coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement KeyCape provider and service identity contracts
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 25s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
This commit is contained in:
tegwick 2026-08-23 13:10:13 +02:00
parent cdfb046b80
commit efce3e9331
15 changed files with 579 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -95,6 +95,14 @@ clients:
Config is validated at startup — the server exits 1 with validation errors if config is invalid.
Confidential `client_credentials` registrations may set a per-client
`tokenLifetime` from 1 minute through 1 hour. This overrides the server default
for that client and lets machine-login consumers carry an explicit maximum TTL.
See `config/service-clients.example.yaml` and
`docs/openbao-service-auth-contract.md` for the non-secret OpenBao service
identity contracts. Client secret values remain outside Git and are resolved
only from the registered `env:` reference at startup.
`browserBaseURL` is used only for the human browser redirect to Authelia.
`tokenBaseURL` is used for server-side code exchange. If either is omitted,
KeyCape falls back to `baseURL`.