sch0maker/printauth repository overview

⁠PrintAuth

A simple Klipper-focused authorization client you can drop in front of Fluidd (or any HTTP UI). It runs as a tiny Rails app behind your reverse proxy, checks /auth/check, and redirects unauthenticated users to /auth. Works best behind Nginx/Cloudflared for remote access.

⁠What you get

• /auth/check returns 200 if the session is authenticated, 401/403/429 otherwise.
• /auth renders the login form; /auth POST sets a session cookie.
• Rack::Attack throttling and ban-by-IP baked in.
• Static assets served by the app (no extra web server needed in-container).

⁠Environment variables

• PRINTAUTH_USER – Username (default: admin).
• PRINTAUTH_PASSWORD – Password (default: changeme). Quote it if it contains # or special chars.
• PRINTAUTH_SECRET_KEY_BASE – Required secret; generate with ruby -e "require 'securerandom'; puts SecureRandom.hex(64)".
• PRINTAUTH_MASTER_KEY – From config/master.key in this repo (or your own credentials).
• PORT – Container listen port (default: 3080).

⁠Quick start (standalone)

cd printauth
docker compose -f example.docker-compose.yml up -d
# or build manually
docker build -t printauth .
docker run -d --name printauth \
  -p 3080:3080 \
  -e PRINTAUTH_USER=admin \
  -e PRINTAUTH_PASSWORD='pass!#123' \
  -e PRINTAUTH_SECRET_KEY_BASE=$(ruby -e "require 'securerandom'; puts SecureRandom.hex(64)") \
  -e PRINTAUTH_MASTER_KEY=$(cat config/master.key) \
  printauth

⁠Reverse proxy (Nginx)

Point your proxy at the app and gate upstream Fluidd. Example:

upstream printauth_upstream { server 127.0.0.1:3080; }
upstream fluidd_upstream   { server 127.0.0.1:7125; } # adjust to your Fluidd/Moonraker port

server {
  listen 8080; server_name print.local;

  auth_request /auth_check;
  error_page 401 = @auth_failed;
  error_page 403 = @auth_failed;
  error_page 429 = @auth_failed;

  location = /auth_check {
    internal;
    proxy_pass http://printauth_upstream/auth/check;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /auth {
    auth_request off;
    proxy_pass http://printauth_upstream;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location @auth_failed {
    return 302 https://$host/auth?redirect=$scheme://$host$request_uri;
  }

  location / {
    proxy_pass http://fluidd_upstream;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_read_timeout 600;
    proxy_send_timeout 600;
  }
}

⁠Cloudflared

• Keep TLS termination at Cloudflare.
• Tunnel your host to your Nginx listener (e.g. http://127.0.0.1:3087).
• Set originRequest.noTLS: true in Cloudflared if your origin is plain HTTP.

⁠Customizing Fluidd target

Change fluidd_upstream in Nginx to point at your Fluidd/Moonraker IP:port. Nothing in the app is Fluidd-specific—the auth proxy sits in front of any HTTP app.

⁠Rate limits / bans

Configured in config/initializers/rack_attack.rb:

• Throttle: 60 req/min/IP (429).
• Allow2Ban: 20 hits in 20s → 10-minute ban (403). Tune to taste.

⁠Development

bundle install
bin/rails s

Remember to export PRINTAUTH_SECRET_KEY_BASE and PRINTAUTH_MASTER_KEY even for local production runs. Static assets are precompiled in the Docker image; use bin/rails assets:precompile if you change CSS.