ginnoir/homelabstack
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: cut files.ginnoir.com over to Nextcloud; fix scope PKs
Deploy Caddyfile to valhalla / deploy (push) Successful in 55s
Details

Browse Source 
Switch files.ginnoir.com from ownCloud to Nextcloud (internal-only).
Fix Authentik scope PKs in CLAUDE.md — the last UUID segments were
wrong and would have caused provider creation failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ginnoir
2026-06-15 23:07:18 -05:00
co-authored by Claude Sonnet 4.6
parent a1c57ca899
commit ac6f233988
2 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+7 -4
View File
@@ -114,9 +114,12 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
"authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74", "authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74",
"invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3", "invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3",
"property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."], "property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."],
"sub_mode": "hashed_user_id" "sub_mode": "hashed_user_id",
"grant_types": ["authorization_code", "hybrid", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
"signing_key": "dc7cbd9e-c6d2-4168-b402-e7570bcb59d1"
} }
``` ```
**IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed).
Note the returned `pk`, `client_id`, and `client_secret`. Note the returned `pk`, `client_id`, and `client_secret`.
2. **Create an Authentik application** → `POST /api/v3/core/applications/`: 2. **Create an Authentik application** → `POST /api/v3/core/applications/`:
@@ -134,9 +137,9 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
|---|---| |---|---|
| Implicit consent flow | `b88daebc-c54d-4e85-ae27-8b47384d5d74` | | Implicit consent flow | `b88daebc-c54d-4e85-ae27-8b47384d5d74` |
| Invalidation flow | `3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3` | | Invalidation flow | `3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3` |
| Scope — openid | `718abef2-8e8e-4133-afe7-a0eec7b37aba` | | Scope — openid | `718abef2-504c-452c-9ff0-329eda8031c7` |
| Scope — email | `19491dd8-da08-469a-8e5e-3be8ed1cbe5d` | | Scope — email | `19491dd8-d239-41a4-aa48-030c1471779d` |
| Scope — profile | `ca45a8da-a38f-4ffe-b7a3-f0c0bac2df92` | | Scope — profile | `ca45a8da-db62-41ba-b1c4-e669bf3c9a82` |
To get the exact scope PKs if needed: `GET /api/v3/propertymappings/scope/?search=openid`. To get the exact scope PKs if needed: `GET /api/v3/propertymappings/scope/?search=openid`.
Caddyfile
+7 -5
View File
@@ -60,14 +60,16 @@ pf2e.ginnoir.com {
} }
# ============================================================= # =============================================================
# FILE STORAGE — public (Authentik on admin UI; shares + WebDAV bypass) # FILE STORAGE — internal only (Nextcloud)
# ============================================================= # =============================================================
files.ginnoir.com { files.ginnoir.com {
handle /.well-known/openid-configuration { import internal_only
rewrite * /index.php/apps/openidconnect/config redir /.well-known/carddav /remote.php/dav 301
reverse_proxy owncloud:8080 redir /.well-known/caldav /remote.php/dav 301
reverse_proxy nextcloud:80 {
header_up X-Forwarded-Proto https
header_up X-Real-IP {remote_host}
} }
reverse_proxy owncloud:8080
} }
# ============================================================= # =============================================================