geointel/docs/EXTERNAL_ACCESS.md

Authenticated external access

DockDeck has no built-in authentication. Keep its Compose bind on 127.0.0.1 or a trusted LAN address unless an authenticated HTTPS reverse proxy protects every route.

Recommended topology

Internet -> HTTPS reverse proxy -> Authentik forward auth -> DockDeck :1218
Trusted LAN -----------------------------------------------> DockDeck :1218

Minimum requirements

1. Terminate TLS with a valid certificate.
2. Require authentication before proxying /, static assets and every /api/* route.
3. Do not create an unauthenticated exception for /api/diagnostics, integration settings or exports.
4. Preserve the original host and forwarding headers.
5. Restrict the upstream to http://192.168.10.150:1218; never publish the internal Docker socket proxy.
6. Use a separate minimum-scope account/token for each provider and protect /data/integrations.env backups.

Validation checklist

• An incognito request is redirected to authentication before DockDeck HTML or API JSON is returned.
• A signed-in user can load the dashboard, search, edit a harmless presentation preference and read diagnostics.
• Signing out invalidates both page and API access.
• The browser reports HTTPS without mixed content.
• The reverse proxy does not cache /api/* responses.

Nginx Proxy Manager discovery in DockDeck remains read-only and does not create or change proxy hosts. Proxy and Authentik configuration therefore stay an explicit deployment responsibility.