# Nginx Proxy Manager → Proxy Host dev.lotusguild.org → Advanced tab.
# Target: http://10.10.10.58:7681, Websockets Support ON, wildcard *.lotusguild.org cert, Force SSL.
#
# Replace __DEVDESK_BASIC__ with the base64 of the credential in /etc/devdesk/secret.env:
#   . /etc/devdesk/secret.env && printf '%s' "$DEVDESK_CREDENTIAL" | base64 -w0
# ttyd rejects (401) every request that does not carry it, so only traffic that
# passed Authelia here can reach the terminal.

include /snippets/authelia-location.conf;

location / {
    # Headers go here, not at server level: a location with its own add_header
    # (HSTS) doesn't inherit the server's.
    add_header Strict-Transport-Security $hsts_header always;
    # No other site may frame the terminal (clickjacking).
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "frame-ancestors 'none'" always;

    auth_request /authelia;
    auth_request_set $user $upstream_http_remote_user;
    auth_request_set $groups $upstream_http_remote_groups;
    auth_request_set $name $upstream_http_remote_name;
    auth_request_set $email $upstream_http_remote_email;

    proxy_set_header Remote-User $user;
    proxy_set_header Remote-Groups $groups;
    proxy_set_header Remote-Name $name;
    proxy_set_header Remote-Email $email;

    error_page 401 =302 https://auth.lotusguild.org/?rd=$scheme://$http_host$request_uri;

    proxy_set_header Authorization "Basic __DEVDESK_BASIC__";

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;
    proxy_buffering off;

    include /etc/nginx/conf.d/include/proxy.conf;
}