From 44d491dc60bbaabe664220d966e8e706a068741c Mon Sep 17 00:00:00 2001 From: Toni <25488000+sinipelto@users.noreply.github.com> Date: Thu, 18 Jul 2024 12:37:41 +0300 Subject: [PATCH 1/3] Create settings.env Separate environment variables in own file. --- docker/settings.env | 168 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 168 insertions(+) create mode 100644 docker/settings.env diff --git a/docker/settings.env b/docker/settings.env new file mode 100644 index 00000000..dc44854d --- /dev/null +++ b/docker/settings.env @@ -0,0 +1,168 @@ +# You can change the name of the app +APP_NAME=2FAuth + +# You can leave this on "local". If you change it to production most console commands will ask for extra confirmation. +# Never set it to "testing". +APP_ENV=local + +# The timezone for your application, which is used to record dates and times to database. This global setting can be +# overridden by users via in-app settings for a personalised dates and times display. +# If this setting is changed while the application is already running, existing records in the database won't be updated +APP_TIMEZONE=UTC + +# Set to true if you want to see debug information in error screens. +APP_DEBUG=false + +# This should be your email address +SITE_OWNER=mail@example.com + +# The encryption key for our database and sessions. Keep this very secure. +# If you generate a new one all existing data must be considered LOST. +# Change it to a string of exactly 32 chars or use command `php artisan key:generate` to generate it +APP_KEY=SomeRandomStringOf32CharsExactly + +# This variable must match your installation's external address. +# Webauthn won't work otherwise. +APP_URL=http://localhost + +# If you want to serve js assets from a CDN (like https://cdn.example.com), +# uncomment the following line and set this var with the CDN url. +# Otherwise, let this line commented. +# ASSET_URL=http://localhost + +# Turn this to true if you want your app to react like a demo. +# The Demo mode reset the app content every hours and set a generic demo user. +IS_DEMO_APP=false + +# The log channel defines where your log entries go to. +# 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/. +# Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel +# to combine multiple channels into a single one. +LOG_CHANNEL=daily + +# Log level. You can set this from least severe to most severe: +# debug, info, notice, warning, error, critical, alert, emergency +# If you set it to debug your logs will grow large, and fast. If you set it to emergency probably +# nothing will get logged, ever. +LOG_LEVEL=notice + +# Database config (can only be sqlite) +DB_DATABASE="/srv/database/database.sqlite" + +# If you're looking for performance improvements, you could install memcached. +CACHE_DRIVER=file +SESSION_DRIVER=file + +# Mail settings +# Refer your email provider documentation to configure your mail settings +# Set a value for every available setting to avoid issue +MAIL_MAILER=log +MAIL_HOST=smtp.mailtrap.io +MAIL_PORT=2525 +MAIL_USERNAME=null +MAIL_PASSWORD=null +MAIL_ENCRYPTION=null +MAIL_FROM_NAME=null +MAIL_FROM_ADDRESS=null + +# SSL peer verification. +# Set this to false to disable the SSL certificate validation. +# WARNING +# Disabling peer verification can result in a major security flaw. +# Change it only if you know what you're doing. +MAIL_VERIFY_SSL_PEER=true + +# API settings +# The maximum number of API calls in a minute from the same IP. +# Once reached, all requests from this IP will be rejected until the minute has elapsed. +# Set to null to disable the API throttling. +THROTTLE_API=60 + +# Authentication settings +# The number of times per minute a user can fail to log in before being locked out. +# Once reached, all login attempts will be rejected until the minute has elapsed. +# This setting applies to both email/password and webauthn login attemps. +LOGIN_THROTTLE=5 + +# The default authentication guard +# Supported: +# 'web-guard' : The Laravel built-in auth system (default if nulled) +# 'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication +# WARNING +# When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in +# authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will +# trust him as long as headers are presents. +AUTHENTICATION_GUARD=web-guard + +# Authentication log retention time, in days. +# Log entries older than that are automatically deleted. +AUTHENTICATION_LOG_RETENTION=365 + +# Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. +# Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) +# (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard') +AUTH_PROXY_HEADER_FOR_USER=null +AUTH_PROXY_HEADER_FOR_EMAIL=null + +# Custom logout URL to open when using an auth proxy. +PROXY_LOGOUT_URL=null + +# WebAuthn settings +# Relying Party name, aka the name of the application. If blank, defaults to APP_NAME. Do not set to null. +WEBAUTHN_NAME=2FAuth + +# Relying Party ID, should equal the site domain (i.e 2fauth.example.com). +# If null, the device will fill it internally (recommended) +# See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id +WEBAUTHN_ID=null + +# Use this setting to control how user verification behave during the +# WebAuthn authentication flow. +# +# Most authenticators and smartphones will ask the user to actively verify +# themselves for log in. For example, through a touch plus pin code, +# password entry, or biometric recognition (e.g., presenting a fingerprint). +# The intent is to distinguish one user from any other. +# +# Supported: +# 'required': Will ALWAYS ask for user verification +# 'preferred' (default) : Will ask for user verification IF POSSIBLE +# 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow) +WEBAUTHN_USER_VERIFICATION=preferred + +#### SSO settings (for Socialite) #### +# Uncomment and complete lines for the OAuth providers you want to enable. +# OPENID_AUTHORIZE_URL= +# OPENID_TOKEN_URL= +# OPENID_USERINFO_URL= +# OPENID_CLIENT_ID= +# OPENID_CLIENT_SECRET= +# GITHUB_CLIENT_ID= +# GITHUB_CLIENT_SECRET= + +# Use this setting to declare trusted proxied. +# Supported: +# '*': to trust any proxy +# A comma separated IP list: The list of proxies IP to trust +TRUSTED_PROXIES=null + +# Proxy for outgoing requests like new releases detection or logo fetching. +# You can provide a proxy URL that contains a scheme, username, and password. +# For example, "http://username:password@192.168.16.1:10". +PROXY_FOR_OUTGOING_REQUESTS=null + +# Leave the following configuration vars as is. +# Unless you like to tinker and know what you're doing. +BROADCAST_DRIVER=log +QUEUE_DRIVER=sync +SESSION_LIFETIME=120 +REDIS_HOST=127.0.0.1 +REDIS_PASSWORD=null +REDIS_PORT=6379 +PUSHER_APP_ID= +PUSHER_APP_KEY= +PUSHER_APP_SECRET= +PUSHER_APP_CLUSTER=mt1 +VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}" +VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}" +MIX_ENV=local From 73289ce7de483ec2cf66b33a1f66d54928c41584 Mon Sep 17 00:00:00 2001 From: Toni <25488000+sinipelto@users.noreply.github.com> Date: Thu, 18 Jul 2024 12:40:02 +0300 Subject: [PATCH 2/3] Update docker-compose.yml Read env vars from a separate file --- docker/docker-compose.yml | 146 +------------------------------------- 1 file changed, 2 insertions(+), 144 deletions(-) diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index add51ac2..0d2ca96a 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -1,152 +1,10 @@ version: "3" services: 2fauth: - image: 2fauth/2fauth + env_file: settings.env + image: 2fauth/2fauth:${TAG:-latest} container_name: 2fauth volumes: - ./2fauth:/2fauth ports: - 8000:8000/tcp - environment: - # You can change the name of the app - - APP_NAME=2FAuth - # You can leave this on "local". If you change it to production most console commands will ask for extra confirmation. - # Never set it to "testing". - - APP_ENV=local - # The timezone for your application, which is used to record dates and times to database. This global setting can be - # overridden by users via in-app settings for a personalised dates and times display. - # If this setting is changed while the application is already running, existing records in the database won't be updated - - APP_TIMEZONE=UTC - # Set to true if you want to see debug information in error screens. - - APP_DEBUG=false - # This should be your email address - - SITE_OWNER=mail@example.com - # The encryption key for our database and sessions. Keep this very secure. - # If you generate a new one all existing data must be considered LOST. - # Change it to a string of exactly 32 chars or use command `php artisan key:generate` to generate it - - APP_KEY=SomeRandomStringOf32CharsExactly - # This variable must match your installation's external address. - # Webauthn won't work otherwise. - - APP_URL=http://localhost - # If you want to serve js assets from a CDN (like https://cdn.example.com), - # uncomment the following line and set this var with the CDN url. - # Otherwise, let this line commented. - # - ASSET_URL=http://localhost - # - # Turn this to true if you want your app to react like a demo. - # The Demo mode reset the app content every hours and set a generic demo user. - - IS_DEMO_APP=false - # The log channel defines where your log entries go to. - # 'daily' is the default logging mode giving you 7 daily rotated log files in /storage/logs/. - # Also available are 'errorlog', 'syslog', 'stderr', 'papertrail', 'slack' and a 'stack' channel - # to combine multiple channels into a single one. - - LOG_CHANNEL=daily - # Log level. You can set this from least severe to most severe: - # debug, info, notice, warning, error, critical, alert, emergency - # If you set it to debug your logs will grow large, and fast. If you set it to emergency probably - # nothing will get logged, ever. - - LOG_LEVEL=notice - # Database config (can only be sqlite) - - DB_DATABASE="/srv/database/database.sqlite" - # If you're looking for performance improvements, you could install memcached. - - CACHE_DRIVER=file - - SESSION_DRIVER=file - # Mail settings - # Refer your email provider documentation to configure your mail settings - # Set a value for every available setting to avoid issue - - MAIL_MAILER=log - - MAIL_HOST=smtp.mailtrap.io - - MAIL_PORT=2525 - - MAIL_USERNAME=null - - MAIL_PASSWORD=null - - MAIL_ENCRYPTION=null - - MAIL_FROM_NAME=null - - MAIL_FROM_ADDRESS=null - # SSL peer verification. - # Set this to false to disable the SSL certificate validation. - # WARNING - # Disabling peer verification can result in a major security flaw. - # Change it only if you know what you're doing. - - MAIL_VERIFY_SSL_PEER=true - # API settings - # The maximum number of API calls in a minute from the same IP. - # Once reached, all requests from this IP will be rejected until the minute has elapsed. - # Set to null to disable the API throttling. - - THROTTLE_API=60 - # Authentication settings - # The number of times per minute a user can fail to log in before being locked out. - # Once reached, all login attempts will be rejected until the minute has elapsed. - # This setting applies to both email/password and webauthn login attemps. - - LOGIN_THROTTLE=5 - # The default authentication guard - # Supported: - # 'web-guard' : The Laravel built-in auth system (default if nulled) - # 'reverse-proxy-guard' : When 2FAuth is deployed behind a reverse-proxy that handle authentication - # WARNING - # When using 'reverse-proxy-guard' 2FAuth only look for the dedicated headers and skip all other built-in - # authentication checks. That means your proxy is fully responsible of the authentication process, 2FAuth will - # trust him as long as headers are presents. - - AUTHENTICATION_GUARD=web-guard - # Authentication log retention time, in days. - # Log entries older than that are automatically deleted. - - AUTHENTICATION_LOG_RETENTION=365 - # Name of the HTTP headers sent by the reverse proxy that identifies the authenticated user at proxy level. - # Check your proxy documentation to find out how these headers are named (i.e 'REMOTE_USER', 'REMOTE_EMAIL', etc...) - # (only relevant when AUTHENTICATION_GUARD is set to 'reverse-proxy-guard') - - AUTH_PROXY_HEADER_FOR_USER=null - - AUTH_PROXY_HEADER_FOR_EMAIL=null - # Custom logout URL to open when using an auth proxy. - - PROXY_LOGOUT_URL=null - # WebAuthn settings - # Relying Party name, aka the name of the application. If blank, defaults to APP_NAME. Do not set to null. - - WEBAUTHN_NAME=2FAuth - # Relying Party ID, should equal the site domain (i.e 2fauth.example.com). - # If null, the device will fill it internally (recommended) - # See https://webauthn-doc.spomky-labs.com/prerequisites/the-relying-party#how-to-determine-the-relying-party-id - - WEBAUTHN_ID=null - # Use this setting to control how user verification behave during the - # WebAuthn authentication flow. - # - # Most authenticators and smartphones will ask the user to actively verify - # themselves for log in. For example, through a touch plus pin code, - # password entry, or biometric recognition (e.g., presenting a fingerprint). - # The intent is to distinguish one user from any other. - # - # Supported: - # 'required': Will ALWAYS ask for user verification - # 'preferred' (default) : Will ask for user verification IF POSSIBLE - # 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow) - - WEBAUTHN_USER_VERIFICATION=preferred - #### SSO settings (for Socialite) #### - # Uncomment and complete lines for the OAuth providers you want to enable. - # - OPENID_AUTHORIZE_URL= - # - OPENID_TOKEN_URL= - # - OPENID_USERINFO_URL= - # - OPENID_CLIENT_ID= - # - OPENID_CLIENT_SECRET= - # - GITHUB_CLIENT_ID= - # - GITHUB_CLIENT_SECRET= - # Use this setting to declare trusted proxied. - # Supported: - # '*': to trust any proxy - # A comma separated IP list: The list of proxies IP to trust - - TRUSTED_PROXIES=null - # Proxy for outgoing requests like new releases detection or logo fetching. - # You can provide a proxy URL that contains a scheme, username, and password. - # For example, "http://username:password@192.168.16.1:10". - - PROXY_FOR_OUTGOING_REQUESTS=null - # Leave the following configuration vars as is. - # Unless you like to tinker and know what you're doing. - - BROADCAST_DRIVER=log - - QUEUE_DRIVER=sync - - SESSION_LIFETIME=120 - - REDIS_HOST=127.0.0.1 - - REDIS_PASSWORD=null - - REDIS_PORT=6379 - - PUSHER_APP_ID= - - PUSHER_APP_KEY= - - PUSHER_APP_SECRET= - - PUSHER_APP_CLUSTER=mt1 - - VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}" - - VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}" - - MIX_ENV=local From 1c5d8d538632d5922aa52e0af180cf1d86817f4c Mon Sep 17 00:00:00 2001 From: Toni <25488000+sinipelto@users.noreply.github.com> Date: Thu, 18 Jul 2024 12:41:23 +0300 Subject: [PATCH 3/3] Create .env Env file for docker compose variables. --- docker/.env | 1 + 1 file changed, 1 insertion(+) create mode 100644 docker/.env diff --git a/docker/.env b/docker/.env new file mode 100644 index 00000000..afc0c68e --- /dev/null +++ b/docker/.env @@ -0,0 +1 @@ +TAG=latest