gsadmin/glkvm-cloud
1
0
Fork 0
mirror of https://github.com/gl-inet/glkvm-cloud.git synced 2026-09-11 21:38:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: clean up README and remove verbose auth sections

Browse Source 
- Remove detailed LDAP and OIDC configuration sections (refer to docker-compose README)
- Remove excessive emojis from section headings
- Simplify web proxy feature description

Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
This commit is contained in:
GL.iNet-Yongping.Xie
2026-04-08 00:12:23 -07:00
parent 5c7ff5531b
commit e4d5e0baec
2 changed files with 20 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -52
View File
@@ -18,7 +18,7 @@ Self-Deployed Lightweight Cloud is a lightweight KVM remote cloud platform tailo
- **Enterprise Authentication** - Supports both **LDAP** and **OIDC** login methods for enterprise users.
- **Deployment & Platform Compatibility** - Supports both **internal network** and **public internet** deployments on **x86_64** and **arm64** platforms
- **HTTP/HTTPS Web Proxy Support** - Supports onboarding OpenWrt, ImmortalWrt, Raspberry Pi, Linux VPS, macOS, and Windows hosts into self-hosted GLKVM Cloud for centralized management, and using them as HTTP/HTTPS web proxy nodes for NAT traversal access
- **HTTP/HTTPS Web Proxy Support** - Supports onboarding embedded devices such as OpenWrt, Raspberry Pi, and other Linux-based hosts into self-hosted GLKVM Cloud for centralized management and NAT traversal access
## Self-Hosting Guide
@@ -45,7 +45,7 @@ The following mainstream operating systems have been tested and verified
| Network Bandwidth | ≥ 3 Mbps |
| KVM Device Firmware | ≥ v1.5.0 |
#### 🔐 Cloud Security Group Settings
#### Cloud Security Group Settings
If your server provider uses a **cloud security group** (e.g., AWS, Aliyun, etc.), please make sure the following ports are **open**:
@@ -60,7 +60,7 @@ If your server provider uses a **cloud security group** (e.g., AWS, Aliyun, etc.
These ports will be **used by GLKVM Cloud**. Please ensure **no other applications or services** on your server are binding to these ports, otherwise the lightweight cloud platform may fail to start properly.
------
### 📦 Installation
### Installation
We provide **two** ways to install GLKVM Cloud:
@@ -82,7 +82,7 @@ Run **as root**:
>
> **Platform:** supports both **x86_64 (amd64)** and **arm64 (AArch64)**.
### 🌐 Platform Access
### Platform Access
Once the installation is complete, the installer will print the platform URL and admin login credentials in the console. You can access the platform via:
@@ -93,7 +93,7 @@ https://<your_server_public_ip>
⚠️ **Note**: Accessing via an IP address will trigger a **browser certificate warning**.
To remove the warning, configure your own domain and a valid SSL certificate.
### 🔑 Web UI Login Credentials
### Web UI Login Credentials
At the end of the installation script, the console will display the Web UI administrator username and password (for example):
@@ -144,7 +144,7 @@ you can **skip** configuring a custom domain and SSL certificate, and still acce
For production use, or if you need to **access multiple KVM devices via subdomains**, it is **strongly recommended** to configure your own **wildcard SSL certificate** (see below).
#### 🌐 Add DNS Records
#### Add DNS Records
To enable full domain-based access, configure the following DNS records for your domain:
@@ -157,7 +157,7 @@ To enable full domain-based access, configure the following DNS records for your
└────────────┴──────┴────────────────────┴─────────────────────────────┘
```
#### 🔧 Using a Custom SSL Certificate
#### Using a Custom SSL Certificate
To avoid browser warnings, replace the default certificates with your own **wildcard SSL certificate**
that supports both:
@@ -176,51 +176,9 @@ Replace the following files in:
⚠️ **Make sure the filenames remain unchanged.**
#### 🔐 LDAP Authentication Configuration (Optional)
#### Restart Services After Configuration Changes
GLKVM Cloud supports LDAP authentication for enterprise environments, allowing you to integrate with existing directory services like Active Directory, OpenLDAP, or FreeIPA.
**Key Features:**
- **Dual Authentication Mode**: Support both LDAP and traditional password authentication simultaneously
- **Group-based Authorization**: Restrict access to specific LDAP groups
- **User-based Authorization**: Allow access for specific users only
- **TLS/SSL Support**: Secure LDAP connections with encryption
- **Multiple LDAP Systems**: Compatible with Active Directory, OpenLDAP, FreeIPA, and generic LDAP servers
**Configuration:**
For detailed LDAP configuration options and setup instructions, see the [Docker Compose README](docker-compose/README.md).
**Note**: When LDAP is enabled, users can choose between:
- **LDAP Authentication**: Enter username and password for directory service authentication
- **Legacy Authentication**: Leave username empty and use the web management password
#### 🔐 OIDC Authentication Configuration (Optional)
GLKVM Cloud provides full support for **OIDC (OpenID Connect)** authentication, allowing seamless integration with modern identity providers such as **Google, Auth0, Authing** and any other standard-compliant OIDC provider.
**Key Features**
- **Modern Authentication**
Secure sign-in through any OIDC provider supporting Authorization Code Flow.
- **Email / Username / Group Whitelisting**
Restrict access based on:
- Email or domain (e.g. *@example.com*)
- Stable user ID (*sub*)
- Username (*preferred_username* or *name*)
- Groups attribute
- **Full OpenID Connect Compliance**
Supports issuer validation, token signature verification, and nonce protection.
- **Flexible Provider Support**
Works with public clouds (Google, Azure AD, Auth0, Okta) and self-hosted solutions.
**Configuration**
For detailed OIDC configuration options and setup instructions, see the
**[Docker Compose README](docker-compose/README.md)**.
#### 🔄 Restart Services After Configuration Changes
After replacing certificates or updating LDAP configuration, restart the GLKVM Cloud services to apply the changes:
After replacing certificates, restart the GLKVM Cloud services to apply the changes:
```bash
cd ~/glkvm_cloud
@@ -233,7 +191,7 @@ Or, on systems with the Docker CLI plugin:
docker compose down && docker compose up -d
```
### Domain-Based Access Example
### Domain-Based Access Example
Once everything is configured, you can access the platform via your domain:
README.zh-CN.md
+10 -48
View File
@@ -19,7 +19,7 @@
* **企业级认证** - 同时支持 **LDAP** 和 **OIDC** 登录方式，适用于企业用户。
- **部署与平台兼容性** - 同时支持 **内网部署** 和 **公网部署**，并兼容 **x86_64** 与 **arm64** 平台
- **HTTP/HTTPS Web代理功能支持** - 支持 OpenWrt、ImmortalWrt、树莓派、Linux VPS、macOS、Windows 等主机接入自部署 GLKVM Cloud 进行统一管理，并可作为 HTTP/HTTPS Web 代理节点实现内网穿透访问
- **HTTP/HTTPS Web 代理支持** - 支持 OpenWrt、树莓派等嵌入式设备及 Linux 主机接入自部署 GLKVM Cloud，实现统一管理与内网穿透访问
## 自部署指南
@@ -46,7 +46,7 @@
| 网络带宽 | ≥ 3 Mbps |
| KVM 固件版本 | ≥ v1.5.0 |
#### 🔐 云安全组端口要求
#### 云安全组端口要求
如果你的服务器提供商（如 AWS、阿里云等）启用了 **云安全组**，请确保以下端口已开放：
@@ -60,7 +60,7 @@
⚠️ **重要提示**：
这些端口将被 **GLKVM 轻量云** 占用，请确保服务器上没有其他程序占用这些端口，否则平台可能无法正常启动。
## 📦 安装
## 安装
我们提供 **两种** 安装 GLKVM Cloud 的方式：
@@ -83,7 +83,7 @@
> 平台支持： 同时支持 x86_64（amd64） 与 arm64（AArch64） 平台。
### 🌐 平台访问
### 平台访问
安装完成后，安装脚本会在控制台输出平台访问地址和管理员登录信息。你可以通过以下方式访问平台：
@@ -94,7 +94,7 @@ https://<你的服务器公网IP>
⚠️ **提示**：通过 IP 访问时，浏览器会提示 **证书不受信任**。
如需消除该提示，建议配置 **自定义域名 + 有效 SSL 证书**。
### 🔑 Web UI 登录信息
### Web UI 登录信息
安装脚本运行结束后，安装控制台会显示 Web UI 管理员用户名和密码（示例）：
@@ -142,7 +142,7 @@ https://<你的服务器公网IP>
但在 **生产环境**，或需要通过 **子域名同时访问多台 KVM 设备** 的情况下，
强烈建议配置 **通配符 SSL 证书**（见下文）。
#### 🌐 添加 DNS 记录
#### 添加 DNS 记录
如果需要完整的域名访问，请在域名解析中添加以下记录：
@@ -157,7 +157,7 @@ https://<你的服务器公网IP>
---
#### 🔧 使用自定义 SSL 证书
#### 使用自定义 SSL 证书
如果要消除浏览器证书警告，请使用支持以下域名的 **通配符 SSL 证书**：
@@ -173,47 +173,9 @@ https://<你的服务器公网IP>
* `glkvm.cer`
* `glkvm.key`
#### 🔐 LDAP 身份认证配置（可选）
#### 配置更改后重启服务
GLKVM 轻量云支持 LDAP 身份认证，适用于企业环境，可以与现有的目录服务（如 Active Directory、OpenLDAP 或 FreeIPA）集成。
**主要功能：**
- **双重认证模式**：同时支持 LDAP 和传统密码认证
- **基于组的授权**：限制特定 LDAP 组访问
- **基于用户的授权**：仅允许特定用户访问
- **TLS/SSL 支持**：加密 LDAP 连接
- **多 LDAP 系统支持**：兼容 Active Directory、OpenLDAP、FreeIPA 和通用 LDAP 服务器
**配置方法：**
详细的 LDAP 配置选项和设置说明，请参见 [Docker Compose README](docker-compose/README.md)。
**注意**：启用 LDAP 后，用户可以选择：
- **LDAP 认证**：输入用户名和密码进行目录服务认证
- **传统认证**：留空用户名并使用 Web 管理密码
#### 🔐 OIDC 登录认证配置（可选）
GLKVM Cloud 完整支持 **OIDC（OpenID Connect）** 登录认证，可无缝集成现代身份提供商，例如 **Google、Auth0、Authing**，以及任何符合 OIDC 标准的认证服务。
**主要功能**
- **现代化认证方式**
支持使用任意支持 Authorization Code Flow 的 OIDC 身份提供商进行安全登录。
- **邮箱 / 用户名 / 用户组白名单控制**
可根据以下信息限制用户访问：
- 邮箱或域名（如 *@example.com*）
- 用户 ID（*sub*）
- 用户名（*preferred_username* 或 *name*）
- 用户组
- **完全符合 OpenID Connect 标准**
支持 Issuer 校验、ID Token 签名验证、Nonce 防重放保护等安全机制。
- **高度灵活的提供商支持**
兼容各类公共云 IdP（Google、Azure AD、Auth0、Okta 等）以及自建身份服务（Keycloak、Authentik、Dex 等）。
#### 🔄 配置更改后重启服务
替换证书或更新 LDAP 配置后，需要重启 GLKVM 轻量云服务以应用更改：
替换证书后，需要重启 GLKVM 轻量云服务以应用更改：
```bash
cd ~/glkvm_cloud
@@ -226,7 +188,7 @@ docker-compose down && docker-compose up -d
docker compose down && docker compose up -d
```
### 🌍 域名访问示例
### 域名访问示例
配置完成后，你可以通过以下方式访问平台：