mirror of
https://github.com/wahyd4/passkey-auth.git
synced 2026-08-09 04:15:55 +10:00
junv
9427c36b8b
- Complete WebAuthn/FIDO2 authentication implementation - SQLite database with user and credential management - Email-based user identification with allowlist support - Admin approval workflow for new users - Session management with secure cookies - Docker containerization with Debian base for SQLite compatibility - Kubernetes deployment manifests with nginx ingress support - Web-based admin interface for user management - Comprehensive documentation and deployment guides - Standard open source project structure with CI/CD
63 lines
2.0 KiB
YAML
63 lines
2.0 KiB
YAML
# Development Configuration
|
|
# Copy this file to config.yaml and modify for your environment
|
|
|
|
server:
|
|
port: "8080"
|
|
host: "0.0.0.0"
|
|
|
|
webauthn:
|
|
# Display name shown during passkey registration
|
|
rp_display_name: "Passkey Auth - Development"
|
|
|
|
# Must match your domain exactly (without protocol)
|
|
# For local development, use "localhost"
|
|
# For production, use your actual domain like "auth.example.com"
|
|
rp_id: "localhost"
|
|
|
|
# List of allowed origins (with protocol)
|
|
# Must include all URLs where users will access the auth interface
|
|
rp_origins:
|
|
- "http://localhost:8080"
|
|
# Add your production URLs:
|
|
# - "https://auth.example.com"
|
|
# - "https://example.com"
|
|
|
|
database:
|
|
# SQLite database file path
|
|
# In Kubernetes, this should be in a persistent volume
|
|
path: "passkey-auth.db"
|
|
|
|
cors:
|
|
# Allowed origins for CORS
|
|
# In production, be specific about allowed origins for security
|
|
allowed_origins:
|
|
- "*" # Only use "*" for development
|
|
# Production example:
|
|
# - "https://auth.example.com"
|
|
# - "https://admin.example.com"
|
|
|
|
auth:
|
|
# Session encryption secret - MUST be changed in production!
|
|
# Generate with: openssl rand -base64 32
|
|
session_secret: "change-me-in-production"
|
|
|
|
# Whether new users need admin approval before they can authenticate
|
|
# Set to false to allow automatic approval for trusted environments
|
|
require_approval: true
|
|
|
|
# Email allowlist - list of email addresses allowed to register
|
|
# Leave empty to allow any email address (not recommended for production)
|
|
allowed_emails:
|
|
# Example emails (uncomment and modify as needed):
|
|
# - "admin@yourcompany.com"
|
|
# - "user1@yourcompany.com"
|
|
# - "user2@yourcompany.com"
|
|
|
|
# Environment-specific overrides can be set via environment variables:
|
|
# - PORT: Server port
|
|
# - HOST: Server host
|
|
# - WEBAUTHN_RP_ID: WebAuthn Relying Party ID
|
|
# - DATABASE_PATH: Database file path
|
|
# - SESSION_SECRET: Session encryption secret
|
|
# - ALLOWED_EMAILS: Comma-separated list of allowed emails
|