36 lines
810 B
Bash
36 lines
810 B
Bash
|
#!/bin/sh
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
auth_file=/etc/caddy/auth.caddy
|
||
|
|
username="${CADDY_BASIC_AUTH_USERNAME:-}"
|
||
|
|
password="${CADDY_BASIC_AUTH_PASSWORD:-}"
|
||
|
|
|
||
|
|
if [ -z "$username" ] && [ -z "$password" ]; then
|
||
|
|
: > "$auth_file"
|
||
|
|
exit 0
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -z "$username" ] || [ -z "$password" ]; then
|
||
|
|
printf 'CADDY_BASIC_AUTH_USERNAME and CADDY_BASIC_AUTH_PASSWORD must both be set.\n' >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
case "$username" in
|
||
|
|
*[!A-Za-z0-9._@-]*)
|
||
|
|
printf 'CADDY_BASIC_AUTH_USERNAME contains unsupported characters.\n' >&2
|
||
|
|
exit 1
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
|
||
|
|
password_hash="$(/usr/local/bin/caddy hash-password --plaintext "$password")"
|
||
|
|
cat > "$auth_file" <<EOF
|
||
|
|
@protected {
|
||
|
|
not path /healthz
|
||
|
|
not path_regexp public ^(/[^/]+/[^/]+\.git/.*|/api/packages(/.*)?)$
|
||
|
|
}
|
||
|
|
|
||
|
|
basic_auth @protected {
|
||
|
|
$username $password_hash
|
||
|
|
}
|
||
|
|
EOF
|