opnsense / plugins

OPNsense plugin collection
https://opnsense.org/
BSD 2-Clause "Simplified" License
810 stars 593 forks source link

www/caddy add copy_headers #4056

Open mimi0000oo opened 4 days ago

mimi0000oo commented 4 days ago

Important notices Before you add a new report, we ask you kindly to acknowledge the following:

Is your feature request related to a problem? Please describe.

I want to add authelia in front of my reverse proxy setup. The guide, on authelia's website: https://www.authelia.com/integration/proxies/caddy/ and Caddy website: https://caddyserver.com/docs/caddyfile/directives/forward_auth

They both suggest that copy_headers should be an option, but there is no way to be found in the gui

Describe the solution you'd like

Simple, add the option to the plugin! I guess that should be on the headers page, but I've searched through all the other and couldn't find anything.

Describe alternatives you've considered

For now I am trying to modify the Caddyfile manually.

Monviech commented 4 days ago

I have a branch here I did a while ago where I tried to fit forward auth into the GUI:

https://github.com/Monviech/opnsense-plugins/tree/forward-auth-stached

I have documented it too:

https://github.com/Monviech/opnsense-docs/blob/forward-auth-stached/source/manual/how-tos/caddy.rst#authelia-as-forward_auth-provider

Warning, this is unusable in the current plugin. I just wanted to show I have spend considerable time on it in the past.

I came to the conclusion that its unfeasable right now, look at the documentation and how careful you would need to set it up, and it still would break because the current template generation has no way to create specific orders.

Authelia sadly needs a very specific order of handles to work. In the GUI there is no way to say "First this handle, then this, and then this last". It's all generated implicitly based on which handlers have been created first.

Right now, you have to continue to use the import statements. (You don't really have to edit the Caddyfile manually.

https://docs.opnsense.org/manual/how-tos/caddy.html#using-custom-configuration-files

So, I sadly have to say this is out of scope for me right now. If somebody wants to pick up on my work in that branch I left behind, feel free to.

Monviech commented 2 days ago

@mimi0000oo

I think I have a new idea here how I could theoretically make this work, without making it too convoluted or prone to breakage.

But before working on it, I want to know if I can count on you to test this.

Monviech commented 1 day ago

@mimi0000oo I have created a PR for you to test. If you have any questions, just ask.