Jeppe Bundgaard
f6b526f4ef
- Extend `users_o` and `subusers_o` with `two_factor_enabled` and `two_factor_secret` properties. - Implement methods for managing 2FA (`isTwoFactorEnabled`, `setTwoFactorSecret`, `verify_2fa_code`) in authentication logic. - Add 2FA handling in login flows for both users and subusers, including token generation and validation. - Introduce `totp` class for TOTP-based authentication, including QR code generation and code verification. - Add test cases for 2FA functionality (`TwoFactorAuthTest.php`) and coverage for login scenarios with 2FA. - Update OpenAPI specifications to include 2FA flows (`auth/2fa/setup`, `auth/2fa/enable`, `auth/2fa/verify`, `auth/2fa/disable`).
Local TLS certificates with Docker Compose
Nginx is configured to terminate TLS using certificates mounted at /etc/letsencrypt inside the container. To use your real Let’s Encrypt certificates on the host, the Compose file mounts a configurable path via LETSENCRYPT_PATH.
1) Configure the host certificate path
Copy .env.example to .env in the project root and adjust the path for your environment:
cp .env.example .env
# Edit .env and set one of the following:
# Linux: LETSENCRYPT_PATH=/etc/letsencrypt
# Windows (WSL Ubuntu): LETSENCRYPT_PATH=//wsl$/Ubuntu/etc/letsencrypt
Ensure the following files exist under the path you set:
live/api.truckwash.dk/fullchain.pemlive/api.truckwash.dk/privkey.pemlive/cloud.truckwash.dk/fullchain.pemlive/cloud.truckwash.dk/privkey.pem
If you don’t have certs for cloud.truckwash.dk locally, either comment out that TLS server block in services/nginx/nginx.conf or place a temporary self‑signed cert/key at the expected path.
2) Start Nginx
docker compose up -d nginx
Check logs:
docker compose logs -f nginx
3) Troubleshooting
- “cannot load certificate … no such file or directory”: verify
LETSENCRYPT_PATHand that alllive/<domain>/files exist on the host. - For purely local testing without HTTPS, you may comment out the HTTPS server blocks and the HTTP→HTTPS redirect in
services/nginx/nginx.confand run on port 80.