doxa-life/doxa-maps
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Cloud container: OIDC_AUTO_SIGNIN, so the Studio can sign in inside a dashboard frame

Browse source 
With it on, oauth2-proxy skips its button page. For a user already signed in to the provider the sign-in is
then redirects only, and the provider's no-framing headers never apply, so a framed Studio signs itself in.
This commit is contained in:
Doxa Maps 2026-09-28 04:32:57 +00:00
parent b23ecd4f64
commit 804ce1ae0c
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
deployment/cloud/README.md
View file

@ -68,6 +68,7 @@ there. Only then does it swap the new build in.
| `PB_OIDC_CLIENT_SECRET` (+ `PB_OIDC_CLIENT_ID`, default `dx-maps-pb-dev`) | turns pb-dev into the team backend: laptops use it directly (`DX_PB_URL=https://<host>/pb`), and people sign in to PocketBase through the same OIDC provider, with its own client whose redirect URI is `https://<host>/pb/api/oauth2-redirect`. Only members of `OIDC_ALLOWED_GROUPS` get in (a sign-in hook baked into the image and pinned; the repo's own hooks never run). Password sign-in is off, new collections are superuser-only until a migration opens them, and data never leaves `/data` |
| `PRODUCTION_BRANCH` | the branch `/cdn/` is built from (default `production`); the dev server keeps following `BRANCH`. Promote with `git push origin main:production` |
| `CDN_AUTOBUILD_MINUTES` | rebuild `/cdn/` by itself once `PRODUCTION_BRANCH` has held a new commit this long (default `2`; `0` = only the admin button) |
| `OIDC_AUTO_SIGNIN` | `1` skips the "Sign in with …" button and goes straight to the provider, so the Studio can sign in inside a frame (a dashboard tile) for anyone already signed in to the provider. Default off |
| `SUBDOMAIN_APPS` | publish plugins as their own PUBLIC sites: `host=bundle/profile`, comma-separated, e.g. `research-gallery.example.org=doxa-maps-spa/doxa-maps-spa`. Served from the `/cdn` build by a separate server on `SUBDOMAIN_PORT` (default `5176`) that answers only those hosts and only with published files; point each host's proxy route at that port. No sign-in is skipped anywhere else |
| `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https://<host>/api-prod`) |
| `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) |

5
deployment/cloud/entry.sh
View file

@ -79,6 +79,10 @@ if [ -z "${OIDC_ISSUER:-}" ]; then
exec bun x vite --config "$CONFIG"
fi
# OIDC_AUTO_SIGNIN=1: no "Sign in with …" button page; an unsigned visitor goes straight to the provider. It lets
# the Studio sign in INSIDE a frame (e.g. a dashboard tile): for a user already signed in to the provider the whole
# round trip is redirects, so the provider's own no-framing headers never apply.
AUTO=(); [ "${OIDC_AUTO_SIGNIN:-0}" = 1 ] && AUTO=(--skip-provider-button)
# OIDC gate: oauth2-proxy owns the public port; Vite listens on localhost behind it, so the Plugin
# Studio, every map and the hot-reload websocket are all behind the same sign-in.
: "${OIDC_CLIENT_ID:?}" "${OIDC_CLIENT_SECRET:?}" "${OIDC_REDIRECT_URL:?}"
@ -142,6 +146,7 @@ oauth2-proxy \
"${ALLOW[@]}" \
--email-domain='*' \
--provider-display-name="${OIDC_DISPLAY_NAME:-your identity provider}" \
"${AUTO[@]}" \
--upstream=http://127.0.0.1:5174/ \
--upstream=http://127.0.0.1:5175/cdn/ \
--upstream=http://127.0.0.1:5175/api-prod/ \