Skip to content

Commit 70813a1

Browse files
MickLeskMickLesk
committed
Add: Hanko
1 parent 5932dac commit 70813a1

3 files changed

Lines changed: 214 additions & 0 deletions

File tree

‎ct/hanko.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env bash
2+
_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/DevScripts/main"
3+
_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
4+
source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
5+
# Copyright (c) 2021-2026 community-scripts ORG
6+
# Author: MickLesk (CanbiZ)
7+
# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE
8+
# Source: https://github.com/teamhanko/hanko
9+
10+
APP="Hanko"
11+
var_tags="${var_tags:-auth;passkeys;sso}"
12+
var_cpu="${var_cpu:-1}"
13+
var_ram="${var_ram:-512}"
14+
var_disk="${var_disk:-4}"
15+
var_os="${var_os:-debian}"
16+
var_version="${var_version:-13}"
17+
var_arm64="${var_arm64:-yes}"
18+
var_unprivileged="${var_unprivileged:-1}"
19+
20+
header_info "$APP"
21+
variables
22+
color
23+
catch_errors
24+
25+
function update_script() {
26+
header_info
27+
check_container_storage
28+
check_container_resources
29+
30+
if [[ ! -d /opt/hanko ]]; then
31+
msg_error "No ${APP} Installation Found!"
32+
exit
33+
fi
34+
35+
# the monorepo tags the backend as backend/vX.Y.Z next to its frontend packages
36+
if check_for_gh_release "hanko" "teamhanko/hanko" "" "" "backend/"; then
37+
msg_info "Stopping Hanko"
38+
systemctl stop hanko
39+
msg_ok "Stopped Hanko"
40+
41+
CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hanko" "teamhanko/hanko" "prebuild" "latest" "/opt/hanko" "hanko_Linux_$(arch_resolve "x86_64" "arm64").tar.gz" "backend/"
42+
43+
msg_info "Migrating Hanko Database"
44+
$STD /opt/hanko/hanko migrate up --config /opt/hanko_data/config.yaml
45+
msg_ok "Migrated Hanko Database"
46+
47+
msg_info "Starting Hanko"
48+
systemctl start hanko
49+
msg_ok "Started Hanko"
50+
msg_ok "Updated successfully!"
51+
fi
52+
exit
53+
}
54+
55+
start
56+
build_container
57+
description
58+
59+
msg_ok "Completed Successfully!\n"
60+
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
61+
echo -e "${INFO}${YW}Access the public API using the following URL:${CL}"
62+
echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
63+
echo -e "${INFO}${YW}Set your app's domain and SMTP server in /opt/hanko_data/config.yaml${CL}"

‎install/hanko-install.sh‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright (c) 2021-2026 community-scripts ORG
4+
# Author: MickLesk (CanbiZ)
5+
# License: MIT | https://github.com/community-scripts/DevScripts/raw/main/LICENSE
6+
# Source: https://github.com/teamhanko/hanko
7+
8+
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
9+
color
10+
verb_ip6
11+
catch_errors
12+
setting_up_container
13+
network_check
14+
update_os
15+
16+
PG_VERSION="17" setup_postgresql
17+
PG_DB_NAME="hanko" PG_DB_USER="hanko" setup_postgresql_db
18+
19+
fetch_and_deploy_gh_release "hanko" "teamhanko/hanko" "prebuild" "latest" "/opt/hanko" "hanko_Linux_$(arch_resolve "x86_64" "arm64").tar.gz" "backend/"
20+
21+
msg_info "Configuring Hanko"
22+
mkdir -p /opt/hanko_data
23+
# v3 reads the top-level secret_keys and cors keys; with the secrets.keys the upstream README
24+
# still shows it signs with its built-in default key, and server.public.cors is ignored
25+
cat <<EOF >/opt/hanko_data/config.yaml
26+
database:
27+
host: localhost
28+
port: "5432"
29+
database: hanko
30+
user: hanko
31+
password: ${PG_DB_PASS}
32+
dialect: postgres
33+
secret_keys:
34+
- $(random_password 32)
35+
server:
36+
public:
37+
address: ":8000"
38+
admin:
39+
address: "127.0.0.1:8001"
40+
service:
41+
name: Hanko Authentication Service
42+
cors:
43+
allow_origins:
44+
- https://app.example.com
45+
webauthn:
46+
relying_party:
47+
id: example.com
48+
origins:
49+
- https://app.example.com
50+
email_delivery:
51+
from_address: noreply@example.com
52+
from_name: Hanko
53+
smtp:
54+
host: localhost
55+
port: "465"
56+
user: ""
57+
password: ""
58+
EOF
59+
chmod 600 /opt/hanko_data/config.yaml
60+
$STD /opt/hanko/hanko migrate up --config /opt/hanko_data/config.yaml
61+
msg_ok "Configured Hanko"
62+
63+
msg_info "Creating Service"
64+
cat <<EOF >/etc/systemd/system/hanko.service
65+
[Unit]
66+
Description=Hanko
67+
After=network.target postgresql.service
68+
Requires=postgresql.service
69+
70+
[Service]
71+
Type=simple
72+
User=root
73+
WorkingDirectory=/opt/hanko_data
74+
ExecStart=/opt/hanko/hanko serve all --config /opt/hanko_data/config.yaml
75+
Restart=on-failure
76+
RestartSec=5
77+
78+
[Install]
79+
WantedBy=multi-user.target
80+
EOF
81+
systemctl enable -q --now hanko
82+
msg_ok "Created Service"
83+
84+
motd_ssh
85+
customize
86+
cleanup_lxc

‎json/hanko.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"name": "Hanko",
3+
"slug": "hanko",
4+
"categories": [
5+
6
6+
],
7+
"date_created": "2026-10-05",
8+
"type": "ct",
9+
"updateable": true,
10+
"privileged": false,
11+
"architectures": [
12+
"amd64",
13+
"arm64"
14+
],
15+
"interface_port": 8000,
16+
"documentation": "https://docs.hanko.io/",
17+
"website": "https://www.hanko.io/",
18+
"repository": "https://github.com/teamhanko/hanko",
19+
"logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/hanko.webp",
20+
"description": "Hanko is an open-source authentication and user management backend, an alternative to Auth0 or Clerk. It provides passkeys, passwords, email passcodes, TOTP and security-key MFA, OAuth/OIDC and SAML single sign-on, sessions and JWTs, and web apps add the login through the Hanko Elements web components or SDKs. This script runs the Hanko backend (public and admin API) with PostgreSQL.",
21+
"install_methods": [
22+
{
23+
"type": "default",
24+
"script": "ct/hanko.sh",
25+
"config_path": "/opt/hanko_data/config.yaml",
26+
"resources": {
27+
"cpu": 1,
28+
"ram": 512,
29+
"hdd": 4,
30+
"os": "Debian",
31+
"version": "13"
32+
}
33+
}
34+
],
35+
"default_credentials": {
36+
"username": null,
37+
"password": null
38+
},
39+
"notes": [
40+
{
41+
"text": "Hanko is a headless authentication API, not a web app. Port 8000 is the public API that your own application's login talks to through Hanko Elements or the SDKs; opened in a browser it only shows an API status page. The self-hosted backend has no admin UI, the Hanko Console is part of the closed-source Hanko Cloud.",
42+
"type": "info"
43+
},
44+
{
45+
"text": "Before an app can use Hanko, replace the example.com placeholders in /opt/hanko_data/config.yaml: webauthn.relying_party.id is your domain, webauthn.relying_party.origins and cors.allow_origins the https:// URL of the app that embeds the login. Then run systemctl restart hanko. Hanko 3 reads the top-level cors key and ignores the server.public.cors of older upstream examples.",
46+
"type": "warning"
47+
},
48+
{
49+
"text": "Passkeys only work over HTTPS on a domain name: browsers refuse WebAuthn on an IP address, and the session cookie is marked Secure. Publish port 8000 through a TLS reverse proxy (e.g. https://auth.example.com) instead of using http://<IP>:8000 directly.",
50+
"type": "warning"
51+
},
52+
{
53+
"text": "Sign-up, email verification and passcode login send emails. Set email_delivery (from_address and the smtp host, port, user and password) in /opt/hanko_data/config.yaml to your mail server; until then these flows fail. Users created through the admin API with a password can still sign in.",
54+
"type": "warning"
55+
},
56+
{
57+
"text": "The admin API (users, sessions, webhooks) has no authentication of its own, so it only listens on 127.0.0.1:8001, e.g. curl http://127.0.0.1:8001/users inside the container. Change server.admin.address only behind a firewall or an authenticating proxy: anyone who reaches it can create sessions for any user.",
58+
"type": "warning"
59+
},
60+
{
61+
"text": "Back up secret_keys from /opt/hanko_data/config.yaml together with the database. It encrypts the JWT signing key stored in PostgreSQL, and without it Hanko can no longer issue session tokens.",
62+
"type": "warning"
63+
}
64+
]
65+
}

0 commit comments

Comments
 (0)