Oier Bravo Urtasun
67d1f82e6a
Collapse the override-file matrix into a single docker-compose.yml holding the whole stack: drasl, minecraft, mc-backup, caddy, nmsr, uptime-kuma. Bring-up is now just `docker compose up -d --build`. Removed features (dead-ends for this deployment): - airgap / full asset mirror (mirror-airgap.sh, mirror-mods.sh, 20-mirror.caddy, caddy local-CA export, /ca.crt) - dnsmasq + avahi/mDNS + dns-records.sh + mdns-host-setup.sh + ENABLE_MDNS; DNS is now handled outside this repo (HOST_LAN_IP dropped) - Blessing Skin auth variant (compose + 00-core-blessingskin.caddy + BS_* env) - host-nginx-static variant (docker-compose.nginx.yml, nginx/ulicraft.conf.tmpl) - build-stack.sh and its run modes (online/airgap/core) Production ingress is the only path now: host nginx terminates TLS (LE certs) in front of caddy on a localhost-only port; caddy routes every vhost by Host header. Launcher downloads move mirror/launcher -> launcher/. Docs: README, deploy skill, and plan/ rewritten to match; obsolete plan docs (dnsmasq, blessing-skin, assets-mirror, full-airgap-mirror, dns-and-run-modes) deleted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
53 lines
2.0 KiB
Markdown
53 lines
2.0 KiB
Markdown
# Drasl — self-hosted auth (Yggdrasil + skins)
|
|
|
|
## Summary
|
|
|
|
Self-hosted, Yggdrasil-compatible auth + skin server. Drop-in Mojang replacement
|
|
via authlib-injector. Image: `unmojang/drasl:latest`. Reached only through Caddy
|
|
at `auth.ulicraft.net`; no host port.
|
|
|
|
**OIDC/Keycloak is OUT for now** — drasl runs in **password-login** mode
|
|
(`AllowPasswordLogin = true`). Admin + guests register with a username/password on
|
|
the drasl web UI. Re-introducing Keycloak OIDC later is a future task.
|
|
|
|
Config is **TOML only** (no env var support). So `config.toml` is rendered from
|
|
`config.toml.tmpl` by `tooling/render-config.sh` to inject `BASE_DOMAIN`.
|
|
|
|
## config.toml.tmpl (key fields)
|
|
|
|
```toml
|
|
BaseURL = "http://auth.${BASE_DOMAIN}"
|
|
Domain = "auth.${BASE_DOMAIN}"
|
|
ListenAddress = "0.0.0.0:25585" # internal; Caddy proxies
|
|
DefaultAdminUsernames = ["admin"]
|
|
|
|
AllowPasswordLogin = true
|
|
|
|
[ApplicationOwner]
|
|
# ...
|
|
|
|
# OIDC block intentionally omitted for now (no Keycloak).
|
|
# [[RegistrationOIDC]] ← future
|
|
```
|
|
|
|
## Critical gotchas (carry-over)
|
|
|
|
- **1.21+ secure profile**: drasl `SignPublicKeys = false` MUST pair with server
|
|
`ENFORCE_SECURE_PROFILE=FALSE`. Linked — both or neither.
|
|
- **authlib endpoint** = `BaseURL` + `/authlib-injector` →
|
|
`http://auth.ulicraft.net/authlib-injector`. Must match on server and client.
|
|
Network alias makes this identical inside/outside the stack.
|
|
- **`Domain` affects skins** — if wrong, authlib clients may not see skins.
|
|
|
|
## Tasks
|
|
|
|
- [ ] Create `drasl/config/config.toml.tmpl` (password-login, no OIDC block)
|
|
- [ ] Set `BaseURL`/`Domain` to `auth.${BASE_DOMAIN}`, `ListenAddress 0.0.0.0:25585`
|
|
- [ ] Set `SignPublicKeys = false`
|
|
- [ ] Wire `render-config.sh` → `drasl/config/config.toml` (gitignored)
|
|
- [ ] Remove drasl host port from compose (internal only)
|
|
- [ ] Update compose: drasl on `mcnet`, no `25585:25585` publish
|
|
- [ ] Bootstrap admin account on first run; create guest accounts
|
|
- [ ] Verify authlib endpoint responds through Caddy
|
|
- [ ] Future: re-add `[[RegistrationOIDC]]` Keycloak block + secret file
|