Caddyfile

{
	order authenticate before respond
	order authorize before basicauth

	security {
		oauth identity provider generic {
			realm generic
			driver generic
			base_auth_url {$CADDY_SECURITY_BASE_AUTH_URL}
			metadata_url {$CADDY_SECURITY_METADATA}
			client_id {$CADDY_SECURITY_CLIENT_ID}
			client_secret {$CADDY_SECURITY_CLIENT_SECRET}
			scopes openid email profile

			delay_start 5
			retry_attempts 100
			retry_interval 10
		}

		authentication portal oidc-provider {
			crypto default token lifetime 86400
			crypto key sign-verify {$CADDY_SECURITY_CLIENT_SECRET}
			enable identity provider generic
			cookie domain test.localhost
			transform user {
				exact match realm generic
				action add role authp/user
			}
		}

		authorization policy oidc-provider {
			set auth url https://bytebase.test.localhost:8443/caddy-security/oauth2/generic
			crypto key verify {$CADDY_SECURITY_CLIENT_SECRET}
			validate bearer header
			allow roles authp/user

			inject header "X-User-Email" from email
			inject header "X-User-Name" from sub
			inject header "X-User-Role" from roles
		}
	}
}

bytebase.test.localhost:8443 {
	tls internal

	handle /caddy-security/* {
		authenticate with oidc-provider
	}

	handle {
		authorize with oidc-provider
		reverse_proxy /auth bytebase-unauth:8080
		reverse_proxy bytebase:8080
	}
}