cgalo5758
aa286bd089
farm Replace wiki-security-passportjs with wiki-security-social across FedWiki configuration, docs, and workflows, and introduce a Caddy TLS proxy so browser login works over HTTPS with Secure cookies. Update Keycloak OIDC discovery URLs, OAuth2 identity mapping, and test-stack HTTPS handling while preserving the existing owner.json and API contracts.
26 lines
1012 B
Caddyfile
26 lines
1012 B
Caddyfile
# TLS termination for the FedWiki farm (test stack only).
|
|
#
|
|
# wiki-security-social (better-auth) issues Secure cookies, which browsers only
|
|
# store over HTTPS. Browsers reach farm sites through here on :443; member-console
|
|
# keeps talking to fedwiki's plain-HTTP admin API directly (bearer token, no
|
|
# cookies), so it bypasses this proxy entirely.
|
|
#
|
|
# Caddy mints the wildcard cert from its own internal CA (no public ACME). To
|
|
# trust it for manual browsing, export the root once and add it to your trust store:
|
|
#
|
|
# docker compose cp caddy:/data/caddy/pki/authorities/local/root.crt ./caddy-root.crt
|
|
#
|
|
# Automated chrome-devtools can instead launch Chrome with --ignore-certificate-errors
|
|
# (it still counts as a secure context, so Secure cookies are stored).
|
|
{
|
|
# The container trust store is ephemeral; don't try to modify it.
|
|
skip_install_trust
|
|
}
|
|
|
|
# Single-level subdomains (admin.localtest.me, <site>.localtest.me) plus the apex.
|
|
*.localtest.me, localtest.me {
|
|
tls internal
|
|
reverse_proxy fedwiki:80
|
|
}
|