dtoro
f1ac82255a
- Server: /oidc-callback HTML page exchanges Authentik code for token, displays it for user to copy into the desktop app's Token tab - oidc.ts: desktop mode uses apiUrl+/oidc-callback as redirect URI, encodes PKCE verifier in state parameter - Config.svelte: add Server URL field to OIDC tab for desktop UX - Caddy: add /oidc-callback to enroll bypass (no Authentik gate) - App: favicon.png as system tray icon, window title 'Oikos' - web/index.html: title 'Oikos'
60 lines
2.6 KiB
Caddyfile
60 lines
2.6 KiB
Caddyfile
# Caddy reverse-proxy snippet for Oikos — Phase 6 cutover, updated for the
|
|
# client/server split (plans/2026-07-12-wails-desktop-app.md, Phase 0).
|
|
# Lives in dtoro/caddy-conf repo; auto-deploys to caddy (LXC 121). THIS COPY
|
|
# IS A REFERENCE, NOT DEPLOYED FROM HERE — keep it in sync manually.
|
|
#
|
|
# The SPA is no longer embedded in the oikos binary; it's built and served
|
|
# by its own container (compose/web/Dockerfile, docker-compose.yml's `web`
|
|
# service, mac-mini:8091) rather than as static files read off local disk —
|
|
# see that service's comment for why. Every API/MCP/agent route now requires
|
|
# a bearer token in all cases (api's dev-open bypass was removed) —
|
|
# non-browser clients (Wails, curl, a future mobile client) can't complete
|
|
# Authentik's browser-session login, so those routes bypass `import
|
|
# authentik` the same way the enrollment endpoint always has and rely on
|
|
# api's own combinedAuth instead. See the Wails plan's "Plan review"
|
|
# section, gap 1.
|
|
#
|
|
# mac-mini and the LXC subnet are routed, so these target its direct LAN IP
|
|
# rather than the mesh (netbird) hostname.
|
|
|
|
oikos.hubris.network {
|
|
tls {
|
|
dns ionos {env.IONOS_AUTH_API_TOKEN}
|
|
}
|
|
@enroll path /api/v1/clients/enroll /oidc-callback
|
|
handle @enroll {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Bearer-token clients — api's combinedAuth (internal/httpapi/server.go)
|
|
# is the real gate for all three; Authentik would just reject non-browser
|
|
# callers before they ever get there. /agent/* now goes through api's own
|
|
# (auth'd) proxy mount rather than straight to nomos:8092, so it's
|
|
# covered by the same check as /api/v1/* and /mcp.
|
|
@api path /api/v1/* /mcp /agent/*
|
|
handle @api {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
# Everything else: the static SPA shell, served by the `web` container.
|
|
# No sensitive data lives here — real enforcement is the bearer-token
|
|
# check above — Authentik is just a first line of defense against
|
|
# anonymous crawlers finding the bundle.
|
|
handle {
|
|
import authentik
|
|
reverse_proxy 192.168.178.182:8091
|
|
}
|
|
}
|
|
|
|
# Oikos MCP endpoint (agents) — bearer token required (api's combinedAuth),
|
|
# no separate gate here.
|
|
mcp.hubris.network {
|
|
reverse_proxy 192.168.178.182:8090
|
|
}
|
|
|
|
# Nomos's own gateway (workstation access) — still has NO auth of its own
|
|
# (C1, plans/2026-07-11-nomos-agent-code-review.md, still open). Anyone who
|
|
# can reach this host can talk to nomos directly, bypassing api entirely.
|
|
# Not fixed by the client/server split — tracked separately.
|
|
nomos.hubris.network {
|
|
reverse_proxy 192.168.178.182:8092
|
|
}
|