os-ssoproxy
Single sign-on for anything behind the OPNsense reverse proxy. Point a site at Authelia, authentik or Keycloak from the firewall interface, with no hand-edited nginx.
Updated
No release published here yet.
Status: not packaged yet
This one works and is in daily use, but there is no installable package here yet. A half-finished .pkg would waste your evening rather than save it. When there is one, it will appear on this page, and https://campbell-moore.com/downloads/os-ssoproxy/latest will point to it.
If you want it sooner, say so. Knowing somebody is waiting is genuinely what moves a project up the list.
What it does
Puts an identity provider in front of any website already behind the firewall's nginx reverse proxy. You configure it from the OPNsense interface. There is no hand-edited configuration, no second reverse proxy, and no identity provider on the firewall itself.
It works with anything that offers a forward-auth endpoint: Authelia, authentik, or Keycloak through oauth2-proxy.
Why it is not just a forward-auth snippet
- It knows which API paths each application needs left alone. Protecting a service usually breaks the integrations that talk to it, and that is where most people give up on forward auth. This ships that knowledge per application.
- It verifies the configuration before applying it. It tests the generated nginx configuration. If nginx refuses it, the change is rolled back. A reverse proxy that will not start takes every site behind it down with it.
Licence
PolyForm Noncommercial 1.0.0. It is free for personal and non-commercial use. For commercial use, ask for a separate licence.