@lamalibre/create-portlama 1.0.13 → 1.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lamalibre/create-portlama",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "One-command setup for secure reverse tunnels with a management dashboard",
   "type": "module",
   "license": "MIT",

package/vendor/panel-server/src/lib/nginx.js

@@ -187,26 +187,31 @@ export async function writeAppVhost(subdomain, domain, port, certPath) {
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
 
-    # Authelia forward authentication
-    location /authelia {
+    # Authelia forward authentication (AuthRequest implementation for nginx)
+    location /internal/authelia/authz {
         internal;
-        proxy_pass http://127.0.0.1:9091/api/authz/forward-auth;
+
+        proxy_pass http://127.0.0.1:9091/api/authz/auth-request;
         proxy_pass_request_body off;
+
         proxy_set_header Content-Length "";
+        proxy_set_header Connection "";
+        proxy_set_header X-Original-Method $request_method;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-Method $request_method;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $http_host;
-        proxy_set_header X-Forwarded-Uri $request_uri;
         proxy_set_header X-Forwarded-For $remote_addr;
+
+        proxy_http_version 1.1;
+        proxy_buffers 4 32k;
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
     }
 
     location / {
-        auth_request /authelia;
+        auth_request /internal/authelia/authz;
         auth_request_set $user $upstream_http_remote_user;
         auth_request_set $groups $upstream_http_remote_groups;
         auth_request_set $name $upstream_http_remote_name;
         auth_request_set $email $upstream_http_remote_email;
+        auth_request_set $redirection_url $upstream_http_location;
 
         proxy_set_header Remote-User $user;
         proxy_set_header Remote-Groups $groups;
@@ -224,8 +229,8 @@ export async function writeAppVhost(subdomain, domain, port, certPath) {
         proxy_send_timeout 86400s;
     }
 
-    # Error page for unauthenticated requests — redirect to Authelia
-    error_page 401 =302 https://auth.${domain}/?rd=$scheme://$http_host$request_uri;
+    # Redirect unauthenticated requests to Authelia login portal
+    error_page 401 =302 $redirection_url;
 }
 `;
 
@@ -315,24 +320,29 @@ export async function writeStaticSiteVhost(site, certDir, domain) {
 
   if (site.autheliaProtected && domain) {
     autheliaBlock = `
-    # Authelia forward authentication
-    location /authelia {
+    # Authelia forward authentication (AuthRequest implementation for nginx)
+    location /internal/authelia/authz {
         internal;
-        proxy_pass http://127.0.0.1:9091/api/authz/forward-auth;
+
+        proxy_pass http://127.0.0.1:9091/api/authz/auth-request;
         proxy_pass_request_body off;
+
         proxy_set_header Content-Length "";
+        proxy_set_header Connection "";
+        proxy_set_header X-Original-Method $request_method;
         proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
-        proxy_set_header X-Forwarded-Method $request_method;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $http_host;
-        proxy_set_header X-Forwarded-Uri $request_uri;
         proxy_set_header X-Forwarded-For $remote_addr;
+
+        proxy_http_version 1.1;
+        proxy_buffers 4 32k;
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
     }
 `;
     locationAuthDirectives = `
-        auth_request /authelia;
+        auth_request /internal/authelia/authz;
         auth_request_set $user $upstream_http_remote_user;
-        auth_request_set $groups $upstream_http_remote_groups;`;
+        auth_request_set $groups $upstream_http_remote_groups;
+        auth_request_set $redirection_url $upstream_http_location;`;
   }
 
   const config = `server {
@@ -357,8 +367,8 @@ ${autheliaBlock}
         ${tryFiles};
     }
 ${site.autheliaProtected && domain ? `
-    # Error page for unauthenticated requests — redirect to Authelia
-    error_page 401 =302 https://auth.${domain}/?rd=$scheme://$http_host$request_uri;
+    # Redirect unauthenticated requests to Authelia login portal
+    error_page 401 =302 $redirection_url;
 ` : ''}
 }
 `;