https://github.com/jamowei/caddy-security

Caddy server with caddy-security extension enabled
https://github.com/jamowei/caddy-security

Last synced: 5 months ago
JSON representation

Caddy server with caddy-security extension enabled

• Host: GitHub
• URL: https://github.com/jamowei/caddy-security
• Owner: jamowei
• License: mit
• Created: 2024-12-19T18:28:11.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2025-12-19T14:25:17.000Z (7 months ago)
• Last Synced: 2026-01-23T18:57:15.598Z (6 months ago)
• Language: Dockerfile
• Homepage: https://caddyserver.com
• Size: 10.7 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# Caddy Security

Docker image containing [caddy](https://github.com/caddyserver/caddy) and [caddy-security](https://github.com/greenpau/caddy-security).

# Use Github OIDC

[Tutorial](https://docs.authcrunch.com/docs/authenticate/oauth/backend-oauth2-0007-github) 

and resulting `Caddyfile` (replace `mydomain.com` with your domain):

```

{

  order authenticate before respond

  order authorize before basicauth

  security {

    oauth identity provider github {env.GITHUB_CLIENT_ID} {env.GITHUB_CLIENT_SECRET}

    authentication portal auth {

      crypto default token lifetime 3600

      cookie domain mydomain.com

      enable identity provider github

      ui {

        links {

          "My Identity" "/whoami" icon "las la-user"

        }

      }

      transform user {

        match realm github

        action add role authp/user

      }

      transform user {

        match realm github

        match sub github.com/

        action add role authp/admin

      }

    }

    authorization policy user {

      set auth url https://auth.mydomain.com/oauth2/github

      allow roles authp/user

      validate bearer header

      inject headers with claims

    }

    authorization policy admin {

      set auth url https://auth.mydomain.com/oauth2/github

      allow roles authp/admin

      validate bearer header

      inject headers with claims

    }

  }

}

auth.mydomain.com {

  authenticate with auth

}

mydomain.com {

  authorize with user

	reverse_proxy user:8080

}

admin.mydomain.com {

  authorize with admin

  reverse_proxy admin:8080

}

```