Files
haproxy-openmanager/docker-compose.yml
T
taylanbakircioglu bd6a31cb0d feat: v1.6.0 — Multi-Factor Authentication (Issue #18)
Adds opt-in TOTP-based Multi-Factor Authentication that is fully
backwards compatible with existing logins. Operators choose to enable
MFA per account; nothing changes for users who do not opt in.

Highlights
==========

* RFC 6238 TOTP (6 digits, 30s period, SHA1) with ±30s skew tolerance,
  compatible with Microsoft / Google Authenticator, Authy, Duo, 1Password.
* Per-step replay protection (`mfa_last_used_totp_step`) so a captured
  code cannot be reused inside the same window.
* Fernet-encrypted TOTP secrets at rest, key resolution via
  `MFA_ENCRYPTION_KEY` env (HKDF-derived from `SECRET_KEY` as fallback).
* 10 single-use, bcrypt-hashed backup codes per user, formatted
  `XXXX-YYYY` from a confusion-free alphabet (no 0/O/1/I/L).
* Two-step login flow: `POST /api/auth/login` returns `mfa_required`
  + `mfa_token`, then `POST /api/auth/login/mfa-verify` accepts a TOTP
  code OR a backup code. JWT is minted only after MFA succeeds.
* Self-service: users enable / disable MFA from their own row in the
  Users page; admins reset (single user or bulk) but never enable on
  behalf of someone else (matches AWS IAM / GitHub / Google Workspace).
* Bulk emergency reset CLI: `scripts/admin-mfa-reset-all.sh`.

Security hardening
==================

* Atomic transactions with `SELECT … FOR UPDATE` on `mfa_pending_logins`
  and `users` rows so concurrent verify / enroll calls cannot race.
* `/api/mfa/enroll/start` refuses re-enrollment when MFA is already on
  (prevents silent secret rotation via a stolen JWT).
* Pydantic `ValidationError` messages are sanitized before reaching the
  audit log so request bodies (TOTP / backup codes in flight) never
  appear in plaintext.
* Slowapi rate limits are per-USER, not per-IP, with a trusted-proxy
  XFF strategy so a single ingress address cannot exhaust the bucket
  for thousands of operators (`MFA_TRUSTED_PROXY_CIDRS`,
  `MFA_RATE_LIMIT_*` env-overridable).
* Login query now scopes to `is_active = TRUE` so a soft-deleted row
  with the same username can no longer occlude the active user
  (also closes a small account-enumeration side channel).

Database
========

Additive migrations (idempotent `ADD COLUMN IF NOT EXISTS`,
`CREATE TABLE IF NOT EXISTS`):

  - users: mfa_enabled, mfa_method, mfa_secret_encrypted,
    mfa_enrolled_at, mfa_last_used_at, mfa_last_used_totp_step
  - mfa_backup_codes (user_id ON DELETE CASCADE)
  - mfa_pending_logins (user_id ON DELETE CASCADE, challenge_token,
    attempts, expires_at)
  - mfa_pending_enrollments (user_id ON DELETE CASCADE)

Frontend
========

* Login page becomes a 3-phase state machine
  (credentials → MFA → submitting); legacy single-step login is
  preserved for users who haven't enrolled.
* New MFAEnrollModal (3-step wizard: QR + secret → verify → backup
  codes) using `qrcode.react`.
* Users page shows MFA column + per-row enable/disable/reset actions.
  Admins viewing other users with MFA off see a non-actionable info
  icon explaining that only the user themselves can enable MFA.

Deployment
==========

* `MFA_ENCRYPTION_KEY` is added to `k8s/manifests/03-secrets.yaml` as
  a placeholder; `SECRET_KEY` is also placeholder-ized so both are
  injected by the existing pipeline pattern (sed-replace + apply).
* No new build-time env vars are required for the frontend. The SPA
  uses `window.location.host` for `/api/*` and is routed by the
  existing nginx ingress configuration.
* `frontend/.dockerignore` ensures host `.env*` files cannot bleed
  into the production bundle.

Tests
=====

* New unit suites:
  - `test_mfa_service.py` (TOTP, encryption, backup codes)
  - `test_mfa_backwards_compat.py` (regression — non-MFA flow unchanged)
  - `test_mfa_rate_limits.py` (env override + dataclass immutability)
  - `test_mfa_rate_limit_key.py` (JWT key, trusted-proxy XFF, fallbacks)
* All existing 1000+ unit tests continue to pass.

Documentation
=============

* README MFA section (overview, day-to-day operations, emergency
  reset CLI, env variables, rate-limit tuning).
* `scripts/README.md` documents the bulk reset script.

Issue: #18
2026-05-19 04:35:16 +03:00

163 lines
4.4 KiB
YAML

services:
# PostgreSQL Database
postgres:
image: postgres:15-alpine
container_name: haproxy-openmanager-db
environment:
POSTGRES_DB: haproxy_openmanager
POSTGRES_USER: haproxy_user
POSTGRES_PASSWORD: haproxy_pass
PGDATA: /var/lib/postgresql/data/pgdata
volumes:
- postgres_data:/var/lib/postgresql/data
ports:
- "5432:5432"
networks:
- haproxy-network
healthcheck:
test: ["CMD-SHELL", "pg_isready -U haproxy_user -d haproxy_openmanager"]
interval: 10s
timeout: 5s
retries: 5
# Redis Cache
redis:
image: redis:7-alpine
container_name: haproxy-openmanager-redis
command: redis-server --maxmemory 2gb --maxmemory-policy volatile-lru --save ""
ports:
- "6379:6379"
networks:
- haproxy-network
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 10s
timeout: 3s
retries: 5
# Backend API - pulls from Docker Hub by default
# To build locally instead, uncomment the build section and run: docker compose build backend
backend:
image: taylanbakircioglu/haproxy-openmanager-backend:latest
# build:
# context: ./backend
# dockerfile: Dockerfile
container_name: haproxy-openmanager-backend
environment:
- DATABASE_URL=postgresql://haproxy_user:haproxy_pass@postgres:5432/haproxy_openmanager
- REDIS_URL=redis://redis:6379
- SECRET_KEY=your-secret-key-change-this-in-production
- DEBUG=False
- LOG_LEVEL=INFO
- PUBLIC_URL=http://localhost:8080
- MANAGEMENT_BASE_URL=http://localhost:8080
volumes:
- haproxy_configs:/etc/haproxy
expose:
- "8000"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
networks:
- haproxy-network
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health')"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
# Frontend React App - pulls from Docker Hub by default
# To build locally instead, uncomment the build section and run: docker compose build frontend
#
# NOTE: REACT_APP_* env vars are BUILD-time only for Create-React-App. The
# runtime container (serve -s build) does NOT consume them. The frontend
# uses same-origin (window.location) for /api/* and is routed by the nginx
# service below to the backend container. No env vars are required here.
frontend:
image: taylanbakircioglu/haproxy-openmanager-frontend:latest
# build:
# context: ./frontend
# dockerfile: Dockerfile
container_name: haproxy-openmanager-frontend
expose:
- "3000"
depends_on:
- backend
networks:
- haproxy-network
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:3000"]
interval: 30s
timeout: 10s
retries: 3
# Nginx Reverse Proxy
nginx:
image: nginx:alpine
container_name: haproxy-openmanager-nginx
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
ports:
- "8080:8080"
depends_on:
- frontend
- backend
networks:
- haproxy-network
healthcheck:
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
interval: 30s
timeout: 10s
retries: 3
# HAProxy Instance (for testing)
haproxy:
image: haproxy:2.8-alpine
container_name: haproxy-instance
volumes:
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
ports:
- "80:80"
- "8404:8404"
networks:
- haproxy-network
# Remote HAProxy Instance 1 (Production)
haproxy-remote1:
image: haproxy:2.8-alpine
container_name: haproxy-remote1
volumes:
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
ports:
- "8001:80"
- "8405:8404"
networks:
- haproxy-network
environment:
- HAPROXY_ENV=production
# Remote HAProxy Instance 2 (Staging)
haproxy-remote2:
image: haproxy:2.8-alpine
container_name: haproxy-remote2
volumes:
- ./haproxy/haproxy-simple.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
ports:
- "8002:80"
- "8406:8404"
networks:
- haproxy-network
environment:
- HAPROXY_ENV=staging
volumes:
postgres_data:
haproxy_configs:
networks:
haproxy-network:
driver: bridge