commit 316a79c0a8f6e5e2cde7782a39ca343b811a2485 · cduck.me/statusphere-example-app-fork

+12 -7
README.md
···

       23
       23
        
       ## Deploying

     

       24
       24
        
       

     

       25
       25
        
       In production, you will need a private key to sign OAuth tokens request. Use the

     

       26
       26
       -
       following command to generate a new JWK (JSON Web Key):

     

       26
       26
       +
       following command to generate a new private key:

     

       27
       27
        
       

     

       28
       28
        
       ```sh

     

       29
       29
        
       ./bin/gen-jwk

     

       30
       30
        
       ```

     

       31
       31
        
       

     

       32
       32
       -
       The generated key must be added to the environment variables (`.env` file) as `PRIVATE_KEY`.

     

       32
       32
       +
       The generated key must be added to the environment variables (`.env` file) in `PRIVATE_KEYS`.

     

       33
       33
        
       

     

       34
       34
        
       ```env

     

       35
       35
        
       PRIVATE_KEYS='[{"kty":"EC","kid":"12",...}]'

     

       36
       36
        
       ```

     

       37
       37
        
       

     

       38
       38
       -
       Note that you can have multiple keys. Always add new keys at the beginning of

     

       39
       39
       -
       the array, so that the first key is always the most recent one. When a key is

     

       40
       40
       -
       removed, all associated sessions will be invalidated.

     

       38
       38
       +
       > [!NOTE] The `PRIVATE_KEYS` is an array of keys. Make sure to use single

     

       39
       39
       +
       > quotes, and square brackets around the keys `PRIVATE_KEYS='[<key here>]'`. If

     

       40
       40
       +
       > you generate multiple keys, add new keys at the beginning of the array, so

     

       41
       41
       +
       > that the first key is always the most recent one. When a key is removed, all

     

       42
       42
       +
       > associated sessions will be invalidated.

     

       41
       43
        
       

     

       42
       42
       -
       Make sure to also set the `COOKIE_SECRET` in your environment variables (`.env` file), which is used to sign session cookies. You can generate a random string for this:

     

       44
       44
       +
       Make sure to also set the `COOKIE_SECRET`, which is used to sign session

     

       45
       45
       +
       cookies, in your environment variables (`.env` file). You can generate a random

     

       46
       46
       +
       string for this:

     

       43
       47
        
       

     

       44
       48
        
       ```sh

     

       45
       49
        
       openssl rand -base64 33

     

       46
       50
        
       ```

     

       47
       51
        
       

     

       48
       48
       -
       Finally, set the `PUBLIC_URL` to the URL where your app will be accessible. This is used for OAuth client ID and other configurations.

     

       52
       52
       +
       Finally, set the `PUBLIC_URL` to the URL where your app will be accessible. This

     

       53
       53
       +
       will allow the authorization servers to download the app's public keys.

     

       49
       54
        
       

     

       50
       55
        
       ```env

     

       51
       56
        
       PUBLIC_URL="https://your-app-url.com"