# admin.alpinux.org

Interface d'administration Alpinux — Flask + AlpID SSO.

## Déploiement

```bash
cd org.alpinux.owni/admin
git pull
source venv/bin/activate
pip install -r requirements.txt
sudo systemctl restart alpinux-admin
```

## Variables d'environnement (`/opt/alpinux-admin/.env`)

| Variable | Obligatoire | Description |
|----------|-------------|-------------|
| `SECRET_KEY` | oui | Clé Flask (`python3 -c "import secrets; print(secrets.token_hex(32))"`) |
| `ALPID_CLIENT_ID` | oui | Client Keycloak |
| `ALPID_CLIENT_SECRET` | oui | Secret Keycloak |
| `ALPID_DISCOVERY_URL` | oui | `https://alpid.alpinux.org/realms/master/.well-known/openid-configuration` |
| `ADMIN_GROUPS` | non | Groupes autorisés (défaut : `admins`) |
| `ADMIN_EMAILS` | non | Emails autorisés (fallback si `groups` absent du token) |

## Apache — directives proxy

```apache
RequestHeader set X-Forwarded-Proto "https"
ProxyPreserveHost On
ProxyPass        / http://127.0.0.1:5001/
ProxyPassReverse / http://127.0.0.1:5001/
```