docs(auth): document local OIDC and Authentik operation

2026-08-18 03:07:33 +02:00
parent 6ec5b76c54
commit f4f38717e1
17 changed files with 407 additions and 0 deletions
@@ -4,6 +4,10 @@ This example assumes Nginx runs on the Linux host, ThothII `frontend` listens on
 `127.0.0.1:8080`, and a separate authentication gateway validates the user's real login/session.
 Replace the documentation domain, certificate paths, and auth-gateway address.

+For ThothII-managed generic OIDC, preserve the configured public origin and the exact callback
+`/api/auth/oidc/callback`; the browser and API remain one same-origin surface. Run
+`tht auth check` and workspace Test after proxy changes.
+
 ## Trust boundary

 Nginx is the only public listener. It terminates TLS, performs an `auth_request`, and proxies only