Do basic auth in Caddy, but delegating user/pass auth to kemal

TODO.md

@@ -19,6 +19,7 @@
 * ✅ Streaming responses in slow operations like scaling down
   or building
 * Make more things configurable / remove hardcoded stuff
+  * admin/admin auth
 * CD for binaries and images for at least arm64/x86
 * Multi-container docker logs [faaso logs -f FUNKO]
 * ✅ Direct error and above to stderr, others to stdout,

config/Caddyfile

@@ -1,18 +1,21 @@
 {
-  http_port 8888
-  https_port 8887
-  local_certs
+	http_port 8888
+	https_port 8887
+	local_certs
 }
 
 http://*:8888 {
-	basicauth /admin/* {
-		admin {$FAASO_PASSWORD}
+	forward_auth /admin/* http://127.0.0.1:3000 {
+		uri http://127.0.0.1:3000
+		copy_headers {
+			Authorization
+		}
 	}
 
-  handle_path /admin/terminal/* {
-    reverse_proxy /* http://127.0.0.1:7681
-  }
-  handle_path /admin/* {
-    reverse_proxy /* http://127.0.0.1:3000
-  }
+	handle_path /admin/terminal/* {
+		reverse_proxy /* http://127.0.0.1:7681
+	}
+	handle_path /admin/* {
+		reverse_proxy /* http://127.0.0.1:3000
+	}
 }

shard.lock

@@ -44,6 +44,10 @@ shards:
     git: https://github.com/kemalcr/kemal.git
     version: 1.5.0
 
+  kemal-basic-auth:
+    git: https://github.com/kemalcr/kemal-basic-auth.git
+    version: 1.0.0
+
   radix:
     git: https://github.com/luislavena/radix.git
     version: 0.4.1

shard.yml

@@ -28,6 +28,8 @@ dependencies:
     branch: add_exposed_ports
   kemal:
     github: kemalcr/kemal
+  kemal-basic-auth:
+    github: kemalcr/kemal-basic-auth
   rucksack:
     github: busyloop/rucksack
   inotify:

src/daemon/main.cr

@@ -5,9 +5,12 @@ require "./terminal.cr"
 require "compress/gzip"
 require "crystar"
 require "docr"
+require "kemal-basic-auth"
 require "kemal"
 require "uuid"
 
+basic_auth "admin", "admin"
+
 macro version
   "{{ `grep version shard.yml | cut -d: -f2` }}".strip()
 end

src/daemon/proxy.cr

@@ -30,24 +30,25 @@ module Proxy
     containers = docker_api.containers.list(all: true)
     config = <<-CONFIG
 {
-  http_port 8888
-  https_port 8887
-  local_certs
+	http_port 8888
+	https_port 8887
+	local_certs
 }
 
 http://*:8888 {
-	basicauth /admin/* {
-		admin {$FAASO_PASSWORD}
+	forward_auth /admin/* http://127.0.0.1:3000 {
+		uri http://127.0.0.1:3000
+		copy_headers {
+			Authorization
+		}
 	}
 
-  handle_path /admin/terminal/* {
-    reverse_proxy /* http://127.0.0.1:7681
-  }
-  handle_path /admin/* {
-    reverse_proxy /* http://127.0.0.1:3000
-  }
-
-
+	handle_path /admin/terminal/* {
+		reverse_proxy /* http://127.0.0.1:7681
+	}
+	handle_path /admin/* {
+		reverse_proxy /* http://127.0.0.1:3000
+	}
 CONFIG
 
     funkos = Funko::Funko.from_docker