Public Access
Add configuration, OIDC auth wiring and discovery endpoints (M1)
Options, JWT bearer validation, the /meta and .well-known endpoints, and a dev compose stack with Keycloak. Verified end to end: compose up, migrate, run, both discovery endpoints return correct payloads, and readiness reports the schema current. Configuration: - Strongly-typed options for Server, Oidc, Relay and Sync, all ValidateOnStart. A self-hosted server that boots half-configured and fails later per-request is far harder to diagnose than one that refuses to start and names the bad setting. - Cross-field validation the annotations cannot express: relay needs a WebSocketUrl when enabled, idle timeout must be under max session duration, item payload cap under batch cap. - Startup warnings for combinations that are individually valid but dangerous together: RequireHttpsMetadata false outside Development, and AllowEmailLinking (which turns any token bearing a victim's email into account takeover, hence default false). Auth: - JwtBearer with ClockSkew cut to 30s from the 5-minute default; five minutes of slack on a credential granting vault ciphertext access is more than any clock needs. - IncludeErrorDetails off, and a FallbackPolicy so an endpoint without an explicit policy still requires a caller rather than silently being public. Discovery, per ADR 0002: - /api/v1/meta reports versions, features and push caps. - /.well-known/dodossh-configuration is the onboarding story: the user types one server URL and the client discovers OIDC authority, client id, scopes and relay endpoint. Two environment problems found by actually running the stack: - PostgreSQL 18 changed its data mount point. Mounting /var/lib/postgresql/data — correct through 17 — makes the image refuse to start; 18+ wants a single mount at /var/lib/postgresql with the cluster in a subdirectory. - Keycloak moved to host port 18080. An unrelated Apache Tomcat on this machine holds 127.0.0.1:8080, and a loopback-specific bind beats Docker's 0.0.0.0 publish for "localhost". It presents as Keycloak 404ing every realm while its own log says the import succeeded, which is a genuinely misleading failure. Also: CA1848 is enforced, not advisory — warnings are errors, so the .editorconfig comment claiming otherwise was wrong. Startup and health logging now uses [LoggerMessage]. And a clean rebuild is back to zero warnings; the incremental build had been hiding 40 in test projects (banned Guid.NewGuid, an obsolete Testcontainers constructor, and two analyzer families that are genuinely noise under a test host). Verified: 0 warnings on a clean rebuild, 122 tests pass, format clean.
This commit is contained in:
@@ -0,0 +1,59 @@
|
||||
# Development dependencies only: PostgreSQL and Keycloak.
|
||||
#
|
||||
# The API itself runs from the IDE or `dotnet run`, so the inner loop stays fast while the
|
||||
# schema is still churning. The production stack is deploy/docker-compose.yml.
|
||||
#
|
||||
# docker compose -f deploy/docker-compose.dev.yml up -d
|
||||
# dotnet run --project src/DodoSSH.Api
|
||||
#
|
||||
# Keycloak admin console: http://localhost:18080 (admin / admin)
|
||||
# Test user: alice / alice
|
||||
|
||||
name: dodossh-dev
|
||||
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:18-alpine
|
||||
container_name: dodossh-dev-postgres
|
||||
environment:
|
||||
POSTGRES_DB: dodossh
|
||||
POSTGRES_USER: dodossh
|
||||
POSTGRES_PASSWORD: dodossh
|
||||
# Deterministic collation, matching the server's InvariantGlobalization.
|
||||
POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
|
||||
ports:
|
||||
- "5432:5432"
|
||||
volumes:
|
||||
# PostgreSQL 18+ wants a single mount at /var/lib/postgresql, with the cluster in a
|
||||
# subdirectory. Mounting /var/lib/postgresql/data directly — which was correct for 17
|
||||
# and earlier — makes the image refuse to start, and pg_upgrade --link cannot cross the
|
||||
# mount boundary later.
|
||||
- postgres-data:/var/lib/postgresql
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U dodossh -d dodossh"]
|
||||
interval: 5s
|
||||
timeout: 5s
|
||||
retries: 10
|
||||
|
||||
keycloak:
|
||||
image: quay.io/keycloak/keycloak:26.4
|
||||
container_name: dodossh-dev-keycloak
|
||||
# start-dev, never in production: it disables HTTPS enforcement and uses an in-memory
|
||||
# database. The realm is imported on every start so this stays disposable.
|
||||
command: ["start-dev", "--import-realm"]
|
||||
environment:
|
||||
KC_BOOTSTRAP_ADMIN_USERNAME: admin
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD: admin
|
||||
KC_HEALTH_ENABLED: "true"
|
||||
ports:
|
||||
# 18080, not 8080. Port 8080 is heavily contested on developer machines — a stray Tomcat
|
||||
# or WSL relay bound to 127.0.0.1 wins over Docker's 0.0.0.0 publish for "localhost",
|
||||
# which presents as Keycloak returning 404 for every realm and is thoroughly confusing to
|
||||
# debug. Keycloak derives the token issuer from the request host, so the port simply has
|
||||
# to match Oidc:Authority.
|
||||
- "18080:8080"
|
||||
volumes:
|
||||
- ./keycloak:/opt/keycloak/data/import:ro
|
||||
|
||||
volumes:
|
||||
postgres-data:
|
||||
@@ -0,0 +1,81 @@
|
||||
{
|
||||
"realm": "dodossh",
|
||||
"enabled": true,
|
||||
"displayName": "DodoSSH (development)",
|
||||
"sslRequired": "none",
|
||||
"registrationAllowed": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"accessTokenLifespan": 900,
|
||||
"ssoSessionIdleTimeout": 1800,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "dodossh-desktop",
|
||||
"name": "DodoSSH Desktop",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": true,
|
||||
"standardFlowEnabled": true,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"implicitFlowEnabled": false,
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256",
|
||||
"post.logout.redirect.uris": "http://127.0.0.1:*/*"
|
||||
},
|
||||
"redirectUris": [
|
||||
"http://127.0.0.1:*/callback",
|
||||
"http://localhost:*/callback"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"protocolMappers": [
|
||||
{
|
||||
"name": "dodossh-api-audience",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-audience-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"included.custom.audience": "dodossh-api",
|
||||
"access.token.claim": "true",
|
||||
"id.token.claim": "false"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
|
||||
"users": [
|
||||
{
|
||||
"username": "alice",
|
||||
"enabled": true,
|
||||
"emailVerified": true,
|
||||
"email": "alice@example.com",
|
||||
"firstName": "Alice",
|
||||
"lastName": "Example",
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "alice",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"username": "bob",
|
||||
"enabled": true,
|
||||
"emailVerified": true,
|
||||
"email": "bob@example.com",
|
||||
"firstName": "Bob",
|
||||
"lastName": "Example",
|
||||
"credentials": [
|
||||
{
|
||||
"type": "password",
|
||||
"value": "bob",
|
||||
"temporary": false
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user