forked from baron/baron-sso
122 lines
3.9 KiB
Nginx Configuration File
122 lines
3.9 KiB
Nginx Configuration File
# ISO8601 시간을 "YYYY-MM-DD HH:mm:ss" 형식으로 변환
|
|
map $time_iso8601 $time_custom {
|
|
"~^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})" "$1-$2-$3 $4:$5:$6";
|
|
}
|
|
|
|
log_format json_combined escape=json
|
|
'{'
|
|
'"time":"$time_custom",'
|
|
'"level":"INFO",'
|
|
'"msg":"http_access",'
|
|
'"svc":"baron-gateway",'
|
|
'"status":$status,'
|
|
'"method":"$request_method",'
|
|
'"path":"$request_uri",'
|
|
'"latency":"${request_time}s",'
|
|
'"ip":"$remote_addr",'
|
|
'"forwarded_for":"$http_x_forwarded_for",'
|
|
'"user_agent":"$http_user_agent"'
|
|
'}';
|
|
|
|
server {
|
|
listen 5000;
|
|
client_header_buffer_size 16k;
|
|
large_client_header_buffers 4 64k;
|
|
include /etc/nginx/mime.types;
|
|
types {
|
|
application/javascript mjs;
|
|
}
|
|
|
|
resolver 127.0.0.11 valid=10s ipv6=off;
|
|
set $backend_upstream http://backend:23000;
|
|
set $userfront_upstream http://userfront:5000;
|
|
set $oathkeeper_upstream http://oathkeeper:4455;
|
|
|
|
error_log /dev/stderr warn;
|
|
access_log /var/log/nginx/access.log json_combined;
|
|
|
|
# --- CRITICAL: OIDC & OAuth2 (Must be at the TOP with ^~ to prevent falling through to /) ---
|
|
|
|
# Discovery Document
|
|
location ^~ /.well-known/openid-configuration {
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# OAuth2 Auth/Token Endpoints (Standard)
|
|
location ^~ /oauth2/ {
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# OAuth2 Auth/Token Endpoints (Localized - /ko/oauth2)
|
|
location ^~ /ko/oauth2/ {
|
|
rewrite ^/ko/oauth2/(.*)$ /oauth2/$1 break;
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# OAuth2 Auth/Token Endpoints (Localized - /en/oauth2)
|
|
location ^~ /en/oauth2/ {
|
|
rewrite ^/en/oauth2/(.*)$ /oauth2/$1 break;
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# OIDC Endpoints (Localized - /ko/oidc, /en/oidc)
|
|
location ^~ /ko/oidc/ {
|
|
rewrite ^/ko/oidc/(.*)$ /oidc/$1 last;
|
|
}
|
|
location ^~ /en/oidc/ {
|
|
rewrite ^/en/oidc/(.*)$ /oidc/$1 last;
|
|
}
|
|
|
|
# --- Other Services ---
|
|
|
|
location /api {
|
|
proxy_pass $backend_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /auth {
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location /oidc {
|
|
rewrite ^/oidc/(.*)$ /$1 break;
|
|
proxy_pass $oathkeeper_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
# --- Default: UserFront ---
|
|
location / {
|
|
proxy_pass $userfront_upstream;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
}
|