# Nginx-based authentication proxy

The idea of this app is to add an authentication layer to web-based applications, that do not support auth natively.

To do that, we use Nginx as a reverse proxy and a Golang app, which syncs the content of a secret in AWS Secrets Manager with an Nginx htpasswd file in the background.

## Configuration

The application uses environment variables to pass configuration parameters. Most of the configuration has reasonable defaults, therefore change them only if you're confident.

Nginx settings can be changed using the following environment variables:

| Environment variable | Nginx directive | Default value |
|---|---|---|
| NGINX_PROXY_HTTP_VERSION | [proxy_http_version](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version) | 1.1 |
| NGINX_PROXY_CONNECT_TIMEOUT | [proxy_connect_timeout](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout) | 60s |
| NGINX_PROXY_SEND_TIMEOUT | [proxy_send_timeout](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout) | 5m |
| NGINX_PROXY_READ_TIMEOUT | [proxy_read_timeout](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout)  | 5m |

AWS Secrets Manager sync settings can be changed using the following environment variables:

| Environment variable | Default value | Description |
|---|---|---|
| SYNC_DELAY | 60s | The delay between sync attempts. Be aware that AWS charges $0.05 per 10,000 API calls. |
| AWS_DEFAULT_REGION | us-east-1 | AWS region. |
| AWS_ACCESS_KEY_ID |  | AWS IAM key id to access Secrets Manager. Application supports IAM roles, so this env is optional. |
| AWS_SECRET_ACCESS_KEY |  |  AWS IAM key secret. Same as above. |

The most important part is the protected service configuration. It has to be configured with the following environment variables (based on schema-registry's example):

| Environment variable | Example value | Description |
|---|---|---|
| PROTECTED_SERVICE_NAME | schema-registry | Service name |
| PROTECTED_SERVICE_PORT | 8080 | Exposed port on Nginx |
| PROTECTED_SERVICE_ENDPOINT | localhost:8081 | Target for Nginx reverse-proxy |
| PROTECTED_SERVICE_HEALTHCHECK | /schemas/types | Health check URL, that should not be password protected |
| PROTECTED_SERVICE_SECRET_NAME | dev/schema-registry/users | AWS Secrets Manager secret id |

## Local testing

To test the app on your local machine you have to perform several steps:

1. Install the `htpasswd` tool:
    - `apt-get install -y apache2-utils` for Ubuntu
    - `yum install -y httpd-tools` for CentOS

2. Generate an `htpasswd` hash using the `bcrypt` algorithm:
    - `htpasswd -nB <username>`

3. Create a secret in AWS Secrets Manager using key-value format, where the key is the `<username>` and value is the `<hash>` that was generated at the previous step.

4. Fill in the `PROTECTED_SERVICE_SECRET_NAME` environment variable in `docker-compose.yaml` with the AWS Secrets Manager Secret's ID that you just created.

5. Fill in the `.env` file with your IAM STS credentials. Part of the workflow can be found [here](https://github.com/theorchard/collab/tree/master/jcarrion/aws-creds-generator).

6. Update the `docker-compose.yaml` using your protected service configuration.

7. Start the local environment using `docker-compose`:
    - `docker-compose up --build`

8. Try accessing the service using the credentials you have created.

## Notes

Basic authentication can be cached by the browser and it may require a browser restart to log out. To avoid this case there is a `/logout` URL embedded, which will reset the cached authentication for the user's browser.