Import the MetaMesh app family from Worph/AppStore

23 apps (MetaCore, the library/network/client tiers and 13 MetaFeeder*) move out of the general-purpose Worph/AppStore into their own store so the MetaMesh family releases on its own cadence. - asset URLs repointed to cdn.jsdelivr.net/gh/Worph/MetaAppStore@main - store scaffolding added (category/recommend/featured lists, licence, contributing, gitattributes) - psd-source/meta-icons-v2 icon generator follows the apps MetaMCP stays in Worph/AppStore: it is third-party metatool-ai software, not part of MetaMesh.
2026-09-13 16:18:29 +00:00
parent 998eba19f4
commit 39f82e1f96
145 changed files with 12964 additions and 1 deletions
@@ -0,0 +1,142 @@
+# =============================================================================
+# Authelia Configuration for MetaMesh (OIDC provider mode)
+#
+# Template — MetaCore/pre-install-cmd substitutes the placeholders below at
+# install time: APP_DOMAIN, APP_PUBLIC_IP_DASH, HMAC secret, RSA JWKS private
+# key, and one argon2id hash per OIDC client.
+#
+# Protected apps reach Authelia via OIDC (not forward_auth) so each app's
+# session cookie can be host-scoped to its own <app>-__AUTH_DOMAIN__ host.
+# =============================================================================
+
+# Server settings (plain HTTP - Caddy edge proxy handles TLS).
+# Buffers bumped to cope with large OIDC requests (long state + cookies).
+server:
+  address: 'tcp://0.0.0.0:9091'
+  buffers:
+    read: 16384
+    write: 16384
+
+# Logging
+log:
+  level: info
+
+# Authentication backend (file-based, single user)
+authentication_backend:
+  file:
+    path: /config/users_database.yml
+
+# Session configuration — scoped to Authelia's own portal only.
+# Host-exact scope: cookie is set on 'auth-<domain>' and authelia_url is
+# 'https://auth-<domain>' — exact host match, valid cookie scope.
+# Protected apps get their own host-scoped sessions via oauth2-proxy sidecars.
+session:
+  cookies:
+    - domain: 'auth-__AUTH_DOMAIN__'
+      authelia_url: 'https://auth-__AUTH_DOMAIN__'
+      name: 'authelia_session'
+      same_site: 'lax'
+      inactivity: '5m'
+      expiration: '1h'
+      remember_me: '1M'
+
+# Storage (SQLite for single-user deployment)
+storage:
+  local:
+    path: /config/db.sqlite
+
+# Access control
+access_control:
+  default_policy: one_factor
+
+# TOTP (for 2FA)
+totp:
+  issuer: 'MetaMesh'
+  period: 30
+  skew: 1
+
+# Filesystem notifier (no SMTP needed for single-user)
+notifier:
+  filesystem:
+    filename: /config/notifications.txt
+
+# OIDC Identity Provider — each MetaMesh app registers as a client and
+# delegates auth to Authelia via the standard Authorization Code flow.
+identity_providers:
+  oidc:
+    hmac_secret: '__OIDC_HMAC__'
+    jwks:
+      - key_id: 'metamesh-default'
+        algorithm: 'RS256'
+        use: 'sig'
+        key: |
+__OIDC_JWKS_KEY__
+    clients:
+      - client_id: 'metacore'
+        client_name: 'MetaCore Dashboard'
+        client_secret: '__CLIENT_METACORE_HASH__'
+        public: false
+        authorization_policy: 'one_factor'
+        consent_mode: 'implicit'
+        require_pkce: false
+        redirect_uris:
+          - 'https://metacore-__AUTH_DOMAIN__/oauth2/callback'
+          - 'https://metacore-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metacore-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+          - 'refresh_token'
+        token_endpoint_auth_method: 'client_secret_basic'
+
+      - client_id: 'metasort'
+        client_name: 'MetaSort Dashboard'
+        client_secret: '__CLIENT_METASORT_HASH__'
+        public: false
+        authorization_policy: 'one_factor'
+        consent_mode: 'implicit'
+        require_pkce: false
+        redirect_uris:
+          - 'https://metasort-__AUTH_DOMAIN__/oauth2/callback'
+          - 'https://metasort-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metasort-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+          - 'refresh_token'
+        token_endpoint_auth_method: 'client_secret_basic'
+
+      - client_id: 'metafuse'
+        client_name: 'MetaFuse Dashboard'
+        client_secret: '__CLIENT_METAFUSE_HASH__'
+        public: false
+        authorization_policy: 'one_factor'
+        consent_mode: 'implicit'
+        require_pkce: false
+        redirect_uris:
+          - 'https://metafuse-__AUTH_DOMAIN__/oauth2/callback'
+          - 'https://metafuse-__APP_PUBLIC_IP_DASH__.nip.io/oauth2/callback'
+          - 'https://metafuse-__APP_PUBLIC_IP_DASH__.sslip.io/oauth2/callback'
+        scopes:
+          - 'openid'
+          - 'profile'
+          - 'email'
+          - 'groups'
+        response_types:
+          - 'code'
+        grant_types:
+          - 'authorization_code'
+          - 'refresh_token'
+        token_endpoint_auth_method: 'client_secret_basic'