mirror of
https://github.com/Zproger/Aurum.git
synced 2026-10-13 02:56:39 +07:00
fe9b079c12
Aurum — a self-hosted personal finance operating system: cash flow, net worth tracking, budgets, goals, recurring payments, reports, proactive alerts, and a compound-interest returns calculator, all bilingual (RU/EN) and mobile-first. Ships as a three-container Docker Compose stack (Postgres + FastAPI + nginx-served React frontend). See README.md for setup and CONTRIBUTING.md for development.
33 lines
1.6 KiB
Bash
33 lines
1.6 KiB
Bash
#!/bin/sh
|
|
# Runs automatically before nginx starts (official nginx image convention:
|
|
# every executable script in /docker-entrypoint.d/ is sourced on boot).
|
|
#
|
|
# Aurum's backend has no login system by design (see backend/app/main.py) —
|
|
# it's built for one person self-hosting their own instance, not a
|
|
# multi-tenant service. That means whoever can reach this container can
|
|
# read, edit, and delete all financial data with no password at all. This
|
|
# script is the only gate in front of that: if AURUM_BASIC_AUTH_USER and
|
|
# AURUM_BASIC_AUTH_PASSWORD are set, it turns on HTTP Basic Auth for the
|
|
# whole app (UI + API) at the nginx layer, in front of everything except
|
|
# the health check endpoint (which must stay reachable for Docker's own
|
|
# HEALTHCHECK and external uptime monitors).
|
|
set -eu
|
|
|
|
AUTH_FRAGMENT=/etc/nginx/basic-auth.conf
|
|
|
|
if [ -n "${AURUM_BASIC_AUTH_USER:-}" ] && [ -n "${AURUM_BASIC_AUTH_PASSWORD:-}" ]; then
|
|
HASH="$(openssl passwd -apr1 "$AURUM_BASIC_AUTH_PASSWORD")"
|
|
echo "${AURUM_BASIC_AUTH_USER}:${HASH}" > /etc/nginx/.htpasswd
|
|
cat > "$AUTH_FRAGMENT" <<EOF
|
|
auth_basic "Aurum";
|
|
auth_basic_user_file /etc/nginx/.htpasswd;
|
|
EOF
|
|
echo "[aurum] Basic auth enabled for user '${AURUM_BASIC_AUTH_USER}'."
|
|
else
|
|
: > "$AUTH_FRAGMENT"
|
|
echo "[aurum] WARNING: AURUM_BASIC_AUTH_USER / AURUM_BASIC_AUTH_PASSWORD are not set." >&2
|
|
echo "[aurum] This instance has NO authentication — anyone who can reach it can read," >&2
|
|
echo "[aurum] edit, and delete all financial data. Fine for 'localhost only'. Before" >&2
|
|
echo "[aurum] exposing this beyond your own machine, set both variables in .env." >&2
|
|
fi
|