NPM con OAuth2 Authorization Code usando OAuth2-Proxy

# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "upgrade";
auth_request /oauth2/auth;
proxy_set_header X-Auth-Request-Redirect $request_uri;

error_page 401 = /oauth2/sign_in?rd=$scheme://$host$request_uri;
error_page 403 = /oauth2/sign_in?rd=$scheme://$host$request_uri;

auth_request_set $user   $upstream_http_x_auth_request_user;
auth_request_set $email  $upstream_http_x_auth_request_email;
auth_request_set $username $upstream_http_x_auth_request_preferred_username;
auth_request_set $groups $upstream_http_x_auth_request_groups;
auth_request_set $token  $upstream_http_x_auth_request_access_token;

proxy_set_header X-User-ID  $user;
proxy_set_header X-Email $email;
proxy_set_header X-Username $username;
proxy_set_header X-Groups $groups;    
proxy_set_header X-Access-Token $token;

client_body_buffer_size 256M;
proxy_read_timeout 600;
proxy_connect_timeout 600;
proxy_send_timeout 600;
client_header_timeout 600s;
client_body_timeout 600s;
proxy_request_buffering off;

location /oauth2/auth {
  internal;
  proxy_pass http://oauth_proxy_i40sys-proxy-1:4180;

  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_set_header Content-Length "";
  proxy_pass_request_body off;
}

location /oauth2/ {
  proxy_pass http://oauth_proxy_i40sys-proxy-1:4180;

  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_set_header X-Auth-Request-Redirect $request_uri;
}

location /access-token/validation {
  internal;
  proxy_method GET;
  proxy_pass https://iam_i40sys-keycloak-1:8443/realms/observability/protocol/openid-connect/userinfo;

  proxy_set_header Host iam.i40sys.com;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Scheme $scheme;
  proxy_set_header Content-Length "";
  proxy_pass_request_body off;
}

location ~ ^/(api|prometheus)/ {
  proxy_pass http://observability_i40sys-mimir-1$request_uri;
  auth_request /access-token/validation;

  # proxy_set_header Upgrade $http_upgrade;
  # proxy_set_header Connection "upgrade";
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  
  auth_request_set $user $upstream_http_x_auth_request_user;
  proxy_set_header X-User-ID $user;
  auth_request_set $email $upstream_http_x_auth_request_email;
  proxy_set_header X-Email $email;
  auth_request_set $username $upstream_http_x_auth_request_preferred_username;
  proxy_set_header X-Username $username;
  auth_request_set $groups $upstream_http_x_auth_request_groups;
  proxy_set_header X-Groups $groups;
  auth_request_set $token $upstream_http_x_auth_request_access_token;
  proxy_set_header X-Access-Token $token;
}

services:
  nginx-reverse-proxy:
    image: 'lepresidente/nginxproxymanager:latest'
		...
    volumes:
      - "/data/rproxy/data:/data"
    ...

name: oauth_proxy_i40sys

x-logging:
  &default-logging
  driver: "json-file"
  options:
    max-size: "10m"
    max-file: "1"

services:
  redis:
    image: redis:alpine
    # container_name: redis
    networks:
      - private
    volumes:
      - /docker-data/oauth2-proxy.i40sys/redis:/data  # Optional: for data persistence
    logging: *default-logging
    
  proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
    command: --config=/oauth2-proxy.cfg --code-challenge-method=S256
    environment:
      - OAUTH2_PROXY_COOKIE_SECRET=LJAxLJAxLJAxLJAxLJAxMQ==
      - OAUTH2_PROXY_BACKEND_LOGOUT_URL=https://iam.i40sys.com/realms/observability/protocol/openid-connect/logout?id_token_hint={id_token}
    networks:
      - private
      - proxy-network
    volumes:
      - /docker-data/oauth2-proxy.i40sys/config/oauth2-proxy.cfg:/oauth2-proxy.cfg
    depends_on:
      - redis
    logging: *default-logging
networks:
  private:
  proxy-network:
    name: services
    external: true

## OAuth2 Proxy Config File
## https://github.com/oauth2-proxy/oauth2-proxy

http_address="0.0.0.0:4180"
reverse_proxy = true
redirect_url="https://proxy.i40sys.com/oauth2/callback"

standard_logging = true
standard_logging_format = "[{{.Timestamp}}] [{{.File}}] {{.Message}}"
request_logging = true
request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
auth_logging = true
auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"

pass_user_headers = true
email_domains = "*"

client_id = "oauth2_proxy"
client_secret = "kxRSwAqJqcxoB4GJ7LaeUJ9n3ymJBljh"

pass_access_token = true
cookie_name = "oauth2_proxy_i40sys"
# cookie_secret = ""
cookie_domains = ".i40sys.com"
# cookie_expire = "168h"
cookie_refresh = "5m"
cookie_secure = true
cookie_httponly = false

whitelist_domains = [
    "iam.i40sys.com:*",
    "*.i40sys.com:*",
    "*:*"
]

oidc_issuer_url = "https://iam.i40sys.com/realms/observability"
provider = "oidc"
provider_display_name = "Keycloak"
skip_provider_button = "true"
set_authorization_header = true
set_xauthrequest =  true

cookie_csrf_per_request=true
cookie_csrf_expire="5m"
cookie_samesite="lax"

session_store_type="redis"
redis_connection_url="redis://redis:6379"

show_debug_on_error=true