Initial commit.

cmd/google-auth-proxy/main.go

@@ -0,0 +1,79 @@
+// Command google-auth-proxy is a small Google OAuth SSO service designed to
+// sit behind nginx's auth_request module. The dokku google-auth plugin runs
+// one instance of it per host and points every protected app's nginx config
+// at it.
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"dokku-google-auth/internal/authproxy"
+)
+
+func main() {
+	healthcheck := flag.Bool("healthcheck", false, "probe the locally running server and exit 0 if healthy")
+	flag.Parse()
+
+	if *healthcheck {
+		os.Exit(runHealthcheck())
+	}
+
+	cfg, err := authproxy.ConfigFromEnv()
+	if err != nil {
+		log.Fatalf("configuration error: %v", err)
+	}
+
+	server, err := authproxy.New(cfg)
+	if err != nil {
+		log.Fatalf("startup error: %v", err)
+	}
+
+	httpServer := &http.Server{
+		Addr:              cfg.ListenAddr,
+		Handler:           server.Routes(),
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	shutdown := make(chan os.Signal, 1)
+	signal.Notify(shutdown, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		<-shutdown
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		_ = httpServer.Shutdown(ctx)
+	}()
+
+	log.Printf("google-auth-proxy listening on %s (auth host: %s)", cfg.ListenAddr, cfg.AuthHost)
+	if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		log.Fatalf("server error: %v", err)
+	}
+}
+
+func runHealthcheck() int {
+	addr := os.Getenv("GOOGLE_AUTH_LISTEN")
+	if addr == "" {
+		addr = ":2999"
+	}
+	if strings.HasPrefix(addr, ":") {
+		addr = "127.0.0.1" + addr
+	}
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, err := client.Get("http://" + addr + "/_google-auth/healthz")
+	if err != nil {
+		return 1
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return 1
+	}
+	return 0
+}