feat(ap4): integrate nginx auth_request

docker-compose.yml

@@ -98,11 +98,13 @@ services:
       - --oidc-jwks-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/certs
       - --profile-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
       - --validate-url=http://keycloak:8080/realms/keycloak-patterns/protocol/openid-connect/userinfo
-      - --redirect-url=http://localhost:4180/oauth2/callback
+      - --redirect-url=http://localhost:8088/oauth2/callback
       - --upstream=http://app:8081
       - --email-domain=*
       - --scope=openid profile email
       - --code-challenge-method=S256
+      - --reverse-proxy=true
+      - --trusted-proxy-ip=172.30.40.10/32
       - --cookie-name=AP4_SESSION
       - --cookie-secure=false
       - --cookie-samesite=lax
@@ -110,14 +112,14 @@ services:
       - --skip-provider-button=true
       - --set-xauthrequest=true
       - --pass-user-headers=true
-      - --whitelist-domain=localhost:4180
+      - --whitelist-domain=localhost:8088
       - --whitelist-domain=localhost:8080
     environment:
       OAUTH2_PROXY_CLIENT_ID: edge-proxy
       OAUTH2_PROXY_CLIENT_SECRET: ${EDGE_PROXY_CLIENT_SECRET:?set EDGE_PROXY_CLIENT_SECRET in .env}
       OAUTH2_PROXY_COOKIE_SECRET: ${OAUTH2_PROXY_COOKIE_SECRET:?set OAUTH2_PROXY_COOKIE_SECRET in .env}
-    ports:
-      - "127.0.0.1:4180:4180"
+    expose:
+      - "4180"
     depends_on:
       keycloak:
         condition: service_healthy
@@ -142,7 +144,7 @@ services:
     ports:
       - "127.0.0.1:${NGINX_PORT:-8088}:80"
     depends_on:
-      app:
+      oauth2-proxy:
         condition: service_healthy
     healthcheck:
       test:
@@ -152,7 +154,8 @@ services:
       timeout: 5s
       retries: 12
     networks:
-      - keycloak-net
+      keycloak-net:
+        ipv4_address: 172.30.40.10
     restart: unless-stopped
 
 volumes:
@@ -162,3 +165,6 @@ volumes:
 networks:
   keycloak-net:
     driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.40.0/24