reverse-proxy-confs VS vouch-proxy

More reading: https://github.com/linuxserver/reverse-proxy-confs/tree/master

Linuxserver.io maintains a reverse proxy (SWAG) and they have a github repo of all the configs they support, nextcloud being one of them (ofc to do it on your own you have to merge a few of the includes they have ssl.conf, proxy.conf, etc).

According to this link, guacamole doesn't need an additional base url configuration as it already uses /guacamole by default: https://github.com/linuxserver/reverse-proxy-confs/blob/master/guacamole.subfolder.conf.sample

Glad to see you got it going. For future learning I'd recommend the sample nginx configs built by Linuxserver.io for SWAG, https://github.com/linuxserver/reverse-proxy-confs

Take a basic config, for example https://github.com/linuxserver/reverse-proxy-confs/blob/master/ghost.subdomain.conf.sample

I think swag also templates for those. You can check at https://github.com/linuxserver/reverse-proxy-confs if there is a subdomain conf for it.

Wow, this makes me appreciate linuxserver's mastodon docker so much more. Plug in your parameters and it just works. Linuxserver's swag docker is similarly one click install for nginx/reverse-proxy/certbot. It even comes with a mastodon sample conf.

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.