ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: block public hermes browser UI
Deploy Caddyfile to valhalla / deploy (push) Successful in 51s
Details

Browse Source
This commit is contained in:
ginnoir
2026-06-21 14:46:22 -05:00
parent d38048faf0
commit b4a45a6735
1 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
+4 -8
View File
@@ -360,22 +360,18 @@ homarr.ginnoir.com {
reverse_proxy homarr:7575 reverse_proxy homarr:7575
} }
# Hermes Desktop remote backend. Browser UI is SSO-gated; API/WS paths # Hermes Desktop remote backend. Only API/WS is exposed for native
# are passed through so Desktop clients can authenticate with the Hermes # clients; the browser dashboard is blocked so its injected session token
# dashboard session token instead of an Authentik browser cookie. # is not leaked to the public web.
hermes.ginnoir.com { hermes.ginnoir.com {
route { route {
import authentik_outpost
handle /api/* { handle /api/* {
reverse_proxy 172.20.0.1:9119 { reverse_proxy 172.20.0.1:9119 {
header_up Host 172.20.0.1:9119 header_up Host 172.20.0.1:9119
} }
} }
handle { handle {
import authentik_forward_auth respond "Hermes dashboard browser UI is disabled on this public hostname." 403
reverse_proxy 172.20.0.1:9119 {
header_up Host 172.20.0.1:9119
}
} }
} }
} }