julien/photofetch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): optional HTTP Basic Auth for the whole site

Browse Source 
nginx includes auth_enabled.conf, (re)written at container start from
BASIC_AUTH_USER/PASSWORD (htpasswd via apache2-utils). Both set => the site +
/api require a shared login; unset => open (local dev not locked out). Set both
on the Coolify web service to protect the deployment.
This commit is contained in:
Julien Calixte
2026-06-26 16:32:42 +01:00
parent 2b4d056ab8
commit 7b871f4cbf
5 changed files with 45 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
README.md
View File

@@ -2,9 +2,14 @@
Deployed at https://photofetch.apoena.dev
Pick a **Napta project** and get a grid of the people staffed on it — each with
their **Slack profile picture**, first name, last name, and role. People are
matched between Napta and Slack by **email**.
Pick one or more **Napta projects** and get a grid of the people staffed on each —
every person shown with their **Slack profile picture**, first name, last name, and
role. People are matched between Napta and Slack by **email**. Selected projects are
shown as separate groups, and you can **export** everyone's photos as a zip with one
folder per project (people without a Slack photo get a generated initials image).
See [`CONTEXT.md`](./CONTEXT.md) for the vocabulary and [`DESIGN.md`](./DESIGN.md)
for the design decisions.
## Architecture
@@ -40,14 +45,15 @@ cd backend && pnpm typecheck
Set on the Coolify app (or in `backend/.env` locally — see `backend/.env.example`):
| Var | Purpose |
| ----------------- | --------------------------------------------------------- |
| `NAPTA_API_TOKEN` | Napta API token (lists projects + their people) |
| `NAPTA_BASE_URL` | Napta API base (default `https://app.napta.io/api/v1`) |
| `SLACK_BOT_TOKEN` | Slack bot token, scopes `users:read` + `users:read.email` |
| Var | Purpose |
| ------------------------------------- | ------------------------------------------------------------------------------------ |
| `NAPTA_CLIENT_ID` / `NAPTA_CLIENT_SECRET` | Napta Auth0 M2M credentials (lists projects + staffing). Without **both** → demo fixtures. |
| `NAPTA_BASE_URL` | Napta API base (default `https://app.napta.io/api/v1`) |
| `SLACK_BOT_TOKEN` | Slack bot token, scopes `users:read` + `users:read.email`. Optional — without it, Members show initials. |
| `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` | Set **both** (on the `web` service) to require a shared login for the whole site. Unset → open. |
Without **both** tokens the API serves demo fixtures and the UI shows a
"demo data" banner.
Without Napta credentials the API serves demo fixtures and the UI shows a
"demo data" banner. `BASIC_AUTH_*` go on the **web** service; the rest on **api**.
## Deploy