====== Use Authelia to login to LMS ======

Relevant parts of the lms config file:

<code>
# Listen port/addr of the web server
listen-port = 5082;
listen-addr = "127.0.0.1";
behind-reverse-proxy = true;
# original-ip-header and trusted-proxies are used only if behind-reverse-proxy is set to true
original-ip-header = "X-Forwarded-For";
trusted-proxies =
(
        "127.0.0.1",
        "::1"
);

# Authentication
# Available backends: "internal", "PAM", "http-headers"
authentication-backend = "http-headers";
# The number of bcrypt rounds to be used when backend is set to "internal". The higher the more secure
internal-password-bcrypt-round = 12;
# The header to be used to read the authentication user when backend is set to "http-headers"
http-headers-login-field = "Remote-User";
</code>

nginx server file:

<code nginx>
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    ssl_certificate     /path/to/certificate.crt;
    ssl_certificate_key /path/to/certificate.key;
    server_name lms.mydomain.tld;
    access_log /var/log/nginx/lms.mydomain.tld-access.log;
    error_log  /var/log/nginx/lms.mydomain.tld-error.log;
    large_client_header_buffers 4 8k;
    add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header X-Download-Options noopen;
    add_header X-Permitted-Cross-Domain-Policies none;
    add_header Referrer-Policy no-referrer;
    
    

    location = /internal/authelia/authz {
        internal;
        proxy_pass http://127.0.0.1:9091/api/authz/auth-request;

        proxy_set_header X-Original-Method $request_method;
        proxy_set_header X-Original-URL $scheme://$host$request_uri;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Content-Length "";
        proxy_set_header Connection "";

        # Basic Proxy Configuration
        proxy_pass_request_body off;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
        proxy_redirect http:// https://;
        proxy_http_version 1.1;
        proxy_cache_bypass $cookie_session;
        proxy_no_cache $cookie_session;
        proxy_buffers 4 32k;
        client_body_buffer_size 128k;

        # Advanced Proxy Configuration
        send_timeout 5m;
        proxy_read_timeout 240;
        proxy_send_timeout 240;
        proxy_connect_timeout 240;
    }
    
    # Proxy LMS
    set $upstream http://127.0.0.1:5082;
    
    location / {
        # Headers
        proxy_set_header Host $host;
        proxy_set_header X-Original-URL $scheme://$host$request_uri;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-URI $request_uri;
        proxy_set_header X-Forwarded-Ssl on;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        
        # Basic Proxy Configuration
        client_body_buffer_size 128k;
        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; ## Timeout if the real server is dead.
        proxy_redirect  http://  $scheme://;
        proxy_http_version 1.1;
        proxy_cache_bypass $cookie_session;
        proxy_no_cache $cookie_session;
        proxy_buffers 64 256k;
        
        # Trusted Proxies Configuration
        real_ip_header X-Forwarded-For;
        real_ip_recursive on;
        
        # Advanced Proxy Configuration
        send_timeout 5m;
        proxy_read_timeout 360;
        proxy_send_timeout 360;
        proxy_connect_timeout 360;
        
        # Send a subrequest to Authelia to verify if the user is authenticated and has permission to access the resource.
        auth_request /internal/authelia/authz;
        
        # Save the upstream metadata response headers from Authelia to variables.
        auth_request_set $user $upstream_http_remote_user;
        
        # Inject the metadata response headers from the variables into the request made to the backend.
        proxy_set_header Remote-User $user;
        
        # Modern Method: Set the $redirection_url to the Location header of the response to the Authz endpoint.
        auth_request_set $redirection_url $upstream_http_location;
        
        # Modern Method: When there is a 401 response code from the authz endpoint redirect to the $redirection_url.
        error_page 401 =302 $redirection_url;
        
        proxy_pass $upstream;
    }
    
    # The access for subsonic clients is managed via LMS' login system, because they don't support header forwarding
    location /rest/ {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header Host $host;
        proxy_max_temp_file_size 0;
        proxy_pass $upstream;
        proxy_read_timeout  120;
        proxy_redirect http:// https://;
    }
}
</code>