feat: naarad protected by heimdall

metaploy/naarad.metaploy.conf

@@ -1,14 +1,36 @@
 upstream naarad {
-	server naarad:8000;
+    server naarad:8000;
 }
 
 server {
-	server_name naarad.metakgp.org;
+    server_name naarad.metakgp.org;
 
-	location / {
-		proxy_pass http://naarad;
+    location /web {
+        auth_request /auth;
+        error_page 400 401 500 =200 @handle_auth;
 
-		proxy_set_header Upgrade $http_upgrade;
-		proxy_set_header Connection "upgrade";
-	}
-}
+        proxy_pass http://naarad;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location /auth {
+        internal;
+        proxy_pass https://heimdall-api.metakgp.org/validate-jwt;
+        proxy_set_header Cookie $http_cookie;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+
+    location @handle_auth {
+        return 301 https://heimdall.metakgp.org/?redirect_url=https://$server_name$request_uri;
+    }
+
+    location / {
+        proxy_pass http://naarad;
+
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+}