SecurityDept

Standalone auth service and reusable Rust crates for OIDC + credential auth. Includes OIDC login, local basic/token entries with groups, and forward-auth endpoints for reverse proxies (Traefik, Nginx). File-based config and data, no database.

---

Status: v0.1.1 release-ready — Core flows are implemented across API, CLI, and Web UI. Docker image build and GHCR publish workflow are in place. See Roadmap for next milestones.

What it does

• Login: External OIDC (authorization code, optional PKCE); optional claims-check script (JS in Boa).
• Entries & groups: Basic auth and token auth entries, grouped by name; CRUD via REST API and CLI.
• Forward-auth: GET /api/forwardauth/traefik/:group and /api/forwardauth/nginx/:group — validate Authorization against group entries; no session.
• Config: TOML + env (Figment); single JSON data file for entries and groups.
• Reusable crates: securitydept-core re-exports sub-crates with feature flags for aligned versions; securitydept-oidc and securitydept-creds can also be used directly.

Workspace Crates

• securitydept-oidc: OIDC client, config model, claims check flow, pending OAuth store abstractions.
• securitydept-creds: Basic/bearer parsing, Argon2/SHA-256 primitives, credential traits, validator traits/helpers.
• securitydept-creds-manage: File-backed store + models for entries/groups, app-level auth helpers, session manager.
• securitydept-utils: Shared URL/HTTP utility helpers.
• securitydept-core: Aggregator crate that re-exports internal crates via features to keep downstream versions aligned.
• securitydept-server: HTTP server (Axum) wiring all crates into APIs/forward-auth endpoints.
• securitydept-cli: Local management CLI using the same store/config model.

Quick Start

Copy config.example.toml to config.toml and edit it.

wget https://raw.githubusercontent.com/ethaxon/securitydept/refs/heads/main/config.example.toml -O config.toml

Then create a docker-compose.yml (see below), and start it with docker compose up -d:

name: securitydept

services:
  securitydept-server:
    # build: .
    image: ghcr.io/ethaxon/securitydept:latest
    ports:
      - 7021:7021
    environment:
      - SECURITYDEPT_CONFIG=/app/config.toml
    volumes:
      - ./config.toml:/app/config.toml
      - ./data:/app/data
      # - ./claims-script-check.mts:/app/claims-script-check.mts # for custom claims check
      # - ./webui:/app/webui # for custom webui

For Developer

Stack: Rust (Axum, OpenID Connect, Figment, Snafu) · TypeScript + Vite + React (TanStack, Tailwind, shadcn/ui) · mise · just · pnpm · cargo

cp config.toml.example config.toml   # edit as needed
just dev-server              # dev server
just dev-webui               # dev webui

Docs

Doc	Content
Overview	Goals, tech stack, index
Architecture	Layout, config/data model, request flow
Features	Implemented capabilities and code locations
Roadmap	Done, gaps, suggested priorities

License

MIT