TL'DR
set a gibberish URL in nginx site definition that would bypass basic-auth to reverse-proxy
More details:
I have a setup with Grafana running on a VPS and an nginx reverse proxy directing towards it behind basic auth. The setup works fine but it's cumbersome to access it from mobile devices having to enter username and password all the time.
I was thinking about keeping the existing setup for regular access but also creating a URL that should not be easily guessed which would allow direct access to Grafana such that I should be able to bookmark the unprotected URL on the phone and access it without user/pw.
I read all the questions on this matter but I'm still required to enter user/pw so I may be doing something wrong.
My current setup, after reading all related questions looks like this:
server {
listen 80;
server_name grafana.some.tld;
auth_basic_user_file /etc/nginx/htpasswd.users;
location /q874gg#11CM2j/ {
auth_basic "off";
allow all;
proxy_redirect off;
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
location / {
auth_basic "Restricted Access";
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
Basically the 2 locations should be identical except for the auth_basic directive. What I presented above is the combined result of what I've read so far.
Probably there are some redirects that go outside my "hidden" location and hit the protected one?
Additional question: is this a good way to achieve unprotected access from mobile phone? I cannot use IP filtering as it's dynamic, also VPN is cumbersome for just a quick view to my dashboards.
Any help greatly appreciated!