30 lines
1.5 KiB
Markdown
30 lines
1.5 KiB
Markdown
# Authenticated external access
|
|
|
|
DockDeck has no built-in authentication. Keep its Compose bind on `127.0.0.1` or a trusted LAN address unless an authenticated HTTPS reverse proxy protects every route.
|
|
|
|
## Recommended topology
|
|
|
|
```text
|
|
Internet -> HTTPS reverse proxy -> Authentik forward auth -> DockDeck :1218
|
|
Trusted LAN -----------------------------------------------> DockDeck :1218
|
|
```
|
|
|
|
## Minimum requirements
|
|
|
|
1. Terminate TLS with a valid certificate.
|
|
2. Require authentication before proxying `/`, static assets and every `/api/*` route.
|
|
3. Do not create an unauthenticated exception for `/api/diagnostics`, integration settings or exports.
|
|
4. Preserve the original host and forwarding headers.
|
|
5. Restrict the upstream to `http://192.168.10.150:1218`; never publish the internal Docker socket proxy.
|
|
6. Use a separate minimum-scope account/token for each provider and protect `/data/integrations.env` backups.
|
|
|
|
## Validation checklist
|
|
|
|
- An incognito request is redirected to authentication before DockDeck HTML or API JSON is returned.
|
|
- A signed-in user can load the dashboard, search, edit a harmless presentation preference and read diagnostics.
|
|
- Signing out invalidates both page and API access.
|
|
- The browser reports HTTPS without mixed content.
|
|
- The reverse proxy does not cache `/api/*` responses.
|
|
|
|
Nginx Proxy Manager discovery in DockDeck remains read-only and does not create or change proxy hosts. Proxy and Authentik configuration therefore stay an explicit deployment responsibility.
|