Thoras Documentation

This guide describes how to front the Thoras dashboard with oauth2-proxy so that users must authenticate against an OIDC identity provider before reaching the dashboard.

How it works

oauth2-proxy runs as a sidecar container next to the Thoras dashboard container. Traffic hits oauth2-proxy first; it handles the OIDC login flow against your identity provider, then reverse-proxies authenticated requests to the dashboard’s local port.

User -> oauth2-proxy (:4180) -> IdP OIDC login -> Thoras Dashboard (:8080)

The Kubernetes secret, sidecar deploy/verify steps, and exposing the sidecar externally all work the same way regardless of which IdP you use — only the app registration and the --oidc-issuer-url differ. Pick your identity provider below for the exact steps:

Further reading