LeoVasanko
e979dd6312
- devserver bootstraps via one-shot 'paskia init' when no database exists (multi --rp-id, --rp-name/--auth-host/--origin apply to the default realm), then runs plain 'paskia' serve which reads all realm configuration from the database; legacy *.paskiadb is adopted by serve without init. - Caddy origins iterate all bootstrap rp-ids. - vite.config.js accepts a comma-separated PASKIA_AUTH_HOST list and proxies /.well-known/webauthn to the backend so ROR works in dev. - caddy/auth/setup forwards /.well-known/openid-configuration and /.well-known/webauthn to paskia (they must not be swallowed by a static /.well-known/* file handler); Caddyfile.dev updated to match the generated dev config.
14 lines
519 B
Plaintext
14 lines
519 B
Plaintext
# Setup auth service at /auth/ and remove any Remote-* headers sent by client (for security)
|
|
header -Remote-*
|
|
@auth_api path /auth /auth/*
|
|
handle @auth_api {
|
|
reverse_proxy {$AUTH_UPSTREAM::4401}
|
|
}
|
|
# Paskia-served well-known endpoints: OIDC discovery and WebAuthn Related
|
|
# Origin Requests (must reach paskia even when other /.well-known/* files
|
|
# are served statically)
|
|
@auth_wellknown path /.well-known/openid-configuration /.well-known/webauthn
|
|
handle @auth_wellknown {
|
|
reverse_proxy {$AUTH_UPSTREAM::4401}
|
|
}
|