docs: add new Access Control and Logs documentation pages
- Documented Access Control features (e.g., Device Approvals, Password Rotation, 2FA, Custom Login Pages). - Added detailed descriptions for Logs & Analytics (Access Logs, Request Logs, Action Logs). - Included configuration instructions and feature-specific notes for Pangolin Cloud and Enterprise Edition. Signed-off-by: Stefan Mogeritsch <stefan.mo.co@gmail.com>
This commit is contained in:
@@ -0,0 +1,170 @@
|
||||
> ## Documentation Index
|
||||
> Fetch the complete documentation index at: https://docs.pangolin.net/llms.txt
|
||||
> Use this file to discover all available pages before exploring further.
|
||||
|
||||
# Rules
|
||||
|
||||
> Configure rules to allow or deny access to resources without authentication
|
||||
|
||||
<div id="pangolin-toc-cta" className="pangolin-toc-cta-source">
|
||||
<Card title="Try free on Pangolin Cloud" icon="cloud" href="https://app.pangolin.net/auth/signup" arrow="true" cta="Sign up free">
|
||||
Fastest way to get started with Pangolin using the hosted control plane. No credit card required.
|
||||
</Card>
|
||||
</div>
|
||||
|
||||
Rules allow you to either "allow" and bypass the Pangolin auth system (no pin, login, password), or "deny" and fully
|
||||
reject the request. After you create a resource you can select the "Rules" tab on the sidebar and enable rules.
|
||||
|
||||
<CardGroup cols={3}>
|
||||
<Card title="Bypass Auth" icon="check">
|
||||
Bypass authentication completely for matching requests. Users can access resources without any login or PIN.
|
||||
</Card>
|
||||
|
||||
<Card title="Block Access" icon="x">
|
||||
Completely reject requests that match the rule. Useful for blocking admin paths or sensitive endpoints.
|
||||
</Card>
|
||||
|
||||
<Card title="Pass to Auth" icon="x">
|
||||
Pass requests that match the rule to the next stage for user to authenticate with SSO, password, or pin. Useful for enforcing auth on specific paths while allowing others.
|
||||
</Card>
|
||||
</CardGroup>
|
||||
|
||||
## Types of Rules
|
||||
|
||||
Rules are processed from top to bottom in order of their priority. This means you can have multiple rules to bypass auth
|
||||
and to just flat deny users at the end.
|
||||
|
||||
Right now you can match on the following items:
|
||||
|
||||
### Path
|
||||
|
||||
Path match rules allow URL patterns defined with plain text and wildcards (`*`) that match any characters. Patterns and
|
||||
URLs are split into segments (using `/`), and **each segment is matched individually**.
|
||||
|
||||
#### Examples:
|
||||
|
||||
* `blog/posts`
|
||||
Matches the exact path `/blog/posts`.
|
||||
|
||||
* `blog/*`
|
||||
Matches any path under `/blog` (e.g., `/blog/travel`).
|
||||
|
||||
* `*/2023/*`
|
||||
Matches paths with `/2023/` as a middle segment (e.g., `/news/2023/summary`).
|
||||
|
||||
* `article*`
|
||||
Matches **segments** starting with "article" (e.g., `/article-123`).
|
||||
|
||||
* `*admin*`
|
||||
Matches **segments** containing "admin" (e.g., `/my-admin-panel`).
|
||||
|
||||
* `personal-*/*`
|
||||
Matches paths where the first segment starts with `personal-` and is followed by any segment (e.g.,
|
||||
`/personal-blog/post`).
|
||||
|
||||
#### Segment-by-Segment Matching
|
||||
|
||||
* **Normalization:**
|
||||
Both patterns and URLs are split into segments. For example, `/blog/journal/entry` becomes
|
||||
`["blog", "journal", "entry"]`, while `/blog*` becomes `["blog*"]`.
|
||||
|
||||
* **Validation:**
|
||||
Each pattern segment must correspond to a URL segment, and wildcards match zero or more characters within that
|
||||
segment. A pattern like `/blog*` only matches the first segment, so URLs with extra segments require additional
|
||||
placeholders (e.g., `/blog*/*`).
|
||||
|
||||
### Country
|
||||
|
||||
Country match rules allow you to specify allowed or denied countries for requests based on their IP address. This is
|
||||
useful for geo-restrictions or compliance with regional regulations.
|
||||
|
||||
We use a IP database to geolocate the IP address but this is not always accurate. We try to keep it updated, but there
|
||||
may be cases where the location is incorrect.
|
||||
|
||||
Select the "ALL" option to match all countries for allowing or denying access.
|
||||
|
||||
### CIDR
|
||||
|
||||
CIDR (Classless Inter-Domain Routing) notation specifies IP address ranges using an IP address and a network prefix
|
||||
length. The format is \[IP address]/\[prefix length].
|
||||
|
||||
**Examples:**
|
||||
|
||||
* `192.168.1.0/0` - Matches all 256 IPs from 192.168.1.0 to 192.168.1.255
|
||||
* `10.0.0.0/8` - Matches any IP starting with 10 (16.7 million addresses)
|
||||
* `2001:db8::/32` - Matches a range of IPv6 addresses
|
||||
* `0.0.0.0/0` - Matches all IPv4 addresses
|
||||
|
||||
<Note>
|
||||
The prefix length (1-32 for IPv4, 1-128 for IPv6) determines how many bits from the left are fixed. Smaller prefix numbers match larger ranges.
|
||||
</Note>
|
||||
|
||||
### IP
|
||||
|
||||
Pretty simple: you can match on simply an IP address like your home IP to bypass auth. This is the same as entering a
|
||||
/32 CIDR.
|
||||
|
||||
**Examples:**
|
||||
|
||||
* `23.234.134.32`
|
||||
* `34.45.245.64`
|
||||
* `192.168.1.1`
|
||||
|
||||
## Rules for Specific Apps
|
||||
|
||||
This table compiles paths that need to be allowed for various apps to work with Pangolin authentication.
|
||||
|
||||
| App | Required Bypass Rules |
|
||||
|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| **Media Management** | |
|
||||
| Radarr | `/api/*` |
|
||||
| Sonarr | `/api/*` |
|
||||
| Lidarr | `/api/*` |
|
||||
| **Media Servers** | |
|
||||
| Jellyfin (iOS) | `/system/info/public` |
|
||||
| Jellyfin (Roku) | `/System/Info/Public`<br />`/Users/AuthenticateByName`<br />`/Users/Public`<br />`/QuickConnect/Initiate`<br />`/QuickConnect/Connect`<br />`/Users/AuthenticateWithQuickConnect` |
|
||||
| Audiobookshelf | Audiobookshelf also supports `/audiobookshelf` by default. Each rule should also be applied to this path.<br />`/api/*`<br />`/login`<br />`/auth/*`<br />`/feed/*`<br />`/socket.io/`<br />`/status`<br />`/logout`<br />`/ping`<br />`/public/*`<br />The following is needed for public shares and is optional for clients:<br />`/share/*`<br />`/_nuxt/*.js`<br />`/_nuxt/fonts/*` |
|
||||
| **Management & Monitoring** | |
|
||||
| Tautulli | `/api/*` |
|
||||
| Harbour | `/api/*` |
|
||||
| Hoarder App | `/api/*` |
|
||||
| Uptime Kuma Manager | `/api/*`<br />`/socket.io/*` |
|
||||
| Beszel | `/api/beszel/agent-connect` |
|
||||
| MeshCentral | `/api/*`<br />`/meshrelay.ashx`<br />`/agent.ashx` |
|
||||
| **Security & Privacy** | |
|
||||
| AdGuard Home | `/api/*` |
|
||||
| Ente Auth | `*api*` |
|
||||
| Vaultwarden/Bitwarden | `/api/*`<br />`/identity/*`<br />`/wl/*`<br />Always Deny - Path - `/admin/*` |
|
||||
| **Cloud & Sync** | |
|
||||
| Nextcloud | `/` (Main interface)<br />`/index.php` (Core handler)<br />`/remote.php` (Remote access)<br />`/status.php` (Status checks)<br />`/ocs` (Collaboration Services API)<br />`/apps` (Applications)<br />`/remote.php/webdav` (WebDAV endpoint)<br />`/remote.php/dav` (CalDAV/CardDAV)<br />`/remote.php/caldav` (Calendar sync)<br />`/remote.php/carddav` (Contacts sync)<br />`/ocs/v1.php` (API endpoints)<br />`/ocs/v2.php` (API v2 endpoints)<br />`/login` (Authentication)<br />`/.well-known/*` (Service discovery)<br />`/.well-known/webfinger` (WebFinger protocol)<br />`/s/*` (Shared files/folders) |
|
||||
| Onlyoffice | `/cache/*`<br />`*/CommandService.ashx`<br />`*/converter/*`<br />`*/doc/*`<br />`*/downloadas/*`<br />`/downloadfile/*`<br />`*/fonts/*`<br />`/healthcheck`<br />`/methodology/*`<br />`*/plugins.json`<br />`*/sdkjs/*`<br />`*/sdkjs-plugins/*`<br />`*/themes.json`<br />`*/web-apps/*` |
|
||||
| **Photo Management** | |
|
||||
| Ente Photos | `*api*` |
|
||||
| Immich | `/api/*`<br />`/.well-known/immich` |
|
||||
| **File Management** | |
|
||||
| Filebrowser | `/static/*`<br />`/share/*` <br /> `/api/public/dl/*` <br /> `/api/public/share/*` |
|
||||
| **Notes & Knowledge Management** | |
|
||||
| Joplin Notes Server | `/api/*`<br />`/shares/*`<br />`/css/*`<br />`/images/*`<br />Always Deny - Path - `/login/*` (optional) |
|
||||
| Erugo | `/api/*`<br />`/shares/*`<br />`/build/*`<br />`/get-logo` |
|
||||
| Memos | `/api/*`<br />`/assets/*`<br />`/explore*`<br />`/memos.api.v1.*`<br />`/auth/callback*`<br />`/auth`<br />`/site.webmanifest`<br />`/logo.webp`<br />`/full-logo.webp`<br />`/android-chrome-192x192.png` |
|
||||
| Linkding | `/api/*`<br />`/bookmarks/*`<br />Always Deny - Path - `/admin/*` |
|
||||
| **Communication** | |
|
||||
| Matrix/Synapse (Clients) | `/_matrix/*`<br />`/_synapse/client/*` |
|
||||
| Matrix/Synapse (Federation) | `/_matrix/*` |
|
||||
| **Notifications** | |
|
||||
| Gotify | `/version`<br />`/message`<br />`/application`<br />`/client`<br />`/stream`<br />`/plugin`<br />`/health` |
|
||||
| **Home Automation** | |
|
||||
| Home Assistant | `/api/*`<br />`/auth/*`<br />`/frontend_latest/*`<br />`/lovelace/*`<br />`/static/*`<br />`/hacsfiles/*`<br />`/local/*`<br />`/manifest.json`<br />`/sw-modern.js` |
|
||||
| n8n | `/webhook-test/*/webhook`<br />`/webhook/*/webhook` |
|
||||
| **Project Management** | |
|
||||
| Jetbrains Youtrack | `/api/*`<br />`/hub/api/*`<br /> |
|
||||
| **Genealogy** | |
|
||||
| Gramps Web | `/api/*` |
|
||||
| **Analytics** | |
|
||||
| Liwan | `/script.js`<br /> `/api/send` |
|
||||
| Umami | `/script.js`<br /> `/api/send` |
|
||||
|
||||
<Note>
|
||||
These rules are examples and may need to be adjusted based on your specific app configuration and version.
|
||||
</Note>
|
||||
|
||||
Reference in New Issue
Block a user