Authentication to protect TeslaMate from outside

[tobiasehlert]

I am thinking if TeslaMate should have some possibilities to have oauth2 login to access the page, if you have it exposed to the internet. As now, Grafana can be configured to use oauth2 with various providers and it would be nice to have that too for TeslaMate web too.
Or shall I aim for some oauth2-proxy instead maybe.. maybe someone has experience with that?

[ngardiner]

Take a look at vouch-proxy, it's what I use. Combined with nginx it controls auth to all of my exposed services without having to configure each on le separately.

[tobiasehlert]

Thanks for the suggestion @ngardiner, I've been looking at GitHub project oauth2-proxy as well, but it looks like Vogue is a better fit for me.

One thing I have in mind is that I want some people to access some TeslaMate installations and some other to another installation.. as it looks to me, there is no fine-grained access control function to be able to allow some user for some page, if I don't create multiple Vouch instances and have multiple authentication points, right?

[ip999]

Have a look into cloudflare access, it's free up to 50 users, can integrate with a bunch of different identity providers and doesn't need to you actually expose your services directly to the internet. You can also assign users to different/multiple apps via the portal.

[tobiasehlert]

Hi @ip999,
Sorry for the slow response first of all and thanks for your suggestion.

The issue with cloudflare is that you need to move the DNS to them. I kind of have most of my DNS in one place.
Also when resolving, will it resolve to "my home ip" or would that be to some tunnel service at cloudflare?
Does it work to send ssh traffic a as well this way too?

Internal DNS inside the network will of course continue to work as usual :)

Or am I getting something wrong maybe?

Regards,
Tobias

[KrzysztofHajdamowicz]

You can use cloudflared to tunnel traffic between Cloudflare and Your box. That way, you don't expose any service to public IP and cloudflared calls home, so dynamic IP is not a problem. I am using it this way for a year or two.