CI communication behind reverse proxy

[w9n]

I use gitea behind an oauth reverse proxy with ssl termination and need the AppURL as seen from outside. When using DroneCI i dont want to communicate through the proxy with oauth but through a local bridge. The URL of the drone pulls come from ComposeHTTPSCloneURL.

I have created a little fix for me but im not sure if this should be handled here, the gitea sdk or in Drone

[BlackVoid]

You can use the following if you use auth_request:

satisfy  any;
auth_request /XXX/oauth2/auth;
allow  127.0.0.1;
deny   all;

[w9n]

Im currently usinglua-resty-openidc not the auth_request module. Not sure how allow 127.0.0.1 would satisfy the internal ip of the nginx container, but could be a possibility to allow the subnet of the backend.

[BlackVoid]

You can enter a subnet ex. 192.168.1.0/24. I hosted everything on the same machine without containers so ip depends on your setup.

…

On 17 September 2017 14:41:08 GMT+02:00, w9n ***@***.***> wrote: Im currently using[lua-resty-openidc]( https://github.com/pingidentity/lua-resty-openidc) not the auth_request module. Not sure how `allow 127.0.0.1` would satisfy the internal ip of the nginx container, but could be a possibility to allow the subnet of the backend. -- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #2428 (comment)

[w9n]

This way might be a little bit of a security drawback/configuration overhead compared to direct communication through a bridge, but it keeps the app much simpler. Thank you for your help!