Guests

Darren’s admin page for dbb-auth guests. Approved 11 Nov 2026.

The host is https://guests.server.daz.dev. It is Tailscale-only, in /data/coolify/proxy/dynamic/dbb-tailscale-only-apps.yaml. On the tailnet the router is dbb-guests-auth@file (platform/traefik-guests-auth.yaml). That middleware calls the app, and the app asks Authelia who the session is. Only the user mail or the group superadmin is allowed. A guest session is refused.

platform/auth/configuration.yml also has an access rule for guests.server.daz.dev with those same subjects. Authelia reads access rules at start. The merge of PR #50 restarted dbb-auth at 15:58 UTC and loaded that rule, so a sign-in can return straight to this host.

What the page does

The page lists guests with their sites, end date, and status. Add a guest with a username, a display name, ticked sites, and an end date. The end date defaults to seven days from today and can be changed. The guest stays active through 23:59 Europe/Isle_of_Man on that date.

Each tick is an existing dbb-auth group:

• A dev host <app>-dev.server.daz.dev maps to the group <app>. Previews of that app use the same group and are not separate ticks.
• A staging host maps to the group <app>-staging.
• A production host behind dbb-auth gets a tick only when an access rule already names a group other than superadmin. The page does not invent a production group.
• A production host with no dbb-auth middleware is shown as “Public, no access needed”.
• A host that is behind sign-in but matches no guest group, such as seraphiim-inloop-development.server.daz.dev, is shown as “Behind sign-in, no guest grant”.

The site list is /home/daz/.local/share/dbb-guests/sites.json, rewritten every minute from the live routers and from the access rules. dbb-auth-expire-guests.timer runs that refresh and then the expiry job.

Password

The page generates a 32-character password once. It is not shown in the page, the logs, or the chat. The plaintext is written to /home/daz/_secrets/guests/<username>.txt (mode 600, owner daz). The page shows that path. Authelia stores only the argon2id hash in /data/users_database.yml on the dbb-auth volume. There is no second encrypted copy.

Ben Holden’s password was created before this page and stays at /home/daz/_secrets/ben-dotai-staging.txt.

Sign-in for a guest added here is the username or <username>@guests.daz.dev. Ben still signs in as ben or ben@craftapplied.com.

Add, revoke, extend, delete

Back up the users file before every write. The copy is /home/daz/_backups-auth/dbb-guests/<stamp>-dbb-auth-users.yml (mode 600). The directory is mode 700. The newest 20 users-file copies are kept. The write is a temp file in the same directory, then a rename. Authelia watches the users file, so the change applies with no restart.

• Add. Username, display name, at least one ticked site, end date. The user mail cannot be created again, and superadmin cannot be granted.
• Revoke. Sets disabled: true now. The end date stays. Status becomes Revoked while the date is still in the future.
• Extend. Sets a new end date. A future date turns disabled back to false, so a revoked or expired guest can sign in again.
• Delete. Removes the guest from the users file and from /data/guests.yml, and deletes the password file under /home/daz/_secrets.

ben is the existing guest: group dotai-website-staging, end date 18 Nov 2026 (through 23:59 Europe/Isle_of_Man). The page does not change that date.

Expiry

dbb-auth-expire-guests.timer runs every minute as daz. The script is /home/daz/.local/lib/dbb-auth/expire-guests.sh, copied from platform/auth/expire-guests.sh so it does not follow the checkout. platform/deploy-guests.sh then points that installed copy at /home/daz/_backups-auth/dbb-guests/ and keeps 20 users-file copies. The git file under platform/auth/ is not edited for that path: merging platform/auth/** redeploys dbb-auth. A guest whose calendar date in Europe/Isle_of_Man is after end_date is set to disabled: true. The job does not restart Authelia. mail is never disabled by it.

The one-shot dbb-auth-expire-ben.timer is retired. Ben’s end date is unchanged, and the shared job covers him.

Deploy

platform/deploy-guests.sh creates the Coolify application dbb-guests in Platform / production, from apps/dbb-guests. Previews are off. It extends the Tailscale rule, writes the guests middleware file, mounts the dbb-auth volume, /home/daz/_secrets, the backup directory, and the site catalog, and enables the timer. It does not restart Traefik or dbb-auth.

Do not put a guest password, the Coolify token, or the Authelia secrets in git, the changelog, or a log.