familyfedie/familyfedie-website
3
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

remove tiny
Some checks failed
/ deploy (push) Has been cancelled
Details

Browse source
This commit is contained in:
Loyyd 2026-06-20 20:21:12 +02:00
parent 8d989f791b
commit 670d90cb15
2 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/OAUTH2-AUTH.md
View file

@ -1,8 +1,8 @@
# OAuth2/OIDC auth for admin.familyfed.ie
`admin.familyfed.ie` must be protected before traffic reaches the static Astro
files. Use Pocket ID as the OIDC issuer, with an OAuth2/OIDC proxy in front of
the generated admin page.
files. Use Pocket ID as the OIDC issuer, with an oauth2-proxy sidecar in front
of the generated admin page.
Required policy:
@ -20,14 +20,14 @@ Create a Pocket ID OIDC client:
- Scopes: `openid email profile groups`
- Allowed user group: `familyfed_admin`
The redirect URL must exactly match the OAuth2 proxy config. If the proxy is
The redirect URL must exactly match the oauth2-proxy config. If the proxy is
mounted on a different hostname or path, use that callback URL in both places.
## OAuth2 proxy setup
Run an OAuth2/OIDC proxy in front of the static admin output. The proxy should
receive all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check
the `groups` claim, and only then forward to the static admin page.
Run oauth2-proxy in front of the static admin output. The proxy should receive
all traffic for `admin.familyfed.ie`, complete the Pocket ID login, check the
`groups` claim, and only then forward to the static admin page.
Example `oauth2-proxy` arguments: