diff --git a/charts/stable/organizr/Chart.yaml b/charts/stable/organizr/Chart.yaml index 5dedcbb76a1..c731bfba08f 100644 --- a/charts/stable/organizr/Chart.yaml +++ b/charts/stable/organizr/Chart.yaml @@ -21,7 +21,7 @@ sources: - https://github.com/causefx/Organizr - https://hub.docker.com/r/organizr/organizr type: application -version: 13.0.4 +version: 13.0.5 annotations: truecharts.org/catagories: | - organizers diff --git a/charts/stable/organizr/docs/forward_auth.md b/charts/stable/organizr/docs/forward_auth.md new file mode 100644 index 00000000000..8c3425a7f0d --- /dev/null +++ b/charts/stable/organizr/docs/forward_auth.md @@ -0,0 +1,90 @@ +# Organizr Forward Auth Setup Guide + +Basic setup guide for enabling Organizr authentication on your apps using Traefik forwardAuth. + +## Requirements + +- Organizr TrueCharts App +- Traefik TrueCharts App + +## Prerequisites + +This guide assumes you're using Traefik as your Reverse Proxy / Ingress provider and have through the configuration listed in our +[Quick-Start guides](https://truecharts.org/manual/guides/adding-letsencrypt) and/or the [Traefik documents](https://truecharts.org/docs/charts/stable/traefik/how-to/). +Please ensure that you can access your domain properly with Ingress before attempting any further steps. + +## Organizr App Setup + +All of the defaults are fine to start off, however `ingress` must be set if you wish to use `organizr` with `traefik`. + +In this guide the app name is `organizr` and ingress is configured as `organizr.example.com` + +**Ingress Example** + +![organizr-ingress-section](img/organizr-ingress-section.png) + +(also complete the TLS section for ingress configuration using the same hostname as above) + +## Organizr GUI Setup + +Once the app is deployed, complete the standard installation steps until you get to the Organizr settings page. + +### Review Pre-defined Groups + +Goto Organizr Settings -> User Management -> Manage Groups + +No changes needed here for now unless you want to create a custom group +![Manage-Groups](img/organizr-groups.png) + +### Configure Traefik Redirect + +Goto Organizr Settings -> Main -> Security + +- Set `Enable Traefik Auth Redirect` to on +- Set `Traefik Domain for Return Override` to `https://organizr.example.com` (this should match the address you defined in the Organizr app ingress section) + +![organizr-gui-traefik-redirect](img/organizr-gui-traefik-redirect.png) + +## Traefik ForwardAuth Setup + +Once Organizr app is up and running, you must create `forwardAuth` middleware entries inside Traefik in order to use Organizr's authentication on your apps. + +We will use the Organizr user groups that map to specific forwardAuth URLs. + +The below table shows the example forwardAuth entries that correspond to the user groups in Organizr. +The URLs for these entries use the kubernetes internal DNS address & default port (`10022`) for your Organizr app. You can name the forwardAuth entries whatever you like. + +| forwardAuth Name | forwardAuth Address | screenshot | +| :------------------------------------ | :-------------------------------------------------------------------------- | :-----------------------------------------------------------------: | +| `organizr-admin` | `http://organizr.ix-organizr.svc.cluster.local:10022/api/v2/auth?group=0` | ![Organizr-admin-forwardAuth](img/organizr-admin-forwardAuth.png) | +| `organizr-guest` (optional) | `http://organizr.ix-organizr.svc.cluster.local:10022/api/v2/auth?group=999` | ![Organizr-guest-forwardAuth](img/organizr-guest-forwardAuth.png) | +| `organizr-custom5` (optional, custom) | `http://organizr.ix-organizr.svc.cluster.local:10022/api/v2/auth?group=5` | ![Organizr-custom-forwardAuth](img/organizr-custom-forwardAuth.png) | + +See Organizr [documentation](https://docs.organizr.app/features/server-authentication#using-the-organizr-authorization-api) on "Server Authentication" +for more details on the predefined groups and their corresponding URL pattern. + +### Add Traefik forwardAuth to Apps + +Once that is done all you need to add the `middleware` to your apps under the `Ingress section`, corresponding to the level of +permissions the app's user should have to access it. Example below uses `organizr-admin`. + +![organizr-traefik-middleware](img/organizr-traefik-middleware.png) + +## Verify it works + +Visit the app's `URL` where you set ingress + forwardAuth middleware. You will see the following organizr login page: + +![organizr-authentication-page](img/organizr-authentication-page.png) + +## Optional: Enable Plex OAuth (or LDAP backend service) + +Additionally Organizr supports enabling plex oauth or LDAP as your authentication backend. If you have users already provisioned +in Plex, you can point to your plex server for OAuth. + +![organizr-plex-oauth](img/organizr-plex-oauth.png) + +When Plex OAuth is enabled, users will see the option on the Organizr authentication page: + +![organizr-plex-authentication-page](img/organizr-plex-authentication-page.png) + +See Organizr [documentation](https://docs.organizr.app/features/authentication-backends/plex-backend) on "Plex Authentication Backend" for more details. diff --git a/charts/stable/organizr/docs/img/organizr-admin-forwardAuth.png b/charts/stable/organizr/docs/img/organizr-admin-forwardAuth.png new file mode 100644 index 00000000000..052eee6c123 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-admin-forwardAuth.png differ diff --git a/charts/stable/organizr/docs/img/organizr-authentication-page.png b/charts/stable/organizr/docs/img/organizr-authentication-page.png new file mode 100644 index 00000000000..e7c34186830 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-authentication-page.png differ diff --git a/charts/stable/organizr/docs/img/organizr-custom-forwardAuth.png b/charts/stable/organizr/docs/img/organizr-custom-forwardAuth.png new file mode 100644 index 00000000000..95c7d67d493 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-custom-forwardAuth.png differ diff --git a/charts/stable/organizr/docs/img/organizr-groups.png b/charts/stable/organizr/docs/img/organizr-groups.png new file mode 100644 index 00000000000..6e0237185b6 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-groups.png differ diff --git a/charts/stable/organizr/docs/img/organizr-guest-forwardAuth.png b/charts/stable/organizr/docs/img/organizr-guest-forwardAuth.png new file mode 100644 index 00000000000..43a1241f9da Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-guest-forwardAuth.png differ diff --git a/charts/stable/organizr/docs/img/organizr-gui-traefik-redirect.png b/charts/stable/organizr/docs/img/organizr-gui-traefik-redirect.png new file mode 100644 index 00000000000..2443e25e915 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-gui-traefik-redirect.png differ diff --git a/charts/stable/organizr/docs/img/organizr-ingress-section.png b/charts/stable/organizr/docs/img/organizr-ingress-section.png new file mode 100644 index 00000000000..a8f28b9f9d9 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-ingress-section.png differ diff --git a/charts/stable/organizr/docs/img/organizr-plex-authentication-page.png b/charts/stable/organizr/docs/img/organizr-plex-authentication-page.png new file mode 100644 index 00000000000..0b5002fe08e Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-plex-authentication-page.png differ diff --git a/charts/stable/organizr/docs/img/organizr-plex-oauth.png b/charts/stable/organizr/docs/img/organizr-plex-oauth.png new file mode 100644 index 00000000000..9ba6b96f891 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-plex-oauth.png differ diff --git a/charts/stable/organizr/docs/img/organizr-traefik-middleware.png b/charts/stable/organizr/docs/img/organizr-traefik-middleware.png new file mode 100644 index 00000000000..96b922f6f37 Binary files /dev/null and b/charts/stable/organizr/docs/img/organizr-traefik-middleware.png differ diff --git a/cspell.config.yaml b/cspell.config.yaml index 584a39e4946..e70f45518c9 100644 --- a/cspell.config.yaml +++ b/cspell.config.yaml @@ -176,6 +176,7 @@ words: - notebookbar - ODBC - OOKLA + - organizr - ornias - ovpn - passwrd