jcoffey-dev
a24860ac2d
Local login is implemented, wired through api, alerting and web, and undiscoverable. No compose file turns it on, the Helm chart sets none of its variables, and no markdown in the repository mentions -seed-admin, LOCAL_AUTH_ENABLED or local login at all. The only way to find it is to read cmd/api/main.go's authorizer switch. Enabling it in docker-compose.yml is not the answer: a plain `docker compose up` has no authentication, and every Phase 0-3 runbook verifies the pipeline with bare curl against /query. Turning login on by default would break the project's own documented verification. So it's an opt-in overlay instead. Four settings have to agree, and only one of them is obviously about login. Each fails differently and none of the failures name the cause: the route 404s, or the browser refuses the request before sending it, or login returns 200 and every later request is anonymous because the cookie was never stored, or the same symptom again from the opposite end because the bundle never attaches it. That is what the new document is mostly for. The Helm chart still has no local-login support. Recorded in the document as a gap rather than papered over. Signed-off-by: John Coffey <[email protected]>
49 lines
2.1 KiB
YAML
49 lines
2.1 KiB
YAML
# Turns on local username/password login, which docker-compose.yml
|
|
# deliberately leaves off: a plain `docker compose up` has no
|
|
# authentication at all, and the Phase 0-3 runbooks' bare curls against
|
|
# /query depend on that staying true.
|
|
#
|
|
# Usage -- both commands need both -f flags:
|
|
#
|
|
# docker compose -f docker-compose.yml -f docker-compose.local-auth.yml up -d --build
|
|
# docker compose -f docker-compose.yml -f docker-compose.local-auth.yml run --rm api -seed-admin
|
|
#
|
|
# The second prints a generated password once. See /docs/local-login.md.
|
|
#
|
|
# The four settings below have to agree with each other, and three of
|
|
# the four are not obviously about login at all:
|
|
#
|
|
# LOCAL_AUTH_ENABLED registers /auth/* on api, and makes both
|
|
# api and alerting swap WithCORS for
|
|
# WithCredentialedCORS
|
|
# CORS_ALLOWED_ORIGIN must be a literal origin. The default is
|
|
# "*", and a browser categorically refuses
|
|
# to combine a credentialed fetch with a
|
|
# wildcard origin -- so leaving the default
|
|
# in place fails every request the moment
|
|
# the cookie starts being sent
|
|
# LOCAL_AUTH_COOKIE_SECURE the session cookie is Secure by default
|
|
# and would not be stored over
|
|
# http://localhost. Set it back to true for
|
|
# anything served over HTTPS
|
|
# VITE_LOCAL_AUTH_ENABLED a BUILD arg, so this needs --build, not a
|
|
# restart. Without it the bundle never
|
|
# sends credentials: 'include' and no
|
|
# request ever carries the session
|
|
services:
|
|
api:
|
|
environment:
|
|
LOCAL_AUTH_ENABLED: "true"
|
|
LOCAL_AUTH_COOKIE_SECURE: "false"
|
|
CORS_ALLOWED_ORIGIN: "http://localhost:3000"
|
|
|
|
alerting:
|
|
environment:
|
|
LOCAL_AUTH_ENABLED: "true"
|
|
CORS_ALLOWED_ORIGIN: "http://localhost:3000"
|
|
|
|
web:
|
|
build:
|
|
args:
|
|
VITE_LOCAL_AUTH_ENABLED: "true"
|