Caddy module to require at-proto authentication and restrict routes to DIDs
1{
2 admin off
3 atproto {
4 storage_path ./e2e.db
5 cookie_secret "testing-secret-must-be-at-least-32-bytes-long"
6 }
7}
8
9# --- Scenario 1: Standalone App ---
10# Acts as its own portal.
11http://localhost:8081 {
12 route {
13 atproto_gate {
14 # Standalone mode enabled by setting 'domain'
15 domain localhost:8081
16 allow @vvill.dev
17 }
18
19 # Protected content
20 respond "Welcome to Standalone App! You are authenticated."
21 }
22}
23
24# --- Scenario 2: Centralized Auth Hub ---
25
26# The Portal (Identity Provider)
27http://localhost:8082 {
28 route {
29 atproto_portal {
30 domain localhost:8082
31 name "Local E2E Hub"
32 }
33 }
34}
35
36# The Service (Relying Party)
37# Redirects users to port 8082 for login
38http://localhost:8083 {
39 route {
40 atproto_gate {
41 # Auth Hub mode (no 'domain' set)
42 portal_url http://localhost:8082
43 allow @vvill.dev
44 }
45
46 respond "Welcome to Service App! You authenticated via the Hub."
47 }
48}