config.example.toml

[server]
host = "0.0.0.0"
port = 7021
# Optional path to webui static files.
# webui_dir = "./webui"
# External base URL for generating absolute URLs such as OIDC callback URLs.
# "auto" (default) = infer from request headers at runtime:
#   Forwarded (RFC 7239) > X-Forwarded-Host/Proto > Host header > http://{host}:{port}
# Or set a fixed URL, for example:
# external_base_url = "https://auth.example.com"

# Remove the entire [oidc] section, or set OIDC_ENABLED=false, to disable OIDC
# and use dev-session login instead.
[oidc]
client_id = "your-client-id"
client_secret = "your-client-secret"
well_known_url = "https://your-oidc-provider.com/.well-known/openid-configuration"

# Optional direct endpoint overrides when well_known_url is not used, or when a
# discovered value should be overridden.
# issuer_url = "https://your-oidc-provider.com"
# jwks_uri = "https://your-oidc-provider.com/jwks"

[oidc_client]
scopes = ["openid", "profile", "email"]
# claims_check_script = "./claims-script-check.mts"
# pkce_enabled = true
# device_poll_interval = "5s"

# Optional direct endpoint overrides.
# authorization_endpoint = "https://your-oidc-provider.com/authorize"
# token_endpoint = "https://your-oidc-provider.com/token"
# userinfo_endpoint = "https://your-oidc-provider.com/userinfo"

# Optional pending OAuth store tuning.
# [oidc_client.pending_store]
# ttl = "5m"
# max_capacity = 1000

# When enabled, refresh tokens are sealed before leaving the server-side
# auth-context layer.
# [oidc_client.refresh_material_protection]
# kind = "sealed"
# master_key = "01234567890123456789012345678901"

# Pending metadata redemption store tuning.
# [oidc_client.metadata_delivery]
# kind = "redemption"
# ttl = "60s"
# max_capacity = 1000

# Post-auth redirect for backend OIDC mode. The current default is effectively
# open (`allowed_redirect_targets = [{ kind = "all" }]`), so tighten this in
# production.
# [oidc_client.post_auth_redirect]
# kind = "resolved"
# dynamic_redirect_target_enabled = true
# allowed_redirect_targets = [{ kind = "all" }]

# Optional backend-mode-only override layer.
# [backend_oidc_override]
# pkce_enabled = true

# Optional frontend-mode-only override layer.
[frontend_oidc_override]
unsafe_frontend_client_secret = "enabled"
# pkce_enabled = true


[session_context]
# cookie_name = "securitydept_session"
# session_context_key = "securitydept.session_context"
# cookie_path = "/"
# http_only = true
# secure = false            # set true for HTTPS deployments
# same_site = "lax"         # "strict", "lax", or "none"
# ttl = "1d"                # omit to disable expiry

[oauth_resource_server]
# audiences = ["api://securitydept"]
# required_scopes = ["entries.read"]

# Downstream bearer propagation policy.
# [oauth_resource_server.token_propagation]
# kind = "enabled"
# default_policy = "validate_then_forward"
#
# [oauth_resource_server.token_propagation.destination_policy]
# allowed_node_ids = ["registry-mirror-a"]
# allowed_targets = [
#   { kind = "exact_origin", scheme = "https", hostname = "service.internal.example.com", port = 443 },
#   { kind = "domain_suffix", scheme = "https", domain_suffix = "mesh.internal.example.com", port = 443 },
# ]
#
# Local same-server propagation smoke example used by the current webui
# token-set page:
# allowed_targets = [
#   { kind = "exact_origin", scheme = "http", hostname = "localhost", port = 7021 },
# ]
#
# [oauth_resource_server.token_propagation.token_validation]
# required_issuers = ["https://your-oidc-provider.com"]
# allowed_audiences = ["mesh-api"]
# required_scopes = ["mesh.forward"]
# allowed_azp = ["securitydept-web"]

[creds_manage]
data_path = "./data/data.json"

[basic_auth_context]
# This is the dashboard-management basic-auth config used for /basic/*
# and /basic/api/*, not the managed creds stored in creds_manage.
# realm = "securitydept"

# post_auth_redirect is NOT configurable in this deployment.
# The server always redirects to '/' (dashboard root) after basic auth login,
# ignoring any user-configured or query-param-supplied redirect targets.
# Configuring this has no effect and will emit a startup warning.

# Optional real-IP access restriction for dashboard basic-auth.
# When this section is set, [real_ip_resolve] must also be configured.
# [basic_auth_context.real_ip_access]
# allowed_cidrs = ["10.0.0.0/8", "192.168.0.0/16"]
# allow_fallback = false

[[basic_auth_context.users]]
# Generate this complete block with:
# securitydept-cli creds create-basic --interactive
username = "admin"
password_hash = "$argon2id$v=19$m=19456,t=2,p=1$replace$with$your$argon2$hash"

# Optional realm override for the basic-auth dashboard zone.
# [[basic_auth_context.zones]]
# realm = "securitydept"

# Optional real-IP resolution strategy. Required when
# basic_auth_context.real_ip_access is configured.
# [real_ip_resolve.fallback]
# strategy = "remote-addr"
#
# [[real_ip_resolve.nodes]]
# name = "edge-proxy"
# kind = "cidrs-inline"
# cidrs = ["10.0.0.0/24", "192.168.10.0/24"]
# accepts_from = ["edge-proxy"]
#
# [[real_ip_resolve.rules]]
# name = "edge-resolved"
# kind = "trusted-resolved-header"
# priority = 300
# headers = ["x-trusted-real-ip"]
# direct_peer_nodes = ["edge-proxy"]
#
# [[real_ip_resolve.rules]]
# name = "edge-xff"
# kind = "x-forwarded-for"
# priority = 200
# headers = ["x-forwarded-for"]
# direction = "right-to-left"
# direct_peer_nodes = ["edge-proxy"]
#
# [[real_ip_resolve.rules]]
# name = "edge-forwarded"
# kind = "forwarded"
# priority = 100
# headers = ["forwarded"]
# direction = "right-to-left"
# direct_peer_nodes = ["edge-proxy"]