@blakearoberts/visage 0.0.1-rc.9 → 0.0.1

package/dist/index.js

@@ -1,71 +1,476 @@
-import { join, dirname } from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
-import { mkdirSync, openSync, chmodSync, rmSync, existsSync, createWriteStream, readFileSync, appendFileSync, writeFileSync } from 'node:fs';
+import { spawnSync, spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { isIP } from 'node:net';
+import { join } from 'node:path';
+import { readFileSync, mkdirSync, chmodSync, openSync, rmSync, appendFileSync, writeFileSync } from 'node:fs';
+import { parse, stringify } from 'yaml';
 import { homedir } from 'node:os';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
-import { stringify } from 'yaml';
 import { hashSync } from 'bcryptjs';
 import { Eta } from 'eta';
-import { createHash } from 'node:crypto';
 
-let stopRef;
-function startCompose(file) {
-    stopRef?.();
-    stopRef = undefined;
-    const logs = join(dirname(file), 'logs');
-    mkdirSync(logs, { recursive: true });
-    const output = openSync(join(logs, 'compose.log'), 'w');
-    const compose = [
-        'compose',
-        `--project-name=${process.env.COMPOSE_PROJECT_NAME ?? 'visage'}`,
-        `--file=${file}`,
-    ];
-    const env = { ...process.env, COMPOSE_MENU: 'false' };
-    const opts = {
-        cwd: dirname(file),
-        stdio: ['ignore', output, output],
-        env,
+const VisageEdgeKeyHeader$1 = 'X-Visage-Edge-Key';
+const DockerImages = parse(readFileSync(new URL('../docker-compose.images.yml', import.meta.url), 'utf8')).services;
+const BaseServiceDex = {
+    image: DockerImages.dex.image,
+    command: ['dex', 'serve', '/etc/dex/dex.yaml'],
+    restart: 'always',
+};
+const BaseServiceNginx = {
+    image: DockerImages.nginx.image,
+    depends_on: ['oauth2_proxy'],
+    extra_hosts: ['host.docker.internal:host-gateway'],
+    restart: 'always',
+};
+const BaseServiceOAuth2Proxy = {
+    image: DockerImages.oauth2_proxy.image,
+    command: ['--config', '/etc/oauth2-proxy/config.yml'],
+    extra_hosts: ['host.docker.internal:host-gateway'],
+    restart: 'always',
+};
+const DefaultProxyPolicy = {
+    auth: { enabled: true, forward: false, redirect: false },
+    csrf: 'api',
+    headers: {
+        Host: '$host',
+        // Mitigate header injection by clearing auth headers.
+        Authorization: '""',
+        Cookie: '""',
+        'X-Auth-Request-User': '""',
+        'X-Auth-Request-Email': '""',
+        'X-Auth-Request-Groups': '""',
+        'X-Auth-Request-Preferred-Username': '""',
+        // Add common proxy headers.
+        'X-Real-IP': '$remote_addr',
+        'X-Forwarded-For': '$proxy_add_x_forwarded_for',
+        'X-Forwarded-Proto': '$scheme',
+    },
+    directives: {
+        proxy_buffer_size: ['8k'],
+    },
+};
+const BaseUpstreamOauth2Proxy = {
+    host: 'oauth2_proxy',
+    scheme: 'http',
+    port: 4180,
+    locations: {
+        '/oauth2/': {
+            auth: { enabled: false, forward: false, redirect: false },
+            csrf: false,
+            headers: {
+                ...DefaultProxyPolicy.headers,
+                Cookie: '$http_cookie', // Forward session cookie.
+                'X-Auth-Request-Redirect': '$request_uri',
+            },
+            directives: { ...DefaultProxyPolicy.directives },
+        },
+        '/oauth2/sign_out': {
+            auth: { enabled: false, forward: false, redirect: false },
+            csrf: false,
+            headers: {
+                ...DefaultProxyPolicy.headers,
+                Cookie: '$http_cookie', // Forward session cookie.
+                'X-Auth-Request-Redirect': '/',
+            },
+            directives: { ...DefaultProxyPolicy.directives },
+        },
+    },
+};
+const DefaultCookiePolicy = {
+    cookie_expire: '8h',
+    cookie_refresh: '15m',
+    cookie_path: '/',
+};
+const DefaultDexUsers = [
+    { email: 'user@example.com', password: 'pass' },
+];
+const DefaultOAuth2Client = {
+    id: 'visage',
+    secret: 'visage-secret',
+    scopes: ['openid', 'email', 'profile', 'offline_access'],
+    emailDomains: ['example.com']};
+function resolveOptions(options) {
+    const { host = 'localhost', port = 9001, cookie = {}, idp = {}, oauth2 = {}, } = options;
+    const cookieName = cookie.name ?? 'sess';
+    const publicClient = oauth2.clientSecret === null;
+    const services = resolveServicesOptions(options.services);
+    return {
+        host,
+        port,
+        cookie: {
+            ...DefaultCookiePolicy,
+            cookie_name: cookie.domains === undefined
+                ? cookieName.startsWith('__Host-')
+                    ? cookieName
+                    : `__Host-${cookieName}`
+                : cookieName,
+            ...(cookie.expire === undefined ? {} : { cookie_expire: cookie.expire }),
+            ...(cookie.refresh === undefined
+                ? {}
+                : { cookie_refresh: cookie.refresh }),
+            ...(cookie.domains === undefined
+                ? {}
+                : { cookie_domains: cookie.domains }),
+            ...(cookie.path === undefined ? {} : { cookie_path: cookie.path }),
+        },
+        idp: 'issuer' in idp
+            ? idp
+            : {
+                dex: {
+                    ...(idp.expiry ? { expiry: idp.expiry } : {}),
+                    users: (idp.users ?? DefaultDexUsers).map((user) => ({
+                        email: user.email,
+                        password: user.password,
+                        username: user.username ?? user.email.split('@', 1)[0],
+                        userID: user.userID ?? user.email,
+                    })),
+                },
+            },
+        oauth2: {
+            id: oauth2.clientId ?? DefaultOAuth2Client.id,
+            ...(publicClient
+                ? {}
+                : { secret: oauth2.clientSecret ?? DefaultOAuth2Client.secret }),
+            scopes: oauth2.scopes ?? DefaultOAuth2Client.scopes,
+            emailDomains: oauth2.emailDomains ?? DefaultOAuth2Client.emailDomains,
+            public: publicClient,
+        },
+        services,
+        upstreams: resolveUpstreamsOptions(services, options.upstreams),
     };
-    const up = [
-        ...compose,
-        'up',
-        '--abort-on-container-failure',
-        '--no-color',
-        '--remove-orphans',
-    ];
-    const child = spawn('docker', up, opts);
-    const stop = () => {
-        if (stopRef !== stop)
+}
+function resolveServicesOptions(services = {}) {
+    return {
+        ...services,
+        nginx: {
+            ...BaseServiceNginx,
+            ...{
+                ...(services.nginx ?? {}),
+                extra_hosts: [
+                    ...BaseServiceNginx.extra_hosts,
+                    ...(services.nginx?.extra_hosts ?? []),
+                ],
+            },
+        },
+        oauth2_proxy: {
+            ...BaseServiceOAuth2Proxy,
+            ...{
+                ...(services.oauth2_proxy ?? {}),
+                extra_hosts: [
+                    ...BaseServiceOAuth2Proxy.extra_hosts,
+                    ...(services.oauth2_proxy?.extra_hosts ?? []),
+                ],
+            },
+        },
+    };
+}
+function resolveUpstreamsOptions(services, upstreams = {}) {
+    return {
+        ...Object.fromEntries(Object.entries(services)
+            .filter(([name]) => 
+        // Exclude base services handled separately.
+        name !== 'dex' && name !== 'nginx' && name !== 'oauth2_proxy')
+            .map(([name, service]) => [
+            name,
+            resolveUpstreamOptions(name, service.upstream, false),
+        ])),
+        ...Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => {
+            if (name === 'vite') {
+                const vite = resolveViteUpstreamOptions(upstream);
+                return [name, resolveUpstreamOptions('vite', vite, true)];
+            }
+            return [
+                name,
+                resolveUpstreamOptions(name, upstream, services[name] === undefined),
+            ];
+        })),
+    };
+}
+const BaseViteUpstreamRootLocation = {
+    auth: { enabled: true, forward: false, redirect: true },
+    csrf: 'app',
+    headers: {
+        Host: '$host',
+        Upgrade: '$http_upgrade',
+        Connection: '$connection_upgrade',
+        'X-Auth-Request-User': '$auth_user',
+        'X-Auth-Request-Email': '$auth_email',
+    },
+    directives: {
+        proxy_http_version: ['1.1'],
+        proxy_read_timeout: ['1h'],
+    },
+};
+function resolveViteUpstreamOptions(upstream) {
+    const base = BaseViteUpstreamRootLocation;
+    const root = upstream.locations?.['/'];
+    return {
+        host: 'host.docker.internal',
+        scheme: 'http',
+        ...upstream,
+        locations: {
+            ...(upstream.locations ?? {}),
+            '/': root === undefined
+                ? { ...base }
+                : {
+                    auth: { ...base.auth, ...root.auth },
+                    csrf: root.csrf ?? base.csrf,
+                    headers: {
+                        ...base.headers,
+                        ...root.headers,
+                    },
+                    directives: {
+                        ...base.directives,
+                        ...root.directives,
+                    },
+                },
+        },
+    };
+}
+function resolveUpstreamOptions(name, upstream = {}, external) {
+    const scheme = upstream.scheme ?? (external ? 'https' : 'http');
+    const host = upstream.host ?? name;
+    return {
+        ...upstream,
+        scheme,
+        host,
+        port: upstream.port ?? (scheme === 'https' ? 443 : 80),
+        locations: {
+            ...Object.fromEntries(Object.entries(upstream.locations ?? { [`/${name}/`]: {} }).map(([path, policy]) => [
+                path,
+                resolveUpstreamLocationOptions(name, host, policy, external),
+            ])),
+        },
+    };
+}
+function resolveUpstreamLocationOptions(name, host, location, external) {
+    const auth = resolveAuthPolicy(location.auth, external && name !== 'vite');
+    return {
+        ...DefaultProxyPolicy,
+        ...location,
+        auth,
+        csrf: location.csrf ?? (auth.enabled ? 'api' : false),
+        headers: {
+            ...DefaultProxyPolicy.headers,
+            ...(external ? { Host: host } : {}),
+            ...(auth.enabled && auth.forward === 'id'
+                ? { Authorization: '$authorization' }
+                : {}),
+            ...(auth.enabled && auth.forward === 'access'
+                ? { Authorization: '"Bearer $access_token"' }
+                : {}),
+            ...(location.headers ?? {}),
+        },
+        directives: {
+            ...DefaultProxyPolicy.directives,
+            ...Object.fromEntries(Object.entries(location.directives ?? {}).map(([name, value]) => [
+                name,
+                Array.isArray(value) ? value : [value],
+            ])),
+        },
+    };
+}
+function resolveAuthPolicy(auth = {}, external) {
+    return {
+        enabled: auth.enabled ?? true,
+        forward: auth.forward === true
+            ? external
+                ? 'access'
+                : 'id'
+            : (auth.forward ?? false),
+        redirect: auth.redirect ?? false,
+    };
+}
+function resolveConfig(options, cache, edgeKey) {
+    const idp = resolveIdpConfig(options);
+    const end_session_endpoint = idp.oidc.end_session_endpoint;
+    const upstreams = {
+        ...(end_session_endpoint === undefined
+            ? { oauth2_proxy: { ...BaseUpstreamOauth2Proxy } }
+            : {
+                oauth2_proxy: {
+                    ...BaseUpstreamOauth2Proxy,
+                    locations: {
+                        ...BaseUpstreamOauth2Proxy.locations,
+                        '/oauth2/sign_out': {
+                            ...BaseUpstreamOauth2Proxy.locations['/oauth2/sign_out'],
+                            headers: {
+                                ...BaseUpstreamOauth2Proxy.locations['/oauth2/sign_out']
+                                    .headers,
+                                'X-Auth-Request-Redirect': JSON.stringify(end_session_endpoint +
+                                    (end_session_endpoint.includes('?') ? '&' : '?') +
+                                    'id_token_hint={id_token}&post_logout_redirect_uri=' +
+                                    encodeURIComponent(`https://${options.host}:${options.port}/`)),
+                            },
+                        },
+                    },
+                },
+            }),
+        ...idp.upstream,
+        ...options.upstreams,
+        ...(edgeKey && options.upstreams.vite
+            ? { vite: resolveViteEdgeKeyConfig(options.upstreams.vite, edgeKey) }
+            : {}),
+    };
+    return {
+        host: options.host,
+        port: options.port,
+        cookie: options.cookie,
+        idp,
+        oauth2: options.oauth2,
+        cache,
+        files: {
+            certs: ['./certs', '/etc/nginx/certs'],
+            compose: './compose.yaml',
+            dex: ['./dex.yaml', '/etc/dex/dex.yaml'],
+            nginx: ['./nginx.conf', '/etc/nginx/nginx.conf'],
+            oauth2Proxy: ['./oauth2-proxy.yml', '/etc/oauth2-proxy/config.yml'],
+        },
+        secrets: {
+            cookieSecret: 'OAUTH2_PROXY_COOKIE_SECRET',
+            clientSecret: 'OAUTH2_CLIENT_SECRET',
+        },
+        network: {
+            name: process.env.COMPOSE_PROJECT_NAME ?? 'visage',
+            trustedProxyIps: [],
+        },
+        services: {
+            ...('dex' in idp
+                ? {
+                    dex: BaseServiceDex,
+                    nginx: { ...BaseServiceNginx, depends_on: ['dex', 'oauth2_proxy'] },
+                    oauth2_proxy: { ...BaseServiceOAuth2Proxy, depends_on: ['dex'] },
+                }
+                : { nginx: BaseServiceNginx, oauth2_proxy: BaseServiceOAuth2Proxy }),
+            ...Object.fromEntries(Object.entries(options.services).map(([name, { upstream: _upstream, ...service }]) => [
+                name,
+                { restart: 'on-failure', ...service },
+            ])),
+        },
+        upstreams: Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => {
+            const external = options.upstreams[name] !== undefined &&
+                options.services[name] === undefined;
+            return [
+                name,
+                { ...upstream, external },
+            ];
+        })),
+    };
+}
+function resolveViteEdgeKeyConfig(upstream, edgeKey) {
+    return {
+        ...upstream,
+        locations: Object.fromEntries(Object.entries(upstream.locations).map(([path, policy]) => [
+            path,
+            {
+                ...policy,
+                headers: {
+                    [VisageEdgeKeyHeader$1]: edgeKey,
+                    ...policy.headers,
+                },
+            },
+        ])),
+    };
+}
+function resolveIdpConfig({ host, port, idp, }) {
+    if ('dex' in idp) {
+        return {
+            dex: {
+                expiry: idp.dex.expiry,
+                users: (idp.dex?.users ?? DefaultDexUsers).map((user) => ({
+                    email: user.email,
+                    password: user.password,
+                    username: user.username ?? user.email.split('@', 1)[0],
+                    userID: user.userID ?? user.email,
+                })),
+            },
+            oidc: {
+                issuer: `https://${host}:${port}/dex`,
+                authorization: `https://${host}:${port}/dex/auth`,
+                token: 'http://dex:5556/dex/token',
+                jwks: 'http://dex:5556/dex/keys',
+            },
+            upstream: {
+                dex: {
+                    host: 'dex',
+                    scheme: 'http',
+                    port: 5556,
+                    locations: {
+                        '/dex/': {
+                            auth: { enabled: false, forward: false, redirect: false },
+                            csrf: false,
+                            headers: { ...DefaultProxyPolicy.headers },
+                            directives: { ...DefaultProxyPolicy.directives },
+                        },
+                    },
+                },
+            },
+        };
+    }
+    const issuer = new URL(idp.issuer);
+    const oidc = {
+        issuer: idp.issuer,
+        ...(idp.end_session_endpoint === undefined
+            ? {}
+            : { end_session_endpoint: idp.end_session_endpoint }),
+    };
+    return {
+        oidc: !idp.authorization && !idp.token && !idp.jwks
+            ? oidc
+            : {
+                ...oidc,
+                authorization: idp.issuer + (idp.authorization ?? '/auth'),
+                token: idp.issuer + (idp.token ?? '/token'),
+                jwks: idp.issuer + (idp.jwks ?? '/keys'),
+            },
+        upstream: {
+            idp: {
+                scheme: issuer.protocol === 'https:' ? 'https' : 'http',
+                host: issuer.hostname,
+                port: Number(issuer.port) || (issuer.protocol === 'https:' ? 443 : 80),
+                locations: {},
+            },
+        },
+    };
+}
+
+const VisageEdgeKeyHeader = 'X-Visage-Edge-Key';
+function createVisageMiddleware(edgeKey) {
+    return function visageMiddleware(request, response, next) {
+        if (isVisageEdgeRequest(request, edgeKey)) {
+            next();
             return;
-        stopRef = undefined;
-        child.kill();
-        const down = [...compose, 'down', '--remove-orphans'];
-        spawnSync('docker', down, opts);
+        }
+        response.statusCode = 403;
+        response.end('Forbidden');
     };
-    stopRef = stop;
-    return stop;
+}
+function createVisageUpgradeHandler(edgeKey) {
+    return function visageUpgrade(request, socket) {
+        if (isVisageEdgeRequest(request, edgeKey)) {
+            return;
+        }
+        socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+        socket.destroy();
+    };
+}
+function isVisageEdgeRequest(request, edgeKey) {
+    const header = request.headers[VisageEdgeKeyHeader.toLowerCase()];
+    return typeof header === 'string' && header === edgeKey;
 }
 
 const CACHE_HOME = process.env.XDG_CACHE_HOME || join(homedir(), '.cache');
-async function ensureCerts({ certs, hostname }) {
+async function ensureCerts(config) {
     const CAROOT = join(CACHE_HOME, 'visage/ca');
     mkdirSync(CAROOT, { recursive: true, mode: 0o700 });
     chmodSync(CAROOT, 0o700);
-    const mkcert = await ensureMkCert();
-    const logs = join(dirname(certs), 'logs');
-    mkdirSync(logs, { recursive: true });
-    const log = join(logs, 'mkcert.log');
-    const output = openSync(log, 'w');
+    const mkcert = resolveMkcert();
+    const out = openSync(join(config.cache, 'logs', 'mkcert.log'), 'w');
     const env = { CAROOT, TRUST_STORES: 'system', ...process.env };
     const tty = process.stdin.isTTY;
-    const stdio = [
-        tty ? 'inherit' : 'ignore',
-        output,
-        output,
-    ];
+    const stdio = [tty ? 'inherit' : 'ignore', out, out];
     if (process.env.CI !== 'true') {
-        // mkcert -install is idempotent; CA files alone do not prove trust-store state.
+        // mkcert -install is idempotent;
+        // CA files alone don't prove trust-store state.
         const result = spawnSync(mkcert, ['-install'], { env, stdio });
         if (result.error)
             throw result.error;
@@ -73,12 +478,14 @@ async function ensureCerts({ certs, hostname }) {
             throw new Error('Failed to install CA');
         }
     }
+    const certs = join(config.cache, config.files.certs[0]);
     const cert = join(certs, 'tls.crt');
     const key = join(certs, 'tls.key');
-    mkdirSync(certs, { recursive: true });
+    mkdirSync(certs, { recursive: true, mode: 0o700 });
+    chmodSync(certs, 0o700);
     rmSync(cert, { force: true });
     rmSync(key, { force: true });
-    const names = [...new Set([hostname, 'localhost', '127.0.0.1', '::1'])];
+    const names = [...new Set([config.host, 'localhost', '127.0.0.1', '::1'])];
     const args = ['-cert-file', cert, '-key-file', key, ...names];
     const result = spawnSync(mkcert, args, { env, stdio });
     if (result.error)
@@ -86,32 +493,128 @@ async function ensureCerts({ certs, hostname }) {
     if (result.status !== 0) {
         throw new Error('Failed to generate TLS certificates');
     }
+    chmodSync(cert, 0o600);
+    chmodSync(key, 0o600);
+}
+function resolveMkcert() {
+    const env = process.env;
+    const options = { encoding: 'utf8', env };
+    const mkcert = findMkcert();
+    const result = spawnSync(mkcert, ['-version'], options);
+    if (result.error || result.status !== 0) {
+        throw new Error([
+            `Visage found mkcert at "${mkcert}", but could not execute it.`,
+            '',
+            mkcertInstallInstructions(),
+        ].join('\n'));
+    }
+    return mkcert;
 }
-async function ensureMkCert() {
-    const bin = join(CACHE_HOME, 'visage/bin');
-    const file = join(bin, `mkcert-${process.platform}-${process.arch}`);
-    if (existsSync(file))
-        return file;
-    mkdirSync(bin, { recursive: true });
-    const base = 'https://dl.filippo.io/mkcert/latest';
-    const arch = process.arch === 'x64' ? 'amd64' : process.arch;
-    const params = `?for=${process.platform}/${arch}`;
-    const url = new URL(params, base);
-    const response = await fetch(url);
-    if (!response.ok || !response.body) {
-        throw new Error('Failed to download mkcert');
+function findMkcert() {
+    const env = process.env;
+    const exec = env.VISAGE_MKCERT || 'mkcert';
+    const options = { encoding: 'utf8', env };
+    const result = process.platform === 'win32'
+        ? spawnSync('where', [exec], options)
+        : spawnSync('sh', ['-c', `command -v ${exec}`], options);
+    const path = result.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .find(Boolean);
+    if (result.error || result.status !== 0 || !path) {
+        throw new Error([
+            'Visage requires mkcert to configure HTTPS, but mkcert was not found.',
+            '',
+            mkcertInstallInstructions(),
+        ].join('\n'));
     }
-    await pipeline(Readable.fromWeb(response.body), createWriteStream(file));
-    chmodSync(file, 0o755);
-    return file;
+    return path;
+}
+function mkcertInstallInstructions() {
+    const common = [
+        'After installing mkcert, run `mkcert -install` once when local ' +
+            'certificates should be trusted.',
+        'Install docs: https://github.com/FiloSottile/mkcert#installation',
+        'Set VISAGE_MKCERT=/path/to/mkcert to use a custom executable.',
+    ];
+    const platform = process.platform;
+    if (platform === 'darwin') {
+        return [
+            'Install mkcert with Homebrew:',
+            '  brew install mkcert',
+            '  brew install nss # optional, for Firefox',
+            ...common,
+        ].join('\n');
+    }
+    if (platform === 'win32') {
+        return [
+            'Install mkcert with Chocolatey or Scoop:',
+            '  choco install mkcert',
+            '  scoop install mkcert',
+            ...common,
+        ].join('\n');
+    }
+    if (platform === 'linux') {
+        return [
+            'Install mkcert with your Linux package manager. Common commands:',
+            '  sudo apt install mkcert libnss3-tools',
+            '  sudo dnf install mkcert nss-tools',
+            '  sudo pacman -Syu mkcert nss',
+            ...common,
+        ].join('\n');
+    }
+    return [
+        'Install mkcert for your operating system and make it available on PATH.',
+        ...common,
+    ].join('\n');
+}
+
+let stopRef;
+function startCompose(config) {
+    stopRef?.();
+    stopRef = undefined;
+    const file = join(config.cache, config.files.compose);
+    const logs = join(config.cache, 'logs');
+    const output = openSync(join(logs, 'compose.log'), 'w');
+    const compose = [
+        'compose',
+        '--ansi=never',
+        `--file=${file}`,
+        `--project-name=${process.env.COMPOSE_PROJECT_NAME ?? 'visage'}`,
+    ];
+    const env = {
+        COMPOSE_MENU: 'false',
+        [config.secrets.cookieSecret]: randomBytes(32).toString('base64url'),
+        ...(config.oauth2.public
+            ? {}
+            : { [config.secrets.clientSecret]: config.oauth2.secret }),
+        ...process.env,
+    };
+    const opts = {
+        cwd: config.cache,
+        stdio: ['ignore', output, output],
+        env,
+    };
+    const up = [...compose, 'up', '--remove-orphans'];
+    const child = spawn('docker', up, opts);
+    const stop = () => {
+        if (stopRef !== stop)
+            return;
+        stopRef = undefined;
+        child.kill();
+        const down = [...compose, 'down', '--remove-orphans'];
+        spawnSync('docker', down, opts);
+    };
+    stopRef = stop;
+    return stop;
 }
 
 const HOSTS_FILE = '/etc/hosts';
-function ensureHostEntry(hostname) {
-    if (!hostname ||
-        hostname.trim() !== hostname ||
-        hostname.includes('/') ||
-        hostname.includes(':')) {
+function ensureHostEntry({ host }) {
+    if (!host ||
+        host.trim() !== host ||
+        host.includes('/') ||
+        host.includes(':')) {
         throw new Error('Invalid hostname');
     }
     const contents = readFileSync(HOSTS_FILE, 'utf8');
@@ -121,7 +624,7 @@ function ensureHostEntry(hostname) {
             continue;
         }
         const [address, ...names] = uncommented.split(/\s+/);
-        if (!names.includes(hostname)) {
+        if (!names.includes(host)) {
             continue;
         }
         if (address === '127.0.0.1' || address === '::1') {
@@ -131,7 +634,7 @@ function ensureHostEntry(hostname) {
         throw new Error('Hosts file contains a conflicting entry');
     }
     const prefix = contents.endsWith('\n') ? '' : '\n';
-    const entry = `${prefix}127.0.0.1\t${hostname} # visage\n`;
+    const entry = `${prefix}127.0.0.1\t${host} # visage\n`;
     try {
         appendFileSync(HOSTS_FILE, entry);
         return;
@@ -151,6 +654,65 @@ function ensureHostEntry(hostname) {
     }
 }
 
+function ensureNginxNetwork(config) {
+    const exists = spawnSync('docker', [
+        'network',
+        'ls',
+        '--filter',
+        `name=${config.network.name}`,
+        '--format',
+        '{{ .Name }}',
+    ], { encoding: 'utf-8' });
+    if (exists.error)
+        throw exists.error;
+    if (exists.status !== 0) {
+        console.error(exists.stderr);
+        throw new Error('Failed to list Docker network');
+    }
+    if (exists.stdout) {
+        return {
+            ...config,
+            network: {
+                ...config.network,
+                trustedProxyIps: inspectNetwork(config.network.name),
+            },
+        };
+    }
+    const create = spawnSync('docker', ['network', 'create', '--driver', 'bridge', config.network.name], { encoding: 'utf-8' });
+    if (create.error)
+        throw create.error;
+    if (create.status !== 0) {
+        console.error(create.stderr);
+        throw new Error('Failed to create Docker network');
+    }
+    return {
+        ...config,
+        network: {
+            ...config.network,
+            trustedProxyIps: inspectNetwork(config.network.name),
+        },
+    };
+}
+function inspectNetwork(name) {
+    const result = spawnSync('docker', [
+        'network',
+        'inspect',
+        '--format',
+        '{{range .IPAM.Config}}{{println .Subnet}}{{end}}',
+        name,
+    ], { encoding: 'utf-8' });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        console.error(result.stderr);
+        throw new Error('Failed to inspect Docker network');
+    }
+    return result.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean);
+}
+
 function writeComposeConfig(config) {
     const file = join(config.cache, config.files.compose);
     const render = renderComposeConfig(config);
@@ -159,29 +721,44 @@ function writeComposeConfig(config) {
 function renderComposeConfig(config) {
     const { dex, nginx, oauth2_proxy, ...services } = config.services;
     return stringify({
+        networks: { default: { external: true, name: config.network.name } },
+        secrets: {
+            [config.secrets.cookieSecret]: {
+                environment: config.secrets.cookieSecret,
+            },
+            ...(config.oauth2.public
+                ? {}
+                : {
+                    [config.secrets.clientSecret]: {
+                        environment: config.secrets.clientSecret,
+                    },
+                }),
+        },
         services: {
-            ...(config.idp.dex !== undefined
+            ...('dex' in config.idp
                 ? {
                     dex: {
                         ...config.services.dex,
                         volumes: [`${config.files.dex[0]}:${config.files.dex[1]}:ro`],
+                        ...(config.oauth2.public
+                            ? {}
+                            : { secrets: [config.secrets.clientSecret] }),
                     },
                 }
                 : {}),
             nginx: {
                 ...config.services.nginx,
-                ports: [`${config.port}:${config.port}`],
+                ports: [`127.0.0.1:${config.port}:${config.port}`],
                 volumes: [config.files.certs, config.files.nginx].map(([from, to]) => `${from}:${to}:ro`),
             },
             oauth2_proxy: {
                 ...config.services.oauth2_proxy,
                 volumes: [
                     `${config.files.oauth2Proxy[0]}:${config.files.oauth2Proxy[1]}:ro`,
-                    ...(config.oauth2.public
-                        ? [
-                            `${config.files.oauth2ProxyClientSecret[0]}:${config.files.oauth2ProxyClientSecret[1]}:ro`,
-                        ]
-                        : []),
+                ],
+                secrets: [
+                    config.secrets.cookieSecret,
+                    ...(config.oauth2.public ? [] : [config.secrets.clientSecret]),
                 ],
             },
             ...services,
@@ -190,38 +767,36 @@ function renderComposeConfig(config) {
 }
 
 function writeDexConfig(config) {
-    const file = join(config.cache, config.files.dex[0]);
     const render = renderDexConfig(config);
+    const file = join(config.cache, config.files.dex[0]);
     writeFileSync(file, render, 'utf-8');
 }
 function renderDexConfig(config) {
-    const { idp } = config;
-    if (idp.dex === undefined) {
-        throw new Error('Dex config is required to render Dex');
-    }
-    const origin = `https://${config.host}:${config.port}`;
-    const redirect = `${origin}/oauth2/callback`;
-    const upstream = config.upstreams[idp.upstream];
+    if (!('dex' in config.idp))
+        throw new Error('Dex config missing');
+    const { host, port, oauth2, secrets, idp: { dex: { expiry, users }, oidc, upstream, }, } = config;
     return stringify({
-        issuer: idp.issuer,
+        issuer: oidc.issuer,
         storage: { type: 'memory' },
-        web: { http: `0.0.0.0:${upstream.port}` },
+        web: { http: `0.0.0.0:${upstream.dex.port}` },
         oauth2: { skipApprovalScreen: true },
         staticClients: [
             {
-                id: config.oauth2.id,
-                name: 'Visage',
-                ...(config.oauth2.secret === undefined
+                id: oauth2.id,
+                name: oauth2.id,
+                ...(oauth2.public
                     ? { public: true }
-                    : { secret: config.oauth2.secret }),
-                redirectURIs: [redirect],
+                    : {
+                        secret: `{{ file.Read "/run/secrets/${secrets.clientSecret}" }}`,
+                    }),
+                redirectURIs: [`https://${host}:${port}/oauth2/callback`],
             },
         ],
         enablePasswordDB: true,
-        ...(idp.dex.expiry === undefined ? {} : { expiry: idp.dex.expiry }),
-        staticPasswords: idp.dex.users.map(({ password, ...user }) => ({
+        ...(expiry === undefined ? {} : { expiry }),
+        staticPasswords: users.map(({ password, ...user }) => ({
             ...user,
-            hash: hashSync(password, 10),
+            hash: hashSync(password),
         })),
     });
 }
@@ -230,25 +805,46 @@ const template = `
 events {}
 
 http {
+    # Disable IPv6 DNS lookups that may fail to resolve upstream hostnames.
     resolver 127.0.0.11 ipv6=off;
 
+    # Configure access log format.
+    map $time_iso8601 $access_log_time {
+        "~^[0-9]{4}-[0-9]{2}-[0-9]{2}T([0-9]{2}:[0-9]{2}:[0-9]{2})" $1;
+        default $time_iso8601;
+    }
+    log_format access_log_format '$access_log_time | $status | $request_method $request_uri | $auth_email | $proxy_host';
+
     # Allow WebSockets (Vite HMR).
     map $http_upgrade $connection_upgrade {
         default upgrade;
         ''      close;
     }
 
+    # Fetch Metadata CSRF guards for cookie-backed locations.
+    map $http_sec_fetch_site $csrf_api {
+        default 0;
+        same-site 1;
+        cross-site 1;
+    }
+    map "$http_sec_fetch_site:$request_method:$http_sec_fetch_mode:$http_sec_fetch_dest" $csrf_app {
+        default 0;
+        ~^(cross-site|same-site):GET:navigate:document$ 0;
+        ~^(cross-site|same-site): 1;
+    }
+
     <%_ for (const [name, upstream] of Object.entries(it.upstreams)) { %>
+
     upstream <%~ name %> {
-        <%_ if (upstream.external) { %>
+        <%_ if (upstream.resolve) { %>
         zone <%~ name %> 64k;
         server <%~ upstream.host %>:<%~ upstream.port %> resolve;
         <%_ } else { %>
         server <%~ upstream.host %>:<%~ upstream.port %>;
         <%_ } %>
     }
-
     <%_ } %>
+
     server {
         listen <%~ it.port %> ssl;
         server_name <%~ it.host %>;
@@ -256,15 +852,40 @@ http {
         ssl_certificate     <%~ it.ssl.cert %>;
         ssl_certificate_key <%~ it.ssl.key %>;
 
-        # Redirect accidental plaintext HTTP requests sent to the HTTPS port.
+        access_log /var/log/nginx/access.log access_log_format;
+        set $auth_email "";
+
+        # Redirect HTTP to HTTPS.
         error_page 497 =301 https://$http_host$request_uri;
 
         <%_ for (const [name, upstream] of Object.entries(it.upstreams)) { %>
-            <%_ for (const [path, location] of Object.entries(upstream.locations ?? {})) { %>
+        <%_ for (const [path, location] of Object.entries(upstream.locations)) { %>
         location <%~ path %> {
+            <%_ if (location.csrf) { %>
+            add_header Vary "Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest" always;
+            <%_ if (location.csrf === 'app') { %>
+            if ($csrf_app) {
+                return 403;
+            }
+            <%_ } else { %>
+            if ($csrf_api) {
+                return 403;
+            }
+            <%_ } %>
+
+            <%_ } %>
             <%_ if (location.auth?.enabled) { %>
             auth_request      /oauth2/auth;
+            auth_request_set  $authorization $upstream_http_authorization;
             auth_request_set  $access_token $upstream_http_x_auth_request_access_token;
+            auth_request_set  $auth_user $upstream_http_x_auth_request_user;
+            auth_request_set  $auth_email $upstream_http_x_auth_request_email;
+            auth_request_set  $auth_groups $upstream_http_x_auth_request_groups;
+            auth_request_set  $auth_preferred_username $upstream_http_x_auth_request_preferred_username;
+
+            # Propagate refreshed session cookie.
+            auth_request_set  $auth_cookie $upstream_http_set_cookie;
+            add_header        Set-Cookie $auth_cookie;
 
             <%_ if (location.auth.redirect) { %>
             error_page 401 =302 /oauth2/start?rd=$scheme://$http_host$request_uri;
@@ -273,8 +894,10 @@ http {
             <%_ for (const [header, value] of Object.entries(location.headers ?? {})) { %>
             proxy_set_header <%~ header %> <%~ value %>;
             <%_ } %>
-            <%_ if (location.auth?.enabled && location.auth.forward) { %>
-            proxy_set_header Authorization "Bearer $access_token";
+            <%_ for (const [directive, values] of Object.entries(location.directives ?? {})) { %>
+                <%_ for (const value of values) { %>
+            <%~ directive %> <%~ value %>;
+                <%_ } %>
             <%_ } %>
             <%_ if (upstream.scheme === 'https') { %>
             proxy_ssl_server_name on;
@@ -282,7 +905,7 @@ http {
             <%_ } %>
             proxy_pass <%~ upstream.scheme %>://<%~ name %>;
         }
-            <%_ } %>
+        <%_ } %>
 
         <%_ } %>
     }
@@ -301,55 +924,76 @@ function renderNginxConfig(config) {
             cert: join(config.files.certs[1], 'tls.crt'),
             key: join(config.files.certs[1], 'tls.key'),
         },
-        upstreams: config.upstreams,
+        upstreams: Object.fromEntries(Object.entries(config.upstreams).map(([name, upstream]) => [
+            name,
+            {
+                ...upstream,
+                resolve: upstream.host === 'host.docker.internal'
+                    ? process.platform !== 'linux'
+                    : upstream.external,
+            },
+        ])),
     };
     return new Eta({ autoTrim: false }).renderString(template, data);
 }
 
+const LogTS = '{{slice .Timestamp 11 19}}';
+const LogReqURI = '{{printf "%.*s" (len (slice .RequestURI 2)) (slice .RequestURI 1)}}';
+const LogFormats = {
+    standard_logging_format: `${LogTS} | [{{.File}}] {{.Message}}`,
+    request_logging_format: `${LogTS} | {{.StatusCode}} | {{.RequestMethod}} ${LogReqURI} | {{.Username}} | {{.Upstream}}`,
+    auth_logging_format: `${LogTS} | {{.Status}} | {{.Username}} | {{.Message}}`,
+};
 function writeOauth2ProxyConfig(config) {
     const file = join(config.cache, config.files.oauth2Proxy[0]);
     const render = renderOauth2ProxyConfig(config);
     writeFileSync(file, render, 'utf-8');
-    if (config.oauth2.public) {
-        writeFileSync(join(config.cache, config.files.oauth2ProxyClientSecret[0]), '');
-    }
 }
 function renderOauth2ProxyConfig(config) {
     const data = {
         http_address: `0.0.0.0:${config.upstreams.oauth2_proxy.port}`,
         provider: 'oidc',
-        oidc_issuer_url: config.idp.issuer,
-        skip_oidc_discovery: true,
-        login_url: config.idp.authorization,
-        redeem_url: config.idp.token,
-        oidc_jwks_url: config.idp.jwks,
+        oidc_issuer_url: config.idp.oidc.issuer,
+        ...('authorization' in config.idp.oidc
+            ? {
+                skip_oidc_discovery: true,
+                login_url: config.idp.oidc.authorization,
+                redeem_url: config.idp.oidc.token,
+                oidc_jwks_url: config.idp.oidc.jwks,
+            }
+            : {}),
         redirect_url: `https://${config.host}:${config.port}/oauth2/callback`,
         client_id: config.oauth2.id,
-        ...(config.oauth2.secret === undefined
+        ...(config.oauth2.public
             ? {
-                client_secret_file: config.files.oauth2ProxyClientSecret[1],
                 code_challenge_method: 'S256',
+                client_secret_file: '/dev/null',
             }
-            : { client_secret: config.oauth2.secret }),
-        cookie_secret: createHash('sha256')
-            .update('visage:cookie-secret\0')
-            .update(config.cache)
-            .digest('base64url'),
+            : { client_secret_file: `/run/secrets/${config.secrets.clientSecret}` }),
         ...config.cookie,
+        cookie_secret_file: `/run/secrets/${config.secrets.cookieSecret}`,
         cookie_httponly: true,
         cookie_secure: true,
         cookie_samesite: 'lax',
         cookie_csrf_per_request: true,
         cookie_csrf_per_request_limit: 16,
-        email_domains: ['*'],
+        email_domains: config.oauth2.emailDomains,
+        whitelist_domains: [
+            config.host,
+            `${config.host}:${config.port}`,
+            ...(!('dex' in config.idp) && config.idp.oidc.end_session_endpoint
+                ? [new URL(config.idp.oidc.end_session_endpoint).host]
+                : []),
+        ],
         scope: config.oauth2.scopes.join(' '),
-        upstreams: ['static://202'],
         reverse_proxy: true,
+        trusted_proxy_ips: config.network.trustedProxyIps,
         set_xauthrequest: true,
+        set_authorization_header: true,
         pass_access_token: true,
-        pass_authorization_header: true,
         skip_provider_button: true,
-        whitelist_domains: [config.host, `${config.host}:${config.port}`],
+        approval_prompt: 'auto',
+        ...LogFormats,
     };
     return `${Object.entries(data)
         .map(([key, value]) => {
@@ -357,329 +1001,47 @@ function renderOauth2ProxyConfig(config) {
             const values = value.map((item) => JSON.stringify(item)).join(', ');
             return `${key} = [${values}]`;
         }
-        if (typeof value === 'string') {
+        if (typeof value === 'string')
             return `${key} = ${JSON.stringify(value)}`;
-        }
         return `${key} = ${String(value)}`;
     })
         .join('\n')}\n`;
 }
 
-function render(config) {
-    writeComposeConfig(config);
-    if (config.idp.dex !== undefined) {
-        writeDexConfig(config);
-    }
-    writeNginxConfig(config);
-    writeOauth2ProxyConfig(config);
-}
-
-const BaseFiles = {
-    certs: ['./certs', '/etc/nginx/certs'],
-    compose: './compose.yaml',
-    dex: ['./dex.yml', '/etc/dex/dex.yml'],
-    nginx: ['./nginx.conf', '/etc/nginx/nginx.conf'],
-    oauth2ProxyClientSecret: [
-        './oauth2-client-secret',
-        '/etc/oauth2-proxy/client-secret',
-    ],
-    oauth2Proxy: ['./oauth2-proxy.yml', '/etc/oauth2-proxy/config.yml'],
-};
-const BaseDexService = {
-    image: 'ghcr.io/dexidp/dex:v2.45.1',
-    command: ['dex', 'serve', '/etc/dex/dex.yml'],
-};
-const BaseServiceNginx = {
-    image: 'nginx:1.30.0-alpine',
-    depends_on: ['oauth2_proxy'],
-    extra_hosts: ['host.docker.internal:host-gateway'],
-};
-const BaseOAuth2ProxyService = {
-    image: 'quay.io/oauth2-proxy/oauth2-proxy:v7.15.2',
-    command: ['--config', '/etc/oauth2-proxy/config.yml'],
-    extra_hosts: ['host.docker.internal:host-gateway'],
-};
-const BaseServices = {
-    nginx: BaseServiceNginx,
-    oauth2_proxy: BaseOAuth2ProxyService,
-};
-const BaseDexUpstream = {
-    host: 'dex',
-    scheme: 'http',
-    port: 5556,
-    locations: { '/dex/': { auth: { enabled: false } } },
-};
-const BaseOauth2ProxyUpstream = {
-    host: 'oauth2_proxy',
-    scheme: 'http',
-    port: 4180,
-    locations: {
-        '/oauth2/': {
-            auth: { enabled: false },
-            headers: {
-                Cookie: '$http_cookie', // Forward session cookie.
-                'X-Auth-Request-Redirect': '$request_uri',
-            },
-        },
-    },
-};
-const BaseViteUpstream = {
-    host: 'host.docker.internal',
-    scheme: 'http',
-    locations: {
-        '/': {
-            auth: { forward: false, redirect: true },
-            headers: {
-                Upgrade: '$http_upgrade',
-                Connection: '$connection_upgrade',
-            },
-        },
-    },
-};
-const DefaultCookiePolicy = {
-    cookie_expire: '8h',
-    cookie_refresh: '15m',
-    cookie_path: '/',
-};
-const DefaultDexUsers = [
-    {
-        email: 'user@example.com',
-        password: 'pass',
-    },
-];
-const DefaultOAuth2Client = {
-    id: 'visage',
-    secret: 'visage-secret',
-    scopes: ['openid', 'email', 'profile', 'offline_access']};
-const DefaultProxyPolicy = {
-    auth: { enabled: true, forward: true, redirect: false },
-    headers: {
-        Cookie: '""', // Don't forward session cookie.
-        Host: '$host',
-        'X-Real-IP': '$remote_addr',
-        'X-Forwarded-For': '$proxy_add_x_forwarded_for',
-        'X-Forwarded-Proto': '$scheme',
-    },
-};
-function resolveOptions(options) {
-    const { host = 'localhost', port = 9001, cookie = {}, oauth2 = {} } = options;
-    const cookieName = cookie.name ?? 'session';
-    const publicClient = oauth2.clientSecret === null;
-    const services = resolveServicesOptions(options.services);
-    const upstreams = resolveUpstreamsOptions(services, options.upstreams);
-    return {
-        host,
-        port,
-        cookie: {
-            ...DefaultCookiePolicy,
-            cookie_name: cookie.domains === undefined
-                ? cookieName.startsWith('__Host-')
-                    ? cookieName
-                    : `__Host-${cookieName}`
-                : cookieName,
-            ...(cookie.expire === undefined ? {} : { cookie_expire: cookie.expire }),
-            ...(cookie.refresh === undefined
-                ? {}
-                : { cookie_refresh: cookie.refresh }),
-            ...(cookie.domains === undefined
-                ? {}
-                : { cookie_domains: cookie.domains }),
-            ...(cookie.path === undefined ? {} : { cookie_path: cookie.path }),
-        },
-        idp: resolveIdpOption(options.idp),
-        oauth2: {
-            id: oauth2.clientId ?? DefaultOAuth2Client.id,
-            ...(publicClient
-                ? {}
-                : { secret: oauth2.clientSecret ?? DefaultOAuth2Client.secret }),
-            scopes: oauth2.scopes ?? DefaultOAuth2Client.scopes,
-            public: publicClient,
-        },
-        services,
-        upstreams,
-    };
-}
-function resolveServicesOptions(services = {}) {
+function createVisageServer(options) {
+    const cache = join(process.cwd(), '.visage');
+    const edgeKey = randomBytes(32).toString('base64url');
+    const config = resolveConfig(resolveOptions(options), cache, edgeKey);
+    let stop;
     return {
-        ...services,
-        nginx: {
-            ...BaseServiceNginx,
-            ...{
-                ...(services.nginx ?? {}),
-                extra_hosts: [
-                    ...BaseServiceNginx.extra_hosts,
-                    ...(services.nginx?.extra_hosts ?? []),
-                ],
-            },
-        },
-        oauth2_proxy: {
-            ...BaseOAuth2ProxyService,
-            ...{
-                ...(services.oauth2_proxy ?? {}),
-                extra_hosts: [
-                    ...BaseOAuth2ProxyService.extra_hosts,
-                    ...(services.oauth2_proxy?.extra_hosts ?? []),
-                ],
-            },
+        middleware: createVisageMiddleware(edgeKey),
+        upgrade: createVisageUpgradeHandler(edgeKey),
+        async listen() {
+            stop ??= await startVisageServer(config);
         },
-    };
-}
-function resolveUpstreamsOptions(services, upstreams = {}) {
-    function resolveUpstream(name, upstream) {
-        return {
-            ...upstream,
-            scheme: upstream.scheme,
-            host: upstream.host ?? name,
-            port: upstream.port ?? (upstream.scheme === 'https' ? 443 : 80),
-            locations: upstream.locations ?? { [`/${name}/`]: {} },
-        };
-    }
-    return {
-        ...Object.fromEntries(Object.entries(services)
-            .filter(([name]) => 
-        // Exclude base services handled separately.
-        name !== 'dex' && name !== 'nginx' && name !== 'oauth2_proxy')
-            .map(([name, service]) => [
-            name,
-            resolveUpstream(name, { scheme: 'http', ...service.upstream }),
-        ])),
-        ...Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => [
-            name,
-            resolveUpstream(name, {
-                scheme: services[name] === undefined ? 'https' : 'http',
-                ...upstream,
-            }),
-        ])),
-    };
-}
-function resolveIdpOption(idp) {
-    if (idp && 'issuer' in idp) {
-        return {
-            issuer: idp.issuer,
-            authorization: idp.authorization ?? '/auth',
-            token: idp.token ?? '/token',
-            jwks: idp.jwks ?? '/keys',
-        };
-    }
-    return {
-        dex: {
-            ...(idp?.expiry ? { expiry: idp.expiry } : {}),
-            users: (idp?.users ?? DefaultDexUsers).map((user) => ({
-                email: user.email,
-                password: user.password,
-                username: user.username ?? user.email.split('@', 1)[0],
-                userID: user.userID ?? user.email,
-            })),
+        close() {
+            stop?.();
+            stop = undefined;
         },
     };
 }
-function resolveIdpConfig({ host, port, idp, }) {
-    if ('dex' in idp) {
-        const issuer = `https://${host}:${port}/dex`;
-        const upstream = `http://dex:5556/dex`;
-        return {
-            upstream: 'dex',
-            issuer,
-            authorization: `${issuer}/auth`,
-            token: `${upstream}/token`,
-            jwks: `${upstream}/keys`,
-            dex: {
-                expiry: idp.dex.expiry,
-                users: (idp.dex?.users ?? DefaultDexUsers).map((user) => ({
-                    email: user.email,
-                    password: user.password,
-                    username: user.username ?? user.email.split('@', 1)[0],
-                    userID: user.userID ?? user.email,
-                })),
-            },
-        };
+async function startVisageServer(config) {
+    const logs = join(config.cache, 'logs');
+    rmSync(logs, { recursive: true, force: true });
+    mkdirSync(logs, { recursive: true, mode: 0o700 });
+    chmodSync(logs, 0o700);
+    await ensureCerts(config);
+    ensureHostEntry(config);
+    const renderConfig = ensureNginxNetwork(config);
+    writeComposeConfig(renderConfig);
+    if ('dex' in renderConfig.idp) {
+        writeDexConfig(renderConfig);
     }
-    return {
-        upstream: 'idp',
-        issuer: idp.issuer,
-        authorization: idp.issuer + (idp.authorization ?? '/auth'),
-        token: idp.issuer + (idp.token ?? '/token'),
-        jwks: idp.issuer + (idp.jwks ?? '/keys'),
-    };
-}
-function resolveExternalIdpUpstream(idp) {
-    const issuer = new URL(idp.issuer);
-    return {
-        host: issuer.hostname,
-        locations: {},
-        scheme: issuer.protocol === 'https:' ? 'https' : 'http',
-        port: Number(issuer.port) || (issuer.protocol === 'https:' ? 443 : 80),
-    };
-}
-function resolveConfig(options, config, vitePort) {
-    const idp = resolveIdpConfig(options);
-    const upstreams = {
-        oauth2_proxy: BaseOauth2ProxyUpstream,
-        vite: { ...BaseViteUpstream, port: vitePort },
-        ...(idp.dex === undefined
-            ? { idp: resolveExternalIdpUpstream(idp) }
-            : { dex: BaseDexUpstream }),
-        ...options.upstreams,
-    };
-    return {
-        host: options.host,
-        port: options.port,
-        cookie: options.cookie,
-        idp,
-        oauth2: options.oauth2,
-        cache: join(config.cacheDir, 'visage'),
-        files: { ...BaseFiles },
-        services: {
-            ...(idp.dex === undefined
-                ? BaseServices
-                : {
-                    dex: BaseDexService,
-                    nginx: {
-                        ...BaseServices.nginx,
-                        depends_on: ['dex', 'oauth2_proxy'],
-                    },
-                    oauth2_proxy: {
-                        command: BaseServices.oauth2_proxy.command,
-                        extra_hosts: BaseServices.oauth2_proxy.extra_hosts,
-                        image: BaseServices.oauth2_proxy.image,
-                        depends_on: ['dex'],
-                    },
-                }),
-            ...Object.fromEntries(Object.entries(options.services).map(([name, { upstream: _upstream, ...service }]) => [name, service])),
-        },
-        upstreams: Object.fromEntries(Object.entries(upstreams).map(([name, upstream]) => {
-            const external = options.upstreams[name] !== undefined &&
-                options.services[name] === undefined;
-            return [
-                name,
-                {
-                    ...upstream,
-                    external,
-                    locations: Object.fromEntries(Object.entries(upstream.locations ?? {}).map(([path, policy]) => [
-                        path,
-                        {
-                            auth: { ...DefaultProxyPolicy.auth, ...policy.auth },
-                            headers: {
-                                ...(external
-                                    ? { ...DefaultProxyPolicy.headers, Host: upstream.host }
-                                    : DefaultProxyPolicy.headers),
-                                ...policy.headers,
-                            },
-                        },
-                    ])),
-                },
-            ];
-        })),
-    };
+    writeNginxConfig(renderConfig);
+    writeOauth2ProxyConfig(renderConfig);
+    return startCompose(renderConfig);
 }
 
-function formatUrl(host, port) {
-    const AnsiGreen = '\x1b[32m';
-    const AnsiCyan = '\x1b[36m';
-    const AnsiBold = '\x1b[1m';
-    const AnsiReset = '\x1b[0m';
-    return `  ${AnsiGreen}➜${AnsiReset}  ${AnsiBold}Visage${AnsiReset}:  ${AnsiCyan}https://${host}:${AnsiBold}${port}${AnsiReset}${AnsiCyan}/${AnsiReset}`;
-}
 function visage(options = {}) {
     const resolvedOptions = resolveOptions(options);
     let stop;
@@ -687,55 +1049,80 @@ function visage(options = {}) {
         stop?.();
         stop = undefined;
     };
+    const edgeKey = randomBytes(32).toString('base64url');
     return {
         name: 'visage',
         apply: 'serve',
         config() {
             return {
                 server: {
+                    // Configure Vite to only allow traffic from the intended host.
+                    allowedHosts: [resolvedOptions.host],
                     hmr: {
                         protocol: 'wss',
                         host: resolvedOptions.host,
                         clientPort: resolvedOptions.port,
                     },
-                    host: '0.0.0.0',
+                    // Configure Vite to listen on the minimal host address to allow
+                    // Docker containers to reach it. Visage (internally managed NGINX)
+                    // exposes the browser-facing host/port. On non-Linux systems, this is
+                    // localhost. On Linux, it's the host's bridge gateway (e.g.,
+                    // 172.17.0.1).
+                    host: process.platform !== 'linux'
+                        ? '127.0.0.1'
+                        : (spawnSync('docker', [
+                            'network',
+                            'inspect',
+                            'bridge',
+                            '--format',
+                            '{{range .IPAM.Config}}{{println .Gateway}}{{end}}',
+                        ], { encoding: 'utf8' })
+                            .stdout?.split(/\r?\n/)
+                            .map((line) => line.trim())
+                            .find((line) => isIP(line)) ?? '0.0.0.0'),
                 },
             };
         },
-        configureServer(server) {
-            let url;
-            const printUrls = server.printUrls.bind(server);
-            server.printUrls = () => {
-                printUrls();
-                if (url)
-                    server.config.logger.info(formatUrl(url.host, url.port));
+        configureServer(vite) {
+            vite.middlewares.use(createVisageMiddleware(edgeKey));
+            vite.httpServer?.prependListener('upgrade', createVisageUpgradeHandler(edgeKey));
+            // Hide Vite's direct URL(s) because browser traffic must flow through the
+            // browser-facing NGINX managed by Visage.
+            let visageUrl;
+            vite.printUrls = () => {
+                vite.config.logger.info(visageUrl ?? 'Visage failed to start');
             };
-            async function startVisage(port) {
-                const config = resolveConfig(resolvedOptions, server.config, port);
-                url = { host: config.host, port: config.port };
-                rmSync(join(config.cache, 'logs'), { recursive: true, force: true });
-                await ensureCerts({
-                    certs: join(config.cache, config.files.certs[0]),
-                    hostname: config.host,
-                });
-                ensureHostEntry(config.host);
-                render(config);
-                return startCompose(join(config.cache, config.files.compose));
-            }
-            const listen = server.listen.bind(server);
-            server.listen = async (port, isRestart) => {
+            // Monkey patch Vite's listen to get the server's auto-resolved port.
+            const listen = vite.listen.bind(vite);
+            vite.listen = async (port, isRestart) => {
                 const result = await listen(port, isRestart);
-                const address = server.httpServer?.address();
+                const address = vite.httpServer?.address();
                 if (!address || typeof address === 'string') {
                     throw new Error('Failed to resolve port for Visage');
                 }
-                stop = await startVisage(address.port);
-                server.httpServer?.once('close', closeBundle);
+                const cache = join(vite.config.cacheDir, 'visage');
+                const config = resolveConfig(resolveOptions({
+                    ...options,
+                    upstreams: {
+                        ...options.upstreams,
+                        vite: { port: address.port, ...options.upstreams?.vite },
+                    },
+                }), cache, edgeKey);
+                visageUrl = formatVisageUrlLog(config.host, config.port);
+                stop = await startVisageServer(config);
+                vite.httpServer?.once('close', closeBundle);
                 return result;
             };
         },
         closeBundle,
     };
 }
+function formatVisageUrlLog(host, port) {
+    const AnsiGreen = '\x1b[32m';
+    const AnsiCyan = '\x1b[36m';
+    const AnsiBold = '\x1b[1m';
+    const AnsiReset = '\x1b[0m';
+    return `  ${AnsiGreen}➜${AnsiReset}  ${AnsiBold}Visage${AnsiReset}:  ${AnsiCyan}https://${host}:${AnsiBold}${port}${AnsiReset}${AnsiCyan}/${AnsiReset}`;
+}
 
-export { visage as default, visage };
+export { createVisageServer, visage as default, visage };