42 lines
1.9 KiB
Markdown
42 lines
1.9 KiB
Markdown
# vnc-hybridauth2 (vnctalk-hybrid-authenticator2)
|
|
|
|
Hybrid authenticator for VNCtalk / VNCmail. An Express service that sits between the
|
|
auth-proxy's `hybridAuthURL` and the directory backends: it authenticates users against
|
|
**LDAP** and the **VNCdirectory** PostgreSQL DB, and issues/verifies the XMPP JWT
|
|
(`xmppToken`) that Prosody and the mail/talk APIs share for SSO.
|
|
|
|
Prosody's `mod_auth_http_async` points `hybridaAuthUrl` at this service's HTTP-basic
|
|
endpoint (default port `9544`).
|
|
|
|
## Build & image
|
|
|
|
Built by Gitea Actions (`.gitea/workflows/deploy.yml`) on every push to `master`, using
|
|
kaniko (no Docker daemon on the runner). The image is pushed to the Gitea registry:
|
|
|
|
- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:latest`
|
|
- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:sha-<short-sha>`
|
|
|
|
Registry auth uses the `REGISTRY_USER` / `REGISTRY_TOKEN` Actions secrets. The image runs
|
|
as the non-root `vncuser` (uid 1001) and starts `node /usr/share/vnctalk-hybrid-authenticator2/app/app.js`.
|
|
|
|
## Configuration
|
|
|
|
`config.js` (copied into the image as `config/vnc-hybrid-authenticator.js`) is env-driven;
|
|
the `development` profile reads `NODE_ENV`-scoped values from `process.env` (LDAP URI/bind,
|
|
Postgres host/port/name/user/pass, `xmppToken`, `domain`). Provide them via the deployment
|
|
(ArgoCD in the `vnc-iac-env` GitOps repo), sourced from Infisical — do **not** commit
|
|
secrets to this repo.
|
|
|
|
## Deploy
|
|
|
|
Deployed by the ArgoCD application in `vnc-iac-env` (the hybrid-auth service that Prosody
|
|
and the mail/talk APIs call). This repo has no live deploy manifest; the image tag is pinned
|
|
in that GitOps repo.
|
|
|
|
## Legacy removed
|
|
|
|
The GitLab CI (`.gitlab-ci.yml`), `Jenkinsfile.deprecated`, and the GCP dev bootstrap
|
|
(`startgcpdevapi.sh`) were removed during the GitLab → Gitea migration. The old
|
|
`eu.gcr.io/vnc-development/vnc-hybridauth-api` promotion flow (`prod-*` / `stable-*` tags)
|
|
is not carried over; the current build pushes a single `master` → `sha-*` + `latest`.
|