Add authentication with TOTP two-factor to the admin panel

deploy/all-in-one-traefik/README.md

@@ -15,7 +15,8 @@ docker network create proxy
 docker compose -f docker-compose.yml up -d
 ```
 
-The admin panel is then available at http://admin.docker.localhost/ with the
-user `admin` and the password `openmu` —
-[change that](../../docs-website/docs/admin-panel/users.md) before the server is
+The admin panel is then available at http://admin.docker.localhost/. Until the
+first user exists it lets you in without a login, so
+[create one](../../docs-website/docs/admin-panel/users.md) — or set
+`OPENMU_ADMIN_USER` and `OPENMU_ADMIN_PASSWORD` beforehand — before the server is
 reachable from the internet.

deploy/all-in-one-traefik/docker-compose-all-in-one-traefik.dcproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="15.0" Sdk="Microsoft.Docker.Sdk">
   <PropertyGroup Label="Globals">
     <ProjectVersion>2.1</ProjectVersion>
@@ -18,7 +18,6 @@
     </None>
     <None Include=".dockerignore" />
     <None Include=".gitignore" />
-    <None Include=".htpasswd" />
     <None Include="README.md" />
   </ItemGroup>
 </Project>

deploy/all-in-one-traefik/docker-compose.prod.yml

@@ -16,17 +16,13 @@ services:
     environment:
       DB_HOST: database
     working_dir: /app/
-    volumes:
-      - ./.htpasswd:/etc/nginx/.htpasswd
     depends_on:
       - database
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
       - "traefik.http.routers.openmu.entrypoints=websecure"
       - "traefik.http.routers.openmu.rule=Host(`${DOMAIN}`)"
-      - "traefik.http.routers.openmu.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.usersfile=.htpasswd"
 
   database:
     image: postgres
@@ -57,7 +53,6 @@ services:
       - ./data-traefik/traefik.yml:/traefik.yml:ro
       - ./data-traefik/acme.json:/acme.json
       - ./data-traefik/configurations:/configurations
-      - "./.htpasswd:/.htpasswd"
     networks:
       - proxy
     labels:

deploy/all-in-one-traefik/docker-compose.yml

@@ -15,18 +15,22 @@ services:
       - "55980:55980"
     environment:
       DB_HOST: database
-    working_dir: /app/
+      # Optional bootstrap admin panel user. Without it, the admin panel is reachable
+      # without a login until the first user has been created within the panel itself.
+      OPENMU_ADMIN_USER: ${OPENMU_ADMIN_USER:-}
+      OPENMU_ADMIN_PASSWORD: ${OPENMU_ADMIN_PASSWORD:-}
+      # Optional base32 TOTP secret, if the bootstrap user should require a second factor.
+      OPENMU_ADMIN_TOTP_SECRET: ${OPENMU_ADMIN_TOTP_SECRET:-}
     volumes:
-      - ./.htpasswd:/etc/nginx/.htpasswd
+      - adminpanel-keys:/app/data-protection-keys
+    working_dir: /app/
     depends_on:
       - database
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"
       - "traefik.http.routers.openmu.entrypoints=web"
       - "traefik.http.routers.openmu.rule=Host(`admin.docker.localhost`)"
-      - "traefik.http.routers.openmu.middlewares=auth"
-      - "traefik.http.middlewares.auth.basicauth.usersfile=.htpasswd"
 
   database:
     image: postgres
@@ -56,7 +60,6 @@ services:
       - "80:80"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
-      - "./.htpasswd:/.htpasswd"
     networks:
       - proxy
 
@@ -65,4 +68,5 @@ networks:
     external: true
 
 volumes:
+  adminpanel-keys:
   dbdata:

deploy/all-in-one/docker-compose-all-in-one.dcproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="15.0" Sdk="Microsoft.Docker.Sdk">
   <PropertyGroup Label="Globals">
     <ProjectVersion>2.1</ProjectVersion>
@@ -19,7 +19,6 @@
     </None>
     <None Include="docker-compose.yml" />
     <None Include=".dockerignore" />
-    <None Include=".htpasswd" />
     <None Include="nginx\nginx.dev.conf" />
     <None Include="nginx\nginx.prod443.conf" />
     <None Include="nginx\nginx.prod80.conf" />

deploy/all-in-one/docker-compose.prod.yml

@@ -13,7 +13,6 @@ services:
       DOMAIN_NAME: ${DOMAIN_NAME}
     volumes:
       - ./nginx/nginx.prod80.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd
       - ./certbot/www:/var/www/certbot/:ro
       - ./nginx/templates/nginx.server_name.conf.template:/etc/nginx/templates/nginx.server_name.conf.template:ro
 
@@ -32,7 +31,6 @@ services:
       - "443:443"
     volumes:
       - ./nginx/nginx.prod443.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd
       - ./certbot/conf/:/etc/nginx/ssl/:ro
       - ./nginx/templates/nginx.server_name.conf.template:/etc/nginx/templates/nginx.server_name.conf.template:ro
       - ./nginx/templates/nginx.prod.certificates.conf.template:/etc/nginx/templates/nginx.prod.certificates.conf.template:ro

deploy/all-in-one/docker-compose.yml

@@ -6,7 +6,6 @@ services:
       - "80:80"
     volumes:
       - ./nginx/nginx.dev.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd
     depends_on:
       - openmu-startup
 
@@ -27,9 +26,15 @@ services:
     environment:
       DB_HOST: database
       ASPNETCORE_URLS: http://+:8080
-    working_dir: /app/
+      # Optional bootstrap admin panel user. Without it, the admin panel is reachable
+      # without a login until the first user has been created within the panel itself.
+      OPENMU_ADMIN_USER: ${OPENMU_ADMIN_USER:-}
+      OPENMU_ADMIN_PASSWORD: ${OPENMU_ADMIN_PASSWORD:-}
+      # Optional base32 TOTP secret, if the bootstrap user should require a second factor.
+      OPENMU_ADMIN_TOTP_SECRET: ${OPENMU_ADMIN_TOTP_SECRET:-}
     volumes:
-      - ./.htpasswd:/etc/nginx/.htpasswd
+      - adminpanel-keys:/app/data-protection-keys
+    working_dir: /app/
     depends_on:
       - database
 
@@ -46,4 +51,5 @@ services:
       - dbdata:/var/lib/postgresql #store data on volume
 
 volumes:
+  adminpanel-keys:
   dbdata:

deploy/all-in-one/nginx/nginx.dev.conf

@@ -9,9 +9,6 @@ http {
     }
 
   server {
-    auth_basic           "Protected Site";
-    auth_basic_user_file /etc/nginx/.htpasswd;
-
     listen 80;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;

deploy/all-in-one/nginx/nginx.prod443.conf

@@ -15,8 +15,6 @@ http {
         include conf.d/nginx.server_name.conf;
         include conf.d/nginx.prod.certificates.conf;
 
-        auth_basic           "Protected Site";
-        auth_basic_user_file /etc/nginx/.htpasswd;
 
         listen 80;
         proxy_http_version 1.1;

deploy/distributed/docker-compose.dcproj

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="15.0" Sdk="Microsoft.Docker.Sdk">
   <PropertyGroup Label="Globals">
     <ProjectVersion>2.1</ProjectVersion>
@@ -24,7 +24,6 @@
     </None>
     <None Include="docker-compose.yml" />
     <None Include=".dockerignore" />
-    <None Include=".htpasswd" />
     <None Include="grafana.ini" />
     <None Include="grafana_datasources.yaml" />
     <None Include="loki-config.yaml" />

deploy/distributed/docker-compose.prod.yml

@@ -10,7 +10,6 @@ services:
     volumes:
       - ./nginx.server_name.conf.template:/etc/nginx/templates/nginx.server_name.conf.template
       - ./nginx.prod80.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd
       - certbot-www:/var/www/certbot/:ro
 
 # We add another nginx here, just for HTTPs.
@@ -30,7 +29,6 @@ services:
       - ./nginx.server_name.conf.template:/etc/nginx/templates/nginx.server_name.conf.template
       - ./nginx.prod.certificates.conf.template:/etc/nginx/templates/nginx.prod.certificates.conf.template
       - ./nginx.prod443.conf:/etc/nginx/nginx.conf:ro
-      - ./.htpasswd:/etc/nginx/.htpasswd
       - certificates:/etc/nginx/ssl/:ro
     depends_on:
       - grafana

deploy/distributed/docker-compose.yml

@@ -1,4 +1,5 @@
 volumes:
+  adminpanel-keys:
   dbdata:
   prometheus-data:
   minio-data:
@@ -12,7 +13,6 @@ services:
       - "80:80"
     volumes:
       - ./nginx.dev.conf:/etc/nginx/nginx.conf
-      - ./.htpasswd:/etc/nginx/.htpasswd
     depends_on:
       - grafana
       - zipkin
@@ -256,8 +256,14 @@ services:
     environment:
       ASPNETCORE_URLS: http://+:8080
       PATH_BASE: /admin/
+      # Optional bootstrap admin panel user. Without it, the admin panel is reachable
+      # without a login until the first user has been created within the panel itself.
+      OPENMU_ADMIN_USER: ${OPENMU_ADMIN_USER:-}
+      OPENMU_ADMIN_PASSWORD: ${OPENMU_ADMIN_PASSWORD:-}
+      # Optional base32 TOTP secret, if the bootstrap user should require a second factor.
+      OPENMU_ADMIN_TOTP_SECRET: ${OPENMU_ADMIN_TOTP_SECRET:-}
     volumes:
-      - ./.htpasswd:/etc/nginx/.htpasswd
+      - adminpanel-keys:/app/data-protection-keys
 
   adminPanel-dapr:
     image: "daprio/daprd:latest"

deploy/distributed/nginx.dev.conf

@@ -9,9 +9,6 @@ http {
     }
 
   server {
-    auth_basic           "Protected Site";
-    auth_basic_user_file /etc/nginx/.htpasswd;
-
     listen 80;
     proxy_http_version 1.1;
     proxy_set_header Upgrade $http_upgrade;
@@ -54,7 +51,6 @@ http {
     # Public API
     location ~ (/serverInfo)(.*) {
        proxy_pass http://connectServer:8080/serverInfo$2;
-       auth_basic off;
     }
 
     # Game Servers:

deploy/distributed/nginx.prod443.conf

@@ -15,8 +15,6 @@ http {
         include conf.d/nginx.server_name.conf;
         include conf.d/nginx.prod.certificates.conf;
 
-        auth_basic           "Protected Site";
-        auth_basic_user_file /etc/nginx/.htpasswd;
 
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
@@ -59,7 +57,6 @@ http {
         # Public API
         location ~ (/serverInfo)(.*) {
            proxy_pass http://connectServer:8080/serverInfo$2;
-           auth_basic off;
         }
 
         # Game Servers: