nginx-proxy VS vouch-proxy

setting up letsencrypt with nginx-proxy and acme-companion

Here is the link, sorry😅

Shit... Here is the link: https://github.com/nginx-proxy/nginx-proxy

I use the nginx-proxy image and it's acme companion image for automated reverse proxy configuration and certbot.

I'm experiencing a weird situation, and am not sure how to go about finding a solution. I am running the nginx-proxy container (https://github.com/nginx-proxy/nginx-proxy) together with the acme-companion container (https://github.com/nginx-proxy/acme-companion) to provide https connections to all my different applications under different subdomains on the same host (currently, for testing purposes: only two other nginx containers with a plain html page).

https://github.com/nginx-proxy/nginx-proxy for reverse proxy

I currently use this (https://github.com/nginx-proxy/nginx-proxy) and I was able to configure anything via env vars. Some minor nginx include files were needed tho. But no UI. So far I was stunned that it works so well. Deploy a new container add 2 env vars. Done. With automated SSL.

We use the nginx-proxy docker image with its acme-companion to have an auto configuring SSL reverse proxy, so it's really easy to deploy images (we do it based on a merge PR into protected release branches).

We use Traefik for Configuration Discovery in Docker Swarm (add a label with the sub-domain to the service and it will automatically be routed to), for simple setup I always found nginx-proxy to be easy to use with containers.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.

I'm using vouch proxy on my Kubernetes cluster and I delegate to a separate IdP (usually GitHub.)

You can't use keycloak direct with auth requests - you need an intermediary they can bridge the gap (or a custom build of Nginx, but that is a pain in the ass). I use Vouch Proxy: https://github.com/vouch/vouch-proxy

Yes. Keycloak, for one: https://www.keycloak.org

I've also heard good things about Hydra: https://www.ory.sh/hydra/

Depending on your needs, an SSO proxy like Vouch works well for internal services: https://github.com/vouch/vouch-proxy

There's also an abundance of libraries for different programming languages to implement authentication or authorisation, lots of them battle-tested by thousands of services. It's not like providing secure services is impossible without Okta.