Frank
3cc99d81cc
Auth layer (Authentik 2026.8.0): - compose: 3-service stack (authentik-postgres, authentik-server, authentik-worker), postgres health-gated, bind mounts under /home/dank/authentik - Caddyfile: auth.franksdank.cloud vhost; forward_auth on the no-auth vhosts (homepage, SearXNG, Hermes, Prometheus, RomM, Copyparty); outpost path proxied first in a route block - .env.example: AUTHENTIK_PG_PASS + AUTHENTIK_SECRET_KEY - deploy.sh: render only CADDY_BASICAUTH_HASH (the homepage per-user hashes are retired; grafana + pihole keep basicauth) - tests/authentik.bats (new) + updated homepage/caddyfile/pihole seams - docs: Authentik.md + per-service pages; Caddy.md + Homepage.md updated Homepage (naked domain): - Caddyfile: dankclaw.franksdank.cloud -> franksdank.cloud www.franksdank.cloud; dankclaw + dankserver redirect to it; bare-IP catch-all updated - addn-hosts: A records for the naked domain, www, and auth (all -> 143) - tests/pihole.bats: vhost_names handles multi-address blocks; TLD check allows the naked domain All 146 tests pass.
39 lines
1.5 KiB
Bash
39 lines
1.5 KiB
Bash
#!/usr/bin/env bats
|
|
# Seam: the homepage site block in dankclaw/Caddyfile. It serves /srv/homepage
|
|
# from the naked domain (franksdank.cloud) and www. Authentication is via
|
|
# Caddy forward_auth (Authentik SSO) — the basicauth hashes were retired in
|
|
# favor of the unified Authentik login. caddy is not on the dev box, so the
|
|
# tests assert the structure statically.
|
|
|
|
load helpers
|
|
|
|
setup() {
|
|
CADDY="$REPO_ROOT/dankclaw/Caddyfile"
|
|
}
|
|
|
|
@test "the homepage serves /srv/homepage" {
|
|
grep -q "root \* /srv/homepage" "$CADDY"
|
|
grep -q "file_server" "$CADDY"
|
|
}
|
|
|
|
@test "the /admin/ page serves admin.html and / serves index.html" {
|
|
# Each page is served by its own 'handle' block via 'try_files'.
|
|
grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
|
|
grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
|
|
grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
|
|
}
|
|
|
|
@test "the shared data + assets are served to any authenticated user" {
|
|
# The data (services.json, status.json) and assets are fetched by both the
|
|
# user page and the admin page. With forward_auth, any authenticated user
|
|
# can access them (the browser's Authentik session covers the fetch).
|
|
grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
|
|
grep -qE "handle[[:space:]]+@data" "$CADDY"
|
|
}
|
|
|
|
@test "the homepage vhost uses forward_auth (Authentik SSO)" {
|
|
local block
|
|
block=$(awk '/^franksdank\.cloud[[:space:]]/,/^}/' "$CADDY")
|
|
echo "$block" | grep -q 'forward_auth'
|
|
}
|