verae-staff-session

Shared cookie login for CS / sales / accounting / access-staff HTML.

Forgejo: https://git.georgelambert.org/marchon/verae-staff-session

Port :3027. Set STAFF_AUTH=1 on the department servers and STAFF_SESSION_URL=http://127.0.0.1:3027. Cookie host is the browser host (ports share 127.0.0.1). JSON APIs stay open unless you also send x-staff-key.

Default key: STAFF_KEY or ADMIN_KEY or admin-dev-key.

Multiple hostnames

Cookies are host-scoped. On one operator box (127.0.0.1) that is enough. For several DNS names, put one reverse proxy in front and set STAFF_COOKIE_DOMAIN:

server {
  server_name staff.example.com;
  location /session/ { proxy_pass http://127.0.0.1:3027/; }
  location /cs/      { proxy_pass http://127.0.0.1:3011/; }
  location /sales/   { proxy_pass http://127.0.0.1:3012/; }
  location /acct/    { proxy_pass http://127.0.0.1:3013/; }
  location /staff/   { proxy_pass http://127.0.0.1:3025/; }
}

STAFF_COOKIE_DOMAIN=.example.com
STAFF_COOKIE_SECURE=1
STAFF_SESSION_URL=https://staff.example.com/session
STAFF_AUTH=1