Unheard0840/munin-bitcoin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update docs/build-notes.md

Browse Source 
Update build notes for authentication milestone
This commit is contained in:
Unheard0840
2026-08-29 07:54:15 +00:00
parent f1604758e7
commit badf797701
1 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/build-notes.md
+23 -16
View File
@@ -44,18 +44,22 @@
### Milestone 4 — Authentication and access control
- Add password authentication for the Munin web interface
- Require authentication before accessing the status API
- Store the configured admin password through the StartOS package configuration
- Pass the configured admin password to the service through `MUNIN_ADMIN_PASSWORD`
- Create cryptographically random session tokens
- Store active sessions in memory with a 24-hour expiration
- Protect sessions with an `HttpOnly`, `Secure`, `SameSite=Strict` cookie
- Compare passwords using a timing-safe comparison
- Return HTTP 401 when the status API is accessed without a valid session
- Provide a web login form for authentication
- Verify successful login and authenticated status API access on the physical StartOS server
- Verify the authentication-protected S9PK package contains the authentication backend and updated web interface
- Add user authentication for the Munin web interface
- Require authentication before accessing wallet and monitoring data
- Add password management through StartOS `Actions & Config`
- Store the Munin admin password in the persistent StartOS `main` volume
- Pass the stored admin password to the Munin container through `MUNIN_ADMIN_PASSWORD`
- Protect the status API from unauthenticated access
- Use secure, HTTP-only, SameSite session cookies
- Use cryptographically random session tokens
- Use constant-time password comparison
- Expire sessions after 24 hours
- Clean up expired sessions periodically
- Display a login form in the web interface
- Display authentication errors in the web interface
- Verify authentication on the physical StartOS server
- Verify that the configured password survives a package update
- Verify that authenticated access to the status API continues to work after the package update
## Current architecture
@@ -64,11 +68,12 @@
- nginx serving the web interface
- Node.js status API
- Static dashboard in `web/index.html`
- Password authentication and session handling in `server/auth.js`
- Fulcrum provided as a StartOS dependency
- Electrum protocol connectivity check from Munin to Fulcrum
- Blockchain height queried through Fulcrum
- Admin password provided to the service through the StartOS package environment
- StartOS `main` volume used for persistent Munin data
- Admin password stored persistently in the StartOS `main` volume
- Session-based authentication for the web interface
## Current status
@@ -76,9 +81,11 @@ Munin Bitcoin is running as a StartOS service and can verify connectivity to the
Munin can query the current Bitcoin blockchain height through Fulcrum.
The Munin web interface now requires password authentication before the protected status API can be accessed.
The Munin web interface is protected by password authentication.
Authenticated sessions use a temporary in-memory session token with a 24-hour lifetime.
The admin password can be configured through StartOS `Actions & Config` and is stored in the persistent `main` volume so that it survives package updates.
Authentication and password persistence have been verified on the physical StartOS server, including verification that an existing password remains valid after a package update.
Bitcoin Core RPC is not currently used by Munin.