fix: use HTTPS for Outline OIDC URLs (#940)

* fix: use HTTPS for Outline OIDC URLs

* Add root-healthy Dex proxy for Outline

---------

Co-authored-by: Rohit Mulani <289630555+rohitmulani63-ops@users.noreply.github.com>

blueprints/outline/docker-compose.yml

@@ -12,18 +12,36 @@ services:
       NODE_ENV: production
       URL: ${URL}
       FORCE_HTTPS: 'false'
+      PROXY_HEADERS_TRUSTED: 'true'
       SECRET_KEY: ${SECRET_KEY}
       UTILS_SECRET: ${UTILS_SECRET}
       DATABASE_URL: postgres://outline:${POSTGRES_PASSWORD}@postgres:5432/outline
       PGSSLMODE: disable
       REDIS_URL: redis://redis:6379
+      FILE_STORAGE: local
+      FILE_STORAGE_LOCAL_ROOT_DIR: /var/lib/outline/data
       OIDC_CLIENT_ID: outline
       OIDC_CLIENT_SECRET: ${CLIENT_SECRET}
       OIDC_AUTH_URI: ${DEX_URL}/auth
       OIDC_TOKEN_URI: ${DEX_URL}/token
       OIDC_USERINFO_URI: ${DEX_URL}/userinfo
+      OIDC_USERNAME_CLAIM: preferred_username
+      OIDC_DISPLAY_NAME: OpenID Connect
+      OIDC_SCOPES: openid profile email
+    volumes:
+      - outline_data-test-outline-khufpx:/var/lib/outline/data
 
   dex:
+    image: nginx:1.27-alpine
+    restart: always
+    depends_on:
+      - dex-server
+    volumes:
+      - ../files/etc/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf
+    ports:
+      - 5556
+
+  dex-server:
     image: ghcr.io/dexidp/dex:v2.37.0
     restart: always
     volumes:
@@ -32,8 +50,6 @@ services:
       - dex
       - serve
       - /etc/dex/config.yaml
-    ports:
-      - 5556
 
   postgres:
     image: postgres:15
@@ -53,5 +69,6 @@ services:
       - redis_data-test-outline-khufpx:/data
     
 volumes:
+  outline_data-test-outline-khufpx:
   postgres_data-test-outline-khufpx:
-  redis_data-test-outline-khufpx:
+  redis_data-test-outline-khufpx:

blueprints/outline/template.toml

@@ -1,6 +1,6 @@
 [variables]
 main_domain = "${domain}"
-dex_domain = "${domain}"
+dex_domain = "dex-${domain}"
 secret_key = "${hash:64}"
 utils_secret = "${base64:32}"
 client_secret = "${base64:32}"
@@ -17,8 +17,8 @@ port = 5_556
 host = "${dex_domain}"
 
 [config.env]
-URL = "http://${main_domain}"
-DEX_URL = "http://${dex_domain}"
+URL = "https://${main_domain}"
+DEX_URL = "https://${dex_domain}"
 DOMAIN_NAME = "${main_domain}"
 POSTGRES_PASSWORD = "${postgres_password}"
 SECRET_KEY = "${secret_key}"
@@ -28,7 +28,7 @@ CLIENT_SECRET = "${client_secret}"
 [[config.mounts]]
 filePath = "/etc/dex/config.yaml"
 content = """
-issuer: http://${dex_domain}
+issuer: https://${dex_domain}
 
 web:
   http: 0.0.0.0:5556
@@ -60,7 +60,28 @@ oauth2:
 staticClients:
   - id: "outline"
     redirectURIs:
-      - http://${main_domain}/auth/oidc.callback
+      - https://${main_domain}/auth/oidc.callback
     name: "Outline"
     secret: "${client_secret}" 
 """
+
+[[config.mounts]]
+filePath = "/etc/nginx/conf.d/default.conf"
+content = """
+server {
+  listen 5556;
+
+  location = / {
+    add_header Content-Type text/plain;
+    return 200 "Dex ready\n";
+  }
+
+  location / {
+    proxy_pass http://dex-server:5556;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+"""