diff --git a/.env.example b/.env.example index 2cbdbaa..4d3f867 100644 --- a/.env.example +++ b/.env.example @@ -1,5 +1,5 @@ # Public app URL (used for OIDC redirect URIs, share links, etc.) -NEXT_PUBLIC_APP_URL=https://fam.ginnoir.com +NEXT_PUBLIC_APP_URL=https://fam.yourdomain.com # Postgres DATABASE_URL=postgres://famapp:famapp@localhost:5432/famapp @@ -15,7 +15,7 @@ DEV_LOGIN_NAME=Dev User DEV_HOUSEHOLD_NAME=Home # OIDC (Authentik) -AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/ +AUTH_OIDC_ISSUER=https://auth.yourdomain.com/application/o/famapp/ AUTH_OIDC_CLIENT_ID=replace-me AUTH_OIDC_CLIENT_SECRET=replace-me diff --git a/.env.production.example b/.env.production.example index 98130d1..60e0c7e 100644 --- a/.env.production.example +++ b/.env.production.example @@ -1,6 +1,5 @@ # ── famapp ──────────────────────────────────────────────────────────────────── # These vars are consumed by the famapp service in docker-compose.yml. -# The production .env lives on valhalla at ~/htpc-download-box/.env # Image tag to deploy. Pin to a specific version after first deploy # (e.g. ghcr.io/ginnoir/famapp:v0.1.0). `latest` is fine for staging/initial. @@ -10,7 +9,7 @@ AUTHENTIK_IMAGE_TAG=2024.12.3 RUN_MIGRATIONS=true # Public URL for the app -AUTH_URL=https://fam.ginnoir.com +AUTH_URL=https://fam.yourdomain.com # famapp Postgres FAMAPP_DB_USER=famapp @@ -23,7 +22,7 @@ FAMAPP_DB_NAME=famapp AUTH_SECRET=replace-with-openssl-rand-base64-32 # OIDC provider (Authentik) — fill in after bootstrapping Authentik -AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/ +AUTH_OIDC_ISSUER=https://auth.yourdomain.com/application/o/famapp/ AUTH_OIDC_CLIENT_ID=replace-me AUTH_OIDC_CLIENT_SECRET=replace-me @@ -33,7 +32,7 @@ VAPID_PRIVATE_KEY= VAPID_SUBJECT=mailto:your-email@example.com # ntfy push fallback -NTFY_URL=https://ntfy.ginnoir.com +NTFY_URL=https://ntfy.yourdomain.com NTFY_TOPIC=famapp # Log level: error | warn | info | debug diff --git a/deploy/authentik/README.md b/deploy/authentik/README.md index 2369ec0..906bb46 100644 --- a/deploy/authentik/README.md +++ b/deploy/authentik/README.md @@ -6,13 +6,13 @@ Run these steps once after the first `docker compose up -d` in the `deploy/` dir ## 1. Set the admin password -Visit `https://auth.ginnoir.com/if/flow/initial-setup/` and set the **akadmin** password. +Visit `https://auth.yourdomain.com/if/flow/initial-setup/` and set the **akadmin** password. --- ## 2. Create the OIDC provider -1. Log in to the Authentik Admin UI at `https://auth.ginnoir.com/if/admin/`. +1. Log in to the Authentik Admin UI at `https://auth.yourdomain.com/if/admin/`. 2. Go to **Applications → Providers → Create**. 3. Choose **OAuth2/OpenID Provider**. 4. Configure: @@ -21,7 +21,7 @@ Visit `https://auth.ginnoir.com/if/flow/initial-setup/` and set the **akadmin** - **Client type:** `Confidential` - **Client ID:** (auto-generated — copy this) - **Client Secret:** (auto-generated — copy this) - - **Redirect URIs:** `https://fam.ginnoir.com/api/auth/callback/authentik` + - **Redirect URIs:** `https://fam.yourdomain.com/api/auth/callback/authentik` - **Signing Key:** `authentik Self-signed Certificate` - **Token validity:** 24 hours (or your preference) 5. Save and note the **Issuer URL** shown on the provider detail page. @@ -29,13 +29,13 @@ Visit `https://auth.ginnoir.com/if/flow/initial-setup/` and set the **akadmin** The issuer URL will look like: ``` -https://auth.ginnoir.com/application/o/famapp/ +https://auth.yourdomain.com/application/o/famapp/ ``` Set this (and the client ID/secret) in famapp's `.env` / production secrets: ```env -AUTH_OIDC_ISSUER=https://auth.ginnoir.com/application/o/famapp/ +AUTH_OIDC_ISSUER=https://auth.yourdomain.com/application/o/famapp/ AUTH_OIDC_CLIENT_ID= AUTH_OIDC_CLIENT_SECRET= ``` @@ -49,7 +49,7 @@ AUTH_OIDC_CLIENT_SECRET= - **Name:** `famapp` - **Slug:** `famapp` - **Provider:** select the `famapp` provider created above - - **Launch URL:** `https://fam.ginnoir.com` + - **Launch URL:** `https://fam.yourdomain.com` 3. Save. --- @@ -68,7 +68,7 @@ AUTH_OIDC_CLIENT_SECRET= Each user can enroll a passkey from their Authentik profile: -1. Sign in as the user at `https://auth.ginnoir.com`. +1. Sign in as the user at `https://auth.yourdomain.com`. 2. Go to **Settings → MFA Devices → Add → WebAuthn Device**. 3. Follow the browser prompt to register a Touch ID / Face ID / hardware key. diff --git a/docs/dev-login.md b/docs/dev-login.md index 6c8a000..f9f8771 100644 --- a/docs/dev-login.md +++ b/docs/dev-login.md @@ -42,11 +42,11 @@ pnpm dev:local The script prints three URLs at startup: -| URL | Use for | -| -------------------------- | ---------------------------------------------------------- | -| `http://localhost:3000` | Browser on this machine | -| `http://192.168.1.74:3000` | Phone on the same WiFi (general UI testing) | -| `https://dev.ginnoir.com` | Push notifications + PWA install (needs Caddy — see below) | +| URL | Use for | +| ---------------------------- | ---------------------------------------------------------- | +| `http://localhost:3000` | Browser on this machine | +| `http://192.168.x.y:3000` | Phone on the same WiFi (general UI testing) | +| `https://dev.yourdomain.com` | Push notifications + PWA install (needs Caddy — see below) | Then open `/login` and click **Dev login**. @@ -74,11 +74,11 @@ Route through the existing Caddy server on the home server instead — no extra **Step 1 — DHCP reservation** -Set a reservation on the router so the dev machine always gets `192.168.1.74`. +Set a reservation on the router so the dev machine always gets `192.168.x.y`. **Step 2 — DNS record** -Add a `dev.ginnoir.com` A record pointing to the same public IP as `fam.ginnoir.com`. +Add a `dev.yourdomain.com` A record pointing to the same public IP as `fam.yourdomain.com`. **Step 3 — Windows Firewall** @@ -97,7 +97,7 @@ Paste `deploy/Caddyfile.dev.snippet` into the home server Caddyfile and reload: caddy reload --config /path/to/Caddyfile ``` -After this, `https://dev.ginnoir.com` proxies to the dev machine with a real Let's Encrypt cert. +After this, `https://dev.yourdomain.com` proxies to the dev machine with a real Let's Encrypt cert. ## Current Local E2E Procedure