinel/oauth2-proxy.env.example at main · wvogel/backup-sentinel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
# ── OAuth2-Proxy Configuration ──────────────────────────────────────────────
# Copy this file to oauth2-proxy.env and fill in your values:
#   cp oauth2-proxy.env.example oauth2-proxy.env

# Provider: oidc, entra-id, keycloak-oidc, google, github, etc.
OAUTH2_PROXY_PROVIDER=oidc
OAUTH2_PROXY_SCOPE="openid profile email"
OAUTH2_PROXY_EMAIL_DOMAINS=*
OAUTH2_PROXY_COOKIE_SECURE=true
OAUTH2_PROXY_COOKIE_SAMESITE=lax
OAUTH2_PROXY_REVERSE_PROXY=true
OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180

# Session store (uses the shared Valkey/Redis container)
OAUTH2_PROXY_SESSION_STORE_TYPE=redis
OAUTH2_PROXY_REDIS_CONNECTION_URL=redis://valkey:6379/0

# Domain settings – adjust to your domain
OAUTH2_PROXY_COOKIE_DOMAINS=backup-sentinel.example.com
OAUTH2_PROXY_WHITELIST_DOMAINS=backup-sentinel.example.com

# Custom sign-in page branding (optional)
# OAUTH2_PROXY_CUSTOM_SIGN_IN_LOGO=https://example.com/logo.svg
# OAUTH2_PROXY_FOOTER=-
# OAUTH2_PROXY_BANNER=

# ── Identity Provider ───────────────────────────────────────────────────────
OAUTH2_PROXY_CLIENT_ID=your-client-id
OAUTH2_PROXY_CLIENT_SECRET=your-client-secret
OAUTH2_PROXY_OIDC_ISSUER_URL=https://your-idp.example.com/realms/your-realm
OAUTH2_PROXY_REDIRECT_URL=https://backup-sentinel.example.com/oauth2/callback

# Generate with: python -c "import secrets; print(secrets.token_hex(16))"
# or: openssl rand -base64 32
OAUTH2_PROXY_COOKIE_SECRET=generate-a-random-secret-here

# Upstream – the backup-sentinel app container
OAUTH2_PROXY_UPSTREAMS=http://backup-sentinel:80/

# Routes that bypass authentication (health check + bootstrap scripts)
OAUTH2_PROXY_SKIP_AUTH_ROUTES=^/metrics$,^/healthz$,^/bootstrap/proxmox-agent\.sh$,^/bootstrap/pbs-agent\.sh$,POST=^/api/bootstrap/finalize$,^/api/bootstrap/pbs-finalize$
OAUTH2_PROXY_SKIP_AUTH_REGEX=^/metrics$|^/healthz$|^/bootstrap/proxmox-agent\.sh$|^/bootstrap/pbs-agent\.sh$|^/api/bootstrap/finalize$|^/api/bootstrap/pbs-finalize$

# Pass user headers to the upstream
OAUTH2_PROXY_PASS_USER_HEADERS=true
OAUTH2_PROXY_SET_XAUTHREQUEST=true

# For Azure Entra ID, add:
# OAUTH2_PROXY_AZURE_TENANT=your-tenant-id
# OAUTH2_PROXY_ALLOWED_GROUPS=your-group-id

# For Keycloak, the issuer URL typically looks like:
# https://keycloak.example.com/realms/your-realm