使用TinyAuth实现任意应用登录认证

docker run -d \
  --name tinyauth \
  -p 3000:3000 \
  -v ./data:/data \
  -e APP_URL=${APP_URL} \
  -e SECRET=${SECRET} \
  -e SESSION_EXPIRY=${SESSION_EXPIRY} \
  -e APP_TITLE=${APP_TITLE} \
  -e OAUTH_AUTO_REDIRECT=${OAUTH_AUTO_REDIRECT} \
  -e BACKGROUND_IMAGE=${BACKGROUND_IMAGE} \
  -e PROVIDER_GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID} \
  -e PROVIDER_GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET} \
  -e PROVIDER_GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID} \
  -e PROVIDER_GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} \
  -e PROVIDER_GENERIC_NAME=${GENERIC_NAME} \
  -e PROVIDER_GENERIC_REDIRECT_URL=${GENERIC_REDIRECT_URL} \
  -e PROVIDER_GENERIC_CLIENT_ID=${GENERIC_CLIENT_ID} \
  -e PROVIDER_GENERIC_CLIENT_SECRET=${GENERIC_CLIENT_SECRET} \
  -e PROVIDER_GENERIC_AUTH_URL=${GENERIC_AUTH_URL} \
  -e PROVIDER_GENERIC_TOKEN_URL=${GENERIC_TOKEN_URL} \
  -e PROVIDER_GENERIC_USER_URL=${GENERIC_USER_URL} \
  -e PROVIDER_GENERIC_SCOPE=${GENERIC_SCOPE} \
  --restart always \
  ghcr.io/steveiliop56/tinyauth:v3.6.2

services:
    tinyauth:
        container_name: ${CONTAINER_NAME}
        environment:
            - APP_URL=${PANEL_TINYAUTH_APP_URL}
            - SECRET=${PANEL_TINYAUTH_SECRET}
            - SESSION_EXPIRY=${PANEL_TINYAUTH_SESSION_EXPIRY}
            - APP_TITLE=${PANEL_TINYAUTH_APP_TITLE}
            - OAUTH_AUTO_REDIRECT=${PANEL_TINYAUTH_OAUTH_AUTO_REDIRECT}
            - BACKGROUND_IMAGE=${PANEL_TINYAUTH_BACKGROUND_IMAGE}
            - GITHUB_CLIENT_ID=${PANEL_TINYAUTH_GITHUB_CLIENT_ID}
            - GITHUB_CLIENT_SECRET=${PANEL_TINYAUTH_GITHUB_CLIENT_SECRET}
            - GITHUB_REDIRECT_URI=${PANEL_TINYAUTH_GITHUB_REDIRECT_URI}
            - GOOGLE_CLIENT_ID=${PANEL_TINYAUTH_GOOGLE_CLIENT_ID}
            - GOOGLE_CLIENT_SECRET=${PANEL_TINYAUTH_GOOGLE_CLIENT_SECRET}
            - GOOGLE_REDIRECT_URI=${PANEL_TINYAUTH_GOOGLE_REDIRECT_URI}
            - GENERIC_NAME=${PANEL_TINYAUTH_GENERIC_NAME}
            - GENERIC_CLIENT_ID=${PANEL_TINYAUTH_GENERIC_CLIENT_ID}
            - GENERIC_CLIENT_SECRET=${PANEL_TINYAUTH_GENERIC_CLIENT_SECRET}
            - GENERIC_AUTH_URL=${PANEL_TINYAUTH_GENERIC_AUTH_URL}
            - GENERIC_TOKEN_URL=${PANEL_TINYAUTH_GENERIC_TOKEN_URL}
            - GENERIC_USER_URL=${PANEL_TINYAUTH_GENERIC_USER_URL}
        image: ghcr.io/steveiliop56/tinyauth:latest
        ports:
            - 3000:3000
        restart: always
        volumes:
            - ./data:/data

# ===============================
# 主应用反向代理 + 鉴权
# ===============================
# 静态资源直接放行（不鉴权）
location = /manifest.json {
    proxy_pass http://127.0.0.1:8082;
}

location = /favicon.ico {
    proxy_pass http://127.0.0.1:8082;
}

location ^~ /assets/ {
    proxy_pass http://127.0.0.1:8082;
}

# 其他请求需要鉴权
location ^~ / {
    proxy_pass http://127.0.0.1:8082;

    # ---------------------
    # tinyauth 前置鉴权
    auth_request /_tinyauth_check;
    error_page 401 = @tinyauth_login;

    # 将用户信息传递给后端（如果 tinyauth 有返回用户信息）
    auth_request_set $ta_user $upstream_http_remote_user;
    proxy_set_header Remote-User $ta_user;
    # ---------------------

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header REMOTE-HOST $remote_addr;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_http_version 1.1;
    add_header X-Cache $upstream_cache_status;
    add_header Cache-Control no-cache;
    proxy_ssl_server_name off;
    proxy_ssl_name $proxy_host;
}

# ===============================
# 子请求：调用 tinyauth 检查登录
# ===============================
location = /_tinyauth_check {
    internal;
    proxy_pass http://127.0.0.1:14389/api/auth/nginx;  # tinyauth 的地址
    proxy_set_header x-forwarded-proto $scheme;
    proxy_set_header x-forwarded-host  $host;
    proxy_set_header x-forwarded-uri   $request_uri;
}

# ===============================
# 如果未登录，跳转到 tinyauth 登录页
# ===============================
location @tinyauth_login {
    return 302 https://sso.liushen.fun/login?redirect_uri=$scheme://$host$request_uri;
}