From d8876d92025427064ed7e8fb7bcc14745195cb1c Mon Sep 17 00:00:00 2001 From: Leo Vasanko Date: Mon, 9 Feb 2026 19:22:05 +0000 Subject: [PATCH] README --- README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/README.md b/README.md index d4d1977..1d28980 100644 --- a/README.md +++ b/README.md @@ -202,6 +202,27 @@ Then enable and start, view output for registration link: sudo systemctl enable --now paskia@example.com && sudo journalctl -u paskia@example.com -f -n 30 -o cat ``` +### Optional: Dedicated Authentication Site + +By default, Paskia serves login dialogs and admin interface at the `/auth/` path on each protected site. For a cleaner setup, you can use a dedicated authentication subdomain instead. We assume you have your DNS setup for that domain or a wildcard of all subdomains to current machine. + +Configure Paskia with the authentication host: + +```fish +paskia --rp-id example.com --auth-host=auth.example.com --save +``` + +Add a Caddy configuration for the authentication domain: + +```caddyfile +auth.example.com { + reverse_proxy :4401 +} +``` + +Now all authentication happens at `auth.example.com` instead of `/auth/` paths on your apps. No other changes are needed. Your existing protected sites continue to work as before but they just forward to the dedicated site for user profile and other such functionality. + + ## Further Documentation