diff --git a/README.MD b/README.MD
index 3f2ddb30..eaecdcd2 100644
--- a/README.MD
+++ b/README.MD
@@ -15,7 +15,7 @@
- 
+
diff --git a/docker-compose.yml b/docker-compose.yml
index a9016841..787e4c9f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,18 +30,32 @@ services:
restart: "no"
dockflare:
- build: ./dockflare
- #image: alplat/dockflare:stable
+ #build: ./dockflare
+ image: alplat/dockflare:stable
container_name: dockflare
restart: unless-stopped
ports:
- - "5001:5000"
- labels:
- # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL --
- - dockflare.enable=true
- - dockflare.hostname=df.dataverse.icu
- - dockflare.service=http://dockflare:5000
- - dockflare.access.policy=bypass
+ - "5000:5000"
+ #labels:
+ # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL --
+ # Main DockFlare interface with access policy
+ #- dockflare.enable=true
+ #- dockflare.hostname=dockflare.example.com
+ #- dockflare.service=http://dockflare:5000
+ #- dockflare.access.group=team # your custom access policy
+
+ # -- OAuth Callback Path (Bypass Access Policy) OPTIONAL --
+ # Required if using OAuth authentication with access policies on main interface
+ # - dockflare.0.hostname=dockflare.example.com
+ # - dockflare.0.path=/auth/google/callback
+ # - dockflare.0.service=http://dockflare:5000
+ # - dockflare.0.access.policy=bypass
+
+ # Add additional callback paths for other OAuth providers as needed
+ # - dockflare.1.hostname=dockflare.example.com
+ # - dockflare.1.path=/auth/github/callback
+ # - dockflare.1.service=http://dockflare:5000
+ # - dockflare.1.access.policy=bypass
volumes:
- dockflare_data:/app/data
environment:
diff --git a/dockflare/app/templates/docs/OAuth-Provider-Setup.md b/dockflare/app/templates/docs/OAuth-Provider-Setup.md
index 72305cb1..17db82b5 100644
--- a/dockflare/app/templates/docs/OAuth-Provider-Setup.md
+++ b/dockflare/app/templates/docs/OAuth-Provider-Setup.md
@@ -51,3 +51,51 @@ Here is a quick guide to configuring Google as an OAuth provider.
* **Client Secret:** `(Your Client Secret from Google)`
Save the provider in DockFlare, and you will be able to log in with your Google account.
+
+---
+
+### Configuring DockFlare with OAuth and Access Policies
+
+When using OAuth authentication, you may want to protect your main DockFlare interface with access policies while ensuring OAuth callbacks work properly. This is especially important if you have IP restrictions or other access controls on your DockFlare instance.
+
+#### **Best Practice: Bypass Policy for OAuth Callbacks**
+
+Use indexed labels to create separate rules for your main interface and OAuth callback paths:
+
+```yaml
+services:
+ dockflare:
+ image: alplat/dockflare:stable
+ labels:
+ # Main DockFlare interface with access policy
+ - "dockflare.enable=true"
+ - "dockflare.hostname=dockflare.example.com"
+ - "dockflare.service=http://dockflare:5000"
+ - "dockflare.access.group=team" # your custom access policy
+
+ # OAuth callback paths with bypass policy (required for OAuth to work)
+ - "dockflare.0.hostname=dockflare.example.com"
+ - "dockflare.0.path=/auth/google/callback"
+ - "dockflare.0.service=http://dockflare:5000"
+ - "dockflare.0.access.policy=bypass"
+
+ # Add additional callback paths for other providers if needed
+ - "dockflare.1.hostname=dockflare.example.com"
+ - "dockflare.1.path=/auth/github/callback"
+ - "dockflare.1.service=http://dockflare:5000"
+ - "dockflare.1.access.policy=bypass"
+```
+
+#### **Why This Configuration is Needed**
+
+- **Main Interface Protection**: Your DockFlare dashboard remains protected by your chosen access policy
+- **OAuth Functionality**: OAuth callbacks can reach DockFlare without authentication barriers
+- **Security**: Only specific callback paths are bypassed, not the entire application
+- **Flexibility**: Works with any combination of access policies (IP-based, authentication-based, etc.)
+
+#### **Important Notes**
+
+1. **Path Matching**: The callback path must exactly match what your OAuth provider expects
+2. **Multiple Providers**: Add a separate indexed rule for each OAuth provider you configure
+3. **No Wildcards**: Avoid using wildcard paths for security reasons - be specific with callback URLs
+4. **Testing**: After configuration, test both protected access (main interface) and OAuth login flows
diff --git a/dockflare/app/templates/settings.html b/dockflare/app/templates/settings.html
index 745b826f..6068f070 100644
--- a/dockflare/app/templates/settings.html
+++ b/dockflare/app/templates/settings.html
@@ -962,6 +962,11 @@
${escapeHtml(user.email)}
enabled: formData.get('enabled') === 'on'
};
+ const issuerUrl = formData.get('issuer_url');
+ if (issuerUrl) {
+ providerData.issuer_url = issuerUrl;
+ }
+
try {
const response = await fetch('/api/v2/auth/providers', {
method: 'POST',
diff --git a/dockflare/app/web/api_v2_routes.py b/dockflare/app/web/api_v2_routes.py
index 32029726..5df71a54 100644
--- a/dockflare/app/web/api_v2_routes.py
+++ b/dockflare/app/web/api_v2_routes.py
@@ -2159,6 +2159,10 @@ def manage_auth_users():
if not _save_encrypted_config(config_data, fernet):
return jsonify({"error": "failed_to_save_config"}), 500
+ current_app.config['OAUTH_AUTHORIZED_USERS'] = [
+ user['email'] for user in config_data.get('authorized_users', [])
+ ]
+
return jsonify({"status": "success", "message": "User added successfully."})
@api_v2_bp.route('/auth/users/', methods=['DELETE'])
@@ -2180,4 +2184,8 @@ def manage_auth_user(user_email):
if not _save_encrypted_config(config_data, fernet):
return jsonify({"error": "failed_to_save_config"}), 500
+ current_app.config['OAUTH_AUTHORIZED_USERS'] = [
+ user['email'] for user in config_data.get('authorized_users', [])
+ ]
+
return jsonify({"status": "success", "message": "User deleted successfully."})