linusandClaude Sonnet 5
7da9a362e1
Authentik accounts don't always have an email set (the test account `hermes` doesn't). AuthentikStrategy / verifyAuthentikClaims no longer reject those — `authentikEmail()` falls back to a stable `<preferred_username|sub>@no-email.authentik` handle for the local User row, and first/last name fall back to preferred_username/name. Set AUTHENTIK_LEITUNGSTEAM_GROUP to the real group "KC-APP-LT". Verified end to end against the live https://sso.konfi-castle.com with a password-grant token for a KC-APP-LT member: backend accepts the RS256 token (JWKS + trailing-slash issuer), JIT-provisions the User, maps the `groups` claim to isLeitungsteam=true, and POST /api/kc returns 201. Only the in-browser redirect round-trip remains untested. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
59 lines
2.1 KiB
Bash
59 lines
2.1 KiB
Bash
# Postgres connection used by Prisma
|
|
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/kcapp?schema=public"
|
|
|
|
# Authentik OIDC issuer (trailing slash optional — both forms are accepted).
|
|
AUTHENTIK_ISSUER_URL="https://sso.konfi-castle.com/application/o/konfi-castle-app"
|
|
|
|
# Name of the Authentik group whose members are Leitungsteam. Mirrored to
|
|
# User.isLeitungsteam on every login (the access token must carry a `groups`
|
|
# claim; add the "groups" scope to the Authentik provider).
|
|
AUTHENTIK_LEITUNGSTEAM_GROUP="KC-APP-LT"
|
|
|
|
# Secret used to sign guest/Konfi session tokens (local accounts only)
|
|
GUEST_JWT_SECRET="change-me"
|
|
|
|
# Secret used to sign local Gemeinde Teamer session tokens (password login)
|
|
TEAM_JWT_SECRET="change-me-too"
|
|
|
|
PORT=3000
|
|
|
|
# Public base URL of the app, used to build links in outgoing emails.
|
|
APP_BASE_URL="http://localhost:3000"
|
|
|
|
# Email: defaults to "log" (writes what it would send to the log, no
|
|
# delivery). Set MAIL_PROVIDER=smtp plus the SMTP_* vars + MAIL_FROM to
|
|
# actually send Gemeinde-Teamer invite emails.
|
|
MAIL_PROVIDER="log"
|
|
MAIL_FROM="KC-App <no-reply@example.org>"
|
|
SMTP_HOST="smtp.example.org"
|
|
SMTP_PORT=587
|
|
SMTP_SECURE="false"
|
|
SMTP_USER=""
|
|
SMTP_PASS=""
|
|
|
|
# File storage: defaults to Nextcloud via WebDAV; set STORAGE_PROVIDER=s3 to
|
|
# use an S3-compatible bucket instead (see S3_* vars below).
|
|
STORAGE_PROVIDER="webdav"
|
|
WEBDAV_URL="https://nextcloud.example.org/remote.php/dav/files/kc-app"
|
|
WEBDAV_USERNAME="kc-app"
|
|
WEBDAV_PASSWORD="change-me"
|
|
|
|
# Only used when STORAGE_PROVIDER=s3
|
|
S3_BUCKET="kc-app"
|
|
S3_REGION="auto"
|
|
S3_ENDPOINT=""
|
|
S3_FORCE_PATH_STYLE="false"
|
|
S3_ACCESS_KEY_ID=""
|
|
S3_SECRET_ACCESS_KEY=""
|
|
|
|
# Unique id for THIS server instance (local on-site vs. cloud); used to tag
|
|
# replication log entries and avoid echoing changes back to their origin.
|
|
SERVER_ID="change-me-uuid"
|
|
|
|
# Local/cloud sync: set on the LOCAL (on-site) server to periodically push/
|
|
# pull against the cloud instance's API base URL. Leave SYNC_ENABLED=false
|
|
# on the cloud server (it only needs to expose /sync/ingest + /sync/export).
|
|
SYNC_ENABLED="false"
|
|
SYNC_PEER_URL="https://kc-app-cloud.example.org/api"
|
|
SYNC_SHARED_SECRET="change-me"
|