rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

owncast: let Owncast's own auth guard /admin, not nginx's

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-12 12:19:11 +01:00
parent 5f85d611c9
commit d9b4c34b6b
1 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
services/nginx.nix
View file

@ -113,13 +113,20 @@ in
# handshake — /ws would 401 forever and chat would silently never # handshake — /ws would 401 forever and chat would silently never
# connect. Video stays gated; only the chat socket is reachable by # connect. Video stays gated; only the chat socket is reachable by
# someone who already knows the hostname. # someone who already knows the hostname.
#
# /admin and /api/admin are exempt too, for a different reason:
# Owncast enforces its own basic auth there (user "admin"). Two
# basic-auth realms on one origin deadlock — the browser can only send
# one Authorization header and nginx forwards it verbatim, so the
# credential that satisfies nginx is rejected by Owncast and vice
# versa. Let Owncast's own login be the only gate on those paths.
"watch.nordhammer.it" = lib.recursiveUpdate (proxy 8088) { "watch.nordhammer.it" = lib.recursiveUpdate (proxy 8088) {
basicAuth = { blizzcon = "Blizzcon"; }; basicAuth = { blizzcon = "Blizzcon"; };
locations."/ws" = { locations = lib.genAttrs [ "/ws" "/admin" "/api/admin" ] (_: {
proxyPass = "http://127.0.0.1:8088"; proxyPass = "http://127.0.0.1:8088";
proxyWebsockets = true; proxyWebsockets = true;
extraConfig = "auth_basic off;"; extraConfig = "auth_basic off;";
}; });
}; };
# wings daemon (see services/pelican.nix). Deliberately NOT behind # wings daemon (see services/pelican.nix). Deliberately NOT behind