Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

README.md

@@ -8,24 +8,32 @@ A self-hosted operations dashboard that brings application discovery, connector
 - Configure Portainer, optional Unraid and application-specific connectors through `/setup`.
 - Inspect health, notification rules, diagnostics and SQLite-safe backups.
 - Apply typed action policies; blocked destructive operations remain blocked.
+- Use Authentik or tenant-specific Microsoft Entra OpenID Connect with persisted users and server-enforced roles.
 - Integrate optional Home Assistant voice commands and separately authenticated MCP/n8n clients.
 - Use deployment and enrollment control planes with pre-registered identities and immutable revisions.
 
 The gateway does not require direct Docker socket access and exposes no arbitrary shell endpoint. Connector credentials are write-only through the API and encrypted at rest. Optional integrations require their own endpoints and scoped credentials.
 
+## Human access
+
+Human API access requires a signed-in user. The shared operator-token unlock and anonymous-admin switch have been removed. No administrator is preconfigured. New users start read-only and administrators assign additional roles in Settings → Security.
+
+For native OIDC, use an HTTPS frontend, configure a confidential Authentik provider or a tenant-specific Entra application, and register the exact callback URL (`https://<app-host>/api/auth/callback/authentik` or `https://<app-host>/api/auth/callback/entra`). An existing Entra federation can remain an Authentik source via `APPOPS_AUTHENTIK_ENTRA_SOURCE`. Put each client secret in its protected file under `./data`; do not place secret values in `.env`, browser storage or source control. Set the initial administrator with either an explicit provider subject (`APPOPS_AUTH_ADMIN_SUBJECTS`) or a one-time Authentik verified-email bootstrap (`APPOPS_AUTH_ADMIN_EMAILS`). Remove the email bootstrap after the first administrator signs in. Leave both settings empty until you choose the intended administrator.
+
+An existing Authentik outpost can also provide identity when AppOps trusts its exact peer network. Enable `APPOPS_OPERATOR_PROXY_AUTH`, list only the proxy peer in `APPOPS_OPERATOR_PROXY_TRUSTED_NETWORKS`, have the proxy overwrite client-supplied `X-authentik-*` identity headers, and prevent direct access to the backend port. Group headers do not grant AppOps roles. The backend enforces the access contract; hiding a control in the UI is not an authorization boundary.
+
 ## Local evaluation
 
-The public Compose configuration is isolated from the owner's deployment. Requirements: Docker Engine with Compose.
+Requirements: Docker Engine with Compose, an HTTPS origin reachable through a trusted reverse proxy or VPN, and an identity provider (or a correctly bounded Authentik outpost).
 
 ```bash
 cp .env.example .env
-# Set APPOPS_OPERATOR_TOKEN and APPOPS_SECRET_KEY to independent random values.
+mkdir -p data
+# Create data/secret-key and the selected OIDC client-secret file with restrictive permissions.
 docker compose up --build -d
 ```
 
-Open `http://localhost:1216/setup`. Keep the operator token and encryption key private. The stack binds only to loopback, persists `./data`, enables operator authentication, and disables MCP/n8n until explicitly configured. It has no production host mounts, proxy networks or broker endpoints. Configure Portainer in the setup wizard; missing optional connectors remain visible as partial coverage.
-
-Before production use, put the application behind a trusted authenticated TLS reverse proxy or VPN. Never expose it directly to the internet. Preserve both `/data` and its encryption key, test restore, and review every connector's permissions. See [Security policy](SECURITY.md).
+The Compose sample binds AppOps to `127.0.0.1:1216`, persists `./data`, and disables MCP/n8n until explicitly configured. Replace the example HTTPS origins, configure the provider and first administrator, and create protected key files before signing in. Without valid OIDC or trusted-proxy configuration, human API requests fail closed. Do not expose the backend directly to the internet. Review connector permissions and test a backup restore before production use. See [Security policy](SECURITY.md).
 
 ## First operator workflow