xcally/jwt-proxy-validator repository overview

JWT Proxy Validator is a lightweight Node.js reverse proxy that validates JSON Web Tokens (JWT) before forwarding requests to Grafana (or other backends). It integrates seamlessly in containerized environments and supports:

Token extraction from Authorization header, cookies, or query parameters.

Role mapping and access control (Admin/User/Agent with customizable overrides).

Configurable Grafana subpath proxying.

Structured JSON logging via Pino, with service metadata and log rotation support.

Optional distributed tracing via OpenTelemetry for Tempo and observability stacks.

This service is designed for secure Grafana deployments where authentication and observability are managed consistently across microservices.

Supports runtime configuration via environment variables:

• XC_SESSION_SECRET (required): JWT secret.
• XC_GRAFANA_URL: Grafana target (default: http://xc-grafana:3000).
• XC_GRAFANA_SUBPATH: Proxy subpath (default: /xc-grafana).
• XC_RUN_USER / XC_RUN_GROUP: Runtime user/group (default: motion).
• PRIVILEGED_RUN_MODE: If true, runs as root (bypasses user setup).
• LOG_FILE: Path for logs (default: /app/logs/jwt-proxy-validator.log).