Phase 2: Docker and OIDC auth

README.md

@@ -23,13 +23,32 @@ The project consists of two subprojects:
 - Dashboard with now-playing sessions, server monitoring overview, and per-library media counts
 - Server monitoring with CPU, IO wait, RAM, network, and disk I/O charts
 - SQLite-indexed media table with full-library sort/filter
+- Read-only Users tab with Jellyfin as the base source and optional Jellyseerr enrichment
 - Remote file browser with ffprobe preview and job execution
-- Jellyfin API integration for library metadata
+- Jellyfin API integration for library metadata and user identity data
 - SSH-based file inspection and remote job templates
 
 ## Quick Start
 
-### Backend
+### Docker Compose (recommended)
+
+Production-style deployment with the frontend serving the SPA and proxying `/api` to the backend:
+
+```bash
+docker compose up --build
+```
+
+Open the app at http://localhost:8080.
+
+Local development with hot reload:
+
+```bash
+docker compose -f docker-compose.dev.yml up --build
+```
+
+Frontend runs on http://localhost:5173 and the backend on http://localhost:8000.
+
+### Manual backend/frontend development
 
 ```bash
 cd backend
@@ -39,16 +58,12 @@ pip install -e '.[dev]'
 uvicorn media_library_viewer_api.main:app --reload --port 8000
 ```
 
-### Frontend
-
 ```bash
 cd frontend
 npm install
 npm run dev
 ```
 
-Frontend runs on http://localhost:5173 and proxies API requests to http://localhost:8000.
-
 ## Configuration
 
 Create a `.env` file in the project root:
@@ -58,6 +73,13 @@ JELLYFIN_URL=https://jellyfin.example.com
 JELLYFIN_API_KEY=your-api-key
 JELLYFIN_USER_ID=
 
+# Optional Jellyseerr enrichment for the Users tab
+JELLYSEERR_URL=https://requests.example.com
+JELLYSEERR_API_KEY=your-jellyseerr-api-key
+
+# Optional backend logging level
+LOG_LEVEL=INFO
+
 SSH_HOST=media-server.example.com
 SSH_USERNAME=username
 SSH_PORT=22
@@ -66,6 +88,21 @@ SSH_PASSWORD=
 
 REMOTE_MEDIA_ROOT=/srv/media
 REMOTE_PATH_PREFIX=
+
+# Authentik / OIDC
+AUTH_ENABLED=true
+OIDC_ISSUER_URL=https://authentik.example/application/o/media-library-viewer/
+OIDC_AUDIENCE=media-library-viewer
+OIDC_JWKS_URL=
+OIDC_CLOCK_SKEW_SECONDS=30
+
+# Frontend OIDC settings
+VITE_OIDC_ENABLED=true
+VITE_OIDC_ISSUER=https://authentik.example/application/o/media-library-viewer/
+VITE_OIDC_CLIENT_ID=media-library-viewer
+VITE_OIDC_SCOPE=openid profile email
+VITE_OIDC_REDIRECT_URI=http://localhost:8080/
+VITE_OIDC_POST_LOGOUT_REDIRECT_URI=http://localhost:8080/
 ```
 
 ## Remote server requirements
@@ -98,3 +135,4 @@ cd frontend && npx tsc --noEmit && npm run build
 - SSH commands run through `/bin/sh -c` regardless of remote login shell.
 - Job templates are shell-quoted. Add new templates in `backend/src/media_library_viewer_api/jobs.py`.
 - Monitoring collector uses JSONL in `/tmp`, pruned to 7 days / 70k lines.
+- Root-level Docker Compose files are provided for production (`docker-compose.yml`) and local development (`docker-compose.dev.yml`).