Merge pull request 'Fix oidc for authentik' (#258) from fix-oidc-for-authentik into main

Reviewed-on: #258
Reviewed-by: carla <carla@noreply.git.local-it.org>

README.md

@@ -45,7 +45,7 @@ Our philosophy: **software should help people spend less time on administration
 - 🚧 Sorting & filtering  
 - 🚧 Roles & permissions (e.g. board, treasurer)  
 - ✅ Custom fields (flexible per club needs)  
-- ✅ SSO via OIDC (tested with Rauthy)  
+- ✅ SSO via OIDC (works with Authentik, Rauthy, Keycloak, etc.)  
 - 🚧 Self-service & online application  
 - 🚧 Accessibility, GDPR, usability improvements  
 - 🚧 Email sending  
@@ -147,7 +147,26 @@ Mila uses OIDC for Single Sign-On. In development, a local **Rauthy** instance i
 5. copy client secret to `.env` file
 6. abort and run `just run` again
 
-Now you can log in to Mila via OIDC!  
+Now you can log in to Mila via OIDC!
+
+### OIDC with other providers (Authentik, Keycloak, etc.)
+
+Mila works with any OIDC-compliant provider. The internal strategy is named `:rauthy`, but this is just a name — it works with any provider.
+
+**Important:** The redirect URI must always end with `/auth/user/rauthy/callback`.
+
+Example for Authentik:
+1. Create an OAuth2/OpenID Provider in Authentik
+2. Set the redirect URI to: `https://your-domain.com/auth/user/rauthy/callback`
+3. Configure environment variables:
+   ```bash
+   DOMAIN=your-domain.com                    # or PHX_HOST=your-domain.com
+   OIDC_CLIENT_ID=your-client-id
+   OIDC_BASE_URL=https://auth.example.com/application/o/your-app
+   OIDC_CLIENT_SECRET=your-client-secret     # or use OIDC_CLIENT_SECRET_FILE
+   ```
+
+The `OIDC_REDIRECT_URI` is auto-generated as `https://{DOMAIN}/auth/user/rauthy/callback` if not explicitly set.  
 
 ## ⚙️ Configuration
 
@@ -210,13 +229,13 @@ For testing the production Docker build locally:
    # Required variables:
    SECRET_KEY_BASE=<your-generated-secret>
    TOKEN_SIGNING_SECRET=<your-generated-secret>
-   PHX_HOST=localhost
+   DOMAIN=localhost                          # or PHX_HOST=localhost
    
-   # Optional (have defaults in docker-compose.prod.yml):
+   # Optional OIDC configuration:
    # OIDC_CLIENT_ID=mv
    # OIDC_BASE_URL=http://localhost:8080/auth/v1
-   # OIDC_REDIRECT_URI=http://localhost:4001/auth/user/rauthy/callback
-   # OIDC_CLIENT_SECRET=<from-rauthy-client>
+   # OIDC_CLIENT_SECRET=<from-your-oidc-provider>
+   # OIDC_REDIRECT_URI is auto-generated as https://{DOMAIN}/auth/user/rauthy/callback
    
    # Alternative: Use _FILE variables for Docker secrets (takes priority over regular vars):
    # SECRET_KEY_BASE_FILE=/run/secrets/secret_key_base

config/runtime.exs

@@ -112,12 +112,21 @@ if config_env() == :prod do
     You can generate one by calling: mix phx.gen.secret
     """)
 
-  host = System.get_env("PHX_HOST") || raise "Please define the PHX_HOST environment variable."
+  # PHX_HOST or DOMAIN can be used to set the host for the application.
+  # DOMAIN is commonly used in deployment environments (e.g., Portainer templates).
+  host =
+    System.get_env("PHX_HOST") ||
+      System.get_env("DOMAIN") ||
+      raise "Please define the PHX_HOST or DOMAIN environment variable."
+
   port = String.to_integer(System.get_env("PORT") || "4000")
 
   config :mv, :dns_cluster_query, System.get_env("DNS_CLUSTER_QUERY")
 
-  # Rauthy OIDC configuration
+  # OIDC configuration (works with any OIDC provider: Authentik, Rauthy, Keycloak, etc.)
+  # Note: The strategy is named :rauthy internally, but works with any OIDC provider.
+  # The redirect_uri callback path is always /auth/user/rauthy/callback regardless of provider.
+  #
   # Supports OIDC_CLIENT_SECRET or OIDC_CLIENT_SECRET_FILE for Docker secrets.
   # OIDC_CLIENT_SECRET is required only if OIDC is being used (indicated by explicit OIDC env vars).
   oidc_base_url = System.get_env("OIDC_BASE_URL")
@@ -134,12 +143,15 @@ if config_env() == :prod do
       get_env_or_file.("OIDC_CLIENT_SECRET", nil)
     end
 
+  # Build redirect_uri: use OIDC_REDIRECT_URI if set, otherwise build from host.
+  # Uses HTTPS since production runs behind TLS termination.
+  default_redirect_uri = "https://#{host}/auth/user/rauthy/callback"
+
   config :mv, :rauthy,
     client_id: oidc_client_id || "mv",
     base_url: oidc_base_url || "http://localhost:8080/auth/v1",
     client_secret: client_secret,
-    redirect_uri:
-      System.get_env("OIDC_REDIRECT_URI") || "http://#{host}:#{port}/auth/user/rauthy/callback"
+    redirect_uri: System.get_env("OIDC_REDIRECT_URI") || default_redirect_uri
 
   # Token signing secret from environment variable
   # This overrides the placeholder value set in prod.exs