Our Setup:

• We have nginx-proxy configured and working in our environment, including letsencrypt SSL cert generation.
• I now want to add authentication via oauth2-proxy service.
• We have the oauth2-proxy service configured and working successfully.
• The oauth2-proxy service is a virtual host under nginx-proxy called auth.braingeneers.gi.ucsc.edu.

We believe the best setup is to use the nginx auth_request directive to authorize requests through oauth2-proxy before proxying to the internal docker service.

However, when we define auth_request in /etc/nginx/vhost.d/default_location, it shows up in the server.location block after the dynamically generated proxy_pass directive, and is ignored. Here's what we see from nginx -T for a simple test web service whoami.

server {
    server_name whoami.braingeneers.gi.ucsc.edu;
    access_log /var/log/nginx/access.log vhost;
    http2 on;
    listen 443 ssl ;
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_certificate /etc/nginx/certs/whoami.braingeneers.gi.ucsc.edu.crt;
    ssl_certificate_key /etc/nginx/certs/whoami.braingeneers.gi.ucsc.edu.key;
    ssl_dhparam /etc/nginx/certs/whoami.braingeneers.gi.ucsc.edu.dhparam.pem;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/certs/whoami.braingeneers.gi.ucsc.edu.chain.pem;
    set $sts_header "";
    if ($https) {
        set $sts_header "max-age=31536000";
    }
    add_header Strict-Transport-Security $sts_header always;
    include /etc/nginx/vhost.d/default;
    location / {
        proxy_pass http://whoami.braingeneers.gi.ucsc.edu;
        set $upstream_keepalive false;
        include /etc/nginx/vhost.d/default_location;
    }
}

I notice that the include of default_location comes after proxy_pass, and when I configure this, no request is made to oauth2-proxy. I'm at least 80% certain that the proxy_pass directive is superseding the auth_request directive since nginx processes directives in order of appearance.

Are there any solutions here? Is there a way to reorder the dynamically generated location block perhaps?