More refinements

diff --git a/cockpit-auth-anywhere.md b/cockpit-auth-anywhere.md
index 59b2c152fc8efd94f59893307433c744661071c4..32d543635814a3502ef27ba2fdf05dd6eb2083fa 100644 (file)
--- a/cockpit-auth-anywhere.md
+++ b/cockpit-auth-anywhere.md
@@ -31,7 +31,7 @@ resize2fs /dev/vg0/data1
 ```
 
 :::notes
 ```
 
 :::notes

-- for example, adding a new PV to an LV and resizing the file system you can spend some time coming up with these commands
+- for example, adding a new PV to an LVM and resizing the file system you can spend some time coming up with these commands

 - lots of possibilities for screwing up
 - you can do it simply and safely with Cockpit like this → go to local browser
 - Storage page, vg0 in Devices (top right), + in Physical Volumes, add sdb2
 - lots of possibilities for screwing up
 - you can do it simply and safely with Cockpit like this → go to local browser
 - Storage page, vg0 in Devices (top right), + in Physical Volumes, add sdb2


@@ -69,9 +69,10 @@ resize2fs /dev/vg0/data1
 :::notes
 - for configuring, extending, and embedding Cockpit you need to coarsely understand the components of it
 - this: simplest structure, what I just showed you and what you will most probably see the first time you try it
 :::notes
 - for configuring, extending, and embedding Cockpit you need to coarsely understand the components of it
 - this: simplest structure, what I just showed you and what you will most probably see the first time you try it

-- browser only speaks HTTP and WebSocket, so you always need a web server, cockpit-ws

 - all components in cockpit communicate to each other via a JSON protocol on standard pipes, usually stdio
 - this provides a lot of flexibility and extensibility, as we'll see shortly
 - all components in cockpit communicate to each other via a JSON protocol on standard pipes, usually stdio
 - this provides a lot of flexibility and extensibility, as we'll see shortly

+- browsers and JS only speak HTTP and WebSocket, and can't directly talk to Linux system APIs
+- so you always need a web server somewhere, cockpit-ws

 - ws roles: communicate with the browser for getting credentials: login page, krb negotiation, client cert
 - ws: deliver HTML/js content, connects JSON protocol on the WebSocket to pipes to the other components; runs as unprivileged system user
 :::
 - ws roles: communicate with the browser for getting credentials: login page, krb negotiation, client cert
 - ws: deliver HTML/js content, connects JSON protocol on the WebSocket to pipes to the other components; runs as unprivileged system user
 :::


@@ -179,6 +180,7 @@ RequireHost=true
   Linux session, it knows who I am
 - put the whole auth structure inside out and instead run cockpit-ws as my user
   inside my session
   Linux session, it knows who I am
 - put the whole auth structure inside out and instead run cockpit-ws as my user
   inside my session

+- open --local-session in shell

 - open localhost:9999 in firefox
 - alarm bells: exposes my session to a TCP port without any auth
 :::
 - open localhost:9999 in firefox
 - alarm bells: exposes my session to a TCP port without any auth
 :::


@@ -203,13 +205,14 @@ RequireHost=true
 - suddenly you end up with a halfway decent desktop app
 - just the storage page, replacement for gnome-disks
 - cockpit-desktop podman
 - suddenly you end up with a halfway decent desktop app
 - just the storage page, replacement for gnome-disks
 - cockpit-desktop podman

+- cockpit-desktop is small shell script, feel free to inspect and bend to your will

 :::
 
 # Conclusion
 
 - Authentication is very flexible
 - Works with zero configuration
 :::
 
 # Conclusion
 
 - Authentication is very flexible
 - Works with zero configuration

-- Can be arbitrarily embedded
+- Can be arbitrarily embedded and customized

 
 :::notes
 - Cockpit provides a set of standard auth protocols that are being used in
 
 :::notes
 - Cockpit provides a set of standard auth protocols that are being used in