nginx-example.conf

# Example of a subrequest auth protected directory.
location /protected {
    auth_request /login/validate;
    error_page 401 = @error401;

    location ~ \.php$ {
        include fastcgi.conf;
        fastcgi_pass php-handler;
    }
}

# IndieAuth authorization endpoint.
location =/auth/ {
    include fastcgi_params;
    fastcgi_pass php-handler;
    fastcgi_param SCRIPT_FILENAME /srv/indieauth/auth/auth.php;
}

# IndieAuth token endpoint.
location =/tokens/ {
    include fastcgi_params;
    fastcgi_pass php-handler;
    fastcgi_param SCRIPT_FILENAME /srv/indieauth/token/tokens.php;
}

# IndieAuth login page
location =/login/ {
    include fastcgi_params;
    fastcgi_pass php-handler;
    fastcgi_param SCRIPT_FILENAME /srv/indieauth/login/login.php;
}

# IndieAuth auth_request validation route.
location =/login/validate {
    internal;

    include fastcgi_params;
    fastcgi_pass php-handler;
    fastcgi_param SCRIPT_FILENAME /srv/indieauth/login/validate.php;
}

# Redirect all 401 errors to login page.
location @error401 {
    return 302 /login?url=$scheme://$http_host$request_uri;
}