mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-10-09 18:28:10 +02:00

Files

Kevin Veen-Birkenbach aa19a97ed6 CORS/CSP hardening & centralization

- Add reusable Nginx include: roles/sys-svc-proxy/templates/headers/access_control_allow.conf.j2
  (dynamic ACAO/credentials/methods/headers via role vars)
- Set global 'Vary: Origin' in nginx.conf.j2 to prevent cache poisoning
- CSP: allow Simple Icons via connect-src when feature is enabled
- Front proxy: rename vars to lowercase + flush handlers after config deploy
- Desktop: gate & load Simple Icons role; inject brand logos when enabled
- Bluesky + Logout: replace inline CORS with centralized include
- Simpleicons: public CORS (ACAO='*', no credentials), keep GET/OPTIONS, allow headers
- Taiga: adjust canonical domain to taiga.kanban.{{ PRIMARY_DOMAIN }}
- LibreTranslate: remove unused images/versions keys

Fixes: https://open.project.infinito.nexus/projects/cymais/work_packages/342/activity
Discussion: https://chatgpt.com/share/68da5e27-ffd4-800f-91a3-0ef103058d44

2025-09-29 12:23:58 +02:00

config

web: general domain cleanup (canonical/aliases normalization)

2025-09-19 14:51:56 +02:00

filter_plugins

Restructured server config

2025-08-07 11:31:06 +02:00

README.md

web-svc-logout

This folder contains an Ansible role to deploy and configure the Universal Logout Service.

Description

This role sets up the universal logout proxy service, a Dockerized Python Flask container that coordinates logout requests across multiple OIDC-integrated applications. It also configures the necessary Nginx proxy snippets and environment variables to enable unified logout flows.

It solves the common challenge of logging a user out from all connected apps with a single action, especially in environments where apps live on multiple subdomains and use OIDC authentication.

Overview

Deploys the universal logout service container based on the official universal-logout GitHub repository.
Configures the logout domains dynamically based on application inventory and features using custom Ansible filters.
Provides an Nginx /logout proxy configuration snippet that handles CORS and forwards logout requests to the logout service.
Supplies a user-friendly logout conductor UI that requests logout on all configured domains and shows live status.
Designed to be used as the Front Channel Logout URL for Keycloak or other OpenID Connect providers, enabling a seamless, service-spanning logout experience.

Features

Automatic discovery of logout domains from applications with the features.logout flag enabled.
Centralized logout proxy that clears cookies and sessions across all configured subdomains.
Status page with live feedback on logout progress for each domain.
Built-in support for Docker Compose deployment and integration with the Infinito.Nexus ecosystem.
Includes security-conscious headers (CORS, CSP) for smooth cross-domain logout operations.

Further Resources

This role is licensed under the Infinito.Nexus NonCommercial License.