ThatGuyJack/nginx-proxy-manager
1
0
Fork 0
mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2025-08-04 16:33:32 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Add template support for all host types to do client CA authorization

Browse Source 
When an access list contains client CAs, the combined CA auth file is
added to all location blocks via an `if` statement. This allows
LetsEncrypt and other support paths to work, while correctly denying
access to the protected resources.
This commit is contained in:
Will Rouesnel
2023-05-29 02:29:42 +10:00
parent fb766d14e9
commit 366efc8ac2
4 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/templates/_access.conf
View File

@@ -1,4 +1,10 @@
{% if access_list_id > 0 %}
{% if access_list.clientcas.size > 0 %}
# TLS Client Certificate Authorization
if ($ssl_client_verify != "SUCCESS") {
return 403;
}
{% endif %}
{% if access_list.items.length > 0 %}
# Authorization
auth_basic "Authorization required";

8
backend/templates/_certificates.conf
View File

@@ -11,4 +11,10 @@
ssl_certificate_key /data/custom_ssl/npm-{{ certificate_id }}/privkey.pem;
{% endif %}
{% endif %}
{% if access_list_id > 0 -%}
{% if access_list.clientcas.size > 0 %}
# Client Certificate Authorization ({{access_list.clientcas.size}} CAs)
ssl_client_certificate /data/clientca/{{ access_list_id }};
ssl_verify_client optional;
{% endif %}
{% endif %}