@blakearoberts/visage 0.0.1-rc.19 → 0.0.1-rc.21

package/dist/index.js

@@ -1,111 +1,14 @@
-import { mkdirSync, chmodSync, openSync, rmSync, existsSync, createWriteStream, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { join } from 'node:path';
+import { readFileSync, mkdirSync, chmodSync, openSync, rmSync, existsSync, createWriteStream, appendFileSync, writeFileSync } from 'node:fs';
+import { parse, stringify } from 'yaml';
 import { spawnSync, spawn } from 'node:child_process';
 import { homedir } from 'node:os';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { stringify } from 'yaml';
 import { hashSync } from 'bcryptjs';
 import { Eta } from 'eta';
 import { randomBytes } from 'node:crypto';
 
-const CACHE_HOME = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
-async function ensureCerts({ certs, hostname }) {
-    const CAROOT = join(CACHE_HOME, 'visage/ca');
-    mkdirSync(CAROOT, { recursive: true, mode: 0o700 });
-    chmodSync(CAROOT, 0o700);
-    const mkcert = await ensureMkCert();
-    const logs = join(dirname(certs), 'logs');
-    mkdirSync(logs, { recursive: true });
-    const log = join(logs, 'mkcert.log');
-    const output = openSync(log, 'w');
-    const env = { CAROOT, TRUST_STORES: 'system', ...process.env };
-    const tty = process.stdin.isTTY;
-    const stdio = [
-        tty ? 'inherit' : 'ignore',
-        output,
-        output,
-    ];
-    if (process.env.CI !== 'true') {
-        // mkcert -install is idempotent; CA files alone do not prove trust-store state.
-        const result = spawnSync(mkcert, ['-install'], { env, stdio });
-        if (result.error)
-            throw result.error;
-        if (result.status !== 0) {
-            throw new Error('Failed to install CA');
-        }
-    }
-    const cert = join(certs, 'tls.crt');
-    const key = join(certs, 'tls.key');
-    mkdirSync(certs, { recursive: true });
-    rmSync(cert, { force: true });
-    rmSync(key, { force: true });
-    const names = [...new Set([hostname, 'localhost', '127.0.0.1', '::1'])];
-    const args = ['-cert-file', cert, '-key-file', key, ...names];
-    const result = spawnSync(mkcert, args, { env, stdio });
-    if (result.error)
-        throw result.error;
-    if (result.status !== 0) {
-        throw new Error('Failed to generate TLS certificates');
-    }
-}
-async function ensureMkCert() {
-    const bin = join(CACHE_HOME, 'visage/bin');
-    const file = join(bin, `mkcert-${process.platform}-${process.arch}`);
-    if (existsSync(file))
-        return file;
-    mkdirSync(bin, { recursive: true });
-    const base = 'https://dl.filippo.io/mkcert/latest';
-    const arch = process.arch === 'x64' ? 'amd64' : process.arch;
-    const params = `?for=${process.platform}/${arch}`;
-    const url = new URL(params, base);
-    const response = await fetch(url);
-    if (!response.ok || !response.body) {
-        throw new Error('Failed to download mkcert');
-    }
-    await pipeline(Readable.fromWeb(response.body), createWriteStream(file));
-    chmodSync(file, 0o755);
-    return file;
-}
-
-let stopRef;
-function startCompose(file) {
-    stopRef?.();
-    stopRef = undefined;
-    const logs = join(dirname(file), 'logs');
-    mkdirSync(logs, { recursive: true });
-    const output = openSync(join(logs, 'compose.log'), 'w');
-    const compose = [
-        'compose',
-        '--ansi=never',
-        `--file=${file}`,
-        `--project-name=${process.env.COMPOSE_PROJECT_NAME ?? 'visage'}`,
-    ];
-    const env = { ...process.env, COMPOSE_MENU: 'false' };
-    const opts = {
-        cwd: dirname(file),
-        stdio: ['ignore', output, output],
-        env,
-    };
-    const up = [
-        ...compose,
-        'up',
-        '--abort-on-container-failure',
-        '--remove-orphans',
-    ];
-    const child = spawn('docker', up, opts);
-    const stop = () => {
-        if (stopRef !== stop)
-            return;
-        stopRef = undefined;
-        child.kill();
-        const down = [...compose, 'down', '--remove-orphans'];
-        spawnSync('docker', down, opts);
-    };
-    stopRef = stop;
-    return stop;
-}
-
 const BaseFiles = {
     certs: ['./certs', '/etc/nginx/certs'],
     compose: './compose.yaml',
@@ -115,29 +18,24 @@ const BaseFiles = {
     clientSecret: ['./oauth2-client-secret', '/etc/oauth2-proxy/client-secret'],
     cookieSecret: ['./oauth2-cookie-secret', '/etc/oauth2-proxy/cookie-secret'],
 };
+const DockerImages = parse(readFileSync(new URL('../docker-compose.images.yml', import.meta.url), 'utf8')).services;
 const BaseServiceDex = {
-    image: 'ghcr.io/dexidp/dex:v2.45.1',
+    image: DockerImages.dex.image,
     command: ['dex', 'serve', '/etc/dex/dex.yml'],
     restart: 'always',
 };
 const BaseServiceNginx = {
-    image: 'nginx:1.30.0-alpine',
+    image: DockerImages.nginx.image,
     depends_on: ['oauth2_proxy'],
     extra_hosts: ['host.docker.internal:host-gateway'],
     restart: 'always',
 };
 const BaseServiceOAuth2Proxy = {
-    image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.15.2',
+    image: DockerImages.oauth2_proxy.image,
     command: ['--config', '/etc/oauth2-proxy/config.yml'],
     extra_hosts: ['host.docker.internal:host-gateway'],
     restart: 'always',
 };
-const BaseUpstreamDex = {
-    host: 'dex',
-    scheme: 'http',
-    port: 5556,
-    locations: { '/dex/': { auth: { enabled: false } } },
-};
 const BaseUpstreamOauth2Proxy = {
     host: 'oauth2_proxy',
     scheme: 'http',
@@ -159,10 +57,7 @@ const DefaultCookiePolicy = {
     cookie_secret_file: BaseFiles.cookieSecret[1],
 };
 const DefaultDexUsers = [
-    {
-        email: 'user@example.com',
-        password: 'pass',
-    },
+    { email: 'user@example.com', password: 'pass' },
 ];
 const DefaultOAuth2Client = {
     id: 'visage',
@@ -170,7 +65,6 @@ const DefaultOAuth2Client = {
     scopes: ['openid', 'email', 'profile', 'offline_access'],
     emailDomains: ['example.com']};
 const DefaultProxyPolicy = {
-    auth: { enabled: true, forward: 'id', redirect: false },
     headers: {
         Cookie: '""', // Don't forward session cookie.
         Host: '$host',
@@ -183,7 +77,7 @@ const DefaultProxyPolicy = {
     },
 };
 function resolveOptions(options) {
-    const { host = 'localhost', port = 9001, cookie = {}, oauth2 = {} } = options;
+    const { host = 'localhost', port = 9001, cookie = {}, idp = {}, oauth2 = {}, } = options;
     const cookieName = cookie.name ?? 'sess';
     const publicClient = oauth2.clientSecret === null;
     const services = resolveServicesOptions(options.services);
@@ -207,7 +101,19 @@ function resolveOptions(options) {
                 : { cookie_domains: cookie.domains }),
             ...(cookie.path === undefined ? {} : { cookie_path: cookie.path }),
         },
-        idp: resolveIdpOption(options.idp),
+        idp: 'issuer' in idp
+            ? idp
+            : {
+                dex: {
+                    ...(idp.expiry ? { expiry: idp.expiry } : {}),
+                    users: (idp.users ?? DefaultDexUsers).map((user) => ({
+                        email: user.email,
+                        password: user.password,
+                        username: user.username ?? user.email.split('@', 1)[0],
+                        userID: user.userID ?? user.email,
+                    })),
+                },
+            },
         oauth2: {
             id: oauth2.clientId ?? DefaultOAuth2Client.id,
             ...(publicClient
@@ -274,78 +180,28 @@ function resolveUpstreamsOptions(services, upstreams = {}) {
         ])),
     };
 }
-function resolveIdpOption(idp) {
-    if (idp && 'issuer' in idp) {
-        return {
-            issuer: idp.issuer,
-            authorization: idp.authorization ?? '/auth',
-            token: idp.token ?? '/token',
-            jwks: idp.jwks ?? '/keys',
-        };
-    }
-    return {
-        dex: {
-            ...(idp?.expiry ? { expiry: idp.expiry } : {}),
-            users: (idp?.users ?? DefaultDexUsers).map((user) => ({
-                email: user.email,
-                password: user.password,
-                username: user.username ?? user.email.split('@', 1)[0],
-                userID: user.userID ?? user.email,
-            })),
-        },
-    };
-}
-function resolveDirectives(directives = {}) {
-    return Object.fromEntries(Object.entries(directives).map(([name, value]) => [
-        name,
-        Array.isArray(value) ? value : [value],
-    ]));
-}
-function resolveIdpConfig({ host, port, idp, }) {
-    if ('dex' in idp) {
-        const issuer = `https://${host}:${port}/dex`;
-        const upstream = `http://dex:5556/dex`;
-        return {
-            upstream: 'dex',
-            issuer,
-            authorization: `${issuer}/auth`,
-            token: `${upstream}/token`,
-            jwks: `${upstream}/keys`,
-            dex: {
-                expiry: idp.dex.expiry,
-                users: (idp.dex?.users ?? DefaultDexUsers).map((user) => ({
-                    email: user.email,
-                    password: user.password,
-                    username: user.username ?? user.email.split('@', 1)[0],
-                    userID: user.userID ?? user.email,
-                })),
-            },
-        };
-    }
-    return {
-        upstream: 'idp',
-        issuer: idp.issuer,
-        authorization: idp.issuer + (idp.authorization ?? '/auth'),
-        token: idp.issuer + (idp.token ?? '/token'),
-        jwks: idp.issuer + (idp.jwks ?? '/keys'),
-    };
-}
-function resolveExternalIdpUpstream(idp) {
-    const issuer = new URL(idp.issuer);
-    return {
-        host: issuer.hostname,
-        locations: {},
-        scheme: issuer.protocol === 'https:' ? 'https' : 'http',
-        port: Number(issuer.port) || (issuer.protocol === 'https:' ? 443 : 80),
-    };
-}
 function resolveConfig(options, cache) {
     const idp = resolveIdpConfig(options);
     const upstreams = {
-        oauth2_proxy: BaseUpstreamOauth2Proxy,
-        ...(idp.dex === undefined
-            ? { idp: resolveExternalIdpUpstream(idp) }
-            : { dex: BaseUpstreamDex }),
+        oauth2_proxy: {
+            ...BaseUpstreamOauth2Proxy,
+            locations: {
+                ...BaseUpstreamOauth2Proxy.locations,
+                '/oauth2/sign_out': {
+                    auth: { enabled: false },
+                    headers: {
+                        Cookie: '$http_cookie', // Forward session cookie.
+                        'X-Auth-Request-Redirect': idp.oidc.end_session_endpoint
+                            ? JSON.stringify(idp.oidc.end_session_endpoint +
+                                (idp.oidc.end_session_endpoint.includes('?') ? '&' : '?') +
+                                'id_token_hint={id_token}&post_logout_redirect_uri=' +
+                                encodeURIComponent(`https://${options.host}:${options.port}/`))
+                            : '/',
+                    },
+                },
+            },
+        },
+        ...idp.upstream,
         ...options.upstreams,
     };
     return {
@@ -355,15 +211,19 @@ function resolveConfig(options, cache) {
         idp,
         oauth2: options.oauth2,
         cache,
-        files: { ...BaseFiles },
+        files: BaseFiles,
+        network: {
+            name: process.env.COMPOSE_PROJECT_NAME ?? 'visage',
+            trustedProxyIps: [],
+        },
         services: {
-            ...(idp.dex === undefined
-                ? { nginx: BaseServiceNginx, oauth2_proxy: BaseServiceOAuth2Proxy }
-                : {
+            ...('dex' in idp
+                ? {
                     dex: BaseServiceDex,
                     nginx: { ...BaseServiceNginx, depends_on: ['dex', 'oauth2_proxy'] },
                     oauth2_proxy: { ...BaseServiceOAuth2Proxy, depends_on: ['dex'] },
-                }),
+                }
+                : { nginx: BaseServiceNginx, oauth2_proxy: BaseServiceOAuth2Proxy }),
             ...Object.fromEntries(Object.entries(options.services).map(([name, { upstream: _upstream, ...service }]) => [
                 name,
                 { restart: 'on-failure', ...service },
@@ -377,33 +237,106 @@ function resolveConfig(options, cache) {
                 {
                     ...upstream,
                     external,
-                    locations: Object.fromEntries(Object.entries(upstream.locations ?? {}).map(([path, policy]) => [
-                        path,
-                        {
-                            auth: { ...DefaultProxyPolicy.auth, ...policy.auth },
-                            headers: {
-                                ...(external
-                                    ? { ...DefaultProxyPolicy.headers, Host: upstream.host }
-                                    : DefaultProxyPolicy.headers),
-                                ...policy.headers,
-                            },
-                            directives: {
-                                ...DefaultProxyPolicy.directives,
-                                ...resolveDirectives(policy.directives),
+                    locations: Object.fromEntries(Object.entries(upstream.locations ?? {}).map(([path, policy]) => {
+                        const auth = resolveAuthPolicy(policy.auth, external && name !== 'vite');
+                        return [
+                            path,
+                            {
+                                auth,
+                                csrf: policy.csrf ?? (auth.enabled ? 'api' : false),
+                                headers: {
+                                    ...(external
+                                        ? { ...DefaultProxyPolicy.headers, Host: upstream.host }
+                                        : DefaultProxyPolicy.headers),
+                                    ...policy.headers,
+                                },
+                                directives: {
+                                    ...DefaultProxyPolicy.directives,
+                                    ...Object.fromEntries(Object.entries(policy.directives ?? {}).map(([name, value]) => [
+                                        name,
+                                        Array.isArray(value) ? value : [value],
+                                    ])),
+                                },
                             },
-                        },
-                    ])),
+                        ];
+                    })),
                 },
             ];
         })),
     };
 }
+function resolveIdpConfig({ host, port, idp, }) {
+    if ('dex' in idp) {
+        return {
+            dex: {
+                expiry: idp.dex.expiry,
+                users: (idp.dex?.users ?? DefaultDexUsers).map((user) => ({
+                    email: user.email,
+                    password: user.password,
+                    username: user.username ?? user.email.split('@', 1)[0],
+                    userID: user.userID ?? user.email,
+                })),
+            },
+            oidc: {
+                issuer: `https://${host}:${port}/dex`,
+                authorization: `https://${host}:${port}/dex/auth`,
+                token: 'http://dex:5556/dex/token',
+                jwks: 'http://dex:5556/dex/keys',
+            },
+            upstream: {
+                dex: {
+                    host: 'dex',
+                    scheme: 'http',
+                    port: 5556,
+                    locations: { '/dex/': { auth: { enabled: false } } },
+                },
+            },
+        };
+    }
+    const issuer = new URL(idp.issuer);
+    const oidc = {
+        issuer: idp.issuer,
+        ...(idp.end_session_endpoint === undefined
+            ? {}
+            : { end_session_endpoint: idp.end_session_endpoint }),
+    };
+    return {
+        oidc: !idp.authorization && !idp.token && !idp.jwks
+            ? oidc
+            : {
+                ...oidc,
+                authorization: idp.issuer + (idp.authorization ?? '/auth'),
+                token: idp.issuer + (idp.token ?? '/token'),
+                jwks: idp.issuer + (idp.jwks ?? '/keys'),
+            },
+        upstream: {
+            idp: {
+                scheme: issuer.protocol === 'https:' ? 'https' : 'http',
+                host: issuer.hostname,
+                port: Number(issuer.port) || (issuer.protocol === 'https:' ? 443 : 80),
+                locations: {},
+            },
+        },
+    };
+}
+function resolveAuthPolicy(auth = {}, external) {
+    return {
+        enabled: auth.enabled ?? true,
+        forward: auth.forward === true
+            ? external
+                ? 'access'
+                : 'id'
+            : (auth.forward ?? false),
+        redirect: auth.redirect ?? false,
+    };
+}
 const BaseViteUpstream = {
     host: 'host.docker.internal',
     scheme: 'http',
     locations: {
         '/': {
-            auth: { forward: undefined, redirect: true },
+            auth: { redirect: true },
+            csrf: 'app',
             headers: {
                 Host: '$host',
                 Upgrade: '$http_upgrade',
@@ -425,15 +358,14 @@ function resolveViteUpstream(vite = { locations: {} }) {
             ...Object.fromEntries(Object.entries(vite.locations ?? {}).map(([path, policy]) => {
                 if (path !== '/')
                     return [path, policy];
-                const defaults = BaseViteUpstream.locations['/'];
+                const base = BaseViteUpstream.locations['/'];
                 return [
                     path,
                     {
-                        ...defaults,
-                        ...policy,
-                        auth: { ...defaults.auth, ...policy.auth },
-                        headers: { ...defaults.headers, ...policy.headers },
-                        directives: { ...defaults.directives, ...policy.directives },
+                        auth: { ...base.auth, ...policy.auth },
+                        csrf: policy.csrf ?? base.csrf,
+                        headers: { ...base.headers, ...policy.headers },
+                        directives: { ...base.directives, ...policy.directives },
                     },
                 ];
             })),
@@ -441,12 +373,99 @@ function resolveViteUpstream(vite = { locations: {} }) {
     };
 }
 
+const CACHE_HOME = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
+async function ensureCerts(config) {
+    const CAROOT = join(CACHE_HOME, 'visage/ca');
+    mkdirSync(CAROOT, { recursive: true, mode: 0o700 });
+    chmodSync(CAROOT, 0o700);
+    const mkcert = await ensureMkCert();
+    mkdirSync(join(config.cache, 'logs'), { recursive: true });
+    const out = openSync(join(config.cache, 'logs', 'mkcert.log'), 'w');
+    const env = { CAROOT, TRUST_STORES: 'system', ...process.env };
+    const tty = process.stdin.isTTY;
+    const stdio = [tty ? 'inherit' : 'ignore', out, out];
+    if (process.env.CI !== 'true') {
+        // mkcert -install is idempotent; CA files alone do not prove trust-store state.
+        const result = spawnSync(mkcert, ['-install'], { env, stdio });
+        if (result.error)
+            throw result.error;
+        if (result.status !== 0) {
+            throw new Error('Failed to install CA');
+        }
+    }
+    const certs = join(config.cache, config.files.certs[0]);
+    const cert = join(certs, 'tls.crt');
+    const key = join(certs, 'tls.key');
+    mkdirSync(certs, { recursive: true });
+    rmSync(cert, { force: true });
+    rmSync(key, { force: true });
+    const names = [...new Set([config.host, 'localhost', '127.0.0.1', '::1'])];
+    const args = ['-cert-file', cert, '-key-file', key, ...names];
+    const result = spawnSync(mkcert, args, { env, stdio });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw new Error('Failed to generate TLS certificates');
+    }
+}
+async function ensureMkCert() {
+    const bin = join(CACHE_HOME, 'visage/bin');
+    const file = join(bin, `mkcert-${process.platform}-${process.arch}`);
+    if (existsSync(file))
+        return file;
+    mkdirSync(bin, { recursive: true });
+    const base = 'https://dl.filippo.io/mkcert/latest';
+    const arch = process.arch === 'x64' ? 'amd64' : process.arch;
+    const params = `?for=${process.platform}/${arch}`;
+    const url = new URL(params, base);
+    const response = await fetch(url);
+    if (!response.ok || !response.body) {
+        throw new Error('Failed to download mkcert');
+    }
+    await pipeline(Readable.fromWeb(response.body), createWriteStream(file));
+    chmodSync(file, 0o755);
+    return file;
+}
+
+let stopRef;
+function startCompose(config) {
+    stopRef?.();
+    stopRef = undefined;
+    const file = join(config.cache, config.files.compose);
+    const logs = join(config.cache, 'logs');
+    const output = openSync(join(logs, 'compose.log'), 'w');
+    const compose = [
+        'compose',
+        '--ansi=never',
+        `--file=${file}`,
+        `--project-name=${process.env.COMPOSE_PROJECT_NAME ?? 'visage'}`,
+    ];
+    const env = { ...process.env, COMPOSE_MENU: 'false' };
+    const opts = {
+        cwd: config.cache,
+        stdio: ['ignore', output, output],
+        env,
+    };
+    const up = [...compose, 'up', '--remove-orphans'];
+    const child = spawn('docker', up, opts);
+    const stop = () => {
+        if (stopRef !== stop)
+            return;
+        stopRef = undefined;
+        child.kill();
+        const down = [...compose, 'down', '--remove-orphans'];
+        spawnSync('docker', down, opts);
+    };
+    stopRef = stop;
+    return stop;
+}
+
 const HOSTS_FILE = '/etc/hosts';
-function ensureHostEntry(hostname) {
-    if (!hostname ||
-        hostname.trim() !== hostname ||
-        hostname.includes('/') ||
-        hostname.includes(':')) {
+function ensureHostEntry({ host }) {
+    if (!host ||
+        host.trim() !== host ||
+        host.includes('/') ||
+        host.includes(':')) {
         throw new Error('Invalid hostname');
     }
     const contents = readFileSync(HOSTS_FILE, 'utf8');
@@ -456,7 +475,7 @@ function ensureHostEntry(hostname) {
             continue;
         }
         const [address, ...names] = uncommented.split(/\s+/);
-        if (!names.includes(hostname)) {
+        if (!names.includes(host)) {
             continue;
         }
         if (address === '127.0.0.1' || address === '::1') {
@@ -466,7 +485,7 @@ function ensureHostEntry(hostname) {
         throw new Error('Hosts file contains a conflicting entry');
     }
     const prefix = contents.endsWith('\n') ? '' : '\n';
-    const entry = `${prefix}127.0.0.1\t${hostname} # visage\n`;
+    const entry = `${prefix}127.0.0.1\t${host} # visage\n`;
     try {
         appendFileSync(HOSTS_FILE, entry);
         return;
@@ -486,6 +505,65 @@ function ensureHostEntry(hostname) {
     }
 }
 
+function ensureNginxNetwork(config) {
+    const exists = spawnSync('docker', [
+        'network',
+        'ls',
+        '--filter',
+        `name=${config.network.name}`,
+        '--format',
+        '{{ .Name }}',
+    ], { encoding: 'utf-8' });
+    if (exists.error)
+        throw exists.error;
+    if (exists.status !== 0) {
+        console.error(exists.stderr);
+        throw new Error('Failed to list Docker network');
+    }
+    if (exists.stdout) {
+        return {
+            ...config,
+            network: {
+                ...config.network,
+                trustedProxyIps: inspectNetwork(config.network.name),
+            },
+        };
+    }
+    const create = spawnSync('docker', ['network', 'create', '--driver', 'bridge', config.network.name], { encoding: 'utf-8' });
+    if (create.error)
+        throw create.error;
+    if (create.status !== 0) {
+        console.error(create.stderr);
+        throw new Error('Failed to create Docker network');
+    }
+    return {
+        ...config,
+        network: {
+            ...config.network,
+            trustedProxyIps: inspectNetwork(config.network.name),
+        },
+    };
+}
+function inspectNetwork(name) {
+    const result = spawnSync('docker', [
+        'network',
+        'inspect',
+        '--format',
+        '{{range .IPAM.Config}}{{println .Subnet}}{{end}}',
+        name,
+    ], { encoding: 'utf-8' });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        console.error(result.stderr);
+        throw new Error('Failed to inspect Docker network');
+    }
+    return result.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+
 function writeComposeConfig(config) {
     const file = join(config.cache, config.files.compose);
     const render = renderComposeConfig(config);
@@ -494,8 +572,9 @@ function writeComposeConfig(config) {
 function renderComposeConfig(config) {
     const { dex, nginx, oauth2_proxy, ...services } = config.services;
     return stringify({
+        networks: { default: { external: true, name: config.network.name } },
         services: {
-            ...(config.idp.dex !== undefined
+            ...('dex' in config.idp
                 ? {
                     dex: {
                         ...config.services.dex,
@@ -526,38 +605,34 @@ function renderComposeConfig(config) {
 }
 
 function writeDexConfig(config) {
-    const file = join(config.cache, config.files.dex[0]);
     const render = renderDexConfig(config);
+    const file = join(config.cache, config.files.dex[0]);
     writeFileSync(file, render, 'utf-8');
 }
 function renderDexConfig(config) {
-    const { idp } = config;
-    if (idp.dex === undefined) {
-        throw new Error('Dex config is required to render Dex');
-    }
-    const origin = `https://${config.host}:${config.port}`;
-    const redirect = `${origin}/oauth2/callback`;
-    const upstream = config.upstreams[idp.upstream];
+    if (!('dex' in config.idp))
+        throw new Error('Dex config missing');
+    const { host, port, oauth2, idp: { dex: { expiry, users }, oidc, upstream, }, } = config;
     return stringify({
-        issuer: idp.issuer,
+        issuer: oidc.issuer,
         storage: { type: 'memory' },
-        web: { http: `0.0.0.0:${upstream.port}` },
+        web: { http: `0.0.0.0:${upstream.dex.port}` },
         oauth2: { skipApprovalScreen: true },
         staticClients: [
             {
-                id: config.oauth2.id,
+                id: oauth2.id,
                 name: 'Visage',
-                ...(config.oauth2.secret === undefined
+                ...(oauth2.secret === undefined
                     ? { public: true }
-                    : { secret: config.oauth2.secret }),
-                redirectURIs: [redirect],
+                    : { secret: oauth2.secret }),
+                redirectURIs: [`https://${host}:${port}/oauth2/callback`],
             },
         ],
         enablePasswordDB: true,
-        ...(idp.dex.expiry === undefined ? {} : { expiry: idp.dex.expiry }),
-        staticPasswords: idp.dex.users.map(({ password, ...user }) => ({
+        ...(expiry === undefined ? {} : { expiry }),
+        staticPasswords: users.map(({ password, ...user }) => ({
             ...user,
-            hash: hashSync(password, 10),
+            hash: hashSync(password),
         })),
     });
 }
@@ -582,6 +657,18 @@ http {
         ''      close;
     }
 
+    # Fetch Metadata CSRF guards for cookie-backed locations.
+    map $http_sec_fetch_site $csrf_api {
+        default 0;
+        same-site 1;
+        cross-site 1;
+    }
+    map "$http_sec_fetch_site:$request_method:$http_sec_fetch_mode:$http_sec_fetch_dest" $csrf_app {
+        default 0;
+        ~^(cross-site|same-site):GET:navigate:document$ 0;
+        ~^(cross-site|same-site): 1;
+    }
+
     <%_ for (const [name, upstream] of Object.entries(it.upstreams)) { %>
 
     upstream <%~ name %> {
@@ -608,8 +695,21 @@ http {
         error_page 497 =301 https://$http_host$request_uri;
 
         <%_ for (const [name, upstream] of Object.entries(it.upstreams)) { %>
-            <%_ for (const [path, location] of Object.entries(upstream.locations ?? {})) { %>
+        <%_ for (const [path, location] of Object.entries(upstream.locations)) { %>
         location <%~ path %> {
+            <%_ if (location.csrf) { %>
+            add_header Vary "Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest" always;
+            <%_ if (location.csrf === 'app') { %>
+            if ($csrf_app) {
+                return 403;
+            }
+            <%_ } else { %>
+            if ($csrf_api) {
+                return 403;
+            }
+            <%_ } %>
+
+            <%_ } %>
             <%_ if (location.auth?.enabled) { %>
             auth_request      /oauth2/auth;
             auth_request_set  $authorization $upstream_http_authorization;
@@ -646,7 +746,7 @@ http {
             <%_ } %>
             proxy_pass <%~ upstream.scheme %>://<%~ name %>;
         }
-            <%_ } %>
+        <%_ } %>
 
         <%_ } %>
     }
@@ -703,11 +803,15 @@ function renderOauth2ProxyConfig(config) {
     const data = {
         http_address: `0.0.0.0:${config.upstreams.oauth2_proxy.port}`,
         provider: 'oidc',
-        oidc_issuer_url: config.idp.issuer,
-        skip_oidc_discovery: true,
-        login_url: config.idp.authorization,
-        redeem_url: config.idp.token,
-        oidc_jwks_url: config.idp.jwks,
+        oidc_issuer_url: config.idp.oidc.issuer,
+        ...('authorization' in config.idp.oidc
+            ? {
+                skip_oidc_discovery: true,
+                login_url: config.idp.oidc.authorization,
+                redeem_url: config.idp.oidc.token,
+                oidc_jwks_url: config.idp.oidc.jwks,
+            }
+            : {}),
         redirect_url: `https://${config.host}:${config.port}/oauth2/callback`,
         client_id: config.oauth2.id,
         ...(config.oauth2.secret === undefined
@@ -723,9 +827,16 @@ function renderOauth2ProxyConfig(config) {
         cookie_csrf_per_request: true,
         cookie_csrf_per_request_limit: 16,
         email_domains: config.oauth2.emailDomains,
-        whitelist_domains: [config.host, `${config.host}:${config.port}`],
+        whitelist_domains: [
+            config.host,
+            `${config.host}:${config.port}`,
+            ...(!('dex' in config.idp) && config.idp.oidc.end_session_endpoint
+                ? [new URL(config.idp.oidc.end_session_endpoint).host]
+                : []),
+        ],
         scope: config.oauth2.scopes.join(' '),
         reverse_proxy: true,
+        trusted_proxy_ips: config.network.trustedProxyIps,
         set_xauthrequest: true,
         set_authorization_header: true,
         pass_access_token: true,
@@ -746,36 +857,19 @@ function renderOauth2ProxyConfig(config) {
         .join('\n')}\n`;
 }
 
-function render(config) {
-    writeComposeConfig(config);
-    if (config.idp.dex !== undefined) {
-        writeDexConfig(config);
-    }
-    writeNginxConfig(config);
-    writeOauth2ProxyConfig(config);
-}
-
 function createVisageServer(options) {
+    const cache = join(process.cwd(), '.visage');
     const config = resolveConfig(resolveOptions({
         ...options,
         upstreams: {
             ...options.upstreams,
             vite: resolveViteUpstream(options.upstreams?.vite),
         },
-    }), join(process.cwd(), '.visage'));
+    }), cache);
     let stop;
     return {
         async listen() {
-            if (stop)
-                return;
-            rmSync(join(config.cache, 'logs'), { recursive: true, force: true });
-            await ensureCerts({
-                certs: join(config.cache, config.files.certs[0]),
-                hostname: config.host,
-            });
-            ensureHostEntry(config.host);
-            render(config);
-            stop = await startCompose(join(config.cache, config.files.compose));
+            stop ??= await startVisageServer(config);
         },
         close() {
             stop?.();
@@ -783,6 +877,22 @@ function createVisageServer(options) {
         },
     };
 }
+async function startVisageServer(config) {
+    const logs = join(config.cache, 'logs');
+    rmSync(logs, { recursive: true, force: true });
+    mkdirSync(logs, { recursive: true });
+    await ensureCerts(config);
+    ensureHostEntry(config);
+    const renderConfig = ensureNginxNetwork(config);
+    writeComposeConfig(renderConfig);
+    if ('dex' in renderConfig.idp) {
+        writeDexConfig(renderConfig);
+    }
+    writeNginxConfig(renderConfig);
+    writeOauth2ProxyConfig(renderConfig);
+    return startCompose(renderConfig);
+}
+
 function visage(options = {}) {
     const resolvedOptions = resolveOptions(options);
     let stop;
@@ -813,21 +923,6 @@ function visage(options = {}) {
                 printUrls();
                 viteDevServer.config.logger.info(visageUrl ?? 'Visage failed to start');
             };
-            async function startVisage(vite) {
-                const config = resolveConfig(resolveOptions({
-                    ...options,
-                    upstreams: { ...options.upstreams, vite },
-                }), join(viteDevServer.config.cacheDir, 'visage'));
-                visageUrl = formatVisageUrlLog(config.host, config.port);
-                rmSync(join(config.cache, 'logs'), { recursive: true, force: true });
-                await ensureCerts({
-                    certs: join(config.cache, config.files.certs[0]),
-                    hostname: config.host,
-                });
-                ensureHostEntry(config.host);
-                render(config);
-                return startCompose(join(config.cache, config.files.compose));
-            }
             // monkey patch vite's listen to get vite's auto-resolved port
             const listen = viteDevServer.listen.bind(viteDevServer);
             viteDevServer.listen = async (port, isRestart) => {
@@ -836,11 +931,19 @@ function visage(options = {}) {
                 if (!address || typeof address === 'string') {
                     throw new Error('Failed to resolve port for Visage');
                 }
-                const vite = resolveViteUpstream({
-                    port: address.port,
-                    ...options.upstreams?.vite,
-                });
-                stop = await startVisage(vite);
+                const cache = join(viteDevServer.config.cacheDir, 'visage');
+                const config = resolveConfig(resolveOptions({
+                    ...options,
+                    upstreams: {
+                        ...options.upstreams,
+                        vite: resolveViteUpstream({
+                            port: address.port,
+                            ...options.upstreams?.vite,
+                        }),
+                    },
+                }), cache);
+                visageUrl = formatVisageUrlLog(config.host, config.port);
+                stop = await startVisageServer(config);
                 viteDevServer.httpServer?.once('close', closeBundle);
                 return result;
             };
@@ -856,4 +959,4 @@ function formatVisageUrlLog(host, port) {
     return `  ${AnsiGreen}➜${AnsiReset}  ${AnsiBold}Visage${AnsiReset}:  ${AnsiCyan}https://${host}:${AnsiBold}${port}${AnsiReset}${AnsiCyan}/${AnsiReset}`;
 }
 
-export { createVisageServer, visage as default };
+export { createVisageServer, visage as default, visage };