rbrooks/BatteryStorageCalculator
Watch
1
0
Fork
You've already forked BatteryStorageCalculator
 0
Code Issues 38 Pull requests 3 Projects Releases Packages Wiki Activity Actions

Configure Authentik env vars on deployment host and verify OIDC callback behind Caddy #8

New issue
Open
opened 2026-07-17 01:17:55 +00:00 by claude-bot · 1 comment
claude-bot commented 2026-07-17 01:17:55 +00:00
Contributor
Copy link

Item 1 of the Recommended Next Implementation Slice in docs/implementation-audit.md.

The backend OIDC implementation is complete and validates issuer, audience, expiration, signature, and login nonce. What has not been done is configuring it on the actual deployment host and confirming the callback works through the Caddy reverse proxy.

Env vars are documented in README.md: AUTH_MODE, AUTH_REQUIRED, PUBLIC_APP_URL, SESSION_SECRET, OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI.

This is deployment/config work, not code work.

Item 1 of the Recommended Next Implementation Slice in `docs/implementation-audit.md`. The backend OIDC implementation is complete and validates issuer, audience, expiration, signature, and login nonce. What has not been done is configuring it on the actual deployment host and confirming the callback works through the Caddy reverse proxy. Env vars are documented in `README.md`: `AUTH_MODE`, `AUTH_REQUIRED`, `PUBLIC_APP_URL`, `SESSION_SECRET`, `OIDC_ISSUER_URL`, `OIDC_CLIENT_ID`, `OIDC_CLIENT_SECRET`, `OIDC_REDIRECT_URI`. This is deployment/config work, not code work.
claude-bot commented 2026-07-17 15:21:14 +00:00
Author
Contributor
Copy link

Sequencing (from the 2026-07-16 audit): do this after #28 (refuse to start OIDC mode with the default SESSION_SECRET) so a misconfigured deploy fails at startup with a clear error rather than running with a forgeable session secret. #29 (CORS default) and #33 (full-stack default compose) touch the same deploy surface and are cheapest to verify in the same deployment pass.

**Sequencing (from the 2026-07-16 audit):** do this **after #28** (refuse to start OIDC mode with the default `SESSION_SECRET`) so a misconfigured deploy fails at startup with a clear error rather than running with a forgeable session secret. #29 (CORS default) and #33 (full-stack default compose) touch the same deploy surface and are cheapest to verify in the same deployment pass.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/lock-file-maintenance
renovate/pg-8.x
renovate/lucide-monorepo
No results found.
Labels
Clear labels   
bug
Defect: incorrect behavior or output

  
decision
Open design decision that gates other work

  
docs
Documentation

  
enhancement
New feature or capability

  
integration
External data source integration

  
ops
Deployment, CI, tooling, observability

  
security
Security hardening: missing or misplaced control

  
tech-debt
Cleanup of legacy or superseded code

  
testing
Test coverage

No labels
bug
decision
docs
enhancement
integration
ops
security
tech-debt
testing
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/BatteryStorageCalculator#8
No description provided.