Authentication

GeoMetrikks ships with single-admin session-cookie authentication:

APP_ADMIN_USER=admin          # defaults to "admin"
APP_ADMIN_PASSWORD=           # required; the app refuses to start without it

Log in through the web UI (/login) or POST /api/v1/auth/login. Everything under /api/ and /ws/ requires a session; the web app’s static files (you need them to reach the login page), /health, /health/ready and /schema stay open. Sessions are held in memory, so restarting the app container logs everyone out.

If something else already controls who reaches the app (an authenticating proxy such as Authelia or Tailscale, or a network only you can reach), you can turn the built-in auth off:

APP_AUTH_DISABLED=true

There is then no login and no session: anyone who can reach the app has full access to it and to the WebSocket feeds.