Sign inSign up

klardo/ident-admin-ui

By klardo

•Updated 2 days ago

Standalone admin console for the KlardoIdent authorization server

Image
0

1.8K

klardo/ident-admin-ui repository overview

⁠KlardoIdent Admin UI

The standalone admin console for the KlardoIdent⁠ OAuth 2.0 / OpenID Connect authorization server — a static React app served by nginx, configured at container start.

⁠Quick reference

  • Maintained by: Klardo GmbH
  • Supported architectures: linux/amd64, linux/arm64
  • Tags: X.Y.Z (immutable release) and X.Y (moves with each patch) — run a version your server satisfies
    • There is no :latest and no bare :X tag during the 0.x beta, for the reason the server image gives, plus one of its own: this UI declares a min_server_version floor, so a tag that crossed minors could pull a bundle your server does not satisfy.
    • X.Y.Z is the reproducible pin. X.Y is the auto-update channel: it moves only with patches, which never raise the floor.
  • Exposes: 8080
  • Signed: cosign keyless, per repository

⁠Quick start

docker run -p 8081:8080 \
  -e SERVER_BASE_URL="https://auth.example.com" \
  -e DEFAULT_REALM="master" \
  klardo/ident-admin-ui:0.5

The UI authenticates cross-origin (OIDC + PKCE), so its own origin must be registered on the target realm's admin client:

kident admin-origin set --realm master --url https://admin.example.com

⁠Configuration

VariableDefaultNotes
SERVER_BASE_URLemptyOrigin of the KlardoIdent server. Empty means the app calls its own origin.
ADMIN_BASE_URLSERVER_BASE_URLSeparate origin for the admin API, when the admin plane is deployed apart from auth.
DEFAULT_REALMmasterRealm to administer when the URL carries no realm path. Set it explicitly EMPTY to declare no default: the bare origin then asks which realm to administer, which is what a multi-tenant origin wants.
UMAMI_SCRIPT_URLemptyURL of a self-hosted Umami⁠ tracker script. Empty, the default, loads no script and makes no request. Prefer a path on the console's own origin, proxied to Umami (e.g. https://app.example.com/analytics/umami.js): a request to a host named analytics. is what content blockers and VPN DNS filters drop. Umami derives its collect endpoint from the script's directory, so the proxy must answer <dir>/api/send too.
UMAMI_WEBSITE_IDemptyThe Umami website id to report into. Both variables must be set for the tracker to load.

These are written into /usr/share/nginx/html/config.js on each container start, so one image runs in every environment, no rebuild per deployment.

Analytics are OFF unless both UMAMI_* variables are set, which is what a self-hosted install wants: no tracker is loaded and no request leaves the browser, rather than a tracker that is present and disabled. When they are set, what the page reports is the ROUTE PATTERN (/users/:id), never the URL the browser is on: that URL carries the realm as its first path segment and object ids in its hash route. The referrer is trimmed to its origin for the same reason.

⁠Verifying an image

docker buildx imagetools inspect docker.io/klardo/ident-admin-ui:0.5 --format '{{.Manifest.Digest}}'

cosign verify docker.io/klardo/ident-admin-ui:0.5 \
  --certificate-identity-regexp '^https://github.com/klardo-gmbh/identcontrol/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The signing identity is the release workflow in the (private) build repository — the certificate is what you verify against, no repository access needed.

⁠Licence

Commercial software, © Klardo GmbH. The licence terms ship with the image and with the on-prem package. Evaluation and subscription terms: https://klardo-ident.com⁠.

Tag summary

Content type

Image

Digest

sha256:7fcd34887…

Size

20.5 MB

Last updated

2 days ago

docker pull klardo/ident-admin-ui:0.7