From 3ccae542599266f49dda8ac74cff57b8169e56fc Mon Sep 17 00:00:00 2001 From: Ryan Date: Sat, 15 Aug 2026 12:40:58 +0200 Subject: [PATCH] Authentik moved to charon.sticknife.com The identity provider's hostname changed. Only AUTHENTIK_ISSUER points at it, so the live change is one line in .env.local; this commit carries the docs and the example, which still named the old host. The issuer string has to match the provider's own discovery document exactly, trailing slash and all -- a host that answers is not the same as an issuer that validates -- so the example now says how to check it. AUTH_URL is unrelated and stays: it is this app's address, not Authentik's. Co-Authored-By: Claude Opus 5 --- .env.example | 9 ++++++++- PLANNING.md | 4 ++-- package-lock.json | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 6a6290e..8e48af8 100644 --- a/.env.example +++ b/.env.example @@ -10,8 +10,15 @@ DATABASE_URL=postgres://user:password@mimir/ampelos # --- sign-in -------------------------------------------------------------- +# AUTH_URL is this app's own address. The ISSUER is Authentik's, and the two +# are unrelated -- moving the identity provider does not change AUTH_URL. AUTH_URL=https://ampelos.sticknife.com -AUTHENTIK_ISSUER= + +# Must match the "issuer" field in the provider's own discovery document +# exactly, trailing slash included, or the sign-in fails validation even though +# the host answers. Check with: +# curl -s https:///application/o//.well-known/openid-configuration +AUTHENTIK_ISSUER=https://charon.sticknife.com/application/o/ampelos/ AUTHENTIK_CLIENT_ID= AUTHENTIK_CLIENT_SECRET= diff --git a/PLANNING.md b/PLANNING.md index 5ae7ace..a1c1555 100755 --- a/PLANNING.md +++ b/PLANNING.md @@ -36,7 +36,7 @@ Ampelos should provide one unified control panel for media requests, watch inten Users should be able to: -- Log in through Authentik at `auth.sticknife.com`. +- Log in through Authentik at `charon.sticknife.com`. - Browse/search media in an Ombi-like interface. - Add shows and movies they are interested in. - Maintain a limited "Watching Now" list. @@ -210,7 +210,7 @@ Ampelos should own the policy and job state. The transcode agent should own the ### Authentik -Authentication should be delegated to Authentik at `auth.sticknife.com`. +Authentication should be delegated to Authentik at `charon.sticknife.com`. Expected model: diff --git a/package-lock.json b/package-lock.json index 8a60210..cc9f1c3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,11 +1,11 @@ { - "name": "web", + "name": "ampelos-dashboard", "version": "0.1.0", "lockfileVersion": 3, "requires": true, "packages": { "": { - "name": "web", + "name": "ampelos-dashboard", "version": "0.1.0", "dependencies": { "drizzle-orm": "^0.45.2",