SWAG

SWAG is an Nginx-based reverse proxy maintained by LinuxServer.io. Its proxy configuration samples include support for Tinyauth.

Prerequisites

• Tinyauth v5.2.0 or newer.
• A working SWAG installation.
• SWAG and Tinyauth attached to the same user-defined Docker network.
• A proxy configuration for Tinyauth enabled by renaming /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf.

Tinyauth SWAG Configuration

Server Configuration

Ensure your /config/nginx/tinyauth-server.conf file looks like this:

/config/nginx/tinyauth-server.conf

location /tinyauth {
    internal;

    include /config/nginx/resolver.conf;
    # Replace this if your Tinyauth container has a different name
    set $upstream_tinyauth tinyauth;
    proxy_pass http://$upstream_tinyauth:3000/api/auth/nginx;

    # Don't send the body to the auth server
    proxy_pass_request_body off;
    proxy_set_header content-length "";

    # Headers needed for authentication
    proxy_set_header x-original-url $scheme://$http_host$request_uri;
    proxy_set_header x-original-method $request_method;
    proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
    proxy_set_header x-real-ip $remote_addr;
}

Authentication Location

Ensure your /config/nginx/tinyauth-location.conf file looks like this:

/config/nginx/tinyauth-location.conf

auth_request /tinyauth;
auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
error_page 401 403 =302 $redirection_url;

auth_request_set $email $upstream_http_remote_email;
auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name;
auth_request_set $user $upstream_http_remote_user;

proxy_set_header remote-email $email;
proxy_set_header remote-groups $groups;
proxy_set_header remote-name $name;
proxy_set_header remote-user $user;

This allows Tinyauth to choose the correct login, unauthorized, or error page and return it through the X-Tinyauth-Location response header.

Protect an Application

Open the application’s file in /config/nginx/proxy-confs/. Uncomment the Tinyauth server include inside its server block:

include /config/nginx/tinyauth-server.conf;

Then uncomment the Tinyauth location include inside the app’s location / block:

include /config/nginx/tinyauth-location.conf;

The relevant parts of a protected proxy configuration should look like this:

server {
    # Other server configuration...

    include /config/nginx/tinyauth-server.conf;

    location / {
        include /config/nginx/tinyauth-location.conf;

        # Existing application proxy configuration...
    }
}

Repeat these two changes for each application you want to protect. Do not add them to Tinyauth’s own proxy configuration.

Apply the Configuration

Test the Nginx configuration, then restart SWAG:

docker exec swag nginx -t
docker restart swag

Visiting a protected application while signed out should now redirect you to Tinyauth. After signing in, Tinyauth redirects you back to the application.

It is recommended, and required for IP address access controls, to set TINYAUTH_AUTH_TRUSTEDPROXIES to the IP address or subnet used by SWAG. This allows Tinyauth to trust the X-Real-IP and X-Forwarded-For headers and determine the correct client IP.