Zakaria
2db02ed369
- Key login throttling on the real peer address; read X-Forwarded-For only from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP limit across usernames so one attacker can no longer lock out the admin. - Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups when the ID token omits them. Redirect IdP and token errors to /login instead of returning 500s; cache discovery and JWKS. - Sweep expired sessions, attempts and pending OIDC requests every 60s, cap each map, and throttle OIDC sign-in starts per IP. - Fix the .ts import extension that broke the API type-check. - Add auth.test.ts and document the new settings.
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
# floci-api config (packages/api)
|
|
FLOCI_ENDPOINT=http://localhost:4566
|
|
FLOCI_AZURE_ENDPOINT=http://localhost:4577
|
|
FLOCI_AZURE_ACCOUNT_NAME=devstoreaccount1
|
|
FLOCI_AZURE_SUBSCRIPTION_ID=00000000-0000-0000-0000-000000000000
|
|
FLOCI_AZURE_RESOURCE_GROUP=floci-local
|
|
VITE_MOCK_MODE=false
|
|
AWS_REGION=us-east-1
|
|
AWS_ACCESS_KEY_ID=test
|
|
AWS_SECRET_ACCESS_KEY=test
|
|
PORT=4501
|
|
|
|
# Console authentication. Generate a hash with:
|
|
# cd packages/api && bun run scripts/hash-password.ts 'choose-a-long-password'
|
|
FLOCI_UI_ADMIN_USER=admin
|
|
FLOCI_UI_ADMIN_PASSWORD_HASH=
|
|
# At least 32 random characters, for example: openssl rand -base64 48
|
|
FLOCI_UI_SESSION_SECRET=
|
|
FLOCI_UI_SESSION_IDLE_TIMEOUT_SECONDS=1800
|
|
FLOCI_UI_SESSION_ABSOLUTE_TIMEOUT_SECONDS=28800
|
|
# Set false only for local HTTP development. Keep true behind HTTPS reverse proxies.
|
|
FLOCI_UI_SECURE_COOKIES=true
|
|
# Reverse proxies (IPs or CIDRs, comma-separated) allowed to report the client address
|
|
# via X-Forwarded-For. Required behind Nginx Proxy Manager, otherwise every visitor
|
|
# shares the proxy's address for sign-in throttling. Leave empty when exposed directly.
|
|
# FLOCI_UI_TRUSTED_PROXIES=192.168.1.10
|
|
|
|
# Optional Authentik / OIDC mode. These are server-only values.
|
|
# FLOCI_UI_AUTH_MODE=oidc
|
|
# FLOCI_UI_OIDC_ISSUER=https://authentik.example.com/application/o/the-cloud
|
|
# FLOCI_UI_OIDC_CLIENT_ID=
|
|
# FLOCI_UI_OIDC_CLIENT_SECRET=
|
|
# FLOCI_UI_PUBLIC_BASE_URL=https://thecloud.example.com
|
|
# OIDC mode refuses to start without an allow-list (comma-separated). Group names come
|
|
# from the `groups` claim; emails must also be verified by the identity provider.
|
|
# FLOCI_UI_OIDC_ALLOWED_GROUPS=thecloud-admins
|
|
# FLOCI_UI_OIDC_ALLOWED_EMAILS=
|
|
# FLOCI_UI_OIDC_ALLOW_ALL_USERS=false
|