Nginx Auth Service + Self-Hosted Apps

Auth gateway and reverse proxy for self-hosted web apps. Lives at ~/Work/services/nginx-auth-service.

Architecture

graph TD
    Client["Browser
(HTTPS)"] --> Nginx["nginx
192.168.1.185"]
    Nginx --> Auth["auth-service
auth_request"]
    Nginx --> MacStudio["Mac Studio
192.168.1.189"]

    MacStudio --> Pi["pi-webui
:49998"]
    MacStudio --> Max["max.dph.am
OpenClaw :18789"]
    MacStudio --> Rsx["rsx.dph.am
Reasonix :49999"]
    MacStudio --> Term["term.dph.am
ttyd :8089"]

    style Client fill:#2d5a27,color:#fff
    style Nginx fill:#1a4a7a,color:#fff
    style Auth fill:#6b3fa0,color:#fff
    style MacStudio fill:#8b4513,color:#fff

All backends run on the Mac Studio (192.168.1.189).

Apps behind the proxy

Auth Service

Project: ~/Work/services/nginx-auth-service

Provides an authentication layer that nginx checks via auth_request before proxying to any backend. Keeps self-hosted tools behind a login wall.

How it works

1. nginx receives a request for *.dph.am
2. Before proxying, nginx sends a sub-request to the auth service endpoint
3. Auth service validates session/cookie/token
4. If valid: nginx stamps X-Forwarded-User header and proxies to backend
5. If invalid: redirects to login page or returns 401

OpenClaw trust

OpenClaw runs in trusted-proxy auth mode — it only trusts X-Forwarded-User if it comes from the nginx proxy at 192.168.1.185. This means:

• Access through max.dph.am is seamless (nginx auth + header = auto-authed)
• Direct LAN access to OpenClaw's port requires a token
• trusted-proxy locks out loopback CLI commands — local openclaw cron list won't work without switching auth mode

pi.dph.am

Serves pi-webui — a web-based UI for the Pi coding agent.

Backend config

For full Pi web UI + MCP adapter setup, see AI/pi-coding-agent.md.

rsx.dph.am

Serves Reasonix — a coding agent with its own dashboard UI.

Startup command

npx reasonix code --dashboard-host 0.0.0.0 --dashboard-port 49999 -n

• Runs on the Mac Studio (192.168.1.189), port 49999
• -n flag runs it non-interactively (daemon/background mode)
• nginx proxies rsx.dph.am → backend 192.168.1.189:49999

Backend config