Point auth references at charon.sticknife.com

auth.sticknife.com moved to charon.sticknife.com. Rather than swapping the
hostname in each place, derive the OIDC issuer and the logout fallback from
AUTH_BASE_URL so the auth host is configured in one place.

Backend routes using charon.potternet.lan are unchanged; that internal name
remains the preferred route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/config.py

@@ -82,11 +82,13 @@ def get_config() -> Config:
     database_url = os.environ.get("DATABASE_URL", "")
     if role != "home" and not database_url:
         raise SystemExit("DATABASE_URL is required unless APP_ROLE=home")
+    # Where the pages this deployment does not serve actually live. A "full" deployment serves
+    # them itself, so its own base URL is the right answer. The OIDC issuer defaults to the same
+    # host, so moving the auth service means changing AUTH_BASE_URL alone.
+    auth_base_url = os.environ.get("AUTH_BASE_URL", base_url).rstrip("/")
     return Config(
         role=role,
-        # Where the pages this deployment does not serve actually live. A "full" deployment serves
-        # them itself, so its own base URL is the right answer.
-        auth_base_url=os.environ.get("AUTH_BASE_URL", base_url).rstrip("/"),
+        auth_base_url=auth_base_url,
         base_url=base_url,
         host=os.environ.get("APP_HOST", "127.0.0.1"),
         port=int(os.environ.get("APP_PORT", "8080")),
@@ -97,7 +99,7 @@ def get_config() -> Config:
         default_ipa_group=os.environ.get("DEFAULT_IPA_GROUP", "sticknife_users"),
         app_admin_emails=_csv("APP_ADMIN_EMAILS"),
         admin_groups=_csv("APP_ADMIN_GROUPS") or {"sticknife_admins"},
-        oidc_issuer=os.environ.get("OIDC_ISSUER", "https://auth.sticknife.com/application/o/charon/").rstrip("/"),
+        oidc_issuer=os.environ.get("OIDC_ISSUER", f"{auth_base_url}/application/o/charon/").rstrip("/"),
         oidc_client_id=os.environ.get("OIDC_CLIENT_ID", ""),
         oidc_client_secret=os.environ.get("OIDC_CLIENT_SECRET", ""),
         oidc_scopes=os.environ.get("OIDC_SCOPES", "openid profile email groups"),

app/oidc.py

@@ -92,6 +92,6 @@ def groups_from_claims(claims: dict[str, Any]) -> set[str]:
 
 def logout_url(config: Config) -> str:
     provider = discover(config)
-    endpoint = provider.end_session_endpoint or "https://auth.sticknife.com/if/session-end/"
+    endpoint = provider.end_session_endpoint or f"{config.auth_base_url}/if/session-end/"
     query = urllib.parse.urlencode({"post_logout_redirect_uri": config.base_url})
     return f"{endpoint}?{query}"

app/templates/landing.html

@@ -73,7 +73,7 @@
     <div class="sn-baseline"></div>
     <div class="sn-colophon">
       <span>sticknife.com</span>
-      <span>accounts and keys &mdash; auth.sticknife.com</span>
+      <span>accounts and keys &mdash; charon.sticknife.com</span>
     </div>
   </footer>
 </div>

app/templates/pantheon/charon.toml

@@ -7,7 +7,7 @@ name   = "Charon"
 domain = "The Ferryman"
 state  = "here"
 label  = "Live"
-host   = "auth.sticknife.com"
+host   = "charon.sticknife.com"
 runs   = "Authentik + FreeIPA"
 
 # one line, used by the no-JavaScript listing