12542ecb19
Pocket ID replaces Forgejo as the OIDC provider for Outline, Vaultwarden and NetBird; Forgejo logs in through it. Uptime Kuma sits behind tinyauth via Caddy forward_auth (group ops), the public status page stays public. offboarding/offboard.py switches one person off in every service with an API and prints what a human still has to do: the shared passwords they could read. Measured: SSO lock alone left 10 of 13 ways open for 45 minutes; the script leaves 1 of 14, the vault copy on their laptop. HARDENING.md: the ufw hairpin that broke Vaultwarden SSO and Kuma, the mesh route into the docker bridges, and a fail2ban exception for Pocket ID.
13 lines
566 B
Text
13 lines
566 B
Text
# offboard.env: copy to offboard.env (chmod 600), fill in, never commit.
|
|
# DOMAIN and VAULTWARDEN_ADMIN_TOKEN are read from the stack's .env.
|
|
|
|
# Pocket ID: Settings -> Admin -> API Keys (set an expiry)
|
|
POCKET_ID_API_KEY=
|
|
# Forgejo: forgejo admin user generate-access-token --username <admin> --token-name offboarding --scopes write:admin --raw
|
|
FORGEJO_ADMIN_TOKEN=
|
|
# Outline: API key of a workspace admin (Settings -> API)
|
|
OUTLINE_API_KEY=
|
|
# NetBird: service user with role admin -> personal access token
|
|
NETBIRD_PAT=
|
|
# n8n: Settings -> n8n API (owner)
|
|
N8N_API_KEY=
|