default.conf

error_log stderr;
access_log /dev/stdout;

lua_package_path '/etc/nginx/lua/?.lua;';

server {
  listen 80;

  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;

  resolver 8.8.8.8 ipv6=off;

  lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
  lua_ssl_verify_depth        5;

  ssl_certificate /etc/nginx/certs/tls.crt;
  ssl_certificate_key /etc/nginx/certs/tls.key;

  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers         HIGH:!aNULL:!MD5;

  set_by_lua $ngo_callback_host '
    if os.getenv("NGO_CALLBACK_HOST") then
      return os.getenv("NGO_CALLBACK_HOST")
    else
      return ngx.var.host
    end
  ';

  set_by_lua $ngo_callback_scheme 'return os.getenv("NGO_CALLBACK_SCHEME")';
  set_by_lua $ngo_callback_uri    'return os.getenv("NGO_CALLBACK_URI")';
  set_by_lua $ngo_signout_uri     'return os.getenv("NGO_SIGNOUT_URI")';
  set_by_lua $ngo_client_id       'return os.getenv("NGO_CLIENT_ID")';
  set_by_lua $ngo_client_secret   'return os.getenv("NGO_CLIENT_SECRET")';
  set_by_lua $ngo_token_secret    'return os.getenv("NGO_TOKEN_SECRET")';
  set_by_lua $ngo_secure_cookies  'return os.getenv("NGO_SECURE_COOKIES")';
  set_by_lua $ngo_extra_validity  'return os.getenv("NGO_EXTRA_VALIDITY")';
  set_by_lua $ngo_domain          'return os.getenv("NGO_DOMAIN")';
  set_by_lua $ngo_whitelist       'return os.getenv("NGO_WHITELIST")';
  set_by_lua $ngo_blacklist       'return os.getenv("NGO_BLACKLIST")';
  set_by_lua $ngo_user            'return os.getenv("NGO_USER")';
  set_by_lua $ngo_email_as_user   'return os.getenv("NGO_EMAIL_AS_USER")';

  access_by_lua_file "/etc/nginx/lua/nginx-google-oauth/access.lua";

  expires 0;

  location / {
    set_by_lua $nginx_proxy_pass 'return os.getenv("NGINX_PROXY_PASS")';
    proxy_pass $nginx_proxy_pass;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Google-User $ngo_user;
      
    # lua script that rewrites response cookies by 
    # appending a SameSite attribute to a cookie path
    header_filter_by_lua '
      local cookies = ngx.header.set_cookie
      if not cookies then return end
      if type(cookies) ~= "table" then cookies = {cookies} end
      local newcookies = {}
      for i, val in ipairs(cookies) do
        local newval = val .. "; SameSite=None"
        table.insert(newcookies, newval)
      end
      ngx.header.set_cookie = newcookies
    ';
  }
}