Authentication is handled by Keycloak at https://auth.veripath.co.uk/realms/veripath. A custom Node.js auth service (auth-server.mjs on port 3053) bridges Keycloak's OIDC protocol with nginx's auth_request module.
| Client | Type | Used For |
|---|---|---|
cms |
Public (no secret) | Decap CMS admin login, staff portal, user guides |
veripath-site |
Confidential (has secret) | Legacy — Nuxt Studio OIDC (no longer used) |
1. User visits /admin/, /internal/, or /guides/
2. nginx sends subrequest to /auth/verify (internal location)
3. Auth server checks vp_session cookie
→ Valid: return 200, nginx serves content
→ Invalid/missing: return 401
4. On 401: nginx redirects to /api/auth/login?redirect=<original URL>
5. Auth server redirects to Keycloak OIDC authorize endpoint
6. User logs in on Keycloak
7. Keycloak redirects back to /api/auth/callback?code=...
8. Auth server exchanges code for access token, creates session
9. Session cookie (vp_session) is set — HttpOnly, Secure, SameSite=Lax
10. User is redirected back to the original URL
11. Subsequent requests pass auth_request validation
vp_session/api/auth/logout to destroy the session| Route | Requirement | Content |
|---|---|---|
/admin/ |
Any valid Keycloak session | Decap CMS — edit all content |
/api/decap-proxy |
Any valid Keycloak session | Decap CMS API backend |
/internal/ |
Any valid Keycloak session | Staff portal, internal policies, business plan |
/guides/ |
Any valid Keycloak session | User manuals |
/ (public) |
None | Homepage, blog, public policies |
All authenticated users in the veripath realm have the same access level. There is currently no role-based access control within the CMS — any authenticated user can edit any content.
File: /root/work/veripath-site/server/auth-server.mjs
Port: 3053
| Endpoint | Method | Purpose |
|---|---|---|
/auth/verify |
GET | nginx auth_request target (internal only) |
/api/auth/login |
GET | Initiate OIDC login |
/api/auth/callback |
GET | OIDC callback handler |
/api/auth/session |
GET | Return current session info (JSON) |
/api/auth/logout |
GET | Destroy session |
A cron job runs every minute to restart any crashed services:
* * * * * /opt/restart-services.sh