frontend.conf

# This is the backend application we are protecting with OpenID Connect
# Custom log format to include the 'sub' claim in the REMOTE_USER field
log_format main_jwt '$remote_addr - $jwt_claim_sub [$time_local] "$request" $status '
                    '$body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

# The frontend server - reverse proxy with OpenID Connect authentication

server {
    include conf.d/openid_connect.server_conf; # Authorization code flow and Relying Party processing
    error_log /var/log/nginx/error.log debug;  # Reduce severity level as required

    listen 443 ssl; # Use SSL/TLS in production

    ssl_certificate /srv/certs/livelogs.crt;
    ssl_certificate_key /srv/certs/livelogs.key;

    server_name LIVELOGS_NGINX_SERVER_DNS;

    location / {
        # This site is protected with OpenID Connect
        auth_jwt "" token=$session_jwt;
        error_page 401 = @do_oidc_flow;

        auth_jwt_key_request /_jwks_uri; # Enable when using URL

        # Successfully authenticated users are proxied to the backend,
        # with 'sub' claim passed as HTTP header
        proxy_set_header username $jwt_claim_sub;

        # Bearer token is uses to authorize NGINX to access protected backend
        proxy_set_header Authorization "Bearer $access_token";
        proxy_set_header X-Original-URI $request_uri;
        # Intercept and redirect "401 Unauthorized" proxied responses to nginx
        # for processing with the error_page directive. Necessary if Access Token
        # can expire before ID Token.
        # proxy_intercept_errors on;

        add_header Access-Control-Allow-Origin '*' always;
        add_header X-Frame-Options SAMEORIGIN always;
        add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' SSO_DNS; script-src 'self' 'unsafe-inline' 'unsafe-eval' SSO_DNS;";

        proxy_pass          http://LIVELOGS_KIBANA_IP:5601;
        proxy_set_header    Host $host;
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_set_header    X-Forwarded-Host $http_host;

        access_log /var/log/nginx/access.log main_jwt;
    }

    location ~ (/app|/translations|/node_modules|/built_assets/|/bundles|/es_admin|/plugins|/api|/ui|/elasticsearch|/spaces/enter|internal) {
        # auth_jwt "" token=$session_jwt;
        # error_page 401 = @do_oidc_flow;

        # auth_jwt_key_request /_jwks_uri; # Enable when using URL

        # Successfully authenticated users are proxied to the backend,
        # with 'sub' claim passed as HTTP header
        proxy_set_header username $jwt_claim_sub;

        # Bearer token is uses to authorize NGINX to access protected backend
        proxy_set_header Authorization "Bearer $access_token";
        proxy_set_header X-Original-URI $request_uri;

        add_header Access-Control-Allow-Origin '*' always;
        add_header X-Frame-Options SAMEORIGIN always;
        add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' SSO_DNS; script-src 'self' 'unsafe-inline' 'unsafe-eval' SSO_DNS;";

        proxy_pass          http://LIVELOGS_KIBANA_IP:5601;
        proxy_set_header    Host $host;
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_set_header    X-Forwarded-Host $http_host;
        proxy_hide_header   Authorization;
    }
}

# vim: syntax=nginx