Turn GitHub Pages into a marketing landing page; cross-link, drop download buttons
- Rewrite docs/index.md as a short landing page (what it is, screenshots, why this over the alternatives, features, a minimal "get it" snippet) instead of a full documentation dump — full docs live in the repo (README, docs/*.md) and are linked from here. - Cross-link to SSO Manager and theta-env's own Pages sites. - Screenshots are now clickable (open full size) on both the Pages site and the README. - Disable show_downloads in docs/_config.yml — the Cayman theme's "Download .zip/.tar.gz" buttons are gone; "View on GitHub" (which links back to the repo) is the only header link now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
@@ -22,12 +22,12 @@ proxy serves them over TLS with auto-renewing certs and no downtime on changes.
|
|||||||
|
|
||||||
| Hosts | Authentication |
|
| Hosts | Authentication |
|
||||||
| --- | --- |
|
| --- | --- |
|
||||||
|  |  |
|
| [](docs/images/hosts.png) | [](docs/images/host-auth-sso.png) |
|
||||||
|
|
||||||
Basic auth and SSO are mutually exclusive per host, with per-user password
|
Basic auth and SSO are mutually exclusive per host, with per-user password
|
||||||
management once basic auth is enabled:
|
management once basic auth is enabled:
|
||||||
|
|
||||||
|
[](docs/images/host-auth-basic.png)
|
||||||
|
|
||||||
## Why this over the alternatives
|
## Why this over the alternatives
|
||||||
|
|
||||||
|
|||||||
+1
-1
@@ -1,7 +1,7 @@
|
|||||||
title: Proxy
|
title: Proxy
|
||||||
description: A reverse proxy and HTTPS termination service using OpenResty/nginx with a management API and web GUI
|
description: A reverse proxy and HTTPS termination service using OpenResty/nginx with a management API and web GUI
|
||||||
theme: jekyll-theme-cayman
|
theme: jekyll-theme-cayman
|
||||||
show_downloads: true
|
show_downloads: false
|
||||||
github:
|
github:
|
||||||
repository_url: https://github.com/theta42/proxy
|
repository_url: https://github.com/theta42/proxy
|
||||||
zip_url: https://github.com/theta42/proxy/archive/refs/heads/master.zip
|
zip_url: https://github.com/theta42/proxy/archive/refs/heads/master.zip
|
||||||
|
|||||||
+51
-95
@@ -5,117 +5,73 @@ title: Home
|
|||||||
|
|
||||||
# Proxy
|
# Proxy
|
||||||
|
|
||||||
A reverse proxy and HTTPS termination service using OpenResty/nginx with a management API and web GUI.
|
A reverse proxy and HTTPS termination service built on OpenResty/nginx, with a
|
||||||
|
management API and web GUI. It puts any of your apps behind single sign-on
|
||||||
|
(OIDC) and can also look users up directly in LDAP — so the same people who
|
||||||
|
log in to your SSO are the people allowed to reach your proxied apps.
|
||||||
|
|
||||||
|
Automatic HTTPS from Let's Encrypt (including wildcards), routing by hostname,
|
||||||
|
and per-host access control tied to your identity provider — managed from a
|
||||||
|
web UI or a REST API, with no downtime on config changes.
|
||||||
|
|
||||||
|
Part of the theta42 self-hosted identity stack, alongside
|
||||||
|
[SSO Manager](https://theta42.github.io/sso-manager-node/) and
|
||||||
|
[theta-env](https://theta42.github.io/theta-env/) (the two composed with one
|
||||||
|
command).
|
||||||
|
|
||||||
## Screenshots
|
## Screenshots
|
||||||
|
|
||||||
| Hosts | Authentication |
|
<a href="images/hosts.png" target="_blank"><img src="images/hosts.png" alt="Host list" width="49%"></a>
|
||||||
| --- | --- |
|
<a href="images/host-auth-sso.png" target="_blank"><img src="images/host-auth-sso.png" alt="Per-host SSO auth" width="49%"></a>
|
||||||
|  |  |
|
|
||||||
|
|
||||||
Basic auth and SSO are mutually exclusive per host, with per-user password
|
Basic auth and SSO are mutually exclusive per host, with per-user password
|
||||||
management once basic auth is enabled:
|
management once basic auth is enabled:
|
||||||
|
|
||||||
|
<a href="images/host-auth-basic.png" target="_blank"><img src="images/host-auth-basic.png" alt="Per-host basic auth" width="60%"></a>
|
||||||
|
|
||||||
|
*(click any screenshot to view full size)*
|
||||||
|
|
||||||
|
## Why this over the alternatives
|
||||||
|
|
||||||
|
Nginx Proxy Manager, Traefik, and Caddy are all good reverse proxies with
|
||||||
|
auto-HTTPS. This one is built around identity: it is both an **OIDC client**
|
||||||
|
of an SSO provider (for browser login) **and** a direct **LDAP client** (for
|
||||||
|
user lookups and per-host access control), so access decisions come from your
|
||||||
|
real user directory, not a static allow-list or a separate auth proxy bolted
|
||||||
|
on top. The trade-off is that it expects an OIDC/LDAP identity source to point
|
||||||
|
at — it is not a standalone auth server. Pair it with
|
||||||
|
[SSO Manager](https://theta42.github.io/sso-manager-node/) (bundled OpenLDAP +
|
||||||
|
OIDC) for a self-hosted SSO + proxy stack, or point it at any OIDC provider +
|
||||||
|
LDAP directory you already run.
|
||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
|
||||||
- **Automated HTTPS/SSL** - Let's Encrypt integration with HTTP-01 and DNS-01 challenges
|
- Automated HTTPS via Let's Encrypt — HTTP-01 and DNS-01 (wildcard) challenges
|
||||||
- **Wildcard SSL Certificates** - Support for wildcard domains with automatic renewal
|
- Multiple DNS providers (Cloudflare, DigitalOcean, PorkBun, DuckDNS — free)
|
||||||
- **Multiple DNS Providers** - Cloudflare, DigitalOcean, PorkBun, DuckDNS (free) integrations
|
- Dynamic host routing with wildcard domain matching (`*`, `**`)
|
||||||
- **Advanced Routing** - Sophisticated wildcard domain matching (*, **)
|
- **OIDC login** and **direct LDAP lookups**, independently of each other
|
||||||
- **RESTful API** - Full programmatic control
|
- Per-host **basic auth** as an alternative to SSO (mutually exclusive, so
|
||||||
- **Web Interface** - User-friendly management GUI
|
it's never ambiguous which one gated a request)
|
||||||
- **High Performance** - Unix socket-based host lookup for minimal latency
|
- **Role-based access control** — global admins, local groups, and
|
||||||
|
per-domain permissions (viewer/manager)
|
||||||
|
- Self-service API tokens for scripting/CI without a browser session
|
||||||
|
- Web UI and a full REST API
|
||||||
|
|
||||||
## Quick Start
|
## Get it
|
||||||
|
|
||||||
### Docker (recommended for self-hosters)
|
|
||||||
|
|
||||||
A single all-in-one image bundling OpenResty + the app + Redis:
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
git clone https://github.com/theta42/proxy.git
|
git clone https://github.com/theta42/proxy.git
|
||||||
cd proxy && docker compose up -d --build
|
cd proxy && docker compose up -d --build
|
||||||
```
|
```
|
||||||
|
|
||||||
See the [Docker Guide](docker.html) for configuration (OIDC/LDAP via `app_*` env)
|
That's the standalone quick start. For the full set of install options (Docker,
|
||||||
and fronting an SSO Manager.
|
bare-metal, or as part of the combined SSO + proxy stack), configuration
|
||||||
|
reference, and API docs, see the
|
||||||
|
**[GitHub repository](https://github.com/theta42/proxy)**.
|
||||||
|
|
||||||
### Automated bare-metal installation
|
## Related projects
|
||||||
|
|
||||||
For modern Debian-based systems (Ubuntu 20.04+, Debian 11+):
|
- **[SSO Manager](https://theta42.github.io/sso-manager-node/)** — the OIDC
|
||||||
|
provider + LDAP directory this proxy is designed to sit in front of.
|
||||||
```bash
|
- **[theta-env](https://theta42.github.io/theta-env/)** — runs this proxy and
|
||||||
wget -O - https://raw.githubusercontent.com/theta42/proxy/master/ops/install.sh | sudo bash
|
SSO Manager together with one command.
|
||||||
```
|
|
||||||
|
|
||||||
### Requirements (bare metal)
|
|
||||||
|
|
||||||
- Node.js 18+ (tested with 18.x, 20.x, 22.x)
|
|
||||||
- OpenResty (nginx with Lua support)
|
|
||||||
- Redis
|
|
||||||
- Linux system with root access
|
|
||||||
|
|
||||||
## Documentation
|
|
||||||
|
|
||||||
- [Docker Guide](docker.html) - All-in-one container deployment + configuration
|
|
||||||
- [Installation Guide](installation.html) - Bare-metal setup instructions
|
|
||||||
- [API Reference](api.html) - Complete API documentation
|
|
||||||
- [Architecture](architecture.html) - System design and components
|
|
||||||
- [Contributing](contributing.html) - Development and testing guide
|
|
||||||
|
|
||||||
## Use Cases
|
|
||||||
|
|
||||||
**Development Teams**
|
|
||||||
- Host multiple projects on a single server with unique domains
|
|
||||||
- Automatic SSL for all development sites
|
|
||||||
- Easy configuration via API or web UI
|
|
||||||
|
|
||||||
**Production Deployments**
|
|
||||||
- High-performance reverse proxy for microservices
|
|
||||||
- Centralized SSL certificate management
|
|
||||||
- Dynamic routing without nginx reloads
|
|
||||||
|
|
||||||
**Personal Projects**
|
|
||||||
- Self-hosted services with automatic HTTPS
|
|
||||||
- Wildcard certificates for unlimited subdomains
|
|
||||||
- Simple management interface
|
|
||||||
|
|
||||||
## Architecture
|
|
||||||
|
|
||||||
```
|
|
||||||
┌─────────────┐
|
|
||||||
│ Client │
|
|
||||||
└──────┬──────┘
|
|
||||||
│ HTTPS
|
|
||||||
▼
|
|
||||||
┌─────────────────────┐
|
|
||||||
│ OpenResty/Nginx │
|
|
||||||
│ - SSL Termination │
|
|
||||||
│ - Host Routing │
|
|
||||||
└──────┬──────────────┘
|
|
||||||
│ Unix Socket
|
|
||||||
▼
|
|
||||||
┌─────────────────────┐ ┌─────────────┐
|
|
||||||
│ Node.js API │◄────►│ Redis │
|
|
||||||
│ - Management │ │ - Storage │
|
|
||||||
│ - SSL Orchestration│ │ - Cache │
|
|
||||||
└──────┬──────────────┘ └─────────────┘
|
|
||||||
│
|
|
||||||
▼
|
|
||||||
┌─────────────────────┐
|
|
||||||
│ Backend Services │
|
|
||||||
│ - Your Apps │
|
|
||||||
└─────────────────────┘
|
|
||||||
```
|
|
||||||
|
|
||||||
## Community
|
|
||||||
|
|
||||||
- [GitHub Repository](https://github.com/theta42/proxy)
|
|
||||||
- [Issue Tracker](https://github.com/theta42/proxy/issues)
|
|
||||||
- [Pull Requests](https://github.com/theta42/proxy/pulls)
|
|
||||||
|
|
||||||
## License
|
|
||||||
|
|
||||||
MIT License - See [LICENSE](https://github.com/theta42/proxy/blob/master/LICENSE) for details.
|
|
||||||
|
|||||||
Reference in New Issue
Block a user