diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/DEPLOY.md | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 74f3953..5281fb6 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -116,6 +116,31 @@ The clients honor `BOKFD_SOCKET`; a host-installed client can also point at `var/run/bokfd.sock`, but that file is owned by uid 10001, so the host user must be in that group (or use `sudo`). +The TUI remembers the server and user (never the password) in +`$XDG_CONFIG_HOME/bokf/tui.conf` (`~/.config/bokf/tui.conf`), written after +a successful login. Precedence: `--socket`/`--user`, then `BOKFD_SOCKET`/ +`BOKFD_USER`, then that file. + +For a credential read from a root-only file, unlocked with `sudo`, create an +admin-scoped token on the host and store it on the client machine: + +```sh +docker compose exec -e BOKFD_PASSWORD='<pw>' bokfd \ + bokfctl --user admin --org 1 token.create \ + '{"label":"tui-laptop","scopes":["read","write","admin"]}' + +# on the client machine: +sudo install -d -m 700 /etc/bokf +sudo sh -c 'umask 077; printf "%s\n" "bokf_..." > /etc/bokf/tui-token' +install -m 755 scripts/bokftui-sudo ~/bin/bokftui-sudo +bokftui-sudo +``` + +`bokftui-sudo` runs `sudo -v`, reads `/etc/bokf/tui-token` (falling back to +`/etc/bokf/tui-password`), exports the credential and execs `bokftui` as +your user; with `BOKFD_TOKEN` set the TUI logs in without showing the login +screen. Revoke the token with `token.revoke` when a machine goes away. + ## TLS and external users Put the ACME DNS credentials in the host's `.env` once (they are never |