e74439b509
When SSO_GATEWAY_SECRET is set and an incoming request carries both X-Artifacto-Gateway (matching the secret) and X-Authentik-Username, the admin middleware mints a session automatically so Authentik-authenticated users skip the password form. Missing or wrong gateway header falls back to the password-login flow, so peers that can reach the container directly (bypassing the reverse proxy) cannot spoof Authentik identities.
11 lines
522 B
Plaintext
11 lines
522 B
Plaintext
ADMIN_PASSWORD=change-me
|
|
SESSION_SECRET=generate-with-openssl-rand-hex-32
|
|
BASE_URL=https://artifacto.hubris.network
|
|
|
|
# Optional: when set, a reverse proxy forwarding Authentik headers can auto-login
|
|
# without the admin password. The proxy must inject `X-Artifacto-Gateway: <this
|
|
# value>` on every request it proxies; Artifacto rejects SSO headers from
|
|
# requests missing that header so peers that can reach the container directly
|
|
# can't spoof Authentik identities.
|
|
# SSO_GATEWAY_SECRET=generate-with-openssl-rand-hex-32
|