[FEAT] Ability to access Sealskin server without the browser extension

[OrcsBR]

Is this a new feature request?

• I have searched the existing issues

Wanted change

I want to access my Sealskin install from a machine where I cant install browser extensions, per IT enforced rules.

Would it possible to provide access to the sealskin instance without having the extension installed? Even if it comes with a cost of losing some features? Os is it a no-no?

Reason for change

broadening user base

Proposed code change

No response

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thelamer]

The reason there is not a standard web access method is authentication.

I am super paranoid about people exposing things to the internet as there are literal groups of bot nets that are making their entire salary installing crypto miners on selkies/kasm based containers people leave exposed to the internet without auth.

There are secure methods, but in almost all cases they can be mis-configured which is why this uses RSA public private key cryptography for auth right now.

I host this and I publicly expose it to the internet. Before adding other more convenient auth methods I need to actually learn about them and how to implement them securely. (Oauth 2FA etc)

[ne0YT]

@thelamer I'm so excited for that feature.. do you have any idea when the next big release is coming? maybe with SSO or Nextcloud?

[jkaberg]

I'd like to +1 for this one, my setup is pretty straightforward;

I use oauth2-proxy in tandem with Traefik offloading auth to Github and effectively force all public endpoints to be authorized via this forward proxy solution - so in this regard I would like to see Sealskin trust forward headers (eg X-Forwarded-For, X-Auth-Request-Email and Remote-User) and an environment variable to effectively disable any other authentication.

I'm in the same boat as @OrcsBR - the IT policy here forbids the install of any none whitelisted browser extension.

[thelamer]

I mean I can make a no auth http landing that looks like the mobile app interface, pretty low hanging fruit. The real question is how do I make sure people don't use this to get it "working".
The other complexity is that the baked in caddy server parses the request to forward it to the correct container it is a tight integration so that would need to be fundamentally altered.

This project exists mostly for me as this is exactly what I want, but also as a roadmap for people to feed to ai agents and be able to leverage spinning up and down selkies based containers. Running them all the time makes no sense for a desktop app usecase. It shows how to do multi user collaboration using the token system with input passing, it shows how to pass the settings to the containers, and it shows a possible proxy that can be used (caddy in this case).

I still do not have a solid idea of how to implement an actual web only system unless I still controlled the auth, that is the mental block on this one. I cannot trust our users as I have been interacting with them for a decade.

Also just to reiterate, this is a public facing container with the docker socket mounted into it, a breach there is catastrophic (full root to the underlying host) so the approach was how does ssh work and to copy that not to invent a new auth stack.

[ne0YT]

The real question is how do I make sure people don't use this to get it "working".

just make the option configurable in the .env -file which also includes a note saying that it's necessary for security to be used with an auth-proxy?

or maybe directly integrate this?:
https://github.com/greenpau/caddy-security

for me it would be amazing to just have OAuth 2.0 easily configurable by .env or similar.

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[thelamer]

I will eventually make a new container called sealskin-web, this will have zero auth and be designed to be run through external proxies. Still have to think about the details. It will use the same codebase but be an isolated container with all kinds of security warnings.