Tailscale Authentication for Nginx

Post by xena » Thu, May 05, 2022, 6:51 PM UTC

mholt wrote: post #5

Had a call with Tailscale (unofficially); this will be coming for Caddy soon.

Post by benmmurphy » Thu, May 05, 2022, 6:54 PM UTC

xena wrote: post #3

xmodem wrote: post #2

This is pretty cool, but does potentially open any of these services not just to the browser but to any malware running on your clients. Probably not a huge deal in most cases but something to keep in mind.

Author of the post here. Realistically this is about as dangerous as what you have already with anything behind an SSH server. If you really need to be sure an actual human is making a request, use a yubikey 2fa challenge. I'll update the post to include this on Monday (I'm off for the rest of the week).

Post by xena » Thu, May 05, 2022, 6:55 PM UTC

zrail wrote: post #4

Neat to see this up here! When I saw xena's initial post about Grafana I saw an opportunity to make it work with an existing, well known, basically bullet proof proxy (nginx). Xena took my sketchy POC and made it great :) One interesting enhancement, which is probably not within scope of this tool, would be a way to logically AND a bunch of these auth tools together. With that you could use this tool without changes…

Post by xena » Thu, May 05, 2022, 6:59 PM UTC

kevinmgranger wrote: post #7

I've been meaning to try something similar for Kubernetes/OpenShift-- you can set up authentication (technically an identity provider) through a configurable HTTP header. My idea was having the reverse proxy only listen on the tailscale IP, but this is even cooler.

Post by zrail » Thu, May 05, 2022, 7:13 PM UTC

xena wrote: post #15

zrail wrote: post #4

Neat to see this up here! When I saw xena's initial post about Grafana I saw an opportunity to make it work with an existing, well known, basically bullet proof proxy (nginx). Xena took my sketchy POC and made it great :) One interesting enhancement, which is probably not within scope of this tool, would be a way to logically AND a bunch of these auth tools together. With that you could use this tool without changes…

Yeah I've been thinking about that too. Something I've been wondering about is tying things to the ACL file through something like "capabilities"[1], but this would probably require a fair bit of per-service hacking. I think it'd be worth it, but it would be a lot of work. The main problem here is that Tailscale ACLs only really have "can connect to port" as the main capability they provide. I think I could end up te…

  location /auth {
    ...
    proxy_set_header X-Required-Caps $required_caps;
    ...
  }

  location /grafana {   
    ...
    set $required_caps "grafana.com/read,grafana.com/write"
    auth_request_set $auth_caps $upstream_http_tailscale_caps;
    proxy_set_header X-Webauth-Caps $auth_caps;
    ...
  }