auth providers

auth.md

@@ -31,6 +31,10 @@ PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin
 # rw is accepted as an alias of full.
 # Admin users ignore this value and can access all profiles.
 PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+
+# Optional: trusted direct-IP/local hosts that should skip pyTorrent auth.
+# Use this only on private networks, never on public proxy hostnames.
+PYTORRENT_AUTH_BYPASS_HOSTS=10.11.1.11:8090,10.11.1.11
 ```
 
 
@@ -97,24 +101,52 @@ Behavior:
 ```nginx
 location / {
   proxy_pass          $forward_scheme://$server:$port;
-  auth_request        /tinyauth;
-  error_page          401 = @tinyauth_login;
+  auth_request /tinyauth;
+  error_page 401 = @tinyauth_login;
+  
+  auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
+  auth_request_set $auth_user $upstream_http_remote_user;
+  proxy_set_header Remote-User $auth_user;
+
 }
 
 location /tinyauth {
-  proxy_pass http://10.10.11.11:3000/api/auth/nginx;
+  proxy_pass http://10.11.1.11:3000/api/auth/nginx;
   proxy_set_header x-forwarded-proto $scheme;
   proxy_set_header x-forwarded-host $http_host;
   proxy_set_header x-forwarded-uri $request_uri;
 }
 
 location @tinyauth_login {
-  return 302 http://auth.domian/login?redirect_uri=$scheme://$http_host$request_uri;
+  return 302 http://auth.example.com/login?redirect_uri=$scheme://$http_host$request_uri;
 }
 ```
 
 Use `PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User` when this setup forwards `Remote-User` to pyTorrent.
 
+## Direct-IP auth bypass
+
+Use this only when pyTorrent is reachable on a trusted private IP and you want:
+
+- reverse proxy hostname protected by Tinyauth;
+- direct private IP access without pyTorrent login.
+
+Example:
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+PYTORRENT_AUTH_PROVIDER=tinyauth
+PYTORRENT_AUTH_BYPASS_HOSTS=10.11.1.11:8090,10.11.1.11
+```
+
+Behavior:
+
+- requests with `Host: 10.11.1.11:8090` or `Host: 10.11.1.11` use the built-in default admin user;
+- requests through the reverse proxy still require the configured auth provider;
+- profile permissions are ignored for bypassed direct-IP requests because they run as the default admin user.
+
+Do not add public domains to this list.
+
 ## Generic reverse proxy authentication
 
 Use this when another proxy authenticates users and sends a username header.
@@ -143,6 +175,21 @@ PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
 - `rw` - grants read-write access to all profiles;
 - `full` - same as `rw`.
 
+## Connection badge behind Tinyauth
+
+The top-right badge shows Socket.IO connectivity, not REST API health.
+
+If the application loads data through REST API but the badge stays `offline`, the most common cause is that the Socket.IO handshake or follow-up events are not authenticated with the same external identity header. pyTorrent resolves external auth during Socket.IO connect/events as well as normal REST requests.
+
+For Tinyauth, make sure the same location that proxies pyTorrent also forwards `Remote-User` to all paths, including `/socket.io/`:
+
+```nginx
+auth_request_set $auth_user $upstream_http_remote_user;
+proxy_set_header Remote-User $auth_user;
+```
+
+No separate badge-disable option is needed. The badge should become `online` when Socket.IO connects correctly.
+
 ## Troubleshooting
 
 If the user is created but profiles are missing: