appname = casdoor
httpport = 8080
runmode = dev #run casdoor in development mode
SessionOn = true
copyrequestbody = true
driverName = mysql
dataSourceName = your_username:your_sql_pwd@tcp(your_host:3306)/your_dbName
# dbName = casdoor
tableNamePrefix =
showSql = false
redisEndpoint =
defaultStorageProvider =
isCloudIntranet = false
authState = "casdoor"
socks5Proxy = (optional)# if you need google log in 
verificationCodeTimeout = 10
initScore = 2000
logPostOnly = false
origin = your_host
staticBaseUrl = "https://cdn.casbin.org"
enableGzip = true

docker run  -p 8000:8000 -v /folder/of/app.conf:/conf casbin/casdoor:latest

admin
123

### 1.转到 GitHub Releases 页面，下载与您的操作系统和 CPU 架构对应的二进制包。 截至 2024 年 1 月 1 日，OAuth-Proxy 的最新版本为 。如果要下载此版本的二进制软件包，可以对带有 AMD64 的 Linux 执行以下命令：V7.5.1
wget -O oauth2-proxy-linux.tar.gz https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.5.1/oauth2-proxy-v7.5.1.linux-amd64.tar.gz

### 2.解压缩下载的包：
tar -zxvf oauth2-proxy-*.tar.gz

### 3.输入解压目录：
cd oauth2-proxy-v7.5.1.linux-amd64 

### 4.将获取的二进制文件移动到并配置可执行权限。根据您的具体情况，您可能需要提升权限。/usr/local/binsudo
cp ./oauth2-proxy /usr/local/bin
cd /usr/local/bin
chmod +x ./oauth2-proxy

### 5.测试二进制安装。如果安装成功，在执行以下命令后，您应该会看到类似于 的输出。oauth2-proxy v7.5.1 (built with go1.21.1)
cd ~
oauth2-proxy --version

oauth2-proxy \ 
--provider=oidc \ #[required] Do not change
--client-id=abc123456def \ #[required] "Client ID" obtained in step I.4 above
--client-secret=abc123456def \ #[required] "Client Secret" obtained in step I.4 above
--oidc-issuer-url=https://auth.yourdomain.com \ #[required] Your Casdoor URL (domain name or public IP)
--redirect-url=https://project.yourdomain.com/oauth2/callback \ #[required] https://domain-of-the-project-to-protect/oauth2/callback 
--scope=email+profile+groups+openid \ #[required] Obtained from Casdoor: user email, user profile, groups, and login authentication
--cookie-domain=project.yourdomain.com \ #[required] Domain name of the project you want to protect
--whitelist-domain=project.yourdomain.com \ #[required] Domain name of the project you want to protect
--cookie-secret=abc123456def \ #[required] Please generate a random string of numbers and letters and fill it in here
--email-domain=* \ #[required] List of acceptable user email domains (* means accept all domains). If the user's email suffix is not in this list, a 403 error will be returned even if the login is successful.
--insecure-oidc-allow-unverified-email=true \ #[required] Whether to accept users with unverified email addresses
--http-address=http://127.0.0.1:65534 \ #[required] Address that oauth2-proxy listens on. The port number here can be set arbitrarily. Please record the value you set, as it will be needed for configuring Nginx later.
--cookie-expire=24h0m0s \ #[optional] Cookie expiration time. After this period, users will need to log in again.
--custom-sign-in-logo=https://cdn.yourdomain.com/pic/proj.png \ #[optional] Icon displayed on the login page. It is recommended to use a rectangular image rather than a square one.
--session-store-type=redis \ #[optional] Use Redis cache. If you don't need Redis, you can delete this item.
--redis-connection-url=redis://127.0.0.1:6379/0 \ #[optional] Redis URL. If you don't need Redis, you can delete this item.
--redis-password=123456 #[optional] Redis connection password. If you don't need Redis or Redis has no password, you can delete this item.
----skip-provider-button=true #[optional] 

# 1.修改配置文件

vi /www/server/panel/install/nginx.sh

# 2.找到第 250-300 行之间 ./configure 开头如下字样的配置，我这里是在安装 ngx-fancyindex 模块，所以增加 --with-http_auth_request_module  ：

./configure --user=www --group=www --prefix=${Setup_Path} ${ENABLE_LUA} --add-module=${Setup_Path}/src/ngx_cache_purge ${ENABLE_STICKY} --with-openssl=${Setup_Path}/src/openssl --with-pcre=pcre-${pcre_version} ${ENABLE_HTTP2} --with-http_stub_status_module --with-http_ssl_module --with-http_image_filter_module --with-http_gzip_static_module --with-http_gunzip_module --with-ipv6 --with-http_sub_module --with-http_flv_module --with-http_addition_module --with-http_realip_module --with-http_mp4_module --with-http_auth_request_module --add-module=${Setup_Path}/src/ngx_http_substitutions_filter_module-master --with-ld-opt="-Wl,-E" --with-cc-opt="-Wno-error" ${jemallocLD} ${ENABLE_WEBDAV} ${ENABLE_NGX_PAGESPEED} ${ADD_EXTENSION} ${i_make_args}
    make -j${cpuCore}
}

# 3.重新编译安装

sh /www/server/panel/install/nginx.sh install your_nginx_version

# 4.检查是否正确安装

nginx -V

正常输出将会包含  --with-http_auth_request_module

location ^~ /oauth2/ {

        proxy_pass       http://127.0.0.1:8011; # Change this to the "--http-address" configured in step II.6

        proxy_set_header Host                    $host;
        proxy_set_header X-Real-IP               $remote_addr;
        proxy_set_header X-Scheme                $scheme;

        proxy_set_header X-Auth-Request-Redirect $request_uri;
        # or, if you are handling multiple domains:
        # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
    }
    location = /oauth2/auth {
        
        proxy_pass       http://127.0.0.1:8011; # Change this to the "--http-address" configured in step II.6

        proxy_set_header Host             $host;
        proxy_set_header X-Real-IP        $remote_addr;
        proxy_set_header X-Scheme         $scheme;
        proxy_set_header Content-Length   "";
        proxy_pass_request_body           off;
    }
    location ^~ /
{
   
    proxy_pass http://127.0.0.1:9003;# Change this to your app's url
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header REMOTE-HOST $remote_addr;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_http_version 1.1;
    # proxy_hide_header Upgrade;

    add_header X-Cache $upstream_cache_status;
    #Set Nginx Cache

    set $static_filefp9pXqS2 0;
    if ( $uri ~* "\.(gif|png|jpg|css|js|woff|woff2)$" )
    {
        set $static_filefp9pXqS2 1;
        expires 1m;
    }
    if ( $static_filefp9pXqS2 = 0 )
    {
        add_header Cache-Control no-cache;
    }
}