AtAuth
Update docs: required secrets setup, security section, GHCR image
Bryan Brooks
(Feb 23, 2026, 5:56 PM -0600)
e3150a09
a3c29c05
+43
-9
+18
-3
README.md
+18
-3
README.md
···
37
37
38
38
```bash
39
39
git clone https://gitea.cloudforest-basilisk.ts.net/Arcnode.xyz/atauth.git
40
-
cd atauth
40
+
cd atauth/gateway
41
41
cp .env.example .env
42
-
echo "ADMIN_TOKEN=$(openssl rand -hex 32)" >> .env
42
+
```
43
+
44
+
Edit `.env` and fill in the required secrets (generate with `openssl rand -hex 32`):
45
+
46
+
```env
47
+
ADMIN_TOKEN=<your-admin-token>
48
+
OIDC_KEY_SECRET=<your-oidc-key-secret>
49
+
MFA_ENCRYPTION_KEY=<your-64-hex-char-key> # openssl rand -hex 32
50
+
```
43
51
52
+
Then start:
53
+
54
+
```bash
44
55
docker compose up -d
45
56
```
46
57
47
-
Then open the admin dashboard at `http://localhost:3100/admin/login` and use the setup wizard to register your first app.
58
+
Open the admin dashboard at `https://your-domain/admin/login` and use the setup wizard to register your first app.
48
59
49
60
## Supported Apps
50
61
···
120
131
121
132
## Security
122
133
134
+
- No hardcoded secrets -- all sensitive config validated at startup
123
135
- Client secrets stored as SHA-256 hashes
136
+
- One-time flash tokens for secret display (never in URLs)
124
137
- PKCE support (configurable per-client)
125
138
- Constant-time comparison for all secret verification
139
+
- HTML escaping on all server-rendered pages
126
140
- HMAC-signed CSRF tokens on all dashboard forms
127
141
- Rate limiting on auth endpoints
142
+
- CSP with per-request nonces for inline scripts
128
143
- WAF-compatible (Cloudflare Managed Ruleset + OWASP)
129
144
130
145
## Documentation
+25
-6
docs/HOMELAB.md
+25
-6
docs/HOMELAB.md
···
12
12
13
13
```bash
14
14
git clone https://gitea.cloudforest-basilisk.ts.net/Arcnode.xyz/atauth.git
15
-
cd atauth
15
+
cd atauth/gateway
16
16
cp .env.example .env
17
+
```
18
+
19
+
Edit `.env` with your configuration. At minimum, set these required secrets:
17
20
18
-
# Generate admin token
19
-
echo "ADMIN_TOKEN=$(openssl rand -hex 32)" >> .env
21
+
```bash
22
+
# Generate and paste each value
23
+
openssl rand -hex 32 # for ADMIN_TOKEN
24
+
openssl rand -hex 32 # for OIDC_KEY_SECRET
25
+
openssl rand -hex 32 # for MFA_ENCRYPTION_KEY (produces 64 hex chars)
26
+
```
27
+
28
+
Also update `OAUTH_CLIENT_ID`, `OAUTH_REDIRECT_URI`, `OIDC_ISSUER`, and `WEBAUTHN_*` to match your domain.
20
29
21
-
# Set your public URL
22
-
# Edit .env: OAUTH_CLIENT_ID and OAUTH_REDIRECT_URI
30
+
Then start:
23
31
32
+
```bash
24
33
docker compose up -d
25
34
```
26
35
···
178
187
179
188
## Updating
180
189
190
+
Using the pre-built image from GHCR:
191
+
181
192
```bash
182
-
docker compose pull
193
+
docker pull ghcr.io/cache8063/atauth-gateway:latest
194
+
docker compose up -d
195
+
```
196
+
197
+
Or if building locally:
198
+
199
+
```bash
200
+
git pull
201
+
docker compose build
183
202
docker compose up -d
184
203
```
185
204