From 4a72999c75a7d94ebb1fb9c9dd160541a45b44e5 Mon Sep 17 00:00:00 2001
From: Michishige Kaito <me@mkaito.com>
Date: Fri, 29 Jun 2018 15:36:03 +0100
Subject: [PATCH 1/2] oauth2_proxy: add nginx vhost module

---
 nixos/modules/module-list.nix                 |  1 +
 .../services/security/oauth2_proxy_nginx.nix  | 58 +++++++++++++++++++
 2 files changed, 59 insertions(+)
 create mode 100644 nixos/modules/services/security/oauth2_proxy_nginx.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c425f3c65075..4975f7c1889e 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -624,6 +624,7 @@
   ./services/security/hologram-agent.nix
   ./services/security/munge.nix
   ./services/security/oauth2_proxy.nix
+  ./services/security/oauth2_proxy_nginx.nix
   ./services/security/physlock.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
diff --git a/nixos/modules/services/security/oauth2_proxy_nginx.nix b/nixos/modules/services/security/oauth2_proxy_nginx.nix
new file mode 100644
index 000000000000..80be28d91618
--- /dev/null
+++ b/nixos/modules/services/security/oauth2_proxy_nginx.nix
@@ -0,0 +1,58 @@
+{ pkgs, config, lib, ... }:
+with lib;
+let
+  cfg = config.services.oauth2_proxy.nginx;
+in
+{
+  options.services.oauth2_proxy.nginx = {
+    proxy = mkOption {
+      type = types.string;
+      default = config.services.oauth2_proxy.httpAddress;
+    };
+    virtualHosts = mkOption {
+      type = types.listOf types.string;
+      default = [];
+    };
+  };
+  config.services.oauth2_proxy = mkIf (cfg.virtualHosts != [] && (hasPrefix "127.0.0.1:" cfg.proxy)) {
+    enable = true;
+  };
+  config.services.nginx = mkMerge ((optional (cfg.virtualHosts != []) {
+    recommendedProxySettings = true; # needed because duplicate headers
+  }) ++ (map (vhost: {
+    virtualHosts.${vhost} = {
+      locations."/oauth2/" = {
+        proxyPass = cfg.proxy;
+        extraConfig = ''
+          proxy_set_header X-Scheme                $scheme;
+          proxy_set_header X-Auth-Request-Redirect $request_uri;
+        '';
+      };
+      locations."/oauth2/auth" = {
+        proxyPass = cfg.proxy;
+        extraConfig = ''
+          proxy_set_header X-Scheme         $scheme;
+          # nginx auth_request includes headers but not body
+          proxy_set_header Content-Length   "";
+          proxy_pass_request_body           off;
+        '';
+      };
+      locations."/".extraConfig = ''
+        auth_request /oauth2/auth;
+        error_page 401 = /oauth2/sign_in;
+
+        # pass information via X-User and X-Email headers to backend,
+        # requires running with --set-xauthrequest flag
+        auth_request_set $user   $upstream_http_x_auth_request_user;
+        auth_request_set $email  $upstream_http_x_auth_request_email;
+        proxy_set_header X-User  $user;
+        proxy_set_header X-Email $email;
+
+        # if you enabled --cookie-refresh, this is needed for it to work with auth_request
+        auth_request_set $auth_cookie $upstream_http_set_cookie;
+        add_header Set-Cookie $auth_cookie;
+      '';
+
+    };
+  }) cfg.virtualHosts));
+}

From 2fec848254381ec5b6a1fca6f45f86f370d32643 Mon Sep 17 00:00:00 2001
From: Michishige Kaito <me@mkaito.com>
Date: Fri, 29 Jun 2018 16:23:24 +0100
Subject: [PATCH 2/2] fixup! oauth2_proxy: add nginx vhost module

---
 nixos/modules/services/security/oauth2_proxy_nginx.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nixos/modules/services/security/oauth2_proxy_nginx.nix b/nixos/modules/services/security/oauth2_proxy_nginx.nix
index 80be28d91618..2aa2c57fd22c 100644
--- a/nixos/modules/services/security/oauth2_proxy_nginx.nix
+++ b/nixos/modules/services/security/oauth2_proxy_nginx.nix
@@ -8,10 +8,16 @@ in
     proxy = mkOption {
       type = types.string;
       default = config.services.oauth2_proxy.httpAddress;
+      description = ''
+        The address of the reverse proxy endpoint for oauth2_proxy
+      '';
     };
     virtualHosts = mkOption {
       type = types.listOf types.string;
       default = [];
+      description = ''
+        A list of nginx virtual hosts to put behind the oauth2 proxy
+      '';
     };
   };
   config.services.oauth2_proxy = mkIf (cfg.virtualHosts != [] && (hasPrefix "127.0.0.1:" cfg.proxy)) {