docs: document using Gitea as the OAuth issuer #70

Merged

Latte merged 1 commits from docs/gitea-oauth-issuer into dev 2026-07-12 15:57:06 +00:00

Conversation 0 Commits 1 Files Changed 3

+32 -1

Ghost commented 2026-07-12 15:52:44 +00:00

Copy link

Copy source

familiar is issuer-agnostic (OAuth resource server only), so Gitea can back oauth mode with config alone — no code change.

Changes

• doc/deployment.md — new "Using Gitea as the OAuth issuer" section: RS256 JWTs, JWKS at /login/oauth/keys, OIDC discovery, the env config, the aud=client-ID audience pitfall, and the no-DCR caveat. The oauth-mode bullet now lists Gitea alongside Authentik/Keycloak.
• .env.example — Gitea example block under the OAuth section, with the audience/DCR notes as comments.
• doc/clients/claude-web.md — explicit note that Gitea can't back the claude.ai web connector (which requires Dynamic Client Registration).

Notes for whoever enables it

• Audience: Gitea puts the OAuth app's client ID in the token aud (not the resource URL) → set FAMILIAR_OAUTH_AUDIENCE to the client ID; verify by decoding a real token.
• Signing algorithm: must stay asymmetric (RS256 default) for JWKS verification; HS* won't work.

Docs-only; no code paths touched.

familiar is issuer-agnostic (OAuth resource server only), so Gitea can back `oauth` mode with config alone — no code change. ## Changes - **`doc/deployment.md`** — new *"Using Gitea as the OAuth issuer"* section: RS256 JWTs, JWKS at `/login/oauth/keys`, OIDC discovery, the env config, the `aud`=client-ID audience pitfall, and the no-DCR caveat. The oauth-mode bullet now lists Gitea alongside Authentik/Keycloak. - **`.env.example`** — Gitea example block under the OAuth section, with the audience/DCR notes as comments. - **`doc/clients/claude-web.md`** — explicit note that Gitea can't back the claude.ai web connector (which requires Dynamic Client Registration). ## Notes for whoever enables it - **Audience:** Gitea puts the OAuth app's client ID in the token `aud` (not the resource URL) → set `FAMILIAR_OAUTH_AUDIENCE` to the client ID; verify by decoding a real token. - **Signing algorithm:** must stay asymmetric (RS256 default) for JWKS verification; `HS*` won't work. Docs-only; no code paths touched.

Ghost added 1 commit 2026-07-12 15:52:45 +00:00

docs: document using Gitea as the OAuth issuer ... 6b9c550d10

familiar is issuer-agnostic (resource server only), so Gitea can back
oauth mode with config alone: RS256 JWTs, JWKS at /login/oauth/keys, and
OIDC discovery. Add a deployment.md section covering the env config, the
aud=client-ID audience pitfall, and the no-DCR caveat; add a Gitea block
to .env.example; and note in claude-web.md that Gitea can't back the
claude.ai web connector (which requires DCR).

Latte merged commit 30036799dc into dev 2026-07-12 15:57:06 +00:00

Latte deleted branch docs/gitea-oauth-issuer 2026-07-12 15:57:07 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

epic

High-level tracking issue spanning a roadmap phase

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Barback Bot Bartender Doorman Bot Latte (Latte) mixologist Bot Sommelier Bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Hiddenden/familiar#70