f9ec4cc986
Eleven app configs declared CFG_<APP>_AUTH_PROFILE as a "capability tier for the WebUI auth tools". Nothing read it — not a shell script, not the frontend, and it was never emitted into apps.json, so the WebUI could not have acted on it even in principle. The job it was meant to do is already done, and done better: authAdapterCanDo tests `declare -F authAdapter_<app>_<method>`, so what an app can do is derived from the functions it actually implements. A declared tier is a second source of truth that can only drift — traefik declared single_password while its adapter implements setPassword only, and linkding declared nothing at all while shipping a full multi-user adapter, and neither mismatch had any effect. Removed the key and its comment from all eleven configs, and replaced the stale contract note in auth_adapter.sh with what the dispatcher really does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
89 lines
4.6 KiB
Plaintext
Executable File
89 lines
4.6 KiB
Plaintext
Executable File
#
|
|
# =============================================================================
|
|
# GENERAL CONFIGURATION
|
|
# =============================================================================
|
|
# APP_NAME = name of application for use in scripts
|
|
# COMPOSE_FILE = default for no app_name in docker-compose file name, app if there is
|
|
# BACKUP = if true, include this application in backup operations
|
|
# UPDATE_TYPE = auto: new image builds are applied automatically (a recovery snapshot is taken first), manual: only when you press Update
|
|
# HEALTHCHECK = if true, default docker health checks for that container will be enabled
|
|
# AUTHELIA = if true, use Authelia authentication, if false turned off.
|
|
# HEADSCALE = options : false, local, remote (see general config). e.g false or local,remote
|
|
# MONITORING = if true, export this app's metrics to Prometheus + Grafana (needs both apps installed)
|
|
#
|
|
CFG_TRAEFIK_APP_NAME=traefik
|
|
CFG_TRAEFIK_BACKUP=true
|
|
CFG_TRAEFIK_BACKUP_STRATEGY=auto
|
|
CFG_TRAEFIK_UPDATE_TYPE=auto
|
|
CFG_TRAEFIK_COMPOSE_FILE=default
|
|
CFG_TRAEFIK_HEALTHCHECK=true
|
|
CFG_TRAEFIK_AUTHELIA=false
|
|
CFG_TRAEFIK_HEADSCALE=false
|
|
CFG_TRAEFIK_MONITORING=false
|
|
#
|
|
# =============================================================================
|
|
# APPLICATION CONFIGURATION
|
|
# =============================================================================
|
|
# LOGGING = log level (ERROR, WARN, INFO, DEBUG)
|
|
# 404_SITE = custom 404 page URL
|
|
# EMAIL = administrator email used by LetsEncrypt for ACME registration & cert-expiry warnings
|
|
# DASHBOARD_ACCESS = how the Traefik dashboard is reachable
|
|
# local-only : dashboard available unauthenticated on http://127.0.0.1:8080 (host only)
|
|
# AND auth-protected via https://traefik.<domain> (recommended default)
|
|
# domain-only : dashboard ONLY via https://traefik.<domain>, fully auth-protected,
|
|
# :8080 not exposed (most secure; requires a working domain)
|
|
# public : dashboard on :8080 reachable from any interface unauthenticated
|
|
# AND auth-protected via https://traefik.<domain> (legacy behavior)
|
|
#
|
|
CFG_TRAEFIK_LOGGING=ERROR
|
|
CFG_TRAEFIK_404_SITE=https://example.org/404
|
|
CFG_TRAEFIK_EMAIL=changeme
|
|
CFG_TRAEFIK_DASHBOARD_ACCESS=local-only
|
|
#
|
|
# =============================================================================
|
|
# METADATA
|
|
# =============================================================================
|
|
# CATEGORY = application category for grouping
|
|
# TITLE = display name for the application
|
|
# DESCRIPTION = short description of the application
|
|
# LONG_DESCRIPTION = detailed description of the application
|
|
# URL = source repository or documentation URL
|
|
# ACTIONS = available actions for this application
|
|
#
|
|
CFG_TRAEFIK_CATEGORY="networking,recommended"
|
|
CFG_TRAEFIK_TITLE="Traefik"
|
|
CFG_TRAEFIK_DESCRIPTION="Reverse Proxy"
|
|
CFG_TRAEFIK_LONG_DESCRIPTION="Traefik is a modern HTTP reverse proxy and load balancer that makes deploying microservices easy and efficient"
|
|
CFG_TRAEFIK_URL="https://github.com/traefik/traefik"
|
|
CFG_TRAEFIK_ACTIONS="configure|install|restart|shutdown|uninstall"
|
|
#
|
|
# =============================================================================
|
|
# NETWORK CONFIGURATION
|
|
# =============================================================================
|
|
# DOMAIN = number of domain from the general config, useful when using multiple domains
|
|
# WHITELIST = if true only allow whitelisted ips on traefik, if false allow all
|
|
#
|
|
CFG_TRAEFIK_DOMAIN=1
|
|
CFG_TRAEFIK_WHITELIST=false
|
|
CFG_TRAEFIK_NETWORK=default
|
|
#
|
|
# =============================================================================
|
|
# PORT CONFIGURATION
|
|
# =============================================================================
|
|
# PORT_ = port configuration: app|name|external:internal|access|protocol|login|traefik|webui|description
|
|
# - app: application name
|
|
# - name: service identifier (webui, api, ssh, etc.)
|
|
# - external:internal: port mapping (external can be 'random' for auto-allocation)
|
|
# - access: 'public' (internet accessible), 'private' (local network only), 'disabled' (not running)
|
|
# - protocol: 'tcp' or 'udp'
|
|
# - login: if true, this port requires basic-auth via Traefik (only meaningful when traefik=true)
|
|
# - traefik: if true, Traefik handles this port (reverse proxy)
|
|
# - webui: if true, this port serves the main web interface
|
|
# - description: human-readable description of the service
|
|
#
|
|
CFG_TRAEFIK_PORT_1="traefik-service|dashboard|random:8080|public|tcp|true|true|true|Admin Dashboard||traefik"
|
|
CFG_TRAEFIK_PORT_2="traefik-service|https|443:443|public|tcp|false|false|false|HTTPS Traffic|"
|
|
CFG_TRAEFIK_PORT_3="traefik-service|http|80:80|disabled|tcp|false|false|false|HTTP Traffic|"
|
|
|
|
CFG_TRAEFIK_ADMIN_USER=
|