Read OIDC_RP_CLIENT_ID from a secret file #15

Merged

Gilles merged 1 commit from fix/oidc-client-id-secret into master

2026-10-25 17:12:15 +00:00

Gilles commented

2026-10-25 16:56:33 +00:00

Owner

Closes #14

OIDC_RP_CLIENT_ID goes through _secret(), so OIDC_RP_CLIENT_ID_FILE works (plain OIDC_RP_CLIENT_ID still does).
deploy/docker-compose.yml: OIDC_RP_CLIENT_ID_FILE: /run/secrets/thierryadeOidcClientId + the thierryadeOidcClientId secret, instead of the hardcoded empty value.
deploy/README.md: SSO section rewritten (the Authentik app exists; both files to fill, what an empty client ID file means).

Checked locally: with the file set, HAS_OIDC is true and /oidc/authenticate/ resolves. 103 tests, pylint 10/10.

Server steps, after the merge (the compose references a new secret file)

cd /srv/docker/thierryade
printf '%s' '<client id>' > secrets/thierryadeOidcClientId && chmod 644 secrets/thierryadeOidcClientId
# then copy the new deploy/docker-compose.yml here
docker compose up -d

Merging alone changes nothing in prod: the deploy job uses the server's compose file, which still has the empty OIDC_RP_CLIENT_ID.

🤖 Generated with Claude Code

https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Closes #14 - `OIDC_RP_CLIENT_ID` goes through `_secret()`, so `OIDC_RP_CLIENT_ID_FILE` works (plain `OIDC_RP_CLIENT_ID` still does). - `deploy/docker-compose.yml`: `OIDC_RP_CLIENT_ID_FILE: /run/secrets/thierryadeOidcClientId` + the `thierryadeOidcClientId` secret, instead of the hardcoded empty value. - `deploy/README.md`: SSO section rewritten (the Authentik app exists; both files to fill, what an empty client ID file means). Checked locally: with the file set, `HAS_OIDC` is true and `/oidc/authenticate/` resolves. 103 tests, pylint 10/10. ## Server steps, after the merge (the compose references a new secret file) ```bash cd /srv/docker/thierryade printf '%s' '<client id>' > secrets/thierryadeOidcClientId && chmod 644 secrets/thierryadeOidcClientId # then copy the new deploy/docker-compose.yml here docker compose up -d ``` Merging alone changes nothing in prod: the deploy job uses the server's compose file, which still has the empty `OIDC_RP_CLIENT_ID`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Gilles added 1 commit

2026-10-25 16:56:33 +00:00

Read OIDC_RP_CLIENT_ID from a secret file

ci / test (pull_request) Successful in 2m1s

Details

ci / e2e (pull_request) Has been skipped

Details

ci / docker (pull_request) Has been skipped

Details

ci / deploy (pull_request) Has been skipped

Details

b1f78f33f4

Hardcoded (empty) in deploy/docker-compose.yml, the real client ID only
lived in the server's copy and was lost when that file was copied over
for #9, unmounting /oidc/. It now goes through _secret() like the other
settings: OIDC_RP_CLIENT_ID_FILE -> secrets/thierryadeOidcClientId.

Closes #14

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA