Merge pull request #2 from NotAlexNoyle/main

Shorter reverse proxy steps

README.md

@@ -15,13 +15,6 @@ Copy [application.yml.example](application.yml.example), rename it to whatever y
 Run the server binary with `--initialSetup.adminUuid=your-uuid-here`.
 
 ## Reverse proxy
-If Staff-Auth runs behind a reverse proxy:
-
-- Set `micronaut.server.client-address-header` (e.g. `X-Forwarded-For`) and make the proxy overwrite that header; the
-  Minecraft IP check reads the client address through Micronaut's `HttpClientAddressResolver`.
-- Set `micronaut.server.host-resolution.protocol-header: X-Forwarded-Proto` (and `host-header: Host`) so the OAuth
-  `redirect_uri` sent to Hydra uses the public `https://` origin instead of the backend's address.
-- Do **not** use `micronaut.server.context-path` to mount the API under a prefix: Micronaut Security registers the
-  `/oauth/login/{provider}` and `/oauth/callback/{provider}` routes programmatically and they ignore the context path
-  (404). Strip the prefix in the proxy instead (nginx: `location /api/ { proxy_pass http://127.0.0.1:8081/; }`) and
-  proxy `/oauth/` to Staff-Auth as well, since the callback URL Micronaut builds has no prefix.
+- Set `micronaut.server.client-address-header` (e.g. `X-Forwarded-For`) and have the proxy overwrite it. The Minecraft IP check uses it.
+- Set `micronaut.server.host-resolution.protocol-header: X-Forwarded-Proto` so the OAuth `redirect_uri` is `https://`.
+- Don't use `micronaut.server.context-path`, the OAuth login/callback routes ignore it. Strip the prefix in the proxy instead and also proxy `/oauth/` to Staff-Auth.