| author |  clover caruso <git@paperclover.net> 2026-01-08 03:17:00-08:00 |
| committer | clover caruso <git@paperclover.net> 2026-01-08 23:41:11-08:00 |
| log | e1dc407ca25836d334933af0bd6e8ec5d13ee511 |
| tree | 7c2a4d2a235bdd92c3c42b726aca4e782c4b7a0a |
| parent | abe58e8dabffdf3c721bf23fe701764f49d547c3 |
| signature |  Commit is signed but in an unrecognized format. |
feat: navidrome sso
2 files changed, 54 insertions(+), 5 deletions(-)
compose.yaml+9-4
| ... | ... | @@ -242,7 +242,7 @@ services: |
| 242 | 242 | net.paperclover.list.access: media |
| 243 | 243 | depends_on: |
| 244 | 244 | keycloak: |
| 245 | condition: service_healthy | |
| 245 | condition: service_started | |
| 246 | 246 | navidrome: # port 4533 |
| 247 | 247 | container_name: navidrome |
| 248 | 248 | image: deluan/navidrome:latest |
| ... | ... | @@ -252,14 +252,19 @@ services: |
| 252 | 252 | - "${APP_ROOT}/navidrone:/data:rw" |
| 253 | 253 | - "${MEDIA_ROOT}/music:/music:ro" |
| 254 | 254 | environment: |
| 255 | - ND_SCANNER_GROUPALBUMRELEASES=1 | |
| 256 | - ND_BASEURL=https://nd.${HOME_DOMAIN}/ | |
| 257 | - ND_PID_ALBUM=folder | |
| 255 | ND_SCANNER_GROUPALBUMRELEASES: "1" | |
| 256 | ND_BASEURL: "https://music.${HOME_DOMAIN}/" | |
| 257 | ND_PID_ALBUM: "folder" | |
| 258 | ND_EXTAUTH_TRUSTEDSOURCES: "0.0.0.0/0" # troll | |
| 259 | ND_PORT: "80" | |
| 258 | 260 | labels: |
| 259 | 261 | net.paperclover.list.name: Navidrome Music |
| 260 | 262 | net.paperclover.list.domain: nd |
| 261 | 263 | net.paperclover.list.priority: 109 |
| 262 | 264 | net.paperclover.list.access: media |
| 265 | depends_on: | |
| 266 | forward-auth: | |
| 267 | condition: service_started | |
| 263 | 268 | # media aquisition |
| 264 | 269 | qbittorrent: # webui on port 23938 |
| 265 | 270 | platform: linux/amd64 # not available for aarch64 |
config/Caddyfile+45-1
| ... | ... | @@ -101,7 +101,51 @@ import ./jellyfin/Caddyfile |
| 101 | 101 | # } |
| 102 | 102 | # } |
| 103 | 103 | music.{$HOME_DOMAIN} { |
| 104 | reverse_proxy "http://navidrome:4533" | |
| 104 | handle_path /app/sw.js { | |
| 105 | header Content-Type "application/javascript" | |
| 106 | respond "// sw disabled" 200 | |
| 107 | } | |
| 108 | ||
| 109 | handle /snow.oauth2/* { | |
| 110 | reverse_proxy "http://forward-auth" { | |
| 111 | header_up X-Real-IP {remote_host} | |
| 112 | header_up X-Forwarded-Uri {uri} | |
| 113 | } | |
| 114 | } | |
| 115 | ||
| 116 | @protected not path /share/* /rest/* /snow.oauth2/* /app/sw.js | |
| 117 | forward_auth @protected "http://forward-auth" { | |
| 118 | uri /snow.oauth2/auth | |
| 119 | header_up X-Real-IP {remote_host} | |
| 120 | copy_headers X-Auth-Request-Preferred-Username>Remote-User | |
| 121 | @error status 401 | |
| 122 | handle_response @error { | |
| 123 | redir * /snow.oauth2/sign_in?rd={scheme}://{host}{uri} | |
| 124 | } | |
| 125 | } | |
| 126 | ||
| 127 | @subsonic path /rest/* | |
| 128 | forward_auth @subsonic "http://forward-auth" { | |
| 129 | uri /snow.oauth2/auth | |
| 130 | header_up X-Real-IP {remote_host} | |
| 131 | copy_headers X-Auth-Request-Preferred-Username>Remote-User | |
| 132 | ||
| 133 | # Some clients that claim to support basicauth still expect a subsonic | |
| 134 | # response in case of authentication failure instead of a proper basicauth | |
| 135 | # response. | |
| 136 | @error status 1xx 3xx 4xx 5xx | |
| 137 | handle_response @error { | |
| 138 | respond <<SUBSONICERR | |
| 139 | <subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true"> | |
| 140 | <error code="40" message="Invalid credentials or unsupported client"></error> | |
| 141 | </subsonic-response> | |
| 142 | SUBSONICERR 200 | |
| 143 | } | |
| 144 | } | |
| 145 | ||
| 146 | handle { | |
| 147 | reverse_proxy "http://navidrome" | |
| 148 | } | |
| 105 | 149 | } |
| 106 | 150 | # opencode.{$HOME_DOMAIN} { |
| 107 | 151 | # import auth |