73 lines
3.8 KiB
Bash
Executable File
73 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
|
|
case "$1" in
|
|
help | google-auth:help)
|
|
help_content() {
|
|
cat <<help_content
|
|
google-auth:configure [options], Set Google credentials and who may sign in (re-run any time to change)
|
|
google-auth:allow <app>|--global [<domain|address>...], Let a domain or address sign in (no entries lists the allow list)
|
|
google-auth:unallow <app>|--global <domain|address...>, Remove a domain or address from an allow list
|
|
google-auth:deny <app>|--global [<address>...], Block an address even if the allow list covers it (no entries lists the deny list)
|
|
google-auth:undeny <app>|--global <address...>, Remove an address from a deny list
|
|
google-auth:enable <app>, Require Google sign-in for all requests to <app>
|
|
google-auth:disable <app>, Remove Google sign-in from <app>
|
|
google-auth:exclude <app> <pattern...>, Exempt path prefixes (/path) or regexes (re:^/x) from sign-in
|
|
google-auth:unexclude <app> <pattern...>, Remove previously excluded patterns
|
|
google-auth:report [app], Show global and per-app google-auth status
|
|
google-auth:start, Start the shared auth service container
|
|
google-auth:stop, Stop the shared auth service container
|
|
google-auth:restart, Restart the shared auth service container (picks up config changes)
|
|
google-auth:logs [--tail|-t], Show logs from the shared auth service container
|
|
help_content
|
|
}
|
|
|
|
if [[ "$1" == "google-auth:help" ]]; then
|
|
echo -e 'Usage: dokku google-auth[:COMMAND]'
|
|
echo ''
|
|
echo 'Put Google OAuth SSO in front of dokku apps.'
|
|
echo ''
|
|
echo 'Commands:'
|
|
help_content | sort | column -c2 -t -s,
|
|
echo ''
|
|
echo 'google-auth:configure options (all persisted; re-run to change any of them):'
|
|
echo ''
|
|
echo ' --client-id <id> Google OAuth client id'
|
|
echo ' --client-secret <secret> Google OAuth client secret'
|
|
echo ' --auth-host <host> the one host registered as a redirect URI with Google'
|
|
echo ' --allow-domain <domain> allow any verified account at <domain> (repeatable)'
|
|
echo ' --allow-email <address> allow one specific address (repeatable)'
|
|
echo ' --deny-email <address> block one address, even if a rule above allows it (repeatable)'
|
|
echo ' --clear-deny-emails empty the deny list'
|
|
echo ' --session-ttl <duration> how long a sign-in lasts (default 24h)'
|
|
echo ' --cookie-name <name> session cookie name (default _google_auth)'
|
|
echo ' --port <port> 127.0.0.1 port for the auth service (default 2999)'
|
|
echo ' --regenerate-cookie-secret rotate the session key (signs everyone out)'
|
|
echo ''
|
|
echo 'These flags set the GLOBAL lists and REPLACE the list they name, so they suit'
|
|
echo 'initial setup. To change one entry afterwards — globally or for a single app —'
|
|
echo 'use google-auth:allow / :unallow / :deny / :undeny.'
|
|
echo ''
|
|
echo 'Who gets in:'
|
|
echo ''
|
|
echo ' * The allow rules are a strict allowlist: an account matching none of them'
|
|
echo ' is rejected, and at least one global rule is required.'
|
|
echo ' * An app with its own allow entries uses ONLY those, ignoring the global'
|
|
echo ' list. An app with none inherits the global list.'
|
|
echo ' * Deny lists combine: an address denied globally or for the app is'
|
|
echo ' rejected, and no app can lift a global denial.'
|
|
else
|
|
# Plain `dokku help` gets a single summary line, the way dokku's own
|
|
# plugins behave; the command list belongs to `dokku google-auth:help`.
|
|
cat <<help_desc
|
|
google-auth, Put Google OAuth SSO in front of dokku apps
|
|
help_desc
|
|
fi
|
|
;;
|
|
|
|
*)
|
|
exit "${DOKKU_NOT_IMPLEMENTED_EXIT:-10}"
|
|
;;
|
|
esac
|