itguyeric/infra
1
0
Fork 0
Code Issues 28 Pull requests Projects 1 Releases Packages Wiki Activity Actions

Single sign-on #5

New issue
Open
opened 2026-08-13 15:50:48 +00:00 by itguyeric · 0 comments
itguyeric commented 2026-08-13 15:50:48 +00:00
Owner
Copy link

Right now access control is an nginx IP allowlist (lan-only.conf) in front of services that mostly have no authentication of their own. That is a reasonable stopgap and it is not a real answer: MeTube's POST /add is an unauthenticated remote-download trigger, and Pinchflat only has optional basic auth.

SSO in front of SWAG would retire the allowlist as the primary control and let LAN-only go back to being defence in depth rather than the whole defence.

Candidates: Authelia, Authentik, Tinyauth. The SWAG proxy-confs already ship commented include lines for all three, so wiring is cheap once something is chosen.

Right now access control is an nginx IP allowlist (`lan-only.conf`) in front of services that mostly have no authentication of their own. That is a reasonable stopgap and it is not a real answer: MeTube's `POST /add` is an unauthenticated remote-download trigger, and Pinchflat only has optional basic auth. SSO in front of SWAG would retire the allowlist as the primary control and let LAN-only go back to being defence in depth rather than the whole defence. Candidates: Authelia, Authentik, Tinyauth. The SWAG proxy-confs already ship commented include lines for all three, so wiring is cheap once something is chosen.
itguyeric added this to the Homelab project 2026-08-13 15:57:51 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
area/ci
Forgejo Actions, runners, Ansible, bootc images

  
area/media
Plex, arr stack, books, YouTube

  
area/network
OPNsense, DNS, Tailscale, SWAG

  
area/observability
Monitoring, alerting, logs

  
area/platform
New services and platform-level builds

  
area/security
Auth, secrets, access control

  
area/storage
NFS, LVM, disks, swap, backups

  
area/web
Hugo site, blog content

  
type/project
Multi-session effort, likely spawns tasks

  
type/task
Discrete piece of work with a clear done

No labels
area/ci
area/media
area/network
area/observability
area/platform
area/security
area/storage
area/web
type/project
type/task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Homelab
Assignees
Clear assignees
No assignees
itguyeric
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
itguyeric/infra#5
No description provided.