Tronax
3f187f1ede
Backend:
- New AUTH_PASSWORD_ENABLED flag (default true). When false, email/password
registration and login return 403; the server enforces OIDC-only login.
- New OIDC_GENERIC_DISPLAY_NAME so the app can show 'Authentik'/'Keycloak'
instead of a generic 'OIDC' label.
- New public endpoint GET /api/config returns which auth methods the
server offers (password_enabled + per-provider OIDC capabilities).
No auth required, so the login screen can query it before logging in.
- .env.example and docker-compose.yml expose the new env vars.
App:
- DTOs + MitbringslApi.getServerConfig() for /api/config.
- AuthViewModel: new 'connect' flow. The user enters the server URL,
taps 'Verbinden', and the app fetches /api/config. The returned
ServerAuthConfig drives which login options are shown:
* password-only -> email/password form
* OIDC-only -> OIDC token form
* both -> toggle between the two
If the server offers no method, a clear error is shown.
- AuthScreen: split into ConnectView (server URL) and LoginView (the
login form matching the server's capabilities). The mode toggle only
appears when the server offers more than one method.
64 lines
2.6 KiB
Text
64 lines
2.6 KiB
Text
# ===========================================================================
|
|
# mitbringsl backend configuration
|
|
# Copy this file to ".env" and adjust the values.
|
|
# cp .env.example .env
|
|
# ===========================================================================
|
|
|
|
# --- General app behavior ---
|
|
APP_ENV=production # development | production
|
|
LOG_LEVEL=info # debug | info | warn | error
|
|
|
|
# The externally reachable base URL (scheme + host, no trailing slash).
|
|
# Must match the domain you serve Caddy on. Used for OIDC redirect URIs etc.
|
|
PUBLIC_BASE_URL=https://mitbringsl.example.com
|
|
|
|
# The public domain Caddy serves. Used to set the Caddy site address.
|
|
PUBLIC_DOMAIN=mitbringsl.example.com
|
|
|
|
# --- PostgreSQL ---
|
|
POSTGRES_USER=app
|
|
# CHOOSE A STRONG PASSWORD (only required for first DB init, then stored).
|
|
POSTGRES_PASSWORD=change-me-to-a-long-random-string
|
|
POSTGRES_DB=appdb
|
|
# DATABASE_URL is composed by docker-compose from the values above.
|
|
|
|
# --- Session tokens ---
|
|
# TTL of the opaque session token issued after login.
|
|
SESSION_TOKEN_TTL=720h # 30 days
|
|
|
|
# --- Auth methods ---
|
|
# Set to false to disable email/password registration and login and enforce
|
|
# OIDC-only login. The Android app reads /api/config and only shows the login
|
|
# methods the server actually offers.
|
|
AUTH_PASSWORD_ENABLED=true
|
|
|
|
# --- OIDC: Google (optional) ---
|
|
OIDC_GOOGLE_ENABLED=false
|
|
# The OAuth client ID you created in Google Cloud Console (Audience the
|
|
# backend accepts). No client_secret needed: the Android app performs the
|
|
# code exchange itself and only sends the id_token to the backend.
|
|
OIDC_GOOGLE_CLIENT_ID=
|
|
OIDC_GOOGLE_ISSUER=https://accounts.google.com
|
|
|
|
# --- OIDC: Generic provider (Keycloak, Authentik, Dex, ...; optional) ---
|
|
OIDC_GENERIC_ENABLED=false
|
|
OIDC_GENERIC_ISSUER= # e.g. https://idp.example.com/realms/main
|
|
OIDC_GENERIC_CLIENT_ID= # audience the backend accepts
|
|
# Human-readable name shown in the app, e.g. "Authentik", "Keycloak".
|
|
OIDC_GENERIC_DISPLAY_NAME=OIDC
|
|
|
|
# --- CORS (only relevant for browser clients; Android doesn't need it) ---
|
|
# Comma-separated list of allowed origins, e.g. https://app.example.com
|
|
CORS_ALLOWED_ORIGINS=
|
|
|
|
# --- Caddy ports ---
|
|
# Standalone mode (Caddy handles TLS directly):
|
|
CADDY_HTTP_PORT=80
|
|
CADDY_HTTPS_PORT=443
|
|
|
|
# Behind a reverse proxy (your proxy does TLS, Caddy is plain HTTP):
|
|
# 1. Change CADDY_HTTP_PORT to the port your proxy forwards to.
|
|
# 2. Mount Caddyfile.behind-proxy instead of Caddyfile in docker-compose.yml.
|
|
# 3. Remove the CADDY_HTTPS_PORT lines from docker-compose caddy.ports.
|
|
#
|
|
# CADDY_HTTP_PORT=8880
|