oauth2-proxy https://raw.githubusercontent.com/Nebur692/unraid-community-apps/main/templates/oauth2-proxy.xml quay.io/oauth2-proxy/oauth2-proxy:latest https://quay.io/repository/oauth2-proxy/oauth2-proxy https://github.com/oauth2-proxy/oauth2-proxy https://oauth2-proxy.github.io/oauth2-proxy/ https://forums.unraid.net/topic/200036-unraid-templates-nebur692/ bridge sh false Network:Other Tools:Utilities https://raw.githubusercontent.com/oauth2-proxy/oauth2-proxy/master/docs/static/img/logos/OAuth2_Proxy_icon.png --restart unless-stopped Puts a login in front of web apps that have none of their own. Your reverse proxy asks this container, on every request, whether the visitor is signed in; if not, the visitor is sent to your identity provider (ZITADEL, Keycloak, Authentik, Authelia, Google, GitHub...) and only comes back once authenticated. Typical use: an Nginx Proxy Manager host with an "auth_request" block in its Advanced tab pointing here, so the app itself is never reachable without a login. One container can protect any number of sites: leave the redirect URL as a path only and it derives the right absolute URL from each request, and a shared cookie domain means one login covers all of them. Every setting below maps to an oauth2-proxy option of the same name. The four you must fill in are the issuer URL, the client ID and secret from your provider, and the cookie secret. The ready-to-paste reverse proxy snippet and a step-by-step walkthrough are in the repository README. IMPORTANT: this container is a gate, not a proxy. It is meant to be used with "Upstreams = static://202", letting your reverse proxy do the actual proxying. Anyone whose e-mail is in the allow-list file gets into everything behind the same instance, so use a separate instance for a different audience. 4180 /mnt/user/appdata/oauth2-proxy 0.0.0.0:4180 oidc /oauth2/callback true 8h * /data/authenticated-emails.txt static://202 true true openid email profile S256 true X-Real-IP Europe/Madrid