From a69ea13086273fc6659c153be93f0f5b37aad733 Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Fri, 7 Oct 2022 14:53:30 +0200 Subject: Add open api doc for two factor auth --- support/doc/api/openapi.yaml | 106 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) (limited to 'support') diff --git a/support/doc/api/openapi.yaml b/support/doc/api/openapi.yaml index c62310b76..2fb154dbd 100644 --- a/support/doc/api/openapi.yaml +++ b/support/doc/api/openapi.yaml @@ -1126,6 +1126,97 @@ paths: '404': description: user not found + /users/{id}/two-factor/request: + post: + summary: Request two factor auth + operationId: requestTwoFactor + description: Request two factor authentication for a user + tags: + - Users + parameters: + - $ref: '#/components/parameters/id' + requestBody: + content: + application/json: + schema: + type: object + properties: + currentPassword: + type: string + description: Password of the currently authenticated user + responses: + '200': + description: successful operation + content: + application/json: + schema: + type: array + items: + $ref: '#/components/schemas/RequestTwoFactorResponse' + '403': + description: invalid password + '404': + description: user not found + + /users/{id}/two-factor/confirm-request: + post: + summary: Confirm two factor auth + operationId: confirmTwoFactorRequest + description: Confirm a two factor authentication request + tags: + - Users + parameters: + - $ref: '#/components/parameters/id' + requestBody: + content: + application/json: + schema: + type: object + properties: + requestToken: + type: string + description: Token to identify the two factor request + otpToken: + type: string + description: OTP token generated by the app + required: + - requestToken + - otpToken + responses: + '204': + description: successful operation + '403': + description: invalid request token or OTP token + '404': + description: user not found + + /users/{id}/two-factor/disable: + post: + summary: Disable two factor auth + operationId: disableTwoFactor + description: Disable two factor authentication of a user + tags: + - Users + parameters: + - $ref: '#/components/parameters/id' + requestBody: + content: + application/json: + schema: + type: object + properties: + currentPassword: + type: string + description: Password of the currently authenticated user + responses: + '204': + description: successful operation + '403': + description: invalid password + '404': + description: user not found + + /users/ask-send-verify-email: post: summary: Resend user verification link @@ -8146,6 +8237,21 @@ components: description: User can select live latency mode if enabled by the instance $ref: '#/components/schemas/LiveVideoLatencyMode' + RequestTwoFactorResponse: + properties: + otpRequest: + type: object + properties: + requestToken: + type: string + description: The token to send to confirm this request + secret: + type: string + description: The OTP secret + uri: + type: string + description: The OTP URI + VideoStudioCreateTask: type: array items: -- cgit v1.2.3 From 1ea868a9456439108fbd87255537093ed8bd456f Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Mon, 10 Oct 2022 11:19:45 +0200 Subject: Fill documentation with required secret conf --- support/doc/docker.md | 1 + support/doc/production.md | 10 ++++++++-- support/docker/production/.env | 3 +++ .../docker/production/config/custom-environment-variables.yaml | 3 +++ 4 files changed, 15 insertions(+), 2 deletions(-) (limited to 'support') diff --git a/support/doc/docker.md b/support/doc/docker.md index 97eecc3ad..267863a4d 100644 --- a/support/doc/docker.md +++ b/support/doc/docker.md @@ -49,6 +49,7 @@ In the downloaded example [.env](https://github.com/Chocobozzz/PeerTube/blob/mas - `` - `` without 'https://' - `` +- `` Other environment variables are used in [/support/docker/production/config/custom-environment-variables.yaml](https://github.com/Chocobozzz/PeerTube/blob/master/support/docker/production/config/custom-environment-variables.yaml) and can be diff --git a/support/doc/production.md b/support/doc/production.md index 64ddd9e48..b400ac451 100644 --- a/support/doc/production.md +++ b/support/doc/production.md @@ -115,8 +115,14 @@ $ cd /var/www/peertube $ sudo -u peertube cp peertube-latest/config/production.yaml.example config/production.yaml ``` -Then edit the `config/production.yaml` file according to your webserver -and database configuration (`webserver`, `database`, `redis`, `smtp` and `admin.email` sections in particular). +Then edit the `config/production.yaml` file according to your webserver and database configuration. In particular: + * `webserver`: Reverse proxy public information + * `secrets`: Secret strings you must generate manually (PeerTube version >= 5.0) + * `database`: PostgreSQL settings + * `redis`: Redis settings + * `smtp`: If you want to use emails + * `admin.email`: To correctly fill `root` user email + Keys defined in `config/production.yaml` will override keys defined in `config/default.yaml`. **PeerTube does not support webserver host change**. Even though [PeerTube CLI can help you to switch hostname](https://docs.joinpeertube.org/maintain-tools?id=update-hostjs) there's no official support for that since it is a risky operation that might result in unforeseen errors. diff --git a/support/docker/production/.env b/support/docker/production/.env index 4e7b21ab6..b4e356a58 100644 --- a/support/docker/production/.env +++ b/support/docker/production/.env @@ -22,6 +22,9 @@ PEERTUBE_WEBSERVER_HOSTNAME= # pass them as a comma separated array: PEERTUBE_TRUST_PROXY=["127.0.0.1", "loopback", "172.18.0.0/16"] +# Generate one using `openssl rand -hex 32` +PEERTUBE_SECRET= + # E-mail configuration # If you use a Custom SMTP server #PEERTUBE_SMTP_USERNAME= diff --git a/support/docker/production/config/custom-environment-variables.yaml b/support/docker/production/config/custom-environment-variables.yaml index 9c84428b7..1d889fe7d 100644 --- a/support/docker/production/config/custom-environment-variables.yaml +++ b/support/docker/production/config/custom-environment-variables.yaml @@ -7,6 +7,9 @@ webserver: __name: "PEERTUBE_WEBSERVER_HTTPS" __format: "json" +secrets: + peertube: "PEERTUBE_SECRET" + trust_proxy: __name: "PEERTUBE_TRUST_PROXY" __format: "json" -- cgit v1.2.3