Yeraze/meshmonitor v2.7.3

v2.7.3 - Anonymous Access Control & OIDC Migration

on GitHub

What's New in v2.7.3

🔒 Anonymous Access Control (#237)

Added ability to completely disable anonymous access to MeshMonitor, requiring authentication before accessing any features.

New Environment Variable:

• DISABLE_ANONYMOUS - Set to true to require authentication (default: false)

Features:

• Beautiful centered login page with MeshMonitor branding
• Support for both local auth and OIDC authentication
• Fully backward compatible (disabled by default)
• Works with all authentication modes:
  • Local authentication only
  • OIDC authentication only
  • Hybrid authentication (both local and OIDC)

When Enabled:

• Unauthenticated users see login page instead of app
• No access to maps, messages, or any features without authentication
• Anonymous users receive empty permissions

🔄 OIDC Account Migration (#236)

Fixed OIDC authentication failure when native-login users with the same username already exist.

Problem Solved:
Previously, when an OIDC user attempted first login and a native-login user with the same username/email existed, authentication failed with:

SqliteError: UNIQUE constraint failed: users.username

Solution:
Automatically migrate existing native-login accounts to OIDC authentication when collision detected.

Migration Features:

• ✅ Preserves user ID and all foreign key relationships
• ✅ Preserves username, permissions, and admin status
• ✅ Updates email and display name from OIDC provider
• ✅ Removes password hash (no longer needed)
• ✅ Creates audit log entry

Migration Flow:
When an OIDC user attempts first login:

1. Checks if user exists by OIDC subject
2. If not found, checks for native-login user with same username
3. Falls back to checking for user with same email
4. If native-login user found → automatically migrates to OIDC
5. If no collision → creates new OIDC user

This ensures seamless transition from native authentication to OIDC providers like Authentik, Keycloak, or Auth0.

Test Results

• ✅ All system tests passed (Quick Start, Reverse Proxy, OIDC integration)
• ✅ All auth route unit tests passing (34/34)
• ✅ TypeScript compilation successful

Installation

Docker

docker pull ghcr.io/yeraze/meshmonitor:v2.7.3

Docker Compose

Update your docker-compose.yml:

services:
  meshmonitor:
    image: ghcr.io/yeraze/meshmonitor:v2.7.3
    environment:
      - DISABLE_ANONYMOUS=false  # Set to true to require authentication
      # ... other environment variables

Kubernetes (Helm)

helm upgrade meshmonitor oci://ghcr.io/yeraze/meshmonitor-chart --version 2.7.3

Configuration

Add to your .env file:

# Disable anonymous access (require authentication)
DISABLE_ANONYMOUS=false  # Set to true to require login

Full Changelog

• feat: Add DISABLE_ANONYMOUS environment variable (#237) @Yeraze
• fix: Migrate native-login users to OIDC on first login (#236)

Resolves: #232, #235

🚀 MeshMonitor v2.7.3

📦 Installation

Docker (recommended):

docker run -d \
  --name meshmonitor \
  -p 8080:3001 \
  -v meshmonitor-data:/data \
  ghcr.io/Yeraze/meshmonitor:v2.7.3

🧪 Testing

✅ All tests passed
✅ TypeScript checks passed
✅ Docker images built for linux/amd64, linux/arm64, linux/arm/v7

📋 Changes

See commit history for detailed changes.