36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
#getting-started
|
|
|
|
SilverBullet supports simple authentication for a single user.
|
|
|
|
# User authentication
|
|
Set the `SB_USER` environment variable with a `username:password` combination to enable authentication:
|
|
|
|
```shell
|
|
docker run -e SB_USER=pete:1234 ...
|
|
```
|
|
|
|
This allows `pete` to log in with password `1234`. When authentication is enabled, SilverBullet shows a login page on first access.
|
|
|
|
# Remember me
|
|
The login page has a "Remember me" checkbox. When checked, the session persists across browser restarts. The session duration defaults to 7 days and can be configured:
|
|
|
|
* `SB_REMEMBER_ME_HOURS`: Sets session duration in hours (default: 168, i.e. 7 days)
|
|
|
|
# Lockout protection
|
|
To prevent brute-force attacks, SilverBullet locks out clients after too many failed login attempts:
|
|
|
|
* `SB_LOCKOUT_LIMIT`: Number of failed attempts before lockout (default: 10)
|
|
* `SB_LOCKOUT_TIME`: Duration of lockout in seconds (default: 60)
|
|
|
|
# API authentication
|
|
For programmatic access via the [[HTTP API]], you can use bearer token authentication:
|
|
|
|
* `SB_AUTH_TOKEN`: Sets a token for `Authorization: Bearer <token>` style authentication
|
|
|
|
This is useful for scripts, automation, or integrating SilverBullet with other tools.
|
|
|
|
# Authentication proxy
|
|
Alternatively, or in addition, you can use an [[Authentication Proxy]] to delegate authentication to an external system (like Authelia, Authentik, or a reverse proxy's built-in auth). This is common in more complex self-hosted setups.
|
|
|
|
For all authentication-related configuration options, see [[Install/Configuration#Authentication]].
|