Function buildForwardAuthEnv

packages/server/src/setup/forward-auth-setup.ts:49–89

(
	options: SetupForwardAuthOptions,
)

};

export const buildForwardAuthEnv = (
	options: SetupForwardAuthOptions,
): string[] => {
	const { oidc, cookieSecret, authDomain, baseDomain, authDomainHttps } =
		options;
	const scheme = authDomainHttps ? "https" : "http";
	const emailDomains =
		options.emailDomains && options.emailDomains.length > 0
			? options.emailDomains
			: ["*"];

	const env: string[] = [
		"OAUTH2_PROXY_PROVIDER=oidc",
		`OAUTH2_PROXY_OIDC_ISSUER_URL=${oidc.issuer}`,
		`OAUTH2_PROXY_CLIENT_ID=${oidc.clientId}`,
		`OAUTH2_PROXY_CLIENT_SECRET=${oidc.clientSecret}`,
		`OAUTH2_PROXY_COOKIE_SECRET=${cookieSecret}`,
		`OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:${FORWARD_AUTH_PORT}`,
		"OAUTH2_PROXY_REVERSE_PROXY=true",
		"OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true",
		"OAUTH2_PROXY_SET_XAUTHREQUEST=true",
		"OAUTH2_PROXY_UPSTREAMS=static://202",
		`OAUTH2_PROXY_REDIRECT_URL=${scheme}://${authDomain}/oauth2/callback`,
		`OAUTH2_PROXY_COOKIE_DOMAINS=${baseDomain}`,
		`OAUTH2_PROXY_WHITELIST_DOMAINS=${baseDomain}`,
		`OAUTH2_PROXY_COOKIE_SECURE=${authDomainHttps ? "true" : "false"}`,
		"OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL=true",
		`OAUTH2_PROXY_EMAIL_DOMAINS=${emailDomains.join(",")}`,
	];

	const scopes = oidc.scopes?.length
		? oidc.scopes
		: ["openid", "email", "profile"];
	env.push(`OAUTH2_PROXY_SCOPE=${scopes.join(" ")}`);

	if (oidc.skipDiscovery) {
		env.push("OAUTH2_PROXY_SKIP_OIDC_DISCOVERY=true");
	}

	return env;
};

export const setupForwardAuth = async (options: SetupForwardAuthOptions) => {
	const { serverId } = options;