kevinveenbirkenbachandClaude Opus 5.5 38902309f4 fix(web-app-pixelfed): send the OIDC token exchange through Tor on an onion issuer ...

On an onion deployment Pixelfed's server-side code-to-token exchange dials
the Keycloak .onion authority. libcurl refuses to resolve .onion names
(RFC 7686) before /etc/hosts or the SSO extra_hosts pin is consulted, so the
callback died with "cURL error 6: Not resolving .onion address" and both
OIDC login specs timed out (Pixelfed#0, compose, Tor, PR #869 run
37954856725).

Pixelfed builds its league/oauth2 GenericProvider without a proxy option,
so the proxy has to come from the environment. When the issuer is an onion,
env.j2 now sets http_proxy and https_proxy to the Tor socks5h endpoint,
with the object store host in no_proxy. Both Pixelfed services pin
host.docker.internal, the compose SOCKS endpoint, since the worker reads
the same env file. Clearnet deploys render no proxy.

Verified with a local compose deploy of variant 0 (SSO, seaweedfs, Tor): the
rendered token URL is an .onion authority, the env carries
socks5h://host.docker.internal:9050, and both pixelfed OIDC login specs pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-10 10:37:42 +02:00

..

main.yml

…