Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update GeoIntel project files
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 0s
Details
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
Details
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Jens
2026-07-25 23:43:08 +02:00
parent 9db6cca2b1
commit d5ea270329
155 changed files with 37970 additions and 825 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/EXTERNAL_ACCESS.md
+29
View File
@@ -0,0 +1,29 @@
# Authenticated external access
DockDeck has no built-in authentication. Keep its Compose bind on `127.0.0.1` or a trusted LAN address unless an authenticated HTTPS reverse proxy protects every route.
## Recommended topology
```text
Internet -> HTTPS reverse proxy -> Authentik forward auth -> DockDeck :1218
Trusted LAN -----------------------------------------------> DockDeck :1218
```
## Minimum requirements
1. Terminate TLS with a valid certificate.
2. Require authentication before proxying `/`, static assets and every `/api/*` route.
3. Do not create an unauthenticated exception for `/api/diagnostics`, integration settings or exports.
4. Preserve the original host and forwarding headers.
5. Restrict the upstream to `http://192.168.10.150:1218`; never publish the internal Docker socket proxy.
6. Use a separate minimum-scope account/token for each provider and protect `/data/integrations.env` backups.
## Validation checklist
- An incognito request is redirected to authentication before DockDeck HTML or API JSON is returned.
- A signed-in user can load the dashboard, search, edit a harmless presentation preference and read diagnostics.
- Signing out invalidates both page and API access.
- The browser reports HTTPS without mixed content.
- The reverse proxy does not cache `/api/*` responses.
Nginx Proxy Manager discovery in DockDeck remains read-only and does not create or change proxy hosts. Proxy and Authentik configuration therefore stay an explicit deployment responsibility.