Serving behind a proxy

[badarsebard]

I'm using fief for a kubernetes application and would like to serve it behind an nginx proxy. There are two issues with this: first the use of subdomains for the workspaces and second the app can't currently be served from a URL prefix. It would be ideal if I could host the fief application under a single domain and URL prefix like mydomain.local/fief/.

As far as implementation the FastAPI app can take and argument root_path that serves all endpoints under a prefix. The react app will need something more dynamic since if I understand correctly it builds during the pypi package install. These would take care of serving under a URL prefix. I have no idea about the subdomains though. Would it be possible to fold the workspaces into the URL structure. For instance domain.org/{workspace}/admin/

[fief-bailiff[bot]]

Hail, @badarsebard 👋 Welcome to Fief's kingdom!

Our team will get back to you very soon to help.

In the meantime, take a minute to star our repository ⭐️

Farewell!

[frankie567]

Hi @badarsebard 👋

Handling arbitrary path prefix would be quite difficult with our current implementation since the prefix is used for Tenants: you can have several tenants in one workspace:

• The default: example.fief.dev
• A first one: example.fief.dev/client1
• Another one: example.fief.dev/client2

There are also lot of difficulties with URL generation.

Currently, I don't really see how it would be possible without breaking everything 🤔

[frankie567]

An idea though:

I'm not really versed into Nginx rewrites but, could it be configured so when it receives this URL:

domain.org/fief/workspace/admin

It rewrites the Host and URL like this:

Host: workspace.domain.org
URL: workspace.domain.org/admin

[badarsebard]

So I have managed to get rewrites to work so that domain.org/fief/admin/ points to the container running fief as domain.org/admin/. The issue is the browser is making requests to the domain/urls fief thinks it's serving on. For instance after making the request to /fief/admin/ the browser requests /favincon.png, not /fief/favicon.png.

[frankie567]

Yes, that's why it's quite hard to get it working like this. There will also be probably issues with URL generation when reaching .well-known/openid-configuration 🤔