os-ssoproxy
Single sign-on for anything behind the OPNsense reverse proxy. Point a site at Authelia, authentik or Keycloak from the firewall interface, with no hand-edited nginx.
No release published here yet.
Status: not packaged yet
This one is working and in daily use, but there is no installable package here yet — putting up a half-finished .pkg would waste your evening rather than save it. When there is one it will appear on this page, and https://campbell-moore.com/downloads/os-ssoproxy/latest will resolve to it.
If you want it sooner, say so — knowing somebody is waiting is genuinely what moves a project up the list.
What it does
Puts an identity provider in front of any website already behind the firewall's nginx reverse proxy, configured from the OPNsense interface. No hand-edited configuration, no second reverse proxy, and no identity provider running on the firewall itself.
It works with anything that offers a forward-auth endpoint — Authelia, authentik, or Keycloak via oauth2-proxy.
Why it is not just a forward-auth snippet
- It knows which API paths each application needs left alone. Protecting a service usually breaks the integrations that were talking to it, which is the point most people give up on forward auth. This ships that knowledge per application.
- It verifies the configuration before applying it. The generated nginx config is tested, and if nginx refuses it the change is rolled back rather than left in place. A reverse proxy that will not start takes every site behind it down with it.
Licence
PolyForm Noncommercial 1.0.0. Free for personal and non-commercial use; commercial use is a separate licence — ask.