Claude
d4c734737b
Replace the ALLOWED_USER_IDS sub-allowlist with a Zitadel project role check: tokens must carry the role from REQUIRED_ROLE (default "user") in the urn:zitadel:iam:org:project[:id]:roles claim. Roles are granted per account in Zitadel (project ClaudeDo), where access is now managed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
944 B
Plaintext
23 lines
944 B
Plaintext
# --- Server (API) ---
|
|
# Shared Postgres. Internal Docker host within Coolify network, or SSH-tunnel locally.
|
|
DATABASE_URL=postgres://mika:CHANGEME@l8kogcggsc80sgcgk8kswww4:5432/claudedo
|
|
|
|
# Zitadel OIDC
|
|
ZITADEL_ISSUER=https://auth.kuns.dev
|
|
# Comma-separated accepted audiences: web client id, desktop client id, project id
|
|
ZITADEL_AUDIENCE=
|
|
# Zitadel project role required for API access (default: user)
|
|
REQUIRED_ROLE=user
|
|
# CORS: the web client origin (the app's own origin)
|
|
WEB_ORIGIN=https://claudedo.kuns.dev
|
|
|
|
# --- Web client (public, exposed to browser) ---
|
|
NUXT_PUBLIC_ZITADEL_ISSUER=https://auth.kuns.dev
|
|
NUXT_PUBLIC_ZITADEL_CLIENT_ID=
|
|
# Zitadel project id — adds the project-audience scope at login so the API can validate `aud`
|
|
NUXT_PUBLIC_ZITADEL_PROJECT_ID=
|
|
|
|
# --- Provisioning script only (not needed at runtime) ---
|
|
# Zitadel Management API PAT (from ~/.secrets/coolify-tokens.env: ZITADEL_SERVICE_TOKEN)
|
|
ZITADEL_SERVICE_TOKEN=
|