NGINX Google OAuth Access Control, VPN and permissions
Budget: €30 – €250 EUR
We are not using WordPress or similars.
We are self-hosted on OVH.
We have:
- 1 OVH VPS 6 vcores, 12GB of RAM, 100GB of space, OS debian 13
- 1 OVH VPS to use as a VPN server, OS debian 13
- Cloudflare for SSL and such
You will not have access to the VPS info since we want to keep everything as private as possible, this work is not intended for public use, only for our team's access. Still, some blocks might be public so we don't want to lockdown every single nginx block, only the selected ones.
REQUIREMENTS:
For NGINX, we will use NGINX 1.28.0, one of the latest stable for this debian version. There is no sites-available folder etc, they got removed in the new versions.
Nginx main folder: /etc/nginx
Websites folders: /usr/share/nginx/
All traffic and ports have been bound to cloudflare, make sure it doesn't interfere with VPN connection and such.
Also, we will have applications and other stuff inside there, please make it so that those applications can communicate correctly, for example if we have a PHPMYADMIN managing an external database server or similars, make sure that everything goes through correctly.
The internal (machine) traffic should not be affected by these protections, but still protect from external malicious accesses and glitches to get inside.
HOW TO ACCESS:
Traffic goes to Cloudflare >
Checks wether or not we are connected to the VPN server > IF NO, they literally cannot connect to the domain at all
PERMITTED USER OAuth check > IF NO, "error page or whatever, just no access"
NGINX gets confirmation of OAuth > IF NO, "error page or whatever, just no access"
Person has permission for block "blockname" > IF NO, "you don't have permission" page
Person can login into the blocks
No workarounds or exploits permitted to get into the system.
We want to gate every request with Google OAuth if that's the best option, we choose that one because it's easy for our team to use. Once a user signs in with a valid Google account, NGINX should pass the traffic through, otherwise it must return the correct 4xx response.
The user will also have to be using the VPN to be able to access the webpage. If they don't, they will not even be able to see the protected nginx blocks. Please note that not all of the blocks and domains will be locked, like public.domain.com or similars will be open to the public.
Please explain us how to lock something with OAuth or VPN or BOTH.
These multiple blocks, like test1.domain.com test2.domain.com etc, will have to remember the previous oauth but avoid workarounds to bypass security. We would like to avoid the token grabber thing they still have on discord or similar incidents if possible.
The login status can be on for max X hours (a time we can choose) after which they will have to login again, we should not be staying for long periods of time on these pages anyways, only for a few tasks.
Additionally, we would like to have some "permission system" or more a "list" of users that can access the test1 block, the test2 one, the admin block etc.
HOW TO REGISTER:
The registration form can only be sent/shown manually, everything here will be used for admin pages etc. so we don't want any random person registering without our permission. If it's possible to add emails manually or to do something to make this work it's perfect, we will have multiples members on the team to add, not just one Admin user.
WHAT WE NEED:
• Tell us whatever we need to install for the system to work (ex. php-xampp, fpm, python or whatever).
• A clean, copy-and-paste NGINX configuration (or companion container) that plugs Google OAuth into the standard auth_request flow.
• Clear instructions on any requirement.
• A short README showing how to register the Google OAuth credentials, where to set client ID/secret, and how to test the flow locally with curl or a browser.
• The vpn system explanation and configs.
• Security tests on possible workarounds etc.
• Any additional config needed or explained
I’ll handle the Google Cloud console work myself; I just need the working config and a quick walkthrough. When you respond, focus on the similar NGINX-based OAuth jobs you’ve completed so I can gauge your experience.
ACCEPTANCE
I will consider the job done once I can:
1. add my own address, sign in with Google, and reach the protected page;
2. remove my address, reload, and immediately lose access;
3. attempt access from an unlisted account and not be able to;
4. run the same three checks from inside the VPN with identical results.
5. run the same checks from an account without permission access to the blocks.
We are self-hosted on OVH.
We have:
- 1 OVH VPS 6 vcores, 12GB of RAM, 100GB of space, OS debian 13
- 1 OVH VPS to use as a VPN server, OS debian 13
- Cloudflare for SSL and such
You will not have access to the VPS info since we want to keep everything as private as possible, this work is not intended for public use, only for our team's access. Still, some blocks might be public so we don't want to lockdown every single nginx block, only the selected ones.
REQUIREMENTS:
For NGINX, we will use NGINX 1.28.0, one of the latest stable for this debian version. There is no sites-available folder etc, they got removed in the new versions.
Nginx main folder: /etc/nginx
Websites folders: /usr/share/nginx/
All traffic and ports have been bound to cloudflare, make sure it doesn't interfere with VPN connection and such.
Also, we will have applications and other stuff inside there, please make it so that those applications can communicate correctly, for example if we have a PHPMYADMIN managing an external database server or similars, make sure that everything goes through correctly.
The internal (machine) traffic should not be affected by these protections, but still protect from external malicious accesses and glitches to get inside.
HOW TO ACCESS:
Traffic goes to Cloudflare >
Checks wether or not we are connected to the VPN server > IF NO, they literally cannot connect to the domain at all
PERMITTED USER OAuth check > IF NO, "error page or whatever, just no access"
NGINX gets confirmation of OAuth > IF NO, "error page or whatever, just no access"
Person has permission for block "blockname" > IF NO, "you don't have permission" page
Person can login into the blocks
No workarounds or exploits permitted to get into the system.
We want to gate every request with Google OAuth if that's the best option, we choose that one because it's easy for our team to use. Once a user signs in with a valid Google account, NGINX should pass the traffic through, otherwise it must return the correct 4xx response.
The user will also have to be using the VPN to be able to access the webpage. If they don't, they will not even be able to see the protected nginx blocks. Please note that not all of the blocks and domains will be locked, like public.domain.com or similars will be open to the public.
Please explain us how to lock something with OAuth or VPN or BOTH.
These multiple blocks, like test1.domain.com test2.domain.com etc, will have to remember the previous oauth but avoid workarounds to bypass security. We would like to avoid the token grabber thing they still have on discord or similar incidents if possible.
The login status can be on for max X hours (a time we can choose) after which they will have to login again, we should not be staying for long periods of time on these pages anyways, only for a few tasks.
Additionally, we would like to have some "permission system" or more a "list" of users that can access the test1 block, the test2 one, the admin block etc.
HOW TO REGISTER:
The registration form can only be sent/shown manually, everything here will be used for admin pages etc. so we don't want any random person registering without our permission. If it's possible to add emails manually or to do something to make this work it's perfect, we will have multiples members on the team to add, not just one Admin user.
WHAT WE NEED:
• Tell us whatever we need to install for the system to work (ex. php-xampp, fpm, python or whatever).
• A clean, copy-and-paste NGINX configuration (or companion container) that plugs Google OAuth into the standard auth_request flow.
• Clear instructions on any requirement.
• A short README showing how to register the Google OAuth credentials, where to set client ID/secret, and how to test the flow locally with curl or a browser.
• The vpn system explanation and configs.
• Security tests on possible workarounds etc.
• Any additional config needed or explained
I’ll handle the Google Cloud console work myself; I just need the working config and a quick walkthrough. When you respond, focus on the similar NGINX-based OAuth jobs you’ve completed so I can gauge your experience.
ACCEPTANCE
I will consider the job done once I can:
1. add my own address, sign in with Google, and reach the protected page;
2. remove my address, reload, and immediately lose access;
3. attempt access from an unlisted account and not be able to;
4. run the same three checks from inside the VPN with identical results.
5. run the same checks from an account without permission access to the blocks.