mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
d4e2554ca4
* Add a BTCPay Server SSO harness to the docker fixture
BTCPay bundles RTL and runs it in single-sign-on mode, reached over an entry
path the standalone login never exercises: no password, a rotating cookie file,
an unregistered /rtl/api/authenticate/cookie URL that falls through to the
catch-all in server/utils/app.ts, and a reverse proxy in front. Regressions on
that path have previously gone unnoticed until they reached BTCPay users.
Adds an "sso" compose profile, so a plain `docker compose up -d` is unchanged:
- rtl-sso, a second RTL running with RTL_SSO=1, RTL_COOKIE_PATH and
LOGOUT_REDIRECT_LINK -- the environment block lifted verbatim from BTCPay's
own compose fragment, so this exercises the env-driven SSO path BTCPay
actually uses. A second container is required because RTL selects one
authentication mode at startup, so SSO and password login cannot coexist in
one instance.
- rtl-sso-config-init, staging rtl/RTL-Config.sso.json into a volume -- the
same copy-into-a-volume dance the standalone RTL already needs, because RTL
rewrites its config on startup.
- rtl-sso-proxy, nginx standing in for BTCPay's traefik, routing only /rtl
and /rtl/* exactly as BTCPay's router rule does. There is no prefix
stripping anywhere: RTL is built with <base href="/rtl/"> and mounts every
route under baseHref '/rtl', so the prefix is passed through unmodified.
Everything outside /rtl 404s, so a request escaping the prefix surfaces as
a failure rather than being quietly served.
scripts/verify-sso.sh asserts the whole flow in 11 checks -- prefix routing,
CSRF token minting on the catch-all, the sha256 access-key handshake, an
authenticated node call, cookie rotation on login, and rejection of a wrong key
-- and exits non-zero so it can gate a change. bin/sso-url prints the link
BTCPay renders on its Services page. RTL_IMAGE overrides both RTL containers at
once, so a branch build gets tested through both entry paths.
BTCPay itself (postgres, nbxplorer, btcpayserver) is deliberately not included;
the README documents what that leaves untested and how to run against BTCPay's
own regtest stack when the question is BTCPay's behaviour rather than RTL's.
Also bumps the fixture's default RTL image from v0.15.8 to v0.15.10.
* Document the SSO harness in the rtl-docker-fixture skill
* Point CLAUDE.md at the BTCPay SSO harness
* Note that no CI runs on an open PR
46 lines
1.8 KiB
Text
46 lines
1.8 KiB
Text
# Reverse proxy in front of RTL running in BTCPay Server's single-sign-on mode.
|
|
#
|
|
# Stands in for the traefik instance BTCPay puts in front of its bundled RTL.
|
|
# The location regex mirrors the router rule BTCPay labels that container with:
|
|
#
|
|
# Host(`${BTCPAY_HOST}`) && (Path(`/rtl`) || PathPrefix(`/rtl/`))
|
|
#
|
|
# so only /rtl and /rtl/* are proxied and everything else 404s here. That
|
|
# strictness is deliberate: RTL is built with <base href="/rtl/"> (angular.json)
|
|
# and mounts every route under baseHref '/rtl' (server/utils/common.ts), so a
|
|
# request that escapes the prefix is a bug the harness should surface rather
|
|
# than quietly serve.
|
|
#
|
|
# The prefix is passed through unmodified -- there is no strip-prefix step to
|
|
# get wrong, because RTL expects to see it. proxy_pass without a URI part
|
|
# preserves the original request URI.
|
|
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
location ~ ^/rtl(/|$) {
|
|
proxy_pass http://rtl-sso:3000;
|
|
|
|
# RTL runs with Express 'trust proxy' enabled, so these are what it sees
|
|
# as the client address in its logs and rate limiting.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# RTL's websocket lives at /rtl/api/ws and stays open for the life of the
|
|
# session. Without the upgrade headers it fails the handshake and the UI
|
|
# silently stops receiving live updates; without the long read timeout
|
|
# nginx drops it after 60s.
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
proxy_read_timeout 3600s;
|
|
}
|
|
}
|