Frank Schwenk
56edcd6fa8
Solo-admin setup; enrollment codes in config/notification.txt. Drop 0012 SMTP/secret files. Co-authored-by: Cursor <cursoragent@cursor.com>
113 lines
3.7 KiB
Markdown
113 lines
3.7 KiB
Markdown
# auth.schwenk.online — Authelia
|
|
|
|
SSO + TOTP (Google Authenticator / Aegis / …) vor Traefik auf **boka**.
|
|
|
|
**Repo:** `ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git`
|
|
|
|
## Consumer-Vertrag
|
|
|
|
Andere Projekte, die diese Instanz nutzen:
|
|
|
|
| Feld | Wert |
|
|
|------|------|
|
|
| Middleware-Referenz | `authelia@docker` |
|
|
| Portal-URL | `https://auth.schwenk.online` |
|
|
| Docker-Netz | externes Netz `traefik` |
|
|
| Session-Cookie-Domain | `schwenk.online` (deckt `*.schwenk.online` ab; entspr. „`.schwenk.online`“) |
|
|
| ACL (Beispiele) | `pi.schwenk.online` → `two_factor`; `whoami-auth.schwenk.online` → `two_factor`; Portal `bypass` |
|
|
| ForwardAuth-Pfad | `http://authelia:9091/api/authz/forward-auth` (nicht legacy `/api/verify`) |
|
|
|
|
### App schützen (Snippet)
|
|
|
|
App-Container am Netz `traefik`, plus Labels:
|
|
|
|
```yaml
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.docker.network=traefik
|
|
- traefik.http.routers.MYAPP.rule=Host(`myapp.schwenk.online`)
|
|
- traefik.http.routers.MYAPP.entrypoints=websecure
|
|
- traefik.http.routers.MYAPP.tls.certresolver=myresolver
|
|
- traefik.http.routers.MYAPP.middlewares=authelia@docker
|
|
```
|
|
|
|
Zusätzlich in diesem Repo unter `config/configuration.yml` → `access_control.rules` eine Regel für den Host (z.B. `two_factor`) eintragen und Authelia neu laden/`compose up -d`.
|
|
|
|
## Layout
|
|
|
|
| Pfad | Zweck |
|
|
|------|--------|
|
|
| `compose.yml` | Authelia, Redis, whoami-Smoke |
|
|
| `config/configuration.yml` | Authelia-Config (kein Secret-Inhalt) |
|
|
| `config/users_database.yml.example` | User-Template |
|
|
| `config/notification.txt` | Filesystem-Notifier-Ausgabe (gitignored, nur Server) |
|
|
| `secrets/` | `jwt_secret.txt`, `session_secret.txt`, `storage_encryption_key.txt` (nur auf dem Server) |
|
|
| `.env` | `TZ` (+ optional Log-Level) |
|
|
|
|
## Deploy (boka)
|
|
|
|
Voraussetzungen: DNS `auth.schwenk.online` (und optional `whoami-auth.schwenk.online`) → boka; Docker-Netz `traefik` existiert.
|
|
|
|
```bash
|
|
ssh frank-schwenk.de
|
|
git clone ssh://git@gitea.schwenk.online:2222/froxxxy/authschwenkonline.git /home/frank/auth.schwenk.online
|
|
cd /home/frank/auth.schwenk.online
|
|
cp .env.example .env
|
|
```
|
|
|
|
### Secrets erzeugen
|
|
|
|
```bash
|
|
mkdir -p secrets
|
|
chown 8000:8000 secrets && chmod 0700 secrets
|
|
docker run --rm -u 8000:8000 -v "$(pwd)/secrets:/secrets" authelia/authelia:4.39 \
|
|
sh -c 'cd /secrets && authelia crypto rand --length 64 \
|
|
session_secret.txt storage_encryption_key.txt jwt_secret.txt'
|
|
```
|
|
|
|
### User-DB
|
|
|
|
```bash
|
|
cp config/users_database.yml.example config/users_database.yml
|
|
docker run --rm authelia/authelia:4.39 \
|
|
authelia crypto hash generate argon2 --password 'YOUR_PASSWORD'
|
|
# Hash in users_database.yml bei frank.password einsetzen
|
|
# email: beliebig (Notifier schreibt lokal, kein SMTP)
|
|
```
|
|
|
|
### Start
|
|
|
|
```bash
|
|
docker compose up -d
|
|
docker compose logs -f authelia
|
|
```
|
|
|
|
## Notifier (filesystem)
|
|
|
|
Codes / Reset-Links landen in `config/notification.txt` auf dem Server:
|
|
|
|
```bash
|
|
ssh frank-schwenk.de
|
|
# config/ is often root-owned after first start:
|
|
docker run --rm -v /home/frank/auth.schwenk.online/config:/config:ro alpine cat /config/notification.txt
|
|
```
|
|
|
|
## TOTP-Enrollment
|
|
|
|
1. `https://auth.schwenk.online` öffnen, einloggen
|
|
2. Gerät registrieren → Code/Link aus `notification.txt` (siehe oben)
|
|
3. QR mit Google Authenticator (o.ä.) scannen
|
|
|
|
## Verify
|
|
|
|
1. Portal erreichbar: `https://auth.schwenk.online`
|
|
2. Smoke hinter 2FA: `https://whoami-auth.schwenk.online` → Login + TOTP → whoami-Body
|
|
3. `docker compose ps` — alle Services `running`
|
|
|
|
whoami nach dem Smoke optional aus `compose.yml` entfernen oder Router-Label deaktivieren.
|
|
|
|
## Explizit nicht
|
|
|
|
- Traefik / Gitea / Immich / Portainer in diesem Stack ändern
|
|
- Fremde App-Compose hier anfassen (nur ACL + Middleware-Vertrag)
|