dtoro/Artifacto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Auto-login from trusted reverse-proxy Authentik headers

Browse Source 
When SSO_GATEWAY_SECRET is set and an incoming request carries both
X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the
admin middleware mints a session automatically so Authentik-authenticated
users skip the password form. Missing or wrong gateway header falls back
to the password-login flow, so peers that can reach the container
directly (bypassing the reverse proxy) cannot spoof Authentik identities.
This commit is contained in:
claudio
2026-04-22 22:21:20 +02:00
parent c7d7ee287c
commit e74439b509
6 changed files with 63 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
.env.example
View File

@@ -1,3 +1,10 @@
ADMIN_PASSWORD=change-me
SESSION_SECRET=generate-with-openssl-rand-hex-32
BASE_URL=https://artifacto.hubris.network
# Optional: when set, a reverse proxy forwarding Authentik headers can auto-login
# without the admin password. The proxy must inject `X-Artifacto-Gateway: <this
# value>` on every request it proxies; Artifacto rejects SSO headers from
# requests missing that header so peers that can reach the container directly
# can't spoof Authentik identities.
# SSO_GATEWAY_SECRET=generate-with-openssl-rand-hex-32