jimmy/nas-tools
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat: RBAC multi-user role-based access control
Deploy Dashboard (Dev) / deploy-dev (push) Successful in 1m14s
Details

Browse Source 
- Add rbac.py with User model, LDAP group-to-role mapping, page/write dependencies
- Proxy auth reads Remote-Groups header to resolve role from LDAP groups
- JWT tokens carry role claim, /me returns role + allowed pages
- Per-router page access control and viewer write protection
- Terminal WebSocket RBAC check
- Frontend filters sidebar links and routes by allowed pages
- Admin-only Settings page and RBAC override endpoints
- Mount rbac.json in docker-compose for page config persistence
This commit is contained in:
Gan, Jimmy
2026-03-01 14:13:43 +08:00
parent 15ad628425
commit 9992105b49
10 changed files with 342 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tmp_remote/Caddyfile_nas
+73 -8
View File
@@ -73,12 +73,77 @@ dev.nas.jimmygan.com {
}
git.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:3300
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:3300
}
photos.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:2283 {
header_up X-Forwarded-Proto https
header_up X-Forwarded-Host {host}
}
}
media.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:8096
}
books.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:13378
}
pdf.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:8030
}
vault.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
forward_auth 127.0.0.1:9092 {
uri /api/verify?rd=https://auth.jimmygan.com:8443
copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
}
reverse_proxy 127.0.0.1:8222
}
speed.jimmygan.com {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
reverse_proxy 127.0.0.1:8080
}