-
Notifications
You must be signed in to change notification settings - Fork 32
/
Caddyfile
127 lines (114 loc) · 2.75 KB
/
Caddyfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
{
http_port 8080
https_port 8443
# debug
order authenticate before respond
order authorize before basicauth
security {
local identity store localdb {
realm local
path {$HOME}/.local/caddy/users.json
}
oauth identity provider github {env.GITHUB_CLIENT_ID} {env.GITHUB_CLIENT_SECRET}
authentication portal myportal {
crypto default token lifetime 3600
crypto key sign-verify {env.JWT_SHARED_KEY}
enable identity store localdb
enable identity provider github
cookie domain myfiosgateway.com
ui {
links {
"My Website" https://assetq.myfiosgateway.com:8443/ icon "las la-star"
"Guests" https://assetq.myfiosgateway.com:8443/guests icon "las la-star"
"Users" https://assetq.myfiosgateway.com:8443/users icon "las la-star"
"Admins" https://assetq.myfiosgateway.com:8443/admins icon "las la-star"
"My Identity" "/whoami" icon "las la-user"
}
password_recovery_enabled yes
}
transform user {
match origin local
action add role authp/user
ui link "Portal Settings" /settings icon "las la-cog"
}
transform user {
match realm github
match sub github.com/greenpau
action add role authp/user
}
}
authorization policy guests_policy {
# disable auth redirect
set auth url https://auth.myfiosgateway.com:8443/
allow roles authp/admin authp/user
crypto key verify {env.JWT_SHARED_KEY}
acl rule {
comment allow guests only
match role guest authp/guest
allow stop log info
}
acl rule {
comment default deny
match any
deny log warn
}
}
authorization policy users_policy {
set auth url https://auth.myfiosgateway.com:8443/
allow roles authp/admin authp/user
crypto key verify {env.JWT_SHARED_KEY}
acl rule {
comment allow users
match role authp/user
allow stop log info
}
acl rule {
comment default deny
match any
deny log warn
}
}
authorization policy admins_policy {
set auth url https://auth.myfiosgateway.com:8443/
allow roles authp/admin authp/user
crypto key verify {env.JWT_SHARED_KEY}
acl rule {
comment allow users
match role authp/user
allow stop log info
}
acl rule {
comment default deny
match any
deny log warn
}
}
}
}
(tls_config) {
tls {$HOME}/.local/caddy/server.crt {$HOME}/.local/caddy/server.key
}
auth.myfiosgateway.com {
import tls_config
route {
authenticate with myportal
}
}
assetq.myfiosgateway.com {
import tls_config
route /guests* {
authorize with guests_policy
respond * "assetq - guests only" 200
}
route /users* {
authorize with users_policy
respond * "assetq - users" 200
}
route /admins* {
authorize with admins_policy
respond * "assetq - admins" 200
}
route {
respond "assetq is running"
}
}