feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <[email protected]>

deploy/docker-compose.cdn-mm.yml

@@ -130,6 +130,10 @@ services:
       PORT: "8000"
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET in .env}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
     volumes:
       - ./data/mm:/app/data
     networks:

deploy/docker-compose.traefik-cdn.yml

@@ -29,6 +29,10 @@ services:
       PORT: "8000"
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET in .env}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
     volumes:
       - ./data:/app/data
     networks:

deploy/docker-compose.traefik.yml

@@ -67,6 +67,10 @@ services:
       PORT: "8000"
       DATABASE_PATH: /app/data/mikrotik.db
       CORS_ORIGIN: ${CORS_ORIGIN:-https://mm.shnt.top}
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-true}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET in .env}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
     volumes:
       - ./data:/app/data
     networks:

deploy/env.cdn-mm.example

@@ -29,7 +29,7 @@ CLOUDFLARE_API_TOKEN=
 LOG_LEVEL=info
 NODE_ENV=production
 
-# Portal SSO (prod default AUTH_REQUIRED=true)
+# Portal SSO — used by CDN Manager and MikrotikManager backend
 AUTH_REQUIRED=true
 # Same HS256 secret as auth-portal JWT_SECRET (required)
 AUTH_JWT_SECRET=
@@ -37,10 +37,10 @@ AUTH_JWT_SECRET=
 JWT_SECRET=
 AUTH_ISSUER=https://auth.shnt.top
 AUTH_PORTAL_URL=https://auth.shnt.top
-# Shared with auth-portal AUDIT_INGEST_SECRET (optional)
+# Shared with auth-portal AUDIT_INGEST_SECRET (optional, CDN Manager)
 AUTH_AUDIT_INGEST_SECRET=
 
-# Legacy local admin — only when AUTH_REQUIRED=false
+# Legacy local admin (CDN) — only when AUTH_REQUIRED=false
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD_HASH=
 

deploy/env.traefik.example

@@ -9,6 +9,12 @@ MM_DOMAIN=mm.shnt.top
 # Must match the public HTTPS origin of the UI (same as MM_DOMAIN with https://).
 CORS_ORIGIN=https://mm.shnt.top
 
+# --- Portal SSO (MM backend) ---
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+
 # --- Traefik / Let's Encrypt (only for docker-compose.traefik.yml standalone) ---
 # Not required when attaching to CDNManager Traefik (traefik-cdn / run-beside script).
 CF_DNS_API_TOKEN=

deploy/run-beside-cdn-traefik.sh

@@ -109,6 +109,10 @@ docker run -d \
   -e PORT=8000 \
   -e DATABASE_PATH=/app/data/mikrotik.db \
   -e "CORS_ORIGIN=${CORS_ORIGIN}" \
+  -e "AUTH_REQUIRED=${AUTH_REQUIRED:-true}" \
+  -e "AUTH_JWT_SECRET=${AUTH_JWT_SECRET:?set AUTH_JWT_SECRET}" \
+  -e "AUTH_ISSUER=${AUTH_ISSUER:-https://auth.shnt.top}" \
+  -e "AUTH_PORTAL_URL=${AUTH_PORTAL_URL:-https://auth.shnt.top}" \
   -v "${MM_ROOT}/data:/app/data" \
   --label mmapp.updater.managed=true \
   --label mmapp.updater.target=backend \