nginx.conf

worker_processes 1;
events { worker_connections 1024; }

http {
    upstream webhosting {
        server webhosting:8000;
    }

    server {
        listen 80;

        location /oauth2/ {
            proxy_pass http://oauth2-proxy:4180;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Scheme $scheme;
            proxy_set_header X-Auth-Request-Redirect $request_uri;
        }

        location / {
            auth_request /oauth2/auth;
            error_page 401 = /oauth2/start;

            # Preserve user and email from upstream
            auth_request_set $user $upstream_http_x_auth_request_user;
            auth_request_set $email $upstream_http_x_auth_request_email;
            proxy_set_header X-User $user;
            proxy_set_header X-Email $email;

            # Pass authenticated requests to the Flask app
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Scheme $scheme;

            # Pass OAuth2 Proxy Auth Headers
            auth_request_set $auth_cookie $upstream_http_set_cookie;
            proxy_set_header Authorization $http_authorization;
            proxy_set_header X-Auth-Request-Access-Token $http_authorization;

            proxy_pass http://webhosting;
        }
    }
}