From b871d62de63f6b6883ab17512f5036fcc84f01c9 Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Sun, 19 Jul 2026 00:55:35 +0700
Subject: [PATCH] feat(auth): add environment variables for portal SSO
 integration

Introduced new environment variables for the authentication portal in the production and microvps configurations. Updated the documentation to clarify the necessity of passing these variables to the evobgp-all service. This change enhances the authentication flow by enabling single sign-on (SSO) capabilities through JWT, ensuring a more secure and streamlined user experience.
---
 deploy/compose/.env.production.example              |  7 +++++++
 deploy/compose/.env.stack.microvps-full.example     | 13 +++++++++++++
 .../compose/docker-compose.production.example.yaml  |  5 +++++
 deploy/compose/stack.microvps-full.yaml             |  6 ++++++
 docs/access.md                                      | 11 +++++++++++
 5 files changed, 42 insertions(+)

diff --git a/deploy/compose/.env.production.example b/deploy/compose/.env.production.example
index 814ddd2..94e4bac 100644
--- a/deploy/compose/.env.production.example
+++ b/deploy/compose/.env.production.example
@@ -15,3 +15,10 @@ WEBUI_DOMAIN=bgp.example.com
 WEBUI_IP_WHITELIST=203.0.113.10/32
 LETSENCRYPT_EMAIL=admin@example.com
 CF_DNS_API_TOKEN=
+
+# Auth-portal SSO → контейнер evobgp-all (не VITE_* — они только для build web)
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+EVOBGP_PORTAL_TENANT_ID=
diff --git a/deploy/compose/.env.stack.microvps-full.example b/deploy/compose/.env.stack.microvps-full.example
index a00122a..b7dc20b 100644
--- a/deploy/compose/.env.stack.microvps-full.example
+++ b/deploy/compose/.env.stack.microvps-full.example
@@ -27,3 +27,16 @@ AUTO_UPDATE_INTERVAL_SEC=300
 AUTO_UPDATE_SERVICES=evobgp-all,evobgp-web
 # Защищенные сервисы, которые updater никогда не перезапускает
 AUTO_UPDATE_PROTECTED_SERVICES=bird2
+
+# ---------------------------------------------------------------------------
+# Auth-portal SSO (прокидывается в контейнер evobgp-all)
+# VITE_* в runtime .env НЕ влияют на уже собранный web-образ —
+# UI читает GET /v1/auth/config с API (AUTH_REQUIRED / AUTH_PORTAL_URL).
+# ---------------------------------------------------------------------------
+AUTH_REQUIRED=true
+AUTH_JWT_SECRET=
+AUTH_ISSUER=https://auth.shnt.top
+AUTH_PORTAL_URL=https://auth.shnt.top
+# UUID tenant из БД (обязателен для JWT). При EVOBGP_SEED_DEMO=1 смотрите лог
+# старта evobgp-all / SELECT id FROM tenant LIMIT 1;
+EVOBGP_PORTAL_TENANT_ID=
diff --git a/deploy/compose/docker-compose.production.example.yaml b/deploy/compose/docker-compose.production.example.yaml
index 2745677..c839d6e 100644
--- a/deploy/compose/docker-compose.production.example.yaml
+++ b/deploy/compose/docker-compose.production.example.yaml
@@ -136,6 +136,11 @@ services:
       EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
       EVOBGP_SERVICE: evobgp-all
       EVOBGP_RUNTIME_LOGS_DIR: /opt/evobgp/runtime-logs
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-}
+      EVOBGP_PORTAL_TENANT_ID: ${EVOBGP_PORTAL_TENANT_ID:-}
       EVOBGP_DEV_INSECURE: "1"
     volumes:
       - bird_etc:/etc/bird
diff --git a/deploy/compose/stack.microvps-full.yaml b/deploy/compose/stack.microvps-full.yaml
index 31fb19a..ff8e3ec 100644
--- a/deploy/compose/stack.microvps-full.yaml
+++ b/deploy/compose/stack.microvps-full.yaml
@@ -138,6 +138,12 @@ services:
       EVOBGP_BIRD_STAGING_DIR: /tmp/evobgp-bird-staging
       EVOBGP_SERVICE: evobgp-all
       EVOBGP_RUNTIME_LOGS_DIR: /opt/evobgp/runtime-logs
+      # Portal SSO (JWT) — см. docs/access.md / auth-portal integrate-evobgp.md
+      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
+      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-}
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
+      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-}
+      EVOBGP_PORTAL_TENANT_ID: ${EVOBGP_PORTAL_TENANT_ID:-}
       # DEV ONLY — не для production (см. docs/access.md).
       EVOBGP_DEV_INSECURE: "1"
     volumes:
diff --git a/docs/access.md b/docs/access.md
index 17d94cb..5dfced2 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -14,6 +14,17 @@
 | `AUTH_PORTAL_URL` | URL портала (также `GET /v1/auth/config`) |
 | `EVOBGP_PORTAL_TENANT_ID` | Tenant для всех portal JWT (обязателен при JWT) |
 
+Compose: переменные `AUTH_*` / `EVOBGP_PORTAL_TENANT_ID` должны быть в `environment:` сервиса **`evobgp-all`** (см. `deploy/compose/stack.microvps-full.yaml`). Просто положить их в `.env` без проброса в контейнер недостаточно.
+
+`VITE_AUTH_*` в runtime `.env` **не** меняют уже собранный `evobgp-web` образ. UI берёт режим из `GET /v1/auth/config` (`required` ← `AUTH_REQUIRED`, `portal_url` ← `AUTH_PORTAL_URL`).
+
+Проверка после рестарта:
+
+```bash
+curl -sS https://bgp.shnt.top/v1/auth/config
+# {"required":true,"portal_url":"https://auth.shnt.top"}
+```
+
 Права — строки `bgp:<section>:<action>` из каталога портала (dashboard, modules, lookup, network, …). Apply/rollback требуют `bgp:operations:admin`.
 
 **Ownership:** modules, peers, firewall clients/rules с `created_by_user_id` видны создателю и portal `is_admin` (API keys — весь tenant).