kyleandClaude Opus 5.5
2fa9eea274
nginx now checks every dashboard and API request with oauth2-proxy (auth_request), which signs users in with Microsoft Entra ID. Who may sign in is controlled in Entra: a single-tenant app registration with "Assignment required", so only assigned users/groups get through. - deploy/oauth2-proxy.cfg (entra-id provider, auth-only mode, secure cookie, trusted proxy = localhost) and deploy/oauth2-proxy.service - nginx: pages redirect to Microsoft sign-in and back to the same URL; API calls get a plain 401 (the page already asks to reload); /api/v1/ingest stays key-only for collectors; /oauth2/auth is internal; the signed-in user is passed to the API in headers nginx sets (so browsers can't spoof them); dashboard files are served with Cache-Control: no-cache so updates show up at once - GET /api/v1/me; the top bar shows the signed-in user and a Sign out that also signs out of Microsoft (otherwise SSO signs straight back in) - README: Entra and server setup steps Tested locally with oauth2-proxy 7.15.5 and nginx 1.31 running the deploy configs (TLS, self-signed): redirects to the tenant's sign-in with the return URL kept, 401s, ingest bypass, sign-out allow-list, cookie flags, security headers. The signed-in path was tested with a stand-in for oauth2-proxy's auth answer; a real Entra sign-in wasn't. Co-Authored-By: Claude Opus 5.5 <[email protected]>
90 lines
4.2 KiB
HTML
90 lines
4.2 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||
<title>Backup Monitor</title>
|
||
<link rel="stylesheet" href="/css/styles.css">
|
||
<!-- type="module" is deferred by default; no inline JS so a strict CSP works -->
|
||
<script type="module" src="/js/app.js"></script>
|
||
</head>
|
||
<body>
|
||
<header class="topbar">
|
||
<h1 class="topbar__title">Backup Monitor</h1>
|
||
<div class="topbar__meta">
|
||
<span id="last-updated" class="muted" aria-live="polite">Loading…</span>
|
||
<button id="refresh-btn" class="btn" type="button">Refresh</button>
|
||
<!-- Filled in from /api/v1/me when signed in with Microsoft 365 -->
|
||
<span id="signed-in" class="topbar__user" hidden>
|
||
<span id="signed-in-email" class="muted"></span>
|
||
<a id="sign-out" class="btn" href="#">Sign out</a>
|
||
</span>
|
||
</div>
|
||
</header>
|
||
|
||
<main class="container">
|
||
<div id="error-banner" class="banner banner--error" role="alert" hidden></div>
|
||
|
||
<!-- Summary cards double as status filters -->
|
||
<section class="summary" aria-label="Status summary and filters">
|
||
<button type="button" class="summary-card" data-filter="all" aria-pressed="true">
|
||
<span class="summary-card__count" data-count="all">–</span>
|
||
<span class="summary-card__label">All jobs</span>
|
||
</button>
|
||
<button type="button" class="summary-card summary-card--failed" data-filter="failed" aria-pressed="false">
|
||
<span class="summary-card__count" data-count="failed">–</span>
|
||
<span class="summary-card__label">Failed</span>
|
||
</button>
|
||
<button type="button" class="summary-card summary-card--warning" data-filter="warning" aria-pressed="false">
|
||
<span class="summary-card__count" data-count="warning">–</span>
|
||
<span class="summary-card__label">Warning</span>
|
||
</button>
|
||
<button type="button" class="summary-card summary-card--running" data-filter="running" aria-pressed="false">
|
||
<span class="summary-card__count" data-count="running">–</span>
|
||
<span class="summary-card__label">Running</span>
|
||
</button>
|
||
<button type="button" class="summary-card summary-card--success" data-filter="success" aria-pressed="false">
|
||
<span class="summary-card__count" data-count="success">–</span>
|
||
<span class="summary-card__label">Success</span>
|
||
</button>
|
||
<button type="button" class="summary-card summary-card--overdue" data-filter="overdue" aria-pressed="false">
|
||
<span class="summary-card__count" data-count="overdue">–</span>
|
||
<span class="summary-card__label">Overdue</span>
|
||
</button>
|
||
</section>
|
||
|
||
<div class="toolbar">
|
||
<label for="search" class="visually-hidden">Search jobs</label>
|
||
<input id="search" class="input" type="search" placeholder="Search company or job…" autocomplete="off">
|
||
</div>
|
||
|
||
<div class="table-wrap">
|
||
<table class="jobs">
|
||
<thead>
|
||
<tr>
|
||
<th scope="col" aria-sort="none"><button type="button" class="sort" data-sort="company">Company</button></th>
|
||
<th scope="col" aria-sort="none"><button type="button" class="sort" data-sort="name">Backup Job</button></th>
|
||
<th scope="col" aria-sort="ascending"><button type="button" class="sort" data-sort="status">Status</button></th>
|
||
<th scope="col" aria-sort="none"><button type="button" class="sort" data-sort="lastRun">Last Run</button></th>
|
||
<th scope="col" aria-sort="none"><button type="button" class="sort" data-sort="nextRun">Next Scheduled</button></th>
|
||
</tr>
|
||
</thead>
|
||
<tbody id="jobs-body"></tbody>
|
||
</table>
|
||
<p id="empty-state" class="empty" hidden>No backup jobs match the current filter.</p>
|
||
</div>
|
||
</main>
|
||
|
||
<!-- Native <dialog>: built-in focus trap, Esc-to-close, and top-layer rendering -->
|
||
<dialog id="detail-dialog" class="modal" aria-labelledby="detail-title">
|
||
<div class="modal__header">
|
||
<div>
|
||
<h2 id="detail-title" class="modal__title"></h2>
|
||
<p id="detail-subtitle" class="muted"></p>
|
||
</div>
|
||
<button type="button" class="btn btn--icon" data-close aria-label="Close">✕</button>
|
||
</div>
|
||
<div id="detail-body" class="modal__body"></div>
|
||
</dialog>
|
||
</body>
|
||
</html> |