139 lines
1.9 KiB
Markdown
139 lines
1.9 KiB
Markdown
# nx9-auth
|
|
|
|
A lightweight Identity and Access Management (IAM) service for the NX9 ecosystem.
|
|
|
|
Built with Rust, Axum, SQLite, and modern security practices, `nx9-auth` provides authentication, authorization, session management, personal access tokens, audit logging, and role-based access control in a single deployable binary.
|
|
|
|
## Features
|
|
|
|
* User management
|
|
* Role-Based Access Control (RBAC)
|
|
* Session authentication
|
|
* Personal Access Tokens (PAT)
|
|
* Audit logging
|
|
* Transaction-safe operations
|
|
* SQLite with WAL mode
|
|
* Online backups
|
|
* Interactive initialization
|
|
* Docker and CasaOS support
|
|
* Systemd deployment support
|
|
* XDG-compliant user mode
|
|
|
|
## Quick Start
|
|
|
|
Initialize a new installation:
|
|
|
|
```bash
|
|
nx9-auth init
|
|
```
|
|
|
|
Start the server:
|
|
|
|
```bash
|
|
nx9-auth serve
|
|
```
|
|
|
|
Verify health:
|
|
|
|
```bash
|
|
curl http://127.0.0.1:8655/health
|
|
```
|
|
|
|
## CLI Commands
|
|
|
|
```bash
|
|
nx9-auth init
|
|
nx9-auth serve
|
|
nx9-auth doctor
|
|
|
|
nx9-auth create-user
|
|
nx9-auth create-admin
|
|
|
|
nx9-auth create-token
|
|
nx9-auth revoke-token
|
|
|
|
nx9-auth show-user
|
|
nx9-auth show-token
|
|
|
|
nx9-auth backup
|
|
```
|
|
|
|
## Deployment Modes
|
|
|
|
### User Mode
|
|
|
|
Uses XDG directories:
|
|
|
|
```text
|
|
~/.config/nx9-auth/
|
|
~/.local/share/nx9-auth/
|
|
~/.local/state/nx9-auth/
|
|
```
|
|
|
|
### System Mode
|
|
|
|
```text
|
|
/etc/nx9-auth/
|
|
/var/lib/nx9-auth/
|
|
/var/log/nx9-auth/
|
|
```
|
|
|
|
### Docker
|
|
|
|
```bash
|
|
docker compose up -d
|
|
```
|
|
|
|
### CasaOS
|
|
|
|
```text
|
|
/DATA/AppData/nx9-auth
|
|
├── config
|
|
├── db
|
|
├── state
|
|
└── backups
|
|
```
|
|
|
|
## Security
|
|
|
|
* Argon2id password hashing
|
|
* BLAKE3 token hashing
|
|
* Session revocation
|
|
* Transactional audit logging
|
|
* Timing attack mitigation
|
|
* Security regression test suite
|
|
|
|
## Testing
|
|
|
|
```bash
|
|
cargo test --all
|
|
```
|
|
|
|
Current test coverage includes:
|
|
|
|
* Unit tests
|
|
* Integration tests
|
|
* Security tests
|
|
* Migration compatibility tests
|
|
* CLI tests
|
|
|
|
## Roadmap
|
|
|
|
### v0.1.x
|
|
|
|
* Stable IAM core
|
|
* BZOD integration
|
|
|
|
### v0.2.x
|
|
|
|
* OAuth2 Authorization Server
|
|
* OpenID Connect (OIDC)
|
|
* PKCE support
|
|
|
|
## License
|
|
|
|
Apache 2.0 or MIT -- Dual License
|
|
|
|
```
|
|
```
|