35 lines
2.0 KiB
Markdown
35 lines
2.0 KiB
Markdown
# 20260706 cnnetmkt auth primary route fix
|
|
|
|
## Problem
|
|
|
|
`https://cnnetmkt.top/` could be opened, but login redirected users to `https://auth.h.imruyi.top:8443`. Casdoor then rejected the OAuth request because `https://cnnetmkt.top/casdoor/callback/` was not in the application allow-list.
|
|
|
|
`*.h.imruyi.top:8443` is retained as a backup domain only and must not be exposed as the primary public login URL.
|
|
|
|
## Runtime Changes
|
|
|
|
- Added `auth.cnnetmkt.top` Nginx server block on `hw.imruyi.top` using the wildcard `cnnetmkt.top` certificate.
|
|
- Proxied `auth.cnnetmkt.top` to the existing backup/home Casdoor upstream `auth.h.imruyi.top:8443` while preserving the public host as `auth.cnnetmkt.top`.
|
|
- Recreated `user-control-web`, `user-control-worker`, and `user-control-beat` with:
|
|
- `CASDOOR_PUBLIC_BASE_URL=https://auth.cnnetmkt.top`
|
|
- `CASDOOR_INTERNAL_BASE_URL=https://auth.cnnetmkt.top`
|
|
- `CASDOOR_INVITE_SYNC_BASE_URL=https://auth.cnnetmkt.top`
|
|
- `UCC_PUBLIC_BASE_URL=https://cnnetmkt.top`
|
|
- Updated Casdoor application `admin/aios-portal` on `aihost` to include `https://cnnetmkt.top/casdoor/callback/` and keep user/portal/backup callbacks.
|
|
|
|
## Backups
|
|
|
|
- Casdoor DB application table backup: `/data/aios/backups/casdoor-cnnetmkt-primary-20260706T085445Z/application-before.sql`
|
|
- HW UCC/Nginx backup directory: `/data/aios-gitops/backups/auth-cnnetmkt-primary-*`
|
|
|
|
## Verification
|
|
|
|
- `https://cnnetmkt.top/` redirects to `/portal/login/` and then to `https://auth.cnnetmkt.top/login/oauth/authorize?...redirect_uri=https%3A%2F%2Fcnnetmkt.top%2Fcasdoor%2Fcallback%2F...`.
|
|
- `https://auth.cnnetmkt.top/login/oauth/authorize?...` returns HTTP 200 from the Casdoor SPA through the HW Nginx proxy.
|
|
- `user-control-web` health returned `healthy` after recreation.
|
|
- Casdoor DB readback contains `https://cnnetmkt.top/casdoor/callback/` in `application.redirect_uris`.
|
|
|
|
## Follow-up
|
|
|
|
Run `ops/gitops-migration/check_cnnetmkt_auth_primary.sh` after any domain, Nginx, or Casdoor application change.
|