greyson/dokkku-google-auth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow per-app allow/deny.

Browse Source
This commit is contained in:
Greyson Parrelli
2026-08-06 13:53:24 -04:00
parent c15a1cc14c
commit 8ce2919627
19 changed files with 1151 additions and 187 deletions
Download Patch File Download Diff File Expand all files Collapse all files
commands
+20 -10
View File
@@ -7,10 +7,10 @@ case "$1" in
help_content() {
cat <<help_content
google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
google-auth:allow [<domain|address>...], Let a domain or address sign in (no arguments lists the allow list)
google-auth:unallow <domain|address...>, Remove a domain or address from the allow list
google-auth:deny [<address>...], Block an address even if the allow list covers it (no arguments lists the deny list)
google-auth:undeny <address...>, Remove an address from the deny list
google-auth:allow <app>|--global [<domain|address>...], Let a domain or address sign in (no entries lists the allow list)
google-auth:unallow <app>|--global <domain|address...>, Remove a domain or address from an allow list
google-auth:deny <app>|--global [<address>...], Block an address even if the allow list covers it (no entries lists the deny list)
google-auth:undeny <app>|--global <address...>, Remove an address from a deny list
google-auth:enable <app>, Require Google sign-in for all requests to <app>
google-auth:disable <app>, Remove Google sign-in from <app>
google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
@@ -45,14 +45,24 @@ help_content
echo ' --port <port> 127.0.0.1 port for the auth service (default 2999)'
echo ' --regenerate-cookie-secret rotate the session key (signs everyone out)'
echo ''
echo 'The allow rules are a strict allowlist: an account that matches none of them'
echo 'is rejected, and at least one rule is required. The deny list wins over both.'
echo 'These flags set the GLOBAL lists and REPLACE the list they name, so they suit'
echo 'initial setup. To change one entry afterwards — globally or for a single app —'
echo 'use google-auth:allow / :unallow / :deny / :undeny.'
echo ''
echo 'These flags REPLACE the list they name, so they suit initial setup. To add or'
echo 'remove one person afterwards, use google-auth:allow / :unallow / :deny /'
echo ':undeny, which change one entry at a time and restart the service for you.'
echo 'Who gets in:'
echo ''
echo ' * The allow rules are a strict allowlist: an account matching none of them'
echo ' is rejected, and at least one global rule is required.'
echo ' * An app with its own allow entries uses ONLY those, ignoring the global'
echo ' list. An app with none inherits the global list.'
echo ' * Deny lists combine: an address denied globally or for the app is'
echo ' rejected, and no app can lift a global denial.'
else
help_content
# Plain `dokku help` gets a single summary line, the way dokku's own
# plugins behave; the command list belongs to `dokku google-auth:help`.
cat <<help_desc
google-auth, Put Google OAuth SSO in front of dokku apps
help_desc
fi
;;