fix

.env.example

@@ -0,0 +1,15 @@
+# OAuth2 Proxy Configuration
+# Copy this file to .env and fill in your values
+
+# GitHub OAuth credentials
+# Get these from: GitHub → Settings → Developer settings → OAuth Apps
+GITHUB_CLIENT_ID=your-github-client-id-here
+GITHUB_CLIENT_SECRET=your-github-client-secret-here
+
+# Cookie secret - generate with: openssl rand -base64 24
+OAUTH2_PROXY_COOKIE_SECRET=your-cookie-secret-here
+
+# Example (do not use these):
+# GITHUB_CLIENT_ID=Iv1.abc123xyz789
+# GITHUB_CLIENT_SECRET=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0
+# OAUTH2_PROXY_COOKIE_SECRET=XOtjj+hRLbjkdzz1BAchBcUd/hR6WSt0

.gitignore

@@ -1,4 +1,10 @@
-filebrowser/filebrowser.db
+.env
-filebrowser/tailscale-state/**
+llama/tailscale-state/
 comfyui/tailscale-state/**
+filebrowser/tailscale-state/**
+filebrowser/config/filebrowser.db
+filebrowser/filebrowser.db
+filebrowser/database/**
 llama/tailscale-state/**
+*.log
+.DS_Store

comfyui/ts_serve.json

@@ -8,7 +8,7 @@
     "comfyui.story-basking.ts.net:443": {
       "Handlers": {
         "/": {
-          "Proxy": "http://127.0.0.1:80"
+          "Proxy": "http://127.0.0.1:4180"
         }
       }
     }

docker-compose.yml

@@ -5,7 +5,7 @@ services:
     image: tailscale/tailscale:latest
     hostname: comfyui
     environment:
-      - TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
+      - TS_AUTHKEY=$TS_AUTHKEY
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/ts_serve.json
       - TS_USERSPACE=false
@@ -19,21 +19,48 @@ services:
       - net_raw
     restart: unless-stopped
 
-  comfy_nginx:
+  comfy_oauth2_proxy:
-    image: nginx:latest
+    image: quay.io/oauth2-proxy/oauth2-proxy:latest
     depends_on:
       - comfy_tailscale
+    environment:
+      - OAUTH2_PROXY_PROVIDER=github
+      - OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
+      - OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
+      - OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
+      - OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
+      - OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
+      - OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
+      - OAUTH2_PROXY_COOKIE_NAME=comfy_session
+      - OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
+      - OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
+      - OAUTH2_PROXY_COOKIE_REFRESH=60m
+      - OAUTH2_PROXY_COOKIE_SECURE=true
+      - OAUTH2_PROXY_COOKIE_HTTPONLY=false
+      - OAUTH2_PROXY_COOKIE_SAMESITE=none
+      - OAUTH2_PROXY_GITHUB_USER=brycecovert
+      - OAUTH2_PROXY_REDIRECT_URL=https://comfyui.story-basking.ts.net/oauth2/callback
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_UPSTREAMS=http://workstation:8188
+      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
+      - OAUTH2_PROXY_REVERSE_PROXY=true
+      - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
+      - OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
+      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
+      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
+      - OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
+      - OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
+      - OAUTH2_PROXY_STANDARD_LOGGING=true
+      - OAUTH2_PROXY_AUTH_LOGGING=true
+      - OAUTH2_PROXY_REQUEST_LOGGING=true
     restart: unless-stopped
-    volumes:
-      - ./comfyui/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd:ro
     network_mode: service:comfy_tailscale
 
   filebrowser_tailscale:
     image: tailscale/tailscale:latest
     hostname: filebrowser
     environment:
-      - TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
+      - TS_AUTHKEY=$TS_AUTHKEY
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/ts_serve.json
       - TS_USERSPACE=false
@@ -46,6 +73,7 @@ services:
       - net_admin
       - net_raw
     restart: unless-stopped
+
   filebrowser:
     image: hurlenko/filebrowser
     container_name: filebrowser
@@ -55,25 +83,56 @@ services:
     volumes:
       - /mnt/data/ai/ComfyUI/output:/data/comfyui-output
       - /home/noti/dev:/data/dev
+      - ./filebrowser/database/:/database
+      - ./filebrowser/config:/config
     environment:
       - FB_BASEURL=/filebrowser
     restart: unless-stopped
     network_mode: service:filebrowser_tailscale
-  filebrowser_nginx:
+
-    image: nginx:latest
+  filebrowser_oauth2_proxy:
+    image: quay.io/oauth2-proxy/oauth2-proxy:latest
     depends_on:
       - filebrowser_tailscale
+    environment:
+      - OAUTH2_PROXY_PROVIDER=github
+      - OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
+      - OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
+      - OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
+      - OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
+      - OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
+      - OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
+      - OAUTH2_PROXY_COOKIE_NAME=filebrowser_session
+      - OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
+      - OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
+      - OAUTH2_PROXY_COOKIE_REFRESH=60m
+      - OAUTH2_PROXY_COOKIE_SECURE=true
+      - OAUTH2_PROXY_COOKIE_HTTPONLY=false
+      - OAUTH2_PROXY_COOKIE_SAMESITE=none
+      - OAUTH2_PROXY_GITHUB_USER=brycecovert
+      - OAUTH2_PROXY_REDIRECT_URL=https://filebrowser.story-basking.ts.net/oauth2/callback
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_UPSTREAMS=http://localhost:8080
+      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
+      - OAUTH2_PROXY_REVERSE_PROXY=true
+      - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
+      - OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
+      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
+      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
+      - OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
+      - OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
+      - OAUTH2_PROXY_STANDARD_LOGGING=true
+      - OAUTH2_PROXY_AUTH_LOGGING=true
+      - OAUTH2_PROXY_REQUEST_LOGGING=true
     restart: unless-stopped
-    volumes:
-      - ./filebrowser/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd:ro
     network_mode: service:filebrowser_tailscale
 
+
   llama_tailscale:
     image: tailscale/tailscale:latest
     hostname: llama
     environment:
-      - TS_AUTHKEY=tskey-auth-kNm64Dbcts11CNTRL-4eLQjm2pQYCLdy285gNaYCFDF1KTjP71
+      - TS_AUTHKEY=$TS_AUTHKEY
       - TS_STATE_DIR=/var/lib/tailscale
       - TS_SERVE_CONFIG=/config/ts_serve.json
       - TS_USERSPACE=false
@@ -87,12 +146,40 @@ services:
       - net_raw
     restart: unless-stopped
 
-  llama_nginx:
+  llama_oauth2_proxy:
-    image: nginx:latest
+    image: quay.io/oauth2-proxy/oauth2-proxy:latest
+    container_name: llama_oauth2_proxy
     depends_on:
       - llama_tailscale
+    environment:
+      - OAUTH2_PROXY_PROVIDER=github
+      - OAUTH2_PROXY_LOGIN_URL=https://gitea.story-basking.ts.net/login/oauth/authorize
+      - OAUTH2_PROXY_REDEEM_URL=https://gitea.story-basking.ts.net/login/oauth/access_token
+      - OAUTH2_PROXY_VALIDATE_URL=https://gitea.story-basking.ts.net/api/v1/user/emails
+      - OAUTH2_PROXY_CLIENT_ID=a7bd5538-8de8-47d2-9963-fd45ce1e0498
+      - OAUTH2_PROXY_CLIENT_SECRET=gto_5qj64uruo6qs35ay3eprbpbkslwq4e7pqe4i773ye4lfzeo6gwwq
+      - OAUTH2_PROXY_COOKIE_SECRET=/kGl9ruL8N01Yx5Mj9kVFfuyTehhl3/5
+      - OAUTH2_PROXY_COOKIE_NAME=llama_session
+      - OAUTH2_PROXY_COOKIE_DOMAINS=.story-basking.ts.net
+      - OAUTH2_PROXY_COOKIE_EXPIRE=168h0m0s
+      - OAUTH2_PROXY_COOKIE_REFRESH=60m
+      - OAUTH2_PROXY_COOKIE_SECURE=true
+      - OAUTH2_PROXY_COOKIE_HTTPONLY=false
+      - OAUTH2_PROXY_COOKIE_SAMESITE=none
+      - OAUTH2_PROXY_GITHUB_USER=brycecovert
+      - OAUTH2_PROXY_REDIRECT_URL=https://llama.story-basking.ts.net/oauth2/callback
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_UPSTREAMS=http://workstation:5082
+      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
+      - OAUTH2_PROXY_REVERSE_PROXY=true
+      - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER=true
+      - OAUTH2_PROXY_PASS_ACCESS_TOKEN=true
+      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
+      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
+      - OAUTH2_PROXY_SKIP_AUTH_REGEX=^/ui
+      - OAUTH2_PROXY_SESSION_STORE_TYPE=cookie
+      - OAUTH2_PROXY_STANDARD_LOGGING=true
+      - OAUTH2_PROXY_AUTH_LOGGING=true
+      - OAUTH2_PROXY_REQUEST_LOGGING=true
     restart: unless-stopped
-    volumes:
-      - ./llama/nginx.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd:ro
     network_mode: service:llama_tailscale

filebrowser/ts_serve.json

@@ -8,7 +8,7 @@
     "filebrowser.story-basking.ts.net:443": {
       "Handlers": {
         "/": {
-          "Proxy": "http://127.0.0.1:80"
+          "Proxy": "http://127.0.0.1:4180"
         }
       }
     }

generate-cookie-secret.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+
+# Generate a secure cookie secret for oauth2-proxy
+# Cookie secret must be 16, 24, or 32 bytes when base64-decoded
+
+set -e
+
+echo "Generating OAuth2 Proxy cookie secret..."
+echo ""
+
+# Generate exactly 24 random bytes (encodes to 32 base64 chars)
+COOKIE_SECRET=$(openssl rand -base64 24 | tr -d '\n')
+
+echo "Generated Cookie Secret:"
+echo "$COOKIE_SECRET"
+echo ""
+
+# Update docker-compose.yml if it exists
+if [ -f "docker-compose.yml" ]; then
+    echo "Updating docker-compose.yml..."
+    sed -i "s|OAUTH2_PROXY_COOKIE_SECRET=.*|OAUTH2_PROXY_COOKIE_SECRET=$COOKIE_SECRET|" docker-compose.yml
+    echo "Updated OAUTH2_PROXY_COOKIE_SECRET in docker-compose.yml"
+else
+    echo "docker-compose.yml not found. Add this to your environment:"
+    echo "  OAUTH2_PROXY_COOKIE_SECRET=$COOKIE_SECRET"
+fi
+
+echo ""
+echo "Restart the oauth2-proxy container to apply:"
+echo "  docker-compose restart llama_oauth2_proxy"

llama/nginx.conf

@@ -1,48 +0,0 @@
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/mime.types;
-    default_type application/octet-stream;
-
-    gzip on;
-    gzip_vary on;
-    gzip_min_length 256;
-    gzip_proxied any;
-    gzip_types
-        application/json
-        application/javascript
-        application/xml
-        application/xml+rss
-        text/css
-        text/javascript
-        text/plain
-        text/xml;
-
-    server {
-        listen 80;
-        server_name _;
-
-        auth_basic "Restricted Access";
-        auth_basic_user_file /etc/nginx/.htpasswd;
-
-        client_max_body_size 100M;
-
-        location / {
-            proxy_pass http://workstation:5082;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-    }
-}

llama/ts_serve.json

@@ -8,7 +8,7 @@
     "llama.story-basking.ts.net:443": {
       "Handlers": {
         "/": {
-          "Proxy": "http://127.0.0.1:80"
+          "Proxy": "http://127.0.0.1:4180"
         }
       }
     }