| author |  clover caruso <git@paperclover.net> 2026-01-08 03:17:00-08:00 |
| committer | clover caruso <git@paperclover.net> 2026-01-08 23:41:11-08:00 |
| log | e1dc407ca25836d334933af0bd6e8ec5d13ee511 |
| tree | 7c2a4d2a235bdd92c3c42b726aca4e782c4b7a0a |
| parent | abe58e8dabffdf3c721bf23fe701764f49d547c3 |
| signature |  Commit is signed but in an unrecognized format. |
feat: navidrome sso
2 files changed, 54 insertions(+), 5 deletions(-)
compose.yaml+9-4
| ... | @@ -242,7 +242,7 @@ services: | ... | @@ -242,7 +242,7 @@ services: |
| 242 | net.paperclover.list.access: media | 242 | net.paperclover.list.access: media |
| 243 | depends_on: | 243 | depends_on: |
| 244 | keycloak: | 244 | keycloak: |
| 245 | condition: service_healthy | 245 | condition: service_started |
| 246 | navidrome: # port 4533 | 246 | navidrome: # port 4533 |
| 247 | container_name: navidrome | 247 | container_name: navidrome |
| 248 | image: deluan/navidrome:latest | 248 | image: deluan/navidrome:latest |
| ... | @@ -252,14 +252,19 @@ services: | ... | @@ -252,14 +252,19 @@ services: |
| 252 | - "${APP_ROOT}/navidrone:/data:rw" | 252 | - "${APP_ROOT}/navidrone:/data:rw" |
| 253 | - "${MEDIA_ROOT}/music:/music:ro" | 253 | - "${MEDIA_ROOT}/music:/music:ro" |
| 254 | environment: | 254 | environment: |
| 255 | - ND_SCANNER_GROUPALBUMRELEASES=1 | 255 | ND_SCANNER_GROUPALBUMRELEASES: "1" |
| 256 | - ND_BASEURL=https://nd.${HOME_DOMAIN}/ | 256 | ND_BASEURL: "https://music.${HOME_DOMAIN}/" |
| 257 | - ND_PID_ALBUM=folder | 257 | ND_PID_ALBUM: "folder" |
| 258 | ND_EXTAUTH_TRUSTEDSOURCES: "0.0.0.0/0" # troll | ||
| 259 | ND_PORT: "80" | ||
| 258 | labels: | 260 | labels: |
| 259 | net.paperclover.list.name: Navidrome Music | 261 | net.paperclover.list.name: Navidrome Music |
| 260 | net.paperclover.list.domain: nd | 262 | net.paperclover.list.domain: nd |
| 261 | net.paperclover.list.priority: 109 | 263 | net.paperclover.list.priority: 109 |
| 262 | net.paperclover.list.access: media | 264 | net.paperclover.list.access: media |
| 265 | depends_on: | ||
| 266 | forward-auth: | ||
| 267 | condition: service_started | ||
| 263 | # media aquisition | 268 | # media aquisition |
| 264 | qbittorrent: # webui on port 23938 | 269 | qbittorrent: # webui on port 23938 |
| 265 | platform: linux/amd64 # not available for aarch64 | 270 | platform: linux/amd64 # not available for aarch64 |
config/Caddyfile+45-1
| ... | @@ -101,7 +101,51 @@ import ./jellyfin/Caddyfile | ... | @@ -101,7 +101,51 @@ import ./jellyfin/Caddyfile |
| 101 | # } | 101 | # } |
| 102 | # } | 102 | # } |
| 103 | music.{$HOME_DOMAIN} { | 103 | music.{$HOME_DOMAIN} { |
| 104 | reverse_proxy "http://navidrome:4533" | 104 | handle_path /app/sw.js { |
| 105 | header Content-Type "application/javascript" | ||
| 106 | respond "// sw disabled" 200 | ||
| 107 | } | ||
| 108 | |||
| 109 | handle /snow.oauth2/* { | ||
| 110 | reverse_proxy "http://forward-auth" { | ||
| 111 | header_up X-Real-IP {remote_host} | ||
| 112 | header_up X-Forwarded-Uri {uri} | ||
| 113 | } | ||
| 114 | } | ||
| 115 | |||
| 116 | @protected not path /share/* /rest/* /snow.oauth2/* /app/sw.js | ||
| 117 | forward_auth @protected "http://forward-auth" { | ||
| 118 | uri /snow.oauth2/auth | ||
| 119 | header_up X-Real-IP {remote_host} | ||
| 120 | copy_headers X-Auth-Request-Preferred-Username>Remote-User | ||
| 121 | @error status 401 | ||
| 122 | handle_response @error { | ||
| 123 | redir * /snow.oauth2/sign_in?rd={scheme}://{host}{uri} | ||
| 124 | } | ||
| 125 | } | ||
| 126 | |||
| 127 | @subsonic path /rest/* | ||
| 128 | forward_auth @subsonic "http://forward-auth" { | ||
| 129 | uri /snow.oauth2/auth | ||
| 130 | header_up X-Real-IP {remote_host} | ||
| 131 | copy_headers X-Auth-Request-Preferred-Username>Remote-User | ||
| 132 | |||
| 133 | # Some clients that claim to support basicauth still expect a subsonic | ||
| 134 | # response in case of authentication failure instead of a proper basicauth | ||
| 135 | # response. | ||
| 136 | @error status 1xx 3xx 4xx 5xx | ||
| 137 | handle_response @error { | ||
| 138 | respond <<SUBSONICERR | ||
| 139 | <subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true"> | ||
| 140 | <error code="40" message="Invalid credentials or unsupported client"></error> | ||
| 141 | </subsonic-response> | ||
| 142 | SUBSONICERR 200 | ||
| 143 | } | ||
| 144 | } | ||
| 145 | |||
| 146 | handle { | ||
| 147 | reverse_proxy "http://navidrome" | ||
| 148 | } | ||
| 105 | } | 149 | } |
| 106 | # opencode.{$HOME_DOMAIN} { | 150 | # opencode.{$HOME_DOMAIN} { |
| 107 | # import auth | 151 | # import auth |