mirror of
https://github.com/Zproger/Aurum.git
synced 2026-10-13 02:56:39 +07:00
1de9ac272e
The browser's native Basic Auth prompt can't be restyled — it's chrome UI, not part of the page. Replace it with Aurum's own login screen: nginx keeps auth_basic on /api/* (the actual protection, unchanged), but drops it from the SPA shell (just HTML/JS/CSS, no data) so the app can render its own branded form instead. On submit the app validates the credentials against a real protected endpoint, then attaches the resulting Authorization header to every request itself — sessionStorage-backed, so closing the tab signs out. Instances with Basic Auth left off (the default) never see this screen. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01855PiW5Wd8n4aRW4n9kByY
42 lines
1.7 KiB
Nginx Configuration File
42 lines
1.7 KiB
Nginx Configuration File
server {
|
|
listen 80;
|
|
server_name _;
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Always open, no auth — this is what Docker's own HEALTHCHECK and any
|
|
# external uptime monitor hit, and it returns nothing but {"status":"ok"}.
|
|
# docker-entrypoint.d/20-basic-auth.sh writes basic-auth.conf; without an
|
|
# explicit "auth_basic off" here this location would inherit whatever it
|
|
# sets below and healthchecks would start failing with 401.
|
|
location = /api/health {
|
|
auth_basic off;
|
|
proxy_pass http://backend:8000/api/health;
|
|
proxy_set_header Host $host;
|
|
}
|
|
|
|
# Reverse proxy to the FastAPI backend container. basic-auth.conf is
|
|
# generated at container start (empty if AURUM_BASIC_AUTH_USER/PASSWORD
|
|
# aren't set, so this is a no-op by default) — see docker-entrypoint.d/.
|
|
location /api/ {
|
|
include /etc/nginx/basic-auth.conf;
|
|
proxy_pass http://backend:8000/api/;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
}
|
|
|
|
# SPA fallback — client-side routing handles the rest. Deliberately NOT
|
|
# behind auth_basic: this is just the built HTML/JS/CSS shell, no
|
|
# financial data lives in it. The app's own branded login screen
|
|
# (frontend/src/components/auth/LoginGate.tsx) is what actually gates
|
|
# entry, by requiring a valid Authorization header on every /api/ call
|
|
# above — the real protection stays exactly where it was.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
|
|
gzip on;
|
|
gzip_types text/css application/javascript application/json image/svg+xml;
|
|
}
|