jnd/beszel-ipv6
1
0
Fork 0
mirror of https://github.com/henrygd/beszel.git synced 2025-12-17 10:46:16 +01:00
Code Issues Packages Projects Releases 2 Wiki Activity

Add MFA_OTP env var to enable email-based one-time password for users and/or superusers

Browse Source
This commit is contained in:
henrygd
2025-10-20 14:29:56 -04:00
parent 03900e54cc
commit a87b9af9d5
2 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
internal/hub/hub.go
View File

@@ -120,7 +120,19 @@ func (h *Hub) initialize(e *core.ServeEvent) error {
return err return err
} }
// set auth settings // set auth settings
usersCollection, err := e.App.FindCollectionByNameOrId("users") if err := setCollectionAuthSettings(e.App); err != nil {
return err
}
return nil
}
// setCollectionAuthSettings sets up default authentication settings for the app
func setCollectionAuthSettings(app core.App) error {
usersCollection, err := app.FindCollectionByNameOrId("users")
if err != nil {
return err
}
superusersCollection, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
if err != nil { if err != nil {
return err return err
} }
@@ -128,10 +140,6 @@ func (h *Hub) initialize(e *core.ServeEvent) error {
disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH") disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH")
usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true" usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
usersCollection.PasswordAuth.IdentityFields = []string{"email"} usersCollection.PasswordAuth.IdentityFields = []string{"email"}
// disable oauth if no providers are configured (todo: remove this in post 0.9.0 release)
if usersCollection.OAuth2.Enabled {
usersCollection.OAuth2.Enabled = len(usersCollection.OAuth2.Providers) > 0
}
// allow oauth user creation if USER_CREATION is set // allow oauth user creation if USER_CREATION is set
if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" { if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" {
cr := "@request.context = 'oauth2'" cr := "@request.context = 'oauth2'"
@@ -139,11 +147,22 @@ func (h *Hub) initialize(e *core.ServeEvent) error {
} else { } else {
usersCollection.CreateRule = nil usersCollection.CreateRule = nil
} }
if err := e.App.Save(usersCollection); err != nil { // enable mfaOtp mfa if MFA_OTP env var is set
mfaOtp, _ := GetEnv("MFA_OTP")
usersCollection.OTP.Length = 6
superusersCollection.OTP.Length = 6
usersCollection.OTP.Enabled = mfaOtp == "true"
usersCollection.MFA.Enabled = mfaOtp == "true"
superusersCollection.OTP.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
superusersCollection.MFA.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
if err := app.Save(superusersCollection); err != nil {
return err
}
if err := app.Save(usersCollection); err != nil {
return err return err
} }
// allow all users to access systems if SHARE_ALL_SYSTEMS is set // allow all users to access systems if SHARE_ALL_SYSTEMS is set
systemsCollection, err := e.App.FindCachedCollectionByNameOrId("systems") systemsCollection, err := app.FindCollectionByNameOrId("systems")
if err != nil { if err != nil {
return err return err
} }
@@ -158,10 +177,7 @@ func (h *Hub) initialize(e *core.ServeEvent) error {
systemsCollection.ViewRule = &systemsReadRule systemsCollection.ViewRule = &systemsReadRule
systemsCollection.UpdateRule = &updateDeleteRule systemsCollection.UpdateRule = &updateDeleteRule
systemsCollection.DeleteRule = &updateDeleteRule systemsCollection.DeleteRule = &updateDeleteRule
if err := e.App.Save(systemsCollection); err != nil { return app.Save(systemsCollection)
return err
}
return nil
} }
// registerCronJobs sets up scheduled tasks // registerCronJobs sets up scheduled tasks

4
supplemental/CHANGELOG.md
View File

@@ -1,3 +1,7 @@
## 0.14.1
- Add `MFA_OTP` environment variable to enable email-based one-time password for users and/or superusers.
## 0.14.0 ## 0.14.0
- Add `/containers` page for viewing current status of all running containers. (#928) - Add `/containers` page for viewing current status of all running containers. (#928)