lyra
b89070e985
Documentation: - Create CHANGELOG.md with full version history (v0.0.1 through unreleased) - Rewrite README with comprehensive setup guide, configuration reference, architecture overview, security model, and feature list - Update ROADMAP.md: fix branch status table, mark completed security review items, update TOTP leeway description - Fix 'centeral' typo in docs/Caddyfile - Remove TODO comment from docs/compose.yaml - Add DESIGN_CONSIDERATIONS.md (design review document) Code quality: - Extract duplicated cookie name/domain logic into CookieNameTrait methods: sessionCookieName() and sessionCookieDomain() - Update AcceptListener, AllowListener, InterceptListener, and LoginManager to use the shared methods - Remove fragile cross-file coupling comment between LoginManager and InterceptListener Error handling: - Wrap cache operations in AcceptListener and AllowListener with try/catch to fail closed (don't authenticate on cache errors) - Log cache errors at error level instead of propagating as 500s - Early return pattern in AcceptListener and AllowListener for cleaner control flow
29 lines
762 B
Caddyfile
29 lines
762 B
Caddyfile
# example of securing full service
|
|
# TODO replace domain and service name and port
|
|
service.example.com {
|
|
forward_auth preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
}
|
|
reverse_proxy service-container:80
|
|
}
|
|
|
|
# you can choose to only restrict select paths
|
|
# or any other Caddy match criteria, if desired
|
|
# IE: https://protected.example.com/secure/
|
|
protected.example.com {
|
|
# note any request that does not start with "/secure/" is NOT protected
|
|
forward_auth /secure/* preauth {
|
|
uri {uri}
|
|
copy_headers Remote-User
|
|
}
|
|
reverse_proxy protected-service:9000
|
|
}
|
|
|
|
# optionally, if you want to use a subdomain for central preauth
|
|
# set SUBDOMAIN_REDIRECT to true
|
|
# and AUTH_SUBDOMAIN to match the subdomain you use here
|
|
auth.example.com {
|
|
reverse_proxy preauth
|
|
}
|