exe-oidc-proxy

exe-oidc-proxy

A minimal reverse proxy that acts as an OpenID Connect identity provider, using exe.dev's authentication headers as the source of truth.

When an app (Plane, Zulip, Gitea, etc.) initiates an OIDC login, the browser is redirected to this proxy's authorization endpoint. Because the proxy sits behind exe.dev's HTTPS proxy, the X-ExeDev-Email and X-ExeDev-UserID headers are already present — so the OIDC flow completes instantly with zero user interaction.

Architecture

User → exe.dev proxy (adds X-ExeDev-Email/X-ExeDev-UserID)
     → exe-oidc-proxy (port 8000)
       ├── OIDC IdP endpoints (/_oidc/*)
       └── reverse proxy → upstream app (e.g. Plane on :3000)

Install

go install github.com/boldsoftware/exe-oidc-proxy@latest

Usage

exe-oidc-proxy \
  -listen :8000 \
  -upstream http://localhost:3000 \
  -issuer https://myvm.exe.xyz/_oidc \
  -client-id myapp \
  -client-secret mysecret

All flags can also be set via environment variables:

How it works

1. App has no session → redirects browser to /_oidc/authorize
2. exe.dev's proxy has already added X-ExeDev-Email to the request
3. The authorize endpoint reads the header, generates an auth code, and redirects back to the app's callback URL instantly
4. App exchanges the code for tokens at /_oidc/token
5. App verifies the id_token using keys from /_oidc/jwks
6. User is logged in

If the user isn't authenticated yet (no X-ExeDev-Email header), the authorize endpoint redirects to /__exe.dev/login first.

OIDC endpoints

License

MIT