Nginx Auth Service + Self-Hosted Apps

Auth gateway and reverse proxy for self-hosted web apps. Lives at ~/Work/services/nginx-auth-service.

Architecture

graph TD
    Client["Browser
(HTTPS)"] --> Nginx["nginx
Mac Studio 192.168.1.189"]
    Nginx --> Auth["auth-service
auth_request"]
    Nginx --> Backends["local backends
(same machine)"]

    Backends --> Pi["pi-webui
:49998"]
    Backends --> Max["max.dph.am
OpenClaw :18789"]
    Backends --> Rsx["rsx.dph.am
Reasonix :49999"]
    Backends --> Term["term.dph.am
ttyd :8089"]

    style Client fill:#2d5a27,color:#fff
    style Nginx fill:#1a4a7a,color:#fff
    style Auth fill:#6b3fa0,color:#fff
    style Backends fill:#8b4513,color:#fff

As of 2026-09-20, nginx itself runs on the Mac Studio (192.168.1.189) — it's the central reverse proxy for *.dph.am, not just the backend host. See nginx.md for the nginx server setup/migration itself. All backends listed below also run on this same machine.

Apps behind the proxy

Auth Service

Project: ~/Work/services/nginx-auth-service

Provides an authentication layer that nginx checks via auth_request before proxying to any backend. Keeps self-hosted tools behind a login wall.

How it works

1. nginx receives a request for *.dph.am
2. Before proxying, nginx sends a sub-request to the auth service endpoint
3. Auth service validates session/cookie/token
4. If valid: nginx stamps X-Forwarded-User header and proxies to backend
5. If invalid: redirects to login page or returns 401

OpenClaw trust

OpenClaw runs in trusted-proxy auth mode — it only trusts X-Forwarded-User from a connection it can verify as coming from the real proxy.

2026-09-20 update: initially just bumped gateway.trustedProxies from 192.168.1.185 to 192.168.1.189 (nginx's new LAN IP after the move), but that alone produced reason=trusted_proxy_local_interface_source rejections. OpenClaw has a hard-coded guard: it refuses to trust a proxy source IP that matches one of this machine's own network interfaces — since nginx and OpenClaw now run on the same box, 192.168.1.189 is both the "trusted proxy" and the app host, which the guard treats as a spoofing risk rather than a legitimate proxy hop. It only allows same-host trust via genuine loopback (127.0.0.1), and only with allowLoopback: true set explicitly.

Fixed by routing through real loopback end-to-end:

• sites-enabled/max.dph.am.conf: proxy_pass changed from http://192.168.1.189:18789 to http://127.0.0.1:18789
• ~/.openclaw/openclaw.json: gateway.trustedProxies → ["127.0.0.1", "::1"], gateway.auth.trustedProxy.allowLoopback → true, and gateway.auth.trustedProxy.allowUsers → ["dominick"] added as a belt-and-suspenders restriction now that IP trust is looser (loopback, not a specific LAN address)

OpenClaw's gateway auto-restarts on config changes; confirmed working — log shows authenticated user connected ... user=dominick over remote=127.0.0.1. This means:

• Access through max.dph.am is seamless (nginx auth + header = auto-authed)
• Direct LAN access to OpenClaw's port requires a token
• trusted-proxy locks out loopback CLI commands — local openclaw cron list won't work without switching auth mode

pi.dph.am

Serves pi-webui — a web-based UI for the Pi coding agent.

Backend config

For full Pi web UI + MCP adapter setup, see AI/pi-coding-agent.md.

rsx.dph.am

Serves Reasonix — a coding agent with its own dashboard UI.

Startup command

npx reasonix code --dashboard-host 0.0.0.0 --dashboard-port 49999 -n

• Runs on the Mac Studio (192.168.1.189), port 49999
• -n flag runs it non-interactively (daemon/background mode)
• nginx proxies rsx.dph.am → backend 192.168.1.189:49999

Backend config