LDAP Access & NGINX IP Whitelisting

New Page

 

 

image.png image.png



1️⃣ load notflix.pknw1.co.uk
  • user loads https://notflix.pknw1.co.uk
  • notflix.pknw1.co.uk proxy_hiost @ proxymanager
  • is IP in not all-allowed-blacklist-failled-whitelist-attemps ACL -> quicklogin
2️⃣ attempt quicklogin
  • proxymanager advanced_config 401 detected
  • passed to error_handler in the advanced config
  • if cookie notflixuid exists, redirect user to /quicklogin
  • if cookie notflixuid does not exist, user cannot quicklogin
  • redirect user to standndar login
3️⃣ process quicklogin
  • load user_ip from current session
  • add IP to ACL
  • restart proxynaner nginx to load allowed_ips.conf
  • redirect user to notflix.pknw1.co.uk
4️⃣ process auth at /auth
  • user is locate at  /auth page
  • user login is sent api.notflix.pknw1.co.uk for authentication against LDAP
  • if the user is not_autenticated, redirect to errro 
  • if the user is authenticated, whitelist their current IP
  • redirect to notflix.pknw1.co.uk
5️⃣ process post-auth 
  • request current IP whiitelist
  • reload ACL
7️⃣ Load Jellyfin 
✅ jellyfin post-login

 
  • after login check if notflixuid cookie exists
  • if notflixuid exists, do northing
  • if notflixuid does not exist, create the notflixuid cookie enabling quicklogin

 

Load notflix.pknw1.co.uk with a vaiid user_account and a valid IP
User Loading site
  • user loads https://notflix.pknw1.co.uk
  • notflix.pknw1.co.uk proxy_hiost @ proxymanager
  • is IP in all-allowed-blacklist-failled-whitelist-attemps ACL
  • True = reverse_proxy to jellyfin:8096/
User Login to Jellyfin
  • useer enters username and password from LDAP
  • True = username is a member iof users_users group
After successful login
  • check if ookie notflixuid exists
  • True = no_action
  • False = create cookie notflixuid for .pknw1.co.uk valid 1 year

aaaa

Load notflix.pknw1.co.uk with a vaiid user_account and an invalid IP

 

Quicklogin initial configuration

Access Layers

Authentication and.Access

ovh.png

OVH Service

image.png

proxymanager

proxymanager-admin
ovh.png
IP.png 
IP.png
tailscale.png

tailscale.png

Tailscale

100.100.69.0/16
image.png

Proxy

172.22.20.0/16
image.png

Admin

172.22.22.0/16

 


image.png

 

/home/apps/core

 

 - ./api.notflix.pknw1.co.uk/docker-compose.yml
 - ./caddy/docker-compose.yml
 - ./internal-proxy/docker-compose.yml
 - ./proxymanager-admin/docker-compose.yml
 - ./dockmon/docker-compose.yml
 - ./lldap/docker-compose.yml
 - ./proxymanager/docker-compose.yml
 - ./squid/docker-compose.yml
 - ./pihole/docker-compose.yml

 

Service
Docker
api.notflix proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
caddy proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
internal_proxy proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
proxymanafer proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
proxymanager-admin proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
dockmon proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
lldap proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
pihole proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1
squid proxy/172.22.20.1
dmz/172.22.21.1
admin/172.22.22.1






 

/home/apps/frontend

 

 

 

/home/apps/backend

 

 

/home/apps/user-apps

 

 

/home/apps/admin-apps