Debian 3a707e2e3f feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91 ...

SSO per OpenID Connect (Authorization Code + PKCE) zusätzlich zum lokalen Login.
- Regeln: kein Auto-Provisioning (E-Mail muss als User existieren), Rolle aus DB (nie aus Token), lokaler Login+TOTP unangetastet.
- Migration 0040: oidc_settings (Singleton, client_secret_enc via secrets.Box) + users.oidc_subject.
- internal/services/oidc: Settings-Repo (write-only Secret) + lazy go-oidc Client (testbarer Authenticator-Seam).
- internal/handlers/oidc.go: GET/PUT /oidc/settings (admin), GET /auth/oidc/{settings,login,callback}. Flow-State (state/PKCE/nonce) stateless im 5-min signierten HttpOnly-Cookie (SameSite=Lax). email_verified erzwungen, opportunistisches sub-Linking, Session via setSessionCookie+Signer.
- session.SignBlob/VerifyBlob; users.Get/SetOIDCSubject; main.go-Wiring.
- Frontend: App.tsx /auth/me-Bootstrap (für Cookie-Session nach Callback), Login-SSO-Button + sso_error, Settings OIDC-Card, i18n de/en.
- Tests (guarded EG_FWTEST_DSN): Secret-Roundtrip + Callback (Rolle-aus-DB, no_account, disabled, unverified, nonce, state).
Deps: go-oidc/v3, x/oauth2. Scope v1: nur Login (kein SLO/Refresh).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-05 16:04:13 +02:00

..

0001_init.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0002_cluster.sql

fix(cluster): ha_nodes INET-Spalten → TEXT — pgx-Scan-Fehler OID 869

2026-05-29 15:41:20 +02:00

0003_http_frontend.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0004_forward_proxy.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0005_wireguard.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0006_firewall.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0007_dns.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0008_licenses.sql

feat(db): Phase 1 — DB-Schema, goose-Migrations, GORM-Models

2026-05-08 23:44:44 +02:00

0009_networks.sql

feat: Network/IP-Verwaltung + Mailguard-Design-Übernahme

2026-05-09 16:08:44 +02:00

0010_firewall_v2.sql

feat(fw): Migration 0010 — Firewall-v2-Schema (Fortigate-Style)

2026-05-09 23:52:01 +02:00

0011_network_members.sql

feat: Networks-Members für bridge/bond + System-Rules-Card + Theme-Revert

2026-05-10 16:19:07 +02:00

0012_firewall_zones.sql

feat: Zonen als first-class Entity + Domain↔Backend-Verknüpfung sichtbar

2026-05-10 18:05:27 +02:00

0013_wireguard.sql

feat: WireGuard (server + client + peers + QR) + shared UI components

2026-05-10 20:51:25 +02:00

0014_dns_forward_targets.sql

feat: Unbound DNS-Resolver — vollständig (Renderer + Handler + UI)

2026-05-11 06:24:51 +02:00

0015_ntp.sql

feat: NTP-Server (Chrony) — vollständig

2026-05-11 06:58:54 +02:00

0016_backend_servers.sql

feat(backends): Pool-Modell — Backend = Pool, N Server pro Backend

2026-05-11 20:55:47 +02:00

0017_backend_websocket.sql

feat(backends): WebSocket-Toggle pro Backend

2026-05-11 21:51:09 +02:00

0018_backups.sql

feat(backup): pg_dump + state-tarball + daily auto + UI

2026-05-12 23:08:18 +02:00

0019_static_routes.sql

feat(routes): Static-Routes-Management + Live-View (Networks-Tab)

2026-05-12 23:50:26 +02:00

0020_ha_nodes_ext.sql

fix(cluster): ha_nodes INET-Spalten → TEXT — pgx-Scan-Fehler OID 869

2026-05-29 15:41:20 +02:00

0021_alerts.sql

feat(alerts): Health-Alarme via Webhook + Email-SMTP

2026-05-13 15:57:05 +02:00

0022_backup_remotes.sql

feat(backup): Off-Site-Upload nach S3 + SFTP

2026-05-13 18:49:02 +02:00

0023_domains_settings.sql

feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

2026-05-19 16:18:41 +02:00

0024_domain_headers_ratelimit.sql

feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

2026-05-19 16:18:41 +02:00

0025_join_tokens_used.sql

feat: umfangreiches UI+API-Polish (v1.1.36–1.1.42)

2026-05-19 16:18:41 +02:00

0026_wg_client_routes.sql

feat(wg): Push-Routes (Client-Routes) für WireGuard-Server-Interfaces

2026-05-21 13:09:51 +02:00

0027_http_protocol_flags.sql

feat(backends+domains): HTTP-Protokoll-Flags — force_http1 + disable_h3

2026-05-22 07:18:48 +02:00

0028_ha_nodes_ip_text.sql

fix(cluster): ha_nodes INET-Spalten → TEXT — pgx-Scan-Fehler OID 869

2026-05-29 15:41:20 +02:00

0029_cluster_vip.sql

feat(cluster): PG Logical Replication + VIP/Keepalived + config_hash sync (v1.2.1–1.2.2)

2026-05-29 23:40:37 +02:00

0030_cluster_sync_replication.sql

docs(migrations): 0030-Kommentar korrigieren — network/ip node-lokal, nicht repliziert

2026-06-04 13:39:44 +02:00

0031_forward_proxy_settings.sql

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

0032_proxy_dns_extended_settings.sql

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

0033_cluster_settings_splitbrain.sql

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

0034_totp.sql

feat: HA-Cluster v1.2.x — Split-Brain, TOTP, Enterprise-FW, Drift-Fix, VIP-Recovery

2026-05-31 18:18:31 +02:00

0035_firewall_note_labels.sql

feat(firewall): Inline-Note + Labels direkt in der Tabelle

2026-05-31 18:46:54 +02:00

0036_crowdsec.sql

feat(crowdsec): CrowdSec IDS/IPS Management — v1.2.61

2026-06-01 20:25:48 +02:00

0037_waf.sql

feat(waf): Phase 1 — Migration + Service + Handler — v1.2.66

2026-06-02 15:28:29 +02:00

0038_waf_alerts.sql

feat(waf): Alerts — Regelübereinstimmungen in DB + UI — v1.2.77

2026-06-03 10:40:43 +02:00

0039_waf_exclusion_notes.sql

feat(waf): Ausnahmen mit Notiz + Ausnahmen-Liste im Drawer — v1.2.79

2026-06-03 11:31:49 +02:00

0040_oidc_settings.sql

feat(auth): OIDC/Keycloak SSO-Login (additiv) — v1.2.91

2026-06-05 16:04:13 +02:00