More than one person, without everyone seeing everything
Administrators, users and guests. Boards are private until they are shared, and sharing goes to one person or to a whole role, at view, edit or act level.
Three roles, three levels of sharing
The role says what someone may do in the installation. What someone may do with a single board is said by the sharing.
| Role | Own boards | Integrations | Accounts and instance |
|---|---|---|---|
| Administrator | build and share | create and change | yes |
| User | build and share | read, not change | no |
| Guest | only what was shared | no | no |
When sharing
- View. The board and its live data, nothing else.
- Edit. Move cards, add them, set them up.
- Act. The buttons on the cards actually do something.
Why the integrations are readable for every signed-in account: when a card turns red, the first question is which address it hangs on. Changing one stays with the administrator, and a single integration can be locked away from users with a tick.
Separate settings
What belongs to a person lives under My settings: profile, own boards, own notification channels, own tokens. What belongs to the installation lives under System: integrations, accounts, mail server, appearance.
An administrator sees his own boards and the ones shared with him. Being allowed to open every board in the house does not mean they all lie around in his list; a switch above it shows them when he really wants that.
Locally, through your own provider, or with a token
Local accounts
Name and password, a picture, an address for forgotten passwords. The administrator can set a password without knowing the old one; every session of that account ends with it.
OpenID Connect
Next to them, not instead. Tried with authentik, Keycloak, Authelia and Pocket ID. If you already run a provider in the house, hang nexdeck on it.
Personal tokens
For scripts and other tools. They belong to one account, they expire, they can be revoked one at a time, and a password change kills them.
Password guessing is counted per account, not only per source address. Behind a reverse proxy the client address is whatever a header claims, and that can be invented anew with every attempt.
What was clicked can be versioned
Every board goes out as YAML and comes back in, on the same installation or another. The secrets stay where they are: a credential is written as a reference to an environment variable, not as a value.
A file under data/boards/ provisions a board at start. That makes an installation something you can set up out of Git, and a migration is one file instead of an afternoon.
Cards reference integrations by name. On import an integration with that name is reused, otherwise a new one is created.
An import over the interface creates no integrations and expands no variables. Only the file route does that, and the operator holds it himself. Otherwise any member could upload a board whose credential asks for the installation's secret key and then read it back out of the list.
# An excerpt from an exported board board: name: Media slug: media pages: - name: Overview widgets: - kind: radarr.queue title: Radarr integration: Movies integrations: - name: Movies kind: radarr config: url: http://radarr:7878 api_key: ${NEXDECK_RADARR_1_API_KEY}