From ac6f233988cc424fe2ef3531cbd36fb1959caa10 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:07:18 -0500
Subject: [PATCH] feat: cut files.ginnoir.com over to Nextcloud; fix scope PKs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch files.ginnoir.com from ownCloud to Nextcloud (internal-only).
Fix Authentik scope PKs in CLAUDE.md — the last UUID segments were
wrong and would have caused provider creation failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 CLAUDE.md | 11 +++++++----
 Caddyfile | 12 +++++++-----
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 9444dca..e96b5e5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -114,9 +114,12 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
      "authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74",
      "invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3",
      "property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."],
-     "sub_mode": "hashed_user_id"
+     "sub_mode": "hashed_user_id",
+     "grant_types": ["authorization_code", "hybrid", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+     "signing_key": "dc7cbd9e-c6d2-4168-b402-e7570bcb59d1"
    }
    ```
+   **IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed).
    Note the returned `pk`, `client_id`, and `client_secret`.
 
 2. **Create an Authentik application** → `POST /api/v3/core/applications/`:
@@ -134,9 +137,9 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
 |---|---|
 | Implicit consent flow | `b88daebc-c54d-4e85-ae27-8b47384d5d74` |
 | Invalidation flow | `3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3` |
-| Scope — openid | `718abef2-8e8e-4133-afe7-a0eec7b37aba` |
-| Scope — email | `19491dd8-da08-469a-8e5e-3be8ed1cbe5d` |
-| Scope — profile | `ca45a8da-a38f-4ffe-b7a3-f0c0bac2df92` |
+| Scope — openid | `718abef2-504c-452c-9ff0-329eda8031c7` |
+| Scope — email | `19491dd8-d239-41a4-aa48-030c1471779d` |
+| Scope — profile | `ca45a8da-db62-41ba-b1c4-e669bf3c9a82` |
 
 To get the exact scope PKs if needed: `GET /api/v3/propertymappings/scope/?search=openid`.
 
diff --git a/Caddyfile b/Caddyfile
index 0dbc706..b810928 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -60,14 +60,16 @@ pf2e.ginnoir.com {
 }
 
 # =============================================================
-# FILE STORAGE — public (Authentik on admin UI; shares + WebDAV bypass)
+# FILE STORAGE — internal only (Nextcloud)
 # =============================================================
 files.ginnoir.com {
-	handle /.well-known/openid-configuration {
-		rewrite * /index.php/apps/openidconnect/config
-		reverse_proxy owncloud:8080
+	import internal_only
+	redir /.well-known/carddav /remote.php/dav 301
+	redir /.well-known/caldav /remote.php/dav 301
+	reverse_proxy nextcloud:80 {
+		header_up X-Forwarded-Proto https
+		header_up X-Real-IP {remote_host}
 	}
-	reverse_proxy owncloud:8080
 }
 
 # =============================================================