Multiple domains with OAuth

[robflate]

I followed the Wordpress tutorial and have everything working as per the tutorial;

• 1 x Wordpress site (domain.com)
• 1 x Non wordpress site (domain1.com)

I added the following;

• 1 x Wordpress site (domain2.com)

The result is;

• domain.com and domain1.com work correctly
• domain2.com has valid certs. I can see them in the browser and in acme.json and I can hit domain2.com which shows as secure and displays my Wordpress sites homepage.

However, I'm having the following issues;

• The domain2.com Wordpress homepage shows insecure content errors such as;
  The page at https://www.domain2.com/ was not allowed to run insecure content from http://www.domain2.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2
• When I go to https://domain2.com/wp-admin I get the Google OAuth screen and login but it returns me to the sites homepage. Maybe this is to do with what URL I have entered in the Authorised redirect URIs section of the Google dev console?

It seems to be something to do with OAuth or redirections or the Traefik routing on the Nginx container. You can't add multiple AUTH_HOST to the OAuth container so you have to manually add Authorised redirect URIs to the Google dev console but maybe I'm adding them wrong? Maybe I've setup the Traefik routing on the Nginx container wrong?

Anyway, here's my additions. I use a slightly different folder layout and PATH variables but I don't think that is an issue here. Maybe you have working code for adding more Wordpress domains or more specifically more sites that mix auth and no-auth and have www redirections.

Thanks.

docker-compose.yml traefik

      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME
      - --entrypoints.https.http.tls.domains[1].main=$DOMAINNAME1
      - --entrypoints.https.http.tls.domains[1].sans=*.$DOMAINNAME1
      - --entrypoints.https.http.tls.domains[2].main=$DOMAINNAME2
      - --entrypoints.https.http.tls.domains[2].sans=*.$DOMAINNAME2

docker-compose.yml Nginx

    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /var/log/nginx:/var/log/nginx
      - $CONFIG/nginx:/etc/nginx
      - $COMPOSEDIR/shared/.htpassd:/shared/.htpasswd
      - $COMPOSEDIR/sites/domain/html:/var/www/html/domain
      - $COMPOSEDIR/sites/domain1/html:/var/www/html/domain1
      - $COMPOSEDIR/sites/domain2/html:/var/www/html/domain2
    labels:
      - "traefik.enable=true"
      ## HTTP Routers domain.com (WordPress) Auth
      - "traefik.http.routers.nginx-domain-auth-rtr.entrypoints=https"
      - "traefik.http.routers.nginx-domain-auth-rtr.rule=Host(`www.$DOMAINNAME`) && Path(`/wp-login.php`)"
      - "traefik.http.routers.nginx-domain-auth-rtr.priority=100"
      ## HTTP Routers domain.com (WordPress) Bypass
      - "traefik.http.routers.nginx-domain-rtr.entrypoints=https"
      - "traefik.http.routers.nginx-domain-rtr.rule=Host(`$DOMAINNAME`) || Host(`www.$DOMAINNAME`)"
      - "traefik.http.routers.nginx-domain-rtr.priority=99"
      ## HTTP Routers domain2.com (WordPress) Auth
      - "traefik.http.routers.nginx-domain2-auth-rtr.entrypoints=https"
      - "traefik.http.routers.nginx-domain2-auth-rtr.rule=Host(`www.$DOMAINNAME2`) && Path(`/wp-login.php`)"
      - "traefik.http.routers.nginx-domain2-auth-rtr.priority=100"
      ## HTTP Routers domain2.com (WordPress) Bypass
      - "traefik.http.routers.nginx-domain2-rtr.entrypoints=https"
      - "traefik.http.routers.nginx-domain2-rtr.rule=Host(`$DOMAINNAME2`) || Host(`www.$DOMAINNAME2`)"
      - "traefik.http.routers.nginx-domain2-rtr.priority=99"
      ## HTTP Routers domain1.com (non-WordPress)
      - "traefik.http.routers.nginx-domain1-rtr.entrypoints=https"
      - "traefik.http.routers.nginx-domain1-rtr.rule=Host(`$DOMAINNAME1`) || Host(`www.$DOMAINNAME1`)"
      # Redirect domain.com non-www to www middleware
      - "traefik.http.middlewares.domain-redirect.redirectregex.regex=^https?://$DOMAINNAME/(.*)"
      - "traefik.http.middlewares.domain-redirect.redirectregex.replacement=https://www.$DOMAINNAME/$${1}"
      - "traefik.http.middlewares.domain-redirect.redirectregex.permanent=true"
      # Redirect domain2.com non-www to www middleware
      - "traefik.http.middlewares.domain2-redirect.redirectregex.regex=^https?://$DOMAINNAME2/(.*)"
      - "traefik.http.middlewares.domain2-redirect.redirectregex.replacement=https://www.$DOMAINNAME2/$${1}"
      - "traefik.http.middlewares.domain2-redirect.redirectregex.permanent=true"
      # Redirect domain1.com non-www to www middleware
      - "traefik.http.middlewares.domain1-redirect.redirectregex.regex=^https?://$DOMAINNAME1/(.*)"
      - "traefik.http.middlewares.domain1-redirect.redirectregex.replacement=https://www.$DOMAINNAME1/$${1}"
      - "traefik.http.middlewares.domain1-redirect.redirectregex.permanent=true"
      ## Middlewares
      - "traefik.http.routers.nginx-domain1-rtr.middlewares=domain1-redirect,chain-no-auth@file"
      - "traefik.http.routers.nginx-domain-rtr.middlewares=domain-redirect,chain-no-auth@file"
      - "traefik.http.routers.nginx-domain-auth-rtr.middlewares=domain-redirect,chain-oauth@file"
      - "traefik.http.routers.nginx-domain2-rtr.middlewares=domain2-redirect,chain-no-auth@file"
      - "traefik.http.routers.nginx-domain2-auth-rtr.middlewares=domain2-redirect,chain-oauth@file"
      ## HTTP Services
      - "traefik.http.routers.nginx-domain-rtr.service=nginx-svc"
      - "traefik.http.routers.nginx-domain-auth-rtr.service=nginx-svc"
      - "traefik.http.routers.nginx-domain2-rtr.service=nginx-svc"
      - "traefik.http.routers.nginx-domain2-auth-rtr.service=nginx-svc"
      - "traefik.http.routers.nginx-domain1-rtr.service=nginx-svc"
      - "traefik.http.services.nginx-svc.loadbalancer.server.port=80"

domain2.conf

server {
    listen 80;
	server_name domain2.com;
	return 301 $scheme://www.domain2.com$request_uri;
}

server {
    listen 80;
    server_name www.domain2.com;

    root /var/www/html/domain2;
    index index.php;

    access_log off;
    #access_log /var/log/nginx/domain2-access.log;
    error_log /var/log/nginx/domain2-error.log;

    include common/wp-nfc-php7.conf;
    include common/wp-common-php7.conf;
    include common/wp-locations-php7.conf;
}

[robflate]

A follow up post. I have got a couple of workarounds to fix the above issues. Although these work, I'd still appreciate any working code or advice on how others are using OAuth on multiple domains. Thanks.

>> FIX OAUTH REDIRECT ERRORS

Previously, after a succesful OAuth login, I was redirected to https://domain2.com/_oauth rather than the URL I was requesting. For instance, going to https://domain2.com/wp-admin would redirect to https://domain2.com/_oauth after authentication.

The workaround is to add another OAuth container with the AUTH_HOST set to the new domain, i.e domain2.com and add another middleware specific to that domain.

Although this works, I'm sure it's not necessary to have multiple OAuth containers but I just don't know how to get it working with only 1.

>> FIX MIXED CONTENT ERRORS

To stop the errors that I had when HTML on domain2.com loads over a secure HTTPS connection I added the following to wp-config.php;

/* SSL Settings */
define('FORCE_SSL_ADMIN', true);
/* Turn HTTPS 'on' if HTTP_X_FORWARDED_PROTO matches 'https' */
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) {
    $_SERVER['HTTPS'] = 'on';
}

Although this works, I don't know why it is required when it's not needed on domain.com. Perhaps it's something specific to the content on the domain2.com Wordpress install?