feat(reui): update ReUI components and documentation

- Added new OIDC configuration options in `.env.example`. - Expanded documentation in `AGENTS.md` to include OIDC endpoints and admin UI. - Updated ReUI skill version and component count from 17 to 20 across various documentation files. - Enhanced `README.md` and other related files to reflect the new component structure and usage guidelines. Co-authored-by: Cursor <[email protected]>
2026-08-11 16:58:47 +07:00
parent cc38bf06f8
commit 0b6fa65b08
61 changed files with 2387 additions and 103 deletions
@@ -0,0 +1,97 @@
+# Интеграция auth-portal ↔ Technitium DNS Server
+
+App id: **`dns`**. Auth mode: **OIDC** (не JWT fragment).
+
+Technitium DNS Server v15.2+ поддерживает SSO через OpenID Connect.
+Ссылки: [Technitium DNS](https://technitium.com/dns/), [Authelia guide](https://www.authelia.com/integration/openid-connect/clients/technitium/), [Pocket ID](https://pocket-id.org/docs/client-examples/technitium-dns).
+
+## Permissions (portal)
+
+| Permission | OIDC group | Technitium Local Group |
+|------------|------------|------------------------|
+| `dns:console:admin` (или portal `is_admin`) | `technitium_admins` | Administrators |
+| `dns:dns:write` | `technitium_dns_admins` | DNS Administrators |
+| `dns:dhcp:write` | `technitium_dhcp_admins` | DHCP Administrators |
+
+Claims `groups` и `roles` отдаются **в id_token и UserInfo**.
+
+## Portal checklist
+
+1. Admin → Пользователи: выдать app `dns` и нужные права
+2. Admin → Ссылки приложений: URL Technitium (`https://dns.…`)
+3. Admin → **OIDC-клиенты**: создать client
+   - Redirect URI: `https://<dns-host>/sso/callback`
+   - Scopes: `openid profile email groups`
+4. Сохранить `client_id` / `client_secret` (секрет показывается один раз)
+5. `RETURN_TO_ALLOWLIST` — origin Technitium (для App Switcher / аудита)
+
+## Technitium SSO
+
+1. Локальный admin (break-glass) оставить
+2. Administration → Sessions → Single Sign-On (или SSO Providers)
+3. Включить SSO:
+
+| Field | Value |
+|-------|--------|
+| Metadata Address | `https://<auth-host>/.well-known/openid-configuration` |
+| Authority / Issuer | `https://<auth-host>` (как в Admin → OIDC) |
+| Client ID | из portal |
+| Client Secret | из portal |
+| Scopes | `openid profile email groups` |
+| Allow Signup | Enabled |
+| Allow Signup Only For Mapped Users | Enabled |
+
+4. Group Map:
+
+| Remote | Local |
+|--------|-------|
+| `technitium_admins` | Administrators |
+| `technitium_dns_admins` | DNS Administrators |
+| `technitium_dhcp_admins` | DHCP Administrators |
+
+5. Save (web service перезапустится)
+
+## DNS pitfall
+
+Technitium резолвит back-channel OIDC (discovery / token / JWKS) **через свой DNS**, не через OS `/etc/hosts`.
+
+Если `auth.*` только split-horizon — добавьте A/AAAA на Technitium и проверьте:
+
+```bash
+dig +short @127.0.0.1 auth.example.com
+```
+
+См. [Discussion #1988](https://github.com/TechnitiumSoftware/DnsServer/discussions/1988).
+
+## Контейнер auth-portal (production)
+
+OIDC поднимается вместе с приложением — отдельный контейнер не нужен.
+
+| Env | Назначение |
+|-----|------------|
+| `ISSUER` / `OIDC_ISSUER` | Публичный HTTPS URL портала (`https://auth.shnt.top`) |
+| `OIDC_RSA_PRIVATE_KEY` | Опционально; иначе ключ в SQLite volume `./data` |
+| `RETURN_TO_ALLOWLIST` | Origin Technitium (`https://dns.shnt.top`) |
+
+Traefik-стек: [deploy-traefik.md](deploy-traefik.md) · [`deploy/env.traefik.example`](../deploy/env.traefik.example) · [`deploy/docker-compose.traefik.yml`](../deploy/docker-compose.traefik.yml).
+
+Локально:
+
+```bash
+docker compose up -d --build
+curl -fsS http://localhost:8080/.well-known/openid-configuration | head
+```
+
+После деплоя: Admin → OIDC-клиенты → redirect `https://<dns-host>/sso/callback`.
+
+## App Switcher
+
+Для `dns` режим `authMode: oidc` — открывается базовый URL (кнопка OpenID Connect на логине Technitium), без `#access_token`.
+
+## Endpoints portal (IdP)
+
+- `GET /.well-known/openid-configuration`
+- `GET /.well-known/jwks.json`
+- `GET /oauth/authorize`
+- `POST /oauth/token` (`client_secret_post` / `client_secret_basic`)
+- `GET /oauth/userinfo`