#Sso
ADR 0018: One group per service, with administration rights and quotas derived from the directory
Access to each service is granted by adding someone to a group; applications' administration rights follow the administrators group; quotas are set from the accounts page.
Group-based access, quotas and documentation in the homelab's colours
Access to each service is granted by ticking a group, administration rights follow the directory, and allocated space is set from a single page.
ADR 0014: Monitoring with Prometheus, a custom public NOC behind SSO
Prometheus collects, Alertmanager notifies by email and on the phone (ntfy), and a custom page publishes a NOC viewable after authentication.
ADR 0015: Semaphore UI to run Ansible from the homelab
An internal web interface, protected by SSO, runs the versioned playbooks; its access is restricted and verified.
ADR 0016: An OpenBao secrets vault, alongside SOPS
Secrets move into an OpenBao vault (SSO sign-in, identity-based access, audit); SOPS remains the bootstrap store.
ADR 0017: Inviting people without sending a password, from an accounts page
Accounts are created without a password and the person chooses their own through a one-time link; an administration page, behind the VPN and SSO, replaces the command line.
Monitoring, a custom NOC and automation
The homelab monitors itself, sends alerts to the phone, shows its status on a home-made NOC and is driven from Semaphore.
ADR 0011: LLDAP directory and Authelia single sign-on
A single LDAP directory for accounts and an SSO portal with two-factor authentication for every published service.