From 0e0be773f57699d78b67b9ea1c00d22e6577c775 Mon Sep 17 00:00:00 2001 From: ChrispyBacon-dev Date: Fri, 26 Sep 2025 21:05:03 +0200 Subject: [PATCH 1/4] small fix for google oauth in modal provider add --- dockflare/app/templates/settings.html | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dockflare/app/templates/settings.html b/dockflare/app/templates/settings.html index 745b826f..6068f070 100644 --- a/dockflare/app/templates/settings.html +++ b/dockflare/app/templates/settings.html @@ -962,6 +962,11 @@
${escapeHtml(user.email)}
enabled: formData.get('enabled') === 'on' }; + const issuerUrl = formData.get('issuer_url'); + if (issuerUrl) { + providerData.issuer_url = issuerUrl; + } + try { const response = await fetch('/api/v2/auth/providers', { method: 'POST', From 77415663db997053fb5534ddd0f6e776334593cd Mon Sep 17 00:00:00 2001 From: ChrispyBacon-dev Date: Fri, 26 Sep 2025 21:34:58 +0200 Subject: [PATCH 2/4] - /auth/users POST route (add user): Now updates current_app.config['OAUTH_AUTHORIZED_USERS'] after saving - /auth/users/ DELETE route (remove user): Now updates current_app.config['OAUTH_AUTHORIZED_USERS'] after saving The authorized users list is now immediately refreshed in memory, so new users can log in without requiring a container restart. --- dockflare/app/web/api_v2_routes.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dockflare/app/web/api_v2_routes.py b/dockflare/app/web/api_v2_routes.py index 32029726..5df71a54 100644 --- a/dockflare/app/web/api_v2_routes.py +++ b/dockflare/app/web/api_v2_routes.py @@ -2159,6 +2159,10 @@ def manage_auth_users(): if not _save_encrypted_config(config_data, fernet): return jsonify({"error": "failed_to_save_config"}), 500 + current_app.config['OAUTH_AUTHORIZED_USERS'] = [ + user['email'] for user in config_data.get('authorized_users', []) + ] + return jsonify({"status": "success", "message": "User added successfully."}) @api_v2_bp.route('/auth/users/', methods=['DELETE']) @@ -2180,4 +2184,8 @@ def manage_auth_user(user_email): if not _save_encrypted_config(config_data, fernet): return jsonify({"error": "failed_to_save_config"}), 500 + current_app.config['OAUTH_AUTHORIZED_USERS'] = [ + user['email'] for user in config_data.get('authorized_users', []) + ] + return jsonify({"status": "success", "message": "User deleted successfully."}) From ef6deae5869f90fd82115cde67c46af25a42dd5f Mon Sep 17 00:00:00 2001 From: ChrispyBacon-dev Date: Fri, 26 Sep 2025 22:12:46 +0200 Subject: [PATCH 3/4] label examples and docs update with label examples --- docker-compose.yml | 32 +++++++++---- .../templates/docs/OAuth-Provider-Setup.md | 48 +++++++++++++++++++ 2 files changed, 71 insertions(+), 9 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index a9016841..787e4c9f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -30,18 +30,32 @@ services: restart: "no" dockflare: - build: ./dockflare - #image: alplat/dockflare:stable + #build: ./dockflare + image: alplat/dockflare:stable container_name: dockflare restart: unless-stopped ports: - - "5001:5000" - labels: - # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL -- - - dockflare.enable=true - - dockflare.hostname=df.dataverse.icu - - dockflare.service=http://dockflare:5000 - - dockflare.access.policy=bypass + - "5000:5000" + #labels: + # -- Cloudflare Tunnel Configuration (via DockFlare) OPTIONAL -- + # Main DockFlare interface with access policy + #- dockflare.enable=true + #- dockflare.hostname=dockflare.example.com + #- dockflare.service=http://dockflare:5000 + #- dockflare.access.group=team # your custom access policy + + # -- OAuth Callback Path (Bypass Access Policy) OPTIONAL -- + # Required if using OAuth authentication with access policies on main interface + # - dockflare.0.hostname=dockflare.example.com + # - dockflare.0.path=/auth/google/callback + # - dockflare.0.service=http://dockflare:5000 + # - dockflare.0.access.policy=bypass + + # Add additional callback paths for other OAuth providers as needed + # - dockflare.1.hostname=dockflare.example.com + # - dockflare.1.path=/auth/github/callback + # - dockflare.1.service=http://dockflare:5000 + # - dockflare.1.access.policy=bypass volumes: - dockflare_data:/app/data environment: diff --git a/dockflare/app/templates/docs/OAuth-Provider-Setup.md b/dockflare/app/templates/docs/OAuth-Provider-Setup.md index 72305cb1..17db82b5 100644 --- a/dockflare/app/templates/docs/OAuth-Provider-Setup.md +++ b/dockflare/app/templates/docs/OAuth-Provider-Setup.md @@ -51,3 +51,51 @@ Here is a quick guide to configuring Google as an OAuth provider. * **Client Secret:** `(Your Client Secret from Google)` Save the provider in DockFlare, and you will be able to log in with your Google account. + +--- + +### Configuring DockFlare with OAuth and Access Policies + +When using OAuth authentication, you may want to protect your main DockFlare interface with access policies while ensuring OAuth callbacks work properly. This is especially important if you have IP restrictions or other access controls on your DockFlare instance. + +#### **Best Practice: Bypass Policy for OAuth Callbacks** + +Use indexed labels to create separate rules for your main interface and OAuth callback paths: + +```yaml +services: + dockflare: + image: alplat/dockflare:stable + labels: + # Main DockFlare interface with access policy + - "dockflare.enable=true" + - "dockflare.hostname=dockflare.example.com" + - "dockflare.service=http://dockflare:5000" + - "dockflare.access.group=team" # your custom access policy + + # OAuth callback paths with bypass policy (required for OAuth to work) + - "dockflare.0.hostname=dockflare.example.com" + - "dockflare.0.path=/auth/google/callback" + - "dockflare.0.service=http://dockflare:5000" + - "dockflare.0.access.policy=bypass" + + # Add additional callback paths for other providers if needed + - "dockflare.1.hostname=dockflare.example.com" + - "dockflare.1.path=/auth/github/callback" + - "dockflare.1.service=http://dockflare:5000" + - "dockflare.1.access.policy=bypass" +``` + +#### **Why This Configuration is Needed** + +- **Main Interface Protection**: Your DockFlare dashboard remains protected by your chosen access policy +- **OAuth Functionality**: OAuth callbacks can reach DockFlare without authentication barriers +- **Security**: Only specific callback paths are bypassed, not the entire application +- **Flexibility**: Works with any combination of access policies (IP-based, authentication-based, etc.) + +#### **Important Notes** + +1. **Path Matching**: The callback path must exactly match what your OAuth provider expects +2. **Multiple Providers**: Add a separate indexed rule for each OAuth provider you configure +3. **No Wildcards**: Avoid using wildcard paths for security reasons - be specific with callback URLs +4. **Testing**: After configuration, test both protected access (main interface) and OAuth login flows From 176a49b6aecae2f1f302730214bb4e53b6a9fb1a Mon Sep 17 00:00:00 2001 From: ChrispyBacon-dev Date: Fri, 26 Sep 2025 22:13:54 +0200 Subject: [PATCH 4/4] release v3.0.1 update --- README.MD | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.MD b/README.MD index 3f2ddb30..eaecdcd2 100644 --- a/README.MD +++ b/README.MD @@ -15,7 +15,7 @@

- Release + Release Docker Pulls Python License