nexus3.conf

server {
    listen 80;

    server_name 172.17.0.1;

    set $oidc_logout_path "/logout";

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Keycloak-Sec-Auth $http_x_remote_user:$http_x_remote_user_access_token;
        # proxy_set_header Authorization $http_authorization;
        # Note: make the HTTP header to be smaller
        proxy_hide_header X-Remote-User-Access-Token;

        # Passthrough the OIDC authentication when the HTTP Authorization header was specified
        if ($http_authorization ~* "^$") {
            set $oidc_realm "master";
            # Note: change the client id and secret to the actual value
            set $oidc_client_id "nexus3";
            set $oidc_client_secret "1a2bfe56-9b4b-4bf3-bda2-2dd31fed1b9a";
            # Nexus will not redirect the logout url, so we should logout in the background
            set $oidc_redirect_logout_url "false";
            set $oidc_discovery "http://172.17.0.1:8086/auth/realms/$oidc_realm/.well-known/openid-configuration";

            access_by_lua_file /etc/nginx/vhost.d/oidc.lua;
        }

        client_max_body_size 500M;
        # Disable cache of assets
        proxy_cache            off;
        proxy_read_timeout     600;
        proxy_connect_timeout  600;

        # Avoid to get address resolve error when starting
        set $target http://172.17.0.1:8903;
        proxy_pass  $target;

        # Just for debuging, you may not want it
        # header_filter_by_lua_block {
        #     for key, value in pairs(ngx.resp.get_headers()) do
        #         local val = type(value) == 'string' and {value} or value
        #         for k, v in ipairs(val) do
        #             for i=0, v:len(), 1024 do
        #                 ngx.log(ngx.DEBUG, 'Response Header: '..key..' -> '..v:sub(i + 1, i + 1024))
        #             end
        #         end
        #     end
        #     for key, value in pairs(ngx.req.get_headers()) do
        #         local val = type(value) == 'string' and {value} or value
        #         for k, v in ipairs(val) do
        #             for i=0, v:len(), 1024 do
        #                 ngx.log(ngx.DEBUG, 'Request Header: '..key..' -> '..v:sub(i + 1, i + 1024))
        #             end
        #         end
        #     end
        # }
    }

    # Override the logout action of Nexus
    location /service/rapture/session {
        if ($request_method ~* "^DELETE$") {
            # Redirect to the internal logout url
            return 302 $scheme://$host$oidc_logout_path;
        }
        # Login forbidden
        return 403;
    }
}