manuals.clinic / manuals.dental subdomainsStatus: DONE — both subdomains LIVE (2026-08-17).
manuals.dental.veripath.co.ukandmanuals.clinic.veripath.co.ukare both live, auth-gated via the Keycloakmanualsrealm with one-click SSO from theveripathrealm. Fully verified end-to-end. Test user deleted.
The user guides at https://veripath.co.uk/guides/ are growing. Split them into two auth-gated subdomains that replicate the same look/feel:
manuals.dental.veripath.co.uk → dental product manualsmanuals.clinic.veripath.co.uk → GP/clinic product manualsUsers logged into the GP/dental apps click a "Manuals" navbar link and get redirected to the correct subdomain, authenticated via SSO from the existing veripath Keycloak realm (no re-entering credentials).
manuals realm federates to the veripath realm via an OIDC Identity Provider (realm-to-realm SSO using the existing broker client).server/auth-server.mjs, port 3053) was extended to be host-aware: manuals.* hosts use the manuals realm + a shared vp_manuals_session cookie; veripath.co.uk keeps the veripath/cms flow untouched.build.mjs) parametrised into full/clinic/dental targets. Subdomain builds filter manuals by a new product frontmatter field and exclude staff-only sections (/internal, /login, /admin).auth_request → auth server → manuals realm)./guides/ on veripath.co.uk is now a hub page with cards linking to both subdomains.manuals realmmanuals (Keycloak 26.6.1). Public clients manuals-clinic / manuals-dental (standard flow, redirect URIs https://manuals.{clinic,dental}.veripath.co.uk/api/auth/callback + /*).broker client in veripath realm + OIDC IdP veripath in manuals realm (syncMode=IMPORT, trustEmail=true). Broker secret in /tmp/broker-secret.txt.broker client had bearerOnly=true → LOGIN_ERROR not_allowed / HTTP 403 at the veripath login page. Set bearerOnly=false. This was the SSO blocker — previous session only verified the redirect chain, not a completed login.server/auth-server.mjs (commit 7485bd5): per-host config for both manuals hosts + default veripath config. Manuals cookie vp_manuals_session with Domain=.veripath.co.uk (one login covers both). kc_idp_hint=veripath on manuals logins. Running on :3053.product: clinic, 1 dental manual (prescription-management/governance.md) tagged product: dental. CMS product select widget added.build.mjs TARGET=full|clinic|dental. Subdomain builds filter by product, exclude /internal+/login+/admin, drop Staff nav. /guides/ hub cards link to both subdomains./opt/deploy-manuals.sh to /var/www/veripath, /var/www/manuals-clinic, /var/www/manuals-dental.*.clinic.veripath.co.uk A → 88.208.212.211 added in Fasthosts LiveDNS (2026-08-17 — mirrors the *.dental wildcard that covers dental). Cert issued HTTP-01 (expires 2026-11-15); HTTPS vhost enabled; temp manuals-tmp-http.conf removed.location = /auth/verify lacked proxy_set_header Host $host → auth-server fell back to default vp_session config → infinite login redirect. Fixed in both confs. veripath.co.uk unaffected (its config IS the default)./api/auth/login → manuals realm → SSO via veripath realm → 200 guides page.vp_manuals_session cookie covers both subdomains.veripath.co.uk unaffected (200, /guides/ hub intact).manuals-test deleted after verification.templates/base.html: "Manuals" → https://manuals.clinic.veripath.co.uk (commit 9da3d62, pushed to main).templates/base.html: "Manuals" → https://manuals.dental.veripath.co.uk (commit 0544512d, pushed to develop).Manuals subdomains are now guides-only (commit fcc8cdc):
/policies, /blog, /siaas, /health-clinics, /dental-surgeries, /about, /onboarding, /user-guide, /internal, /login. Only assets/, guides/, and index.html are built.veripath.co.uk build unaffected (navbar, pages, hub cards intact) — verified 200 + /siaas 200.buildManualSidebar() gained an openAll option (used by the front cover).dist-clinic/, dist-dental/ added to .gitignore./opt/deploy-manuals.sh; pushed to origin/main.nohup node /root/work/veripath-site/server/auth-server.mjs > /var/log/auth-server.log 2>&1 &/internal, /admin, /login built); whole subdomain behind the manuals-realm auth gate./guides/client-admin-guide/...) predate this work — out of scope./opt/deploy-manuals.sh, /tmp/dns-wait.sh, /tmp/dns-cleanup.sh, /tmp/test_sso.py, /tmp/kc-manuals.sh.veripath-site: server/api/oidc/callback.get.ts has a different clientSecret (Nuxt route not used in production) — left untouched.build.mjs via DENTAL_SIDEBAR_HEADINGS = ['Appointments'] — add names there as they're decided; declared order wins, any other content app groups append after.rxPages) are now excluded from the dental build (still on veripath.co.uk full build; clinic unaffected).product: dental + app: Appointments slots under the heading automatically./opt/deploy-manuals.sh; commit a5aff59 pushed. Verified live: homepage sidebar shows "Appointments → Coming soon"; clinic (3 headings, 44 links) + full site unaffected.