familyfedie/familyfedie-website
3
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

remove tiny
Some checks failed
/ deploy (push) Has been cancelled
Details

Browse source
This commit is contained in:
Loyyd 2026-06-20 20:21:12 +02:00
parent 8d989f791b
commit 670d90cb15
2 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/ADMIN.md
View file

@ -10,7 +10,9 @@ with OAuth2/OIDC through Pocket ID. Require the Pocket ID user group
`familyfed_admin`. The generated page has `noindex`, but a static page cannot `familyfed_admin`. The generated page has `noindex`, but a static page cannot
enforce a secure admin login by itself. enforce a secure admin login by itself.
See `docs/OAUTH2-AUTH.md` for the exact proxy/auth requirements. If Pocket ID says `Invalid callback URL`, the FamilyFed Admin OIDC client must
allow `https://admin.familyfed.ie/oauth2/callback`. See `docs/OAUTH2-AUTH.md`
for the exact proxy/auth requirements.
## Content changes ## Content changes

12
docs/OAUTH2-AUTH.md
View file

@ -1,8 +1,8 @@
# OAuth2/OIDC auth for admin.familyfed.ie # OAuth2/OIDC auth for admin.familyfed.ie
`admin.familyfed.ie` must be protected before traffic reaches the static Astro `admin.familyfed.ie` must be protected before traffic reaches the static Astro
files. Use Pocket ID as the OIDC issuer, with an OAuth2/OIDC proxy in front of files. Use Pocket ID as the OIDC issuer, with an oauth2-proxy sidecar in front
the generated admin page. of the generated admin page.
Required policy: Required policy:
@ -20,14 +20,14 @@ Create a Pocket ID OIDC client:
- Scopes: `openid email profile groups` - Scopes: `openid email profile groups`
- Allowed user group: `familyfed_admin` - Allowed user group: `familyfed_admin`
The redirect URL must exactly match the OAuth2 proxy config. If the proxy is The redirect URL must exactly match the oauth2-proxy config. If the proxy is
mounted on a different hostname or path, use that callback URL in both places. mounted on a different hostname or path, use that callback URL in both places.
## OAuth2 proxy setup ## OAuth2 proxy setup
Run an OAuth2/OIDC proxy in front of the static admin output. The proxy should Run oauth2-proxy in front of the static admin output. The proxy should receive
receive all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check the
the `groups` claim, and only then forward to the static admin page. `groups` claim, and only then forward to the static admin page.
Example `oauth2-proxy` arguments: Example `oauth2-proxy` arguments: