32 lines
2.6 KiB
Markdown
32 lines
2.6 KiB
Markdown
> Historical: Google/OIDC was withdrawn on 2026-09-09. Do not use these setup instructions. The replacement is documented in local-mail.md.
|
|
|
|
# Enabling account login
|
|
|
|
The deployed preview remains in guest mode until OIDC is deliberately configured. The local browser fixture does not change the public installation.
|
|
|
|
Use the existing systemd environment file on the deployment host:
|
|
`/home/pacs/mih04/users/werkjournal/.config/werkjournal/environment`.
|
|
Keep it readable only by its owner (`chmod 600`). The deployment process preserves this file; do not put credentials in the repository or CI logs.
|
|
|
|
The application reads these explicit environment variables:
|
|
|
|
```ini
|
|
WERKJOURNAL_GUEST_MODE=false
|
|
WERKJOURNAL_AUTH_ISSUER=https://accounts.google.com
|
|
WERKJOURNAL_AUTH_CLIENT_ID=replace-with-client-id
|
|
WERKJOURNAL_AUTH_CLIENT_SECRET=replace-with-client-secret
|
|
WERKJOURNAL_AUTH_REDIRECT_URI=https://werkjournal.javagil.de/login/oauth2/code/google
|
|
WERKJOURNAL_AUTH_BOOTSTRAP_CODE=replace-with-a-long-random-one-time-code
|
|
WERKJOURNAL_PUBLIC_URL=https://werkjournal.javagil.de
|
|
```
|
|
|
|
Register the exact HTTPS redirect URI with the provider. TLS terminates at the Hostsharing proxy; the application continues listening on its existing loopback port 18090. OIDC uses discovery, authorization code flow, and the `openid profile` scopes. No provider API token is retained after identity admission.
|
|
|
|
After configuring the client and environment file, restart with `tools/remote backend restart`. Check the public login page and complete **Initial setup** with the configured setup code and the Google identity intended as administrator. Bootstrap is consumed transactionally and cannot be reused, even if its environment variable remains present. Remove the setup code from the environment after successful setup and restart again.
|
|
|
|
The administrator creates seven-day single-use invitation links under Settings → Administration. Links carry their token in the fragment; the login page removes it from the URL and submits it with CSRF protection before starting OIDC. Accounts identify users by issuer and subject, not email address.
|
|
|
|
Disabling guest mode does not assign shared guest tracking records to a newly signed-in account. Each admitted account receives its own tracking defaults. The guest database records remain separate.
|
|
|
|
Do not enable authenticated mode without a valid client: missing OIDC configuration deliberately prevents startup. Real Google and public proxy acceptance remains outstanding; the local signing-provider tests are not evidence of a configured production Google client. Last-administrator recovery and self-service deletion belong to the separate recovery/deletion implementation nodes.
|