ad3laid3/TheOrb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document NPM-protected deploy mode

Browse source
This commit is contained in:
MiTHRAL 2026-05-13 22:33:37 -04:00
parent 86ea28cceb
commit 77464b8030
2 changed files with 6 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.env.deploy.example
View file

@ -6,9 +6,7 @@ CHECK_INTERVAL_SECONDS=60
HTTP_USER_AGENT=ArchiveStatusBot/1.0
DISCORD_DRY_RUN=false
DASHBOARD_ENABLED=true
DASHBOARD_AUTH_DISABLED=true
DASHBOARD_HOST=0.0.0.0
DASHBOARD_PORT=8787
DASHBOARD_USERNAME=admin
DASHBOARD_PASSWORD_HASH=replace-with-generated-pbkdf2-hash
DASHBOARD_SESSION_TTL_SECONDS=28800
DASHBOARD_COOKIE_SECURE=true

7
README.md
View file

@ -148,13 +148,16 @@ Use this target from your proxy:
http://archive-status-bot:8787
```
For HTTPS behind a reverse proxy, set:
For Nginx Proxy Manager, put the dashboard behind an Access List or basic auth on the proxy host and disable the app's own login:
```env
DASHBOARD_AUTH_DISABLED=true
DASHBOARD_COOKIE_SECURE=true
```
Leave it `false` only for direct localhost HTTP testing.
NPM’s Access Lists use browser `Authorization` headers, so the app never needs to receive your username/password directly. Leave `DASHBOARD_AUTH_DISABLED=false` only for direct localhost testing.
NPM’s own docs call out that Access List basic auth and app-side auth both use `Authorization`, so the app-side login is the one to disable in production.
For direct local Docker testing without a proxy: