From d9b4c34b6b84bf3ec5fffc259e171ab3f6ecd0ca Mon Sep 17 00:00:00 2001 From: rope Date: Sat, 12 Sep 2026 12:19:11 +0100 Subject: [PATCH] owncast: let Owncast's own auth guard /admin, not nginx's Co-Authored-By: Claude Opus 5 --- services/nginx.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/services/nginx.nix b/services/nginx.nix index 866356f..7476cd0 100644 --- a/services/nginx.nix +++ b/services/nginx.nix @@ -113,13 +113,20 @@ in # handshake — /ws would 401 forever and chat would silently never # connect. Video stays gated; only the chat socket is reachable by # someone who already knows the hostname. + # + # /admin and /api/admin are exempt too, for a different reason: + # Owncast enforces its own basic auth there (user "admin"). Two + # basic-auth realms on one origin deadlock — the browser can only send + # one Authorization header and nginx forwards it verbatim, so the + # credential that satisfies nginx is rejected by Owncast and vice + # versa. Let Owncast's own login be the only gate on those paths. "watch.nordhammer.it" = lib.recursiveUpdate (proxy 8088) { basicAuth = { blizzcon = "Blizzcon"; }; - locations."/ws" = { + locations = lib.genAttrs [ "/ws" "/admin" "/api/admin" ] (_: { proxyPass = "http://127.0.0.1:8088"; proxyWebsockets = true; extraConfig = "auth_basic off;"; - }; + }); }; # wings daemon (see services/pelican.nix). Deliberately NOT behind