techy/Media-Server-Setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Logout ends the Authentik session: copyparty idp-logout -> outpost sign_out; live portal Sign out link

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Brandyn / Techy
2026-10-31 15:11:53 -05:00
parent 268a6a2f81
commit 2a74cb7b40
4 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -239,6 +239,8 @@ Design: **Authentik authenticates once for the whole domain; Caddy authorizes pe
the matching access on next login; removing it removes it. the matching access on next login; removing it removes it.
copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`, copyparty additionally requires a header with a secret name that only Caddy adds (`idp-h-key`,
`COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly. `COPYPARTY_IDP_KEY` in `.env`), so identity headers cannot be forged even if copyparty were reached directly.
Logout: copyparty's logout link and the live portal's "Sign out" go to `/outpost.goauthentik.io/sign_out`,
which ends the Authentik session (a local app logout alone would be undone on the next request).
5. Debug: `https://HOST/whoami` prints the username/groups headers exactly as the apps receive them. 5. Debug: `https://HOST/whoami` prints the username/groups headers exactly as the apps receive them.
Group changes in Authentik apply on the next login — log out at `https://auth.HOST/` and back in. Group changes in Authentik apply on the next login — log out at `https://auth.HOST/` and back in.
6. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless 6. Test in a private window: `https://live.HOST/` → Discord login → portal; `https://bot.HOST/` → 403 unless

1
configure.py
View File

@@ -398,6 +398,7 @@ def write_copyparty():
idp-h-usr: X-Authentik-Username idp-h-usr: X-Authentik-Username
idp-h-grp: X-Authentik-Groups idp-h-grp: X-Authentik-Groups
idp-h-key: X-Vanguard-{key} # header Caddy inserts on every request; IdP headers are ignored without it idp-h-key: X-Vanguard-{key} # header Caddy inserts on every request; IdP headers are ignored without it
idp-logout: /outpost.goauthentik.io/sign_out # copyparty's logout link ends the Authentik session (not just its own cookie)
no-robots no-robots
name: vanguard name: vanguard

1
live/src/App.jsx
View File

@@ -59,6 +59,7 @@ export default function App() {
<button onClick={() => audio.muteAll()} title="mute every window until you click one">Mute all</button> <button onClick={() => audio.muteAll()} title="mute every window until you click one">Mute all</button>
<button onClick={() => audio.followFocus()} title="clear pinned audio; only the focused window plays sound">Follow focus</button> <button onClick={() => audio.followFocus()} title="clear pinned audio; only the focused window plays sound">Follow focus</button>
<button className="golive-btn" onClick={() => { audio.muteAll(); apiRef.current = null; setMode('golive') }} title="stop watching and broadcast a window from this browser">Go Live</button> <button className="golive-btn" onClick={() => { audio.muteAll(); apiRef.current = null; setMode('golive') }} title="stop watching and broadcast a window from this browser">Go Live</button>
<a className="signout" href="/outpost.goauthentik.io/sign_out" title="sign out of Discord login for all Vanguard sites">Sign out</a>
</div> </div>
{mode === 'golive' ? ( {mode === 'golive' ? (
<GoLive onExit={() => { audio.followFocus(); setMode('watch') }} /> <GoLive onExit={() => { audio.followFocus(); setMode('watch') }} />

2
live/src/styles.css
View File

@@ -56,3 +56,5 @@ html, body, #root { height:100%; margin:0; background:var(--bg); color:var(--fg)
.golive-form .warn-box { background:#3a2a10; border:1px solid #f1c40f; color:#ffe9a8; border-radius:8px; padding:10px 12px; font-size:13px; line-height:1.5; } .golive-form .warn-box { background:#3a2a10; border:1px solid #f1c40f; color:#ffe9a8; border-radius:8px; padding:10px 12px; font-size:13px; line-height:1.5; }
.golive-form .warn-box b { color:#fff; } .golive-form .warn-box b { color:#fff; }
.golive-stats .rec { background:#f1c40f; color:#000; font-weight:700; font-size:11px; padding:2px 6px; border-radius:4px; } .golive-stats .rec { background:#f1c40f; color:#000; font-weight:700; font-size:11px; padding:2px 6px; border-radius:4px; }
.topbar a.signout { color:var(--mut); font-size:13px; text-decoration:none; border:1px solid #3a3a3a; border-radius:6px; padding:5px 10px; }
.topbar a.signout:hover { color:var(--fg); border-color:#666; }