mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
c215aca058
Run 34421944328 Nextcloud#1 timed out "waiting for a signed-in Nextcloud
shell after the login redirect". 4164f37981 turned sso on in variant 1
while ldap stays off there, so that round logs in through sociallogin
instead of oidc_login - the first variant, on this branch or on main,
that runs sociallogin against an onion issuer. oidc_login goes through
Nextcloud's HTTP client, which honours the proxy in proxy.config.php;
sociallogin builds its own client and reads only
social_login_http_client['proxy'], so its token exchange never reached
the onion Keycloak. The template now sets the same tor SOCKS proxy for
it, inside the existing "sso on and the OIDC host is an onion" branch.
The spec only treated 5xx documents as a page failure, so a refused
callback surfaced as a 60s (x5 over tor) wait for a shell that could not
come. A 4xx on /apps/sociallogin/ or /apps/oidc_login/ now counts as
the page itself failing, reported without the query so no code leaks.
The plugin loop printed every item, including the OIDC client secret,
into the include line of a public CI log; it now labels by plugin key and
honours MASK_CREDENTIALS_IN_LOGS.
_shared.js grew past 250 lines; its page and modal helpers move to
_page.js and _shared.js re-exports them, with an identical export
surface.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
17 lines
393 B
Django/Jinja
17 lines
393 B
Django/Jinja
<?php
|
|
{% if NEXTCLOUD_SSO_ENABLED and (NEXTCLOUD_OIDC_HOST is search('\.onion$')) %}
|
|
return [
|
|
'proxy' => '{{ NEXTCLOUD_TOR_SOCKS_PROXY }}',
|
|
'proxyexclude' => [
|
|
{% for host in NEXTCLOUD_PROXY_EXCLUDED_HOSTS %}
|
|
'{{ host }}',
|
|
{% endfor %}
|
|
],
|
|
'social_login_http_client' => [
|
|
'proxy' => '{{ NEXTCLOUD_TOR_SOCKS_PROXY }}',
|
|
],
|
|
];
|
|
{% else %}
|
|
return [];
|
|
{% endif %}
|