dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

photos: revert /library/login proxy — OIDC starts at /api/v1/oidc/login

Browse Source 
Earlier commits (e535f93 + a52cf68) proxied /library/login through to
PhotoPrism to fix what I thought was the OIDC initiation path. Wrong:
the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login
(already routed via @pp). The /library/login URL is what PhotoPrism's
UI uses POST-OIDC for the localStorage handoff back to the SPA — it
MUST bounce to / via the caddy redir, otherwise the SPA never picks
up the session and the user lands in PhotoPrism's own UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-05-22 01:08:10 +02:00
parent a52cf68d0f
commit db7f8fbf4e
1 changed files with 15 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Caddyfile
View File

@@ -149,21 +149,14 @@ photos.hubris.network {
dns ionos {env.IONOS_AUTH_API_TOKEN} dns ionos {env.IONOS_AUTH_API_TOKEN}
} }
encode zstd gzip encode zstd gzip
# Wrap everything in `route` so directives run in literal source # PhotoPrism API + OIDC initiation (/api/v1/oidc/login) + OIDC
# order. Without it caddy hoists `redir` above `reverse_proxy`, # callback (/api/v1/oidc/redirect) all live here.
# and the /library/* redir eats /library/login before PhotoPrism
# ever sees it (OIDC initiation dies).
route {
# PhotoPrism API + OIDC callback (callback path /api/v1/oidc/redirect)
@pp path /api/v1/* /api/v1 /static/* /share/* @pp path /api/v1/* /api/v1 /static/* /share/*
reverse_proxy @pp 192.168.8.136:2342 reverse_proxy @pp 192.168.8.136:2342
# PhotoPrism's OIDC initiation surface — must reach PhotoPrism, # After OIDC succeeds PhotoPrism stores the session in localStorage
# not be bounced back to the SPA. # then `window.location.href = "/library/login"` to hand off. Bounce
@pp_login path /library/login /library/login/* # every /library/* request back to the SvelteKit root; the SPA reads
reverse_proxy @pp_login 192.168.8.136:2342 # the localStorage session via bootstrapSessionFromPhotoPrism().
# Everything else under /library/* (notably /library/browse,
# PhotoPrism's post-login destination) bounces back to the
# SvelteKit SPA — mule-image is the only user-facing frontend.
redir /library / 302 redir /library / 302
redir /library/* / 302 redir /library/* / 302
# mule-sidecar (Go) — keeps the /api/sidecar/ prefix # mule-sidecar (Go) — keeps the /api/sidecar/ prefix
@@ -171,7 +164,6 @@ photos.hubris.network {
reverse_proxy @sc 192.168.8.136:8000 reverse_proxy @sc 192.168.8.136:8000
# Catch-all → nginx-on-120 serving the SvelteKit static bundle # Catch-all → nginx-on-120 serving the SvelteKit static bundle
reverse_proxy 192.168.8.136:3000 reverse_proxy 192.168.8.136:3000
}
} }
auth.hubris.network { auth.hubris.network {