docs: update TinyAuth v5 setup guide

[maposia]

No description provided.

[greptile-apps]

Greptile Summary

This PR rewrites the TinyAuth setup guide to cover the v5 release, which introduces a new TINYAUTH_-prefixed environment variable format, SQLite-backed sessions (replacing the SECRET env var), and a revised Nginx integration pattern using X-Tinyauth-Location for redirects.

• The Docker Compose example, user-creation commands, and all environment variable names are updated to v5 conventions, and a complete v4→v5 migration table with upgrade and rollback procedures is added.
• The Nginx configuration is restructured: the auth subrequest location is marked internal, X-Api-Key is explicitly cleared before proxying to the protected app, and redirect handling is delegated to the X-Tinyauth-Location response header rather than a hardcoded login URL.

Confidence Score: 4/5

Safe to merge; all findings are minor documentation polish issues that do not break the described setup.

The guide is accurate and the new Nginx and Compose configurations are functionally correct. The three findings are all improvement opportunities: keepalive connections to TinyAuth won't be reused without proxy_http_version 1.1 and proxy_set_header Connection empty string, an empty $tinyauth_location can cause a redirect loop if TinyAuth omits the header, and the base64 call in the curl example may produce a line-wrapped token on macOS.

docs/install/panel-security/tinyAuth-for-nginx.md — the Nginx configuration snippets in the Configuring Nginx section

Important Files Changed

Filename	Overview
docs/install/panel-security/tinyAuth-for-nginx.md	Rewrites the TinyAuth setup guide for v5: new env var names, v4→v5 migration table, upgrade/rollback procedure, keepalive upstream, internal auth subrequest, and X-Tinyauth-Location redirect pattern. Three minor issues: keepalive requires proxy_http_version 1.1 in the subrequest location, empty $tinyauth_location can cause a redirect loop, and base64 line-wrapping in the curl example.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Browser
    participant Nginx
    participant TinyAuth as TinyAuth (subrequest)
    participant App as Protected App

    Browser->>Nginx: GET /resource
    Nginx->>TinyAuth: "auth_request /tinyauth (internal)<br/>passes X-Api-Key, Authorization, X-Forwarded-*"
    alt Authenticated
        TinyAuth-->>Nginx: 200 OK
        Nginx->>App: proxy_pass (Authorization preserved, X-Api-Key cleared)
        App-->>Browser: 200 Response
    else Unauthenticated / Forbidden
        TinyAuth-->>Nginx: 401/403 + X-Tinyauth-Location header
        Nginx->>Nginx: auth_request_set $tinyauth_location
        Nginx-->>Browser: 302 → $tinyauth_location (login page)
        Browser->>Nginx: GET /login (tinyauth.example.com)
        Nginx->>TinyAuth: proxy_pass (login UI)
        TinyAuth-->>Browser: Login form
        Browser->>TinyAuth: POST credentials
        TinyAuth-->>Browser: Set-Cookie session + 302 → original URL
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Browser
    participant Nginx
    participant TinyAuth as TinyAuth (subrequest)
    participant App as Protected App

    Browser->>Nginx: GET /resource
    Nginx->>TinyAuth: "auth_request /tinyauth (internal)<br/>passes X-Api-Key, Authorization, X-Forwarded-*"
    alt Authenticated
        TinyAuth-->>Nginx: 200 OK
        Nginx->>App: proxy_pass (Authorization preserved, X-Api-Key cleared)
        App-->>Browser: 200 Response
    else Unauthenticated / Forbidden
        TinyAuth-->>Nginx: 401/403 + X-Tinyauth-Location header
        Nginx->>Nginx: auth_request_set $tinyauth_location
        Nginx-->>Browser: 302 → $tinyauth_location (login page)
        Browser->>Nginx: GET /login (tinyauth.example.com)
        Nginx->>TinyAuth: proxy_pass (login UI)
        TinyAuth-->>Browser: Login form
        Browser->>TinyAuth: POST credentials
        TinyAuth-->>Browser: Set-Cookie session + 302 → original URL
    end

Loading

_{Reviews (1): Last reviewed commit: "docs: update TinyAuth v5 setup guide" | Re-trigger Greptile}

[greptile-apps]

The keepalive 16 directive in the upstream block has no effect without proxy_http_version 1.1 and proxy_set_header Connection "" in the location block that proxies to it. Without these two directives, Nginx defaults to HTTP/1.0 for upstream requests, which always closes the connection after each request and never reuses the keepalive pool. As a result, every auth subrequest opens a fresh TCP connection to TinyAuth, making keepalive 16 a no-op.

Suggested change

	location = /tinyauth {
	internal;
	proxy_pass http://tinyauth/api/auth/nginx;
	proxy_pass_request_body off;
	proxy_set_header Content-Length "";
	location = /tinyauth {
	internal;
	proxy_pass http://tinyauth/api/auth/nginx;
	proxy_pass_request_body off;
	proxy_set_header Content-Length "";
	proxy_http_version 1.1;
	proxy_set_header Connection "";

[greptile-apps]

If TinyAuth returns a 401 or 403 without the X-Tinyauth-Location response header (e.g., on a backend error or misconfiguration), $tinyauth_location will be an empty string. Nginx interprets an empty redirect target as a redirect to /, which immediately triggers another auth subrequest that fails again, producing a redirect loop. Adding a fallback error_page for 5xx codes avoids this.

Suggested change

	auth_request /tinyauth;
	auth_request_set $tinyauth_location $upstream_http_x_tinyauth_location;
	error_page 401 403 =302 $tinyauth_location;
	auth_request /tinyauth;
	auth_request_set $tinyauth_location $upstream_http_x_tinyauth_location;
	error_page 401 403 =302 $tinyauth_location;
	# Fallback if TinyAuth does not return X-Tinyauth-Location.
	error_page 500 502 503 504 /50x.html;

[greptile-apps]

base64 on macOS (and some Linux defaults) wraps output at 76 characters. For credentials longer than ~55 bytes the encoded string will contain a newline, breaking the header value sent by curl. Using base64 | tr -d ' ' ensures a single-line output regardless of platform.

Suggested change

	curl https://panel.remnawave.com/api/example \
	-H "X-Api-Key: Basic $(printf 'username:password' | base64)" \
	-H "Authorization: Bearer application-token"
	curl https://panel.remnawave.com/api/example \
	-H "X-Api-Key: Basic $(printf 'username:password' | base64 | tr -d '\n')" \
	-H "Authorization: Bearer application-token"

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!