Reverse proxy authentication to Woodpecker CI and Gitea

[pboguslawski]

This mod adds option to authenticate user using HTTP header set by
reverse proxy. It forwards specified HTTP header with authenticated
username in requests to Gitea.

Requirements:

• Gitea must be configured for reverse proxy authentication and
  must accept HTTP header auth in API calls
  (Allow Token API calls be authorized using the reverse-proxy header go-gitea/gitea#15119).

To enable set the following variables in woodpecker server
environment (woodpecker running behind reverse proxy):

• internal woodpecker server URL, i.e.:

  WOODPECKER_HOST_INTERNAL=http://192.168.1.100:8000/

• enable reverse proxy auth in woodpecker and forwarding auth
  header to gitea:

  WOODPECKER_GITEA_REV_PROXY_AUTH=true

• set name of header with authenticated username (set by
  reverse proxy), i.e.:

  WOODPECKER_GITEA_REV_PROXY_AUTH_HEADER=X-Forward-Username

Related: go-gitea/gitea#15119
Author-Change-Id: IB#1107569

[qwerty287]

1. Docs are missing, please add them.
2. Please remove the chsnged copyright headers, we do this nowhere else.

[qwerty287]

I don't fully understand this PR, but why do you disable OAuth2 for the rev proxy auth? I'm not an expert with reverse proxies, but shouldn't it be possible to use OAuth2 with them?

[pboguslawski]

I don't fully understand this PR, but why do you disable OAuth2 for the rev proxy auth? I'm not an expert with reverse proxies, but shouldn't it be possible to use OAuth2 with them?

If you use proxy for authentication, proxy is responsible for this and backend apps like gitea or woodpecker should trust it (user login passed in specified header). Because woodpecker must authenticate to gitea using HTTP call, it must also be able to forward header with user login to authenticate user in gitea. OAuth2 is different/separate auth logic and I don't see any point in trying to use it along with proxy auth using HTTP headers.

[pboguslawski]

1. Docs are missing, please add them.

   2. Please remove the chsnged copyright headers, we do this nowhere else.

Fixed.

[6543]

well sorry that we dont come allong to review it ...

@pboguslawski what realy would help us is some docker-compose with such an auth-proxy in it ...
or an easy description how to set it up

so we can test it and play around with it

[pboguslawski]

Providing container infrastructure setup script/description for header auth is not easy, requires time and is outside the scope of this PR (feel free to create separate issue if required).

For simple tests consider setting WOODPECKER_GITEA_REV_PROXY_AUTH_HEADER=X-Forward-Username and sending request using curl like this

curl --header 'X-Forward-Username: mylogin' http://127.0.0.1:1234

or using your favourite proxy (i.e. apache, nginx, haproxy) in front of woodpecker + gitea backends with hardcoded X-Forward-Username: mylogin HTTP header injecting before passing request to backend (authenticated user simulation).

[6543]

CI failed :/ (lint issue)

[anbraten]

OAuth2 works just fine. As miss-configurations of the reverse proxy setup could lead to some serious security issues I will close this PR now. Anyways Thanks for your work.