tom-smith-okta/nginx-oss-okta ? reverse-engineered prompt

Build me a Docker image for NGINX that forces users to sign in with Okta before they can reach the site.

I want it to work like a simple protected proxy, where NGINX checks for a valid OIDC id token, sends people to Okta if they are not logged in, then passes the request through once they authenticate. After login, it should add a few useful user details from the token into request headers and forward them to an upstream app that just shows the headers so I can see it working.

Please include a sample NGINX config and a Dockerfile that builds the whole thing, plus clear placeholders for the Okta discovery URL, client ID, client secret, and redirect URI. Make it easy to run locally with Docker on a port like 8126, and if needed, look up current docs online for the OIDC setup details.