e74439b509
When SSO_GATEWAY_SECRET is set and an incoming request carries both X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the admin middleware mints a session automatically so Authentik-authenticated users skip the password form. Missing or wrong gateway header falls back to the password-login flow, so peers that can reach the container directly (bypassing the reverse proxy) cannot spoof Authentik identities.
18 lines
489 B
YAML
18 lines
489 B
YAML
name: artifacto
|
|
services:
|
|
artifacto:
|
|
build: .
|
|
image: artifacto:latest
|
|
container_name: artifacto
|
|
restart: unless-stopped
|
|
environment:
|
|
ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set in .env}
|
|
SESSION_SECRET: ${SESSION_SECRET:?set in .env}
|
|
BASE_URL: ${BASE_URL:-https://artifacto.hubris.network}
|
|
MAX_UPLOAD_MB: ${MAX_UPLOAD_MB:-5}
|
|
SSO_GATEWAY_SECRET: ${SSO_GATEWAY_SECRET:-}
|
|
volumes:
|
|
- ./data:/data
|
|
ports:
|
|
- "127.0.0.1:3100:3000"
|