From 9e93cb1acbbb0a5ab5605556bebb6540dcccc099 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 24 Oct 2023 19:02:57 +0000 Subject: [PATCH] Update documentation based on dcf3bd1bcf83cad07f39ecf3ded129339570088d --- 404.html | 8 ++++---- .../js/{0f425520.3de858f9.js => 0f425520.06fae793.js} | 2 +- .../js/{e7cb9657.4a6bd425.js => e7cb9657.42f19412.js} | 2 +- assets/js/{main.30b04635.js => main.4bdab2e9.js} | 4 ++-- ...635.js.LICENSE.txt => main.4bdab2e9.js.LICENSE.txt} | 0 ...ntime~main.3f651c82.js => runtime~main.e6219104.js} | 2 +- docs/6.1.x/behaviour/index.html | 8 ++++---- docs/6.1.x/community/security/index.html | 8 ++++---- docs/6.1.x/configuration/oauth_provider/index.html | 8 ++++---- docs/6.1.x/configuration/overview/index.html | 8 ++++---- docs/6.1.x/configuration/session_storage/index.html | 8 ++++---- docs/6.1.x/configuration/tls/index.html | 8 ++++---- docs/6.1.x/features/endpoints/index.html | 8 ++++---- docs/6.1.x/features/request_signatures/index.html | 8 ++++---- docs/6.1.x/index.html | 8 ++++---- docs/7.0.x/behaviour/index.html | 8 ++++---- docs/7.0.x/community/security/index.html | 8 ++++---- docs/7.0.x/configuration/alpha-config/index.html | 8 ++++---- docs/7.0.x/configuration/oauth_provider/index.html | 8 ++++---- docs/7.0.x/configuration/overview/index.html | 8 ++++---- docs/7.0.x/configuration/session_storage/index.html | 8 ++++---- docs/7.0.x/configuration/tls/index.html | 8 ++++---- docs/7.0.x/features/endpoints/index.html | 8 ++++---- docs/7.0.x/features/request_signatures/index.html | 8 ++++---- docs/7.0.x/index.html | 8 ++++---- docs/7.1.x/behaviour/index.html | 8 ++++---- docs/7.1.x/community/security/index.html | 8 ++++---- docs/7.1.x/configuration/alpha-config/index.html | 8 ++++---- docs/7.1.x/configuration/oauth_provider/index.html | 8 ++++---- docs/7.1.x/configuration/overview/index.html | 8 ++++---- docs/7.1.x/configuration/session_storage/index.html | 8 ++++---- docs/7.1.x/configuration/tls/index.html | 8 ++++---- docs/7.1.x/features/endpoints/index.html | 8 ++++---- docs/7.1.x/index.html | 8 ++++---- docs/7.2.x/behaviour/index.html | 8 ++++---- docs/7.2.x/community/security/index.html | 8 ++++---- docs/7.2.x/configuration/alpha-config/index.html | 8 ++++---- docs/7.2.x/configuration/oauth_provider/index.html | 8 ++++---- docs/7.2.x/configuration/overview/index.html | 8 ++++---- docs/7.2.x/configuration/session_storage/index.html | 8 ++++---- docs/7.2.x/configuration/tls/index.html | 8 ++++---- docs/7.2.x/features/endpoints/index.html | 8 ++++---- docs/7.2.x/index.html | 8 ++++---- docs/7.3.x/behaviour/index.html | 8 ++++---- docs/7.3.x/community/security/index.html | 8 ++++---- docs/7.3.x/configuration/alpha-config/index.html | 8 ++++---- docs/7.3.x/configuration/oauth_provider/index.html | 8 ++++---- docs/7.3.x/configuration/overview/index.html | 8 ++++---- docs/7.3.x/configuration/session_storage/index.html | 8 ++++---- docs/7.3.x/configuration/tls/index.html | 8 ++++---- docs/7.3.x/features/endpoints/index.html | 8 ++++---- docs/7.3.x/index.html | 8 ++++---- docs/7.4.x/behaviour/index.html | 8 ++++---- docs/7.4.x/community/security/index.html | 8 ++++---- docs/7.4.x/configuration/alpha-config/index.html | 8 ++++---- docs/7.4.x/configuration/oauth_provider/index.html | 8 ++++---- docs/7.4.x/configuration/overview/index.html | 8 ++++---- docs/7.4.x/configuration/session_storage/index.html | 8 ++++---- docs/7.4.x/configuration/tls/index.html | 8 ++++---- docs/7.4.x/features/endpoints/index.html | 8 ++++---- docs/7.4.x/index.html | 8 ++++---- docs/behaviour/index.html | 8 ++++---- docs/community/security/index.html | 8 ++++---- docs/configuration/alpha-config/index.html | 8 ++++---- docs/configuration/oauth_provider/index.html | 8 ++++---- docs/configuration/overview/index.html | 10 +++++----- docs/configuration/session_storage/index.html | 8 ++++---- docs/configuration/tls/index.html | 8 ++++---- docs/features/endpoints/index.html | 8 ++++---- docs/index.html | 8 ++++---- docs/next/behaviour/index.html | 8 ++++---- docs/next/community/security/index.html | 8 ++++---- docs/next/configuration/alpha-config/index.html | 8 ++++---- docs/next/configuration/oauth_provider/index.html | 8 ++++---- docs/next/configuration/overview/index.html | 10 +++++----- docs/next/configuration/session_storage/index.html | 8 ++++---- docs/next/configuration/tls/index.html | 8 ++++---- docs/next/features/endpoints/index.html | 8 ++++---- docs/next/index.html | 8 ++++---- docs/next/search-index.json | 2 +- index.html | 8 ++++---- search-index.json | 2 +- search/index.html | 8 ++++---- 83 files changed, 313 insertions(+), 313 deletions(-) rename assets/js/{0f425520.3de858f9.js => 0f425520.06fae793.js} (95%) rename assets/js/{e7cb9657.4a6bd425.js => e7cb9657.42f19412.js} (95%) rename assets/js/{main.30b04635.js => main.4bdab2e9.js} (99%) rename assets/js/{main.30b04635.js.LICENSE.txt => main.4bdab2e9.js.LICENSE.txt} (100%) rename assets/js/{runtime~main.3f651c82.js => runtime~main.e6219104.js} (97%) diff --git a/404.html b/404.html index 76e8f85d..31b3f1f7 100644 --- a/404.html +++ b/404.html @@ -4,13 +4,13 @@ Page Not Found | OAuth2 Proxy - - + +
Skip to main content

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

- - + + \ No newline at end of file diff --git a/assets/js/0f425520.3de858f9.js b/assets/js/0f425520.06fae793.js similarity index 95% rename from assets/js/0f425520.3de858f9.js rename to assets/js/0f425520.06fae793.js index 2aeca3f1..751f015b 100644 --- a/assets/js/0f425520.3de858f9.js +++ b/assets/js/0f425520.06fae793.js @@ -1 +1 @@ -"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7240],{3905:function(t,e,n){n.d(e,{Zo:function(){return p},kt:function(){return g}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u="mdxType",m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},k=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),u=s(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function g(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=k;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o[u]="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})))?void 0:n.filter(Boolean))?e:[]}(t).map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes,default:e.default}}))}function m(t){var e=t.values,n=t.children;return(0,r.useMemo)((function(){var t=null!=e?e:u(n);return function(t){var e=(0,s.l)(t,(function(t,e){return t.value===e.value}));if(e.length>0)throw new Error('Docusaurus error: Duplicate values "'+e.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.')}(t),t}),[e,n])}function k(t){var e=t.value;return t.tabValues.some((function(t){return t.value===e}))}function g(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId,l=(0,o.k6)(),i=function(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!a)throw new Error('Docusaurus error: The component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return null!=a?a:null}({queryString:n,groupId:a});return[(0,d._X)(i),(0,r.useCallback)((function(t){if(i){var e=new URLSearchParams(l.location.search);e.set(i,t),l.replace(Object.assign({},l.location,{search:e.toString()}))}}),[i,l])]}function N(t){var e,n,a,l,i=t.defaultValue,o=t.queryString,d=void 0!==o&&o,s=t.groupId,u=m(t),N=(0,r.useState)((function(){return function(t){var e,n=t.defaultValue,a=t.tabValues;if(0===a.length)throw new Error("Docusaurus error: the component requires at least one children component");if(n){if(!k({value:n,tabValues:a}))throw new Error('Docusaurus error: The has a defaultValue "'+n+'" but none of its children has the corresponding value. Available values are: '+a.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");return n}var r=null!=(e=a.find((function(t){return t.default})))?e:a[0];if(!r)throw new Error("Unexpected error: 0 tabValues");return r.value}({defaultValue:i,tabValues:u})})),c=N[0],h=N[1],f=g({queryString:d,groupId:s}),b=f[0],y=f[1],v=(e=function(t){return t?"docusaurus.tab."+t:null}({groupId:s}.groupId),n=(0,p.Nk)(e),a=n[0],l=n[1],[a,(0,r.useCallback)((function(t){e&&l.set(t)}),[e,l])]),C=v[0],w=v[1],_=function(){var t=null!=b?b:C;return k({value:t,tabValues:u})?t:null}();return(0,r.useLayoutEffect)((function(){_&&h(_)}),[_]),{selectedValue:c,selectValue:(0,r.useCallback)((function(t){if(!k({value:t,tabValues:u}))throw new Error("Can't select invalid tab value="+t);h(t),y(t),w(t)}),[y,w,u]),tabValues:u}}var c=n(2389),h={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};function f(t){var e=t.className,n=t.block,o=t.selectedValue,d=t.selectValue,s=t.tabValues,p=[],u=(0,i.o5)().blockElementScrollPositionUntilNextRender,m=function(t){var e=t.currentTarget,n=p.indexOf(e),a=s[n].value;a!==o&&(u(e),d(a))},k=function(t){var e,n=null;switch(t.key){case"Enter":m(t);break;case"ArrowRight":var a,r=p.indexOf(t.currentTarget)+1;n=null!=(a=p[r])?a:p[0];break;case"ArrowLeft":var l,i=p.indexOf(t.currentTarget)-1;n=null!=(l=p[i])?l:p[p.length-1]}null==(e=n)||e.focus()};return r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,l.Z)("tabs",{"tabs--block":n},e)},s.map((function(t){var e=t.value,n=t.label,i=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:o===e?0:-1,"aria-selected":o===e,key:e,ref:function(t){return p.push(t)},onKeyDown:k,onClick:m},i,{className:(0,l.Z)("tabs__item",h.tabItem,null==i?void 0:i.className,{"tabs__item--active":o===e})}),null!=n?n:e)})))}function b(t){var e=t.lazy,n=t.children,a=t.selectedValue,l=(Array.isArray(n)?n:[n]).filter(Boolean);if(e){var i=l.find((function(t){return t.props.value===a}));return i?(0,r.cloneElement)(i,{className:"margin-top--md"}):null}return r.createElement("div",{className:"margin-top--md"},l.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==a})})))}function y(t){var e=N(t);return r.createElement("div",{className:(0,l.Z)("tabs-container",h.tabList)},r.createElement(f,(0,a.Z)({},t,e)),r.createElement(b,(0,a.Z)({},t,e)))}function v(t){var e=(0,c.Z)();return r.createElement(y,(0,a.Z)({key:String(e)},t))}},4826:function(t,e,n){n.r(e),n.d(e,{assets:function(){return m},contentTitle:function(){return p},default:function(){return c},frontMatter:function(){return s},metadata:function(){return u},toc:function(){return k}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(4866),o=n(5162),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/docs/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/next/configuration/overview",draft:!1,editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",tags:[],version:"current",frontMatter:{id:"overview",title:"Overview"},sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"}},m={},k=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",level:3},{value:"Config File",id:"config-file",level:3},{value:"Command Line Options",id:"command-line-options",level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",level:3},{value:"Environment variables",id:"environment-variables",level:3},{value:"Logging Configuration",id:"logging-configuration",level:2},{value:"Auth Log Format",id:"auth-log-format",level:3},{value:"Request Log Format",id:"request-log-format",level:3},{value:"Standard Log Format",id:"standard-log-format",level:3},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"http://[::1]:4180")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[https://]:")," to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"https://[::1]:443")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the audience"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"aud"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"additional audiences which are allowed to pass verification"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"[]"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ready-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ready endpoint that can be used for deep health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ready"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-insecure-skip-tls-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip TLS verification when connecting to Redis"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis connection idle timeout seconds. If Redis ",(0,l.kt)("a",{parentName:"td",href:"https://redis.io/docs/reference/clients/#client-timeouts"},"timeout")," option is set to non-zero, the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be less than Redis timeout option. Exmpale: if either redis.conf includes ",(0,l.kt)("inlineCode",{parentName:"td"},"timeout 15")," or using ",(0,l.kt)("inlineCode",{parentName:"td"},"CONFIG SET timeout 15")," the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be at least ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout=14")),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/next/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping & ready endpoints"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cipher-suite")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),"."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-min-version")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"minimum TLS version that is acceptable, either ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.3"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"maximum amount of time the server will wait for a response from the upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"30s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") and the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ready")," endpoint can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated.")))}c.isMDXComponent=!0}}]); \ No newline at end of file +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[7240],{3905:function(t,e,n){n.d(e,{Zo:function(){return p},kt:function(){return g}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u="mdxType",m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},k=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),u=s(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function g(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=k;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o[u]="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})))?void 0:n.filter(Boolean))?e:[]}(t).map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes,default:e.default}}))}function m(t){var e=t.values,n=t.children;return(0,r.useMemo)((function(){var t=null!=e?e:u(n);return function(t){var e=(0,s.l)(t,(function(t,e){return t.value===e.value}));if(e.length>0)throw new Error('Docusaurus error: Duplicate values "'+e.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.')}(t),t}),[e,n])}function k(t){var e=t.value;return t.tabValues.some((function(t){return t.value===e}))}function g(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId,l=(0,o.k6)(),i=function(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!a)throw new Error('Docusaurus error: The component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return null!=a?a:null}({queryString:n,groupId:a});return[(0,d._X)(i),(0,r.useCallback)((function(t){if(i){var e=new URLSearchParams(l.location.search);e.set(i,t),l.replace(Object.assign({},l.location,{search:e.toString()}))}}),[i,l])]}function N(t){var e,n,a,l,i=t.defaultValue,o=t.queryString,d=void 0!==o&&o,s=t.groupId,u=m(t),N=(0,r.useState)((function(){return function(t){var e,n=t.defaultValue,a=t.tabValues;if(0===a.length)throw new Error("Docusaurus error: the component requires at least one children component");if(n){if(!k({value:n,tabValues:a}))throw new Error('Docusaurus error: The has a defaultValue "'+n+'" but none of its children has the corresponding value. Available values are: '+a.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");return n}var r=null!=(e=a.find((function(t){return t.default})))?e:a[0];if(!r)throw new Error("Unexpected error: 0 tabValues");return r.value}({defaultValue:i,tabValues:u})})),c=N[0],h=N[1],f=g({queryString:d,groupId:s}),b=f[0],y=f[1],v=(e=function(t){return t?"docusaurus.tab."+t:null}({groupId:s}.groupId),n=(0,p.Nk)(e),a=n[0],l=n[1],[a,(0,r.useCallback)((function(t){e&&l.set(t)}),[e,l])]),C=v[0],w=v[1],_=function(){var t=null!=b?b:C;return k({value:t,tabValues:u})?t:null}();return(0,r.useLayoutEffect)((function(){_&&h(_)}),[_]),{selectedValue:c,selectValue:(0,r.useCallback)((function(t){if(!k({value:t,tabValues:u}))throw new Error("Can't select invalid tab value="+t);h(t),y(t),w(t)}),[y,w,u]),tabValues:u}}var c=n(2389),h={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};function f(t){var e=t.className,n=t.block,o=t.selectedValue,d=t.selectValue,s=t.tabValues,p=[],u=(0,i.o5)().blockElementScrollPositionUntilNextRender,m=function(t){var e=t.currentTarget,n=p.indexOf(e),a=s[n].value;a!==o&&(u(e),d(a))},k=function(t){var e,n=null;switch(t.key){case"Enter":m(t);break;case"ArrowRight":var a,r=p.indexOf(t.currentTarget)+1;n=null!=(a=p[r])?a:p[0];break;case"ArrowLeft":var l,i=p.indexOf(t.currentTarget)-1;n=null!=(l=p[i])?l:p[p.length-1]}null==(e=n)||e.focus()};return r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,l.Z)("tabs",{"tabs--block":n},e)},s.map((function(t){var e=t.value,n=t.label,i=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:o===e?0:-1,"aria-selected":o===e,key:e,ref:function(t){return p.push(t)},onKeyDown:k,onClick:m},i,{className:(0,l.Z)("tabs__item",h.tabItem,null==i?void 0:i.className,{"tabs__item--active":o===e})}),null!=n?n:e)})))}function b(t){var e=t.lazy,n=t.children,a=t.selectedValue,l=(Array.isArray(n)?n:[n]).filter(Boolean);if(e){var i=l.find((function(t){return t.props.value===a}));return i?(0,r.cloneElement)(i,{className:"margin-top--md"}):null}return r.createElement("div",{className:"margin-top--md"},l.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==a})})))}function y(t){var e=N(t);return r.createElement("div",{className:(0,l.Z)("tabs-container",h.tabList)},r.createElement(f,(0,a.Z)({},t,e)),r.createElement(b,(0,a.Z)({},t,e)))}function v(t){var e=(0,c.Z)();return r.createElement(y,(0,a.Z)({key:String(e)},t))}},4826:function(t,e,n){n.r(e),n.d(e,{assets:function(){return m},contentTitle:function(){return p},default:function(){return c},frontMatter:function(){return s},metadata:function(){return u},toc:function(){return k}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(4866),o=n(5162),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/docs/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/next/configuration/overview",draft:!1,editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/docs/configuration/overview.md",tags:[],version:"current",frontMatter:{id:"overview",title:"Overview"},sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/next/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/next/configuration/oauth_provider"}},m={},k=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",level:3},{value:"Config File",id:"config-file",level:3},{value:"Command Line Options",id:"command-line-options",level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",level:3},{value:"Environment variables",id:"environment-variables",level:3},{value:"Logging Configuration",id:"logging-configuration",level:2},{value:"Auth Log Format",id:"auth-log-format",level:3},{value:"Request Log Format",id:"request-log-format",level:3},{value:"Standard Log Format",id:"standard-log-format",level:3},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"http://[::1]:4180")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[https://]:")," to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"https://[::1]:443")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the audience"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"aud"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"additional audiences which are allowed to pass verification"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"[]"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ready-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ready endpoint that can be used for deep health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ready"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-insecure-skip-tls-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip TLS verification when connecting to Redis"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis connection idle timeout seconds. If Redis ",(0,l.kt)("a",{parentName:"td",href:"https://redis.io/docs/reference/clients/#client-timeouts"},"timeout")," option is set to non-zero, the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be less than Redis timeout option. Exmpale: if either redis.conf includes ",(0,l.kt)("inlineCode",{parentName:"td"},"timeout 15")," or using ",(0,l.kt)("inlineCode",{parentName:"td"},"CONFIG SET timeout 15")," the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be at least ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout=14")),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/next/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping & ready endpoints"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cipher-suite")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),"."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-min-version")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"minimum TLS version that is acceptable, either ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.3"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"maximum amount of time the server will wait for a response from the upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"30s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") and the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ready")," endpoint can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in?rd={url}"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated.")))}c.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/e7cb9657.4a6bd425.js b/assets/js/e7cb9657.42f19412.js similarity index 95% rename from assets/js/e7cb9657.4a6bd425.js rename to assets/js/e7cb9657.42f19412.js index d4d0d6d6..9d41f438 100644 --- a/assets/js/e7cb9657.4a6bd425.js +++ b/assets/js/e7cb9657.42f19412.js @@ -1 +1 @@ -"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2423],{3905:function(t,e,n){n.d(e,{Zo:function(){return p},kt:function(){return g}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u="mdxType",m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},k=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),u=s(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function g(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=k;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o[u]="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})))?void 0:n.filter(Boolean))?e:[]}(t).map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes,default:e.default}}))}function m(t){var e=t.values,n=t.children;return(0,r.useMemo)((function(){var t=null!=e?e:u(n);return function(t){var e=(0,s.l)(t,(function(t,e){return t.value===e.value}));if(e.length>0)throw new Error('Docusaurus error: Duplicate values "'+e.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.')}(t),t}),[e,n])}function k(t){var e=t.value;return t.tabValues.some((function(t){return t.value===e}))}function g(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId,l=(0,o.k6)(),i=function(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!a)throw new Error('Docusaurus error: The component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return null!=a?a:null}({queryString:n,groupId:a});return[(0,d._X)(i),(0,r.useCallback)((function(t){if(i){var e=new URLSearchParams(l.location.search);e.set(i,t),l.replace(Object.assign({},l.location,{search:e.toString()}))}}),[i,l])]}function N(t){var e,n,a,l,i=t.defaultValue,o=t.queryString,d=void 0!==o&&o,s=t.groupId,u=m(t),N=(0,r.useState)((function(){return function(t){var e,n=t.defaultValue,a=t.tabValues;if(0===a.length)throw new Error("Docusaurus error: the component requires at least one children component");if(n){if(!k({value:n,tabValues:a}))throw new Error('Docusaurus error: The has a defaultValue "'+n+'" but none of its children has the corresponding value. Available values are: '+a.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");return n}var r=null!=(e=a.find((function(t){return t.default})))?e:a[0];if(!r)throw new Error("Unexpected error: 0 tabValues");return r.value}({defaultValue:i,tabValues:u})})),c=N[0],h=N[1],f=g({queryString:d,groupId:s}),b=f[0],y=f[1],v=(e=function(t){return t?"docusaurus.tab."+t:null}({groupId:s}.groupId),n=(0,p.Nk)(e),a=n[0],l=n[1],[a,(0,r.useCallback)((function(t){e&&l.set(t)}),[e,l])]),C=v[0],w=v[1],_=function(){var t=null!=b?b:C;return k({value:t,tabValues:u})?t:null}();return(0,r.useLayoutEffect)((function(){_&&h(_)}),[_]),{selectedValue:c,selectValue:(0,r.useCallback)((function(t){if(!k({value:t,tabValues:u}))throw new Error("Can't select invalid tab value="+t);h(t),y(t),w(t)}),[y,w,u]),tabValues:u}}var c=n(2389),h={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};function f(t){var e=t.className,n=t.block,o=t.selectedValue,d=t.selectValue,s=t.tabValues,p=[],u=(0,i.o5)().blockElementScrollPositionUntilNextRender,m=function(t){var e=t.currentTarget,n=p.indexOf(e),a=s[n].value;a!==o&&(u(e),d(a))},k=function(t){var e,n=null;switch(t.key){case"Enter":m(t);break;case"ArrowRight":var a,r=p.indexOf(t.currentTarget)+1;n=null!=(a=p[r])?a:p[0];break;case"ArrowLeft":var l,i=p.indexOf(t.currentTarget)-1;n=null!=(l=p[i])?l:p[p.length-1]}null==(e=n)||e.focus()};return r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,l.Z)("tabs",{"tabs--block":n},e)},s.map((function(t){var e=t.value,n=t.label,i=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:o===e?0:-1,"aria-selected":o===e,key:e,ref:function(t){return p.push(t)},onKeyDown:k,onClick:m},i,{className:(0,l.Z)("tabs__item",h.tabItem,null==i?void 0:i.className,{"tabs__item--active":o===e})}),null!=n?n:e)})))}function b(t){var e=t.lazy,n=t.children,a=t.selectedValue,l=(Array.isArray(n)?n:[n]).filter(Boolean);if(e){var i=l.find((function(t){return t.props.value===a}));return i?(0,r.cloneElement)(i,{className:"margin-top--md"}):null}return r.createElement("div",{className:"margin-top--md"},l.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==a})})))}function y(t){var e=N(t);return r.createElement("div",{className:(0,l.Z)("tabs-container",h.tabList)},r.createElement(f,(0,a.Z)({},t,e)),r.createElement(b,(0,a.Z)({},t,e)))}function v(t){var e=(0,c.Z)();return r.createElement(y,(0,a.Z)({key:String(e)},t))}},8520:function(t,e,n){n.r(e),n.d(e,{assets:function(){return m},contentTitle:function(){return p},default:function(){return c},frontMatter:function(){return s},metadata:function(){return u},toc:function(){return k}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(4866),o=n(5162),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"version-7.5.x/configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/versioned_docs/version-7.5.x/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",draft:!1,editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.5.x/configuration/overview.md",tags:[],version:"7.5.x",frontMatter:{id:"overview",title:"Overview"},sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},m={},k=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",level:3},{value:"Config File",id:"config-file",level:3},{value:"Command Line Options",id:"command-line-options",level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",level:3},{value:"Environment variables",id:"environment-variables",level:3},{value:"Logging Configuration",id:"logging-configuration",level:2},{value:"Auth Log Format",id:"auth-log-format",level:3},{value:"Request Log Format",id:"request-log-format",level:3},{value:"Standard Log Format",id:"standard-log-format",level:3},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"http://[::1]:4180")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[https://]:")," to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"https://[::1]:443")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the audience"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"aud"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"additional audiences which are allowed to pass verification"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"[]"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ready-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ready endpoint that can be used for deep health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ready"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-insecure-skip-tls-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip TLS verification when connecting to Redis"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis connection idle timeout seconds. If Redis ",(0,l.kt)("a",{parentName:"td",href:"https://redis.io/docs/reference/clients/#client-timeouts"},"timeout")," option is set to non-zero, the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be less than Redis timeout option. Exmpale: if either redis.conf includes ",(0,l.kt)("inlineCode",{parentName:"td"},"timeout 15")," or using ",(0,l.kt)("inlineCode",{parentName:"td"},"CONFIG SET timeout 15")," the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be at least ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout=14")),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping & ready endpoints"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cipher-suite")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),"."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-min-version")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"minimum TLS version that is acceptable, either ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.3"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"maximum amount of time the server will wait for a response from the upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"30s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") and the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ready")," endpoint can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated.")))}c.isMDXComponent=!0}}]); \ No newline at end of file +"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[2423],{3905:function(t,e,n){n.d(e,{Zo:function(){return p},kt:function(){return g}});var a=n(7294);function r(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function l(t,e){var n=Object.keys(t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(t);e&&(a=a.filter((function(e){return Object.getOwnPropertyDescriptor(t,e).enumerable}))),n.push.apply(n,a)}return n}function i(t){for(var e=1;e=0||(r[n]=t[n]);return r}(t,e);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(t);for(a=0;a=0||Object.prototype.propertyIsEnumerable.call(t,n)&&(r[n]=t[n])}return r}var d=a.createContext({}),s=function(t){var e=a.useContext(d),n=e;return t&&(n="function"==typeof t?t(e):i(i({},e),t)),n},p=function(t){var e=s(t.components);return a.createElement(d.Provider,{value:e},t.children)},u="mdxType",m={inlineCode:"code",wrapper:function(t){var e=t.children;return a.createElement(a.Fragment,{},e)}},k=a.forwardRef((function(t,e){var n=t.components,r=t.mdxType,l=t.originalType,d=t.parentName,p=o(t,["components","mdxType","originalType","parentName"]),u=s(n),k=r,g=u["".concat(d,".").concat(k)]||u[k]||m[k]||l;return n?a.createElement(g,i(i({ref:e},p),{},{components:n})):a.createElement(g,i({ref:e},p))}));function g(t,e){var n=arguments,r=e&&e.mdxType;if("string"==typeof t||r){var l=n.length,i=new Array(l);i[0]=k;var o={};for(var d in e)hasOwnProperty.call(e,d)&&(o[d]=e[d]);o.originalType=t,o[u]="string"==typeof t?t:r,i[1]=o;for(var s=2;s child <"+("string"==typeof t.type?t.type:t.type.name)+'>: all children of the component should be , and every should have a unique "value" prop.')})))?void 0:n.filter(Boolean))?e:[]}(t).map((function(t){var e=t.props;return{value:e.value,label:e.label,attributes:e.attributes,default:e.default}}))}function m(t){var e=t.values,n=t.children;return(0,r.useMemo)((function(){var t=null!=e?e:u(n);return function(t){var e=(0,s.l)(t,(function(t,e){return t.value===e.value}));if(e.length>0)throw new Error('Docusaurus error: Duplicate values "'+e.map((function(t){return t.value})).join(", ")+'" found in . Every value needs to be unique.')}(t),t}),[e,n])}function k(t){var e=t.value;return t.tabValues.some((function(t){return t.value===e}))}function g(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId,l=(0,o.k6)(),i=function(t){var e=t.queryString,n=void 0!==e&&e,a=t.groupId;if("string"==typeof n)return n;if(!1===n)return null;if(!0===n&&!a)throw new Error('Docusaurus error: The component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return null!=a?a:null}({queryString:n,groupId:a});return[(0,d._X)(i),(0,r.useCallback)((function(t){if(i){var e=new URLSearchParams(l.location.search);e.set(i,t),l.replace(Object.assign({},l.location,{search:e.toString()}))}}),[i,l])]}function N(t){var e,n,a,l,i=t.defaultValue,o=t.queryString,d=void 0!==o&&o,s=t.groupId,u=m(t),N=(0,r.useState)((function(){return function(t){var e,n=t.defaultValue,a=t.tabValues;if(0===a.length)throw new Error("Docusaurus error: the component requires at least one children component");if(n){if(!k({value:n,tabValues:a}))throw new Error('Docusaurus error: The has a defaultValue "'+n+'" but none of its children has the corresponding value. Available values are: '+a.map((function(t){return t.value})).join(", ")+". If you intend to show no default tab, use defaultValue={null} instead.");return n}var r=null!=(e=a.find((function(t){return t.default})))?e:a[0];if(!r)throw new Error("Unexpected error: 0 tabValues");return r.value}({defaultValue:i,tabValues:u})})),c=N[0],h=N[1],f=g({queryString:d,groupId:s}),b=f[0],y=f[1],v=(e=function(t){return t?"docusaurus.tab."+t:null}({groupId:s}.groupId),n=(0,p.Nk)(e),a=n[0],l=n[1],[a,(0,r.useCallback)((function(t){e&&l.set(t)}),[e,l])]),C=v[0],w=v[1],_=function(){var t=null!=b?b:C;return k({value:t,tabValues:u})?t:null}();return(0,r.useLayoutEffect)((function(){_&&h(_)}),[_]),{selectedValue:c,selectValue:(0,r.useCallback)((function(t){if(!k({value:t,tabValues:u}))throw new Error("Can't select invalid tab value="+t);h(t),y(t),w(t)}),[y,w,u]),tabValues:u}}var c=n(2389),h={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};function f(t){var e=t.className,n=t.block,o=t.selectedValue,d=t.selectValue,s=t.tabValues,p=[],u=(0,i.o5)().blockElementScrollPositionUntilNextRender,m=function(t){var e=t.currentTarget,n=p.indexOf(e),a=s[n].value;a!==o&&(u(e),d(a))},k=function(t){var e,n=null;switch(t.key){case"Enter":m(t);break;case"ArrowRight":var a,r=p.indexOf(t.currentTarget)+1;n=null!=(a=p[r])?a:p[0];break;case"ArrowLeft":var l,i=p.indexOf(t.currentTarget)-1;n=null!=(l=p[i])?l:p[p.length-1]}null==(e=n)||e.focus()};return r.createElement("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,l.Z)("tabs",{"tabs--block":n},e)},s.map((function(t){var e=t.value,n=t.label,i=t.attributes;return r.createElement("li",(0,a.Z)({role:"tab",tabIndex:o===e?0:-1,"aria-selected":o===e,key:e,ref:function(t){return p.push(t)},onKeyDown:k,onClick:m},i,{className:(0,l.Z)("tabs__item",h.tabItem,null==i?void 0:i.className,{"tabs__item--active":o===e})}),null!=n?n:e)})))}function b(t){var e=t.lazy,n=t.children,a=t.selectedValue,l=(Array.isArray(n)?n:[n]).filter(Boolean);if(e){var i=l.find((function(t){return t.props.value===a}));return i?(0,r.cloneElement)(i,{className:"margin-top--md"}):null}return r.createElement("div",{className:"margin-top--md"},l.map((function(t,e){return(0,r.cloneElement)(t,{key:e,hidden:t.props.value!==a})})))}function y(t){var e=N(t);return r.createElement("div",{className:(0,l.Z)("tabs-container",h.tabList)},r.createElement(f,(0,a.Z)({},t,e)),r.createElement(b,(0,a.Z)({},t,e)))}function v(t){var e=(0,c.Z)();return r.createElement(y,(0,a.Z)({key:String(e)},t))}},8520:function(t,e,n){n.r(e),n.d(e,{assets:function(){return m},contentTitle:function(){return p},default:function(){return c},frontMatter:function(){return s},metadata:function(){return u},toc:function(){return k}});var a=n(7462),r=n(3366),l=(n(7294),n(3905)),i=n(4866),o=n(5162),d=["components"],s={id:"overview",title:"Overview"},p=void 0,u={unversionedId:"configuration/overview",id:"version-7.5.x/configuration/overview",title:"Overview",description:"oauth2-proxy can be configured via command line options, environment variables or config file (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings).",source:"@site/versioned_docs/version-7.5.x/configuration/overview.md",sourceDirName:"configuration",slug:"/configuration/overview",permalink:"/oauth2-proxy/docs/configuration/overview",draft:!1,editUrl:"https://github.com/oauth2-proxy/oauth2-proxy/edit/master/docs/versioned_docs/version-7.5.x/configuration/overview.md",tags:[],version:"7.5.x",frontMatter:{id:"overview",title:"Overview"},sidebar:"docs",previous:{title:"Behaviour",permalink:"/oauth2-proxy/docs/behaviour"},next:{title:"OAuth Provider Configuration",permalink:"/oauth2-proxy/docs/configuration/oauth_provider"}},m={},k=[{value:"Generating a Cookie Secret",id:"generating-a-cookie-secret",level:3},{value:"Config File",id:"config-file",level:3},{value:"Command Line Options",id:"command-line-options",level:3},{value:"Upstreams Configuration",id:"upstreams-configuration",level:3},{value:"Environment variables",id:"environment-variables",level:3},{value:"Logging Configuration",id:"logging-configuration",level:2},{value:"Auth Log Format",id:"auth-log-format",level:3},{value:"Request Log Format",id:"request-log-format",level:3},{value:"Standard Log Format",id:"standard-log-format",level:3},{value:"Configuring for use with the Nginx auth_request directive",id:"configuring-for-use-with-the-nginx-auth_request-directive",level:2},{value:"Configuring for use with the Traefik (v2) ForwardAuth middleware",id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware",level:2},{value:"ForwardAuth with 401 errors middleware",id:"forwardauth-with-401-errors-middleware",level:3},{value:"ForwardAuth with static upstreams configuration",id:"forwardauth-with-static-upstreams-configuration",level:3}],g={toc:k},N="wrapper";function c(t){var e=t.components,n=(0,r.Z)(t,d);return(0,l.kt)(N,(0,a.Z)({},g,n,{components:e,mdxType:"MDXLayout"}),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," can be configured via ",(0,l.kt)("a",{parentName:"p",href:"#command-line-options"},"command line options"),", ",(0,l.kt)("a",{parentName:"p",href:"#environment-variables"},"environment variables")," or ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file")," (in decreasing order of precedence, i.e. command line options will overwrite environment variables and environment variables will overwrite configuration file settings)."),(0,l.kt)("h3",{id:"generating-a-cookie-secret"},"Generating a Cookie Secret"),(0,l.kt)("p",null,"To generate a strong cookie secret use one of the below commands:"),(0,l.kt)(i.Z,{defaultValue:"python",values:[{label:"Python",value:"python"},{label:"Bash",value:"bash"},{label:"OpenSSL",value:"openssl"},{label:"PowerShell",value:"powershell"},{label:"Terraform",value:"terraform"}],mdxType:"Tabs"},(0,l.kt)(o.Z,{value:"python",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"python -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\n"))),(0,l.kt)(o.Z,{value:"bash",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\\n' | tr -- '+/' '-_'; echo\n"))),(0,l.kt)(o.Z,{value:"openssl",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},"openssl rand -base64 32 | tr -- '+/' '-_'\n"))),(0,l.kt)(o.Z,{value:"powershell",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Add System.Web assembly to session, just in case\nAdd-Type -AssemblyName System.Web\n[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes([System.Web.Security.Membership]::GeneratePassword(32,4))).Replace("+","-").Replace("/","_")\n'))),(0,l.kt)(o.Z,{value:"terraform",mdxType:"TabItem"},(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-shell"},'# Valid 32 Byte Base64 URL encoding set that will decode to 24 []byte AES-192 secret\nresource "random_password" "cookie_secret" {\n length = 32\n override_special = "-_"\n}\n')))),(0,l.kt)("h3",{id:"config-file"},"Config File"),(0,l.kt)("p",null,"Every command line argument can be specified in a config file by replacing hyphens (-) with underscores (","_","). If the argument can be specified multiple times, the config option should be plural (trailing s)."),(0,l.kt)("p",null,"An example ",(0,l.kt)("a",{parentName:"p",href:"https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example"},"oauth2-proxy.cfg")," config file is in the contrib directory. It can be used by specifying ",(0,l.kt)("inlineCode",{parentName:"p"},"--config=/etc/oauth2-proxy.cfg")),(0,l.kt)("h3",{id:"command-line-options"},"Command Line Options"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Option"),(0,l.kt)("th",{parentName:"tr",align:null},"Type"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"),(0,l.kt)("th",{parentName:"tr",align:null},"Default"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--acr-values")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"optional, see ",(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-eap-acr-values-1_0.html#acrValues"},"docs")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--api-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"return HTTP 401 instead of redirecting to authentication server if token is not valid. Format: path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--approval-prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth approval_prompt"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"force"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log authentication attempts"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--auth-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for authentication log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--authenticated-emails-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate against emails via file (one per line)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--azure-tenant")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"go to a tenant-specific or common (tenant-independent) endpoint."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"common"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--basic-auth-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the password to set when passing the HTTP Basic Auth header"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-id")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client ID, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"123456.apps.googleusercontent.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--client-secret-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the file with OAuth Client Secret"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--code-challenge-method")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"use PKCE code challenges with the specified method. Either 'plain' or 'S256' (recommended)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--config")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to config file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Optional cookie domains to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".yourcompany.com"),"). The longest domain matching the request's host will be used (or the shortest cookie domain if there is no match)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for cookie. If set to 0, cookie becomes a session-cookie which will expire when the browser is closed."),(0,l.kt)("td",{parentName:"tr",align:null},"168h0m0s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-httponly")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HttpOnly cookie flag"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the name of the cookie that the oauth_proxy creates. Should be changed to use a ",(0,l.kt)("a",{parentName:"td",href:"https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes"},"cookie prefix")," (",(0,l.kt)("inlineCode",{parentName:"td"},"__Host-")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"__Secure-"),") if ",(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")," is set."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"_oauth2_proxy"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"an optional cookie path to force cookies to (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"/poc/"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-refresh")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"refresh the cookie after this duration; ",(0,l.kt)("inlineCode",{parentName:"td"},"0")," to disable; not supported by all providers","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote1"},"1"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secret")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the seed string for secure cookies (optionally base64 encoded)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-secure")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set ",(0,l.kt)("a",{parentName:"td",href:"https://owasp.org/www-community/controls/SecureFlag"},"secure (HTTPS only) cookie flag")),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-samesite")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"set SameSite cookie attribute (",(0,l.kt)("inlineCode",{parentName:"td"},'"lax"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"strict"'),", ",(0,l.kt)("inlineCode",{parentName:"td"},'"none"'),", or ",(0,l.kt)("inlineCode",{parentName:"td"},'""'),")."),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-per-request")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Enable having different CSRF cookies per request, making it possible to have parallel requests."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--cookie-csrf-expire")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"expire timeframe for CSRF cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"15m")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-templates-dir")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to custom html templates"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--custom-sign-in-logo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path or a URL to an custom image for the sign_in page logo. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default logo."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--display-htpasswd-form")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"display username / password login form if an htpasswd file is provided"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--email-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"authenticate emails with the specified domain (may be given multiple times). Use ",(0,l.kt)("inlineCode",{parentName:"td"},"*")," to authenticate any email"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--errors-to-info-log")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"redirects error-level logging to default log channel instead of stderr"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--extra-jwt-issuers")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"if ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")," is set, a list of extra JWT ",(0,l.kt)("inlineCode",{parentName:"td"},"issuer=audience")," (see a token's ",(0,l.kt)("inlineCode",{parentName:"td"},"iss"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"aud")," fields) pairs (where the issuer URL has a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/openid-configuration")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},".well-known/jwks.json"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--exclude-logging-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"comma separated list of paths to exclude from logging, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"/ping,/path2"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (no paths excluded)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--flush-interval")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"period between flushing response buffers when streaming responses"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"1s"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-https")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enforce https redirect"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--force-json-errors")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"force JSON errors instead of HTTP error pages or redirects"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"false"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--banner")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) banner string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default banner."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--footer")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"custom (html) footer string. Use ",(0,l.kt)("inlineCode",{parentName:"td"},'"-"')," to disable default footer."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-org")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this organisation"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-team")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these teams (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-repo")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to collaborators of this repository formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-token")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the token to use when verifying repository collaborators (must have push access to the repository)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--github-user")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"To allow users to login by username even if they do not belong to the specified org and team or collaborators"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these groups (slug), separated by a comma"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--gitlab-projects")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of any of these projects (may be given multiple times) formatted as ",(0,l.kt)("inlineCode",{parentName:"td"},"orgname/repo=accesslevel"),". Access level should be a value matching ",(0,l.kt)("a",{parentName:"td",href:"https://docs.gitlab.com/ee/api/members.html#valid-access-levels"},"Gitlab access levels"),", defaulted to 20 if absent"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-admin-email")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the google admin to impersonate for api calls"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this google group (may be given multiple times)."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-service-account-json")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the path to the service account json credentials"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--google-use-application-default-credentials")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"use application default credentials instead of service account json (i.e. GKE Workload Identity)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"additionally authenticate against a htpasswd file. Entries must be created with ",(0,l.kt)("inlineCode",{parentName:"td"},"htpasswd -B")," for bcrypt encryption"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--htpasswd-user-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the groups to be set on sessions for htpasswd users"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--http-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[http://]:")," or ",(0,l.kt)("inlineCode",{parentName:"td"},"unix://")," to listen on for HTTP clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"http://[::1]:4180")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"127.0.0.1:4180"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--https-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"[https://]:")," to listen on for HTTPS clients. Square brackets are required for ipv6 address, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"https://[::1]:443")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'":443"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-compress")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Should rotated log files be compressed using gzip"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-filename")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"File to log requests to, empty for ",(0,l.kt)("inlineCode",{parentName:"td"},"stdout")),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (stdout)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-local-time")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Use local time in log files and backup filenames instead of UTC"),(0,l.kt)("td",{parentName:"tr",align:null},"true (local time)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-age")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of days to retain old log files"),(0,l.kt)("td",{parentName:"tr",align:null},"7")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-backups")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum number of old log files to retain; 0 to disable"),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--logging-max-size")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Maximum size in megabytes of the log file before rotation"),(0,l.kt)("td",{parentName:"tr",align:null},"100")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"private key in PEM format used to sign JWT, so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},'--jwt-key="${OAUTH2_PROXY_JWT_KEY}"'),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to the private key file in PEM format used to sign the JWT so that you can say something like ",(0,l.kt)("inlineCode",{parentName:"td"},"--jwt-key-file=/etc/ssl/private/jwt_signing_key.pem"),": required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--login-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Authentication endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-allow-unverified-email")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"don't fail if an email address in an id_token is not verified"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-issuer-verification")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"allow the OIDC issuer URL to differ from the expected (currently required for Azure multi-tenant compatibility)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--insecure-oidc-skip-nonce")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip verifying the OIDC ID Token's nonce claim"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-issuer-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OpenID Connect issuer URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://accounts.google.com"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OIDC JWKS URI for token verification; required if OIDC discovery is disabled"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-email-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user's email"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"email"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-groups-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the user groups"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"groups"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-audience-claim")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"which OIDC claim contains the audience"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"aud"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-extra-audience")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"additional audiences which are allowed to pass verification"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"[]"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OAuth access_token to upstream via X-Forwarded-Access-Token header. When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")," this adds the X-Auth-Request-Access-Token header to the response"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass OIDC IDToken to upstream via Authorization Bearer header"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass HTTP Basic Auth, X-Forwarded-User, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prefer-email-to-user")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Prefer to use the Email address as the Username when passing information to upstream. Will only use Username if Email is unavailable, e.g. htaccess authentication. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-basic-auth")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-host-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass the request Host Header to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pass-user-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"pass X-Forwarded-User, X-Forwarded-Groups, X-Forwarded-Email and X-Forwarded-Preferred-Username information to upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--profile-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Profile access endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--prompt")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest"},"OIDC prompt"),"; if present, ",(0,l.kt)("inlineCode",{parentName:"td"},"approval-prompt")," is ignored"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth provider"),(0,l.kt)("td",{parentName:"tr",align:null},"google")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-ca-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Paths to CA certificates that should be used when connecting to the provider. If not specified, the default Go trust sources are used instead."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--provider-display-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Override the provider's name with the given string; used for the sign-in page"),(0,l.kt)("td",{parentName:"tr",align:null},"(depends on provider)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ping endpoint that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ping"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ping-user-agent")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"a User-Agent that can be used for basic health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""')," (don't check user agent)")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ready-path")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the ready endpoint that can be used for deep health checks"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/ready"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--metrics-address")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the address prometheus metrics will be scraped from"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'""'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-prefix")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the url root path that this proxy should be nested under (e.g. /",(0,l.kt)("inlineCode",{parentName:"td"},"/sign_in"),")"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"/oauth2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--proxy-websockets")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"enables WebSocket proxying"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--pubjwk-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"JWK pubkey access endpoint: required by login.gov"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Header used to determine the real IP of the client, requires ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," to be set (one of: X-Forwarded-For, X-Real-IP, or X-ProxyUser-IP)"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Real-IP")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Token redemption endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redirect-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"the OAuth Redirect URL, e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},'"https://internalapp.yourcompany.com/oauth2/callback"')),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis cluster connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"URL of redis server for redis session storage (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),")"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-insecure-skip-tls-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip TLS verification when connecting to Redis"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis password. Applicable for all Redis configurations. Will override any password set in ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-url")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-password")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-password")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis sentinel master name. Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"List of Redis sentinel connection URLs (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},"redis://HOST[:PORT]"),"). Used in conjunction with ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-cluster")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis cluster. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-cluster-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-use-sentinel")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Connect to redis via sentinels. Must set ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-master-name")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-sentinel-connection-urls")," to use this feature"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"int"),(0,l.kt)("td",{parentName:"tr",align:null},"Redis connection idle timeout seconds. If Redis ",(0,l.kt)("a",{parentName:"td",href:"https://redis.io/docs/reference/clients/#client-timeouts"},"timeout")," option is set to non-zero, the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be less than Redis timeout option. Exmpale: if either redis.conf includes ",(0,l.kt)("inlineCode",{parentName:"td"},"timeout 15")," or using ",(0,l.kt)("inlineCode",{parentName:"td"},"CONFIG SET timeout 15")," the ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout")," must be at least ",(0,l.kt)("inlineCode",{parentName:"td"},"--redis-connection-idle-timeout=14")),(0,l.kt)("td",{parentName:"tr",align:null},"0")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Request header to use as the request ID in logging"),(0,l.kt)("td",{parentName:"tr",align:null},"X-Request-Id")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log requests"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--request-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for request log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--resource")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"The resource that is protected (Azure AD only)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"are we running behind a reverse proxy, controls whether headers like X-Real-IP are accepted and allows X-Forwarded-{Proto,Host,Uri} headers to be used on redirect selection"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--scope")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"OAuth scope specification"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-cookie-minimal")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strip OAuth tokens from cookie session stores if they aren't needed (cookie session store only)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--session-store-type")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"/oauth2-proxy/docs/configuration/session_storage"},"Session data storage backend"),"; redis or cookie"),(0,l.kt)("td",{parentName:"tr",align:null},"cookie")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-xauthrequest")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and X-Auth-Request-Preferred-Username response headers (useful in Nginx auth_request mode). When used with ",(0,l.kt)("inlineCode",{parentName:"td"},"--pass-access-token"),", X-Auth-Request-Access-Token is added to response headers."),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-authorization-header")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set Authorization Bearer response header (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--set-basic-auth")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"set HTTP Basic Auth information in response (useful in Nginx auth_request mode)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--show-debug-on-error")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"show detailed error information on error pages (WARNING: this may contain sensitive information - do not use in production)"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--signature-key")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"GAP-Signature request signature key (algorithm:secretkey)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--silence-ping-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"disable logging of requests to ping & ready endpoints"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-preflight")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip authentication for OPTIONS requests"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-regex")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"(DEPRECATED for ",(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route"),") bypass authentication for requests paths that match (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-route")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass authentication for requests that match the method & path. Format: method=path_regex OR method!=path_regex. For all methods: path_regex OR !=path_regex"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-auth-strip-headers")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"strips ",(0,l.kt)("inlineCode",{parentName:"td"},"X-Forwarded-*")," style authentication headers & ",(0,l.kt)("inlineCode",{parentName:"td"},"Authorization")," header if they would be set by oauth2-proxy"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-jwt-bearer-tokens")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip requests that have verified JWT bearer tokens (the token must have ",(0,l.kt)("a",{parentName:"td",href:"https://en.wikipedia.org/wiki/JSON_Web_Token#Standard_fields"},(0,l.kt)("inlineCode",{parentName:"a"},"aud"))," that matches this client id or one of the extras from ",(0,l.kt)("inlineCode",{parentName:"td"},"extra-jwt-issuers"),")"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-oidc-discovery")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"bypass OIDC endpoint discovery. ",(0,l.kt)("inlineCode",{parentName:"td"},"--login-url"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"--redeem-url")," and ",(0,l.kt)("inlineCode",{parentName:"td"},"--oidc-jwks-url")," must be configured in this case"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--skip-provider-button")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"will skip sign-in-page to directly reach the next step: oauth/start"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS providers"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--ssl-upstream-insecure-skip-verify")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"skip validation of certificates presented when using HTTPS upstreams"),(0,l.kt)("td",{parentName:"tr",align:null},"false")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging")),(0,l.kt)("td",{parentName:"tr",align:null},"bool"),(0,l.kt)("td",{parentName:"tr",align:null},"Log standard runtime information"),(0,l.kt)("td",{parentName:"tr",align:null},"true")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--standard-logging-format")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Template for standard log lines"),(0,l.kt)("td",{parentName:"tr",align:null},"see ",(0,l.kt)("a",{parentName:"td",href:"#logging-configuration"},"Logging Configuration"))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cert-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to certificate file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-cipher-suite")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"Restricts TLS cipher suites used by server to those listed (e.g. TLS_RSA_WITH_RC4_128_SHA) (may be given multiple times). If not specified, the default Go safe cipher list is used. List of valid cipher suites can be found in the ",(0,l.kt)("a",{parentName:"td",href:"https://pkg.go.dev/crypto/tls#pkg-constants"},"crypto/tls documentation"),"."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-key-file")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"path to private key file"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--tls-min-version")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"minimum TLS version that is acceptable, either ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"')," or ",(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.3"')),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},'"TLS1.2"'))),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"the http url(s) of the upstream endpoint, file:// paths for static files or ",(0,l.kt)("inlineCode",{parentName:"td"},"static://")," for static response. Routing is based on the path"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--upstream-timeout")),(0,l.kt)("td",{parentName:"tr",align:null},"duration"),(0,l.kt)("td",{parentName:"tr",align:null},"maximum amount of time the server will wait for a response from the upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"30s")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-group")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to members of this group (may be given multiple times)"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--allowed-role")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"restrict logins to users with this role (may be given multiple times). Only works with the keycloak-oidc provider."),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--validate-url")),(0,l.kt)("td",{parentName:"tr",align:null},"string"),(0,l.kt)("td",{parentName:"tr",align:null},"Access token validation endpoint"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--version")),(0,l.kt)("td",{parentName:"tr",align:null},"n/a"),(0,l.kt)("td",{parentName:"tr",align:null},"print version string"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--whitelist-domain")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"allowed domains for redirection after authentication. Prefix domain with a ",(0,l.kt)("inlineCode",{parentName:"td"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"td"},"*.")," to allow subdomains (e.g. ",(0,l.kt)("inlineCode",{parentName:"td"},".example.com"),", ",(0,l.kt)("inlineCode",{parentName:"td"},"*.example.com"),")","\xa0","[",(0,l.kt)("a",{parentName:"td",href:"#footnote2"},"2"),"]"),(0,l.kt)("td",{parentName:"tr",align:null})),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("inlineCode",{parentName:"td"},"--trusted-ip")),(0,l.kt)("td",{parentName:"tr",align:null},"string ","|"," list"),(0,l.kt)("td",{parentName:"tr",align:null},"list of IPs or CIDR ranges to allow to bypass authentication (may be given multiple times). When combined with ",(0,l.kt)("inlineCode",{parentName:"td"},"--reverse-proxy")," and optionally ",(0,l.kt)("inlineCode",{parentName:"td"},"--real-client-ip-header")," this will evaluate the trust of the IP stored in an HTTP header by a reverse proxy rather than the layer-3/4 remote address. WARNING: trusting IPs has inherent security flaws, especially when obtaining the IP address from an HTTP header (reverse-proxy mode). Use this option only if you understand the risks and how to manage them."),(0,l.kt)("td",{parentName:"tr",align:null})))),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote1"},"1"),"]",": Only these providers support ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-refresh"),": GitLab, Google and OIDC"),(0,l.kt)("p",null,"[",(0,l.kt)("a",{name:"footnote2"},"2"),"]",": When using the ",(0,l.kt)("inlineCode",{parentName:"p"},"whitelist-domain")," option, any domain prefixed with a ",(0,l.kt)("inlineCode",{parentName:"p"},".")," or a ",(0,l.kt)("inlineCode",{parentName:"p"},"*.")," will allow any subdomain of the specified domain as a valid redirect URL. By default, only empty ports are allowed. This translates to allowing the default port of the URL's protocol (80 for HTTP, 443 for HTTPS, etc.) since browsers omit them. To allow only a specific port, add it to the whitelisted domain: ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:8080"),". To allow any port, use ",(0,l.kt)("inlineCode",{parentName:"p"},"*"),": ",(0,l.kt)("inlineCode",{parentName:"p"},"example.com:*"),"."),(0,l.kt)("p",null,"See below for provider specific options"),(0,l.kt)("h3",{id:"upstreams-configuration"},"Upstreams Configuration"),(0,l.kt)("p",null,(0,l.kt)("inlineCode",{parentName:"p"},"oauth2-proxy")," supports having multiple upstreams, and has the option to pass requests on to HTTP(S) servers or serve static files from the file system. HTTP and HTTPS upstreams are configured by providing a URL such as ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/")," for the upstream parameter. This will forward all authenticated requests to the upstream server. If you instead provide ",(0,l.kt)("inlineCode",{parentName:"p"},"http://127.0.0.1:8080/some/path/")," then it will only be requests that start with ",(0,l.kt)("inlineCode",{parentName:"p"},"/some/path/")," which are forwarded to the upstream."),(0,l.kt)("p",null,"Static file paths are configured as a file:// URL. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/")," will serve the files from that directory at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/var/www/static/"),", which may not be what you want. You can provide the path to where the files should be available by adding a fragment to the configured URL. The value of the fragment will then be used to specify which path the files are available at, e.g. ",(0,l.kt)("inlineCode",{parentName:"p"},"file:///var/www/static/#/static/")," will make ",(0,l.kt)("inlineCode",{parentName:"p"},"/var/www/static/")," available at ",(0,l.kt)("inlineCode",{parentName:"p"},"http://[oauth2-proxy url]/static/"),"."),(0,l.kt)("p",null,"Multiple upstreams can either be configured by supplying a comma separated list to the ",(0,l.kt)("inlineCode",{parentName:"p"},"--upstream")," parameter, supplying the parameter multiple times or providing a list in the ",(0,l.kt)("a",{parentName:"p",href:"#config-file"},"config file"),". When multiple upstreams are used routing to them will be based on the path they are set up with."),(0,l.kt)("h3",{id:"environment-variables"},"Environment variables"),(0,l.kt)("p",null,"Every command line argument can be specified as an environment variable by\nprefixing it with ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_"),", capitalising it, and replacing hyphens (",(0,l.kt)("inlineCode",{parentName:"p"},"-"),")\nwith underscores (",(0,l.kt)("inlineCode",{parentName:"p"},"_"),"). If the argument can be specified multiple times, the\nenvironment variable should be plural (trailing ",(0,l.kt)("inlineCode",{parentName:"p"},"S"),")."),(0,l.kt)("p",null,"This is particularly useful for storing secrets outside of a configuration file\nor the command line."),(0,l.kt)("p",null,"For example, the ",(0,l.kt)("inlineCode",{parentName:"p"},"--cookie-secret")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_COOKIE_SECRET"),",\nand the ",(0,l.kt)("inlineCode",{parentName:"p"},"--email-domain")," flag becomes ",(0,l.kt)("inlineCode",{parentName:"p"},"OAUTH2_PROXY_EMAIL_DOMAINS"),"."),(0,l.kt)("h2",{id:"logging-configuration"},"Logging Configuration"),(0,l.kt)("p",null,"By default, OAuth2 Proxy logs all output to stdout. Logging can be configured to output to a rotating log file using the ",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-filename")," command."),(0,l.kt)("p",null,"If logging to a file you can also configure the maximum file size (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-size"),"), age (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-age"),"), max backup logs (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-max-backups"),"), and if backup logs should be compressed (",(0,l.kt)("inlineCode",{parentName:"p"},"--logging-compress"),")."),(0,l.kt)("p",null,"There are three different types of logging: standard, authentication, and HTTP requests. These can each be enabled or disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging"),", ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging"),", and ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging"),"."),(0,l.kt)("p",null,"Each type of logging has its own configurable format and variables. By default these formats are similar to the Apache Combined Log."),(0,l.kt)("p",null,"Logging of requests to the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ping")," endpoint (or using ",(0,l.kt)("inlineCode",{parentName:"p"},"--ping-user-agent"),") and the ",(0,l.kt)("inlineCode",{parentName:"p"},"/ready")," endpoint can be disabled with ",(0,l.kt)("inlineCode",{parentName:"p"},"--silence-ping-logging")," reducing log volume."),(0,l.kt)("h3",{id:"auth-log-format"},"Auth Log Format"),(0,l.kt)("p",null,"Authentication logs are logs which are guaranteed to contain a username or email address of a user attempting to authenticate. These logs are output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"}," - - [19/Mar/2015:17:20:19 -0400] [] \n")),(0,l.kt)("p",null,"The status block will contain one of the below strings:"),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthSuccess")," If a user has authenticated successfully by any method"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthFailure")," If the user failed to authenticate explicitly"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"AuthError")," If there was an unexpected error during authentication")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--auth-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for auth logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"Authenticated via OAuth2"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the auth attempt.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Status"),(0,l.kt)("td",{parentName:"tr",align:null},"AuthSuccess"),(0,l.kt)("td",{parentName:"tr",align:null},"The status of the auth request. See above for details.")))),(0,l.kt)("h3",{id:"request-log-format"},"Request Log Format"),(0,l.kt)("p",null,"HTTP request logs will output by default in the below format:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},' - - [19/Mar/2015:17:20:19 -0400] GET "/path/" HTTP/1.1 "" \n')),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--request-logging-format")," flag.\nThe default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"{{.Client}} - {{.RequestID}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}\n")),(0,l.kt)("p",null,"Available variables for request logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Client"),(0,l.kt)("td",{parentName:"tr",align:null},"74.125.224.72"),(0,l.kt)("td",{parentName:"tr",align:null},"The client/remote IP address. Will use the X-Real-IP header it if exists & reverse-proxy is set to true.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Host"),(0,l.kt)("td",{parentName:"tr",align:null},"domain.com"),(0,l.kt)("td",{parentName:"tr",align:null},"The value of the Host header.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Protocol"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP/1.0"),(0,l.kt)("td",{parentName:"tr",align:null},"The request protocol.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestDuration"),(0,l.kt)("td",{parentName:"tr",align:null},"0.001"),(0,l.kt)("td",{parentName:"tr",align:null},"The time in seconds that a request took to process.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestID"),(0,l.kt)("td",{parentName:"tr",align:null},"00010203-0405-4607-8809-0a0b0c0d0e0f"),(0,l.kt)("td",{parentName:"tr",align:null},"The request ID pulled from the ",(0,l.kt)("inlineCode",{parentName:"td"},"--request-id-header"),". Random UUID if empty")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestMethod"),(0,l.kt)("td",{parentName:"tr",align:null},"GET"),(0,l.kt)("td",{parentName:"tr",align:null},"The request method.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"RequestURI"),(0,l.kt)("td",{parentName:"tr",align:null},'"/oauth2/auth"'),(0,l.kt)("td",{parentName:"tr",align:null},"The URI path of the request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"ResponseSize"),(0,l.kt)("td",{parentName:"tr",align:null},"12"),(0,l.kt)("td",{parentName:"tr",align:null},"The size in bytes of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"StatusCode"),(0,l.kt)("td",{parentName:"tr",align:null},"200"),(0,l.kt)("td",{parentName:"tr",align:null},"The HTTP status code of the response.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Upstream"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The upstream data of the HTTP request.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"UserAgent"),(0,l.kt)("td",{parentName:"tr",align:null},"-"),(0,l.kt)("td",{parentName:"tr",align:null},"The full user agent as reported by the requesting client.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Username"),(0,l.kt)("td",{parentName:"tr",align:null},(0,l.kt)("a",{parentName:"td",href:"mailto:username@email.com"},"username@email.com")),(0,l.kt)("td",{parentName:"tr",align:null},"The email or username of the auth request.")))),(0,l.kt)("h3",{id:"standard-log-format"},"Standard Log Format"),(0,l.kt)("p",null,"All other logging that is not covered by the above two types of logging will be output in this standard logging format. This includes configuration information at startup and errors that occur outside of a session. The default format is below:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[19/Mar/2015:17:20:19 -0400] [main.go:40] \n")),(0,l.kt)("p",null,"If you require a different format than that, you can configure it with the ",(0,l.kt)("inlineCode",{parentName:"p"},"--standard-logging-format")," flag. The default format is configured as follows:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre"},"[{{.Timestamp}}] [{{.File}}] {{.Message}}\n")),(0,l.kt)("p",null,"Available variables for standard logging:"),(0,l.kt)("table",null,(0,l.kt)("thead",{parentName:"table"},(0,l.kt)("tr",{parentName:"thead"},(0,l.kt)("th",{parentName:"tr",align:null},"Variable"),(0,l.kt)("th",{parentName:"tr",align:null},"Example"),(0,l.kt)("th",{parentName:"tr",align:null},"Description"))),(0,l.kt)("tbody",{parentName:"table"},(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Timestamp"),(0,l.kt)("td",{parentName:"tr",align:null},"19/Mar/2015:17:20:19 -0400"),(0,l.kt)("td",{parentName:"tr",align:null},"The date and time of the logging event.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"File"),(0,l.kt)("td",{parentName:"tr",align:null},"main.go:40"),(0,l.kt)("td",{parentName:"tr",align:null},"The file and line number of the logging statement.")),(0,l.kt)("tr",{parentName:"tbody"},(0,l.kt)("td",{parentName:"tr",align:null},"Message"),(0,l.kt)("td",{parentName:"tr",align:null},"HTTP: listening on 127.0.0.1:4180"),(0,l.kt)("td",{parentName:"tr",align:null},"The details of the log statement.")))),(0,l.kt)("h2",{id:"configuring-for-use-with-the-nginx-auth_request-directive"},"Configuring for use with the Nginx ",(0,l.kt)("inlineCode",{parentName:"h2"},"auth_request")," directive"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"http://nginx.org/en/docs/http/ngx_http_auth_request_module.html"},"Nginx ",(0,l.kt)("inlineCode",{parentName:"a"},"auth_request")," directive")," allows Nginx to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/auth")," endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-nginx"},'server {\n listen 443 ssl;\n server_name ...;\n include ssl/ssl.conf;\n\n location /oauth2/ {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n proxy_set_header X-Auth-Request-Redirect $request_uri;\n # or, if you are handling multiple domains:\n # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;\n }\n location = /oauth2/auth {\n proxy_pass http://127.0.0.1:4180;\n proxy_set_header Host $host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Scheme $scheme;\n # nginx auth_request includes headers but not body\n proxy_set_header Content-Length "";\n proxy_pass_request_body off;\n }\n\n location / {\n auth_request /oauth2/auth;\n error_page 401 = /oauth2/sign_in;\n\n # pass information via X-User and X-Email headers to backend,\n # requires running with --set-xauthrequest flag\n auth_request_set $user $upstream_http_x_auth_request_user;\n auth_request_set $email $upstream_http_x_auth_request_email;\n proxy_set_header X-User $user;\n proxy_set_header X-Email $email;\n\n # if you enabled --pass-access-token, this will pass the token to the backend\n auth_request_set $token $upstream_http_x_auth_request_access_token;\n proxy_set_header X-Access-Token $token;\n\n # if you enabled --cookie-refresh, this is needed for it to work with auth_request\n auth_request_set $auth_cookie $upstream_http_set_cookie;\n add_header Set-Cookie $auth_cookie;\n\n # When using the --set-authorization-header flag, some provider\'s cookies can exceed the 4kb\n # limit and so the OAuth2 Proxy splits these into multiple parts.\n # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\n # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\n auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;\n\n # Extract the Cookie attributes from the first Set-Cookie header and append them\n # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\n if ($auth_cookie ~* "(; .*)") {\n set $auth_cookie_name_0 $auth_cookie;\n set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";\n }\n\n # Send both Set-Cookie headers now if there was a second part\n if ($auth_cookie_name_upstream_1) {\n add_header Set-Cookie $auth_cookie_name_0;\n add_header Set-Cookie $auth_cookie_name_1;\n }\n\n proxy_pass http://backend/;\n # or "root /path/to/site;" or "fastcgi_pass ..." etc\n }\n}\n')),(0,l.kt)("p",null,"When you use ingress-nginx in Kubernetes, you MUST use ",(0,l.kt)("inlineCode",{parentName:"p"},"kubernetes/ingress-nginx")," (which includes the Lua module) and the following configuration snippet for your ",(0,l.kt)("inlineCode",{parentName:"p"},"Ingress"),".\nVariables set with ",(0,l.kt)("inlineCode",{parentName:"p"},"auth_request_set")," are not ",(0,l.kt)("inlineCode",{parentName:"p"},"set"),"-able in plain nginx config when the location is processed via ",(0,l.kt)("inlineCode",{parentName:"p"},"proxy_pass")," and then may only be processed by Lua.\nNote that ",(0,l.kt)("inlineCode",{parentName:"p"},"nginxinc/kubernetes-ingress")," does not include the Lua module."),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'nginx.ingress.kubernetes.io/auth-response-headers: Authorization\nnginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri\nnginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth\nnginx.ingress.kubernetes.io/configuration-snippet: |\n auth_request_set $name_upstream_1 $upstream_cookie_name_1;\n\n access_by_lua_block {\n if ngx.var.name_upstream_1 ~= "" then\n ngx.header["Set-Cookie"] = "name_1=" .. ngx.var.name_upstream_1 .. ngx.var.auth_cookie:match("(; .*)")\n end\n }\n')),(0,l.kt)("p",null,"It is recommended to use ",(0,l.kt)("inlineCode",{parentName:"p"},"--session-store-type=redis")," when expecting large sessions/OIDC tokens (",(0,l.kt)("em",{parentName:"p"},"e.g.")," with MS Azure)."),(0,l.kt)("p",null,"You have to substitute ",(0,l.kt)("em",{parentName:"p"},"name"),' with the actual cookie name you configured via --cookie-name parameter. If you don\'t set a custom cookie name the variable should be "$upstream_cookie__oauth2_proxy_1" instead of "$upstream_cookie_name_1" and the new cookie-name should be "_oauth2_proxy_1=" instead of "name_1=".'),(0,l.kt)("h2",{id:"configuring-for-use-with-the-traefik-v2-forwardauth-middleware"},"Configuring for use with the Traefik (v2) ",(0,l.kt)("inlineCode",{parentName:"h2"},"ForwardAuth")," middleware"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"This option requires ",(0,l.kt)("inlineCode",{parentName:"strong"},"--reverse-proxy")," option to be set.")),(0,l.kt)("h3",{id:"forwardauth-with-401-errors-middleware"},"ForwardAuth with 401 errors middleware"),(0,l.kt)("p",null,"The ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," allows Traefik to authenticate requests via the oauth2-proxy's ",(0,l.kt)("inlineCode",{parentName:"p"},"/oauth2/auth")," endpoint on every request, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the whole request through. For example, on Dynamic File (YAML) Configuration:"),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service:\n rule: "Host(`a-service.example.com`)"\n service: a-service-backend\n middlewares:\n - oauth-errors\n - oauth-auth\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth:\n rule: "Host(`a-service.example.com`, `oauth.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n oauth-errors:\n errors:\n status:\n - "401-403"\n service: oauth-backend\n query: "/oauth2/sign_in?rd={url}"\n')),(0,l.kt)("h3",{id:"forwardauth-with-static-upstreams-configuration"},"ForwardAuth with static upstreams configuration"),(0,l.kt)("p",null,"Redirect to sign_in functionality provided without the use of ",(0,l.kt)("inlineCode",{parentName:"p"},"errors")," middleware with ",(0,l.kt)("a",{parentName:"p",href:"https://doc.traefik.io/traefik/middlewares/forwardauth/"},"Traefik v2 ",(0,l.kt)("inlineCode",{parentName:"a"},"ForwardAuth")," middleware")," pointing to oauth2-proxy service's ",(0,l.kt)("inlineCode",{parentName:"p"},"/")," endpoint"),(0,l.kt)("p",null,(0,l.kt)("strong",{parentName:"p"},"Following options need to be set on ",(0,l.kt)("inlineCode",{parentName:"strong"},"oauth2-proxy"),":")),(0,l.kt)("ul",null,(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--upstream=static://202"),": Configures a static response for authenticated sessions"),(0,l.kt)("li",{parentName:"ul"},(0,l.kt)("inlineCode",{parentName:"li"},"--reverse-proxy=true"),": Enables the use of ",(0,l.kt)("inlineCode",{parentName:"li"},"X-Forwarded-*")," headers to determine redirects correctly")),(0,l.kt)("pre",null,(0,l.kt)("code",{parentName:"pre",className:"language-yaml"},'http:\n routers:\n a-service-route-1:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-redirect # redirects all unauthenticated to oauth2 signin\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n a-service-route-2:\n rule: "Host(`a-service.example.com`) && PathPrefix(`/no-auto-redirect`)"\n service: a-service-backend\n middlewares:\n - oauth-auth-wo-redirect # unauthenticated session will return a 401\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n services-oauth2-route:\n rule: "Host(`a-service.example.com`, `b-service.example.com`) && PathPrefix(`/oauth2/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n oauth2-proxy-route:\n rule: "Host(`oauth.example.com`) && PathPrefix(`/`)"\n middlewares:\n - auth-headers\n service: oauth-backend\n tls:\n certResolver: default\n domains:\n - main: "example.com"\n sans:\n - "*.example.com"\n\n services:\n a-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.2:7555\n b-service-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.3:7555\n oauth-backend:\n loadBalancer:\n servers:\n - url: http://172.16.0.1:4180\n\n middlewares:\n auth-headers:\n headers:\n sslRedirect: true\n stsSeconds: 315360000\n browserXssFilter: true\n contentTypeNosniff: true\n forceSTSHeader: true\n sslHost: example.com\n stsIncludeSubdomains: true\n stsPreload: true\n frameDeny: true\n oauth-auth-redirect:\n forwardAuth:\n address: https://oauth.example.com/\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n oauth-auth-wo-redirect:\n forwardAuth:\n address: https://oauth.example.com/oauth2/auth\n trustForwardHeader: true\n authResponseHeaders:\n - X-Auth-Request-Access-Token\n - Authorization\n')),(0,l.kt)("admonition",{type:"note"},(0,l.kt)("p",{parentName:"admonition"},"If you set up your OAuth2 provider to rotate your client secret, you can use the ",(0,l.kt)("inlineCode",{parentName:"p"},"client-secret-file")," option to reload the secret when it is updated.")))}c.isMDXComponent=!0}}]); \ No newline at end of file diff --git a/assets/js/main.30b04635.js b/assets/js/main.4bdab2e9.js similarity index 99% rename from assets/js/main.30b04635.js rename to assets/js/main.4bdab2e9.js index d48e7d10..2620a40b 100644 --- a/assets/js/main.30b04635.js +++ b/assets/js/main.4bdab2e9.js @@ -1,2 +1,2 @@ -/*! For license information please see main.30b04635.js.LICENSE.txt */ -(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([[179],{723:function(e,t,n){"use strict";n.d(t,{Z:function(){return p}});var r=n(7294),o=n(7462),i=n(8356),a=n.n(i),u=n(6887),l={"001ca130":[function(){return n.e(4431).then(n.bind(n,1593))},"@site/versioned_docs/version-7.0.x/features/endpoints.md",1593],"00691219":[function(){return n.e(5322).then(n.bind(n,2353))},"@site/versioned_docs/version-7.0.x/configuration/tls.md",2353],"03a491a5":[function(){return n.e(2506).then(n.bind(n,128))},"@site/versioned_docs/version-7.4.x/behaviour.md",128],"0721a2c0":[function(){return n.e(6760).then(n.bind(n,9603))},"@site/versioned_docs/version-7.0.x/installation.md",9603],"08659987":[function(){return n.e(4042).then(n.bind(n,9097))},"@site/versioned_docs/version-7.3.x/configuration/tls.md",9097],"0f425520":[function(){return Promise.all([n.e(532),n.e(7240)]).then(n.bind(n,4826))},"@site/docs/configuration/overview.md",4826],"121b3f12":[function(){return n.e(4963).then(n.bind(n,7442))},"@site/versioned_docs/version-7.5.x/configuration/sessions.md",7442],15098498:[function(){return n.e(8676).then(n.t.bind(n,2776,19))},"/home/runner/work/oauth2-proxy/oauth2-proxy/master/docs/.docusaurus/@easyops-cn/docusaurus-search-local/default/plugin-route-context-module-100.json",2776],"1737cda1":[function(){return n.e(5144).then(n.bind(n,3501))},"@site/versioned_docs/version-7.3.x/installation.md",3501],17896441:[function(){return Promise.all([n.e(532),n.e(771),n.e(7918)]).then(n.bind(n,903))},"@theme/DocItem",903],"1999cd7b":[function(){return n.e(1898).then(n.bind(n,6485))},"@site/versioned_docs/version-7.1.x/configuration/sessions.md",6485],"1a4e3797":[function(){return Promise.all([n.e(532),n.e(7920)]).then(n.bind(n,2027))},"@theme/SearchPage",2027],"1be78505":[function(){return Promise.all([n.e(532),n.e(9514)]).then(n.bind(n,9963))},"@theme/DocPage",9963],"1f391b9e":[function(){return Promise.all([n.e(532),n.e(771),n.e(3085)]).then(n.bind(n,4247))},"@theme/MDXPage",4247],"230aeb34":[function(){return n.e(3291).then(n.t.bind(n,7765,19))},"~docs/default/version-7-0-x-metadata-prop-4d1.json",7765],"243cbd97":[function(){return n.e(5845).then(n.bind(n,9780))},"@site/versioned_docs/version-7.1.x/configuration/alpha_config.md",9780],"2c77072c":[function(){return n.e(9692).then(n.bind(n,760))},"@site/versioned_docs/version-7.3.x/configuration/alpha_config.md",760],"300a9996":[function(){return n.e(2593).then(n.bind(n,8630))},"@site/versioned_docs/version-7.1.x/community/security.md",8630],"35234f08":[function(){return n.e(2158).then(n.bind(n,7213))},"@site/docs/community/security.md",7213],"357fe94d":[function(){return n.e(9267).then(n.bind(n,3647))},"@site/docs/configuration/auth.md",3647],"3b8c55ea":[function(){return n.e(3217).then(n.bind(n,9803))},"@site/docs/installation.md",9803],"3b8e2d60":[function(){return n.e(7165).then(n.bind(n,2679))},"@site/versioned_docs/version-7.2.x/community/security.md",2679],"3def9002":[function(){return n.e(4189).then(n.bind(n,1693))},"@site/versioned_docs/version-6.1.x/configuration/auth.md",1693],"3fa022c7":[function(){return n.e(8967).then(n.bind(n,2970))},"@site/versioned_docs/version-7.0.x/configuration/alpha_config.md",2970],"41de83de":[function(){return n.e(7250).then(n.bind(n,6239))},"@site/versioned_docs/version-7.1.x/behaviour.md",6239],"42326c77":[function(){return n.e(7595).then(n.bind(n,7327))},"@site/versioned_docs/version-6.1.x/behaviour.md",7327],"452b66d6":[function(){return n.e(5626).then(n.bind(n,4949))},"@site/versioned_docs/version-7.4.x/features/endpoints.md",4949],"4922efd5":[function(){return n.e(5679).then(n.bind(n,5137))},"@site/versioned_docs/version-7.4.x/configuration/alpha_config.md",5137],"4ae90ba0":[function(){return n.e(74).then(n.bind(n,2714))},"@site/versioned_docs/version-7.4.x/community/security.md",2714],"567d20e7":[function(){return n.e(5367).then(n.t.bind(n,7834,19))},"~docs/default/version-7-5-x-metadata-prop-b7f.json",7834],"585bdad0":[function(){return n.e(8249).then(n.bind(n,6647))},"@site/docs/configuration/tls.md",6647],"5a047177":[function(){return n.e(2598).then(n.bind(n,2846))},"@site/versioned_docs/version-7.0.x/behaviour.md",2846],"5dfb0b41":[function(){return n.e(5597).then(n.bind(n,9232))},"@site/versioned_docs/version-7.4.x/configuration/sessions.md",9232],"63d69a63":[function(){return n.e(7401).then(n.bind(n,6249))},"@site/versioned_docs/version-7.1.x/installation.md",6249],"64f5dfca":[function(){return n.e(7356).then(n.bind(n,4452))},"@site/versioned_docs/version-7.4.x/configuration/tls.md",4452],"65a49553":[function(){return n.e(3938).then(n.bind(n,8106))},"@site/versioned_docs/version-7.3.x/configuration/sessions.md",8106],"674dcd29":[function(){return Promise.all([n.e(532),n.e(9464)]).then(n.bind(n,5366))},"@site/versioned_docs/version-7.4.x/configuration/overview.md",5366],"6f497b56":[function(){return n.e(2114).then(n.bind(n,4925))},"@site/versioned_docs/version-6.1.x/features/request_signatures.md",4925],"76aee1e9":[function(){return Promise.all([n.e(532),n.e(707)]).then(n.bind(n,6104))},"@site/versioned_docs/version-7.2.x/configuration/overview.md",6104],"7874e99f":[function(){return n.e(6482).then(n.bind(n,3615))},"@site/versioned_docs/version-7.2.x/configuration/alpha_config.md",3615],"7b04b1d5":[function(){return n.e(4998).then(n.bind(n,5403))},"@site/versioned_docs/version-6.1.x/installation.md",5403],"7dcecc8d":[function(){return n.e(1351).then(n.bind(n,7025))},"@site/versioned_docs/version-7.0.x/configuration/auth.md",7025],"8c826f25":[function(){return Promise.all([n.e(532),n.e(9890)]).then(n.bind(n,5508))},"@site/versioned_docs/version-7.0.x/configuration/overview.md",5508],"8f68f251":[function(){return n.e(507).then(n.t.bind(n,4802,19))},"~docs/default/version-7-3-x-metadata-prop-08c.json",4802],92147208:[function(){return n.e(2098).then(n.bind(n,2769))},"@site/versioned_docs/version-7.1.x/configuration/overview.md",2769],"935f2afb":[function(){return n.e(53).then(n.t.bind(n,1109,19))},"~docs/default/version-current-metadata-prop-751.json",1109],94285305:[function(){return n.e(2822).then(n.bind(n,3761))},"@site/docs/behaviour.md",3761],"9ac82b89":[function(){return n.e(2608).then(n.bind(n,8778))},"@site/versioned_docs/version-7.2.x/installation.md",8778],"9b9cfcc1":[function(){return n.e(5410).then(n.bind(n,8954))},"@site/versioned_docs/version-7.2.x/configuration/tls.md",8954],"9c6b37b9":[function(){return n.e(268).then(n.bind(n,6972))},"@site/versioned_docs/version-7.3.x/configuration/auth.md",6972],"9f61b932":[function(){return n.e(8583).then(n.bind(n,831))},"@site/docs/configuration/sessions.md",831],a1bbfb14:[function(){return n.e(3782).then(n.bind(n,861))},"@site/versioned_docs/version-7.2.x/configuration/auth.md",861],a37c03cb:[function(){return n.e(2871).then(n.bind(n,8291))},"@site/versioned_docs/version-6.1.x/configuration/tls.md",8291],a68195a4:[function(){return n.e(1169).then(n.bind(n,1816))},"@site/versioned_docs/version-7.5.x/configuration/auth.md",1816],a916fa41:[function(){return n.e(7357).then(n.bind(n,5503))},"@site/versioned_docs/version-7.5.x/features/endpoints.md",5503],a991188b:[function(){return n.e(9512).then(n.bind(n,7832))},"@site/versioned_docs/version-6.1.x/features/endpoints.md",7832],ab02279c:[function(){return n.e(3005).then(n.t.bind(n,5745,19))},"/home/runner/work/oauth2-proxy/oauth2-proxy/master/docs/.docusaurus/docusaurus-plugin-content-pages/default/plugin-route-context-module-100.json",5745],acde588d:[function(){return n.e(8500).then(n.bind(n,9048))},"@site/versioned_docs/version-7.3.x/community/security.md",9048],adcdd4d2:[function(){return n.e(1487).then(n.bind(n,4163))},"@site/versioned_docs/version-7.2.x/behaviour.md",4163],ade45c9a:[function(){return Promise.all([n.e(532),n.e(8447)]).then(n.bind(n,7324))},"@site/versioned_docs/version-6.1.x/configuration/overview.md",7324],b312ff36:[function(){return n.e(5680).then(n.bind(n,1662))},"@site/versioned_docs/version-7.5.x/behaviour.md",1662],b89e1cb0:[function(){return n.e(8873).then(n.bind(n,8706))},"@site/versioned_docs/version-7.0.x/features/request_signatures.md",8706],b9702c11:[function(){return n.e(1365).then(n.bind(n,31))},"@site/versioned_docs/version-7.3.x/behaviour.md",31],be200c4b:[function(){return n.e(3358).then(n.t.bind(n,3972,19))},"~docs/default/version-6-1-x-metadata-prop-625.json",3972],cbc8963c:[function(){return n.e(8555).then(n.bind(n,7072))},"@site/versioned_docs/version-7.1.x/configuration/auth.md",7072],cd4a49c1:[function(){return n.e(2439).then(n.bind(n,4044))},"@site/docs/configuration/alpha_config.md",4044],cecf159a:[function(){return n.e(5995).then(n.t.bind(n,6720,19))},"~docs/default/version-7-1-x-metadata-prop-4ab.json",6720],ceef21a3:[function(){return n.e(2575).then(n.bind(n,4840))},"@site/versioned_docs/version-7.5.x/configuration/tls.md",4840],cf2016e4:[function(){return n.e(7163).then(n.t.bind(n,3769,19))},"/home/runner/work/oauth2-proxy/oauth2-proxy/master/docs/.docusaurus/docusaurus-plugin-content-docs/default/plugin-route-context-module-100.json",3769],d319f4c2:[function(){return n.e(2960).then(n.bind(n,1142))},"@site/versioned_docs/version-7.4.x/installation.md",1142],d4a2a59c:[function(){return n.e(2260).then(n.bind(n,2033))},"@site/versioned_docs/version-7.3.x/features/endpoints.md",2033],d62b9139:[function(){return n.e(5910).then(n.bind(n,7590))},"@site/versioned_docs/version-7.5.x/configuration/alpha_config.md",7590],dc696e54:[function(){return n.e(5971).then(n.bind(n,9637))},"@site/versioned_docs/version-7.5.x/installation.md",9637],de718920:[function(){return n.e(8338).then(n.bind(n,7772))},"@site/versioned_docs/version-7.1.x/configuration/tls.md",7772],e7cb9657:[function(){return Promise.all([n.e(532),n.e(2423)]).then(n.bind(n,8520))},"@site/versioned_docs/version-7.5.x/configuration/overview.md",8520],e8c74efb:[function(){return n.e(811).then(n.t.bind(n,275,19))},"~docs/default/version-7-2-x-metadata-prop-080.json",275],ea7cbf6d:[function(){return n.e(5874).then(n.bind(n,754))},"@site/versioned_docs/version-6.1.x/community/security.md",754],ecc333f0:[function(){return n.e(3843).then(n.bind(n,8750))},"@site/versioned_docs/version-7.2.x/configuration/sessions.md",8750],edfc6e1b:[function(){return n.e(8724).then(n.bind(n,5696))},"@site/versioned_docs/version-7.0.x/configuration/sessions.md",5696],efc9be4b:[function(){return n.e(6119).then(n.bind(n,6522))},"@site/docs/features/endpoints.md",6522],efec474a:[function(){return Promise.all([n.e(532),n.e(1558)]).then(n.bind(n,3957))},"@site/versioned_docs/version-7.3.x/configuration/overview.md",3957],f3976560:[function(){return n.e(2844).then(n.bind(n,672))},"@site/src/pages/index.md",672],f4c9d322:[function(){return n.e(4472).then(n.bind(n,6779))},"@site/versioned_docs/version-7.0.x/community/security.md",6779],f5839aac:[function(){return n.e(7826).then(n.bind(n,8782))},"@site/versioned_docs/version-6.1.x/configuration/sessions.md",8782],f5afe1a5:[function(){return n.e(5809).then(n.bind(n,1408))},"@site/versioned_docs/version-7.4.x/configuration/auth.md",1408],f69784af:[function(){return n.e(4193).then(n.bind(n,2501))},"@site/versioned_docs/version-7.5.x/community/security.md",2501],f8ffbaca:[function(){return n.e(4024).then(n.t.bind(n,7572,19))},"~docs/default/version-7-4-x-metadata-prop-fe5.json",7572],f98fc388:[function(){return n.e(5437).then(n.bind(n,2018))},"@site/versioned_docs/version-7.1.x/features/endpoints.md",2018],fb908f49:[function(){return n.e(6042).then(n.bind(n,7286))},"@site/versioned_docs/version-7.2.x/features/endpoints.md",7286]};function s(e){var t=e.error,n=e.retry,o=e.pastDelay;return t?r.createElement("div",{style:{textAlign:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"}},r.createElement("p",null,String(t)),r.createElement("div",null,r.createElement("button",{type:"button",onClick:n},"Retry"))):o?r.createElement("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"}},r.createElement("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb"},r.createElement("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2"},r.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},r.createElement("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),r.createElement("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0"},r.createElement("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),r.createElement("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})),r.createElement("circle",{cx:"22",cy:"22",r:"8"},r.createElement("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"}))))):null}var c=n(9670),d=n(226);function f(e,t){if("*"===e)return a()({loading:s,loader:function(){return n.e(4972).then(n.bind(n,4972))},modules:["@theme/NotFound"],webpack:function(){return[4972]},render:function(e,t){var n=e.default;return r.createElement(d.z,{value:{plugin:{name:"native",id:"default"}}},r.createElement(n,t))}});var i=u[e+"-"+t],f={},p=[],h=[],m=(0,c.Z)(i);return Object.entries(m).forEach((function(e){var t=e[0],n=e[1],r=l[n];r&&(f[t]=r[0],p.push(r[1]),h.push(r[2]))})),a().Map({loading:s,loader:f,modules:p,webpack:function(){return h},render:function(t,n){var a=JSON.parse(JSON.stringify(i));Object.entries(t).forEach((function(t){var n=t[0],r=t[1],o=r.default;if(!o)throw new Error("The page component at "+e+" doesn't have a default export. This makes it impossible to render anything. Consider default-exporting a React component.");"object"!=typeof o&&"function"!=typeof o||Object.keys(r).filter((function(e){return"default"!==e})).forEach((function(e){o[e]=r[e]}));var i=a,u=n.split(".");u.slice(0,-1).forEach((function(e){i=i[e]})),i[u[u.length-1]]=o}));var u=a.__comp;delete a.__comp;var l=a.__context;return delete a.__context,r.createElement(d.z,{value:l},r.createElement(u,(0,o.Z)({},a,n)))}})}var p=[{path:"/oauth2-proxy/search",component:f("/oauth2-proxy/search","56a"),exact:!0},{path:"/oauth2-proxy/docs/6.1.x",component:f("/oauth2-proxy/docs/6.1.x","d8d"),routes:[{path:"/oauth2-proxy/docs/6.1.x/",component:f("/oauth2-proxy/docs/6.1.x/","5cb"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/behaviour",component:f("/oauth2-proxy/docs/6.1.x/behaviour","f27"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/community/security",component:f("/oauth2-proxy/docs/6.1.x/community/security","fca"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/6.1.x/configuration/oauth_provider","b14"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/configuration/overview",component:f("/oauth2-proxy/docs/6.1.x/configuration/overview","f3f"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/configuration/session_storage",component:f("/oauth2-proxy/docs/6.1.x/configuration/session_storage","e48"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/configuration/tls",component:f("/oauth2-proxy/docs/6.1.x/configuration/tls","1ec"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/features/endpoints",component:f("/oauth2-proxy/docs/6.1.x/features/endpoints","130"),exact:!0,sidebar:"version-6.1.x/docs"},{path:"/oauth2-proxy/docs/6.1.x/features/request_signatures",component:f("/oauth2-proxy/docs/6.1.x/features/request_signatures","da5"),exact:!0,sidebar:"version-6.1.x/docs"}]},{path:"/oauth2-proxy/docs/7.0.x",component:f("/oauth2-proxy/docs/7.0.x","ca7"),routes:[{path:"/oauth2-proxy/docs/7.0.x/",component:f("/oauth2-proxy/docs/7.0.x/","244"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/behaviour",component:f("/oauth2-proxy/docs/7.0.x/behaviour","8be"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/community/security",component:f("/oauth2-proxy/docs/7.0.x/community/security","e9b"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/configuration/alpha-config",component:f("/oauth2-proxy/docs/7.0.x/configuration/alpha-config","988"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/7.0.x/configuration/oauth_provider","43b"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/configuration/overview",component:f("/oauth2-proxy/docs/7.0.x/configuration/overview","1f8"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/configuration/session_storage",component:f("/oauth2-proxy/docs/7.0.x/configuration/session_storage","cb8"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/configuration/tls",component:f("/oauth2-proxy/docs/7.0.x/configuration/tls","30b"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/features/endpoints",component:f("/oauth2-proxy/docs/7.0.x/features/endpoints","3c2"),exact:!0,sidebar:"version-7.0.x/docs"},{path:"/oauth2-proxy/docs/7.0.x/features/request_signatures",component:f("/oauth2-proxy/docs/7.0.x/features/request_signatures","494"),exact:!0,sidebar:"version-7.0.x/docs"}]},{path:"/oauth2-proxy/docs/7.1.x",component:f("/oauth2-proxy/docs/7.1.x","254"),routes:[{path:"/oauth2-proxy/docs/7.1.x/",component:f("/oauth2-proxy/docs/7.1.x/","735"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/behaviour",component:f("/oauth2-proxy/docs/7.1.x/behaviour","070"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/community/security",component:f("/oauth2-proxy/docs/7.1.x/community/security","702"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/configuration/alpha-config",component:f("/oauth2-proxy/docs/7.1.x/configuration/alpha-config","f0d"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/7.1.x/configuration/oauth_provider","a58"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/configuration/overview",component:f("/oauth2-proxy/docs/7.1.x/configuration/overview","323"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/configuration/session_storage",component:f("/oauth2-proxy/docs/7.1.x/configuration/session_storage","ee0"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/configuration/tls",component:f("/oauth2-proxy/docs/7.1.x/configuration/tls","46b"),exact:!0,sidebar:"version-7.1.x/docs"},{path:"/oauth2-proxy/docs/7.1.x/features/endpoints",component:f("/oauth2-proxy/docs/7.1.x/features/endpoints","3a4"),exact:!0,sidebar:"version-7.1.x/docs"}]},{path:"/oauth2-proxy/docs/7.2.x",component:f("/oauth2-proxy/docs/7.2.x","db9"),routes:[{path:"/oauth2-proxy/docs/7.2.x/",component:f("/oauth2-proxy/docs/7.2.x/","85e"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/behaviour",component:f("/oauth2-proxy/docs/7.2.x/behaviour","030"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/community/security",component:f("/oauth2-proxy/docs/7.2.x/community/security","abd"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/configuration/alpha-config",component:f("/oauth2-proxy/docs/7.2.x/configuration/alpha-config","2bf"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/7.2.x/configuration/oauth_provider","9d7"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/configuration/overview",component:f("/oauth2-proxy/docs/7.2.x/configuration/overview","4f6"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/configuration/session_storage",component:f("/oauth2-proxy/docs/7.2.x/configuration/session_storage","9d2"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/configuration/tls",component:f("/oauth2-proxy/docs/7.2.x/configuration/tls","44c"),exact:!0,sidebar:"version-7.2.x/docs"},{path:"/oauth2-proxy/docs/7.2.x/features/endpoints",component:f("/oauth2-proxy/docs/7.2.x/features/endpoints","5eb"),exact:!0,sidebar:"version-7.2.x/docs"}]},{path:"/oauth2-proxy/docs/7.3.x",component:f("/oauth2-proxy/docs/7.3.x","dc0"),routes:[{path:"/oauth2-proxy/docs/7.3.x/",component:f("/oauth2-proxy/docs/7.3.x/","7a6"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/behaviour",component:f("/oauth2-proxy/docs/7.3.x/behaviour","b82"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/community/security",component:f("/oauth2-proxy/docs/7.3.x/community/security","6c3"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/configuration/alpha-config",component:f("/oauth2-proxy/docs/7.3.x/configuration/alpha-config","c64"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/7.3.x/configuration/oauth_provider","d30"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/configuration/overview",component:f("/oauth2-proxy/docs/7.3.x/configuration/overview","413"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/configuration/session_storage",component:f("/oauth2-proxy/docs/7.3.x/configuration/session_storage","474"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/configuration/tls",component:f("/oauth2-proxy/docs/7.3.x/configuration/tls","1cb"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.3.x/features/endpoints",component:f("/oauth2-proxy/docs/7.3.x/features/endpoints","084"),exact:!0,sidebar:"docs"}]},{path:"/oauth2-proxy/docs/7.4.x",component:f("/oauth2-proxy/docs/7.4.x","0a6"),routes:[{path:"/oauth2-proxy/docs/7.4.x/",component:f("/oauth2-proxy/docs/7.4.x/","2a8"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/behaviour",component:f("/oauth2-proxy/docs/7.4.x/behaviour","6d7"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/community/security",component:f("/oauth2-proxy/docs/7.4.x/community/security","7bf"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/configuration/alpha-config",component:f("/oauth2-proxy/docs/7.4.x/configuration/alpha-config","056"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/configuration/oauth_provider",component:f("/oauth2-proxy/docs/7.4.x/configuration/oauth_provider","fd5"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/configuration/overview",component:f("/oauth2-proxy/docs/7.4.x/configuration/overview","922"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/configuration/session_storage",component:f("/oauth2-proxy/docs/7.4.x/configuration/session_storage","251"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/configuration/tls",component:f("/oauth2-proxy/docs/7.4.x/configuration/tls","d5c"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/7.4.x/features/endpoints",component:f("/oauth2-proxy/docs/7.4.x/features/endpoints","304"),exact:!0,sidebar:"docs"}]},{path:"/oauth2-proxy/docs/next",component:f("/oauth2-proxy/docs/next","1a2"),routes:[{path:"/oauth2-proxy/docs/next/",component:f("/oauth2-proxy/docs/next/","f81"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/behaviour",component:f("/oauth2-proxy/docs/next/behaviour","a17"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/community/security",component:f("/oauth2-proxy/docs/next/community/security","54a"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/configuration/alpha-config",component:f("/oauth2-proxy/docs/next/configuration/alpha-config","1f5"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/configuration/oauth_provider",component:f("/oauth2-proxy/docs/next/configuration/oauth_provider","dad"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/configuration/overview",component:f("/oauth2-proxy/docs/next/configuration/overview","252"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/configuration/session_storage",component:f("/oauth2-proxy/docs/next/configuration/session_storage","08f"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/configuration/tls",component:f("/oauth2-proxy/docs/next/configuration/tls","411"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/next/features/endpoints",component:f("/oauth2-proxy/docs/next/features/endpoints","348"),exact:!0,sidebar:"docs"}]},{path:"/oauth2-proxy/docs",component:f("/oauth2-proxy/docs","2ed"),routes:[{path:"/oauth2-proxy/docs/",component:f("/oauth2-proxy/docs/","fd7"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/behaviour",component:f("/oauth2-proxy/docs/behaviour","a51"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/community/security",component:f("/oauth2-proxy/docs/community/security","6a2"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/configuration/alpha-config",component:f("/oauth2-proxy/docs/configuration/alpha-config","4fb"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/configuration/oauth_provider",component:f("/oauth2-proxy/docs/configuration/oauth_provider","c3a"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/configuration/overview",component:f("/oauth2-proxy/docs/configuration/overview","658"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/configuration/session_storage",component:f("/oauth2-proxy/docs/configuration/session_storage","9a1"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/configuration/tls",component:f("/oauth2-proxy/docs/configuration/tls","88f"),exact:!0,sidebar:"docs"},{path:"/oauth2-proxy/docs/features/endpoints",component:f("/oauth2-proxy/docs/features/endpoints","773"),exact:!0,sidebar:"docs"}]},{path:"/oauth2-proxy/",component:f("/oauth2-proxy/","549"),exact:!0},{path:"*",component:f("*")}]},8934:function(e,t,n){"use strict";n.d(t,{_:function(){return o},t:function(){return i}});var r=n(7294),o=r.createContext(!1);function i(e){var t=e.children,n=(0,r.useState)(!1),i=n[0],a=n[1];return(0,r.useEffect)((function(){a(!0)}),[]),r.createElement(o.Provider,{value:i},t)}},9383:function(e,t,n){"use strict";var r=n(7294),o=n(3935),i=n(3727),a=n(405),u=n(412),l=[n(2497),n(3310),n(8320),n(2295)],s=n(723),c=n(6550),d=n(8790);function f(e){var t=e.children;return r.createElement(r.Fragment,null,t)}var p=n(7462),h=n(5742),m=n(2263),g=n(4996),v=n(6668),y=n(1944),b=n(4711),x=n(9727),w=n(3320),k=n(197);function E(){var e=(0,m.Z)().i18n,t=e.defaultLocale,n=e.localeConfigs,o=(0,b.l)();return r.createElement(h.Z,null,Object.entries(n).map((function(e){var t=e[0],n=e[1].htmlLang;return r.createElement("link",{key:t,rel:"alternate",href:o.createUrl({locale:t,fullyQualified:!0}),hrefLang:n})})),r.createElement("link",{rel:"alternate",href:o.createUrl({locale:t,fullyQualified:!0}),hrefLang:"x-default"}))}function S(e){var t=e.permalink,n=(0,m.Z)().siteConfig.url,o=function(){var e=(0,m.Z)().siteConfig.url,t=(0,c.TH)().pathname;return e+(0,g.Z)(t)}(),i=t?""+n+t:o;return r.createElement(h.Z,null,r.createElement("meta",{property:"og:url",content:i}),r.createElement("link",{rel:"canonical",href:i}))}function _(){var e=(0,m.Z)().i18n.currentLocale,t=(0,v.L)(),n=t.metadata,o=t.image;return r.createElement(r.Fragment,null,r.createElement(h.Z,null,r.createElement("meta",{name:"twitter:card",content:"summary_large_image"}),r.createElement("body",{className:x.h})),o&&r.createElement(y.d,{image:o}),r.createElement(S,null),r.createElement(E,null),r.createElement(k.Z,{tag:w.HX,locale:e}),r.createElement(h.Z,null,n.map((function(e,t){return r.createElement("meta",(0,p.Z)({key:t},e))}))))}var T=new Map;function C(e){if(T.has(e.pathname))return Object.assign({},e,{pathname:T.get(e.pathname)});if((0,d.f)(s.Z,e.pathname).some((function(e){return!0===e.route.exact})))return T.set(e.pathname,e.pathname),e;var t=e.pathname.trim().replace(/(?:\/index)?\.html$/,"")||"/";return T.set(e.pathname,t),Object.assign({},e,{pathname:t})}var A=n(8934),D=n(8940),P=n(4578);function L(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r\n

Your Docusaurus site did not load properly.

\n

A very common reason is a wrong site baseUrl configuration.

\n

Current configured baseUrl = '+e+" "+("/"===e?" (default value)":"")+'

\n

We suggest trying baseUrl =

\n\n'}(e)).replace(/0)&&(j.current.unobserve(e),j.current.disconnect(),null!=N&&window.docusaurus.prefetch(N))}))})),j.current.observe(e))},to:N},m&&{isActive:b,activeClassName:y}))}var m=i.forwardRef(h)},5999:function(e,t,n){"use strict";n.d(t,{Z:function(){return l},I:function(){return u}});var r=n(7294);function o(e,t){var n=e.split(/(\{\w+\})/).map((function(e,n){if(n%2==1){var r=null==t?void 0:t[e.slice(1,-1)];if(void 0!==r)return r}return e}));return n.some((function(e){return(0,r.isValidElement)(e)}))?n.map((function(e,t){return(0,r.isValidElement)(e)?r.cloneElement(e,{key:t}):e})).filter((function(e){return""!==e})):n.join("")}var i=n(7529);function a(e){var t,n,r=e.id,o=e.message;if(void 0===r&&void 0===o)throw new Error("Docusaurus translation declarations must have at least a translation id or a default translation message");return null!=(t=null!=(n=i[null!=r?r:o])?n:o)?t:r}function u(e,t){return o(a({message:e.message,id:e.id}),t)}function l(e){var t=e.children,n=e.id,i=e.values;if(t&&"string"!=typeof t)throw console.warn("Illegal children",t),new Error("The Docusaurus component only accept simple string values");var u=a({message:t,id:n});return r.createElement(r.Fragment,null,o(u,i))}},9935:function(e,t,n){"use strict";n.d(t,{m:function(){return r}});var r="default"},3919:function(e,t,n){"use strict";function r(e){return/^(?:\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,{Z:function(){return o},b:function(){return r}})},4996:function(e,t,n){"use strict";n.d(t,{C:function(){return a},Z:function(){return u}});var r=n(7294),o=n(2263),i=n(3919);function a(){var e=(0,o.Z)().siteConfig,t=e.baseUrl,n=e.url,a=(0,r.useCallback)((function(e,r){return function(e,t,n,r){var o=void 0===r?{}:r,a=o.forcePrependBaseUrl,u=void 0!==a&&a,l=o.absolute,s=void 0!==l&&l;if(!n||n.startsWith("#")||(0,i.b)(n))return n;if(u)return t+n.replace(/^\//,"");if(n===t.replace(/\/$/,""))return t;var c=n.startsWith(t)?n:t+n.replace(/^\//,"");return s?e+c:c}(n,t,e,r)}),[n,t]);return{withBaseUrl:a}}function u(e,t){return void 0===t&&(t={}),(0,a().withBaseUrl)(e,t)}},2263:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n(7294),o=n(8940);function i(){return(0,r.useContext)(o._)}},2389:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n(7294),o=n(8934);function i(){return(0,r.useContext)(o._)}},9670:function(e,t,n){"use strict";n.d(t,{Z:function(){return o}});var r=function(e){return"object"==typeof e&&!!e&&Object.keys(e).length>0};function o(e){var t={};return function e(n,o){Object.entries(n).forEach((function(n){var i=n[0],a=n[1],u=o?o+"."+i:i;r(a)?e(a,u):t[u]=a}))}(e),t}},226:function(e,t,n){"use strict";n.d(t,{_:function(){return o},z:function(){return i}});var r=n(7294),o=r.createContext(null);function i(e){var t=e.children,n=e.value,i=r.useContext(o),a=(0,r.useMemo)((function(){return function(e){var t=e.parent,n=e.value;if(!t){if(!n)throw new Error("Unexpected: no Docusaurus route context found");if(!("plugin"in n))throw new Error("Unexpected: Docusaurus topmost route context has no `plugin` attribute");return n}var r=Object.assign({},t.data,null==n?void 0:n.data);return{plugin:t.plugin,data:r}}({parent:i,value:n})}),[i,n]);return r.createElement(o.Provider,{value:a},t)}},143:function(e,t,n){"use strict";n.d(t,{Iw:function(){return m},gA:function(){return f},_r:function(){return c},Jo:function(){return g},zh:function(){return d},yW:function(){return h},gB:function(){return p}});var r=n(6550),o=n(2263),i=n(9935);function a(e,t){void 0===t&&(t={});var n=(0,o.Z)().globalData[e];if(!n&&t.failfast)throw new Error('Docusaurus plugin global data not found for "'+e+'" plugin.');return n}var u=function(e){return e.versions.find((function(e){return e.isLast}))};function l(e,t){var n,o,i=function(e,t){var n=u(e);return[].concat(e.versions.filter((function(e){return e!==n})),[n]).find((function(e){return!!(0,r.LX)(t,{path:e.path,exact:!1,strict:!1})}))}(e,t),a=null==i?void 0:i.docs.find((function(e){return!!(0,r.LX)(t,{path:e.path,exact:!0,strict:!1})}));return{activeVersion:i,activeDoc:a,alternateDocVersions:a?(n=a.id,o={},e.versions.forEach((function(e){e.docs.forEach((function(t){t.id===n&&(o[e.name]=t)}))})),o):{}}}var s={},c=function(){var e;return null!=(e=a("docusaurus-plugin-content-docs"))?e:s},d=function(e){return function(e,t,n){void 0===t&&(t=i.m),void 0===n&&(n={});var r=a(e),o=null==r?void 0:r[t];if(!o&&n.failfast)throw new Error('Docusaurus plugin global data not found for "'+e+'" plugin with id "'+t+'".');return o}("docusaurus-plugin-content-docs",e,{failfast:!0})};function f(e){return void 0===e&&(e={}),function(e,t,n){void 0===n&&(n={});var o=Object.entries(e).sort((function(e,t){return t[1].path.localeCompare(e[1].path)})).find((function(e){var n=e[1];return!!(0,r.LX)(t,{path:n.path,exact:!1,strict:!1})})),i=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!i&&n.failfast)throw new Error("Can't find active docs plugin for \""+t+'" pathname, while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: '+Object.values(e).map((function(e){return e.path})).join(", "));return i}(c(),(0,r.TH)().pathname,e)}function p(e){return d(e).versions}function h(e){var t=d(e);return u(t)}function m(e){return l(d(e),(0,r.TH)().pathname)}function g(e){return function(e,t){var n=u(e);return{latestDocSuggestion:l(e,t).alternateDocVersions[n.name],latestVersionSuggestion:n}}(d(e),(0,r.TH)().pathname)}},8320:function(e,t,n){"use strict";n.r(t);var r=n(4865),o=n.n(r);o().configure({showSpinner:!1});var i={onRouteUpdate:function(e){var t=e.location,n=e.previousLocation;if(n&&t.pathname!==n.pathname){var r=window.setTimeout((function(){o().start()}),200);return function(){return window.clearTimeout(r)}}},onRouteDidUpdate:function(){o().done()}};t.default=i},3310:function(e,t,n){"use strict";n.r(t);var r,o,i=n(7410),a=n(6809);r=i.Z,o=a.Z.themeConfig.prism.additionalLanguages,globalThis.Prism=r,o.forEach((function(e){n(6726)("./prism-"+e)})),delete globalThis.Prism},9471:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n(7294),o={iconExternalLink:"iconExternalLink_nPIU"};function i(e){var t=e.width,n=void 0===t?13.5:t,i=e.height,a=void 0===i?13.5:i;return r.createElement("svg",{width:n,height:a,"aria-hidden":"true",viewBox:"0 0 24 24",className:o.iconExternalLink},r.createElement("path",{fill:"currentColor",d:"M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"}))}},179:function(e,t,n){"use strict";n.d(t,{Z:function(){return tn}});var r=n(7294),o=n(6010),i=n(4763),a=n(1944),u=n(7462),l=n(6550),s=n(5999),c=n(5936),d="__docusaurus_skipToContent_fallback";function f(e){e.setAttribute("tabindex","-1"),e.focus(),e.removeAttribute("tabindex")}function p(){var e=(0,r.useRef)(null),t=(0,l.k6)().action,n=(0,r.useCallback)((function(e){e.preventDefault();var t,n=null!=(t=document.querySelector("main:first-of-type"))?t:document.getElementById(d);n&&f(n)}),[]);return(0,c.S)((function(n){var r=n.location;e.current&&!r.hash&&"PUSH"===t&&f(e.current)})),{containerRef:e,onClick:n}}var h=(0,s.I)({id:"theme.common.skipToMainContent",description:"The skip to content label used for accessibility, allowing to rapidly navigate to main content with keyboard tab/enter navigation",message:"Skip to main content"});function m(e){var t,n=null!=(t=e.children)?t:h,o=p(),i=o.containerRef,a=o.onClick;return r.createElement("div",{ref:i,role:"region","aria-label":h},r.createElement("a",(0,u.Z)({},e,{href:"#"+d,onClick:a}),n))}var g=n(5281),v=n(9727),y={skipToContent:"skipToContent_fXgn"};function b(){return r.createElement(m,{className:y.skipToContent})}var x=n(6668),w=n(9689),k=n(3366),E=["width","height","color","strokeWidth","className"];function S(e){var t=e.width,n=void 0===t?21:t,o=e.height,i=void 0===o?21:o,a=e.color,l=void 0===a?"currentColor":a,s=e.strokeWidth,c=void 0===s?1.2:s,d=(e.className,(0,k.Z)(e,E));return r.createElement("svg",(0,u.Z)({viewBox:"0 0 15 15",width:n,height:i},d),r.createElement("g",{stroke:l,strokeWidth:c},r.createElement("path",{d:"M.75.75l13.5 13.5M14.25.75L.75 14.25"})))}var _={closeButton:"closeButton_CVFx"};function T(e){return r.createElement("button",(0,u.Z)({type:"button","aria-label":(0,s.I)({id:"theme.AnnouncementBar.closeButtonAriaLabel",message:"Close",description:"The ARIA label for close button of announcement bar"})},e,{className:(0,o.Z)("clean-btn close",_.closeButton,e.className)}),r.createElement(S,{width:14,height:14,strokeWidth:3.1}))}var C={content:"content_knG7"};function A(e){var t=(0,x.L)().announcementBar.content;return r.createElement("div",(0,u.Z)({},e,{className:(0,o.Z)(C.content,e.className),dangerouslySetInnerHTML:{__html:t}}))}var D={announcementBar:"announcementBar_mb4j",announcementBarPlaceholder:"announcementBarPlaceholder_vyr4",announcementBarClose:"announcementBarClose_gvF7",announcementBarContent:"announcementBarContent_xLdY"};function P(){var e=(0,x.L)().announcementBar,t=(0,w.nT)(),n=t.isActive,o=t.close;if(!n)return null;var i=e.backgroundColor,a=e.textColor,u=e.isCloseable;return r.createElement("div",{className:D.announcementBar,style:{backgroundColor:i,color:a},role:"banner"},u&&r.createElement("div",{className:D.announcementBarPlaceholder}),r.createElement(A,{className:D.announcementBarContent}),u&&r.createElement(T,{onClick:o,className:D.announcementBarClose}))}var L=n(3163),R=n(2466);var O=n(9688),N=n(3102),I=r.createContext(null);function F(e){var t,n,o,i,a,u,l,s=e.children,c=(t=(0,L.e)(),n=(0,N.HY)(),o=(0,r.useState)(!1),i=o[0],a=o[1],u=null!==n.component,l=(0,O.D9)(u),(0,r.useEffect)((function(){u&&!l&&a(!0)}),[u,l]),(0,r.useEffect)((function(){u?t.shown||a(!0):a(!1)}),[t.shown,u]),(0,r.useMemo)((function(){return[i,a]}),[i]));return r.createElement(I.Provider,{value:c},s)}function M(e){if(e.component){var t=e.component;return r.createElement(t,e.props)}}function j(){var e=(0,r.useContext)(I);if(!e)throw new O.i6("NavbarSecondaryMenuDisplayProvider");var t=e[0],n=e[1],o=(0,r.useCallback)((function(){return n(!1)}),[n]),i=(0,N.HY)();return(0,r.useMemo)((function(){return{shown:t,hide:o,content:M(i)}}),[o,i,t])}function B(e){var t=e.header,n=e.primaryMenu,i=e.secondaryMenu,a=j().shown;return r.createElement("div",{className:"navbar-sidebar"},t,r.createElement("div",{className:(0,o.Z)("navbar-sidebar__items",{"navbar-sidebar__items--show-secondary":a})},r.createElement("div",{className:"navbar-sidebar__item menu"},n),r.createElement("div",{className:"navbar-sidebar__item menu"},i)))}var z=n(2949),U=n(2389);function Z(e){return r.createElement("svg",(0,u.Z)({viewBox:"0 0 24 24",width:24,height:24},e),r.createElement("path",{fill:"currentColor",d:"M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"}))}function q(e){return r.createElement("svg",(0,u.Z)({viewBox:"0 0 24 24",width:24,height:24},e),r.createElement("path",{fill:"currentColor",d:"M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"}))}var H={toggle:"toggle_vylO",toggleButton:"toggleButton_gllP",darkToggleIcon:"darkToggleIcon_wfgR",lightToggleIcon:"lightToggleIcon_pyhR",toggleButtonDisabled:"toggleButtonDisabled_aARS"};function $(e){var t=e.className,n=e.buttonClassName,i=e.value,a=e.onChange,u=(0,U.Z)(),l=(0,s.I)({message:"Switch between dark and light mode (currently {mode})",id:"theme.colorToggle.ariaLabel",description:"The ARIA label for the navbar color mode toggle"},{mode:"dark"===i?(0,s.I)({message:"dark mode",id:"theme.colorToggle.ariaLabel.mode.dark",description:"The name for the dark color mode"}):(0,s.I)({message:"light mode",id:"theme.colorToggle.ariaLabel.mode.light",description:"The name for the light color mode"})});return r.createElement("div",{className:(0,o.Z)(H.toggle,t)},r.createElement("button",{className:(0,o.Z)("clean-btn",H.toggleButton,!u&&H.toggleButtonDisabled,n),type:"button",onClick:function(){return a("dark"===i?"light":"dark")},disabled:!u,title:l,"aria-label":l,"aria-live":"polite"},r.createElement(Z,{className:(0,o.Z)(H.toggleIcon,H.lightToggleIcon)}),r.createElement(q,{className:(0,o.Z)(H.toggleIcon,H.darkToggleIcon)})))}var G=r.memo($),Q={darkNavbarColorModeToggle:"darkNavbarColorModeToggle_X3D1"};function V(e){var t=e.className,n=(0,x.L)().navbar.style,o=(0,x.L)().colorMode.disableSwitch,i=(0,z.I)(),a=i.colorMode,u=i.setColorMode;return o?null:r.createElement(G,{className:t,buttonClassName:"dark"===n?Q.darkNavbarColorModeToggle:void 0,value:a,onChange:u})}var W=n(1327);function K(){return r.createElement(W.Z,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title text--truncate"})}function Y(){var e=(0,L.e)();return r.createElement("button",{type:"button","aria-label":(0,s.I)({id:"theme.docs.sidebar.closeSidebarButtonAriaLabel",message:"Close navigation bar",description:"The ARIA label for close button of mobile sidebar"}),className:"clean-btn navbar-sidebar__close",onClick:function(){return e.toggle()}},r.createElement(S,{color:"var(--ifm-color-emphasis-600)"}))}function X(){return r.createElement("div",{className:"navbar-sidebar__brand"},r.createElement(K,null),r.createElement(V,{className:"margin-right--md"}),r.createElement(Y,null))}var J=n(9960),ee=n(4996),te=n(3919);function ne(e,t){return void 0!==e&&void 0!==t&&new RegExp(e,"gi").test(t)}var re=n(9471),oe=["activeBasePath","activeBaseRegex","to","href","label","html","isDropdownLink","prependBaseUrlToHref"];function ie(e){var t=e.activeBasePath,n=e.activeBaseRegex,o=e.to,i=e.href,a=e.label,l=e.html,s=e.isDropdownLink,c=e.prependBaseUrlToHref,d=(0,k.Z)(e,oe),f=(0,ee.Z)(o),p=(0,ee.Z)(t),h=(0,ee.Z)(i,{forcePrependBaseUrl:!0}),m=a&&i&&!(0,te.Z)(i),g=l?{dangerouslySetInnerHTML:{__html:l}}:{children:r.createElement(r.Fragment,null,a,m&&r.createElement(re.Z,s&&{width:12,height:12}))};return i?r.createElement(J.Z,(0,u.Z)({href:c?h:i},d,g)):r.createElement(J.Z,(0,u.Z)({to:f,isNavLink:!0},(t||n)&&{isActive:function(e,t){return n?ne(n,t.pathname):t.pathname.startsWith(p)}},d,g))}var ae=["className","isDropdownItem"],ue=["className","isDropdownItem"],le=["mobile","position"];function se(e){var t=e.className,n=e.isDropdownItem,i=void 0!==n&&n,a=(0,k.Z)(e,ae),l=r.createElement(ie,(0,u.Z)({className:(0,o.Z)(i?"dropdown__link":"navbar__item navbar__link",t),isDropdownLink:i},a));return i?r.createElement("li",null,l):l}function ce(e){var t=e.className,n=(e.isDropdownItem,(0,k.Z)(e,ue));return r.createElement("li",{className:"menu__list-item"},r.createElement(ie,(0,u.Z)({className:(0,o.Z)("menu__link",t)},n)))}function de(e){var t,n=e.mobile,o=void 0!==n&&n,i=(e.position,(0,k.Z)(e,le)),a=o?ce:se;return r.createElement(a,(0,u.Z)({},i,{activeClassName:null!=(t=i.activeClassName)?t:o?"menu__link--active":"navbar__link--active"}))}var fe=n(6043),pe=n(8596),he=n(2263);var me=["items","position","className","onClick"],ge=["items","className","position","onClick"],ve=["mobile"];function ye(e,t){return e.some((function(e){return function(e,t){return!!(0,pe.Mg)(e.to,t)||!!ne(e.activeBaseRegex,t)||!(!e.activeBasePath||!t.startsWith(e.activeBasePath))}(e,t)}))}function be(e){var t,n=e.items,i=e.position,a=e.className,l=(e.onClick,(0,k.Z)(e,me)),s=(0,r.useRef)(null),c=(0,r.useState)(!1),d=c[0],f=c[1];return(0,r.useEffect)((function(){var e=function(e){s.current&&!s.current.contains(e.target)&&f(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),document.addEventListener("focusin",e),function(){document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e),document.removeEventListener("focusin",e)}}),[s]),r.createElement("div",{ref:s,className:(0,o.Z)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--right":"right"===i,"dropdown--show":d})},r.createElement(ie,(0,u.Z)({"aria-haspopup":"true","aria-expanded":d,role:"button",href:l.to?void 0:"#",className:(0,o.Z)("navbar__link",a)},l,{onClick:l.to?void 0:function(e){return e.preventDefault()},onKeyDown:function(e){"Enter"===e.key&&(e.preventDefault(),f(!d))}}),null!=(t=l.children)?t:l.label),r.createElement("ul",{className:"dropdown__menu"},n.map((function(e,t){return r.createElement(dt,(0,u.Z)({isDropdownItem:!0,activeClassName:"dropdown__link--active"},e,{key:t}))}))))}function xe(e){var t,n,i=e.items,a=e.className,s=(e.position,e.onClick),c=(0,k.Z)(e,ge),d=(n=(0,he.Z)().siteConfig.baseUrl,(0,l.TH)().pathname.replace(n,"/")),f=ye(i,d),p=(0,fe.u)({initialState:function(){return!f}}),h=p.collapsed,m=p.toggleCollapsed,g=p.setCollapsed;return(0,r.useEffect)((function(){f&&g(!f)}),[d,f,g]),r.createElement("li",{className:(0,o.Z)("menu__list-item",{"menu__list-item--collapsed":h})},r.createElement(ie,(0,u.Z)({role:"button",className:(0,o.Z)("menu__link menu__link--sublist menu__link--sublist-caret",a)},c,{onClick:function(e){e.preventDefault(),m()}}),null!=(t=c.children)?t:c.label),r.createElement(fe.z,{lazy:!0,as:"ul",className:"menu__list",collapsed:h},i.map((function(e,t){return r.createElement(dt,(0,u.Z)({mobile:!0,isDropdownItem:!0,onClick:s,activeClassName:"menu__link--active"},e,{key:t}))}))))}function we(e){var t=e.mobile,n=void 0!==t&&t,o=(0,k.Z)(e,ve),i=n?xe:be;return r.createElement(i,o)}var ke=n(4711),Ee=["width","height"];function Se(e){var t=e.width,n=void 0===t?20:t,o=e.height,i=void 0===o?20:o,a=(0,k.Z)(e,Ee);return r.createElement("svg",(0,u.Z)({viewBox:"0 0 24 24",width:n,height:i,"aria-hidden":!0},a),r.createElement("path",{fill:"currentColor",d:"M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"}))}var _e="iconLanguage_nlXk",Te=["mobile","dropdownItemsBefore","dropdownItemsAfter"];var Ce=n(1029),Ae=n(7855),De=n(4165),Pe=n(5861),Le=n(412),Re=n(373),Oe=n(143),Ne=n(22),Ie=n(8202),Fe=n(3926),Me=n(1073),je=n(2539),Be=n(726),ze='',Ue='',Ze='',qe='',He='',$e='',Ge='',Qe={searchBar:"searchBar_RVTs",dropdownMenu:"dropdownMenu_qbY6",suggestion:"suggestion_fB_2",cursor:"cursor_eG29",hitTree:"hitTree_kk6K",hitIcon:"hitIcon_a7Zy",hitPath:"hitPath_ieM4",noResultsIcon:"noResultsIcon_EBY5",hitFooter:"hitFooter_E9YW",hitWrapper:"hitWrapper_sAK8",hitTitle:"hitTitle_vyVt",hitAction:"hitAction_NqkB",hideAction:"hideAction_vcyE",noResults:"noResults_l6Q3",searchBarContainer:"searchBarContainer_NW3z",searchBarLoadingRing:"searchBarLoadingRing_YnHq",searchClearButton:"searchClearButton_qk4g",searchIndexLoading:"searchIndexLoading_EJ1f",searchHintContainer:"searchHintContainer_Pkmr",searchHint:"searchHint_iIMx",input:"input_FOTf",hint:"hint_URu1",suggestions:"suggestions_X8XU",dataset:"dataset_QiCy",empty:"empty_eITn"};function Ve(e){var t=e.document,n=e.type,r=e.page,o=e.metadata,i=e.tokens,a=e.isInterOfTree,u=e.isLastOfTree,l=0===n,s=1===n,c=[];a?c.push($e):u&&c.push(Ge);var d=c.map((function(e){return''+e+""})),f=''+(l?ze:s?Ue:Ze)+"",p=[''+(0,Be.o)(t.t,(0,Me.m)(o,"t"),i)+""];if(!a&&!u&&Ce.H6){var h,m=r?(null!=(h=r.b)?h:[]).concat(r.t).concat(t.s&&t.s!==r.t?t.s:[]):t.b;p.push(''+(0,Fe.e)(null!=m?m:[])+"")}else l||p.push(''+(0,je.C)(r.t||(t.u.startsWith("/docs/api-reference/")?"API Reference":""),i)+"");var g=''+qe+"";return[].concat(d,[f,''],p,["",g]).join("")}function We(){return''+He+""+(0,s.I)({id:"theme.SearchBar.noResultsText",message:"No results"})+""}var Ke,Ye=n(311);function Xe(){return(Ke=Ke||(0,Pe.Z)((0,De.Z)().mark((function e(){var t,r;return(0,De.Z)().wrap((function(e){for(;;)switch(e.prev=e.next){case 0:return e.next=2,Promise.all([n.e(8443),n.e(5525)]).then(n.t.bind(n,8443,23));case 2:return t=e.sent,(r=t.default).noConflict?r.noConflict():t.noConflict&&t.noConflict(),e.abrupt("return",r);case 6:case"end":return e.stop()}}),e)})))).apply(this,arguments)}var Je="_highlight";var et=function(e){var t,n,i,a=e.handleSearchBarToggle,u=(0,he.Z)().siteConfig.baseUrl,c=(0,Oe.gA)(),d=u,f=(0,Re.J)(null==c?void 0:c.pluginId).preferredVersion;f&&!f.isLast&&(d=f.path+"/");var p=(0,l.k6)(),h=(0,l.TH)(),m=(0,r.useRef)(null),g=(0,r.useRef)("empty"),v=(0,r.useRef)(!1),y=(0,r.useState)(!1),b=y[0],x=y[1],w=(0,r.useState)(!1),k=w[0],E=w[1],S=(0,r.useState)(""),_=S[0],T=S[1],C=(0,r.useRef)(null),A=(0,r.useCallback)((0,Pe.Z)((0,De.Z)().mark((function e(){var t,n,r,o,i,a;return(0,De.Z)().wrap((function(e){for(;;)switch(e.prev=e.next){case 0:if("empty"===g.current){e.next=2;break}return e.abrupt("return");case 2:return g.current="loading",x(!0),e.next=6,Promise.all([(0,Ne.w)(d),Xe()]);case 6:t=e.sent,n=t[0],r=n.wrappedIndexes,o=n.zhDictionary,i=t[1],C.current=i(m.current,{hint:!1,autoselect:!0,openOnFocus:!0,cssClasses:{root:Qe.searchBar,noPrefix:!0,dropdownMenu:Qe.dropdownMenu,input:Qe.input,hint:Qe.hint,suggestions:Qe.suggestions,suggestion:Qe.suggestion,cursor:Qe.cursor,dataset:Qe.dataset,empty:Qe.empty}},[{source:(0,Ie.v)(r,o,Ce.qo),templates:{suggestion:Ve,empty:We,footer:function(e){var t=e.query;if(!e.isEmpty){var n=document.createElement("a"),r=u+"search?q="+encodeURIComponent(t);n.href=r,n.textContent=(0,s.I)({id:"theme.SearchBar.seeAll",message:"See all results"}),n.addEventListener("click",(function(e){e.ctrlKey||e.metaKey||(e.preventDefault(),C.current.autocomplete.close(),p.push(r))}));var o=document.createElement("div");return o.className=Qe.hitFooter,o.appendChild(n),o}}}}]).on("autocomplete:selected",(function(e,t){var n,r=t.document,o=r.u,i=r.h,a=t.tokens;null==(n=m.current)||n.blur();var u=o;if(Ce.vc&&a.length>0){for(var l,s=new URLSearchParams,c=(0,Ae.Z)(a);!(l=c()).done;){var d=l.value;s.append(Je,d)}u+="?"+s.toString()}i&&(u+=i),p.push(u)})).on("autocomplete:closed",(function(){var e;null==(e=m.current)||e.blur()})),g.current="done",x(!1),v.current&&((a=m.current).value&&C.current.autocomplete.open(),a.focus());case 15:case"end":return e.stop()}}),e)}))),[u,d,p]);(0,r.useEffect)((function(){if(Ce.vc){var e=Le.Z.canUseDOM?new URLSearchParams(h.search).getAll(Je):[];setTimeout((function(){var t,n=document.querySelector("article");if(n){var r=new Ce.vc(n);r.unmark(),0!==e.length&&r.mark(e),T(e.join(" ")),null==(t=C.current)||t.autocomplete.setVal(e.join(" "))}}))}}),[h.search,h.pathname]);var D=(0,r.useCallback)((function(){v.current=!0,A(),null==a||a(!0)}),[a,A]),P=(0,r.useCallback)((function(){null==a||a(!1)}),[a]),L=(0,r.useCallback)((function(){A()}),[A]),R=(0,r.useCallback)((function(e){T(e.target.value),e.target.value&&E(!0)}),[]),O=!!Le.Z.canUseDOM&&/mac/i.test(null!=(t=null==(n=navigator.userAgentData)?void 0:n.platform)?t:navigator.platform);(0,r.useEffect)((function(){if(Ce.AY){var e=function(e){var t;(O?e.metaKey:e.ctrlKey)&&"KeyK"===e.code&&(e.preventDefault(),null==(t=m.current)||t.focus(),D())};return document.addEventListener("keydown",e),function(){document.removeEventListener("keydown",e)}}}),[O,D]);var N=(0,r.useCallback)((function(){var e,t=new URLSearchParams(h.search);t.delete(Je);var n=t.toString(),r=h.pathname+(""!=n?"?"+n:"")+h.hash;r!=h.pathname+h.search+h.hash&&p.push(r),T(""),null==(e=C.current)||e.autocomplete.setVal("")}),[h.pathname,h.search,h.hash,p]);return r.createElement("div",{className:(0,o.Z)("navbar__search",Qe.searchBarContainer,(i={},i[Qe.searchIndexLoading]=b&&k,i))},r.createElement("input",{placeholder:(0,s.I)({id:"theme.SearchBar.label",message:"Search",description:"The ARIA label and placeholder for search button"}),"aria-label":"Search",className:"navbar__search-input",onMouseEnter:L,onFocus:D,onBlur:P,onChange:R,ref:m,value:_}),r.createElement(Ye.Z,{className:Qe.searchBarLoadingRing}),Ce.AY&&Ce.t_&&(""!==_?r.createElement("button",{className:Qe.searchClearButton,onClick:N},"\u2715"):r.createElement("div",{className:Qe.searchHintContainer},r.createElement("kbd",{className:Qe.searchHint},O?"\u2318":"ctrl"),r.createElement("kbd",{className:Qe.searchHint},"K"))))},tt={searchBox:"searchBox_ZlJk"};function nt(e){var t=e.children,n=e.className;return r.createElement("div",{className:(0,o.Z)(n,tt.searchBox)},t)}var rt=n(3438),ot=["docId","label","docsPluginId"];var it=["sidebarId","label","docsPluginId"];var at=["label","to","docsPluginId"];var ut=["mobile","docsPluginId","dropdownActiveClassDisabled","dropdownItemsBefore","dropdownItemsAfter"],lt=function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))};var st={default:de,localeDropdown:function(e){var t=e.mobile,n=e.dropdownItemsBefore,o=e.dropdownItemsAfter,i=(0,k.Z)(e,Te),a=(0,he.Z)().i18n,c=a.currentLocale,d=a.locales,f=a.localeConfigs,p=(0,ke.l)(),h=(0,l.TH)(),m=h.search,g=h.hash,v=d.map((function(e){var n=""+("pathname://"+p.createUrl({locale:e,fullyQualified:!1}))+m+g;return{label:f[e].label,lang:f[e].htmlLang,to:n,target:"_self",autoAddBaseUrl:!1,className:e===c?t?"menu__link--active":"dropdown__link--active":""}})),y=[].concat(n,v,o),b=t?(0,s.I)({message:"Languages",id:"theme.navbar.mobileLanguageDropdown.label",description:"The label for the mobile language switcher dropdown"}):f[c].label;return r.createElement(we,(0,u.Z)({},i,{mobile:t,label:r.createElement(r.Fragment,null,r.createElement(Se,{className:_e}),b),items:y}))},search:function(e){var t=e.mobile,n=e.className;return t?null:r.createElement(nt,{className:n},r.createElement(et,null))},dropdown:we,html:function(e){var t=e.value,n=e.className,i=e.mobile,a=void 0!==i&&i,u=e.isDropdownItem,l=void 0!==u&&u,s=l?"li":"div";return r.createElement(s,{className:(0,o.Z)({navbar__item:!a&&!l,"menu__list-item":a},n),dangerouslySetInnerHTML:{__html:t}})},doc:function(e){var t=e.docId,n=e.label,o=e.docsPluginId,i=(0,k.Z)(e,ot),a=(0,Oe.Iw)(o).activeDoc,l=(0,rt.vY)(t,o);return null===l?null:r.createElement(de,(0,u.Z)({exact:!0},i,{isActive:function(){return(null==a?void 0:a.path)===l.path||!(null==a||!a.sidebar)&&a.sidebar===l.sidebar},label:null!=n?n:l.id,to:l.path}))},docSidebar:function(e){var t=e.sidebarId,n=e.label,o=e.docsPluginId,i=(0,k.Z)(e,it),a=(0,Oe.Iw)(o).activeDoc,l=(0,rt.oz)(t,o).link;if(!l)throw new Error('DocSidebarNavbarItem: Sidebar with ID "'+t+"\" doesn't have anything to be linked to.");return r.createElement(de,(0,u.Z)({exact:!0},i,{isActive:function(){return(null==a?void 0:a.sidebar)===t},label:null!=n?n:l.label,to:l.path}))},docsVersion:function(e){var t=e.label,n=e.to,o=e.docsPluginId,i=(0,k.Z)(e,at),a=(0,rt.lO)(o)[0],l=null!=t?t:a.label,s=null!=n?n:function(e){return e.docs.find((function(t){return t.id===e.mainDocId}))}(a).path;return r.createElement(de,(0,u.Z)({},i,{label:l,to:s}))},docsVersionDropdown:function(e){var t=e.mobile,n=e.docsPluginId,o=e.dropdownActiveClassDisabled,i=e.dropdownItemsBefore,a=e.dropdownItemsAfter,c=(0,k.Z)(e,ut),d=(0,l.TH)(),f=d.search,p=d.hash,h=(0,Oe.Iw)(n),m=(0,Oe.gB)(n),g=(0,Re.J)(n).savePreferredVersionName,v=m.map((function(e){var t,n=null!=(t=h.alternateDocVersions[e.name])?t:lt(e);return{label:e.label,to:""+n.path+f+p,isActive:function(){return e===h.activeVersion},onClick:function(){return g(e.name)}}})),y=[].concat(i,v,a),b=(0,rt.lO)(n)[0],x=t&&y.length>1?(0,s.I)({id:"theme.navbar.mobileVersionsDropdown.label",message:"Versions",description:"The label for the navbar versions dropdown on mobile view"}):b.label,w=t&&y.length>1?void 0:lt(b).path;return y.length<=1?r.createElement(de,(0,u.Z)({},c,{mobile:t,label:x,to:w,isActive:o?function(){return!1}:void 0})):r.createElement(we,(0,u.Z)({},c,{mobile:t,label:x,to:w,items:y,isActive:o?function(){return!1}:void 0}))}},ct=["type"];function dt(e){var t=e.type,n=(0,k.Z)(e,ct),o=function(e,t){return e&&"default"!==e?e:"items"in t?"dropdown":"default"}(t,n),i=st[o];if(!i)throw new Error('No NavbarItem component found for type "'+t+'".');return r.createElement(i,n)}function ft(){var e=(0,L.e)(),t=(0,x.L)().navbar.items;return r.createElement("ul",{className:"menu__list"},t.map((function(t,n){return r.createElement(dt,(0,u.Z)({mobile:!0},t,{onClick:function(){return e.toggle()},key:n}))})))}function pt(e){return r.createElement("button",(0,u.Z)({},e,{type:"button",className:"clean-btn navbar-sidebar__back"}),r.createElement(s.Z,{id:"theme.navbar.mobileSidebarSecondaryMenu.backButtonLabel",description:"The label of the back button to return to main menu, inside the mobile navbar sidebar secondary menu (notably used to display the docs sidebar)"},"\u2190 Back to main menu"))}function ht(){var e=0===(0,x.L)().navbar.items.length,t=j();return r.createElement(r.Fragment,null,!e&&r.createElement(pt,{onClick:function(){return t.hide()}}),t.content)}function mt(){var e,t=(0,L.e)();return void 0===(e=t.shown)&&(e=!0),(0,r.useEffect)((function(){return document.body.style.overflow=e?"hidden":"visible",function(){document.body.style.overflow="visible"}}),[e]),t.shouldRender?r.createElement(B,{header:r.createElement(X,null),primaryMenu:r.createElement(ft,null),secondaryMenu:r.createElement(ht,null)}):null}var gt={navbarHideable:"navbarHideable_m1mJ",navbarHidden:"navbarHidden_jGov"};function vt(e){return r.createElement("div",(0,u.Z)({role:"presentation"},e,{className:(0,o.Z)("navbar-sidebar__backdrop",e.className)}))}function yt(e){var t=e.children,n=(0,x.L)().navbar,i=n.hideOnScroll,a=n.style,u=(0,L.e)(),l=function(e){var t=(0,r.useState)(e),n=t[0],o=t[1],i=(0,r.useRef)(!1),a=(0,r.useRef)(0),u=(0,r.useCallback)((function(e){null!==e&&(a.current=e.getBoundingClientRect().height)}),[]);return(0,R.RF)((function(t,n){var r=t.scrollY;if(e)if(r=u?o(!1):r+s0&&r.createElement(Zt,{links:n}),logo:o&&r.createElement(Gt,{logo:o}),copyright:t&&r.createElement(Qt,{copyright:t})})}var Kt=r.memo(Wt),Yt=(0,O.Qc)([z.S,w.pl,R.OC,Re.L5,a.VC,function(e){var t=e.children;return r.createElement(N.n2,null,r.createElement(L.M,null,r.createElement(F,null,t)))}]);function Xt(e){var t=e.children;return r.createElement(Yt,null,t)}function Jt(e){var t=e.error,n=e.tryAgain;return r.createElement("main",{className:"container margin-vert--xl"},r.createElement("div",{className:"row"},r.createElement("div",{className:"col col--6 col--offset-3"},r.createElement("h1",{className:"hero__title"},r.createElement(s.Z,{id:"theme.ErrorPageContent.title",description:"The title of the fallback page when the page crashed"},"This page crashed.")),r.createElement("div",{className:"margin-vert--lg"},r.createElement(kt,{onClick:n,className:"button button--primary shadow--lw"})),r.createElement("hr",null),r.createElement("div",{className:"margin-vert--md"},r.createElement(Et,{error:t})))))}var en={mainWrapper:"mainWrapper_z2l0"};function tn(e){var t=e.children,n=e.noFooter,u=e.wrapperClassName,l=e.title,s=e.description;return(0,v.t)(),r.createElement(Xt,null,r.createElement(a.d,{title:l,description:s}),r.createElement(b,null),r.createElement(P,null),r.createElement(Ot,null),r.createElement("div",{id:d,className:(0,o.Z)(g.k.wrapper.main,en.mainWrapper,u)},r.createElement(i.Z,{fallback:function(e){return r.createElement(Jt,e)}},t)),!n&&r.createElement(Kt,null))}},1327:function(e,t,n){"use strict";n.d(t,{Z:function(){return p}});var r=n(7462),o=n(3366),i=n(7294),a=n(9960),u=n(4996),l=n(2263),s=n(6668),c=n(941),d=["imageClassName","titleClassName"];function f(e){var t=e.logo,n=e.alt,r=e.imageClassName,o={light:(0,u.Z)(t.src),dark:(0,u.Z)(t.srcDark||t.src)},a=i.createElement(c.Z,{className:t.className,sources:o,height:t.height,width:t.width,alt:n,style:t.style});return r?i.createElement("div",{className:r},a):a}function p(e){var t,n=(0,l.Z)().siteConfig.title,c=(0,s.L)().navbar,p=c.title,h=c.logo,m=e.imageClassName,g=e.titleClassName,v=(0,o.Z)(e,d),y=(0,u.Z)((null==h?void 0:h.href)||"/"),b=p?"":n,x=null!=(t=null==h?void 0:h.alt)?t:b;return i.createElement(a.Z,(0,r.Z)({to:y},v,(null==h?void 0:h.target)&&{target:h.target}),h&&i.createElement(f,{logo:h,alt:x,imageClassName:m}),null!=p&&i.createElement("b",{className:g},p))}},197:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n(7294),o=n(5742);function i(e){var t=e.locale,n=e.version,i=e.tag,a=t;return r.createElement(o.Z,null,t&&r.createElement("meta",{name:"docusaurus_locale",content:t}),n&&r.createElement("meta",{name:"docusaurus_version",content:n}),i&&r.createElement("meta",{name:"docusaurus_tag",content:i}),a&&r.createElement("meta",{name:"docsearch:language",content:a}),n&&r.createElement("meta",{name:"docsearch:version",content:n}),i&&r.createElement("meta",{name:"docsearch:docusaurus_tag",content:i}))}},941:function(e,t,n){"use strict";n.d(t,{Z:function(){return d}});var r=n(7462),o=n(3366),i=n(7294),a=n(6010),u=n(2389),l=n(2949),s={themedImage:"themedImage_ToTc","themedImage--light":"themedImage--light_HNdA","themedImage--dark":"themedImage--dark_i4oU"},c=["sources","className","alt"];function d(e){var t=(0,u.Z)(),n=(0,l.I)().colorMode,d=e.sources,f=e.className,p=e.alt,h=(0,o.Z)(e,c),m=t?"dark"===n?["dark"]:["light"]:["light","dark"];return i.createElement(i.Fragment,null,m.map((function(e){return i.createElement("img",(0,r.Z)({key:e,src:d[e],alt:p,className:(0,a.Z)(s.themedImage,s["themedImage--"+e],f)},h))})))}},6043:function(e,t,n){"use strict";n.d(t,{u:function(){return d},z:function(){return b}});var r=n(7462),o=n(3366),i=n(7294),a=n(412),u=n(1442),l=["collapsed"],s=["lazy"],c="ease-in-out";function d(e){var t=e.initialState,n=(0,i.useState)(null!=t&&t),r=n[0],o=n[1],a=(0,i.useCallback)((function(){o((function(e){return!e}))}),[]);return{collapsed:r,setCollapsed:o,toggleCollapsed:a}}var f={display:"none",overflow:"hidden",height:"0px"},p={display:"block",overflow:"visible",height:"auto"};function h(e,t){var n=t?f:p;e.style.display=n.display,e.style.overflow=n.overflow,e.style.height=n.height}function m(e){var t=e.collapsibleRef,n=e.collapsed,r=e.animation,o=(0,i.useRef)(!1);(0,i.useEffect)((function(){var e,i=t.current;function a(){var e,t,n=i.scrollHeight,o=null!=(e=null==r?void 0:r.duration)?e:function(e){if((0,u.n)())return 1;var t=e/36;return Math.round(10*(4+15*Math.pow(t,.25)+t/5))}(n);return{transition:"height "+o+"ms "+(null!=(t=null==r?void 0:r.easing)?t:c),height:n+"px"}}function l(){var e=a();i.style.transition=e.transition,i.style.height=e.height}if(!o.current)return h(i,n),void(o.current=!0);return i.style.willChange="height",e=requestAnimationFrame((function(){n?(l(),requestAnimationFrame((function(){i.style.height=f.height,i.style.overflow=f.overflow}))):(i.style.display="block",requestAnimationFrame((function(){l()})))})),function(){return cancelAnimationFrame(e)}}),[t,n,r])}function g(e){if(!a.Z.canUseDOM)return e?f:p}function v(e){var t=e.as,n=void 0===t?"div":t,r=e.collapsed,o=e.children,a=e.animation,u=e.onCollapseTransitionEnd,l=e.className,s=e.disableSSRStyle,c=(0,i.useRef)(null);return m({collapsibleRef:c,collapsed:r,animation:a}),i.createElement(n,{ref:c,style:s?void 0:g(r),onTransitionEnd:function(e){"height"===e.propertyName&&(h(c.current,r),null==u||u(r))},className:l},o)}function y(e){var t=e.collapsed,n=(0,o.Z)(e,l),a=(0,i.useState)(!t),u=a[0],s=a[1],c=(0,i.useState)(t),d=c[0],f=c[1];return(0,i.useLayoutEffect)((function(){t||s(!0)}),[t]),(0,i.useLayoutEffect)((function(){u&&f(t)}),[u,t]),u?i.createElement(v,(0,r.Z)({},n,{collapsed:d})):null}function b(e){var t=e.lazy,n=(0,o.Z)(e,s),r=t?y:v;return i.createElement(r,n)}},9689:function(e,t,n){"use strict";n.d(t,{nT:function(){return h},pl:function(){return p}});var r=n(7294),o=n(2389),i=n(12),a=n(9688),u=n(6668),l=(0,i.WA)("docusaurus.announcement.dismiss"),s=(0,i.WA)("docusaurus.announcement.id"),c=function(){return"true"===l.get()},d=function(e){return l.set(String(e))},f=r.createContext(null);function p(e){var t=e.children,n=function(){var e=(0,u.L)().announcementBar,t=(0,o.Z)(),n=(0,r.useState)((function(){return!!t&&c()})),i=n[0],a=n[1];(0,r.useEffect)((function(){a(c())}),[]);var l=(0,r.useCallback)((function(){d(!0),a(!0)}),[]);return(0,r.useEffect)((function(){if(e){var t=e.id,n=s.get();"annoucement-bar"===n&&(n="announcement-bar");var r=t!==n;s.set(t),r&&d(!1),!r&&c()||a(!1)}}),[e]),(0,r.useMemo)((function(){return{isActive:!!e&&!i,close:l}}),[e,i,l])}();return r.createElement(f.Provider,{value:n},t)}function h(){var e=(0,r.useContext)(f);if(!e)throw new a.i6("AnnouncementBarProvider");return e}},2949:function(e,t,n){"use strict";n.d(t,{I:function(){return g},S:function(){return m}});var r=n(7294),o=n(412),i=n(9688),a=n(12),u=n(6668),l=r.createContext(void 0),s="theme",c=(0,a.WA)(s),d={light:"light",dark:"dark"},f=function(e){return e===d.dark?d.dark:d.light},p=function(e){return o.Z.canUseDOM?f(document.documentElement.getAttribute("data-theme")):f(e)},h=function(e){c.set(f(e))};function m(e){var t=e.children,n=function(){var e=(0,u.L)().colorMode,t=e.defaultMode,n=e.disableSwitch,o=e.respectPrefersColorScheme,i=(0,r.useState)(p(t)),a=i[0],l=i[1];(0,r.useEffect)((function(){n&&c.del()}),[n]);var m=(0,r.useCallback)((function(e,n){void 0===n&&(n={});var r=n.persist,i=void 0===r||r;e?(l(e),i&&h(e)):(l(o?window.matchMedia("(prefers-color-scheme: dark)").matches?d.dark:d.light:t),c.del())}),[o,t]);(0,r.useEffect)((function(){document.documentElement.setAttribute("data-theme",f(a))}),[a]),(0,r.useEffect)((function(){if(!n){var e=function(e){if(e.key===s){var t=c.get();null!==t&&m(f(t))}};return window.addEventListener("storage",e),function(){return window.removeEventListener("storage",e)}}}),[n,m]);var g=(0,r.useRef)(!1);return(0,r.useEffect)((function(){if(!n||o){var e=window.matchMedia("(prefers-color-scheme: dark)"),t=function(){window.matchMedia("print").matches||g.current?g.current=window.matchMedia("print").matches:m(null)};return e.addListener(t),function(){return e.removeListener(t)}}}),[m,n,o]),(0,r.useMemo)((function(){return{colorMode:a,setColorMode:m,get isDarkTheme(){return a===d.dark},setLightTheme:function(){m(d.light)},setDarkTheme:function(){m(d.dark)}}}),[a,m])}();return r.createElement(l.Provider,{value:n},t)}function g(){var e=(0,r.useContext)(l);if(null==e)throw new i.i6("ColorModeProvider","Please see https://docusaurus.io/docs/api/themes/configuration#use-color-mode.");return e}},373:function(e,t,n){"use strict";n.d(t,{J:function(){return y},L5:function(){return g}});var r=n(7294),o=n(143),i=n(9935),a=n(6668),u=n(3438),l=n(9688),s=n(12),c=function(e){return"docs-preferred-version-"+e},d={save:function(e,t,n){(0,s.WA)(c(e),{persistence:t}).set(n)},read:function(e,t){return(0,s.WA)(c(e),{persistence:t}).get()},clear:function(e,t){(0,s.WA)(c(e),{persistence:t}).del()}},f=function(e){return Object.fromEntries(e.map((function(e){return[e,{preferredVersionName:null}]})))};var p=r.createContext(null);function h(){var e=(0,o._r)(),t=(0,a.L)().docs.versionPersistence,n=(0,r.useMemo)((function(){return Object.keys(e)}),[e]),i=(0,r.useState)((function(){return f(n)})),u=i[0],l=i[1];return(0,r.useEffect)((function(){l(function(e){var t=e.pluginIds,n=e.versionPersistence,r=e.allDocsData;return Object.fromEntries(t.map((function(e){return[e,(t=e,o=d.read(t,n),r[t].versions.some((function(e){return e.name===o}))?{preferredVersionName:o}:(d.clear(t,n),{preferredVersionName:null}))];var t,o})))}({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]),[u,(0,r.useMemo)((function(){return{savePreferredVersion:function(e,n){d.save(e,t,n),l((function(t){var r;return Object.assign({},t,((r={})[e]={preferredVersionName:n},r))}))}}}),[t])]}function m(e){var t=e.children,n=h();return r.createElement(p.Provider,{value:n},t)}function g(e){var t=e.children;return u.cE?r.createElement(m,null,t):r.createElement(r.Fragment,null,t)}function v(){var e=(0,r.useContext)(p);if(!e)throw new l.i6("DocsPreferredVersionContextProvider");return e}function y(e){var t;void 0===e&&(e=i.m);var n=(0,o.zh)(e),a=v(),u=a[0],l=a[1],s=u[e].preferredVersionName;return{preferredVersion:null!=(t=n.versions.find((function(e){return e.name===s})))?t:null,savePreferredVersionName:(0,r.useCallback)((function(t){l.savePreferredVersion(e,t)}),[l,e])}}},1116:function(e,t,n){"use strict";n.d(t,{V:function(){return l},b:function(){return u}});var r=n(7294),o=n(9688),i=Symbol("EmptyContext"),a=r.createContext(i);function u(e){var t=e.children,n=e.name,o=e.items,i=(0,r.useMemo)((function(){return n&&o?{name:n,items:o}:null}),[n,o]);return r.createElement(a.Provider,{value:i},t)}function l(){var e=(0,r.useContext)(a);if(e===i)throw new o.i6("DocsSidebarProvider");return e}},3163:function(e,t,n){"use strict";n.d(t,{M:function(){return d},e:function(){return f}});var r=n(7294),o=n(3102),i=n(7524),a=n(1980),u=n(6668),l=n(9688),s=r.createContext(void 0);function c(){var e,t=(e=(0,o.HY)(),0===(0,u.L)().navbar.items.length&&!e.component),n=(0,i.i)(),l=!t&&"mobile"===n,s=(0,r.useState)(!1),c=s[0],d=s[1];(0,a.Rb)((function(){if(c)return d(!1),!1}));var f=(0,r.useCallback)((function(){d((function(e){return!e}))}),[]);return(0,r.useEffect)((function(){"desktop"===n&&d(!1)}),[n]),(0,r.useMemo)((function(){return{disabled:t,shouldRender:l,toggle:f,shown:c}}),[t,l,f,c])}function d(e){var t=e.children,n=c();return r.createElement(s.Provider,{value:n},t)}function f(){var e=r.useContext(s);if(void 0===e)throw new l.i6("NavbarMobileSidebarProvider");return e}},3102:function(e,t,n){"use strict";n.d(t,{HY:function(){return u},Zo:function(){return l},n2:function(){return a}});var r=n(7294),o=n(9688),i=r.createContext(null);function a(e){var t=e.children,n=(0,r.useState)({component:null,props:null});return r.createElement(i.Provider,{value:n},t)}function u(){var e=(0,r.useContext)(i);if(!e)throw new o.i6("NavbarSecondaryMenuContentProvider");return e[0]}function l(e){var t=e.component,n=e.props,a=(0,r.useContext)(i);if(!a)throw new o.i6("NavbarSecondaryMenuContentProvider");var u=a[1],l=(0,o.Ql)(n);return(0,r.useEffect)((function(){u({component:t,props:l})}),[u,t,l]),(0,r.useEffect)((function(){return function(){return u({component:null,props:null})}}),[u]),null}},9727:function(e,t,n){"use strict";n.d(t,{h:function(){return o},t:function(){return i}});var r=n(7294),o="navigation-with-keyboard";function i(){(0,r.useEffect)((function(){function e(e){"keydown"===e.type&&"Tab"===e.key&&document.body.classList.add(o),"mousedown"===e.type&&document.body.classList.remove(o)}return document.addEventListener("keydown",e),document.addEventListener("mousedown",e),function(){document.body.classList.remove(o),document.removeEventListener("keydown",e),document.removeEventListener("mousedown",e)}}),[])}},7524:function(e,t,n){"use strict";n.d(t,{i:function(){return s}});var r=n(7294),o=n(412),i={desktop:"desktop",mobile:"mobile",ssr:"ssr"},a=996;function u(){return o.Z.canUseDOM?window.innerWidth>a?i.desktop:i.mobile:i.ssr}var l=!1;function s(){var e=(0,r.useState)((function(){return l?"ssr":u()})),t=e[0],n=e[1];return(0,r.useEffect)((function(){function e(){n(u())}var t=l?window.setTimeout(e,1e3):void 0;return window.addEventListener("resize",e),function(){window.removeEventListener("resize",e),clearTimeout(t)}}),[]),t}},5281:function(e,t,n){"use strict";n.d(t,{k:function(){return r}});var r={page:{blogListPage:"blog-list-page",blogPostPage:"blog-post-page",blogTagsListPage:"blog-tags-list-page",blogTagPostListPage:"blog-tags-post-list-page",docsDocPage:"docs-doc-page",docsTagsListPage:"docs-tags-list-page",docsTagDocListPage:"docs-tags-doc-list-page",mdxPage:"mdx-page"},wrapper:{main:"main-wrapper",blogPages:"blog-wrapper",docsPages:"docs-wrapper",mdxPages:"mdx-wrapper"},common:{editThisPage:"theme-edit-this-page",lastUpdated:"theme-last-updated",backToTopButton:"theme-back-to-top-button",codeBlock:"theme-code-block",admonition:"theme-admonition",admonitionType:function(e){return"theme-admonition-"+e}},layout:{},docs:{docVersionBanner:"theme-doc-version-banner",docVersionBadge:"theme-doc-version-badge",docBreadcrumbs:"theme-doc-breadcrumbs",docMarkdown:"theme-doc-markdown",docTocMobile:"theme-doc-toc-mobile",docTocDesktop:"theme-doc-toc-desktop",docFooter:"theme-doc-footer",docFooterTagsRow:"theme-doc-footer-tags-row",docFooterEditMetaRow:"theme-doc-footer-edit-meta-row",docSidebarContainer:"theme-doc-sidebar-container",docSidebarMenu:"theme-doc-sidebar-menu",docSidebarItemCategory:"theme-doc-sidebar-item-category",docSidebarItemLink:"theme-doc-sidebar-item-link",docSidebarItemCategoryLevel:function(e){return"theme-doc-sidebar-item-category-level-"+e},docSidebarItemLinkLevel:function(e){return"theme-doc-sidebar-item-link-level-"+e}},blog:{}}},1442:function(e,t,n){"use strict";function r(){return window.matchMedia("(prefers-reduced-motion: reduce)").matches}n.d(t,{n:function(){return r}})},3438:function(e,t,n){"use strict";n.d(t,{Wl:function(){return p},_F:function(){return g},cE:function(){return f},hI:function(){return k},lO:function(){return b},oz:function(){return x},s1:function(){return y},vY:function(){return w}});var r=n(7855),o=n(7294),i=n(6550),a=n(8790),u=n(143),l=n(373),s=n(1116),c=n(7392),d=n(8596),f=!!u._r;function p(e){if(e.href)return e.href;for(var t,n=(0,r.Z)(e.items);!(t=n()).done;){var o=t.value;if("link"===o.type)return o.href;if("category"===o.type){var i=p(o);if(i)return i}}}var h=function(e,t){return void 0!==e&&(0,d.Mg)(e,t)},m=function(e,t){return e.some((function(e){return g(e,t)}))};function g(e,t){return"link"===e.type?h(e.href,t):"category"===e.type&&(h(e.href,t)||m(e.items,t))}function v(e){var t=e.sidebarItems,n=e.pathname,o=e.onlyCategories,i=void 0!==o&&o,a=[];return function e(t){for(var o,u=(0,r.Z)(t);!(o=u()).done;){var l=o.value;if("category"===l.type&&((0,d.Mg)(l.href,n)||e(l.items))||"link"===l.type&&(0,d.Mg)(l.href,n))return i&&"category"!==l.type||a.unshift(l),!0}return!1}(t),a}function y(){var e,t=(0,s.V)(),n=(0,i.TH)().pathname;return!1!==(null==(e=(0,u.gA)())?void 0:e.pluginData.breadcrumbs)&&t?v({sidebarItems:t.items,pathname:n}):null}function b(e){var t=(0,u.Iw)(e).activeVersion,n=(0,l.J)(e).preferredVersion,r=(0,u.yW)(e);return(0,o.useMemo)((function(){return(0,c.j)([t,n,r].filter(Boolean))}),[t,n,r])}function x(e,t){var n=b(t);return(0,o.useMemo)((function(){var t=n.flatMap((function(e){return e.sidebars?Object.entries(e.sidebars):[]})),r=t.find((function(t){return t[0]===e}));if(!r)throw new Error("Can't find any sidebar with id \""+e+'" in version'+(n.length>1?"s":"")+" "+n.map((function(e){return e.name})).join(", ")+'".\nAvailable sidebar ids are:\n- '+t.map((function(e){return e[0]})).join("\n- "));return r[1]}),[e,n])}function w(e,t){var n=b(t);return(0,o.useMemo)((function(){var t=n.flatMap((function(e){return e.docs})),r=t.find((function(t){return t.id===e}));if(!r){if(n.flatMap((function(e){return e.draftIds})).includes(e))return null;throw new Error("Couldn't find any doc with id \""+e+'" in version'+(n.length>1?"s":"")+' "'+n.map((function(e){return e.name})).join(", ")+'".\nAvailable doc ids are:\n- '+(0,c.j)(t.map((function(e){return e.id}))).join("\n- "))}return r}),[e,n])}function k(e){var t=e.route,n=e.versionMetadata,r=(0,i.TH)(),o=t.routes,u=o.find((function(e){return(0,i.LX)(r.pathname,e)}));if(!u)return null;var l=u.sidebar,s=l?n.docsSidebars[l]:void 0;return{docElement:(0,a.H)(o),sidebarName:l,sidebarItems:s}}},1980:function(e,t,n){"use strict";n.d(t,{Rb:function(){return u},_X:function(){return l}});var r=n(7294),o=n(6550),i=n(1688),a=n(9688);function u(e){!function(e){var t=(0,o.k6)(),n=(0,a.zX)(e);(0,r.useEffect)((function(){return t.block((function(e,t){return n(e,t)}))}),[t,n])}((function(t,n){if("POP"===n)return e(t,n)}))}function l(e){return t=function(t){return null===e?null:new URLSearchParams(t.location.search).get(e)},n=(0,o.k6)(),(0,i.useSyncExternalStore)(n.listen,(function(){return t(n)}),(function(){return t(n)}));var t,n}},7392:function(e,t,n){"use strict";function r(e,t){return void 0===t&&(t=function(e,t){return e===t}),e.filter((function(n,r){return e.findIndex((function(e){return t(e,n)}))!==r}))}function o(e){return Array.from(new Set(e))}n.d(t,{j:function(){return o},l:function(){return r}})},1944:function(e,t,n){"use strict";n.d(t,{FG:function(){return f},d:function(){return c},VC:function(){return p}});var r=n(7294),o=n(6010),i=n(5742),a=n(226);function u(){var e=r.useContext(a._);if(!e)throw new Error("Unexpected: no Docusaurus route context found");return e}var l=n(4996),s=n(2263);function c(e){var t=e.title,n=e.description,o=e.keywords,a=e.image,u=e.children,c=function(e){var t=(0,s.Z)().siteConfig,n=t.title,r=t.titleDelimiter;return null!=e&&e.trim().length?e.trim()+" "+r+" "+n:n}(t),d=(0,l.C)().withBaseUrl,f=a?d(a,{absolute:!0}):void 0;return r.createElement(i.Z,null,t&&r.createElement("title",null,c),t&&r.createElement("meta",{property:"og:title",content:c}),n&&r.createElement("meta",{name:"description",content:n}),n&&r.createElement("meta",{property:"og:description",content:n}),o&&r.createElement("meta",{name:"keywords",content:Array.isArray(o)?o.join(","):o}),f&&r.createElement("meta",{property:"og:image",content:f}),f&&r.createElement("meta",{name:"twitter:image",content:f}),u)}var d=r.createContext(void 0);function f(e){var t=e.className,n=e.children,a=r.useContext(d),u=(0,o.Z)(a,t);return r.createElement(d.Provider,{value:u},r.createElement(i.Z,null,r.createElement("html",{className:u})),n)}function p(e){var t=e.children,n=u(),i="plugin-"+n.plugin.name.replace(/docusaurus-(?:plugin|theme)-(?:content-)?/gi,""),a="plugin-id-"+n.plugin.id;return r.createElement(f,{className:(0,o.Z)(i,a)},t)}},9688:function(e,t,n){"use strict";n.d(t,{i6:function(){return p},Qc:function(){return m},zX:function(){return d},D9:function(){return f},Ql:function(){return h}});var r=n(7099),o=n(4578);function i(e){return i=Object.setPrototypeOf?Object.getPrototypeOf.bind():function(e){return e.__proto__||Object.getPrototypeOf(e)},i(e)}var a=n(9611);function u(e,t,n){return u=function(){if("undefined"==typeof Reflect||!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("function"==typeof Proxy)return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],(function(){}))),!0}catch(e){return!1}}()?Reflect.construct.bind():function(e,t,n){var r=[null];r.push.apply(r,t);var o=new(Function.bind.apply(e,r));return n&&(0,a.Z)(o,n.prototype),o},u.apply(null,arguments)}function l(e){var t="function"==typeof Map?new Map:void 0;return l=function(e){if(null===e||(n=e,-1===Function.toString.call(n).indexOf("[native code]")))return e;var n;if("function"!=typeof e)throw new TypeError("Super expression must either be null or a function");if(void 0!==t){if(t.has(e))return t.get(e);t.set(e,r)}function r(){return u(e,arguments,i(this).constructor)}return r.prototype=Object.create(e.prototype,{constructor:{value:r,enumerable:!1,writable:!0,configurable:!0}}),(0,a.Z)(r,e)},l(e)}var s=n(7294),c=n(412).Z.canUseDOM?s.useLayoutEffect:s.useEffect;function d(e){var t=(0,s.useRef)(e);return c((function(){t.current=e}),[e]),(0,s.useCallback)((function(){return t.current.apply(t,arguments)}),[])}function f(e){var t=(0,s.useRef)();return c((function(){t.current=e})),t.current}var p=function(e){function t(t,n){var o,i,a;return(a=e.call(this)||this).name="ReactContextError",a.message="Hook "+(null!=(o=null==(i=a.stack)||null==(i=i.split("\n")[1])||null==(i=i.match((0,r.Z)(/at (?:\w+\.)?(\w+)/,{name:1})))?void 0:i.groups.name)?o:"")+" is called outside the <"+t+">. "+(null!=n?n:""),a}return(0,o.Z)(t,e),t}(l(Error));function h(e){var t=Object.entries(e);return t.sort((function(e,t){return e[0].localeCompare(t[0])})),(0,s.useMemo)((function(){return e}),t.flat())}function m(e){return function(t){var n=t.children;return s.createElement(s.Fragment,null,e.reduceRight((function(e,t){return s.createElement(t,null,e)}),n))}}},8596:function(e,t,n){"use strict";n.d(t,{Mg:function(){return a},Ns:function(){return u}});var r=n(7294),o=n(723),i=n(2263);function a(e,t){var n=function(e){var t;return null==(t=!e||e.endsWith("/")?e:e+"/")?void 0:t.toLowerCase()};return n(e)===n(t)}function u(){var e=(0,i.Z)().siteConfig.baseUrl;return(0,r.useMemo)((function(){return function(e){var t=e.baseUrl;function n(e){return e.path===t&&!0===e.exact}function r(e){return e.path===t&&!e.exact}return function e(t){if(0!==t.length)return t.find(n)||e(t.filter(r).flatMap((function(e){var t;return null!=(t=e.routes)?t:[]})))}(e.routes)}({routes:o.Z,baseUrl:e})}),[e])}},2466:function(e,t,n){"use strict";n.d(t,{Ct:function(){return p},OC:function(){return l},RF:function(){return d},o5:function(){return f}});var r=n(7294),o=n(412),i=n(2389),a=n(9688);var u=r.createContext(void 0);function l(e){var t,n=e.children,o=(t=(0,r.useRef)(!0),(0,r.useMemo)((function(){return{scrollEventsEnabledRef:t,enableScrollEvents:function(){t.current=!0},disableScrollEvents:function(){t.current=!1}}}),[]));return r.createElement(u.Provider,{value:o},n)}function s(){var e=(0,r.useContext)(u);if(null==e)throw new a.i6("ScrollControllerProvider");return e}var c=function(){return o.Z.canUseDOM?{scrollX:window.pageXOffset,scrollY:window.pageYOffset}:null};function d(e,t){void 0===t&&(t=[]);var n=s().scrollEventsEnabledRef,o=(0,r.useRef)(c()),i=(0,a.zX)(e);(0,r.useEffect)((function(){var e=function(){if(n.current){var e=c();i(e,o.current),o.current=e}},t={passive:!0};return e(),window.addEventListener("scroll",e,t),function(){return window.removeEventListener("scroll",e,t)}}),[i,n].concat(t))}function f(){var e,t,n,o=s(),i=(e=(0,r.useRef)({elem:null,top:0}),t=(0,r.useCallback)((function(t){e.current={elem:t,top:t.getBoundingClientRect().top}}),[]),n=(0,r.useCallback)((function(){var t=e.current,n=t.elem,r=t.top;if(!n)return{restored:!1};var o=n.getBoundingClientRect().top-r;return o&&window.scrollBy({left:0,top:o}),e.current={elem:null,top:0},{restored:0!==o}}),[]),(0,r.useMemo)((function(){return{save:t,restore:n}}),[n,t])),a=(0,r.useRef)(void 0),u=(0,r.useCallback)((function(e){i.save(e),o.disableScrollEvents(),a.current=function(){var e=i.restore().restored;if(a.current=void 0,e){window.addEventListener("scroll",(function e(){o.enableScrollEvents(),window.removeEventListener("scroll",e)}))}else o.enableScrollEvents()}}),[o,i]);return(0,r.useLayoutEffect)((function(){queueMicrotask((function(){return null==a.current?void 0:a.current()}))})),{blockElementScrollPositionUntilNextRender:u}}function p(){var e=(0,r.useRef)(null),t=(0,i.Z)()&&"smooth"===getComputedStyle(document.documentElement).scrollBehavior;return{startScroll:function(n){e.current=t?function(e){return window.scrollTo({top:e,behavior:"smooth"}),function(){}}(n):function(e){var t=null,n=document.documentElement.scrollTop>e;return function r(){var o=document.documentElement.scrollTop;(n&&o>e||!n&&oc.length?e(o.substr(c.length),d):n.push(d),l=!0}else for(var f=c.length-1;f>u;f-=1){var p=c.substr(0,f);if(o.substr(0,f)===p){u=f;var h={missed:i.missed,term:i.term.concat({value:p,trailing:!0})};o.length>f?e(o.substr(f),h):n.push(h),l=!0;break}}}l||(o.length>0?e(o.substr(1),{missed:i.missed+1,term:i.term}):i.term.length>0&&n.push(i))}(e,{missed:0,term:[]}),n.sort((function(e,t){var n=e.missed>0?1:0,r=t.missed>0?1:0;return n!==r?n-r:e.term.length-t.term.length})).map((function(e){return e.term}))}(a,t),s=(0,r.Z)(l);!(u=s()).done;){var c=u.value,d=i.concat.apply(i,c);e(o.slice(1),d)}else{var f=i.concat({value:a});e(o.slice(1),f)}}else n.push(i)}(e,[]),n}var u=n(1029);function l(e){return s(e).concat(s(e.filter((function(e){var t=e[e.length-1];return!t.trailing&&t.maybeTyping})),!0))}function s(e,t){return e.map((function(e){return{tokens:e.map((function(e){return e.value})),term:e.map((function(e){return{value:e.value,presence:i().Query.presence.REQUIRED,wildcard:(t?e.trailing||e.maybeTyping:e.trailing)?i().Query.wildcard.TRAILING:i().Query.wildcard.NONE}}))}}))}function c(e,t,n){return function(o,s){var c=function(e,t){if(1===t.length&&["ja","jp","th"].includes(t[0]))return i()[t[0]].tokenizer(e).map((function(e){return e.toString()}));var n=/[^-\s]+/g;return t.includes("zh")&&(n=/[0-9A-Z_a-z]+|(?:[\u3400-\u4DBF\u4E00-\u9FFF\uFA0E\uFA0F\uFA11\uFA13\uFA14\uFA1F\uFA21\uFA23\uFA24\uFA27-\uFA29]|[\uD840-\uD868\uD86A-\uD86C\uD86F-\uD872\uD874-\uD879\uD880-\uD883\uD885-\uD887][\uDC00-\uDFFF]|\uD869[\uDC00-\uDEDF\uDF00-\uDFFF]|\uD86D[\uDC00-\uDF39\uDF40-\uDFFF]|\uD86E[\uDC00-\uDC1D\uDC20-\uDFFF]|\uD873[\uDC00-\uDEA1\uDEB0-\uDFFF]|\uD87A[\uDC00-\uDFE0]|\uD884[\uDC00-\uDF4A\uDF50-\uDFFF]|\uD888[\uDC00-\uDFAF])+/g),e.toLowerCase().match(n)||[]}(o,u.dK);if(0!==c.length){var d=function(e,t){var n=a(e,t);if(0===n.length)return[{tokens:e,term:e.map((function(e){return{value:e,presence:i().Query.presence.REQUIRED,wildcard:i().Query.wildcard.LEADING|i().Query.wildcard.TRAILING}}))}];for(var o,s=(0,r.Z)(n);!(o=s()).done;){var c=o.value;c[c.length-1].maybeTyping=!0}for(var d,f,p=[],h=(0,r.Z)(u.dK);!(d=h()).done;){var m=d.value;if("en"===m)u._k||p.unshift(i().stopWordFilter);else{var g=i()[m];g.stopWordFilter&&p.unshift(g.stopWordFilter)}}if(p.length>0){var v=function(e){return p.reduce((function(e,t){return e.filter((function(e){return t(e.value)}))}),e)};f=[];for(var y,b=[],x=(0,r.Z)(n);!(y=x()).done;){var w=y.value,k=v(w);f.push(k),k.length0&&b.push(k)}n.push.apply(n,b)}else f=n.slice();for(var E,S=[],_=(0,r.Z)(f);!(E=_()).done;){var T=E.value;if(T.length>2)for(var C=T.length-1;C>=0;C-=1)S.push(T.slice(0,C).concat(T.slice(C+1)))}return l(n).concat(l(S))}(c,t),f=[],p=function(){for(var t,o,i=h.value,a=i.term,u=i.tokens,l=function(){var t=o.value,i=t.documents,l=t.index,s=t.type;if(f.push.apply(f,l.query((function(e){for(var t,n=(0,r.Z)(a);!(t=n()).done;){var o=t.value;e.term(o.value,{wildcard:o.wildcard,presence:o.presence})}})).slice(0,n).filter((function(e){return!f.some((function(t){return t.document.i.toString()===e.ref}))})).slice(0,n-f.length).map((function(t){var n=i.find((function(e){return e.i.toString()===t.ref}));return{document:n,type:s,page:0!==s&&e[0].documents.find((function(e){return e.i===n.p})),metadata:t.matchData.metadata,tokens:u,score:t.score}}))),f.length>=n)return{v:1}},s=(0,r.Z)(e);!(o=s()).done;)if(t=l())return t.v};e:for(var h,m=(0,r.Z)(d);!(h=m()).done&&!p(););!function(e){e.forEach((function(e,t){e.index=t})),e.sort((function(t,n){var r=t.type>0&&t.page?e.findIndex((function(e){return e.document===t.page})):t.index,o=n.type>0&&n.page?e.findIndex((function(e){return e.document===n.page})):n.index;return-1===r&&(r=t.index),-1===o&&(o=n.index),r===o?0===t.type?-1:0===n.type?1:t.index-n.index:r-o}))}(f),function(e){e.forEach((function(t,n){n>0&&t.page&&e.some((function(e){return e.document===t.page}))&&(n/g,">").replace(/"/g,""").replace(/'/g,"'")}n.d(t,{X:function(){return r}})},1073:function(e,t,n){"use strict";function r(e,t){for(var n=[],r=0,o=Object.values(e);r=0){c>0&&u.push(i(e.substr(0,c),t)),u.push(""+(0,o.X)(e.substr(c,s.length))+"");var d=c+s.length;d"+(0,o.X)(e)+"":(0,o.X)(e):u.join("")}},726:function(e,t,n){"use strict";n.d(t,{o:function(){return l}});var r=n(1690),o=n(2539),i=/[0-9A-Z_a-z]+|(?:[\u3400-\u4DBF\u4E00-\u9FFF\uFA0E\uFA0F\uFA11\uFA13\uFA14\uFA1F\uFA21\uFA23\uFA24\uFA27-\uFA29]|[\uD840-\uD868\uD86A-\uD86C\uD86F-\uD872\uD874-\uD879\uD880-\uD883\uD885-\uD887][\uDC00-\uDFFF]|\uD869[\uDC00-\uDEDF\uDF00-\uDFFF]|\uD86D[\uDC00-\uDF39\uDF40-\uDFFF]|\uD86E[\uDC00-\uDC1D\uDC20-\uDFFF]|\uD873[\uDC00-\uDEA1\uDEB0-\uDFFF]|\uD87A[\uDC00-\uDFE0]|\uD884[\uDC00-\uDF4A\uDF50-\uDFFF]|\uD888[\uDC00-\uDFAF])/;function a(e){for(var t=[],n=0,r=e;r.length>0;){var o=r.match(i);if(!o){t.push(r);break}o.index>0&&t.push(r.substr(0,o.index)),t.push(o[0]),n+=o.index+o[0].length,r=e.substr(n)}return t}var u=n(1029);function l(e,t,n,r){void 0===r&&(r=u.Hk);for(var o={chunkIndex:-1},i=s(e,t,n,0,0,o),a=i.slice(0,o.chunkIndex),l=i[o.chunkIndex],c=[l.html],d=i.slice(o.chunkIndex+1),f=l.textLength,p=0,h=0,m=!1,g=!1;f0){var v=a.pop();f+v.textLength<=r?(c.unshift(v.html),p+=v.textLength,f+=v.textLength):(m=!0,a.length=0)}else{if(!(d.length>0))break;var y=d.shift();f+y.textLength<=r?(c.push(y.html),h+=y.textLength,f+=y.textLength):(g=!0,d.length=0)}return(m||a.length>0)&&c.unshift("\u2026"),(g||d.length>0)&&c.push("\u2026"),c.join("")}function s(e,t,n,i,u,l){var c=[],d=t[i],f=d[0],p=d[1];if(fu&&c.push.apply(c,a(e.substring(u,f)).map((function(e){return{html:(0,r.X)(e),textLength:e.length}}))),l&&(l.chunkIndex=c.length),c.push({html:(0,o.C)(e.substr(f,p),n,!0),textLength:p});var h=f+p;(i+=1)=0;f--){var p=a[f];"."===p?i(a,f):".."===p?(i(a,f),d++):d&&(i(a,f),d--)}if(!s)for(;d--;d)a.unshift("..");!s||""===a[0]||a[0]&&o(a[0])||a.unshift("");var h=a.join("/");return n&&"/"!==h.substr(-1)&&(h+="/"),h},u=n(2177);function l(e){return"/"===e.charAt(0)?e:"/"+e}function s(e){return"/"===e.charAt(0)?e.substr(1):e}function c(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function d(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function f(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function p(e,t,n,o){var i;"string"==typeof e?(i=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var i=t.indexOf("?");return-1!==i&&(n=t.substr(i),t=t.substr(0,i)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e),i.state=t):(void 0===(i=(0,r.Z)({},e)).pathname&&(i.pathname=""),i.search?"?"!==i.search.charAt(0)&&(i.search="?"+i.search):i.search="",i.hash?"#"!==i.hash.charAt(0)&&(i.hash="#"+i.hash):i.hash="",void 0!==t&&void 0===i.state&&(i.state=t));try{i.pathname=decodeURI(i.pathname)}catch(u){throw u instanceof URIError?new URIError('Pathname "'+i.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):u}return n&&(i.key=n),o?i.pathname?"/"!==i.pathname.charAt(0)&&(i.pathname=a(i.pathname,o.pathname)):i.pathname=o.pathname:i.pathname||(i.pathname="/"),i}function h(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var i="function"==typeof e?e(t,n):e;"string"==typeof i?"function"==typeof r?r(i,o):o(!0):o(!1!==i)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=p(e,t,m(),x.location);c.confirmTransitionTo(o,r,n,(function(e){e&&(x.entries[x.index]=o,d({action:r,location:o}))}))},go:b,goBack:function(){b(-1)},goForward:function(){b(1)},canGo:function(e){var t=x.index+e;return t>=0&&t0){var l=I.utils.clone(t)||{};l.position=[a,u],l.index=o.length,o.push(new I.Token(n.slice(a,i),l))}a=i+1}}return o},I.tokenizer.separator=/[\s\-]+/,I.Pipeline=function(){this._stack=[]},I.Pipeline.registeredFunctions=Object.create(null),I.Pipeline.registerFunction=function(e,t){t in this.registeredFunctions&&I.utils.warn("Overwriting existing registered function: "+t),e.label=t,I.Pipeline.registeredFunctions[e.label]=e},I.Pipeline.warnIfFunctionNotRegistered=function(e){e.label&&e.label in this.registeredFunctions||I.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},I.Pipeline.load=function(e){var t=new I.Pipeline;return e.forEach((function(e){var n=I.Pipeline.registeredFunctions[e];if(!n)throw new Error("Cannot load unregistered function: "+e);t.add(n)})),t},I.Pipeline.prototype.add=function(){Array.prototype.slice.call(arguments).forEach((function(e){I.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)}),this)},I.Pipeline.prototype.after=function(e,t){I.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");n+=1,this._stack.splice(n,0,t)},I.Pipeline.prototype.before=function(e,t){I.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");this._stack.splice(n,0,t)},I.Pipeline.prototype.remove=function(e){var t=this._stack.indexOf(e);-1!=t&&this._stack.splice(t,1)},I.Pipeline.prototype.run=function(e){for(var t=this._stack.length,n=0;n1&&(ie&&(n=o),i!=e);)r=n-t,o=t+Math.floor(r/2),i=this.elements[2*o];return i==e||i>e?2*o:iu?s+=2:a==u&&(t+=n[l+1]*r[s+1],l+=2,s+=2);return t},I.Vector.prototype.similarity=function(e){return this.dot(e)/this.magnitude()||0},I.Vector.prototype.toArray=function(){for(var e=new Array(this.elements.length/2),t=1,n=0;t0){var i,a=o.str.charAt(0);a in o.node.edges?i=o.node.edges[a]:(i=new I.TokenSet,o.node.edges[a]=i),1==o.str.length&&(i.final=!0),r.push({node:i,editsRemaining:o.editsRemaining,str:o.str.slice(1)})}if(0!=o.editsRemaining){if("*"in o.node.edges)var u=o.node.edges["*"];else{u=new I.TokenSet;o.node.edges["*"]=u}if(0==o.str.length&&(u.final=!0),r.push({node:u,editsRemaining:o.editsRemaining-1,str:o.str}),o.str.length>1&&r.push({node:o.node,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)}),1==o.str.length&&(o.node.final=!0),o.str.length>=1){if("*"in o.node.edges)var l=o.node.edges["*"];else{l=new I.TokenSet;o.node.edges["*"]=l}1==o.str.length&&(l.final=!0),r.push({node:l,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)})}if(o.str.length>1){var s,c=o.str.charAt(0),d=o.str.charAt(1);d in o.node.edges?s=o.node.edges[d]:(s=new I.TokenSet,o.node.edges[d]=s),1==o.str.length&&(s.final=!0),r.push({node:s,editsRemaining:o.editsRemaining-1,str:c+o.str.slice(2)})}}}return n},I.TokenSet.fromString=function(e){for(var t=new I.TokenSet,n=t,r=0,o=e.length;r=e;t--){var n=this.uncheckedNodes[t],r=n.child.toString();r in this.minimizedNodes?n.parent.edges[n.char]=this.minimizedNodes[r]:(n.child._str=r,this.minimizedNodes[r]=n.child),this.uncheckedNodes.pop()}},I.Index=function(e){this.invertedIndex=e.invertedIndex,this.fieldVectors=e.fieldVectors,this.tokenSet=e.tokenSet,this.fields=e.fields,this.pipeline=e.pipeline},I.Index.prototype.search=function(e){return this.query((function(t){new I.QueryParser(e,t).parse()}))},I.Index.prototype.query=function(e){for(var t=new I.Query(this.fields),n=Object.create(null),r=Object.create(null),o=Object.create(null),i=Object.create(null),a=Object.create(null),u=0;u1?1:e},I.Builder.prototype.k1=function(e){this._k1=e},I.Builder.prototype.add=function(e,t){var n=e[this._ref],r=Object.keys(this._fields);this._documents[n]=t||{},this.documentCount+=1;for(var o=0;o=this.length)return I.QueryLexer.EOS;var e=this.str.charAt(this.pos);return this.pos+=1,e},I.QueryLexer.prototype.width=function(){return this.pos-this.start},I.QueryLexer.prototype.ignore=function(){this.start==this.pos&&(this.pos+=1),this.start=this.pos},I.QueryLexer.prototype.backup=function(){this.pos-=1},I.QueryLexer.prototype.acceptDigitRun=function(){var e,t;do{t=(e=this.next()).charCodeAt(0)}while(t>47&&t<58);e!=I.QueryLexer.EOS&&this.backup()},I.QueryLexer.prototype.more=function(){return this.pos1&&(e.backup(),e.emit(I.QueryLexer.TERM)),e.ignore(),e.more())return I.QueryLexer.lexText},I.QueryLexer.lexEditDistance=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(I.QueryLexer.EDIT_DISTANCE),I.QueryLexer.lexText},I.QueryLexer.lexBoost=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(I.QueryLexer.BOOST),I.QueryLexer.lexText},I.QueryLexer.lexEOS=function(e){e.width()>0&&e.emit(I.QueryLexer.TERM)},I.QueryLexer.termSeparator=I.tokenizer.separator,I.QueryLexer.lexText=function(e){for(;;){var t=e.next();if(t==I.QueryLexer.EOS)return I.QueryLexer.lexEOS;if(92!=t.charCodeAt(0)){if(":"==t)return I.QueryLexer.lexField;if("~"==t)return e.backup(),e.width()>0&&e.emit(I.QueryLexer.TERM),I.QueryLexer.lexEditDistance;if("^"==t)return e.backup(),e.width()>0&&e.emit(I.QueryLexer.TERM),I.QueryLexer.lexBoost;if("+"==t&&1===e.width())return e.emit(I.QueryLexer.PRESENCE),I.QueryLexer.lexText;if("-"==t&&1===e.width())return e.emit(I.QueryLexer.PRESENCE),I.QueryLexer.lexText;if(t.match(I.QueryLexer.termSeparator))return I.QueryLexer.lexTerm}else e.escapeCharacter()}},I.QueryParser=function(e,t){this.lexer=new I.QueryLexer(e),this.query=t,this.currentClause={},this.lexemeIdx=0},I.QueryParser.prototype.parse=function(){this.lexer.run(),this.lexemes=this.lexer.lexemes;for(var e=I.QueryParser.parseClause;e;)e=e(this);return this.query},I.QueryParser.prototype.peekLexeme=function(){return this.lexemes[this.lexemeIdx]},I.QueryParser.prototype.consumeLexeme=function(){var e=this.peekLexeme();return this.lexemeIdx+=1,e},I.QueryParser.prototype.nextClause=function(){var e=this.currentClause;this.query.clause(e),this.currentClause={}},I.QueryParser.parseClause=function(e){var t=e.peekLexeme();if(null!=t)switch(t.type){case I.QueryLexer.PRESENCE:return I.QueryParser.parsePresence;case I.QueryLexer.FIELD:return I.QueryParser.parseField;case I.QueryLexer.TERM:return I.QueryParser.parseTerm;default:var n="expected either a field or a term, found "+t.type;throw t.str.length>=1&&(n+=" with value '"+t.str+"'"),new I.QueryParseError(n,t.start,t.end)}},I.QueryParser.parsePresence=function(e){var t=e.consumeLexeme();if(null!=t){switch(t.str){case"-":e.currentClause.presence=I.Query.presence.PROHIBITED;break;case"+":e.currentClause.presence=I.Query.presence.REQUIRED;break;default:var n="unrecognised presence operator'"+t.str+"'";throw new I.QueryParseError(n,t.start,t.end)}var r=e.peekLexeme();if(null==r){n="expecting term or field, found nothing";throw new I.QueryParseError(n,t.start,t.end)}switch(r.type){case I.QueryLexer.FIELD:return I.QueryParser.parseField;case I.QueryLexer.TERM:return I.QueryParser.parseTerm;default:n="expecting term or field, found '"+r.type+"'";throw new I.QueryParseError(n,r.start,r.end)}}},I.QueryParser.parseField=function(e){var t=e.consumeLexeme();if(null!=t){if(-1==e.query.allFields.indexOf(t.str)){var n=e.query.allFields.map((function(e){return"'"+e+"'"})).join(", "),r="unrecognised field '"+t.str+"', possible fields: "+n;throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.fields=[t.str];var o=e.peekLexeme();if(null==o){r="expecting term, found nothing";throw new I.QueryParseError(r,t.start,t.end)}if(o.type===I.QueryLexer.TERM)return I.QueryParser.parseTerm;r="expecting term, found '"+o.type+"'";throw new I.QueryParseError(r,o.start,o.end)}},I.QueryParser.parseTerm=function(e){var t=e.consumeLexeme();if(null!=t){e.currentClause.term=t.str.toLowerCase(),-1!=t.str.indexOf("*")&&(e.currentClause.usePipeline=!1);var n=e.peekLexeme();if(null!=n)switch(n.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:var r="Unexpected lexeme type '"+n.type+"'";throw new I.QueryParseError(r,n.start,n.end)}else e.nextClause()}},I.QueryParser.parseEditDistance=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="edit distance must be numeric";throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.editDistance=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new I.QueryParseError(r,o.start,o.end)}else e.nextClause()}},I.QueryParser.parseBoost=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="boost must be numeric";throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.boost=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new I.QueryParseError(r,o.start,o.end)}else e.nextClause()}},void 0===(o="function"==typeof(r=function(){return I})?r.call(t,n,t,e):r)||(e.exports=o)}()},2497:function(e,t,n){"use strict";n.r(t)},2295:function(e,t,n){"use strict";n.r(t)},4865:function(e,t,n){var r,o;r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'
'};function o(e,t,n){return en?n:e}function i(e){return 100*(-1+e)}function a(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+i(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+i(e)+"%,0)"}:{"margin-left":i(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var i=n.render(!t),s=i.querySelector(r.barSelector),c=r.speed,d=r.easing;return i.offsetWidth,u((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),l(s,a(e,c,d)),1===e?(l(i,{transition:"none",opacity:1}),i.offsetWidth,setTimeout((function(){l(i,{transition:"all "+c+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),c)}),c)):setTimeout(t,c)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");c(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,a=t.querySelector(r.barSelector),u=e?"-100":i(n.status||0),s=document.querySelector(r.parent);return l(a,{transition:"all 0 linear",transform:"translate3d("+u+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&p(o),s!=document.body&&c(s,"nprogress-custom-parent"),s.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&p(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var u=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),l=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,i=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+i)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function i(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&i(e,n,r);else i(e,o[1],o[2])}}();function s(e,t){return("string"==typeof e?e:f(e)).indexOf(" "+t+" ")>=0}function c(e,t){var n=f(e),r=n+t;s(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=f(e);s(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function f(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function p(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n},void 0===(o="function"==typeof r?r.call(t,n,t,e):r)||(e.exports=o)},7418:function(e){"use strict";var t=Object.getOwnPropertySymbols,n=Object.prototype.hasOwnProperty,r=Object.prototype.propertyIsEnumerable;e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(o){return!1}}()?Object.assign:function(e,o){for(var i,a,u=function(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}(e),l=1;l=d.reach);E+=k.value.length,k=k.next){var S=k.value;if(t.length>e.length)return;if(!(S instanceof o)){var _,T=1;if(y){if(!(_=i(w,E,e,v))||_.index>=e.length)break;var C=_.index,A=_.index+_[0].length,D=E;for(D+=k.value.length;C>=D;)D+=(k=k.next).value.length;if(E=D-=k.value.length,k.value instanceof o)continue;for(var P=k;P!==t.tail&&(Dd.reach&&(d.reach=N);var I=k.prev;if(R&&(I=l(t,I,R),E+=R.length),s(t,I,T),k=l(t,I,new o(f,g?r.tokenize(L,g):L,b,L)),O&&l(t,k,O),T>1){var F={cause:f+","+h,reach:N};a(e,t,n,k.prev,E,F),d&&F.reach>d.reach&&(d.reach=F.reach)}}}}}}function u(){var e={value:null,prev:null,next:null},t={value:null,prev:e,next:null};e.next=t,this.head=e,this.tail=t,this.length=0}function l(e,t,n){var r=t.next,o={value:n,prev:t,next:r};return t.next=o,r.prev=o,e.length++,o}function s(e,t,n){for(var r=t.next,o=0;o"+i.content+""},r}(),r=n;n.default=n,r.languages.markup={comment:{pattern://,greedy:!0},prolog:{pattern:/<\?[\s\S]+?\?>/,greedy:!0},doctype:{pattern:/"'[\]]|"[^"]*"|'[^']*')+(?:\[(?:[^<"'\]]|"[^"]*"|'[^']*'|<(?!!--)|)*\]\s*)?>/i,greedy:!0,inside:{"internal-subset":{pattern:/(^[^\[]*\[)[\s\S]+(?=\]>$)/,lookbehind:!0,greedy:!0,inside:null},string:{pattern:/"[^"]*"|'[^']*'/,greedy:!0},punctuation:/^$|[[\]]/,"doctype-tag":/^DOCTYPE/i,name:/[^\s<>'"]+/}},cdata:{pattern://i,greedy:!0},tag:{pattern:/<\/?(?!\d)[^\s>\/=$<%]+(?:\s(?:\s*[^\s>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))|(?=[\s/>])))+)?\s*\/?>/,greedy:!0,inside:{tag:{pattern:/^<\/?[^\s>\/]+/,inside:{punctuation:/^<\/?/,namespace:/^[^\s>\/:]+:/}},"special-attr":[],"attr-value":{pattern:/=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+)/,inside:{punctuation:[{pattern:/^=/,alias:"attr-equals"},/"|'/]}},punctuation:/\/?>/,"attr-name":{pattern:/[^\s>\/]+/,inside:{namespace:/^[^\s>\/:]+:/}}}},entity:[{pattern:/&[\da-z]{1,8};/i,alias:"named-entity"},/&#x?[\da-f]{1,8};/i]},r.languages.markup.tag.inside["attr-value"].inside.entity=r.languages.markup.entity,r.languages.markup.doctype.inside["internal-subset"].inside=r.languages.markup,r.hooks.add("wrap",(function(e){"entity"===e.type&&(e.attributes.title=e.content.replace(/&/,"&"))})),Object.defineProperty(r.languages.markup.tag,"addInlined",{value:function(e,t){var n={};n["language-"+t]={pattern:/(^$)/i,lookbehind:!0,inside:r.languages[t]},n.cdata=/^$/i;var o={"included-cdata":{pattern://i,inside:n}};o["language-"+t]={pattern:/[\s\S]+/,inside:r.languages[t]};var i={};i[e]={pattern:RegExp(/(<__[^>]*>)(?:))*\]\]>|(?!)/.source.replace(/__/g,(function(){return e})),"i"),lookbehind:!0,greedy:!0,inside:o},r.languages.insertBefore("markup","cdata",i)}}),Object.defineProperty(r.languages.markup.tag,"addAttribute",{value:function(e,t){r.languages.markup.tag.inside["special-attr"].push({pattern:RegExp(/(^|["'\s])/.source+"(?:"+e+")"+/\s*=\s*(?:"[^"]*"|'[^']*'|[^\s'">=]+(?=[\s>]))/.source,"i"),lookbehind:!0,inside:{"attr-name":/^[^\s=]+/,"attr-value":{pattern:/=[\s\S]+/,inside:{value:{pattern:/(^=\s*(["']|(?!["'])))\S[\s\S]*(?=\2$)/,lookbehind:!0,alias:[t,"language-"+t],inside:r.languages[t]},punctuation:[{pattern:/^=/,alias:"attr-equals"},/"|'/]}}}})}}),r.languages.html=r.languages.markup,r.languages.mathml=r.languages.markup,r.languages.svg=r.languages.markup,r.languages.xml=r.languages.extend("markup",{}),r.languages.ssml=r.languages.xml,r.languages.atom=r.languages.xml,r.languages.rss=r.languages.xml,function(e){var t="\\b(?:BASH|BASHOPTS|BASH_ALIASES|BASH_ARGC|BASH_ARGV|BASH_CMDS|BASH_COMPLETION_COMPAT_DIR|BASH_LINENO|BASH_REMATCH|BASH_SOURCE|BASH_VERSINFO|BASH_VERSION|COLORTERM|COLUMNS|COMP_WORDBREAKS|DBUS_SESSION_BUS_ADDRESS|DEFAULTS_PATH|DESKTOP_SESSION|DIRSTACK|DISPLAY|EUID|GDMSESSION|GDM_LANG|GNOME_KEYRING_CONTROL|GNOME_KEYRING_PID|GPG_AGENT_INFO|GROUPS|HISTCONTROL|HISTFILE|HISTFILESIZE|HISTSIZE|HOME|HOSTNAME|HOSTTYPE|IFS|INSTANCE|JOB|LANG|LANGUAGE|LC_ADDRESS|LC_ALL|LC_IDENTIFICATION|LC_MEASUREMENT|LC_MONETARY|LC_NAME|LC_NUMERIC|LC_PAPER|LC_TELEPHONE|LC_TIME|LESSCLOSE|LESSOPEN|LINES|LOGNAME|LS_COLORS|MACHTYPE|MAILCHECK|MANDATORY_PATH|NO_AT_BRIDGE|OLDPWD|OPTERR|OPTIND|ORBIT_SOCKETDIR|OSTYPE|PAPERSIZE|PATH|PIPESTATUS|PPID|PS1|PS2|PS3|PS4|PWD|RANDOM|REPLY|SECONDS|SELINUX_INIT|SESSION|SESSIONTYPE|SESSION_MANAGER|SHELL|SHELLOPTS|SHLVL|SSH_AUTH_SOCK|TERM|UID|UPSTART_EVENTS|UPSTART_INSTANCE|UPSTART_JOB|UPSTART_SESSION|USER|WINDOWID|XAUTHORITY|XDG_CONFIG_DIRS|XDG_CURRENT_DESKTOP|XDG_DATA_DIRS|XDG_GREETER_DATA_DIR|XDG_MENU_PREFIX|XDG_RUNTIME_DIR|XDG_SEAT|XDG_SEAT_PATH|XDG_SESSION_DESKTOP|XDG_SESSION_ID|XDG_SESSION_PATH|XDG_SESSION_TYPE|XDG_VTNR|XMODIFIERS)\\b",n={pattern:/(^(["']?)\w+\2)[ \t]+\S.*/,lookbehind:!0,alias:"punctuation",inside:null},r={bash:n,environment:{pattern:RegExp("\\$"+t),alias:"constant"},variable:[{pattern:/\$?\(\([\s\S]+?\)\)/,greedy:!0,inside:{variable:[{pattern:/(^\$\(\([\s\S]+)\)\)/,lookbehind:!0},/^\$\(\(/],number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee]-?\d+)?/,operator:/--|\+\+|\*\*=?|<<=?|>>=?|&&|\|\||[=!+\-*/%<>^&|]=?|[?~:]/,punctuation:/\(\(?|\)\)?|,|;/}},{pattern:/\$\((?:\([^)]+\)|[^()])+\)|`[^`]+`/,greedy:!0,inside:{variable:/^\$\(|^`|\)$|`$/}},{pattern:/\$\{[^}]+\}/,greedy:!0,inside:{operator:/:[-=?+]?|[!\/]|##?|%%?|\^\^?|,,?/,punctuation:/[\[\]]/,environment:{pattern:RegExp("(\\{)"+t),lookbehind:!0,alias:"constant"}}},/\$(?:\w+|[#?*!@$])/],entity:/\\(?:[abceEfnrtv\\"]|O?[0-7]{1,3}|U[0-9a-fA-F]{8}|u[0-9a-fA-F]{4}|x[0-9a-fA-F]{1,2})/};e.languages.bash={shebang:{pattern:/^#!\s*\/.*/,alias:"important"},comment:{pattern:/(^|[^"{\\$])#.*/,lookbehind:!0},"function-name":[{pattern:/(\bfunction\s+)[\w-]+(?=(?:\s*\(?:\s*\))?\s*\{)/,lookbehind:!0,alias:"function"},{pattern:/\b[\w-]+(?=\s*\(\s*\)\s*\{)/,alias:"function"}],"for-or-select":{pattern:/(\b(?:for|select)\s+)\w+(?=\s+in\s)/,alias:"variable",lookbehind:!0},"assign-left":{pattern:/(^|[\s;|&]|[<>]\()\w+(?=\+?=)/,inside:{environment:{pattern:RegExp("(^|[\\s;|&]|[<>]\\()"+t),lookbehind:!0,alias:"constant"}},alias:"variable",lookbehind:!0},string:[{pattern:/((?:^|[^<])<<-?\s*)(\w+)\s[\s\S]*?(?:\r?\n|\r)\2/,lookbehind:!0,greedy:!0,inside:r},{pattern:/((?:^|[^<])<<-?\s*)(["'])(\w+)\2\s[\s\S]*?(?:\r?\n|\r)\3/,lookbehind:!0,greedy:!0,inside:{bash:n}},{pattern:/(^|[^\\](?:\\\\)*)"(?:\\[\s\S]|\$\([^)]+\)|\$(?!\()|`[^`]+`|[^"\\`$])*"/,lookbehind:!0,greedy:!0,inside:r},{pattern:/(^|[^$\\])'[^']*'/,lookbehind:!0,greedy:!0},{pattern:/\$'(?:[^'\\]|\\[\s\S])*'/,greedy:!0,inside:{entity:r.entity}}],environment:{pattern:RegExp("\\$?"+t),alias:"constant"},variable:r.variable,function:{pattern:/(^|[\s;|&]|[<>]\()(?:add|apropos|apt|apt-cache|apt-get|aptitude|aspell|automysqlbackup|awk|basename|bash|bc|bconsole|bg|bzip2|cal|cat|cfdisk|chgrp|chkconfig|chmod|chown|chroot|cksum|clear|cmp|column|comm|composer|cp|cron|crontab|csplit|curl|cut|date|dc|dd|ddrescue|debootstrap|df|diff|diff3|dig|dir|dircolors|dirname|dirs|dmesg|docker|docker-compose|du|egrep|eject|env|ethtool|expand|expect|expr|fdformat|fdisk|fg|fgrep|file|find|fmt|fold|format|free|fsck|ftp|fuser|gawk|git|gparted|grep|groupadd|groupdel|groupmod|groups|grub-mkconfig|gzip|halt|head|hg|history|host|hostname|htop|iconv|id|ifconfig|ifdown|ifup|import|install|ip|jobs|join|kill|killall|less|link|ln|locate|logname|logrotate|look|lpc|lpr|lprint|lprintd|lprintq|lprm|ls|lsof|lynx|make|man|mc|mdadm|mkconfig|mkdir|mke2fs|mkfifo|mkfs|mkisofs|mknod|mkswap|mmv|more|most|mount|mtools|mtr|mutt|mv|nano|nc|netstat|nice|nl|node|nohup|notify-send|npm|nslookup|op|open|parted|passwd|paste|pathchk|ping|pkill|pnpm|podman|podman-compose|popd|pr|printcap|printenv|ps|pushd|pv|quota|quotacheck|quotactl|ram|rar|rcp|reboot|remsync|rename|renice|rev|rm|rmdir|rpm|rsync|scp|screen|sdiff|sed|sendmail|seq|service|sftp|sh|shellcheck|shuf|shutdown|sleep|slocate|sort|split|ssh|stat|strace|su|sudo|sum|suspend|swapon|sync|tac|tail|tar|tee|time|timeout|top|touch|tr|traceroute|tsort|tty|umount|uname|unexpand|uniq|units|unrar|unshar|unzip|update-grub|uptime|useradd|userdel|usermod|users|uudecode|uuencode|v|vcpkg|vdir|vi|vim|virsh|vmstat|wait|watch|wc|wget|whereis|which|who|whoami|write|xargs|xdg-open|yarn|yes|zenity|zip|zsh|zypper)(?=$|[)\s;|&])/,lookbehind:!0},keyword:{pattern:/(^|[\s;|&]|[<>]\()(?:case|do|done|elif|else|esac|fi|for|function|if|in|select|then|until|while)(?=$|[)\s;|&])/,lookbehind:!0},builtin:{pattern:/(^|[\s;|&]|[<>]\()(?:\.|:|alias|bind|break|builtin|caller|cd|command|continue|declare|echo|enable|eval|exec|exit|export|getopts|hash|help|let|local|logout|mapfile|printf|pwd|read|readarray|readonly|return|set|shift|shopt|source|test|times|trap|type|typeset|ulimit|umask|unalias|unset)(?=$|[)\s;|&])/,lookbehind:!0,alias:"class-name"},boolean:{pattern:/(^|[\s;|&]|[<>]\()(?:false|true)(?=$|[)\s;|&])/,lookbehind:!0},"file-descriptor":{pattern:/\B&\d\b/,alias:"important"},operator:{pattern:/\d?<>|>\||\+=|=[=~]?|!=?|<<[<-]?|[&\d]?>>|\d[<>]&?|[<>][&=]?|&[>&]?|\|[&|]?/,inside:{"file-descriptor":{pattern:/^\d/,alias:"important"}}},punctuation:/\$?\(\(?|\)\)?|\.\.|[{}[\];\\]/,number:{pattern:/(^|\s)(?:[1-9]\d*|0)(?:[.,]\d+)?\b/,lookbehind:!0}},n.inside=e.languages.bash;for(var o=["comment","function-name","for-or-select","assign-left","string","environment","function","keyword","builtin","boolean","file-descriptor","operator","punctuation","number"],i=r.variable[1].inside,a=0;a]=?|[!=]=?=?|--?|\+\+?|&&?|\|\|?|[?*/~^%]/,punctuation:/[{}[\];(),.:]/},r.languages.c=r.languages.extend("clike",{comment:{pattern:/\/\/(?:[^\r\n\\]|\\(?:\r\n?|\n|(?![\r\n])))*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},"class-name":{pattern:/(\b(?:enum|struct)\s+(?:__attribute__\s*\(\([\s\S]*?\)\)\s*)?)\w+|\b[a-z]\w*_t\b/,lookbehind:!0},keyword:/\b(?:_Alignas|_Alignof|_Atomic|_Bool|_Complex|_Generic|_Imaginary|_Noreturn|_Static_assert|_Thread_local|__attribute__|asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|inline|int|long|register|return|short|signed|sizeof|static|struct|switch|typedef|typeof|union|unsigned|void|volatile|while)\b/,function:/\b[a-z_]\w*(?=\s*\()/i,number:/(?:\b0x(?:[\da-f]+(?:\.[\da-f]*)?|\.[\da-f]+)(?:p[+-]?\d+)?|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:e[+-]?\d+)?)[ful]{0,4}/i,operator:/>>=?|<<=?|->|([-+&|:])\1|[?:~]|[-+*/%&|^!=<>]=?/}),r.languages.insertBefore("c","string",{char:{pattern:/'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n]){0,32}'/,greedy:!0}}),r.languages.insertBefore("c","string",{macro:{pattern:/(^[\t ]*)#\s*[a-z](?:[^\r\n\\/]|\/(?!\*)|\/\*(?:[^*]|\*(?!\/))*\*\/|\\(?:\r\n|[\s\S]))*/im,lookbehind:!0,greedy:!0,alias:"property",inside:{string:[{pattern:/^(#\s*include\s*)<[^>]+>/,lookbehind:!0},r.languages.c.string],char:r.languages.c.char,comment:r.languages.c.comment,"macro-name":[{pattern:/(^#\s*define\s+)\w+\b(?!\()/i,lookbehind:!0},{pattern:/(^#\s*define\s+)\w+\b(?=\()/i,lookbehind:!0,alias:"function"}],directive:{pattern:/^(#\s*)[a-z]+/,lookbehind:!0,alias:"keyword"},"directive-hash":/^#/,punctuation:/##|\\(?=[\r\n])/,expression:{pattern:/\S[\s\S]*/,inside:r.languages.c}}}}),r.languages.insertBefore("c","function",{constant:/\b(?:EOF|NULL|SEEK_CUR|SEEK_END|SEEK_SET|__DATE__|__FILE__|__LINE__|__TIMESTAMP__|__TIME__|__func__|stderr|stdin|stdout)\b/}),delete r.languages.c.boolean,function(e){var t=/\b(?:alignas|alignof|asm|auto|bool|break|case|catch|char|char16_t|char32_t|char8_t|class|co_await|co_return|co_yield|compl|concept|const|const_cast|consteval|constexpr|constinit|continue|decltype|default|delete|do|double|dynamic_cast|else|enum|explicit|export|extern|final|float|for|friend|goto|if|import|inline|int|int16_t|int32_t|int64_t|int8_t|long|module|mutable|namespace|new|noexcept|nullptr|operator|override|private|protected|public|register|reinterpret_cast|requires|return|short|signed|sizeof|static|static_assert|static_cast|struct|switch|template|this|thread_local|throw|try|typedef|typeid|typename|uint16_t|uint32_t|uint64_t|uint8_t|union|unsigned|using|virtual|void|volatile|wchar_t|while)\b/,n=/\b(?!)\w+(?:\s*\.\s*\w+)*\b/.source.replace(//g,(function(){return t.source}));e.languages.cpp=e.languages.extend("c",{"class-name":[{pattern:RegExp(/(\b(?:class|concept|enum|struct|typename)\s+)(?!)\w+/.source.replace(//g,(function(){return t.source}))),lookbehind:!0},/\b[A-Z]\w*(?=\s*::\s*\w+\s*\()/,/\b[A-Z_]\w*(?=\s*::\s*~\w+\s*\()/i,/\b\w+(?=\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>\s*::\s*\w+\s*\()/],keyword:t,number:{pattern:/(?:\b0b[01']+|\b0x(?:[\da-f']+(?:\.[\da-f']*)?|\.[\da-f']+)(?:p[+-]?[\d']+)?|(?:\b[\d']+(?:\.[\d']*)?|\B\.[\d']+)(?:e[+-]?[\d']+)?)[ful]{0,4}/i,greedy:!0},operator:/>>=?|<<=?|->|--|\+\+|&&|\|\||[?:~]|<=>|[-+*/%&|^!=<>]=?|\b(?:and|and_eq|bitand|bitor|not|not_eq|or|or_eq|xor|xor_eq)\b/,boolean:/\b(?:false|true)\b/}),e.languages.insertBefore("cpp","string",{module:{pattern:RegExp(/(\b(?:import|module)\s+)/.source+"(?:"+/"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|<[^<>\r\n]*>/.source+"|"+/(?:\s*:\s*)?|:\s*/.source.replace(//g,(function(){return n}))+")"),lookbehind:!0,greedy:!0,inside:{string:/^[<"][\s\S]+/,operator:/:/,punctuation:/\./}},"raw-string":{pattern:/R"([^()\\ ]{0,16})\([\s\S]*?\)\1"/,alias:"string",greedy:!0}}),e.languages.insertBefore("cpp","keyword",{"generic-function":{pattern:/\b(?!operator\b)[a-z_]\w*\s*<(?:[^<>]|<[^<>]*>)*>(?=\s*\()/i,inside:{function:/^\w+/,generic:{pattern:/<[\s\S]+/,alias:"class-name",inside:e.languages.cpp}}}}),e.languages.insertBefore("cpp","operator",{"double-colon":{pattern:/::/,alias:"punctuation"}}),e.languages.insertBefore("cpp","class-name",{"base-clause":{pattern:/(\b(?:class|struct)\s+\w+\s*:\s*)[^;{}"'\s]+(?:\s+[^;{}"'\s]+)*(?=\s*[;{])/,lookbehind:!0,greedy:!0,inside:e.languages.extend("cpp",{})}}),e.languages.insertBefore("inside","double-colon",{"class-name":/\b[a-z_]\w*\b(?!\s*::)/i},e.languages.cpp["base-clause"])}(r),function(e){var t=/(?:"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"|'(?:\\(?:\r\n|[\s\S])|[^'\\\r\n])*')/;e.languages.css={comment:/\/\*[\s\S]*?\*\//,atrule:{pattern:/@[\w-](?:[^;{\s]|\s+(?![\s{]))*(?:;|(?=\s*\{))/,inside:{rule:/^@[\w-]+/,"selector-function-argument":{pattern:/(\bselector\s*\(\s*(?![\s)]))(?:[^()\s]|\s+(?![\s)])|\((?:[^()]|\([^()]*\))*\))+(?=\s*\))/,lookbehind:!0,alias:"selector"},keyword:{pattern:/(^|[^\w-])(?:and|not|only|or)(?![\w-])/,lookbehind:!0}}},url:{pattern:RegExp("\\burl\\((?:"+t.source+"|"+/(?:[^\\\r\n()"']|\\[\s\S])*/.source+")\\)","i"),greedy:!0,inside:{function:/^url/i,punctuation:/^\(|\)$/,string:{pattern:RegExp("^"+t.source+"$"),alias:"url"}}},selector:{pattern:RegExp("(^|[{}\\s])[^{}\\s](?:[^{};\"'\\s]|\\s+(?![\\s{])|"+t.source+")*(?=\\s*\\{)"),lookbehind:!0},string:{pattern:t,greedy:!0},property:{pattern:/(^|[^-\w\xA0-\uFFFF])(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*(?=\s*:)/i,lookbehind:!0},important:/!important\b/i,function:{pattern:/(^|[^-a-z0-9])[-a-z0-9]+(?=\()/i,lookbehind:!0},punctuation:/[(){};:,]/},e.languages.css.atrule.inside.rest=e.languages.css;var n=e.languages.markup;n&&(n.tag.addInlined("style","css"),n.tag.addAttribute("style","css"))}(r),function(e){var t,n=/("|')(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/;e.languages.css.selector={pattern:e.languages.css.selector.pattern,lookbehind:!0,inside:t={"pseudo-element":/:(?:after|before|first-letter|first-line|selection)|::[-\w]+/,"pseudo-class":/:[-\w]+/,class:/\.[-\w]+/,id:/#[-\w]+/,attribute:{pattern:RegExp("\\[(?:[^[\\]\"']|"+n.source+")*\\]"),greedy:!0,inside:{punctuation:/^\[|\]$/,"case-sensitivity":{pattern:/(\s)[si]$/i,lookbehind:!0,alias:"keyword"},namespace:{pattern:/^(\s*)(?:(?!\s)[-*\w\xA0-\uFFFF])*\|(?!=)/,lookbehind:!0,inside:{punctuation:/\|$/}},"attr-name":{pattern:/^(\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+/,lookbehind:!0},"attr-value":[n,{pattern:/(=\s*)(?:(?!\s)[-\w\xA0-\uFFFF])+(?=\s*$)/,lookbehind:!0}],operator:/[|~*^$]?=/}},"n-th":[{pattern:/(\(\s*)[+-]?\d*[\dn](?:\s*[+-]\s*\d+)?(?=\s*\))/,lookbehind:!0,inside:{number:/[\dn]+/,operator:/[+-]/}},{pattern:/(\(\s*)(?:even|odd)(?=\s*\))/i,lookbehind:!0}],combinator:/>|\+|~|\|\|/,punctuation:/[(),]/}},e.languages.css.atrule.inside["selector-function-argument"].inside=t,e.languages.insertBefore("css","property",{variable:{pattern:/(^|[^-\w\xA0-\uFFFF])--(?!\s)[-_a-z\xA0-\uFFFF](?:(?!\s)[-\w\xA0-\uFFFF])*/i,lookbehind:!0}});var r={pattern:/(\b\d+)(?:%|[a-z]+(?![\w-]))/,lookbehind:!0},o={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0};e.languages.insertBefore("css","function",{operator:{pattern:/(\s)[+\-*\/](?=\s)/,lookbehind:!0},hexcode:{pattern:/\B#[\da-f]{3,8}\b/i,alias:"color"},color:[{pattern:/(^|[^\w-])(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)(?![\w-])/i,lookbehind:!0},{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:r,number:o,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:r,number:o})}(r),r.languages.javascript=r.languages.extend("clike",{"class-name":[r.languages.clike["class-name"],{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$A-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\.(?:constructor|prototype))/,lookbehind:!0}],keyword:[{pattern:/((?:^|\})\s*)catch\b/,lookbehind:!0},{pattern:/(^|[^.]|\.\.\.\s*)\b(?:as|assert(?=\s*\{)|async(?=\s*(?:function\b|\(|[$\w\xA0-\uFFFF]|$))|await|break|case|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally(?=\s*(?:\{|$))|for|from(?=\s*(?:['"]|$))|function|(?:get|set)(?=\s*(?:[#\[$\w\xA0-\uFFFF]|$))|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)\b/,lookbehind:!0}],function:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*(?:\.\s*(?:apply|bind|call)\s*)?\()/,number:{pattern:RegExp(/(^|[^\w$])/.source+"(?:"+/NaN|Infinity/.source+"|"+/0[bB][01]+(?:_[01]+)*n?/.source+"|"+/0[oO][0-7]+(?:_[0-7]+)*n?/.source+"|"+/0[xX][\dA-Fa-f]+(?:_[\dA-Fa-f]+)*n?/.source+"|"+/\d+(?:_\d+)*n/.source+"|"+/(?:\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\.\d+(?:_\d+)*)(?:[Ee][+-]?\d+(?:_\d+)*)?/.source+")"+/(?![\w$])/.source),lookbehind:!0},operator:/--|\+\+|\*\*=?|=>|&&=?|\|\|=?|[!=]==|<<=?|>>>?=?|[-+*/%&|^!=<>]=?|\.{3}|\?\?=?|\?\.?|[~:]/}),r.languages.javascript["class-name"][0].pattern=/(\b(?:class|extends|implements|instanceof|interface|new)\s+)[\w.\\]+/,r.languages.insertBefore("javascript","keyword",{regex:{pattern:/((?:^|[^$\w\xA0-\uFFFF."'\])\s]|\b(?:return|yield))\s*)\/(?:\[(?:[^\]\\\r\n]|\\.)*\]|\\.|[^/\\\[\r\n])+\/[dgimyus]{0,7}(?=(?:\s|\/\*(?:[^*]|\*(?!\/))*\*\/)*(?:$|[\r\n,.;:})\]]|\/\/))/,lookbehind:!0,greedy:!0,inside:{"regex-source":{pattern:/^(\/)[\s\S]+(?=\/[a-z]*$)/,lookbehind:!0,alias:"language-regex",inside:r.languages.regex},"regex-delimiter":/^\/|\/$/,"regex-flags":/^[a-z]+$/}},"function-variable":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*[=:]\s*(?:async\s*)?(?:\bfunction\b|(?:\((?:[^()]|\([^()]*\))*\)|(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)\s*=>))/,alias:"function"},parameter:[{pattern:/(function(?:\s+(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*)?\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\))/,lookbehind:!0,inside:r.languages.javascript},{pattern:/(^|[^$\w\xA0-\uFFFF])(?!\s)[_$a-z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*=>)/i,lookbehind:!0,inside:r.languages.javascript},{pattern:/(\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*=>)/,lookbehind:!0,inside:r.languages.javascript},{pattern:/((?:\b|\s|^)(?!(?:as|async|await|break|case|catch|class|const|continue|debugger|default|delete|do|else|enum|export|extends|finally|for|from|function|get|if|implements|import|in|instanceof|interface|let|new|null|of|package|private|protected|public|return|set|static|super|switch|this|throw|try|typeof|undefined|var|void|while|with|yield)(?![$\w\xA0-\uFFFF]))(?:(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*)\(\s*|\]\s*\(\s*)(?!\s)(?:[^()\s]|\s+(?![\s)])|\([^()]*\))+(?=\s*\)\s*\{)/,lookbehind:!0,inside:r.languages.javascript}],constant:/\b[A-Z](?:[A-Z_]|\dx?)*\b/}),r.languages.insertBefore("javascript","string",{hashbang:{pattern:/^#!.*/,greedy:!0,alias:"comment"},"template-string":{pattern:/`(?:\\[\s\S]|\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}|(?!\$\{)[^\\`])*`/,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},interpolation:{pattern:/((?:^|[^\\])(?:\\{2})*)\$\{(?:[^{}]|\{(?:[^{}]|\{[^}]*\})*\})+\}/,lookbehind:!0,inside:{"interpolation-punctuation":{pattern:/^\$\{|\}$/,alias:"punctuation"},rest:r.languages.javascript}},string:/[\s\S]+/}},"string-property":{pattern:/((?:^|[,{])[ \t]*)(["'])(?:\\(?:\r\n|[\s\S])|(?!\2)[^\\\r\n])*\2(?=\s*:)/m,lookbehind:!0,greedy:!0,alias:"property"}}),r.languages.insertBefore("javascript","operator",{"literal-property":{pattern:/((?:^|[,{])[ \t]*)(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*(?=\s*:)/m,lookbehind:!0,alias:"property"}}),r.languages.markup&&(r.languages.markup.tag.addInlined("script","javascript"),r.languages.markup.tag.addAttribute(/on(?:abort|blur|change|click|composition(?:end|start|update)|dblclick|error|focus(?:in|out)?|key(?:down|up)|load|mouse(?:down|enter|leave|move|out|over|up)|reset|resize|scroll|select|slotchange|submit|unload|wheel)/.source,"javascript")),r.languages.js=r.languages.javascript,function(e){var t=/#(?!\{).+/,n={pattern:/#\{[^}]+\}/,alias:"variable"};e.languages.coffeescript=e.languages.extend("javascript",{comment:t,string:[{pattern:/'(?:\\[\s\S]|[^\\'])*'/,greedy:!0},{pattern:/"(?:\\[\s\S]|[^\\"])*"/,greedy:!0,inside:{interpolation:n}}],keyword:/\b(?:and|break|by|catch|class|continue|debugger|delete|do|each|else|extend|extends|false|finally|for|if|in|instanceof|is|isnt|let|loop|namespace|new|no|not|null|of|off|on|or|own|return|super|switch|then|this|throw|true|try|typeof|undefined|unless|until|when|while|window|with|yes|yield)\b/,"class-member":{pattern:/@(?!\d)\w+/,alias:"variable"}}),e.languages.insertBefore("coffeescript","comment",{"multiline-comment":{pattern:/###[\s\S]+?###/,alias:"comment"},"block-regex":{pattern:/\/{3}[\s\S]*?\/{3}/,alias:"regex",inside:{comment:t,interpolation:n}}}),e.languages.insertBefore("coffeescript","string",{"inline-javascript":{pattern:/`(?:\\[\s\S]|[^\\`])*`/,inside:{delimiter:{pattern:/^`|`$/,alias:"punctuation"},script:{pattern:/[\s\S]+/,alias:"language-javascript",inside:e.languages.javascript}}},"multiline-string":[{pattern:/'''[\s\S]*?'''/,greedy:!0,alias:"string"},{pattern:/"""[\s\S]*?"""/,greedy:!0,alias:"string",inside:{interpolation:n}}]}),e.languages.insertBefore("coffeescript","keyword",{property:/(?!\d)\w+(?=\s*:(?!:))/}),delete e.languages.coffeescript["template-string"],e.languages.coffee=e.languages.coffeescript}(r),function(e){var t=/[*&][^\s[\]{},]+/,n=/!(?:<[\w\-%#;/?:@&=+$,.!~*'()[\]]+>|(?:[a-zA-Z\d-]*!)?[\w\-%#;/?:@&=+$.~*'()]+)?/,r="(?:"+n.source+"(?:[ \t]+"+t.source+")?|"+t.source+"(?:[ \t]+"+n.source+")?)",o=/(?:[^\s\x00-\x08\x0e-\x1f!"#%&'*,\-:>?@[\]`{|}\x7f-\x84\x86-\x9f\ud800-\udfff\ufffe\uffff]|[?:-])(?:[ \t]*(?:(?![#:])|:))*/.source.replace(//g,(function(){return/[^\s\x00-\x08\x0e-\x1f,[\]{}\x7f-\x84\x86-\x9f\ud800-\udfff\ufffe\uffff]/.source})),i=/"(?:[^"\\\r\n]|\\.)*"|'(?:[^'\\\r\n]|\\.)*'/.source;function a(e,t){t=(t||"").replace(/m/g,"")+"m";var n=/([:\-,[{]\s*(?:\s<>[ \t]+)?)(?:<>)(?=[ \t]*(?:$|,|\]|\}|(?:[\r\n]\s*)?#))/.source.replace(/<>/g,(function(){return r})).replace(/<>/g,(function(){return e}));return RegExp(n,t)}e.languages.yaml={scalar:{pattern:RegExp(/([\-:]\s*(?:\s<>[ \t]+)?[|>])[ \t]*(?:((?:\r?\n|\r)[ \t]+)\S[^\r\n]*(?:\2[^\r\n]+)*)/.source.replace(/<>/g,(function(){return r}))),lookbehind:!0,alias:"string"},comment:/#.*/,key:{pattern:RegExp(/((?:^|[:\-,[{\r\n?])[ \t]*(?:<>[ \t]+)?)<>(?=\s*:\s)/.source.replace(/<>/g,(function(){return r})).replace(/<>/g,(function(){return"(?:"+o+"|"+i+")"}))),lookbehind:!0,greedy:!0,alias:"atrule"},directive:{pattern:/(^[ \t]*)%.+/m,lookbehind:!0,alias:"important"},datetime:{pattern:a(/\d{4}-\d\d?-\d\d?(?:[tT]|[ \t]+)\d\d?:\d{2}:\d{2}(?:\.\d*)?(?:[ \t]*(?:Z|[-+]\d\d?(?::\d{2})?))?|\d{4}-\d{2}-\d{2}|\d\d?:\d{2}(?::\d{2}(?:\.\d*)?)?/.source),lookbehind:!0,alias:"number"},boolean:{pattern:a(/false|true/.source,"i"),lookbehind:!0,alias:"important"},null:{pattern:a(/null|~/.source,"i"),lookbehind:!0,alias:"important"},string:{pattern:a(i),lookbehind:!0,greedy:!0},number:{pattern:a(/[+-]?(?:0x[\da-f]+|0o[0-7]+|(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|\.inf|\.nan)/.source,"i"),lookbehind:!0},tag:n,important:t,punctuation:/---|[:[\]{}\-,|>?]|\.\.\./},e.languages.yml=e.languages.yaml}(r),function(e){var t=/(?:\\.|[^\\\n\r]|(?:\n|\r\n?)(?![\r\n]))/.source;function n(e){return e=e.replace(//g,(function(){return t})),RegExp(/((?:^|[^\\])(?:\\{2})*)/.source+"(?:"+e+")")}var r=/(?:\\.|``(?:[^`\r\n]|`(?!`))+``|`[^`\r\n]+`|[^\\|\r\n`])+/.source,o=/\|?__(?:\|__)+\|?(?:(?:\n|\r\n?)|(?![\s\S]))/.source.replace(/__/g,(function(){return r})),i=/\|?[ \t]*:?-{3,}:?[ \t]*(?:\|[ \t]*:?-{3,}:?[ \t]*)+\|?(?:\n|\r\n?)/.source;e.languages.markdown=e.languages.extend("markup",{}),e.languages.insertBefore("markdown","prolog",{"front-matter-block":{pattern:/(^(?:\s*[\r\n])?)---(?!.)[\s\S]*?[\r\n]---(?!.)/,lookbehind:!0,greedy:!0,inside:{punctuation:/^---|---$/,"front-matter":{pattern:/\S+(?:\s+\S+)*/,alias:["yaml","language-yaml"],inside:e.languages.yaml}}},blockquote:{pattern:/^>(?:[\t ]*>)*/m,alias:"punctuation"},table:{pattern:RegExp("^"+o+i+"(?:"+o+")*","m"),inside:{"table-data-rows":{pattern:RegExp("^("+o+i+")(?:"+o+")*$"),lookbehind:!0,inside:{"table-data":{pattern:RegExp(r),inside:e.languages.markdown},punctuation:/\|/}},"table-line":{pattern:RegExp("^("+o+")"+i+"$"),lookbehind:!0,inside:{punctuation:/\||:?-{3,}:?/}},"table-header-row":{pattern:RegExp("^"+o+"$"),inside:{"table-header":{pattern:RegExp(r),alias:"important",inside:e.languages.markdown},punctuation:/\|/}}}},code:[{pattern:/((?:^|\n)[ \t]*\n|(?:^|\r\n?)[ \t]*\r\n?)(?: {4}|\t).+(?:(?:\n|\r\n?)(?: {4}|\t).+)*/,lookbehind:!0,alias:"keyword"},{pattern:/^```[\s\S]*?^```$/m,greedy:!0,inside:{"code-block":{pattern:/^(```.*(?:\n|\r\n?))[\s\S]+?(?=(?:\n|\r\n?)^```$)/m,lookbehind:!0},"code-language":{pattern:/^(```).+/,lookbehind:!0},punctuation:/```/}}],title:[{pattern:/\S.*(?:\n|\r\n?)(?:==+|--+)(?=[ \t]*$)/m,alias:"important",inside:{punctuation:/==+$|--+$/}},{pattern:/(^\s*)#.+/m,lookbehind:!0,alias:"important",inside:{punctuation:/^#+|#+$/}}],hr:{pattern:/(^\s*)([*-])(?:[\t ]*\2){2,}(?=\s*$)/m,lookbehind:!0,alias:"punctuation"},list:{pattern:/(^\s*)(?:[*+-]|\d+\.)(?=[\t ].)/m,lookbehind:!0,alias:"punctuation"},"url-reference":{pattern:/!?\[[^\]]+\]:[\t ]+(?:\S+|<(?:\\.|[^>\\])+>)(?:[\t ]+(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\)))?/,inside:{variable:{pattern:/^(!?\[)[^\]]+/,lookbehind:!0},string:/(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|\((?:\\.|[^)\\])*\))$/,punctuation:/^[\[\]!:]|[<>]/},alias:"url"},bold:{pattern:n(/\b__(?:(?!_)|_(?:(?!_))+_)+__\b|\*\*(?:(?!\*)|\*(?:(?!\*))+\*)+\*\*/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^..)[\s\S]+(?=..$)/,lookbehind:!0,inside:{}},punctuation:/\*\*|__/}},italic:{pattern:n(/\b_(?:(?!_)|__(?:(?!_))+__)+_\b|\*(?:(?!\*)|\*\*(?:(?!\*))+\*\*)+\*/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^.)[\s\S]+(?=.$)/,lookbehind:!0,inside:{}},punctuation:/[*_]/}},strike:{pattern:n(/(~~?)(?:(?!~))+\2/.source),lookbehind:!0,greedy:!0,inside:{content:{pattern:/(^~~?)[\s\S]+(?=\1$)/,lookbehind:!0,inside:{}},punctuation:/~~?/}},"code-snippet":{pattern:/(^|[^\\`])(?:``[^`\r\n]+(?:`[^`\r\n]+)*``(?!`)|`[^`\r\n]+`(?!`))/,lookbehind:!0,greedy:!0,alias:["code","keyword"]},url:{pattern:n(/!?\[(?:(?!\]))+\](?:\([^\s)]+(?:[\t ]+"(?:\\.|[^"\\])*")?\)|[ \t]?\[(?:(?!\]))+\])/.source),lookbehind:!0,greedy:!0,inside:{operator:/^!/,content:{pattern:/(^\[)[^\]]+(?=\])/,lookbehind:!0,inside:{}},variable:{pattern:/(^\][ \t]?\[)[^\]]+(?=\]$)/,lookbehind:!0},url:{pattern:/(^\]\()[^\s)]+/,lookbehind:!0},string:{pattern:/(^[ \t]+)"(?:\\.|[^"\\])*"(?=\)$)/,lookbehind:!0}}}}),["url","bold","italic","strike"].forEach((function(t){["url","bold","italic","strike","code-snippet"].forEach((function(n){t!==n&&(e.languages.markdown[t].inside.content.inside[n]=e.languages.markdown[n])}))})),e.hooks.add("after-tokenize",(function(e){"markdown"!==e.language&&"md"!==e.language||function e(t){if(t&&"string"!=typeof t)for(var n=0,r=t.length;n",quot:'"'},l=String.fromCodePoint||String.fromCharCode;e.languages.md=e.languages.markdown}(r),r.languages.graphql={comment:/#.*/,description:{pattern:/(?:"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*")(?=\s*[a-z_])/i,greedy:!0,alias:"string",inside:{"language-markdown":{pattern:/(^"(?:"")?)(?!\1)[\s\S]+(?=\1$)/,lookbehind:!0,inside:r.languages.markdown}}},string:{pattern:/"""(?:[^"]|(?!""")")*"""|"(?:\\.|[^\\"\r\n])*"/,greedy:!0},number:/(?:\B-|\b)\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,boolean:/\b(?:false|true)\b/,variable:/\$[a-z_]\w*/i,directive:{pattern:/@[a-z_]\w*/i,alias:"function"},"attr-name":{pattern:/\b[a-z_]\w*(?=\s*(?:\((?:[^()"]|"(?:\\.|[^\\"\r\n])*")*\))?:)/i,greedy:!0},"atom-input":{pattern:/\b[A-Z]\w*Input\b/,alias:"class-name"},scalar:/\b(?:Boolean|Float|ID|Int|String)\b/,constant:/\b[A-Z][A-Z_\d]*\b/,"class-name":{pattern:/(\b(?:enum|implements|interface|on|scalar|type|union)\s+|&\s*|:\s*|\[)[A-Z_]\w*/,lookbehind:!0},fragment:{pattern:/(\bfragment\s+|\.{3}\s*(?!on\b))[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},"definition-mutation":{pattern:/(\bmutation\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},"definition-query":{pattern:/(\bquery\s+)[a-zA-Z_]\w*/,lookbehind:!0,alias:"function"},keyword:/\b(?:directive|enum|extend|fragment|implements|input|interface|mutation|on|query|repeatable|scalar|schema|subscription|type|union)\b/,operator:/[!=|&]|\.{3}/,"property-query":/\w+(?=\s*\()/,object:/\w+(?=\s*\{)/,punctuation:/[!(){}\[\]:=,]/,property:/\w+/},r.hooks.add("after-tokenize",(function(e){if("graphql"===e.language)for(var t=e.tokens.filter((function(e){return"string"!=typeof e&&"comment"!==e.type&&"scalar"!==e.type})),n=0;n0)){var u=f(/^\{$/,/^\}$/);if(-1===u)continue;for(var l=n;l=0&&p(s,"variable-input")}}}}function c(e){return t[n+e]}function d(e,t){t=t||0;for(var n=0;n?|<|>)?|>[>=]?|\b(?:AND|BETWEEN|DIV|ILIKE|IN|IS|LIKE|NOT|OR|REGEXP|RLIKE|SOUNDS LIKE|XOR)\b/i,punctuation:/[;[\]()`,.]/},function(e){var t=e.languages.javascript["template-string"],n=t.pattern.source,r=t.inside.interpolation,o=r.inside["interpolation-punctuation"],i=r.pattern.source;function a(t,r){if(e.languages[t])return{pattern:RegExp("((?:"+r+")\\s*)"+n),lookbehind:!0,greedy:!0,inside:{"template-punctuation":{pattern:/^`|`$/,alias:"string"},"embedded-code":{pattern:/[\s\S]+/,alias:t}}}}function u(e,t){return"___"+t.toUpperCase()+"_"+e+"___"}function l(t,n,r){var o={code:t,grammar:n,language:r};return e.hooks.run("before-tokenize",o),o.tokens=e.tokenize(o.code,o.grammar),e.hooks.run("after-tokenize",o),o.tokens}function s(t){var n={};n["interpolation-punctuation"]=o;var i=e.tokenize(t,n);if(3===i.length){var a=[1,1];a.push.apply(a,l(i[1],e.languages.javascript,"javascript")),i.splice.apply(i,a)}return new e.Token("interpolation",i,r.alias,t)}function c(t,n,r){var o=e.tokenize(t,{interpolation:{pattern:RegExp(i),lookbehind:!0}}),a=0,c={},d=l(o.map((function(e){if("string"==typeof e)return e;for(var n,o=e.content;-1!==t.indexOf(n=u(a++,r)););return c[n]=o,n})).join(""),n,r),f=Object.keys(c);return a=0,function e(t){for(var n=0;n=f.length)return;var r=t[n];if("string"==typeof r||"string"==typeof r.content){var o=f[a],i="string"==typeof r?r:r.content,u=i.indexOf(o);if(-1!==u){++a;var l=i.substring(0,u),d=s(c[o]),p=i.substring(u+o.length),h=[];if(l&&h.push(l),h.push(d),p){var m=[p];e(m),h.push.apply(h,m)}"string"==typeof r?(t.splice.apply(t,[n,1].concat(h)),n+=h.length-1):r.content=h}}else{var g=r.content;Array.isArray(g)?e(g):e([g])}}}(d),new e.Token(r,d,"language-"+r,t)}e.languages.javascript["template-string"]=[a("css",/\b(?:styled(?:\([^)]*\))?(?:\s*\.\s*\w+(?:\([^)]*\))*)*|css(?:\s*\.\s*(?:global|resolve))?|createGlobalStyle|keyframes)/.source),a("html",/\bhtml|\.\s*(?:inner|outer)HTML\s*\+?=/.source),a("svg",/\bsvg/.source),a("markdown",/\b(?:markdown|md)/.source),a("graphql",/\b(?:gql|graphql(?:\s*\.\s*experimental)?)/.source),a("sql",/\bsql/.source),t].filter(Boolean);var d={javascript:!0,js:!0,typescript:!0,ts:!0,jsx:!0,tsx:!0};function f(e){return"string"==typeof e?e:Array.isArray(e)?e.map(f).join(""):f(e.content)}e.hooks.add("after-tokenize",(function(t){t.language in d&&function t(n){for(var r=0,o=n.length;r]|<(?:[^<>]|<[^<>]*>)*>)*>)?/,lookbehind:!0,greedy:!0,inside:null},builtin:/\b(?:Array|Function|Promise|any|boolean|console|never|number|string|symbol|unknown)\b/}),e.languages.typescript.keyword.push(/\b(?:abstract|declare|is|keyof|readonly|require)\b/,/\b(?:asserts|infer|interface|module|namespace|type)\b(?=\s*(?:[{_$a-zA-Z\xA0-\uFFFF]|$))/,/\btype\b(?=\s*(?:[\{*]|$))/),delete e.languages.typescript.parameter,delete e.languages.typescript["literal-property"];var t=e.languages.extend("typescript",{});delete t["class-name"],e.languages.typescript["class-name"].inside=t,e.languages.insertBefore("typescript","function",{decorator:{pattern:/@[$\w\xA0-\uFFFF]+/,inside:{at:{pattern:/^@/,alias:"operator"},function:/^[\s\S]+/}},"generic-function":{pattern:/#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*\s*<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>(?=\s*\()/,greedy:!0,inside:{function:/^#?(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*/,generic:{pattern:/<[\s\S]+/,alias:"class-name",inside:t}}}}),e.languages.ts=e.languages.typescript}(r),function(e){function t(e,t){return RegExp(e.replace(//g,(function(){return/(?!\s)[_$a-zA-Z\xA0-\uFFFF](?:(?!\s)[$\w\xA0-\uFFFF])*/.source})),t)}e.languages.insertBefore("javascript","function-variable",{"method-variable":{pattern:RegExp("(\\.\\s*)"+e.languages.javascript["function-variable"].pattern.source),lookbehind:!0,alias:["function-variable","method","function","property-access"]}}),e.languages.insertBefore("javascript","function",{method:{pattern:RegExp("(\\.\\s*)"+e.languages.javascript.function.source),lookbehind:!0,alias:["function","property-access"]}}),e.languages.insertBefore("javascript","constant",{"known-class-name":[{pattern:/\b(?:(?:Float(?:32|64)|(?:Int|Uint)(?:8|16|32)|Uint8Clamped)?Array|ArrayBuffer|BigInt|Boolean|DataView|Date|Error|Function|Intl|JSON|(?:Weak)?(?:Map|Set)|Math|Number|Object|Promise|Proxy|Reflect|RegExp|String|Symbol|WebAssembly)\b/,alias:"class-name"},{pattern:/\b(?:[A-Z]\w*)Error\b/,alias:"class-name"}]}),e.languages.insertBefore("javascript","keyword",{imports:{pattern:t(/(\bimport\b\s*)(?:(?:\s*,\s*(?:\*\s*as\s+|\{[^{}]*\}))?|\*\s*as\s+|\{[^{}]*\})(?=\s*\bfrom\b)/.source),lookbehind:!0,inside:e.languages.javascript},exports:{pattern:t(/(\bexport\b\s*)(?:\*(?:\s*as\s+)?(?=\s*\bfrom\b)|\{[^{}]*\})/.source),lookbehind:!0,inside:e.languages.javascript}}),e.languages.javascript.keyword.unshift({pattern:/\b(?:as|default|export|from|import)\b/,alias:"module"},{pattern:/\b(?:await|break|catch|continue|do|else|finally|for|if|return|switch|throw|try|while|yield)\b/,alias:"control-flow"},{pattern:/\bnull\b/,alias:["null","nil"]},{pattern:/\bundefined\b/,alias:"nil"}),e.languages.insertBefore("javascript","operator",{spread:{pattern:/\.{3}/,alias:"operator"},arrow:{pattern:/=>/,alias:"operator"}}),e.languages.insertBefore("javascript","punctuation",{"property-access":{pattern:t(/(\.\s*)#?/.source),lookbehind:!0},"maybe-class-name":{pattern:/(^|[^$\w\xA0-\uFFFF])[A-Z][$\w\xA0-\uFFFF]+/,lookbehind:!0},dom:{pattern:/\b(?:document|(?:local|session)Storage|location|navigator|performance|window)\b/,alias:"variable"},console:{pattern:/\bconsole(?=\s*\.)/,alias:"class-name"}});for(var n=["function","function-variable","method","method-variable","property-access"],r=0;r*\.{3}(?:[^{}]|)*\})/.source;function i(e,t){return e=e.replace(//g,(function(){return n})).replace(//g,(function(){return r})).replace(//g,(function(){return o})),RegExp(e,t)}o=i(o).source,e.languages.jsx=e.languages.extend("markup",t),e.languages.jsx.tag.pattern=i(/<\/?(?:[\w.:-]+(?:+(?:[\w.:$-]+(?:=(?:"(?:\\[\s\S]|[^\\"])*"|'(?:\\[\s\S]|[^\\'])*'|[^\s{'"/>=]+|))?|))**\/?)?>/.source),e.languages.jsx.tag.inside.tag.pattern=/^<\/?[^\s>\/]*/,e.languages.jsx.tag.inside["attr-value"].pattern=/=(?!\{)(?:"(?:\\[\s\S]|[^\\"])*"|'(?:\\[\s\S]|[^\\'])*'|[^\s'">]+)/,e.languages.jsx.tag.inside.tag.inside["class-name"]=/^[A-Z]\w*(?:\.[A-Z]\w*)*$/,e.languages.jsx.tag.inside.comment=t.comment,e.languages.insertBefore("inside","attr-name",{spread:{pattern:i(//.source),inside:e.languages.jsx}},e.languages.jsx.tag),e.languages.insertBefore("inside","special-attr",{script:{pattern:i(/=/.source),alias:"language-javascript",inside:{"script-punctuation":{pattern:/^=(?=\{)/,alias:"punctuation"},rest:e.languages.jsx}}},e.languages.jsx.tag);var a=function(e){return e?"string"==typeof e?e:"string"==typeof e.content?e.content:e.content.map(a).join(""):""},u=function(t){for(var n=[],r=0;r0&&n[n.length-1].tagName===a(o.content[0].content[1])&&n.pop():"/>"===o.content[o.content.length-1].content||n.push({tagName:a(o.content[0].content[1]),openedBraces:0}):n.length>0&&"punctuation"===o.type&&"{"===o.content?n[n.length-1].openedBraces++:n.length>0&&n[n.length-1].openedBraces>0&&"punctuation"===o.type&&"}"===o.content?n[n.length-1].openedBraces--:i=!0),(i||"string"==typeof o)&&n.length>0&&0===n[n.length-1].openedBraces){var l=a(o);r0&&("string"==typeof t[r-1]||"plain-text"===t[r-1].type)&&(l=a(t[r-1])+l,t.splice(r-1,1),r--),t[r]=new e.Token("plain-text",l,null,l)}o.content&&"string"!=typeof o.content&&u(o.content)}};e.hooks.add("after-tokenize",(function(e){"jsx"!==e.language&&"tsx"!==e.language||u(e.tokens)}))}(r),function(e){e.languages.diff={coord:[/^(?:\*{3}|-{3}|\+{3}).*$/m,/^@@.*@@$/m,/^\d.*$/m]};var t={"deleted-sign":"-","deleted-arrow":"<","inserted-sign":"+","inserted-arrow":">",unchanged:" ",diff:"!"};Object.keys(t).forEach((function(n){var r=t[n],o=[];/^\w+$/.test(n)||o.push(/\w+/.exec(n)[0]),"diff"===n&&o.push("bold"),e.languages.diff[n]={pattern:RegExp("^(?:["+r+"].*(?:\r\n?|\n|(?![\\s\\S])))+","m"),alias:o,inside:{line:{pattern:/(.)(?=[\s\S]).*(?:\r\n?|\n)?/,lookbehind:!0},prefix:{pattern:/[\s\S]/,alias:/\w+/.exec(n)[0]}}}})),Object.defineProperty(e.languages.diff,"PREFIXES",{value:t})}(r),r.languages.git={comment:/^#.*/m,deleted:/^[-\u2013].*/m,inserted:/^\+.*/m,string:/("|')(?:\\.|(?!\1)[^\\\r\n])*\1/,command:{pattern:/^.*\$ git .*$/m,inside:{parameter:/\s--?\w+/}},coord:/^@@.*@@$/m,"commit-sha1":/^commit \w{40}$/m},r.languages.go=r.languages.extend("clike",{string:{pattern:/(^|[^\\])"(?:\\.|[^"\\\r\n])*"|`[^`]*`/,lookbehind:!0,greedy:!0},keyword:/\b(?:break|case|chan|const|continue|default|defer|else|fallthrough|for|func|go(?:to)?|if|import|interface|map|package|range|return|select|struct|switch|type|var)\b/,boolean:/\b(?:_|false|iota|nil|true)\b/,number:[/\b0(?:b[01_]+|o[0-7_]+)i?\b/i,/\b0x(?:[a-f\d_]+(?:\.[a-f\d_]*)?|\.[a-f\d_]+)(?:p[+-]?\d+(?:_\d+)*)?i?(?!\w)/i,/(?:\b\d[\d_]*(?:\.[\d_]*)?|\B\.\d[\d_]*)(?:e[+-]?[\d_]+)?i?(?!\w)/i],operator:/[*\/%^!=]=?|\+[=+]?|-[=-]?|\|[=|]?|&(?:=|&|\^=?)?|>(?:>=?|=)?|<(?:<=?|=|-)?|:=|\.\.\./,builtin:/\b(?:append|bool|byte|cap|close|complex|complex(?:64|128)|copy|delete|error|float(?:32|64)|u?int(?:8|16|32|64)?|imag|len|make|new|panic|print(?:ln)?|real|recover|rune|string|uintptr)\b/}),r.languages.insertBefore("go","string",{char:{pattern:/'(?:\\.|[^'\\\r\n]){0,10}'/,greedy:!0}}),delete r.languages.go["class-name"],function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,o,i){if(n.language===r){var a=n.tokenStack=[];n.code=n.code.replace(o,(function(e){if("function"==typeof i&&!i(e))return e;for(var o,u=a.length;-1!==n.code.indexOf(o=t(r,u));)++u;return a[u]=e,o})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var o=0,i=Object.keys(n.tokenStack);!function a(u){for(var l=0;l=i.length);l++){var s=u[l];if("string"==typeof s||s.content&&"string"==typeof s.content){var c=i[o],d=n.tokenStack[c],f="string"==typeof s?s:s.content,p=t(r,c),h=f.indexOf(p);if(h>-1){++o;var m=f.substring(0,h),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),v=f.substring(h+p.length),y=[];m&&y.push.apply(y,a([m])),y.push(g),v&&y.push.apply(y,a([v])),"string"==typeof s?u.splice.apply(u,[l,1].concat(y)):s.content=y}}else s.content&&a(s.content)}return u}(n.tokens)}}}})}(r),function(e){e.languages.handlebars={comment:/\{\{![\s\S]*?\}\}/,delimiter:{pattern:/^\{\{\{?|\}\}\}?$/,alias:"punctuation"},string:/(["'])(?:\\.|(?!\1)[^\\\r\n])*\1/,number:/\b0x[\dA-Fa-f]+\b|(?:\b\d+(?:\.\d*)?|\B\.\d+)(?:[Ee][+-]?\d+)?/,boolean:/\b(?:false|true)\b/,block:{pattern:/^(\s*(?:~\s*)?)[#\/]\S+?(?=\s*(?:~\s*)?$|\s)/,lookbehind:!0,alias:"keyword"},brackets:{pattern:/\[[^\]]+\]/,inside:{punctuation:/\[|\]/,variable:/[\s\S]+/}},punctuation:/[!"#%&':()*+,.\/;<=>@\[\\\]^`{|}~]/,variable:/[^!"#%&'()*+,\/;<=>@\[\\\]^`{|}~\s]+/},e.hooks.add("before-tokenize",(function(t){e.languages["markup-templating"].buildPlaceholders(t,"handlebars",/\{\{\{[\s\S]+?\}\}\}|\{\{[\s\S]+?\}\}/g)})),e.hooks.add("after-tokenize",(function(t){e.languages["markup-templating"].tokenizePlaceholders(t,"handlebars")})),e.languages.hbs=e.languages.handlebars}(r),r.languages.json={property:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?=\s*:)/,lookbehind:!0,greedy:!0},string:{pattern:/(^|[^\\])"(?:\\.|[^\\"\r\n])*"(?!\s*:)/,lookbehind:!0,greedy:!0},comment:{pattern:/\/\/.*|\/\*[\s\S]*?(?:\*\/|$)/,greedy:!0},number:/-?\b\d+(?:\.\d+)?(?:e[+-]?\d+)?\b/i,punctuation:/[{}[\],]/,operator:/:/,boolean:/\b(?:false|true)\b/,null:{pattern:/\bnull\b/,alias:"keyword"}},r.languages.webmanifest=r.languages.json,r.languages.less=r.languages.extend("css",{comment:[/\/\*[\s\S]*?\*\//,{pattern:/(^|[^\\])\/\/.*/,lookbehind:!0}],atrule:{pattern:/@[\w-](?:\((?:[^(){}]|\([^(){}]*\))*\)|[^(){};\s]|\s+(?!\s))*?(?=\s*\{)/,inside:{punctuation:/[:()]/}},selector:{pattern:/(?:@\{[\w-]+\}|[^{};\s@])(?:@\{[\w-]+\}|\((?:[^(){}]|\([^(){}]*\))*\)|[^(){};@\s]|\s+(?!\s))*?(?=\s*\{)/,inside:{variable:/@+[\w-]+/}},property:/(?:@\{[\w-]+\}|[\w-])+(?:\+_?)?(?=\s*:)/,operator:/[+\-*\/]/}),r.languages.insertBefore("less","property",{variable:[{pattern:/@[\w-]+\s*:/,inside:{punctuation:/:/}},/@@?[\w-]+/],"mixin-usage":{pattern:/([{;]\s*)[.#](?!\d)[\w-].*?(?=[(;])/,lookbehind:!0,alias:"function"}}),r.languages.makefile={comment:{pattern:/(^|[^\\])#(?:\\(?:\r\n|[\s\S])|[^\\\r\n])*/,lookbehind:!0},string:{pattern:/(["'])(?:\\(?:\r\n|[\s\S])|(?!\1)[^\\\r\n])*\1/,greedy:!0},"builtin-target":{pattern:/\.[A-Z][^:#=\s]+(?=\s*:(?!=))/,alias:"builtin"},target:{pattern:/^(?:[^:=\s]|[ \t]+(?![\s:]))+(?=\s*:(?!=))/m,alias:"symbol",inside:{variable:/\$+(?:(?!\$)[^(){}:#=\s]+|(?=[({]))/}},variable:/\$+(?:(?!\$)[^(){}:#=\s]+|\([@*%<^+?][DF]\)|(?=[({]))/,keyword:/-include\b|\b(?:define|else|endef|endif|export|ifn?def|ifn?eq|include|override|private|sinclude|undefine|unexport|vpath)\b/,function:{pattern:/(\()(?:abspath|addsuffix|and|basename|call|dir|error|eval|file|filter(?:-out)?|findstring|firstword|flavor|foreach|guile|if|info|join|lastword|load|notdir|or|origin|patsubst|realpath|shell|sort|strip|subst|suffix|value|warning|wildcard|word(?:list|s)?)(?=[ \t])/,lookbehind:!0},operator:/(?:::|[?:+!])?=|[|@]/,punctuation:/[:;(){}]/},r.languages.objectivec=r.languages.extend("c",{string:{pattern:/@?"(?:\\(?:\r\n|[\s\S])|[^"\\\r\n])*"/,greedy:!0},keyword:/\b(?:asm|auto|break|case|char|const|continue|default|do|double|else|enum|extern|float|for|goto|if|in|inline|int|long|register|return|self|short|signed|sizeof|static|struct|super|switch|typedef|typeof|union|unsigned|void|volatile|while)\b|(?:@interface|@end|@implementation|@protocol|@class|@public|@protected|@private|@property|@try|@catch|@finally|@throw|@synthesize|@dynamic|@selector)\b/,operator:/-[->]?|\+\+?|!=?|<>?=?|==?|&&?|\|\|?|[~^%?*\/@]/}),delete r.languages.objectivec["class-name"],r.languages.objc=r.languages.objectivec,r.languages.ocaml={comment:{pattern:/\(\*[\s\S]*?\*\)/,greedy:!0},char:{pattern:/'(?:[^\\\r\n']|\\(?:.|[ox]?[0-9a-f]{1,3}))'/i,greedy:!0},string:[{pattern:/"(?:\\(?:[\s\S]|\r\n)|[^\\\r\n"])*"/,greedy:!0},{pattern:/\{([a-z_]*)\|[\s\S]*?\|\1\}/,greedy:!0}],number:[/\b(?:0b[01][01_]*|0o[0-7][0-7_]*)\b/i,/\b0x[a-f0-9][a-f0-9_]*(?:\.[a-f0-9_]*)?(?:p[+-]?\d[\d_]*)?(?!\w)/i,/\b\d[\d_]*(?:\.[\d_]*)?(?:e[+-]?\d[\d_]*)?(?!\w)/i],directive:{pattern:/\B#\w+/,alias:"property"},label:{pattern:/\B~\w+/,alias:"property"},"type-variable":{pattern:/\B'\w+/,alias:"function"},variant:{pattern:/`\w+/,alias:"symbol"},keyword:/\b(?:as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|match|method|module|mutable|new|nonrec|object|of|open|private|rec|sig|struct|then|to|try|type|val|value|virtual|when|where|while|with)\b/,boolean:/\b(?:false|true)\b/,"operator-like-punctuation":{pattern:/\[[<>|]|[>|]\]|\{<|>\}/,alias:"punctuation"},operator:/\.[.~]|:[=>]|[=<>@^|&+\-*\/$%!?~][!$%&*+\-.\/:<=>?@^|~]*|\b(?:and|asr|land|lor|lsl|lsr|lxor|mod|or)\b/,punctuation:/;;|::|[(){}\[\].,:;#]|\b_\b/},r.languages.python={comment:{pattern:/(^|[^\\])#.*/,lookbehind:!0,greedy:!0},"string-interpolation":{pattern:/(?:f|fr|rf)(?:("""|''')[\s\S]*?\1|("|')(?:\\.|(?!\2)[^\\\r\n])*\2)/i,greedy:!0,inside:{interpolation:{pattern:/((?:^|[^{])(?:\{\{)*)\{(?!\{)(?:[^{}]|\{(?!\{)(?:[^{}]|\{(?!\{)(?:[^{}])+\})+\})+\}/,lookbehind:!0,inside:{"format-spec":{pattern:/(:)[^:(){}]+(?=\}$)/,lookbehind:!0},"conversion-option":{pattern:/![sra](?=[:}]$)/,alias:"punctuation"},rest:null}},string:/[\s\S]+/}},"triple-quoted-string":{pattern:/(?:[rub]|br|rb)?("""|''')[\s\S]*?\1/i,greedy:!0,alias:"string"},string:{pattern:/(?:[rub]|br|rb)?("|')(?:\\.|(?!\1)[^\\\r\n])*\1/i,greedy:!0},function:{pattern:/((?:^|\s)def[ \t]+)[a-zA-Z_]\w*(?=\s*\()/g,lookbehind:!0},"class-name":{pattern:/(\bclass\s+)\w+/i,lookbehind:!0},decorator:{pattern:/(^[\t ]*)@\w+(?:\.\w+)*/m,lookbehind:!0,alias:["annotation","punctuation"],inside:{punctuation:/\./}},keyword:/\b(?:_(?=\s*:)|and|as|assert|async|await|break|case|class|continue|def|del|elif|else|except|exec|finally|for|from|global|if|import|in|is|lambda|match|nonlocal|not|or|pass|print|raise|return|try|while|with|yield)\b/,builtin:/\b(?:__import__|abs|all|any|apply|ascii|basestring|bin|bool|buffer|bytearray|bytes|callable|chr|classmethod|cmp|coerce|compile|complex|delattr|dict|dir|divmod|enumerate|eval|execfile|file|filter|float|format|frozenset|getattr|globals|hasattr|hash|help|hex|id|input|int|intern|isinstance|issubclass|iter|len|list|locals|long|map|max|memoryview|min|next|object|oct|open|ord|pow|property|range|raw_input|reduce|reload|repr|reversed|round|set|setattr|slice|sorted|staticmethod|str|sum|super|tuple|type|unichr|unicode|vars|xrange|zip)\b/,boolean:/\b(?:False|None|True)\b/,number:/\b0(?:b(?:_?[01])+|o(?:_?[0-7])+|x(?:_?[a-f0-9])+)\b|(?:\b\d+(?:_\d+)*(?:\.(?:\d+(?:_\d+)*)?)?|\B\.\d+(?:_\d+)*)(?:e[+-]?\d+(?:_\d+)*)?j?(?!\w)/i,operator:/[-+%=]=?|!=|:=|\*\*?=?|\/\/?=?|<[<=>]?|>[=>]?|[&|^~]/,punctuation:/[{}[\];(),.:]/},r.languages.python["string-interpolation"].inside.interpolation.inside.rest=r.languages.python,r.languages.py=r.languages.python,r.languages.reason=r.languages.extend("clike",{string:{pattern:/"(?:\\(?:\r\n|[\s\S])|[^\\\r\n"])*"/,greedy:!0},"class-name":/\b[A-Z]\w*/,keyword:/\b(?:and|as|assert|begin|class|constraint|do|done|downto|else|end|exception|external|for|fun|function|functor|if|in|include|inherit|initializer|lazy|let|method|module|mutable|new|nonrec|object|of|open|or|private|rec|sig|struct|switch|then|to|try|type|val|virtual|when|while|with)\b/,operator:/\.{3}|:[:=]|\|>|->|=(?:==?|>)?|<=?|>=?|[|^?'#!~`]|[+\-*\/]\.?|\b(?:asr|land|lor|lsl|lsr|lxor|mod)\b/}),r.languages.insertBefore("reason","class-name",{char:{pattern:/'(?:\\x[\da-f]{2}|\\o[0-3][0-7][0-7]|\\\d{3}|\\.|[^'\\\r\n])'/,greedy:!0},constructor:/\b[A-Z]\w*\b(?!\s*\.)/,label:{pattern:/\b[a-z]\w*(?=::)/,alias:"symbol"}}),delete r.languages.reason.function,function(e){e.languages.sass=e.languages.extend("css",{comment:{pattern:/^([ \t]*)\/[\/*].*(?:(?:\r?\n|\r)\1[ \t].+)*/m,lookbehind:!0,greedy:!0}}),e.languages.insertBefore("sass","atrule",{"atrule-line":{pattern:/^(?:[ \t]*)[@+=].+/m,greedy:!0,inside:{atrule:/(?:@[\w-]+|[+=])/}}}),delete e.languages.sass.atrule;var t=/\$[-\w]+|#\{\$[-\w]+\}/,n=[/[+*\/%]|[=!]=|<=?|>=?|\b(?:and|not|or)\b/,{pattern:/(\s)-(?=\s)/,lookbehind:!0}];e.languages.insertBefore("sass","property",{"variable-line":{pattern:/^[ \t]*\$.+/m,greedy:!0,inside:{punctuation:/:/,variable:t,operator:n}},"property-line":{pattern:/^[ \t]*(?:[^:\s]+ *:.*|:[^:\s].*)/m,greedy:!0,inside:{property:[/[^:\s]+(?=\s*:)/,{pattern:/(:)[^:\s]+/,lookbehind:!0}],punctuation:/:/,variable:t,operator:n,important:e.languages.sass.important}}}),delete e.languages.sass.property,delete e.languages.sass.important,e.languages.insertBefore("sass","punctuation",{selector:{pattern:/^([ \t]*)\S(?:,[^,\r\n]+|[^,\r\n]*)(?:,[^,\r\n]+)*(?:,(?:\r?\n|\r)\1[ \t]+\S(?:,[^,\r\n]+|[^,\r\n]*)(?:,[^,\r\n]+)*)*/m,lookbehind:!0,greedy:!0}})}(r),r.languages.scss=r.languages.extend("css",{comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},atrule:{pattern:/@[\w-](?:\([^()]+\)|[^()\s]|\s+(?!\s))*?(?=\s+[{;])/,inside:{rule:/@[\w-]+/}},url:/(?:[-a-z]+-)?url(?=\()/i,selector:{pattern:/(?=\S)[^@;{}()]?(?:[^@;{}()\s]|\s+(?!\s)|#\{\$[-\w]+\})+(?=\s*\{(?:\}|\s|[^}][^:{}]*[:{][^}]))/,inside:{parent:{pattern:/&/,alias:"important"},placeholder:/%[-\w]+/,variable:/\$[-\w]+|#\{\$[-\w]+\}/}},property:{pattern:/(?:[-\w]|\$[-\w]|#\{\$[-\w]+\})+(?=\s*:)/,inside:{variable:/\$[-\w]+|#\{\$[-\w]+\}/}}}),r.languages.insertBefore("scss","atrule",{keyword:[/@(?:content|debug|each|else(?: if)?|extend|for|forward|function|if|import|include|mixin|return|use|warn|while)\b/i,{pattern:/( )(?:from|through)(?= )/,lookbehind:!0}]}),r.languages.insertBefore("scss","important",{variable:/\$[-\w]+|#\{\$[-\w]+\}/}),r.languages.insertBefore("scss","function",{"module-modifier":{pattern:/\b(?:as|hide|show|with)\b/i,alias:"keyword"},placeholder:{pattern:/%[-\w]+/,alias:"selector"},statement:{pattern:/\B!(?:default|optional)\b/i,alias:"keyword"},boolean:/\b(?:false|true)\b/,null:{pattern:/\bnull\b/,alias:"keyword"},operator:{pattern:/(\s)(?:[-+*\/%]|[=!]=|<=?|>=?|and|not|or)(?=\s)/,lookbehind:!0}}),r.languages.scss.atrule.inside.rest=r.languages.scss,function(e){var t={pattern:/(\b\d+)(?:%|[a-z]+)/,lookbehind:!0},n={pattern:/(^|[^\w.-])-?(?:\d+(?:\.\d+)?|\.\d+)/,lookbehind:!0},r={comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0},url:{pattern:/\burl\((["']?).*?\1\)/i,greedy:!0},string:{pattern:/("|')(?:(?!\1)[^\\\r\n]|\\(?:\r\n|[\s\S]))*\1/,greedy:!0},interpolation:null,func:null,important:/\B!(?:important|optional)\b/i,keyword:{pattern:/(^|\s+)(?:(?:else|for|if|return|unless)(?=\s|$)|@[\w-]+)/,lookbehind:!0},hexcode:/#[\da-f]{3,6}/i,color:[/\b(?:AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenRod|DarkGr[ae]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGr[ae]y|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGr[ae]y|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|GhostWhite|Gold|GoldenRod|Gr[ae]y|Green|GreenYellow|HoneyDew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenRodYellow|LightGr[ae]y|LightGreen|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGr[ae]y|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquaMarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenRod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|SeaShell|Sienna|Silver|SkyBlue|SlateBlue|SlateGr[ae]y|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Transparent|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen)\b/i,{pattern:/\b(?:hsl|rgb)\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*\)\B|\b(?:hsl|rgb)a\(\s*\d{1,3}\s*,\s*\d{1,3}%?\s*,\s*\d{1,3}%?\s*,\s*(?:0|0?\.\d+|1)\s*\)\B/i,inside:{unit:t,number:n,function:/[\w-]+(?=\()/,punctuation:/[(),]/}}],entity:/\\[\da-f]{1,8}/i,unit:t,boolean:/\b(?:false|true)\b/,operator:[/~|[+!\/%<>?=]=?|[-:]=|\*[*=]?|\.{2,3}|&&|\|\||\B-\B|\b(?:and|in|is(?: a| defined| not|nt)?|not|or)\b/],number:n,punctuation:/[{}()\[\];:,]/};r.interpolation={pattern:/\{[^\r\n}:]+\}/,alias:"variable",inside:{delimiter:{pattern:/^\{|\}$/,alias:"punctuation"},rest:r}},r.func={pattern:/[\w-]+\([^)]*\).*/,inside:{function:/^[^(]+/,rest:r}},e.languages.stylus={"atrule-declaration":{pattern:/(^[ \t]*)@.+/m,lookbehind:!0,inside:{atrule:/^@[\w-]+/,rest:r}},"variable-declaration":{pattern:/(^[ \t]*)[\w$-]+\s*.?=[ \t]*(?:\{[^{}]*\}|\S.*|$)/m,lookbehind:!0,inside:{variable:/^\S+/,rest:r}},statement:{pattern:/(^[ \t]*)(?:else|for|if|return|unless)[ \t].+/m,lookbehind:!0,inside:{keyword:/^\S+/,rest:r}},"property-declaration":{pattern:/((?:^|\{)([ \t]*))(?:[\w-]|\{[^}\r\n]+\})+(?:\s*:\s*|[ \t]+)(?!\s)[^{\r\n]*(?:;|[^{\r\n,]$(?!(?:\r?\n|\r)(?:\{|\2[ \t])))/m,lookbehind:!0,inside:{property:{pattern:/^[^\s:]+/,inside:{interpolation:r.interpolation}},rest:r}},selector:{pattern:/(^[ \t]*)(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\)|(?![\w-]))|\{[^}\r\n]+\})+)(?:(?:\r?\n|\r)(?:\1(?:(?=\S)(?:[^{}\r\n:()]|::?[\w-]+(?:\([^)\r\n]*\)|(?![\w-]))|\{[^}\r\n]+\})+)))*(?:,$|\{|(?=(?:\r?\n|\r)(?:\{|\1[ \t])))/m,lookbehind:!0,inside:{interpolation:r.interpolation,comment:r.comment,punctuation:/[{},]/}},func:r.func,string:r.string,comment:{pattern:/(^|[^\\])(?:\/\*[\s\S]*?\*\/|\/\/.*)/,lookbehind:!0,greedy:!0},interpolation:r.interpolation,punctuation:/[{}()\[\];:.]/}}(r),function(e){var t=e.util.clone(e.languages.typescript);e.languages.tsx=e.languages.extend("jsx",t),delete e.languages.tsx.parameter,delete e.languages.tsx["literal-property"];var n=e.languages.tsx.tag;n.pattern=RegExp(/(^|[^\w$]|(?=<\/))/.source+"(?:"+n.pattern.source+")",n.pattern.flags),n.lookbehind=!0}(r),r.languages.wasm={comment:[/\(;[\s\S]*?;\)/,{pattern:/;;.*/,greedy:!0}],string:{pattern:/"(?:\\[\s\S]|[^"\\])*"/,greedy:!0},keyword:[{pattern:/\b(?:align|offset)=/,inside:{operator:/=/}},{pattern:/\b(?:(?:f32|f64|i32|i64)(?:\.(?:abs|add|and|ceil|clz|const|convert_[su]\/i(?:32|64)|copysign|ctz|demote\/f64|div(?:_[su])?|eqz?|extend_[su]\/i32|floor|ge(?:_[su])?|gt(?:_[su])?|le(?:_[su])?|load(?:(?:8|16|32)_[su])?|lt(?:_[su])?|max|min|mul|neg?|nearest|or|popcnt|promote\/f32|reinterpret\/[fi](?:32|64)|rem_[su]|rot[lr]|shl|shr_[su]|sqrt|store(?:8|16|32)?|sub|trunc(?:_[su]\/f(?:32|64))?|wrap\/i64|xor))?|memory\.(?:grow|size))\b/,inside:{punctuation:/\./}},/\b(?:anyfunc|block|br(?:_if|_table)?|call(?:_indirect)?|data|drop|elem|else|end|export|func|get_(?:global|local)|global|if|import|local|loop|memory|module|mut|nop|offset|param|result|return|select|set_(?:global|local)|start|table|tee_local|then|type|unreachable)\b/],variable:/\$[\w!#$%&'*+\-./:<=>?@\\^`|~]+/,number:/[+-]?\b(?:\d(?:_?\d)*(?:\.\d(?:_?\d)*)?(?:[eE][+-]?\d(?:_?\d)*)?|0x[\da-fA-F](?:_?[\da-fA-F])*(?:\.[\da-fA-F](?:_?[\da-fA-D])*)?(?:[pP][+-]?\d(?:_?\d)*)?)\b|\binf\b|\bnan(?::0x[\da-fA-F](?:_?[\da-fA-D])*)?\b/,punctuation:/[()]/},t.Z=r},9901:function(e){e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apex:{title:"Apex",require:["clike","sql"],owner:"RunDevelopment"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",alias:"ino",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},armasm:{title:"ARM Assembly",alias:"arm-asm",owner:"RunDevelopment"},arturo:{title:"Arturo",alias:"art",optional:["bash","css","javascript","markup","markdown","sql"],owner:"drkameleon"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},asmatmel:{title:"Atmel AVR Assembly",owner:"cerkit"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},avisynth:{title:"AviSynth",alias:"avs",owner:"Zinfidel"},"avro-idl":{title:"Avro IDL",alias:"avdl",owner:"RunDevelopment"},awk:{title:"AWK",alias:"gawk",aliasTitles:{gawk:"GAWK"},owner:"RunDevelopment"},bash:{title:"Bash",alias:["sh","shell"],aliasTitles:{sh:"Shell",shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},bbj:{title:"BBj",owner:"hyyan"},bicep:{title:"Bicep",owner:"johnnyreilly"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},bqn:{title:"BQN",owner:"yewscion"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cfscript:{title:"CFScript",require:"clike",alias:"cfc",owner:"mjclemente"},chaiscript:{title:"ChaiScript",require:["clike","cpp"],owner:"RunDevelopment"},cil:{title:"CIL",owner:"sbrl"},cilkc:{title:"Cilk/C",require:"c",alias:"cilk-c",owner:"OpenCilk"},cilkcpp:{title:"Cilk/C++",require:"cpp",alias:["cilk-cpp","cilk"],owner:"OpenCilk"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},cobol:{title:"COBOL",owner:"RunDevelopment"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},cooklang:{title:"Cooklang",owner:"ahue"},coq:{title:"Coq",owner:"RunDevelopment"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},csv:{title:"CSV",owner:"RunDevelopment"},cue:{title:"CUE",owner:"RunDevelopment"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dataweave:{title:"DataWeave",owner:"machaval"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},dot:{title:"DOT (Graphviz)",alias:"gv",optional:"markup",owner:"RunDevelopment"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},false:{title:"False",owner:"edukisto"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gap:{title:"GAP (CAS)",owner:"RunDevelopment"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gettext:{title:"gettext",alias:"po",owner:"RunDevelopment"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},gn:{title:"GN",alias:"gni",owner:"RunDevelopment"},"linker-script":{title:"GNU Linker Script",alias:"ld",owner:"RunDevelopment"},go:{title:"Go",require:"clike",owner:"arnehormann"},"go-module":{title:"Go module",alias:"go-mod",owner:"RunDevelopment"},gradle:{title:"Gradle",require:"clike",owner:"zeabdelkhalek-badido18"},graphql:{title:"GraphQL",optional:"markdown",owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",alias:["hbs","mustache"],aliasTitles:{mustache:"Mustache"},owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",optional:"regex",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},hoon:{title:"Hoon",owner:"matildepark"},http:{title:"HTTP",optional:["csp","css","hpkp","hsts","javascript","json","markup","uri"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},"icu-message-format":{title:"ICU Message Format",owner:"RunDevelopment"},idris:{title:"Idris",alias:"idr",owner:"KeenS",require:"haskell"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jexl:{title:"Jexl",owner:"czosel"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup","sql"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keepalived:{title:"Keepalived Configure",owner:"dev-itsheng"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},kumir:{title:"KuMir (\u041a\u0443\u041c\u0438\u0440)",alias:"kum",owner:"edukisto"},kusto:{title:"Kusto",owner:"RunDevelopment"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",require:"markup-templating",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},log:{title:"Log file",optional:"javastacktrace",owner:"RunDevelopment"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},magma:{title:"Magma (CAS)",owner:"RunDevelopment"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",optional:"yaml",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},mata:{title:"Mata",owner:"RunDevelopment"},matlab:{title:"MATLAB",owner:"Golmote"},maxscript:{title:"MAXScript",owner:"RunDevelopment"},mel:{title:"MEL",owner:"Golmote"},mermaid:{title:"Mermaid",owner:"RunDevelopment"},metafont:{title:"METAFONT",owner:"LaeriExNihilo"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nevod:{title:"Nevod",owner:"nezaboodka"},nginx:{title:"nginx",owner:"volado"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},odin:{title:"Odin",owner:"edukisto"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},openqasm:{title:"OpenQasm",alias:"qasm",owner:"RunDevelopment"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},psl:{title:"PATROL Scripting Language",owner:"bertysentry"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:"markup-templating",owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},"plant-uml":{title:"PlantUML",alias:"plantuml",owner:"RunDevelopment"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},promql:{title:"PromQL",owner:"arendjr"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},qsharp:{title:"Q#",require:"clike",alias:"qs",owner:"fedonman"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},cshtml:{title:"Razor C#",alias:"razor",require:["markup","csharp"],optional:["css","css-extras","javascript","js-extras"],owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},rego:{title:"Rego",owner:"JordanSh"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rescript:{title:"ReScript",alias:"res",owner:"vmarcosp"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",optional:"css-extras",owner:"Golmote"},scss:{title:"Sass (SCSS)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",optional:"php",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},squirrel:{title:"Squirrel",require:"clike",owner:"RunDevelopment"},stan:{title:"Stan",owner:"RunDevelopment"},stata:{title:"Stata Ado",require:["mata","java","python"],owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},supercollider:{title:"SuperCollider",alias:"sclang",owner:"RunDevelopment"},swift:{title:"Swift",owner:"chrischares"},systemd:{title:"Systemd configuration file",owner:"RunDevelopment"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},tremor:{title:"Tremor",alias:["trickle","troy"],owner:"darach",aliasTitles:{trickle:"trickle",troy:"troy"}},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup-templating",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},uorazor:{title:"UO Razor Script",owner:"jaseowns"},uri:{title:"URI",alias:"url",aliasTitles:{url:"URL"},owner:"RunDevelopment"},v:{title:"V",require:"clike",owner:"taggon"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},"web-idl":{title:"Web IDL",alias:"webidl",owner:"RunDevelopment"},wgsl:{title:"WGSL",owner:"Dr4gonthree"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},wolfram:{title:"Wolfram language",alias:["mathematica","nb","wl"],aliasTitles:{mathematica:"Mathematica",nb:"Mathematica Notebook"},owner:"msollami"},wren:{title:"Wren",owner:"clsource"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to WebPlatform.org documentation. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (.comment can become .namespace--comment) or replace them with your defined ones (like .editor__comment). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword for fine-grained highlighting.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the highlightAll and highlightAllUnder methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},2885:function(e,t,n){const r=n(9901),o=n(9642),i=new Set;function a(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...i,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(a.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(6500).resolve(t)],delete Prism.languages[e],n(6500)(t),i.add(e)}))}a.silent=!1,e.exports=a},6726:function(e,t,n){var r={"./":2885};function o(e){var t=i(e);return n(t)}function i(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=i,e.exports=o,o.id=6726},6500:function(e,t,n){var r={"./":2885};function o(e){var t=i(e);return n(t)}function i(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=i,e.exports=o,o.id=6500},9642:function(e){"use strict";var t=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n "));var u={},l=e[r];if(l){function s(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in u))for(var a in o(t,i),u[t]=!0,n[t])u[a]=!0}t(l.require,s),t(l.optional,s),t(l.modify,s)}n[r]=u,i.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(i,a,u){var l=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var i=r[o];t[o]="string"==typeof i?{title:i}:i}}return t}(i),s=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var i=e[o];t(i&&i.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(l);a=a.map(s),u=(u||[]).map(s);var c=n(a),d=n(u);a.forEach((function e(n){var r=l[n];t(r&&r.require,(function(t){t in d||(c[t]=!0,e(t))}))}));for(var f,p=r(l),h=c;o(h);){for(var m in f={},h){var g=l[m];t(g&&g.modify,(function(e){e in d&&(f[e]=!0)}))}for(var v in d)if(!(v in c))for(var y in p(v))if(y in c){f[v]=!0;break}for(var b in h=f)c[b]=!0}var x={getIds:function(){var e=[];return x.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){var i=o?o.series:void 0,a=o?o.parallel:e,u={},l={};function s(e){if(e in u)return u[e];l[e]=!0;var o,c=[];for(var d in t(e))d in n&&c.push(d);if(0===c.length)o=r(e);else{var f=a(c.map((function(e){var t=s(e);return delete l[e],t})));i?o=i(f,(function(){return r(e)})):r(e)}return u[e]=o}for(var c in n)s(c);var d=[];for(var f in l)d.push(u[f]);return a(d)}(p,c,t,n)}};return x}}();e.exports=t},2703:function(e,t,n){"use strict";var r=n(414);function o(){}function i(){}i.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,i,a){if(a!==r){var u=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw u.name="Invariant Violation",u}}function t(){return e}e.isRequired=e;var n={array:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:i,resetWarningCache:o};return n.PropTypes=n,n}},5697:function(e,t,n){e.exports=n(2703)()},414:function(e){"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},4448:function(e,t,n){"use strict";var r=n(7294),o=n(7418),i=n(3840);function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n