diff --git a/examples/README.md b/examples/README.md index 3e8594a6..3b82ed75 100644 --- a/examples/README.md +++ b/examples/README.md @@ -8,6 +8,7 @@ These are the same examples shown in the [documentation](https://neko.m1k1o.net/ | --- | --- | | [simple-browser](./simple-browser) | Firefox with commented options for persistent/custom profiles and other available browser images. | | [kiosk-browser](./kiosk-browser) | Firefox in kiosk mode that opens a fixed URL on startup (e.g. a streaming service or dashboard). Stateless by default. | +| [oauth-browser](./oauth-browser) | Firefox authenticating members through an external OAuth 2.0 / OpenID Connect provider, configured via a mounted config.yaml. | | [gpu-nvidia-browser](./gpu-nvidia-browser) | Firefox with Nvidia GPU acceleration, with a commented "encode-only" option. | | [gpu-intel-browser](./gpu-intel-browser) | Firefox with Intel (VAAPI) GPU acceleration, with a commented "encode-only" option. | | [raspberry-pi-browser](./raspberry-pi-browser) | Firefox tuned for Raspberry Pi, with a commented hardware-encoding option. | diff --git a/examples/oauth/config.yaml b/examples/oauth/config.yaml new file mode 100644 index 00000000..7ca1f322 --- /dev/null +++ b/examples/oauth/config.yaml @@ -0,0 +1,42 @@ +# See: https://neko.m1k1o.net/docs/v3/configuration/authentication#member.oauth +member: + provider: "oauth" + oauth: + enabled: true + # When true, visiting the Neko root page immediately starts OAuth login. + auto_redirect: true + name: "Example SSO" + admin_emails: ["admin@example.com"] + user_emails: [] # if empty, any authenticated user is allowed to log in + client_id: "" + client_secret: "" + # For OpenID Connect providers, issuer_url alone is enough - Neko + # discovers the authorization, token and user-info endpoints from + # /.well-known/openid-configuration. + issuer_url: "https://id.example.com" + scopes: ["openid", "profile", "email"] + # Configure these to match the JSON returned by the user-info endpoint. + subject_field: "sub" + username_field: "name" + avatar_field: "picture" + success_redirect: "/" + user_profile: + is_admin: false + can_login: true + can_connect: true + can_watch: true + can_host: true + can_share_media: true + can_access_clipboard: true + sends_inactive_cursor: true + can_see_inactive_cursors: false + admin_profile: + is_admin: true + can_login: true + can_connect: true + can_watch: true + can_host: true + can_share_media: true + can_access_clipboard: true + sends_inactive_cursor: true + can_see_inactive_cursors: true diff --git a/examples/oauth/docker-compose.yaml b/examples/oauth/docker-compose.yaml new file mode 100644 index 00000000..b0afe0e5 --- /dev/null +++ b/examples/oauth/docker-compose.yaml @@ -0,0 +1,23 @@ +# Neko - OAuth Example +# +# Authenticates users via an external OAuth 2.0 / OpenID Connect provider +# instead of the built-in multiuser passwords. OAuth has many settings, so +# they are set via a mounted config.yaml instead of environment variables. +# +# See: https://neko.m1k1o.net/docs/v3/configuration/authentication#member.oauth +services: + neko: + image: "ghcr.io/m1k1o/neko/firefox:latest" + restart: "unless-stopped" + shm_size: "2gb" + ports: + - "8080:8080" + - "52000-52100:52000-52100/udp" + volumes: + - "./config.yaml:/etc/neko/neko.yaml" + environment: + NEKO_DESKTOP_SCREEN: '1920x1080@30' + NEKO_WEBRTC_EPR: 52000-52100 + NEKO_WEBRTC_ICELITE: 1 + # See: https://neko.m1k1o.net/docs/v3/configuration/webrtc#nat1to1 + # NEKO_WEBRTC_NAT1TO1: diff --git a/webpage/docs/installation/examples.md b/webpage/docs/installation/examples.md index 69b15cfa..9153b9cd 100644 --- a/webpage/docs/installation/examples.md +++ b/webpage/docs/installation/examples.md @@ -35,7 +35,7 @@ Browse: [`examples/kiosk-browser`](https://github.com/m1k1o/neko/tree/main/examp For some workflows, passing the target URL directly to Firefox is more reliable than using homepage policies, because session restore can otherwise override the start page. See also: [Supervisord Configuration](/docs/v3/customization#supervisord). -## Nvidia Browser {#gpu-nvidia-browser} +## Nvidia GPU Browser {#gpu-nvidia-browser} Neko supports hardware acceleration using Nvidia GPUs. To use this feature, you need to have the Nvidia Container Toolkit installed on your system. You can find the installation instructions [here](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html). Check if your GPU supports hardware encoding with [this list](https://developer.nvidia.com/video-encode-decode-gpu-support-matrix). @@ -50,7 +50,7 @@ Browse: [`examples/gpu-nvidia-browser`](https://github.com/m1k1o/neko/tree/main/ See available [Nvidia Docker Images](/docs/v3/installation/docker-images#nvidia). -## Intel Browser {#gpu-intel-browser} +## Intel GPU Browser {#gpu-intel-browser} Neko supports hardware acceleration using Intel GPUs via VAAPI. This requires the host to expose `/dev/dri` and have the Intel graphics driver installed. @@ -85,6 +85,20 @@ Browse: [`examples/arm64-browser`](https://github.com/m1k1o/neko/tree/main/examp See supported architectures and per-app availability in the [Availability Matrix](/docs/v3/installation/docker-images#availability). +## OAuth {#oauth} + +Authenticates members through an external OAuth 2.0 / OpenID Connect provider instead of the built-in multiuser passwords. OAuth has many settings, so this example sets them via a mounted `config.yaml` instead of environment variables. + +Browse: [`examples/oauth`](https://github.com/m1k1o/neko/tree/main/examples/oauth) + +```yaml title="docker-compose.yaml" file=/examples/oauth/docker-compose.yaml +``` + +```yaml title="config.yaml" file=/examples/oauth/config.yaml +``` + +See [OAuth 2.0 Provider](/docs/v3/configuration/authentication#member.oauth) for all available options. + ## TURN Server {#turn-server} WebRTC needs a direct connection between the client and the server. When that is not possible (e.g. both sides are behind restrictive NATs or firewalls), a [TURN server](/docs/v3/configuration/webrtc#iceservers) relays the traffic instead. This example runs a [Coturn](https://github.com/coturn/coturn) TURN server alongside Neko.