dtoro/caddy-conf
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

photos: revert /library/login proxy — OIDC starts at /api/v1/oidc/login

Browse Source 
Earlier commits (e535f93 + a52cf68) proxied /library/login through to
PhotoPrism to fix what I thought was the OIDC initiation path. Wrong:
the SvelteKit SPA initiates OIDC by navigating to /api/v1/oidc/login
(already routed via @pp). The /library/login URL is what PhotoPrism's
UI uses POST-OIDC for the localStorage handoff back to the SPA — it
MUST bounce to / via the caddy redir, otherwise the SPA never picks
up the session and the user lands in PhotoPrism's own UI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-05-22 01:08:10 +02:00
parent a52cf68d0f
commit db7f8fbf4e
1 changed files with 15 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Caddyfile
View File

@@ -149,21 +149,14 @@ photos.hubris.network {
dns ionos {env.IONOS_AUTH_API_TOKEN}
}
encode zstd gzip
# Wrap everything in `route` so directives run in literal source
# order. Without it caddy hoists `redir` above `reverse_proxy`,
# and the /library/* redir eats /library/login before PhotoPrism
# ever sees it (OIDC initiation dies).
route {
# PhotoPrism API + OIDC callback (callback path /api/v1/oidc/redirect)
# PhotoPrism API + OIDC initiation (/api/v1/oidc/login) + OIDC
# callback (/api/v1/oidc/redirect) all live here.
@pp path /api/v1/* /api/v1 /static/* /share/*
reverse_proxy @pp 192.168.8.136:2342
# PhotoPrism's OIDC initiation surface — must reach PhotoPrism,
# not be bounced back to the SPA.
@pp_login path /library/login /library/login/*
reverse_proxy @pp_login 192.168.8.136:2342
# Everything else under /library/* (notably /library/browse,
# PhotoPrism's post-login destination) bounces back to the
# SvelteKit SPA — mule-image is the only user-facing frontend.
# After OIDC succeeds PhotoPrism stores the session in localStorage
# then `window.location.href = "/library/login"` to hand off. Bounce
# every /library/* request back to the SvelteKit root; the SPA reads
# the localStorage session via bootstrapSessionFromPhotoPrism().
redir /library / 302
redir /library/* / 302
# mule-sidecar (Go) — keeps the /api/sidecar/ prefix
@@ -172,7 +165,6 @@ photos.hubris.network {
# Catch-all → nginx-on-120 serving the SvelteKit static bundle
reverse_proxy 192.168.8.136:3000
}
}
auth.hubris.network {
tls {