docs(auth): document local OIDC and Authentik operation

2026-08-18 03:07:33 +02:00
parent 6ec5b76c54
commit f4f38717e1
17 changed files with 407 additions and 0 deletions
@@ -4,6 +4,10 @@ This example assumes Caddy runs on the Linux host, ThothII `frontend` listens on
 `127.0.0.1:8080`, public DNS points to the host, and a separate authentication gateway validates
 the user's real login/session. Replace the domain and auth-gateway address.

+For ThothII-managed generic OIDC, preserve the configured public origin and the exact callback
+`/api/auth/oidc/callback`; the browser and API remain one same-origin surface. Run
+`tht auth check` and workspace Test after proxy changes.
+
 ## Trust boundary

 Caddy is the only public listener. It provides automatic HTTPS, performs `forward_auth`, and