kyleandClaude Opus 5.5
2fa9eea274
nginx now checks every dashboard and API request with oauth2-proxy (auth_request), which signs users in with Microsoft Entra ID. Who may sign in is controlled in Entra: a single-tenant app registration with "Assignment required", so only assigned users/groups get through. - deploy/oauth2-proxy.cfg (entra-id provider, auth-only mode, secure cookie, trusted proxy = localhost) and deploy/oauth2-proxy.service - nginx: pages redirect to Microsoft sign-in and back to the same URL; API calls get a plain 401 (the page already asks to reload); /api/v1/ingest stays key-only for collectors; /oauth2/auth is internal; the signed-in user is passed to the API in headers nginx sets (so browsers can't spoof them); dashboard files are served with Cache-Control: no-cache so updates show up at once - GET /api/v1/me; the top bar shows the signed-in user and a Sign out that also signs out of Microsoft (otherwise SSO signs straight back in) - README: Entra and server setup steps Tested locally with oauth2-proxy 7.15.5 and nginx 1.31 running the deploy configs (TLS, self-signed): redirects to the tenant's sign-in with the return URL kept, 401s, ingest bypass, sign-out allow-list, cookie flags, security headers. The signed-in path was tested with a stand-in for oauth2-proxy's auth answer; a real Entra sign-in wasn't. Co-Authored-By: Claude Opus 5.5 <[email protected]>
19 lines
994 B
JavaScript
19 lines
994 B
JavaScript
// Central runtime config. Kept as a static file so ops can change it without a build.
|
|
const params = new URLSearchParams(window.location.search);
|
|
|
|
export const CONFIG = Object.freeze({
|
|
apiBaseUrl: '/api/v1',
|
|
refreshIntervalMs: 60_000,
|
|
requestTimeoutMs: 15_000,
|
|
// A job whose next scheduled run is this far in the past is flagged "Overdue".
|
|
// Catches the silent failure mode: a job stops reporting and stays green forever.
|
|
overdueGraceMinutes: 30,
|
|
// Run history shown in the job modal (the API caps this at 30)
|
|
historyDays: 30,
|
|
// ?mock=1 → use in-browser sample data, no backend needed
|
|
useMock: params.has('mock'),
|
|
// oauth2-proxy clears the dashboard session, then hands over to Microsoft's sign-out page.
|
|
// Signing out of the dashboard alone would be undone at once: the browser's Microsoft session
|
|
// would sign it straight back in.
|
|
signOutUrl: '/oauth2/sign_out?rd=' + encodeURIComponent('https://login.microsoftonline.com/common/oauth2/v2.0/logout'),
|
|
}); |