Who is using Vouch Proxy? What are you using it for?

[bnfinet]

As we work to improve Vouch Proxy and work on the Vouch project overall we'd like to hear from you about your usage of VP.

Please take a moment to chime in here about how you're using VP and anything else you'd like to share about your setup and your organization.

If you have a particularly interesting setup we may add it to the list of advanced configurartions in the README.

[aaronpk]

I run two instances of Vouch Proxy in very different configurations:

Home

I have Vouch on my home nginx server and it sits in front of a few different applications and other internal servers which either don't have their own authentication or I don't trust their authentication.

Vouch is configured to use my Gitea instance for authentication, and I am the only allowed user.

IndieWeb

I run Vouch on indieweb.org to authenticate to a few apps behind the proxy.

• MediaWiki - The main site indieweb.org is a MediaWiki instance with a plugin to use a plugin to auto-create MW users based on the header Vouch sets
• Meetable - Our events site events.indieweb.org which supports Vouch natively

In this case Vouch is configured to use https://indielogin.com to authenticate users. Anyone is allowed to log in, and the sites are visible publicly without authentication, but editing is only allowed after a user logs in.

[AKTheKnight]

Currently running 3 instances of Vouch personally, while also pushing towards usage at work for various cloud webapps.

Personal

Three different servers (one at home) with Vouch and Nginx running within docker. All set to auth against AzureAD.

Used so I can make any service accessible across the internet without worrying about security. I would much rather have nginx as the web facing service instead of the services behind it.

Work

We run lots of services while in development, and developers often setup temporary authentication systems within an app. I would like to move this towards Vouch proxy for two reasons:

• Don't need to pay for AWS/AZURE/GCP versions.
• Same vouch base setup can be used across all clouds for all services. This is much easier for us to manage from a security point of view

[ReneHezser]

Home
Vouch and Nginx will allow a single sign on to all services on my homeserver.

• First thing using vouch will be Home Assistant (a pull request already exists).
• Then I need to figure out if Node-RED, and the other services I use support external authentication

[ArcolaJasper]

I'm using a couple of instances with nginx to protect access to directories of files on webservers. Using google as the oauth provider.

[jimcheetham]

Right now it's used to provide authentication to a family tree app that doesn't have a robust auth layer of its own; I don't want to manage new user accounts for family, and have more passwords for them to remember/forget, so it authenticates from google and I handle authorization in vouch by whitelisting email addresses.

I want to be able to use this with Discord as both authn and authz, so I can have a website automatically visible to users who have the appropriate roles within a discord server. This may be a bit of a bigger stretch. I'd put the discord server ID and role name into the vouch config and expect magic to happen. I haven't read #312 yet :-)

Ultimately Vouch simplifies the development of lightweight web applications, by allowing them to ignore authn and perhaps also authz, but the end-user experience is much better than .htpasswd :-)

[dariusk]

I run a Mastodon social media server and I want to be able to provide secondary services to my users. Prior to discovering Vouch, I was writing custom code into every new application to make the Mastodon OAuth dance happen but now I can just shove the simpler ones behind vouch-proxy and call it a day. Makes my life so much easier.

[khorwood]

Using it as a zero-trust edge for my home server with nginx.
Google OAuth with a restricted allow-list of users.

[Glowsome]

(trying to) Use it in combo with Microfocus AccesManager (previously NetIQ) for my small company and testing lab.

[billfor]

I use it with Okta to front openhab for my Tesla, whose browser does not support BasicAuth.

[frisson]

As an alternative to bitly/oauth2_proxy to provide SSO for in-house applications. We deploy to k8s and needed a way to authenticate services. We already use okta and this provides the easiest integration. One big benefit is one can deploy a single instance of vouch instead of a proxy per service. Requiring auth becomes as simple as adding the right annotations to a service's ingress.

[dionjwa]

I have a complete cloud stack template (app + ci + deploy in cloud providers with oauth). There are other oauth systems, but for a flexible simple single oauth service vouch is reliable and simple. I use node.js instead of nginx as the router of requests (maybe that config could be useful to others, idk it feels a pretty rare case). In a sense it replaces using Auth0, Okta, etc, or an integrated OAuth library like http://www.passportjs.org/. There's just so much complexity, possible vendor lock-in, expense, etc, that sometimes a tool solving a single task is preferable, at least in the beginning.

[bnfinet]

@dionjwa thanks for offering your setup and the kind words for VP.

I'm very curious about your usage of node.js in front of VP. I'm sure it would be of value to other users if you cared to share more about how you're interacting with VP from node. On occasion I've thought to myself that we should host language specific libraries to support interaction with VP. If you were at all interested in working towards a javascript or typescript library for VP interaction I'd be happy to be a resource to you.