notid/workstation-share
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: notid:f14c90e05ae222fa5debd11ba9fcaa272f33dc10
Branches Tags
notid:master
...
compare: notid:master
Branches Tags
notid:master

2 Commits
f14c90e05a ... master

Author SHA1 Message Date
Bryce
c96e7a694f fix 2026-04-20 22:47:02 -07:00
Bryce
26716b7b2b changes 2026-04-20 14:05:17 -07:00
10 changed files with 161 additions and 71 deletions
Expand all files Collapse all files

15
.env.example Normal file
View File

@@ -0,0 +1,15 @@
# OAuth2 Proxy Configuration
# Copy this file to .env and fill in your values
# GitHub OAuth credentials
# Get these from: GitHub → Settings → Developer settings → OAuth Apps
GITHUB_CLIENT_ID=your-github-client-id-here
GITHUB_CLIENT_SECRET=your-github-client-secret-here
# Cookie secret - generate with: openssl rand -base64 24
OAUTH2_PROXY_COOKIE_SECRET=your-cookie-secret-here
# Example (do not use these):
# GITHUB_CLIENT_ID=Iv1.abc123xyz789
# GITHUB_CLIENT_SECRET=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0
# OAUTH2_PROXY_COOKIE_SECRET=XOtjj+hRLbjkdzz1BAchBcUd/hR6WSt0

10
.gitignore vendored
View File

@@ -1,4 +1,10 @@
filebrowser/filebrowser.db
filebrowser/tailscale-state/**
.env
llama/tailscale-state/
comfyui/tailscale-state/**
filebrowser/tailscale-state/**
filebrowser/config/filebrowser.db
filebrowser/filebrowser.db
filebrowser/database/**
llama/tailscale-state/**
*.log
.DS_Store

2
comfyui/ts_serve.json
View File

@@ -8,7 +8,7 @@
"comfyui.story-basking.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:80"
"Proxy": "http://127.0.0.1:4180"
}
}
}

123
docker-compose.yml
View File

@@ -5,7 +5,7 @@ services:
image: tailscale/tailscale:latest
hostname: comfyui
environment:
- TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
- TS_AUTHKEY=$TS_AUTHKEY
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/ts_serve.json
- TS_USERSPACE=false
@@ -19,21 +19,48 @@ services:
- net_raw
restart: unless-stopped
comfy_nginx:
image: nginx:latest
comfy_oauth2_proxy:
image: quay.io/oauth2-proxy/oauth2-proxy:latest
depends_on:
- comfy_tailscale
environment:
- OAUTH2_PROXY_PROVIDER=github
- OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
- OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
- OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
- OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
- OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
- OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
- OAUTH2_PROXY_COOKIE_NAME=comfy_session
- OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
- OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
- OAUTH2_PROXY_COOKIE_REFRESH=60m
- OAUTH2_PROXY_COOKIE_SECURE=true
- OAUTH2_PROXY_COOKIE_HTTPONLY=false
- OAUTH2_PROXY_COOKIE_SAMESITE=none
- OAUTH2_PROXY_GITHUB_USER=brycecovert
- OAUTH2_PROXY_REDIRECT_URL=https://comfyui.story-basking.ts.net/oauth2/callback
- OAUTH2_PROXY_EMAIL_DOMAINS=*
- OAUTH2_PROXY_UPSTREAMS=http://workstation:8188
- OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
- OAUTH2_PROXY_REVERSE_PROXY=true
- OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
- OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
- OAUTH2_PROXY_SET_XAUTHREQUEST=true
- OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
- OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
- OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
- OAUTH2_PROXY_STANDARD_LOGGING=true
- OAUTH2_PROXY_AUTH_LOGGING=true
- OAUTH2_PROXY_REQUEST_LOGGING=true
restart: unless-stopped
volumes:
- ./comfyui/nginx.conf:/etc/nginx/nginx.conf:ro
- ./.htpasswd:/etc/nginx/.htpasswd:ro
network_mode: service:comfy_tailscale
filebrowser_tailscale:
image: tailscale/tailscale:latest
hostname: filebrowser
environment:
- TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
- TS_AUTHKEY=$TS_AUTHKEY
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/ts_serve.json
- TS_USERSPACE=false
@@ -46,6 +73,7 @@ services:
- net_admin
- net_raw
restart: unless-stopped
filebrowser:
image: hurlenko/filebrowser
container_name: filebrowser
@@ -55,25 +83,56 @@ services:
volumes:
- /mnt/data/ai/ComfyUI/output:/data/comfyui-output
- /home/noti/dev:/data/dev
- ./filebrowser/database/:/database
- ./filebrowser/config:/config
environment:
- FB_BASEURL=/filebrowser
restart: unless-stopped
network_mode: service:filebrowser_tailscale
filebrowser_nginx:
image: nginx:latest
filebrowser_oauth2_proxy:
image: quay.io/oauth2-proxy/oauth2-proxy:latest
depends_on:
- filebrowser_tailscale
environment:
- OAUTH2_PROXY_PROVIDER=github
- OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
- OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
- OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
- OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
- OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
- OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
- OAUTH2_PROXY_COOKIE_NAME=filebrowser_session
- OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
- OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
- OAUTH2_PROXY_COOKIE_REFRESH=60m
- OAUTH2_PROXY_COOKIE_SECURE=true
- OAUTH2_PROXY_COOKIE_HTTPONLY=false
- OAUTH2_PROXY_COOKIE_SAMESITE=none
- OAUTH2_PROXY_GITHUB_USER=brycecovert
- OAUTH2_PROXY_REDIRECT_URL=https://filebrowser.story-basking.ts.net/oauth2/callback
- OAUTH2_PROXY_EMAIL_DOMAINS=*
- OAUTH2_PROXY_UPSTREAMS=http://localhost:8080
- OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
- OAUTH2_PROXY_REVERSE_PROXY=true
- OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
- OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
- OAUTH2_PROXY_SET_XAUTHREQUEST=true
- OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
- OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
- OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
- OAUTH2_PROXY_STANDARD_LOGGING=true
- OAUTH2_PROXY_AUTH_LOGGING=true
- OAUTH2_PROXY_REQUEST_LOGGING=true
restart: unless-stopped
volumes:
- ./filebrowser/nginx.conf:/etc/nginx/nginx.conf:ro
- ./.htpasswd:/etc/nginx/.htpasswd:ro
network_mode: service:filebrowser_tailscale
llama_tailscale:
image: tailscale/tailscale:latest
hostname: llama
environment:
- TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
- TS_AUTHKEY=$TS_AUTHKEY
- TS_STATE_DIR=/var/lib/tailscale
- TS_SERVE_CONFIG=/config/ts_serve.json
- TS_USERSPACE=false
@@ -87,12 +146,40 @@ services:
- net_raw
restart: unless-stopped
llama_nginx:
image: nginx:latest
llama_oauth2_proxy:
image: quay.io/oauth2-proxy/oauth2-proxy:latest
container_name: llama_oauth2_proxy
depends_on:
- llama_tailscale
environment:
- OAUTH2_PROXY_PROVIDER=github
- OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
- OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
- OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
- OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
- OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
- OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
- OAUTH2_PROXY_COOKIE_NAME=llama_session
- OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
- OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
- OAUTH2_PROXY_COOKIE_REFRESH=60m
- OAUTH2_PROXY_COOKIE_SECURE=true
- OAUTH2_PROXY_COOKIE_HTTPONLY=false
- OAUTH2_PROXY_COOKIE_SAMESITE=none
- OAUTH2_PROXY_GITHUB_USER=brycecovert
- OAUTH2_PROXY_REDIRECT_URL=https://llama.story-basking.ts.net/oauth2/callback
- OAUTH2_PROXY_EMAIL_DOMAINS=*
- OAUTH2_PROXY_UPSTREAMS=http://workstation:5082
- OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
- OAUTH2_PROXY_REVERSE_PROXY=true
- OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
- OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
- OAUTH2_PROXY_SET_XAUTHREQUEST=true
- OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
- OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
- OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
- OAUTH2_PROXY_STANDARD_LOGGING=true
- OAUTH2_PROXY_AUTH_LOGGING=true
- OAUTH2_PROXY_REQUEST_LOGGING=true
restart: unless-stopped
volumes:
- ./llama/nginx.conf:/etc/nginx/nginx.conf:ro
- ./.htpasswd:/etc/nginx/.htpasswd:ro
network_mode: service:llama_tailscale

0
filebrowser/config/.gitkeep Normal file
View File

0
filebrowser/database/.gitkeep Normal file
View File

2
filebrowser/ts_serve.json
View File

@@ -8,7 +8,7 @@
"filebrowser.story-basking.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:80"
"Proxy": "http://127.0.0.1:4180"
}
}
}

30
generate-cookie-secret.sh Executable file
View File

@@ -0,0 +1,30 @@
#!/bin/bash
# Generate a secure cookie secret for oauth2-proxy
# Cookie secret must be 16, 24, or 32 bytes when base64-decoded
set -e
echo "Generating OAuth2 Proxy cookie secret..."
echo ""
# Generate exactly 24 random bytes (encodes to 32 base64 chars)
COOKIE_SECRET=$(openssl rand -base64 24 | tr -d '\n')
echo "Generated Cookie Secret:"
echo "$COOKIE_SECRET"
echo ""
# Update docker-compose.yml if it exists
if [ -f "docker-compose.yml" ]; then
echo "Updating docker-compose.yml..."
sed -i "s|OAUTH2_PROXY_COOKIE_SECRET=.*|OAUTH2_PROXY_COOKIE_SECRET=$COOKIE_SECRET|" docker-compose.yml
echo "Updated OAUTH2_PROXY_COOKIE_SECRET in docker-compose.yml"
else
echo "docker-compose.yml not found. Add this to your environment:"
echo " OAUTH2_PROXY_COOKIE_SECRET=$COOKIE_SECRET"
fi
echo ""
echo "Restart the oauth2-proxy container to apply:"
echo " docker-compose restart llama_oauth2_proxy"

48
llama/nginx.conf
View File

@@ -1,48 +0,0 @@
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
gzip on;
gzip_vary on;
gzip_min_length 256;
gzip_proxied any;
gzip_types
application/json
application/javascript
application/xml
application/xml+rss
text/css
text/javascript
text/plain
text/xml;
server {
listen 80;
server_name _;
auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/.htpasswd;
client_max_body_size 100M;
location / {
proxy_pass http://workstation:5082;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_connect_timeout 60s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;
}
}
}

2
llama/ts_serve.json
View File

@@ -8,7 +8,7 @@
"llama.story-basking.ts.net:443": {
"Handlers": {
"/": {
"Proxy": "http://127.0.0.1:80"
"Proxy": "http://127.0.0.1:4180"
}
}
}