From 05da050b5f9aec6d8e2f4fb146090dbe92713285 Mon Sep 17 00:00:00 2001 From: Stavros Date: Sun, 19 Jul 2026 00:48:02 +0300 Subject: [PATCH 1/7] refactor: use x-tinyauth-location header in tinyauth auth request --- README.md | 1 + .../nginx/tinyauth-location.conf.sample | 8 +++++--- .../nginx/tinyauth-server.conf.sample | 20 +------------------ 3 files changed, 7 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index d039eb69..8d282aad 100644 --- a/README.md +++ b/README.md @@ -436,6 +436,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **19.07.26:** - Use new X-Tinyauth-Location header in Tinyauth locations. * **10.07.26:** - Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay. * **19.06.26:** - Add support for mijn.host dns validation. * **01.06.26:** - Remove obsolete old cert check logic. diff --git a/root/defaults/nginx/tinyauth-location.conf.sample b/root/defaults/nginx/tinyauth-location.conf.sample index f829c6d0..0bf7e99a 100644 --- a/root/defaults/nginx/tinyauth-location.conf.sample +++ b/root/defaults/nginx/tinyauth-location.conf.sample @@ -1,11 +1,13 @@ -## Version 2025/12/17 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample +## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf ## Send a subrequest to tinyauth to verify if the user is authenticated and has permission to access the resource auth_request /tinyauth; - -## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal +auth_request_set $redirection_url $upstream_http_x_tinyauth_location; +error_page 401 403 =302 $redirection_url; + +## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the URL tinyauth returns in the X-Tinyauth-Location header error_page 401 = @tinyauth_login; ## Translate the user information response headers from the auth subrequest into variables diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index a4256c82..fc1a746b 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -1,4 +1,4 @@ -## Version 2025/06/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample +## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf @@ -15,21 +15,3 @@ location /tinyauth { proxy_set_header x-forwarded-host $http_host; proxy_set_header x-forwarded-uri $request_uri; } - -# virtual location for tinyauth 401 redirects -location @tinyauth_login { - internal; - - ## Set the $target_url variable based on the original request - set_escape_uri $target_url $scheme://$http_host$request_uri; - - ## Set the $signin_url variable - set $domain $host; - if ($host ~* "^[^.]+\.([^.]+\..+)$") { - set $domain $1; - } - set $signin_url https://tinyauth.$domain/login?redirect_uri=$target_url; - - ## Redirect to login - return 302 $signin_url; -} From 84915dcfcf6e80414bf7fb33cb3dc2fd124ff40a Mon Sep 17 00:00:00 2001 From: Stavros Date: Sun, 19 Jul 2026 00:50:45 +0300 Subject: [PATCH 2/7] fix: update readme vars instead of main readme --- README.md | 1 - readme-vars.yml | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8d282aad..d039eb69 100644 --- a/README.md +++ b/README.md @@ -436,7 +436,6 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions -* **19.07.26:** - Use new X-Tinyauth-Location header in Tinyauth locations. * **10.07.26:** - Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay. * **19.06.26:** - Add support for mijn.host dns validation. * **01.06.26:** - Remove obsolete old cert check logic. diff --git a/readme-vars.yml b/readme-vars.yml index 5c3a9635..c7379b91 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -220,6 +220,7 @@ init_diagram: | "swag:latest" <- Base Images # changelog changelogs: + - {date: "19.07.26:", desc: "Use new X-Tinyauth-Location header in Tinyauth locations."} - {date: "10.07.26:", desc: "Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay."} - {date: "19.06.26:", desc: "Add support for mijn.host dns validation."} - {date: "01.06.26:", desc: "Remove obsolete old cert check logic."} From be4fdf0d4d3f57bcdd827dd802a5872d629226a5 Mon Sep 17 00:00:00 2001 From: Stavros Date: Mon, 7 Sep 2026 23:59:53 +0300 Subject: [PATCH 3/7] fix: remove duplicate auth module headers --- .../defaults/nginx/tinyauth-proxy.conf.sample | 39 +++++++++++++++++++ .../nginx/tinyauth-server.conf.sample | 6 +-- 2 files changed, 40 insertions(+), 5 deletions(-) create mode 100644 root/defaults/nginx/tinyauth-proxy.conf.sample diff --git a/root/defaults/nginx/tinyauth-proxy.conf.sample b/root/defaults/nginx/tinyauth-proxy.conf.sample new file mode 100644 index 00000000..c68a6c7f --- /dev/null +++ b/root/defaults/nginx/tinyauth-proxy.conf.sample @@ -0,0 +1,39 @@ +## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample + +# Timeout if the real server is dead +proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; + +# Proxy Connection Settings +proxy_buffers 32 4k; +proxy_connect_timeout 240; +proxy_headers_hash_bucket_size 128; +proxy_headers_hash_max_size 1024; +proxy_http_version 1.1; +proxy_read_timeout 240; +proxy_redirect http:// $scheme://; +proxy_send_timeout 240; + +# Proxy Cache and Cookie Settings +proxy_cache_bypass $cookie_session; +#proxy_cookie_path / "/; Secure"; # enable at your own risk, may break certain apps +proxy_no_cache $cookie_session; + +# Proxy Header Settings +proxy_set_header Connection $connection_upgrade; +proxy_set_header Early-Data $ssl_early_data; +proxy_set_header Host $host; +proxy_set_header Proxy ""; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +# Tinyauth doesn't want both the x-forwarded-host/x-forwarded-uri headers and the x-original-url header, +# so we clear them out here +proxy_set_header X-Forwarded-Host ""; +proxy_set_header X-Forwarded-Uri ""; +proxy_set_header X-Forwarded-Method $request_method; +proxy_set_header X-Forwarded-Port $server_port; +proxy_set_header X-Forwarded-Proto $scheme; +proxy_set_header X-Forwarded-Server $host; +proxy_set_header X-Forwarded-Ssl on; +proxy_set_header X-Original-Method $request_method; +proxy_set_header X-Original-URL $scheme://$http_host$request_uri; +proxy_set_header X-Real-IP $remote_addr; diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index fc1a746b..a695d1c9 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -6,12 +6,8 @@ location /tinyauth { internal; - include /config/nginx/proxy.conf; + include /config/nginx/tinyauth-proxy.conf; include /config/nginx/resolver.conf; set $upstream_tinyauth tinyauth; proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx; - - proxy_set_header x-forwarded-proto $scheme; - proxy_set_header x-forwarded-host $http_host; - proxy_set_header x-forwarded-uri $request_uri; } From ad8764c2f83d07a0e2a26f127caffe48c19a3dbb Mon Sep 17 00:00:00 2001 From: Stavros Date: Tue, 8 Sep 2026 01:03:32 +0300 Subject: [PATCH 4/7] fix: do not forward request body to auth server --- root/defaults/nginx/tinyauth-server.conf.sample | 2 ++ 1 file changed, 2 insertions(+) diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index a695d1c9..03bdeb57 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -10,4 +10,6 @@ location /tinyauth { include /config/nginx/resolver.conf; set $upstream_tinyauth tinyauth; proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx; + proxy_pass_request_body off; + proxy_set_header Content-Length ""; } From 9e54158d381dae87cb70f023cecbc026d8359822 Mon Sep 17 00:00:00 2001 From: Stavros Date: Tue, 8 Sep 2026 20:30:46 +0300 Subject: [PATCH 5/7] refacotr: no need to copy all proxy headers to tinyauth --- .../defaults/nginx/tinyauth-proxy.conf.sample | 39 ------------------- .../nginx/tinyauth-server.conf.sample | 13 ++++++- 2 files changed, 11 insertions(+), 41 deletions(-) delete mode 100644 root/defaults/nginx/tinyauth-proxy.conf.sample diff --git a/root/defaults/nginx/tinyauth-proxy.conf.sample b/root/defaults/nginx/tinyauth-proxy.conf.sample deleted file mode 100644 index c68a6c7f..00000000 --- a/root/defaults/nginx/tinyauth-proxy.conf.sample +++ /dev/null @@ -1,39 +0,0 @@ -## Version 2023/02/09 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/proxy.conf.sample - -# Timeout if the real server is dead -proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; - -# Proxy Connection Settings -proxy_buffers 32 4k; -proxy_connect_timeout 240; -proxy_headers_hash_bucket_size 128; -proxy_headers_hash_max_size 1024; -proxy_http_version 1.1; -proxy_read_timeout 240; -proxy_redirect http:// $scheme://; -proxy_send_timeout 240; - -# Proxy Cache and Cookie Settings -proxy_cache_bypass $cookie_session; -#proxy_cookie_path / "/; Secure"; # enable at your own risk, may break certain apps -proxy_no_cache $cookie_session; - -# Proxy Header Settings -proxy_set_header Connection $connection_upgrade; -proxy_set_header Early-Data $ssl_early_data; -proxy_set_header Host $host; -proxy_set_header Proxy ""; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -# Tinyauth doesn't want both the x-forwarded-host/x-forwarded-uri headers and the x-original-url header, -# so we clear them out here -proxy_set_header X-Forwarded-Host ""; -proxy_set_header X-Forwarded-Uri ""; -proxy_set_header X-Forwarded-Method $request_method; -proxy_set_header X-Forwarded-Port $server_port; -proxy_set_header X-Forwarded-Proto $scheme; -proxy_set_header X-Forwarded-Server $host; -proxy_set_header X-Forwarded-Ssl on; -proxy_set_header X-Original-Method $request_method; -proxy_set_header X-Original-URL $scheme://$http_host$request_uri; -proxy_set_header X-Real-IP $remote_addr; diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index 03bdeb57..a8118ce6 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -1,4 +1,4 @@ -## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample +## Version 2026/09/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf @@ -6,10 +6,19 @@ location /tinyauth { internal; - include /config/nginx/tinyauth-proxy.conf; include /config/nginx/resolver.conf; set $upstream_tinyauth tinyauth; proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx; + + # Don't send the body to the auth server proxy_pass_request_body off; proxy_set_header Content-Length ""; + + # Headers needed for authentication + proxy_set_header X-Original-URL $scheme://$http_host$request_uri; + proxy_set_header X-Real-IP $remote_addr; + + # Not needed by Tinyauth right now but may be needed in the future + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Original-Method $request_method; } From 7820a40f011d07f79c919c45d29ef462cfd4314e Mon Sep 17 00:00:00 2001 From: Stavros Date: Wed, 9 Sep 2026 19:02:53 +0300 Subject: [PATCH 6/7] fix: remove duplicate error page --- root/defaults/nginx/tinyauth-location.conf.sample | 3 --- root/defaults/nginx/tinyauth-server.conf.sample | 5 +---- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/root/defaults/nginx/tinyauth-location.conf.sample b/root/defaults/nginx/tinyauth-location.conf.sample index 0bf7e99a..e7196b8b 100644 --- a/root/defaults/nginx/tinyauth-location.conf.sample +++ b/root/defaults/nginx/tinyauth-location.conf.sample @@ -6,9 +6,6 @@ auth_request /tinyauth; auth_request_set $redirection_url $upstream_http_x_tinyauth_location; error_page 401 403 =302 $redirection_url; - -## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the URL tinyauth returns in the X-Tinyauth-Location header -error_page 401 = @tinyauth_login; ## Translate the user information response headers from the auth subrequest into variables auth_request_set $email $upstream_http_remote_email; diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index a8118ce6..62f1f503 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -16,9 +16,6 @@ location /tinyauth { # Headers needed for authentication proxy_set_header X-Original-URL $scheme://$http_host$request_uri; - proxy_set_header X-Real-IP $remote_addr; - - # Not needed by Tinyauth right now but may be needed in the future - proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Original-Method $request_method; + proxy_set_header X-Real-IP $remote_addr; } From 1898dc3ede08cae18d209d63d0bdf2b20936c935 Mon Sep 17 00:00:00 2001 From: Stavros Date: Wed, 9 Sep 2026 19:06:58 +0300 Subject: [PATCH 7/7] fix: include the x forwarded for header --- root/defaults/nginx/tinyauth-server.conf.sample | 1 + 1 file changed, 1 insertion(+) diff --git a/root/defaults/nginx/tinyauth-server.conf.sample b/root/defaults/nginx/tinyauth-server.conf.sample index 62f1f503..39e8e4ae 100644 --- a/root/defaults/nginx/tinyauth-server.conf.sample +++ b/root/defaults/nginx/tinyauth-server.conf.sample @@ -17,5 +17,6 @@ location /tinyauth { # Headers needed for authentication proxy_set_header X-Original-URL $scheme://$http_host$request_uri; proxy_set_header X-Original-Method $request_method; + proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; }