Klagarge
fc1b45058c
- docs/: shiroa book with three example categories (thermo, security, homelab); pages declare access via '#let access-groups = (...)' - cmd/parser: scans docs/ and generates acl.json (public by default, skips book.typ/template.typ/partials) - internal/acl: loads acl.json, normalizes URLs to page keys so a page's renderer data (*.multi.sir.in) inherits its protection; fail closed on malformed input - internal/oidc: authorization-code flow client, verified ID tokens, groups claim from Authentik - internal/middleware: in-memory sessions, login/logout/callback handlers, CSRF states, access gate + security headers - cmd/server + embed.go: single binary embedding dist/ and acl.json; /searchindex.json blocked; graceful shutdown - Justfile (build/run/parse/check/clean/preview-docs), Gitea Actions workflow (shiroa v0.4.0-rc2), rootless Dockerfile, README - legacy docs moved to legacy_docs/; .idea untracked
18 lines
658 B
Bash
18 lines
658 B
Bash
# Server configuration. Copy to .env (gitignored), export or source it.
|
|
|
|
# Address the server listens on.
|
|
LISTEN_ADDR=:8080
|
|
# Session lifetime.
|
|
SESSION_TTL=12h
|
|
# Set to false only when testing locally over plain http.
|
|
COOKIE_SECURE=false
|
|
|
|
# OIDC (Authentik). Unset: public pages still work, protected pages answer 503.
|
|
OIDC_ISSUER_URL=https://auth.example.com/application/o/yggdrasil/
|
|
OIDC_CLIENT_ID=yggdrasil
|
|
OIDC_CLIENT_SECRET=change-me
|
|
OIDC_REDIRECT_URL=http://localhost:8080/callback
|
|
# Comma/space separated scopes. The groups claim must be covered by a scope
|
|
# mapping on the provider for group checks to work.
|
|
# OIDC_SCOPES=openid profile email groups
|