denozord/auth-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

feat(reui): update ReUI components and documentation
Build and Push Auth Portal Docker Image / build-and-push (push) Successful in 2m30s
Details
Build and Push Auth Portal Docker Image / create-release (push) Skipped
Details

Browse Source 
- Added new OIDC configuration options in `.env.example`.
- Expanded documentation in `AGENTS.md` to include OIDC endpoints and admin UI.
- Updated ReUI skill version and component count from 17 to 20 across various documentation files.
- Enhanced `README.md` and other related files to reflect the new component structure and usage guidelines.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
Denozordec
2026-08-11 16:58:47 +07:00
co-authored by Cursor
parent cc38bf06f8
commit 0b6fa65b08
61 changed files with 2387 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deploy-traefik.md
+31 -3
View File
@@ -82,13 +82,25 @@ nano .env # заполнить секреты
| `JWT_SECRET` | HS256; тот же секрет в VPS Tracker / CFDM (`AUTH_JWT_SECRET`) |
| `ADMIN_PASSWORD` | Пароль bootstrap-админа (только при пустой БД) |
| `AUTH_DOMAIN` | Хост в Traefik rule, по умолчанию `auth.shnt.top` |
| `ISSUER` | `https://auth.shnt.top` — совпадает с `AUTH_ISSUER` приложений |
| `RETURN_TO_ALLOWLIST` | Origins SSO (например `.shnt.top`) |
| `ISSUER` | `https://auth.shnt.top` — совпадает с `AUTH_ISSUER` приложений **и** OIDC issuer |
| `RETURN_TO_ALLOWLIST` | Origins SSO / App Switcher (`.shnt.top`, `https://dns.shnt.top`, …) |
| `OIDC_ISSUER` | Опционально; если пусто — берётся `ISSUER`. Публичный URL IdP для Technitium |
| `OIDC_RSA_PRIVATE_KEY` | Опционально PKCS8 PEM; иначе RSA-ключ в SQLite (`./data`) |
Опционально: `AUTH_IMAGE_TAG`, `TRAEFIK_IMAGE_TAG`, `TRAEFIK_HTTP_PORT`, `TRAEFIK_HTTPS_PORT`.
В production cookie refresh с флагом `Secure` — нужен HTTPS.
### Проверка OIDC после старта
```bash
curl -fsS https://auth.shnt.top/.well-known/openid-configuration | head
curl -fsS https://auth.shnt.top/.well-known/jwks.json | head
```
Админка: `https://auth.shnt.top/admin/oidc` — создать client для Technitium.
Полная инструкция SSO: [integrate-technitium.md](integrate-technitium.md).
---
## 3. Запуск (один compose)
@@ -149,6 +161,8 @@ docker compose down
## Связка с приложениями
### JWT apps (CFDM / VPS / BGP / FW)
```env
AUTH_REQUIRED=true
AUTH_JWT_SECRET=<тот же JWT_SECRET>
@@ -163,9 +177,21 @@ VITE_AUTH_ENABLED=true
VITE_AUTH_PORTAL_URL=https://auth.shnt.top
```
См. [integrate-vps-tracker.md](integrate-vps-tracker.md), [integrate-cfdm.md](integrate-cfdm.md).
См. [integrate-vps-tracker.md](integrate-vps-tracker.md), [integrate-cfdm.md](integrate-cfdm.md), [integrate-evobgp.md](integrate-evobgp.md), [integrate-evofirewall.md](integrate-evofirewall.md).
Logout SSO: `https://auth.shnt.top/logout`.
### Technitium DNS (OIDC)
Portal — IdP; Technitium — RP. После `docker compose up`:
1. В `.env` добавьте origin DNS в `RETURN_TO_ALLOWLIST` (например `https://dns.shnt.top`).
2. `curl https://auth.shnt.top/.well-known/openid-configuration` — должен отвечать JSON.
3. Admin → OIDC-клиенты → redirect `https://dns.shnt.top/sso/callback`.
4. В Technitium SSO: Metadata = `https://auth.shnt.top/.well-known/openid-configuration`.
Важно: Technitium резолвит IdP **своим** DNS — A/AAAA для `auth.shnt.top` должна быть видна с DNS-сервера.
Детали: [integrate-technitium.md](integrate-technitium.md).
---
## Бэкап
@@ -194,6 +220,8 @@ docker run --rm -v auth_portal_traefik_letsencrypt:/data -v "$PWD:/backup" alpin
| Login OK, SSO в app падает | `JWT_SECRET` / `ISSUER` |
| `return_to` rejected | `RETURN_TO_ALLOWLIST` |
| Cookie не держится | HTTPS; `NODE_ENV=production` |
| Technitium «Failed to reach SSO provider» | A/AAAA `auth.*` в самом Technitium; `curl` с хоста DNS к discovery URL |
| OIDC discovery 404 | образ без OIDC; `ISSUER`/`OIDC_ISSUER` = публичный HTTPS URL; Traefik Host |
```bash
docker compose logs traefik 2>&1 | grep -iE 'acme|certificate|cloudflare|error'
docs/integrate-technitium.md
+97
View File
@@ -0,0 +1,97 @@
# Интеграция auth-portal ↔ Technitium DNS Server
App id: **`dns`**. Auth mode: **OIDC** (не JWT fragment).
Technitium DNS Server v15.2+ поддерживает SSO через OpenID Connect.
Ссылки: [Technitium DNS](https://technitium.com/dns/), [Authelia guide](https://www.authelia.com/integration/openid-connect/clients/technitium/), [Pocket ID](https://pocket-id.org/docs/client-examples/technitium-dns).
## Permissions (portal)
| Permission | OIDC group | Technitium Local Group |
|------------|------------|------------------------|
| `dns:console:admin` (или portal `is_admin`) | `technitium_admins` | Administrators |
| `dns:dns:write` | `technitium_dns_admins` | DNS Administrators |
| `dns:dhcp:write` | `technitium_dhcp_admins` | DHCP Administrators |
Claims `groups` и `roles` отдаются **в id_token и UserInfo**.
## Portal checklist
1. Admin → Пользователи: выдать app `dns` и нужные права
2. Admin → Ссылки приложений: URL Technitium (`https://dns.…`)
3. Admin → **OIDC-клиенты**: создать client
- Redirect URI: `https://<dns-host>/sso/callback`
- Scopes: `openid profile email groups`
4. Сохранить `client_id` / `client_secret` (секрет показывается один раз)
5. `RETURN_TO_ALLOWLIST` — origin Technitium (для App Switcher / аудита)
## Technitium SSO
1. Локальный admin (break-glass) оставить
2. Administration → Sessions → Single Sign-On (или SSO Providers)
3. Включить SSO:
| Field | Value |
|-------|--------|
| Metadata Address | `https://<auth-host>/.well-known/openid-configuration` |
| Authority / Issuer | `https://<auth-host>` (как в Admin → OIDC) |
| Client ID | из portal |
| Client Secret | из portal |
| Scopes | `openid profile email groups` |
| Allow Signup | Enabled |
| Allow Signup Only For Mapped Users | Enabled |
4. Group Map:
| Remote | Local |
|--------|-------|
| `technitium_admins` | Administrators |
| `technitium_dns_admins` | DNS Administrators |
| `technitium_dhcp_admins` | DHCP Administrators |
5. Save (web service перезапустится)
## DNS pitfall
Technitium резолвит back-channel OIDC (discovery / token / JWKS) **через свой DNS**, не через OS `/etc/hosts`.
Если `auth.*` только split-horizon — добавьте A/AAAA на Technitium и проверьте:
```bash
dig +short @127.0.0.1 auth.example.com
```
См. [Discussion #1988](https://github.com/TechnitiumSoftware/DnsServer/discussions/1988).
## Контейнер auth-portal (production)
OIDC поднимается вместе с приложением — отдельный контейнер не нужен.
| Env | Назначение |
|-----|------------|
| `ISSUER` / `OIDC_ISSUER` | Публичный HTTPS URL портала (`https://auth.shnt.top`) |
| `OIDC_RSA_PRIVATE_KEY` | Опционально; иначе ключ в SQLite volume `./data` |
| `RETURN_TO_ALLOWLIST` | Origin Technitium (`https://dns.shnt.top`) |
Traefik-стек: [deploy-traefik.md](deploy-traefik.md) · [`deploy/env.traefik.example`](../deploy/env.traefik.example) · [`deploy/docker-compose.traefik.yml`](../deploy/docker-compose.traefik.yml).
Локально:
```bash
docker compose up -d --build
curl -fsS http://localhost:8080/.well-known/openid-configuration | head
```
После деплоя: Admin → OIDC-клиенты → redirect `https://<dns-host>/sso/callback`.
## App Switcher
Для `dns` режим `authMode: oidc` — открывается базовый URL (кнопка OpenID Connect на логине Technitium), без `#access_token`.
## Endpoints portal (IdP)
- `GET /.well-known/openid-configuration`
- `GET /.well-known/jwks.json`
- `GET /oauth/authorize`
- `POST /oauth/token` (`client_secret_post` / `client_secret_basic`)
- `GET /oauth/userinfo`
docs/ui-design-contract.md
+1 -1
View File
@@ -3,7 +3,7 @@
Единый контракт ops-семейства (CFDM / vps / EvoBGP / EvoFirewall / **auth-portal**).
Surface: **ReUI Frame**. Иерархия: **ReUI PRO > shadcn primitives**.
Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks)
Карта: [docs](https://reui.io/docs) · [llms.txt](https://reui.io/llms.txt) · [Get Started](https://reui.io/docs/get-started) · [Styling](https://reui.io/docs/styling) · [Registry](https://reui.io/docs/registry) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks) · [MCP](https://reui.io/docs/mcp) · [Agent Skills](https://reui.io/docs/agent-skills)
Эталоны: [app-shell-12](https://reui.io/preview/base/app-shell-12) · [solution-users-1](https://reui.io/preview/base/solution-users-1) · [solution-users-6](https://reui.io/preview/base/solution-users-6) · [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2) · [empty-state-12](https://reui.io/preview/base/empty-state-12) · KPI [stats-12](https://reui.io/preview/base/stats-12)