feat: init proxy yaml configs

integration/docker-compose.yaml.tmpl

@@ -0,0 +1,34 @@
+services:
+{{ if eq .Proxy "caddy" }}
+  {{ template "caddy" . }}
+{{ else if eq .Proxy "traefik" }}
+  {{ template "traefik" . }}
+{{ else if eq .Proxy "nginx" }}
+  {{ template "nginx" . }}
+{{ else if eq .Proxy "envoy" }}
+  {{ template "envoy" . }}
+{{ else }}
+  {{ template "traefik" . }}
+{{ end }}
+
+  whoami:
+    image: traefik/whoami:v1.12.0
+    pull_policy: missing
+
+  tinyauth:
+    {{ if .Build }}
+    build:
+      context: ../
+      dockerfile: Dockerfile
+      args:
+        - VERSION=e2e
+        - BUILD_TAGS=nomsgpack
+        - LDFLAGS=-s -w
+    {{ else }}
+    image: ghcr.io/tinyauthapp/tinyauth:{{ .Version }}
+    {{ end }}
+    pull_policy: missing
+    command: ["--configfile", "/config.yaml"]
+    volumes:
+      - ./tinyauth.config.yaml:/config.yaml:ro
+

integration/suite/proxies/caddy.yaml.tmpl

@@ -0,0 +1,33 @@
+{{ define "caddy" }}
+caddy:
+  image: caddy:2.11.4
+  pull_policy: missing
+  ports:
+    - {{ .Proxy.Port }}:80
+  configs:
+    - source: caddy_caddyfile
+      target: /etc/caddy/Caddyfile
+      mode: 0664
+{{ end }}
+
+{{ define "caddy_config" }}
+caddy_caddyfile:
+  content: |
+    {
+        auto_https off
+    }
+
+    {{ if .Services.Whoami.Enabled }}
+    http://{{ .Domains.Whoami }} {
+        forward_auth tinyauth:3000 {
+            uri /api/auth/caddy
+            copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
+        }
+        reverse_proxy whoami:80
+    }
+    {{ end }}
+
+    http://{{ .Domains.Tinyauth }} {
+        reverse_proxy tinyauth:3000
+    }
+{{ end }}

integration/suite/proxies/envoy.yaml.tmpl

@@ -0,0 +1,137 @@
+{{ define "envoy" }}
+envoy:
+  image: envoyproxy/envoy:v1.33-latest
+  pull_policy: missing
+  ports:
+    - {{ .Proxy.Port }}:80
+  configs:
+   - source: envoy_config
+      target: /etc/envoy/envoy.yaml
+      mode: 0664
+{{ end }}
+
+{{ define "envoy_config" }}
+envoy_config:
+  content: |
+    static_resources:
+      listeners:
+        - name: http
+          address:
+            socket_address:
+              address: 0.0.0.0
+              port_value: 80
+
+          filter_chains:
+            - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: ingress_http
+                    use_remote_address: true
+
+                    route_config:
+                      name: routes
+
+                      virtual_hosts:
+                      {{ if .Services.Whoami.Enabled }}
+                        - name: whoami
+                          domains:
+                            - {{ .Domains.Whoami }}
+
+                          request_headers_to_add:
+                            - header:
+                                key: x-real-ip
+                                value: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
+                              append_action: OVERWRITE_IF_EXISTS_OR_ADD
+
+                          routes:
+                            - match:
+                                prefix: /
+                              route:
+                                cluster: whoami
+                      {{ end }}
+
+                        - name: tinyauth
+                          domains:
+                            - {{ .Domains.Tinyauth }}
+
+                          typed_per_filter_config:
+                            envoy.filters.http.ext_authz:
+                              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+                              disabled: true
+
+                          routes:
+                            - match:
+                                prefix: /
+                              route:
+                                cluster: tinyauth
+
+                    http_filters:
+                      - name: envoy.filters.http.ext_authz
+                        typed_config:
+                          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+                          failure_mode_allow: false
+
+                          http_service:
+                            server_uri:
+                              uri: http://tinyauth:3000
+                              cluster: tinyauth
+                              timeout: 5s
+
+                            path_prefix: "/api/auth/envoy?path="
+
+                            authorization_request:
+                              allowed_headers:
+                                patterns:
+                                  - exact: cookie
+                                  - exact: x-forwarded-for
+                                  - exact: x-forwarded-proto
+                                  - exact: x-real-ip
+                                  - exact: user-agent
+
+                            authorization_response:
+                              allowed_upstream_headers:
+                                patterns:
+                                  - exact: remote-user
+                                  - exact: remote-name
+                                  - exact: remote-email
+                                  - exact: remote-groups
+                                  - exact: remote-sub
+                                  - exact: authorization
+
+                              allowed_client_headers:
+                                patterns:
+                                  - exact: set-cookie
+                                  - exact: content-type
+
+                      - name: envoy.filters.http.router
+                        typed_config:
+                          "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+
+      clusters:
+        {{ if .Services.Whoami.Enabled }}
+        - name: whoami
+          type: LOGICAL_DNS
+          load_assignment:
+            cluster_name: whoami
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: whoami
+                          port_value: 80
+        {{ end }}
+
+        - name: tinyauth
+          type: LOGICAL_DNS
+          load_assignment:
+            cluster_name: tinyauth
+            endpoints:
+              - lb_endpoints:
+                  - endpoint:
+                      address:
+                        socket_address:
+                          address: tinyauth
+                          port_value: 3000
+{{ end }}

integration/suite/proxies/nginx.yaml.tmpl

@@ -0,0 +1,79 @@
+{{ define "nginx" }}
+nginx:
+  image: nginx:1.31.6
+  pull_policy: missing
+  ports:
+    - {{ .Proxy.Port }}:80
+  configs:
+    - source: nginx_default
+      target: /etc/nginx/conf.d/default.conf
+      mode: 0664
+    - source: nginx_tinyauth
+      target: /etc/nginx/conf.d/tinyauth.conf
+      mode: 0664
+    {{ if .Services.Whoami.Enabled }}
+    - source: nginx_whoami
+      target: /etc/nginx/conf.d/whoami.conf
+      mode: 0664
+    {{ end }}
+{{ end }}
+
+{{ define "nginx_config" }}
+nginx_default:
+  content: {}
+nginx_tinyauth:
+  content: |
+    server {
+        listen 80;
+        server_name {{ .Domains.Tinyauth }};
+
+        location / {
+            proxy_pass http://tinyauth:3000;
+
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host $http_host;
+        }
+    }
+{{ if .Services.Whoami.Enabled }}
+nginx_whoami:
+  content: |
+    server {
+        listen 80;
+        server_name {{ .Domains.Whoami }};
+
+        location / {
+            proxy_pass http://whoami:80;
+
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host $host;
+
+            auth_request /tinyauth;
+            auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
+            error_page 401 403 =302 $redirection_url;
+        }
+
+        location = /tinyauth {
+            internal;
+
+            proxy_pass http://tinyauth:3000/api/auth/nginx;
+
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+
+            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+            proxy_set_header X-Original-Method $request_method;
+
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Host $http_host;
+        }
+    }
+{{ end }}
+{{ end }}

integration/suite/proxies/proxies.go

@@ -0,0 +1,27 @@
+package proxies
+
+import (
+	_ "embed"
+	"html/template"
+)
+
+// Bundle the templates
+
+//go:embed caddy.yaml.tmpl
+var caddyTemplateSource string
+
+//go:embed envoy.yaml.tmpl
+var envoyTemplateSource string
+
+//go:embed nginx.yaml.tmpl
+var nginxTemplateSource string
+
+//go:embed traefik.yaml.tmpl
+var traefikTemplateSource string
+
+// Compile them and export them
+
+var CaddyTemplate = template.Must(template.New("caddy").Parse(caddyTemplateSource))
+var EnvoyTemplate = template.Must(template.New("envoy").Parse(envoyTemplateSource))
+var NginxTemplate = template.Must(template.New("nginx").Parse(nginxTemplateSource))
+var TraefikTemplate = template.Must(template.New("traefik").Parse(traefikTemplateSource))

integration/suite/proxies/traefik.yaml.tmpl

@@ -0,0 +1,68 @@
+{{ define "traefik" }}
+traefik:
+  image: traefik:v3.7.13
+  pull_policy: missing
+  ports:
+    - {{ .Proxy.Port }}:80
+  configs:
+    - source: traefik_static
+      target: /etc/traefik/traefik.yml
+      mode: 0664
+    - source: traefik_dynamic
+      target: /etc/traefik/dynamic.yml
+      mode: 0664
+{{ end }}
+
+{{ define "traefik_config" }}
+traefik_static:
+  content: |
+    entryPoints:
+      web:
+        address: ":80"
+
+    providers:
+      file:
+        filename: /etc/traefik/dynamic.yml
+traefik_dynamic:
+  content: |
+    http:
+      routers:
+        {{ if .Services.Whoami.Enabled }}
+        whoami:
+          rule: Host(`{{ .Domains.Whoami }}`)
+          entryPoints:
+            - web
+          service: whoami
+          middlewares:
+            - tinyauth
+        {{ end }}
+
+        tinyauth:
+          rule: Host(`{{ .Domains.Tinyauth }}`)
+          entryPoints:
+            - web
+          service: tinyauth
+
+      middlewares:
+        tinyauth:
+          forwardAuth:
+            address: http://tinyauth:3000/api/auth/traefik
+            authResponseHeaders:
+              - Remote-User
+              - Remote-Name
+              - Remote-Email
+              - Remote-Groups
+
+      services:
+        {{ if .Services.Whoami.Enabled }}
+        whoami:
+          loadBalancer:
+            servers:
+              - url: http://whoami:80
+        {{ end }}
+
+        tinyauth:
+          loadBalancer:
+            servers:
+              - url: http://tinyauth:3000
+{{ end }}