access.lua

if ngx.var.uri == "/_access_token" then
  ngx.exit(403)
end

local cjson = require "cjson"
local zlib = require "zlib"

local app_id = "xxx"
local app_secret = "xxx"
local app_team = "xxx"

local args = ngx.req.get_uri_args()

local access_token = ngx.var.cookie_SLACK_ACCESS_TOKEN
if access_token then
  ngx.header["Set-Cookie"] = "SLACK_ACCESS_TOKEN="..access_token.."; path=/"
end

if not access_token or args.code then
  if args.code then
    local res = ngx.location.capture("/_access_token?client_id="..app_id.."&client_secret="..app_secret.."&code="..args.code)

    local stream = zlib.inflate()
    local text = stream(res.body)

    if res.status ~=200 then
      ngx.status = res.status
      ngx.header.content_type = 'application/json';
      ngx.say(text)
      ngx.exit(ngx.HTTP_OK)
    end

    local json = cjson.decode(text)
    access_token = json.access_token
  end

  if not access_token then
    ngx.header["Set-Cookie"] = "REDIRECT_URL="..ngx.var.uri.."; path=/;Max-Age=120"
    return ngx.redirect("https://slack.com/oauth/authorize?client_id="..app_id.."&scope=identify&team="..app_team)
  end
end
ngx.header["Set-Cookie"] = "HAMARESI_SLACK_TOKEN="..access_token.."; path=/"

nginx.conf

upstream kibana-app {
  server localhost:8080;
}

server {
	listen 127.0.0.1:8080;

	server_name localhost;

	allow 127.0.0.1;
	deny all;

	location / {
		root /path/to/kibana;
		index index.html index.htm;
		try_files $uri $uri/ =404;
	}
}

server {
  listen	80 default_server;
  server_name	localhost;
  root		/path/to/kibana;
  charset	utf-8;
  gzip off;

  access_by_lua_file "/etc/nginx/access.lua";

  location /_access_token { proxy_pass https://slack.com/api/oauth.access; }

  location / {
    proxy_set_header X-READ-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect   off;
    proxy_max_temp_file_size 0;

    if (!-f $request_filename){
      proxy_pass http://kibana-app;
      break;
    }
  }
}