Add info about necessity to setup "username" and "password" within config file

[knuurr]

I was having trouble with launching betanin the first time (both first install on amchine and first usage in my life) because I've seen in Portainer that contianer is constantly restarting itself.

I initialy thought it's about user permissions - and indeed there was such problem, but after fixing it container still restarted itself

2023-07-23 17:25:44.999 | ERROR    | betanin.entry.betanin:_ensure_config:69 - please provide a frontend username and password

I had to provide username and password manually, using vim into my config.toml file:

[frontend]
username = "user"
password = "pass"

I believe to have truly automated and seamless experience, either:

• provide default user + pass for application after install - there are users like me who have it behind reverse proxy with SSO, so I don't care that much about what credentials I use here
• allow to configure them via env variables passed, i.e. using environment section in docker-compose - either credentials or even option to disable it completely
• provide info on github page about necessity to provide these manually in confing after first run, after config generates, otherwise web page won't display

Thanks for cool piece of software, will test it soon, I hope you will find my proposal useful for the project.

[DuvelCorp]

Hi,

Starting with your tool and I noticed that error too.
Same remark as @knuurr : it makes no sense to have to hardcode a user/pass there, if the service isn't exposed to the internet and only accessible from a LAN/DMZ.
Also it is bad security as (unless I missed something) the app exposes only a http port and no https, meaning that the credentials could be easily sniffed on the network it runs.

Cheers

[sentriz]

the password needs to be kept somewhere. I don't think hardcoding is the issue

we could store a hash instead of plaintext but thats a separate issue

as for TLS, its better practise to terminate at a reverse proxy instead. you don't want all your individual services managing their own certs. that can get very messy

[martydingo]

I want to authenticate via forward proxy using Authentik.

It should be my own decision on whether to implement authentication on the software I am using, as it limits flexibility on what I can achieve. I am aware of security concerns.

I think at very least authentication should be enabled by default, but I should have the ability to disable authentication. I may result into hacking through the code myself and bypass the authentication, and that brings it's own woes with maintainance.