mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 12:34:38 +00:00
CyberMind-FR
cc2bc47cc1
secubox-authelia v1.0.2 #263 wired the /verify endpoint properly. This PR flips both modules from the temporary LAN-only allow/deny fallback (shipped in #259 and #261) to proper Authelia SSO via: auth_request /__sbx_auth_verify; error_page 401 = @sbx_auth_login; Operators can now access /zigbee/ and /lyrion/ from outside the LAN after authenticating through the Authelia portal. * secubox-zigbee → 2.4.2 * secubox-lyrion → 1.0.5 Auth identity propagation: nginx auth_request_set captures Remote-User and Remote-Groups from Authelia's response (via secubox-authelia v1.0.2 /verify) and forwards them as X-Forwarded-User / X-Forwarded-Groups to the backend (z2m / LMS). Neither natively consumes those today, but downstream logging / audit can. Lyrion's dedicated lyrion.maegia.tv vhost is a separate server block, so it ships its own /__sbx_auth_verify location inline (the authelia.conf snippet only loads on the canonical hub). The 401 redirect on this vhost goes to https://auth.maegia.tv/ rather than /auth/ — the authelia_session cookie is scoped to .maegia.tv per the #239 spec, shared across subdomains. Board-validated 2026-05-20: $ curl -sIk -H 'Host: admin.gk2.secubox.in' \ https://192.168.1.200:9443/zigbee/ HTTP/1.1 302 Moved Temporarily location: http://admin.gk2.secubox.in:9080/auth/?rd=…/zigbee/ $ curl -sIk -H 'Host: admin.gk2.secubox.in' \ https://192.168.1.200:9443/lyrion/ HTTP/1.1 302 Moved Temporarily location: http://admin.gk2.secubox.in:9080/auth/?rd=…/lyrion/ Closes #264
58 lines
2.3 KiB
Plaintext
58 lines
2.3 KiB
Plaintext
# /etc/nginx/secubox.d/zigbee.conf + /etc/nginx/secubox-routes.d/zigbee.conf
|
|
# Installed by secubox-zigbee (#241, v2.4.1 adds the z2m frontend proxy).
|
|
|
|
# Host control-plane API
|
|
location /api/v1/zigbee/ {
|
|
rewrite ^/api/v1/zigbee/(.*)$ /$1 break;
|
|
proxy_pass http://unix:/run/secubox/zigbee.sock;
|
|
include /etc/nginx/snippets/secubox-proxy.conf;
|
|
}
|
|
|
|
# Native zigbee2mqtt frontend (LXC :8080) — proxied at /zigbee/ on the
|
|
# canonical hub vhost so it shows up inside the SecuBox WebUI without
|
|
# needing a separate public vhost. WebSocket upgrade required for live
|
|
# device state pushes.
|
|
location /zigbee/ {
|
|
# z2m has no authentication of its own. Gate via Authelia SSO:
|
|
# nginx auth_request → /__sbx_auth_verify (host FastAPI, implemented
|
|
# in secubox-authelia v1.0.2+ #263, which reverse-proxies to the
|
|
# Authelia LXC's native /api/verify and returns 200 + Remote-User
|
|
# headers when the authelia_session cookie is valid).
|
|
auth_request /__sbx_auth_verify;
|
|
error_page 401 = @sbx_auth_login;
|
|
|
|
# Capture the Authelia-validated identity and forward to z2m.
|
|
# z2m doesn't use it (no native SSO), but downstream logging /
|
|
# auditing can.
|
|
auth_request_set $sbx_user $upstream_http_remote_user;
|
|
auth_request_set $sbx_groups $upstream_http_remote_groups;
|
|
proxy_set_header X-Forwarded-User $sbx_user;
|
|
proxy_set_header X-Forwarded-Groups $sbx_groups;
|
|
|
|
proxy_pass http://10.100.0.111:8080/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# z2m frontend uses WebSocket — must upgrade.
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
|
|
proxy_buffering off;
|
|
proxy_read_timeout 86400;
|
|
|
|
# Health-banner injection (consistent with sibling iframe targets like
|
|
# /yacy/, /lyrion/, /auth/).
|
|
sub_filter_types text/html;
|
|
sub_filter_once on;
|
|
sub_filter "</body>" '<script src="/shared/health-banner.js"></script></body>';
|
|
}
|
|
|
|
# 401 from auth_request → 302 to the Authelia portal, carrying the
|
|
# original URL in `rd` so the user returns to /zigbee/ post-login.
|
|
location @sbx_auth_login {
|
|
return 302 /auth/?rd=$scheme://$http_host$request_uri;
|
|
}
|