36 lines
1.3 KiB
Caddyfile
36 lines
1.3 KiB
Caddyfile
# Add this site block to the existing Caddy 2.8 Caddyfile (or an already-imported
|
|
# site-fragment directory). This does not define a second listener or proxy.
|
|
# Replace BASIC_AUTH_HASH with interactive `caddy hash-password` output.
|
|
# Basic Auth is the supported access gate; do not add Authelia without confirming
|
|
# the existing proxy's auth policy and trusted identity headers.
|
|
random.ochenstarik.ru {
|
|
tls {
|
|
issuer acme {
|
|
disable_tlsalpn_challenge
|
|
}
|
|
}
|
|
basic_auth {
|
|
owner BASIC_AUTH_HASH
|
|
}
|
|
# Caddy 2.8 supports this body limit. Keep it ahead of the upstream.
|
|
request_body {
|
|
max_size 1MB
|
|
}
|
|
# No access log: OAuth callback query values are sensitive.
|
|
reverse_proxy 10.77.0.3:3100 {
|
|
header_up Host random.ochenstarik.ru
|
|
header_up X-Forwarded-Host random.ochenstarik.ru
|
|
header_up X-Forwarded-Proto https
|
|
# Replace caller-supplied forwarding metadata; Caddy's peer identity
|
|
# depends on the confirmed HAProxy-to-Caddy path.
|
|
header_up X-Forwarded-For {remote_host}
|
|
header_up -X-Real-IP
|
|
header_up -Forwarded
|
|
header_up -CF-Connecting-IP
|
|
header_up -Authorization
|
|
transport http {
|
|
dial_timeout 10s
|
|
response_header_timeout 120s
|
|
}
|
|
}
|
|
}
|