KNetraHub Core API: auth, sessions, users, access control and the portal schema.
881
Core API ā the identity and admin service everything else trusts.
KNetraHub is a self-hosted IT operations portal: a Docker Swarm console, full-stack monitoring, work management, privileged access management, IP address management and a database workspace, behind one sign-in. It ships two ways ā as a single monolith image, or as the split stack of one image per service that this image belongs to.
š Documentation: https://sengphirum.github.io/KNetraHub/documentationā
Authentication, sessions, users/groups, per-app access, Admin (modules, settings, notifications, AI integrations, backups, logs), the portal database schema and its housekeeping. Provisions module databases when a module is enabled.
Owns authentication, sessions, users and groups, per-app access, the admin surfaces and the portal database schema. It issues the JWT that every other API verifies, and it provisions a module's database the first time that module is enabled.
It carries no module business logic, so a change to Monitoring or PAM never redeploys the service that holds your sessions.
Runs unprivileged with cap_drop: [ALL] and nothing added back.
| Image | Serves HTTP | Runs background jobs | Scale it with |
|---|---|---|---|
knetrahub-core-api (this image) | yes | no | request load |
knetrahub-appā | yes | yes | nothing ā it is one process |
Mandatory in a split stack: with it down, nothing else can authorise a request.
Read straight from the stack file that deploys this service, so the list is what the image actually takes. Optional entries ship commented out.
| Variable | Default | |
|---|---|---|
NUXT_APP_REPLICAS | 2 | set |
NUXT_DB_POOL_MAX | 20 | set |
NUXT_JWT_SECRET | change-me-to-a-long-random-string | set |
NUXT_JWT_SECRET_FILE | /run/secrets/knetrahub_jwt_secret | optional |
NUXT_ENV_MODE | staging | optional |
NUXT_PUBLIC_APP_URL | https://knetrahub.example.com | optional |
NUXT_DB_PASSWORD_FILE | /run/secrets/knetrahub_db_password | optional |
NUXT_DB_HOST | timescaledb | set |
NUXT_DB_PORT | 5432 | set |
NUXT_DB_NAME | knetrahub | set |
NUXT_DB_USER | knetrahub | set |
NUXT_DB_PASSWORD | change-me-to-a-long-random-string | set |
KNETRA_INTERNAL_TOKEN_FILE | /run/secrets/knetrahub_internal_token | optional |
KNETRA_REQUIRE_INTERNAL_TOKEN | false | optional |
KNETRA_RESTORE_SUSPEND_GRACE_MS | 15000 | optional |
NUXT_BACKUP_DIR | /app/data/backups | set |
NUXT_SMTP_ENABLED | true | optional |
NUXT_SMTP_HOST | smtp.example.com | optional |
NUXT_SMTP_PORT | 587 | optional |
NUXT_SMTP_ENCRYPTION | starttls | optional |
NUXT_SMTP_USERNAME | knetrahub | optional |
NUXT_SMTP_PASSWORD_FILE | /run/secrets/knetrahub_smtp_password | optional |
NUXT_SMTP_FROM_ADDRESS | [email protected] | optional |
NUXT_LOCAL_AUTH_HIDE_LOGIN | false | set |
NUXT_LOCAL_AUTH_SESSION_TIMEOUT_MINUTES | 720 | set |
NUXT_LOCAL_AUTH_PASSWORD_MIN_LENGTH | 8 | set |
NUXT_LOCAL_AUTH_PASSWORD_REQUIRE_UPPERCASE | false | set |
NUXT_LOCAL_AUTH_PASSWORD_REQUIRE_LOWERCASE | false | set |
NUXT_LOCAL_AUTH_PASSWORD_REQUIRE_NUMBER | false | set |
NUXT_LOCAL_AUTH_PASSWORD_REQUIRE_SPECIAL | false | set |
NUXT_LDAP_ENABLED | false | set |
NUXT_OIDC_ENABLED | false | set |
NUXT_OIDC_ISSUER | https://keycloak.example.com/realms/main | optional |
NUXT_OIDC_CLIENT_ID | knetrahub | optional |
NUXT_OIDC_CLIENT_SECRET_FILE | /run/secrets/knetrahub_oidc_client_secret | optional |
NUXT_OIDC_ADMIN_GROUP | swarm-admins | optional |
NUXT_OIDC_OPERATOR_GROUP | swarm-operators | optional |
Anything ending in _FILE reads its value from that path instead, which is how the stack passes Docker secrets.
This is one service of a stack, not a standalone container: it expects the portal database and its siblings on the same overlay network. Deploy it with the stack file that owns it rather than with docker run.
docker stack deploy -c docker/docker-compose.yml knetrahub
Pin a tag or a registry for this one service with KNETRAHUB_CORE_API_IMAGE, which the stack file reads:
export KNETRAHUB_CORE_API_IMAGE=phirumseng/knetrahub-core-api:0.1.11
latest ā the most recent releasex.y.z (e.g. 0.1.11) ā immutable release versionsPin the version in production. A rollback needs a tag that does not move, and every image in the stack is released under the same version so the whole set can be pinned together.
Each service is its own image, so one can be updated without restarting the others:
phirumseng/knetrahub-appā ā Monolith (app)phirumseng/knetrahub-uiā ā UIphirumseng/knetrahub-core-api ā Core API ā this imagephirumseng/knetrahub-docker-apiā ā Docker APIphirumseng/knetrahub-docker-workerā ā Docker workerphirumseng/knetrahub-monitoring-apiā ā Monitoring APIphirumseng/knetrahub-monitoring-workerā ā Monitoring workerphirumseng/knetrahub-work-apiā ā Work APIphirumseng/knetrahub-work-workerā ā Work workerphirumseng/knetrahub-pam-apiā ā Privileged Access APIphirumseng/knetrahub-pam-workerā ā Privileged Access workerphirumseng/knetrahub-ipmgt-apiā ā IP Management APIphirumseng/knetrahub-ipmgt-workerā ā IP Management workerphirumseng/knetrahub-dbmanager-apiā ā Database Manager APIphirumseng/knetrahub-agentā ā node agentphirumseng/knetrahub-pam-ssh-gatewayā ā PAM SSH gatewayphirumseng/knetrahub-pam-connector-runnerā ā PAM connector runnerphirumseng/knetrahub-dbmanager-gatewayā ā DB Manager gatewayProprietary ā Ā© Seng Phirum. All rights reserved.
Content type
Image
Digest
sha256:f1d4dcf6cā¦
Size
63.9 MB
Last updated
7 days ago
docker pull phirumseng/knetrahub-core-api