Account system for self-hosting

[zuoxiaodong0815]

Next we plan to develop a self-hosted version. Currently our account system uses firebase. We would like to hear your suggestions for the account system.

• Keep using the current firebase service.
• Use an open-source alternative for firebase.
• Support access to the user's SSO service, Affine provides the interface specification and the user implements it themselves.

What do you think is the most appropriate account access?

[m1911star]

I may suggest https://supabase.com/

[nghia-dang]

https://supabase.com/
https://appwrite.io/

Could be some locally hosted options.

[douglasparker]

The whole point to self-hosting is to keep everything local and self contained. We shouldn't have to rely on a third party service.

AFFiNE should work out of the box using sqlite within docker, but it's also important to support mysql and/or postgresql.

I've been watching this project and I hope to see local auth and more granular control of permissions so that way pages can be exposed to the web for read only access.

[himself65]

I'm working on refactoring the affine infra. Good to say that we now have an abstracted workspace layer that is isolated from each other workspace(like affine, local). So you can implement a different workspace type like sqlite workspace, as you said, with your authorization protocol.

But this is still under work, I hope we can publish an SDK to the community that supports a self-designed workspace.

[gnacoding]

I agree with @m1911star
Supabase would be nice because it can be self-hosted as well (+ easy to set up with docker)

This would be a great solution for people who truly want to self-host everything, meaning, Affine itself, Auth & Collaboration between users/devices

[PhilippMolitor]

On self hosting in general - the docker image has not been updated in six months. Is this intentional, or is there a pipeline that accidentially does not trigger on new releases?
Also, i think SSO via Google, GitHub, Apple, etc. is a great option for self hosted, but for private instances for clubs and communities, I'd love to see local auth in order to only allow those who are supposed to gain access.

[gnacoding]

@PhilippMolitor I read somewhere in the Projects tab that apparently when the version 0.8 is stable, they will release a new docker image. Im eagerly waiting to fully self-host affine and be able to collaborate without relying on a third-party server

[Avey777]

Currently, Affine is using Google authorization to log in, which is almost equivalent to giving up the entire Chinese market. Hope to provide an alternative solution as soon as possible

[m-akami]

I believe using our own SSO service would be best for the project, as in a usual self-hosted instance we would put the application behind a reverse proxy and manage access there. This would also lessen the burden of securing the application against common attack vectors as authentication would be managed externally, so AFFINE can focus on its core features.

[almereyda]

This is also how Outline does it, which decidedly does not offer local authentication options.

• Local Authentication outline/outline#1881

Also Affine self-hosted has such an email option nowadays.

• Run AFFiNE with Custom Options – Nextra

It also has existing oauth support for GitHub and Google, on which one could build upon.

AFFiNE/packages/backend/server/src/config/affine.ts

Lines 132 to 153 in b15ae21

	// AFFiNE.plugins.use('oauth', {
	// providers: {
	// github: {
	// clientId: '',
	// clientSecret: '',
	// // See https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps
	// args: {
	// scope: 'user',
	// },
	// },
	// google: {
	// clientId: '',
	// clientSecret: '',
	// args: {
	// // See https://developers.google.com/identity/protocols/oauth2
	// scope: 'openid email profile',
	// promot: 'select_account',
	// access_type: 'offline',
	// },
	// },
	// },
	// });

[m-akami]

What may work better is allowing the user's email to be passed through on an auth header from the proxy once authenticated, and if the account does not exist already, then AFFiNE will create one. This way minimal code is added and all authentication is done by an external provider, whether that be Authentik or Authelia etc.

[m-akami]

Although that would be a security hole, as anyone with direct access to the instance could spoof the header, and it wouldn't be a standard implementation. Additional security may work around this, but I'm not sure.

[IvanLi-CN]

I'm not sure how it's going now, but I think continuing to extend oauth should implement this feature with minimal code, without considering too many situations.

Passing user information through HTTP headers is also a good solution, but it should be necessary to add configuration such as a reverse proxy IP address whitelist in AFFine to enhance security.

I am looking forward to the implementation of the SSO function. Many of my self-deployed services are connected to Traefik + Authelia, which is very satisfactory.

[m-akami]

I agree with @IvanLi-CN, regardless of what solution is chosen one point remains - that authentication should be done externally to AFFiNE