From: Martin Pitt <martin@piware.de>
Date: Fri, 17 Jan 2020 10:48:34 +0000 (+0100)
Subject: More refinements
X-Git-Url: https://piware.de/gitweb/?p=talk-cockpit-auth-anywhere.git;a=commitdiff_plain;h=c7d6ded4b717ca8eb1ef19742e3fc77d19d6c460

More refinements
---

diff --git a/cockpit-auth-anywhere.md b/cockpit-auth-anywhere.md
index 59b2c15..32d5436 100644
--- a/cockpit-auth-anywhere.md
+++ b/cockpit-auth-anywhere.md
@@ -31,7 +31,7 @@ resize2fs /dev/vg0/data1
 ```
 
 :::notes
-- for example, adding a new PV to an LV and resizing the file system you can spend some time coming up with these commands
+- for example, adding a new PV to an LVM and resizing the file system you can spend some time coming up with these commands
 - lots of possibilities for screwing up
 - you can do it simply and safely with Cockpit like this → go to local browser
 - Storage page, vg0 in Devices (top right), + in Physical Volumes, add sdb2
@@ -69,9 +69,10 @@ resize2fs /dev/vg0/data1
 :::notes
 - for configuring, extending, and embedding Cockpit you need to coarsely understand the components of it
 - this: simplest structure, what I just showed you and what you will most probably see the first time you try it
-- browser only speaks HTTP and WebSocket, so you always need a web server, cockpit-ws
 - all components in cockpit communicate to each other via a JSON protocol on standard pipes, usually stdio
 - this provides a lot of flexibility and extensibility, as we'll see shortly
+- browsers and JS only speak HTTP and WebSocket, and can't directly talk to Linux system APIs
+- so you always need a web server somewhere, cockpit-ws
 - ws roles: communicate with the browser for getting credentials: login page, krb negotiation, client cert
 - ws: deliver HTML/js content, connects JSON protocol on the WebSocket to pipes to the other components; runs as unprivileged system user
 :::
@@ -179,6 +180,7 @@ RequireHost=true
   Linux session, it knows who I am
 - put the whole auth structure inside out and instead run cockpit-ws as my user
   inside my session
+- open --local-session in shell
 - open localhost:9999 in firefox
 - alarm bells: exposes my session to a TCP port without any auth
 :::
@@ -203,13 +205,14 @@ RequireHost=true
 - suddenly you end up with a halfway decent desktop app
 - just the storage page, replacement for gnome-disks
 - cockpit-desktop podman
+- cockpit-desktop is small shell script, feel free to inspect and bend to your will
 :::
 
 # Conclusion
 
 - Authentication is very flexible
 - Works with zero configuration
-- Can be arbitrarily embedded
+- Can be arbitrarily embedded and customized
 
 :::notes
 - Cockpit provides a set of standard auth protocols that are being used in