source: Klonkt/.env.example@ 32cc601

main
Last change on this file since 32cc601 was 32cc601, checked in by roboburr <roboburr@…>, 3 months ago

auth: route Google login via central Klonkt broker (no credentials per instance)

The instance no longer talks directly to Google but delegates to the central
broker (license.klonkt.com): it performs the OAuth dance with one Google client
and returns a signed, audience-bound identity token, which we verify offline
against the broker's pubkey. This way no self-hoster needs to create their own
Google client.

  • config/google.js: broker client (brokerStartUrl + verifyIdentityToken against /pubkey: issuer + EdDSA + audience==SITE_ORIGIN + typ; consumeJti against replay).
  • routes/auth.js: /auth/google sets state in session -> broker; callback checks state (CSRF) + token + replay, finds-or-creates user on email.
  • god only via ADMIN_EMAIL; the "first user becomes god" bootstrap only applies when NO ADMIN_EMAIL is set (otherwise a stranger on a fresh install could become owner).
  • Reject login if the email address is already linked to a different google_sub.
  • jose added to dependencies (verifier; otherwise npm ci crashes the app).
  • .env: KLONKT_BROKER_URL + SITE_ORIGIN instead of GOOGLE_CLIENT_ID/SECRET.

Co-Authored-By: Claude <noreply@…>
  • Property mode set to 100644
File size: 1.0 KB
Line 
1NODE_ENV=development
2PORT=3000
3SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
4DATABASE_PATH=./storage/database.sqlite
5MEDIA_PATH=./storage/media
6
7# ── Google login via de Klonkt-broker ──────────────────────────────
8# Inloggen gaat via Google, maar gerouteerd door de centrale Klonkt-broker —
9# deze app maakt dus GEEN eigen Google-client aan. Je hoeft hier alleen de
10# broker-URL en het eigen publieke origin te zetten. Zonder deze waarden boot
11# de app gewoon en toont de loginpagina "nog niet geconfigureerd".
12KLONKT_BROKER_URL=https://license.klonkt.com
13# Het eigen publieke origin (scheme + host, geen pad/slash). Bepaalt de callback
14# (<SITE_ORIGIN>/auth/google/callback) en de audience die we eisen. Dit origin
15# moet in de KLONKT_ALLOWED_ORIGINS van de broker staan.
16SITE_ORIGIN=https://example.com
17
18# Het Google-e-mailadres dat owner/admin (god) is op deze instance.
19# De eerste gebruiker die inlogt wordt sowieso god als de DB nog leeg is.
20ADMIN_EMAIL=
Note: See TracBrowser for help on using the repository browser.