Add auth

docs/configuration.md

@@ -7,6 +7,7 @@
     - [Other ways of providing tokens/passwords/secrets](#other-ways-of-providing-tokenspasswordssecrets)
   - [Including other config files](#including-other-config-files)
   - [Config schema](#config-schema)
+- [Authentication](#authentication)
 - [Server](#server)
 - [Document](#document)
 - [Branding](#branding)
@@ -187,6 +188,67 @@ This assumes that the config you want to print is in your current working direct
 
 For property descriptions, validation and autocompletion of the config within your IDE, @not-first has kindly created a [schema](https://github.com/not-first/glance-schema). Massive thanks to them for this, go check it out and give them a star!
 
+## Authentication
+
+To make sure that only you and the people you want to share your dashboard with have access to it, you can set up authentication via username and password. This is done through a top level `auth` property. Example:
+
+```yaml
+auth:
+  secret-key: # this must be set to a random value generated using the secret:make CLI command
+  users:
+    admin:
+      password: 123456
+    svilen:
+      password: 123456
+```
+
+To generate a secret key, run the following command:
+
+```sh
+./glance secret:make
+```
+
+Or with Docker:
+
+```sh
+docker run --rm glanceapp/glance secret:make
+```
+
+### Using hashed passwords
+
+If you do not want to store plain passwords in your config file or in environment variables, you can hash your password and provide its hash instead:
+
+```sh
+./glance password:hash mysecretpassword
+```
+
+Or with Docker:
+
+```sh
+docker run --rm glanceapp/glance password:hash mysecretpassword
+```
+
+Then, in your config file use the `password-hash` property instead of `password`:
+
+```yaml
+auth:
+  secret-key: # this must be set to a random value generated using the secret:make CLI command
+  users:
+    admin:
+      password-hash: $2a$10$o6SXqiccI3DDP2dN4ADumuOeIHET6Q4bUMYZD6rT2Aqt6XQ3DyO.6
+```
+
+### Preventing brute-force attacks
+
+Glance will automatically block IP addresses of users who fail to authenticate 5 times in a row in the span of 5 minutes. In order for this feature to work correctly, Glance must know the real IP address of requests. If you're using a reverse proxy such as nginx, Traefik, NPM, etc, you must set the `proxied` property in the `server` configuration to `true`:
+
+```yaml
+server:
+  proxied: true
+```
+
+When set to `true`, Glance will use the `X-Forwarded-For` header to determine the original IP address of the request, so make sure that your reverse proxy is correctly configured to send that header.
+
 ## Server
 Server configuration is done through a top level `server` property. Example:
 
@@ -202,6 +264,7 @@ server:
 | ---- | ---- | -------- | ------- |
 | host | string | no |  |
 | port | number | no | 8080 |
+| proxied | boolean | no | false |
 | base-url | string | no | |
 | assets-path | string | no |  |
 
@@ -211,6 +274,9 @@ The address which the server will listen on. Setting it to `localhost` means tha
 #### `port`
 A number between 1 and 65,535, so long as that port isn't already used by anything else.
 
+#### `proxied`
+Set to `true` if you're using a reverse proxy in front of Glance. This will make Glance use the `X-Forwarded-*` headers to determine the original request details.
+
 #### `base-url`
 The base URL that Glance is hosted under. No need to specify this unless you're using a reverse proxy and are hosting Glance under a directory. If that's the case then you can set this value to `/glance` or whatever the directory is called. Note that the forward slash (`/`) in the beginning is required unless you specify the full domain and path.