Djeex/docudjeex
1
1
Fork 0
Code Issues Pull Requests Actions Projects Wiki Activity

Fix TinyAuth's Uptime-Kuma public-paths example: mislabeled tag and over-broad /api and /metrics exposure

Browse Source
This commit is contained in:
Djeex
2026-09-07 13:42:48 +02:00
parent 81c54c9afc
commit d1f3f4ff88
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/3.serveex/3.security/3.tinyauth.md
+4 -4
View File
@@ -12,7 +12,7 @@ description: Install TinyAuth, a lightweight forward-auth proxy, and pair it wit
It supports a simple local username/password login out of the box, which is what we'll set up here. It can also delegate login to an external OIDC provider like [Pocket ID](/serveex/security/pocket-id) instead, so anyone visiting a protected app authenticates with a passkey via Pocket ID and then gets forwarded through: install Pocket ID afterwards and follow [its guide](/serveex/security/pocket-id#connecting-pocket-id-to-tinyauth) to connect the two.
- [TinyAuth documentation](https://tinyauth.app/docs)
- [TinyAuth documentation](https://tinyauth.app/docs/getting-started)
- [TinyAuth on GitHub](https://github.com/tinyauthapp/tinyauth)
## Installation
@@ -299,9 +299,9 @@ Sometimes you want most of an app locked behind TinyAuth, but a handful of paths
A regex `location` block always takes priority over the plain `location /` block, no matter which one appears first in the file. So any path matched by a regex location you define runs its own `proxy_pass`, without ever reaching the `auth_request /tinyauth;` line in `location /`.
For example, to leave Uptime-Kuma's public status page and its assets open while protecting everything else:
For example, here's how to leave Uptime-Kuma's public status page and its assets open while protecting everything else. Only `api/status-page` is left public, not all of `/api`, since the rest of Uptime-Kuma's API is meant to stay behind authentication; `/metrics` (Uptime-Kuma's Prometheus endpoint) is left out of the regex entirely for the same reason:
```nginx [dockge.subdomain.conf]{9-16}
```nginx [uptime-kuma.subdomain.conf]{9-16}
server {
listen 443 ssl;
listen [::]:443 ssl;
@@ -310,7 +310,7 @@ server {
include /config/nginx/ssl.conf;
location ~ ^/(status|assets|icon\.svg|api|upload|metrics) {
location ~ ^/(status|assets|icon\.svg|api/status-page|upload) {
include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
set $upstream_app uptime-kuma;