FRP 面板(Basic Auth)接入 Authentik 单点登录指南

1
echo -n "你的账户:你的密码" | base64

1
map $http_upgrade $connection_upgrade_keepalive {
2
    default upgrade;
3
    ''      '';
4
}
5

6
server {
7
    listen 443 ssl http2;
8
    server_name frp.example.com; # 配置域名
9

10
    # 配置证书
11
    ssl_certificate     /root/.acme.sh/xxx;
12
    ssl_certificate_key /root/.acme.sh/xxx;
13

14
    proxy_buffer_size          128k;
15
    proxy_buffers              4 256k;
16
    proxy_busy_buffers_size    256k;
17

18
    location / {
19
        auth_request /authentik-verify;
20
        error_page 401 = @goauthentik_proxy_signin;
21

22
        # 配置刚刚生成的 base64 密钥
23
        set $fixed_auth "Basic 5L2g6Kej5a+G5LqG5oOz5bmy5ZibT3ZP";
24
        proxy_set_header Authorization $fixed_auth;
25

26
        auth_request_set $auth_cookie $upstream_http_set_cookie;
27
        add_header Set-Cookie $auth_cookie;
28

29
        # 这是 FRP Dash 的端口，默认 7500
30
        proxy_pass http://127.0.0.1:7500;
31
        proxy_set_header Host 127.0.0.1;
32

33
        proxy_set_header X-Real-IP $remote_addr;
34
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
35
        proxy_set_header X-Forwarded-Proto $scheme;
36
    }
37

38
    location = /authentik-verify {
39
        internal;
40
        # 替换你的 Authentik 域名
41
        proxy_pass              https://sso.example.com/outpost.goauthentik.io/auth/nginx;
42

43
        # 替换你的 Authentik 域名
44
        proxy_set_header        Host sso.example.com;
45
        proxy_set_header        X-Forwarded-Host $http_host;
46
        proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
47

48
        proxy_pass_request_body off;
49
        proxy_set_header        Content-Length "";
50
    }
51

52
    location /outpost.goauthentik.io {
53
        # 替换你的 Authentik 域名
54
        proxy_pass              https://sso.example.com/outpost.goauthentik.io;
55

56
        # 替换你的 Authentik 域名
57
        proxy_set_header        Host sso.example.com;
58
        proxy_set_header        X-Forwarded-Host $http_host;
59
        proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
60

61
        add_header              Set-Cookie $auth_cookie;
62
        auth_request_set        $auth_cookie $upstream_http_set_cookie;
63
        proxy_pass_request_body off;
64
        proxy_set_header        Content-Length "";
65
    }
66

67
    location @goauthentik_proxy_signin {
68
        internal;
69
        add_header Set-Cookie $auth_cookie;
70
        return 302 /outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
71
    }
72
}