marcandClaude Opus 5
43a98b0972
OpenID Connect, off unless four settings are present. It is a second way to the same token the password login mints — every route and the WebSocket still know only a signed JWT — which is why it fits in one file and needs no new dependency: Node imports a JWK itself, so checking an ID token is a signature and five claims. Authorization Code with PKCE, exchanged on the server so the client secret stays there. The browser comes home with a one-time ticket rather than the token, because a token in a redirect URL sits in the history, in the proxy's log and in the referrer of the next request. Somebody the app has not seen gets an account; an account that already exists under that name is linked to the identity rather than duplicated, by subject from then on. Never an administrator. An account made this way has no password here, and the interface stops offering one — but an admin can still set one, which is the way back in if the provider is ever gone. The suite signs in at a provider of its own that signs real RS256 tokens, and holds down the four ways the journey must fail as well as the way it must work. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
56 lines
2.8 KiB
Bash
56 lines
2.8 KiB
Bash
# cp .env.example .env — Compose reads it from this directory.
|
|
# Back the finished .env up with the database: without ENCRYPTION_KEY the
|
|
# stored notes cannot be read again.
|
|
|
|
# Both: openssl rand -hex 32
|
|
JWT_SECRET=
|
|
ENCRYPTION_KEY=
|
|
|
|
# The first administrator. There is no public sign-up — every other account is
|
|
# created in the app under Account → Administration. Used only until an admin
|
|
# exists, then ignored, so they can never reset anything later.
|
|
INKNOTE_ADMIN_USER=
|
|
INKNOTE_ADMIN_PASSWORD=
|
|
|
|
# Where the notes are kept on the host. Defaults to /srv/inknote in production
|
|
# and ./data for development — leave it commented unless you want another path,
|
|
# since one .env serves both. Create the directory first, or Docker creates it
|
|
# as root and the server (uid 1000) cannot write:
|
|
# mkdir -p /srv/inknote/{db,uploads} && chown -R 1000:1000 /srv/inknote
|
|
# INKNOTE_DATA_DIR=/srv/inknote
|
|
#
|
|
# Under /root also run "chmod o+x /root", or the server cannot reach it at all.
|
|
# That and the alternative: readme.md → Where the data lives.
|
|
|
|
# ── Optional ── unset keeps the default shown
|
|
# INKNOTE_MAX_IMAGE_MB=25 # pasted images
|
|
# INKNOTE_MAX_PDF_MB=200 # imported PDFs, limited separately
|
|
# INKNOTE_UID=1000 # must own INKNOTE_DATA_DIR
|
|
# INKNOTE_GID=1000
|
|
# MAX_VERSIONS_PER_NOTE=50 # default; each notebook can set its own
|
|
# VERSION_RETENTION_DAYS= # off: versions expire by count, not by age
|
|
# VERSION_COALESCE_MINUTES=5
|
|
# ALLOWED_ORIGINS= # only if the UI is on another host
|
|
|
|
# ── Signing in through an identity provider (OpenID Connect) ──
|
|
# Optional. Leave the four empty and the app is password-only; set all four and
|
|
# the sign-in screen offers the provider as well. The password login stays in
|
|
# either case — an unreachable provider must not lock anybody out of their own
|
|
# notes. Somebody who signs in this way and has no account here yet gets one
|
|
# (never an administrator: that is granted in the app, on purpose).
|
|
#
|
|
# In PocketID: a new OIDC client, redirect URI exactly
|
|
# https://<your-inknote-host>/api/auth/oidc/callback
|
|
# The *server container* has to reach the issuer itself, not just your browser.
|
|
#
|
|
# The first sign-in binds an identity to an account of the same name here, so
|
|
# this trusts the provider's usernames. Right for a provider whose names are set
|
|
# by its own administrator; wrong for one where people pick their own.
|
|
# INKNOTE_PUBLIC_URL=https://notes.example.com
|
|
# INKNOTE_OIDC_ISSUER=https://id.example.com
|
|
# INKNOTE_OIDC_CLIENT_ID=
|
|
# INKNOTE_OIDC_CLIENT_SECRET=
|
|
# INKNOTE_OIDC_LABEL=PocketID # what the button says: "Continue with …"
|
|
# INKNOTE_OIDC_SCOPES=openid profile email
|
|
# INKNOTE_OIDC_REDIRECT_URI= # only if it is not <public url>/api/auth/oidc/callback
|