diff --git a/Dockerfile b/Dockerfile index c7e33e6..8d0f6d3 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,4 +7,9 @@ RUN pip install --no-cache-dir -r ./requirements.txt COPY ./main.py /app/ +ENV BIND_HOST=0.0.0.0 +ENV BIND_PORT=500 + +EXPOSE 5000 + CMD ["python", "main.py"] diff --git a/README.md b/README.md index 23b57d4..b3290a6 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,22 @@ Shim service allowing authenticating a Nomad session using Vault -The idea is that this service would be run along side Nomad and Vault and proxied on the same hostname so it can write to localstorage. It would then provide a form to allow authentication with Vault and then will retrieve the token and store that in the browser for Nomad to use. +This service would runs along side Nomad and Vault and proxied on the same hostname so it can write to localstorage. It then provides a form to allow authentication with Vault and then will retrieve the token and store that in the browser for Nomad to use. -Right now it appears to be working, but isn't super pretty and I have no written instructions. +## Instructions + +You can configure the service through environment variables. + +* `BIND_HOST`: Host to bind the server on. Defaults to `0.0.0.0`. +* `BIND_PORT`: Port to bind the server on. Defaults to `5000`. +* `VAULT_ADDR`: Address where we can find Vault. Defaults to `http://127.0.0.1:8200`. +* `NOMAD_ROLE`: Default Nomad role to request from Vault. Defaults to `admin`. + +Example Caddyfile + +```caddyfile +nomad.example.com { + reverse_proxy /login localhost:5000 + reverse_proxy localhost:4646 +} +``` diff --git a/main.py b/main.py index 63ad40e..922d55a 100644 --- a/main.py +++ b/main.py @@ -5,6 +5,9 @@ from flask import request from hvac import Client +BIND_HOST = os.getenv("BIND_HOST", "0.0.0.0") +BIND_PORT = int(os.getenv("BIND_PORT", "5000")) + VAULT_ADDR = os.getenv("VAULT_ADDR", "http://127.0.0.1:8200") NOMAD_ROLE = os.getenv("NOMAD_ROLE", "admin") @@ -12,7 +15,7 @@ NOMAD_ROLE = os.getenv("NOMAD_ROLE", "admin") app = Flask(__name__) -@app.route('/') +@app.route("/") def root(): # TODO: Render a basic page that checks for existance of token in local storage and displays form return f""" @@ -55,4 +58,4 @@ def login(): """ -app.run(host="0.0.0.0", port=5000) +app.run(host=BIND_HOST, port=BIND_PORT)