nginx.conf

upstream upstream_app {
    server app:3000;
}

server {
  listen 80;

  location /oauth2/ {
    proxy_pass       http://oauth2-proxy:4180;
    proxy_set_header X-Forwarded-Uri $http_x_forwarded_uri;
  }

  location = /oauth2/auth {
    internal;
    proxy_pass       http://oauth2-proxy:4180;
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    # if user is not logged in, then process request anyway (the "=" sign lets the app backend reset the response status code)
    error_page 401 403 = @allow_unauthenticated;
    # read headers from OAuth2 proxy into variables
    auth_request_set $user        $upstream_http_x_auth_request_user;
    auth_request_set $email       $upstream_http_x_auth_request_email;
    auth_request_set $groups      $upstream_http_x_auth_request_groups;
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    # tell backend who is logged in
    proxy_set_header X-User $user;
    proxy_set_header X-Email $email;
    proxy_set_header X-Groups $groups;
    # set auth cookie for frontend
    add_header Set-Cookie $auth_cookie;

    proxy_pass http://upstream_app;
  }

  location @allow_unauthenticated {
    # clear auth headers to prevent impersonation/forgery
    proxy_set_header X-User '' ;
    proxy_set_header X-Email '';
    proxy_set_header X-Groups '';
    proxy_pass http://upstream_app;
  }
}

# example ingress config (replace %APP_PATH% with actual path):
# server {
#     listen 80;
#     server_name localhost;

#     location /%APP_PATH%/ {
#         rewrite  ^  $request_uri;            # get original URI
#         rewrite ^/%APP_PATH%/(.*)$ /$1 break; # remove app path
#         return 400; #if the second rewrite won't match
#         proxy_pass http://localhost:8089$uri; # this way, nginx does not "sanitize" the request path and does not remove the double slashes we need in the backend
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_set_header X-Forwarded-Host  $host;
#         proxy_set_header X-Forwarded-Uri     /%APP_PATH%;
        
#         proxy_cookie_path / /%APP_PATH%/;
#     }
# }