From 303dff30bef94c362588822bc266942e1c99ed59 Mon Sep 17 00:00:00 2001 From: ibizaman Date: Mon, 29 Dec 2025 22:51:48 +0100 Subject: [PATCH] nginx: add phpForwardAuth --- docs/redirects.json | 3 +++ modules/blocks/nginx.nix | 10 ++++++++++ modules/blocks/nginx/docs/default.md | 3 +++ 3 files changed, 16 insertions(+) diff --git a/docs/redirects.json b/docs/redirects.json index 21414a9..8212693 100644 --- a/docs/redirects.json +++ b/docs/redirects.json @@ -1163,6 +1163,9 @@ "blocks-nginx-options-shb.nginx.vhosts._.extraConfig": [ "blocks-nginx.html#blocks-nginx-options-shb.nginx.vhosts._.extraConfig" ], + "blocks-nginx-options-shb.nginx.vhosts._.phpForwardAuth": [ + "blocks-nginx.html#blocks-nginx-options-shb.nginx.vhosts._.phpForwardAuth" + ], "blocks-nginx-options-shb.nginx.vhosts._.ssl": [ "blocks-nginx.html#blocks-nginx-options-shb.nginx.vhosts._.ssl" ], diff --git a/modules/blocks/nginx.nix b/modules/blocks/nginx.nix index b55e6c6..fef458c 100644 --- a/modules/blocks/nginx.nix +++ b/modules/blocks/nginx.nix @@ -79,6 +79,12 @@ let ''; }; + phpForwardAuth = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Authelia rule configuration"; + }; + extraConfig = lib.mkOption { type = lib.types.lines; default = ""; @@ -203,6 +209,10 @@ in error_page 403 = ${c.authEndpoint}/error/403; ''; + locations."~ \\.php$".extraConfig = lib.mkIf (c.phpForwardAuth) '' + fastcgi_param HTTP_X_FORWARDED_USER $user; + fastcgi_param HTTP_X_FORWARDED_GROUPS $groups; + ''; # Virtual endpoint created by nginx to forward auth requests. locations."/authelia".extraConfig = lib.mkIf (!(isNull c.authEndpoint)) '' diff --git a/modules/blocks/nginx/docs/default.md b/modules/blocks/nginx/docs/default.md index c864ee6..0ce36f7 100644 --- a/modules/blocks/nginx/docs/default.md +++ b/modules/blocks/nginx/docs/default.md @@ -179,6 +179,9 @@ so it involves more hops than a direct [OIDC integration](blocks-authelia.html#b } ``` +If PHP is used with fastCGI, +extra headers must be added by enabling the [`shb.nginx.vhosts.*.phpForwardAuth`](#blocks-nginx-options-shb.nginx.vhosts._.phpForwardAuth) option. + ### Virtual Host Extra Config {#blocks-nginx-usage-extraconfig} To add extra configuration to a virtual host,