echolot

EchoLot/echolot

Fork 0

Files

T

History

mrambossekandClaude Fable 5 c7750fbf0b

server-release / image (push) Successful in 15s

Details

server-test / test (push) Successful in 34s

Details

server-release / release (push) Successful in 35s

Details

oidc: one verifier per issuer, because IdPs mint one per application

Authentik derives the issuer from the application slug, so two applications mean
two issuers - and a token's `iss` must match whoever signed it. A single pinned
issuer could therefore only ever serve one of the two clients.

So there is a verifier per issuer, and each accepts only the client belonging to
it. That is tighter than the previous arrangement as well as more general: a
token minted for the phone cannot be replayed at the admin login, and vice
versa, because they arrive at different verifiers with different audiences.

ECHOLOT_OIDC_APP_ISSUER is optional - empty means both clients share
ECHOLOT_OIDC_ISSUER, which is what IdPs with one global issuer do.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-01 18:47:34 +02:00

acmehttp

acme: answer HTTP-01 from the server itself, on port 80

2026-08-01 18:16:09 +02:00

adminauth

adminauth: a break-glass local admin alongside OIDC

2026-08-01 17:12:54 +02:00

canarydns

server: send granted traffic from the address the session actually used

2026-08-01 10:45:43 +02:00

certreload

admin: terminate TLS in the binary, with a certificate that reloads itself