jhodgkin
74c7bf6ef7
Previously logout only destroyed our own session -- someone who
signed in via Authentik stayed logged into Authentik itself, so
"Sign in with Authentik" again would silently re-authenticate with
no prompt.
Session now tracks authMethod ("local" | "oidc") and, for OIDC
sessions, the raw id_token (needed as id_token_hint at logout time).
New GET /api/auth/oidc/logout redirects through Authentik's
end_session_endpoint (openid-client's buildEndSessionUrl, not
hand-rolled) before landing back on /. Must be a full-page navigation
-- Authentik needs a real browser request to clear its own session
cookie, a fetch() wouldn't do that. Local sessions still use the
existing POST /api/auth/logout unchanged.
Confirmed Authentik has no dedicated post_logout_redirect_uri
allowlist field by checking the provider's DB schema directly before
implementing, rather than assuming.
Closes #19.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Homelab Monitor
A single dashboard for the health of everything in the homelab (documented in
jhodgkin/homelab): Proxmox host + LXC + bare-metal
CPU/mem/disk/pressure, historical sparklines, and a LAN device inventory. Local auth always available,
plus an optional "Sign in with Authentik" OIDC button. Live at https://monitor.jerodrigged.com.
Project status, architecture, and how to resume work: see CLAUDE.md.
Playwright e2e tests against the live deployment: see e2e/README.md.
Local development
# terminal 1
cd apps/api && npm install && cp ../../.env.example ../../.env # fill in .env first
npm run dev
# terminal 2
cd apps/web && npm install && npm run dev
Web dev server proxies /api to localhost:3000 (see apps/web/vite.config.ts).
Production deploy
Runs as Docker Compose on CT122 (homelab-monitor, 192.168.1.103):
ssh homelab-monitor
cd /opt/homelab-monitor
git pull
docker compose up -d --build