notakey/auth-server repository overview

⁠Notakey Authentication Server

This is the main service for Notakey solution on-premise deployment. This container communicates with devices and API consumers (web authentication plugins, RADIUS proxy) and provides UI for key exchange and management.

⁠Deployment

This container provides a plain HTTP interface on port 5000, that has to be published using reverse proxy of your choice. The underlying framework expects the following headers to be set by reverse proxy.

⁠How to use this image

# start reverse proxy
docker run -d \
    -p 443:443 \
    -p 8080:8080 \
    -v $PWD/traefik.yml:/etc/traefik/traefik.yml \
    -v /var/run/docker.sock:/var/run/docker.sock \
    traefik:latest

# start consul
docker run -d \
    --name consul \
    -e CONSUL_LOCAL_CONFIG='{}' \
    -v devdata:/consul/data \
    -v devconfig:/consul/config \
    -p 8500:8500 \
    consul:latest \
    agent \
    -server \
    -node=devroot \
    -advertise=127.0.0.1 \
    -ui \
    -client=0.0.0.0 \
    -bind=0.0.0.0 \
    -bootstrap-expect=1

# start auth server
docker run -d \
    --name my-auth-server \
    -e CLUSTER_BACKEND=http://172.17.0.1:8500/my-auth-server
    -e SECRET_KEY_BASE=820e823802e0de141cdcf735b047323d937bc5bad785600c5e310beab63654b3846bfa8f93a5be91ecc64030561cc81cab06f66865536ad4b2918a74e246beb9 \
    notakey/auth-server:latest

Please see Consul and Traefik documentation for configuration details.

⁠Documentation

Administration and API integration manual is available on documentation.notakey.com⁠.

⁠Configuration

Container configuration is done using ENV variables and docker secrets. Commonly used configuration parameters are described below.

⁠SECRET_KEY_BASE

Required

This is the encryption key for management sessions.

SECRET_KEY_BASE=820e823802e0de141cdcf735b047323d937bc5bad785600c5e310beab63654b3846bfa8f93a5be91ecc64030561cc81cab06f66865536ad4b2918a74e246beb9

⁠SECRET_KEY_BASE_FILE

Required

Path to file containing SECRET_KEY_BASE value, for use with docker secrets.

SECRET_KEY_BASE_FILE=/var/secret/SECRET_KEY_BASE

⁠CLUSTER_BACKEND

Required

This is the URL where all persistence state (keys, users, services) will be stored. This needs to point to a Consul instance. The form should be:

CLUSTER_BACKEND=http://consul-host:8500/application-name

Where 8500 is the Consul client port, and "application-name" is the root folder in Consul's KV store, where all data should be stored.

⁠REDIS_BACKEND

Optional

This is the URL where all persistence state (keys, users, services) will be stored if REDIS is used for persistence(USE_REDIS=1). The form should be:

REDIS_BACKEND=redis://redis-host:6379/application-name

⁠USE_REDIS

Optional

When set to 1 (USE_REDIS=1) enables persistence storage in REDIS server provided by REDIS_BACKEND. Disabled by default.

USE_REDIS=1

⁠REDIS_URL

Optional

This is the URL for distributed cache storage. If deploying service with multiple instances, e.g. in docker swarm or k8s this value must be set. The form should be:

REDIS_URL=redis://redis-host:8500/application-name

⁠NOTAKEY_MESSENGER_URL

Optional

This should point to the Notakey Messenger service API (without version). Defaults to https://messenger.notakey.com/api⁠. Set to "off" to disable push notifications.

⁠LOG_LEVEL

Optional

Service logging level (debug, info (default), error ...) for logs sent to container stdout.

LOG_LEVEL=info

⁠TZ

Optional

Timezone for container (affects logging timestamps and DST changes). Defaults to UTC.

TZ=Europe/Riga

⁠MGMT_PORT

This is the external management port on reverse proxy that is serving authentication server management UI. Defaults to 443 - management is provided togather with device and consumer API. Compared to value provided in X-Forwarded-Port set by reverse proxy.

MGMT_PORT=8443

⁠SERVICE_FQDN

Optional

External DNS domain name that is used by end users (this is no service domain). Typically this is the same value as for X-Forwarded-Host header for non-management HTTP requests.

SERVICE_FQDN=ntk.mydomain.net

⁠PORT

Optional

Internal container port to provide HTTP service. Defaults to 5000.

PORT=3000

⁠PHONE_COUNTRY_CODE

Optional

Attempt to complete phone numbers to get international format by adding this prefix for sending onboarding SMS messages, if number is incomplete.

PHONE_COUNTRY_CODE=371

⁠AUTH_REQUEST_STORAGE_DAYS

Optional

Number of days to store signed auth requests.

AUTH_REQUEST_STORAGE_DAYS=10

⁠AUTH_LOG_STORAGE_DAYS

Optional

Number of days to store authentication activity history.

AUTH_LOG_STORAGE_DAYS=60

⁠ONBOARDING_LOG_STORAGE_DAYS

Optional

Number of days to store onboarding activity history.

ONBOARDING_LOG_STORAGE_DAYS=90

⁠ACCESS_TOKEN_TTL

Optional

Time-to-live in seconds for API access tokens, defaults to 2h.

ACCESS_TOKEN_TTL=7200

⁠LOG_SYSLOG

Optional

Syslog server IP address for request and technical logs.

LOG_SYSLOG=192.168.4.100

⁠SYSLOG_LEVEL

Optional

Syslog minimal log severity, as integer, see: log severity levels⁠

SYSLOG_LEVEL=3

⁠RAILS_CACHE_TTL

Optional

Time-to-live in seconds for application cache, defaults to 1h.

RAILS_CACHE_TTL=3600