From db7f8fbf4e7d2686988fd02310f239b2fa4bdcbe Mon Sep 17 00:00:00 2001 From: dtoro Date: Fri, 22 May 2026 01:08:10 +0200 Subject: [PATCH] =?UTF-8?q?photos:=20revert=20/library/login=20proxy=20?= =?UTF-8?q?=E2=80=94=20OIDC=20starts=20at=20/api/v1/oidc/login?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Earlier commits (e535f93 + a52cf68) proxied /library/login through to PhotoPrism to fix what I thought was the OIDC initiation path. Wrong: the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login (already routed via @pp). The /library/login URL is what PhotoPrism's UI uses POST-OIDC for the localStorage handoff back to the SPA — it MUST bounce to / via the caddy redir, otherwise the SPA never picks up the session and the user lands in PhotoPrism's own UI. Co-Authored-By: Claude Opus 4.7 (1M context) --- Caddyfile | 38 +++++++++++++++----------------------- 1 file changed, 15 insertions(+), 23 deletions(-) diff --git a/Caddyfile b/Caddyfile index a93c034..0eac6fa 100644 --- a/Caddyfile +++ b/Caddyfile @@ -149,29 +149,21 @@ photos.hubris.network { dns ionos {env.IONOS_AUTH_API_TOKEN} } encode zstd gzip - # Wrap everything in `route` so directives run in literal source - # order. Without it caddy hoists `redir` above `reverse_proxy`, - # and the /library/* redir eats /library/login before PhotoPrism - # ever sees it (OIDC initiation dies). - route { - # PhotoPrism API + OIDC callback (callback path /api/v1/oidc/redirect) - @pp path /api/v1/* /api/v1 /static/* /share/* - reverse_proxy @pp 192.168.8.136:2342 - # PhotoPrism's OIDC initiation surface — must reach PhotoPrism, - # not be bounced back to the SPA. - @pp_login path /library/login /library/login/* - reverse_proxy @pp_login 192.168.8.136:2342 - # Everything else under /library/* (notably /library/browse, - # PhotoPrism's post-login destination) bounces back to the - # SvelteKit SPA — mule-image is the only user-facing frontend. - redir /library / 302 - redir /library/* / 302 - # mule-sidecar (Go) — keeps the /api/sidecar/ prefix - @sc path /api/sidecar/* - reverse_proxy @sc 192.168.8.136:8000 - # Catch-all → nginx-on-120 serving the SvelteKit static bundle - reverse_proxy 192.168.8.136:3000 - } + # PhotoPrism API + OIDC initiation (/api/v1/oidc/login) + OIDC + # callback (/api/v1/oidc/redirect) all live here. + @pp path /api/v1/* /api/v1 /static/* /share/* + reverse_proxy @pp 192.168.8.136:2342 + # After OIDC succeeds PhotoPrism stores the session in localStorage + # then `window.location.href = "/library/login"` to hand off. Bounce + # every /library/* request back to the SvelteKit root; the SPA reads + # the localStorage session via bootstrapSessionFromPhotoPrism(). + redir /library / 302 + redir /library/* / 302 + # mule-sidecar (Go) — keeps the /api/sidecar/ prefix + @sc path /api/sidecar/* + reverse_proxy @sc 192.168.8.136:8000 + # Catch-all → nginx-on-120 serving the SvelteKit static bundle + reverse_proxy 192.168.8.136:3000 } auth.hubris.network {