4f0107f1b2
Add a complete authentication and authorization system to Silo with three pluggable backends (local bcrypt, LDAP/FreeIPA, OIDC/Keycloak), session management, API token support, and role-based access control. Authentication backends: - Local: bcrypt (cost 12) password verification against users table - LDAP: FreeIPA simple bind with group-to-role mapping - OIDC: Keycloak redirect flow with realm role mapping - Backends are tried in order; users upserted to DB on first login Session and token management: - PostgreSQL-backed sessions via alexedwards/scs + pgxstore - Opaque API tokens (silo_ prefix, SHA-256 hashed, shown once) - 24h session lifetime, HttpOnly/SameSite=Lax/Secure cookies Role-based access control (admin > editor > viewer): - RequireAuth middleware: Bearer token -> session -> redirect/401 - RequireRole middleware: per-route-group minimum role enforcement - CSRF protection via justinas/nosurf on web forms, API exempt - CORS locked to configured origins when auth enabled Route restructuring: - Public: /health, /ready, /login, /auth/oidc, /auth/callback - Web (auth + CSRF): /, /projects, /schemas, /settings - API read (viewer): GET /api/** - API write (editor): POST/PUT/PATCH/DELETE /api/** User context wiring: - created_by/updated_by columns on items, projects, relationships - All create/update handlers populate tracking fields from context - CSV and BOM import handlers pass authenticated username - Revision creation tracks user across all code paths Default admin account: - Configurable via auth.local.default_admin_username/password - Env var overrides: SILO_ADMIN_USERNAME, SILO_ADMIN_PASSWORD - Idempotent: created on first startup, skipped if exists CLI and FreeCAD plugin: - silo token create/list/revoke subcommands (HTTP API client) - FreeCAD SiloClient sends Bearer token on all requests - Token read from ApiToken preference or SILO_API_TOKEN env var Web UI: - Login page (Catppuccin Mocha themed, OIDC button conditional) - Settings page with account info and API token management - User display name, role badge, and logout button in header - One-time token display banner with copy-to-clipboard Database (migration 009): - users table with role, auth_source, oidc_subject, password_hash - api_tokens table with SHA-256 hash, prefix, expiry, scopes - sessions table (scs pgxstore schema) - audit_log table (schema ready for future use) - created_by/updated_by ALTER on items, relationships, projects New dependencies: scs/v2, scs/pgxstore, go-oidc/v3, go-ldap/v3, justinas/nosurf, golang.org/x/oauth2
88 lines
2.4 KiB
YAML
88 lines
2.4 KiB
YAML
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
container_name: silo-postgres
|
|
environment:
|
|
POSTGRES_DB: silo
|
|
POSTGRES_USER: silo
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-silodev}
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
- ../migrations:/docker-entrypoint-initdb.d:ro
|
|
ports:
|
|
- "5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U silo -d silo"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- silo-network
|
|
|
|
minio:
|
|
image: minio/minio:RELEASE.2023-05-04T21-44-30Z
|
|
container_name: silo-minio
|
|
command: server /data --console-address ":9001"
|
|
environment:
|
|
MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-silominio}
|
|
MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-silominiosecret}
|
|
volumes:
|
|
- minio_data:/data
|
|
ports:
|
|
- "9000:9000"
|
|
- "9001:9001"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
networks:
|
|
- silo-network
|
|
|
|
silo:
|
|
build:
|
|
context: ..
|
|
dockerfile: build/package/Dockerfile
|
|
container_name: silo-api
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
minio:
|
|
condition: service_healthy
|
|
environment:
|
|
SILO_DB_HOST: postgres
|
|
SILO_DB_PORT: 5432
|
|
SILO_DB_NAME: silo
|
|
SILO_DB_USER: silo
|
|
SILO_DB_PASSWORD: ${POSTGRES_PASSWORD:-silodev}
|
|
SILO_MINIO_ENDPOINT: minio:9000
|
|
SILO_MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-silominio}
|
|
SILO_MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-silominiosecret}
|
|
SILO_MINIO_BUCKET: silo-files
|
|
SILO_MINIO_USE_SSL: "false"
|
|
SILO_SESSION_SECRET: ${SILO_SESSION_SECRET:-change-me-in-production}
|
|
SILO_OIDC_CLIENT_SECRET: ${SILO_OIDC_CLIENT_SECRET:-}
|
|
SILO_LDAP_BIND_PASSWORD: ${SILO_LDAP_BIND_PASSWORD:-}
|
|
SILO_ADMIN_USERNAME: ${SILO_ADMIN_USERNAME:-admin}
|
|
SILO_ADMIN_PASSWORD: ${SILO_ADMIN_PASSWORD:-}
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- ../schemas:/etc/silo/schemas:ro
|
|
- ../configs/config.yaml:/etc/silo/config.yaml:ro
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://localhost:8080/health"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
networks:
|
|
- silo-network
|
|
|
|
volumes:
|
|
postgres_data:
|
|
minio_data:
|
|
|
|
networks:
|
|
silo-network:
|
|
driver: bridge
|