Miles WardandClaude Fable 5.1
ad3720edbf
Platform-neutral successor to Discord Authenticator, forked from its v0.1.2
state with fresh history. Same vault, same UI, same live-message mechanism —
now behind one `Sink` that speaks three platforms.
Why each platform needs what it needs (this drove the whole settings model):
- Discord: an incoming-webhook URL. Webhooks can edit their own messages.
- Slack: a bot token (xoxb-, scope chat:write) + channel ID. Slack incoming
webhooks can post but never edit, and editing IS the live mechanism, so
chat.postMessage / chat.update via a bot is the only path.
- Telegram: a bot token + chat id. No webhook concept exists. The app detects
the chat id itself from the bot's pending updates ("send /start, then
Detect"), since users rarely know it.
- core: Provider enum; settings hold all three configs so switching back and
forth never re-asks for tokens; per-platform shape validation that names the
common mistakes (xoxp- user token, #name instead of channel ID); a
destination key that clears message ids on platform/channel change but not
on token rotation
- delivery: shared DeliveryError + pacing Governor; Discord client refactored
onto them; new Slack client (classifies Slack's ok:false-on-HTTP-200
errors) and Telegram client ("message is not modified" is success; chat
detection via getUpdates); provider-agnostic message builders — code in a
copyable span everywhere, rollover time as live as each platform allows
- http-api: setup accepts an optional provider; settings PUT/GET carry the
full model; /api/slack/whoami, /api/telegram/whoami, /api/telegram/chats
- webui: three-way optional picker on setup and in Settings → Delivery with
guided per-platform fields; "Check token" (Slack) and "Detect chat"
(Telegram); inline white mark via currentColor
- brand: white mark on the dark plate; blue stays with the Discord sibling
- docs/TEAMS.md: exploration for v0.2 — Teams connectors were disabled May
2026 and Workflows webhooks can't edit, so live tiles need a Bot Framework
bot; options for the inbound endpoint on a homelab and a recommended scope
Verified against mock Discord, Slack and Telegram servers speaking each
platform's real protocol shape: edits target the same message rather than
re-posting, deleted tiles are recovered, dead credentials are surfaced with a
next step, renames refresh without a rollover, and switching platform reposts
on the new one and leaves the old one alone. 138 tests.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
35 lines
1.1 KiB
YAML
35 lines
1.1 KiB
YAML
# OpenMFA — single-container deployment.
|
|
#
|
|
# docker compose up -d
|
|
#
|
|
# Then open http://<this-host>:8720/ and complete first-run setup.
|
|
#
|
|
# No special networking: outbound HTTPS to Discord, Slack or Telegram, and
|
|
# one served HTTP port. Bridge mode is fine.
|
|
|
|
services:
|
|
openmfa:
|
|
image: gitea.milesward.dev/mward4/openmfa:latest
|
|
container_name: openmfa
|
|
restart: unless-stopped
|
|
ports:
|
|
- "8720:8720"
|
|
environment:
|
|
OPENMFA_HTTP_ADDR: "0.0.0.0:8720"
|
|
OPENMFA_LOG: "info,openmfa=info"
|
|
# Optional. Supply a base64 32-byte key to keep the vault key OFF the
|
|
# data volume — then a leaked copy of the volume is useless on its own.
|
|
# Generate one with: openssl rand -base64 32
|
|
# If unset, a key is generated into the volume as `vault.key` (0600).
|
|
# OPENMFA_MASTER_KEY: "…"
|
|
volumes:
|
|
# Vault, key, admin account and settings. Back this up — losing it
|
|
# loses every stored TOTP secret.
|
|
- ./data/work:/var/lib/openmfa
|
|
healthcheck:
|
|
test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8720/healthz"]
|
|
interval: 30s
|
|
timeout: 3s
|
|
retries: 3
|
|
start_period: 5s
|