From 943fd9495fa54d157dfc2acdcc946d5b7fe67dd3 Mon Sep 17 00:00:00 2001 From: Jerod Hodgkin Date: Mon, 20 Jul 2026 06:33:28 +0000 Subject: [PATCH] Update docs: Authentik OIDC setup is complete and verified Reflects tonight's work: scripts/authentik-setup.sh actually run for the first time (three bugs found/fixed), OIDC login and client self-registration verified end-to-end on both dev and prod. Closes the loop on issues #10/#12/#17. --- CLAUDE.md | 6 ++++-- docs/BACKLOG-2026-07-16.md | 33 +++++++++++++++++++-------------- 2 files changed, 23 insertions(+), 16 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 24b8d8e..85e73a0 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -195,9 +195,11 @@ local dev (`docker compose up -d` alone still builds from source as before). | 7 | Confirm & submit | — | Done — summary + POST /api/bookings | Also done: n8n webhooks (#8), admin dashboard at `/dashboard` (#11), Authentik OIDC -login (#10, needs Authentik-side setup), client portal at `/my-bookings` (#13). +login (#10) and client self-registration enrollment (#12) - both live and verified +on dev and prod as of 2026-07-20, client portal at `/my-bookings` (#13). Auth lives in `api/auth.js` (zero-dep OIDC + HMAC cookie sessions); admin routes -accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer. +accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer. One shared +Authentik provider/application serves both environments - see `scripts/authentik-setup.sh`. ### Booking JS Functions (in `src/index.html`) diff --git a/docs/BACKLOG-2026-07-16.md b/docs/BACKLOG-2026-07-16.md index 302bbf7..11b25d1 100644 --- a/docs/BACKLOG-2026-07-16.md +++ b/docs/BACKLOG-2026-07-16.md @@ -13,24 +13,29 @@ git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`, `write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine. ### B2. Production (CT111) api/.env is a blank template -The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the -new stack runs — but every secret is empty. Until real values are set on CT111 at -`/opt/lisilou-portfolio/api/.env`: +Prod moved off the GitHub deploy path this session (see B4) — `api/.env` now +lives on CT111 and is deployed to via `git push origin main:prod`, no longer +auto-templated by GitHub Actions. + +**Update 2026-07-20:** `OIDC_*` and `SESSION_SECRET` are now filled in and +verified working (see #12/#17). Still outstanding: - admin dashboard login is disabled (no `ADMIN_SECRET`) - **new bookings send no n8n notification — real clients could book silently** - calendar availability shows all dates free (no Google creds) -- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`) -Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN` -to https://lisilou.jerodrigged.com), then `docker compose restart api`. +- `SITE_URL` still points at CT114's LAN IP (`192.168.1.192:8080`) instead of + `https://lisilou.jerodrigged.com`; `CORS_ORIGIN` is still `localhost:8080` +Deliberately left alone tonight — these need real values from Jerod (an n8n +webhook URL, Google service account, a chosen admin passphrase), not something +to fill with placeholders. `docker compose up -d api` (not `restart` — it +doesn't reload `env_file` changes) after editing. -### B3. Authentik provider + groups (issues #10/#12) -Code for OIDC login and the client portal is deployed and tested, but Authentik -needs one-time admin setup (see header comment in `api/auth.js`): -1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod - `/api/auth/callback`), application "LisiLou Portfolio" -2. `lisilou-admin` group with Elysse (grants dashboard access) -3. Enrollment flow for client self-registration (#12) — Authentik-side config only -4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env` +### ~~B3. Authentik provider + groups (issues #10/#12)~~ RESOLVED 2026-07-20 +`scripts/authentik-setup.sh` was run for real against auth.jerodrigged.com (it +never had been before). Three bugs found and fixed along the way — see the +closing comments on #12 and #17 for the full writeup. Provider, application, +`lisilou-admin` group, and the client enrollment flow are all live; `api/.env` +is filled on both dev and prod; verified end-to-end via a real authorization- +code+PKCE round trip on both hosts. ### B4. Decide the deploy topology (dev vs prod) Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed