fix(auth): add oidc.issuer_url to use public-facing Authelia URL for browser redirects

app/config.yaml

@@ -19,6 +19,7 @@ authelia:
   users_db_path: "/opt/authelia/users_database.yml"
 
 oidc:
+  issuer_url: "https://auth.sechpoint.app"
   client_id: "nextwks"
   client_secret: ""
   redirect_url: "https://wks.lohmar.co.uk/auth/callback"

install.sh

@@ -240,6 +240,7 @@ authelia:
   users_db_path: "/opt/authelia/users_database.yml"
 
 oidc:
+  issuer_url: "https://auth.sechpoint.app"
   client_id: "nextwks"
   client_secret: ""
   redirect_url: "https://wks.lohmar.co.uk/auth/callback"

src/core/config/config.go

@@ -40,6 +40,7 @@ type AutheliaConfig struct {
 
 // OIDCConfig holds the OIDC provider settings (Authelia).
 type OIDCConfig struct {
+	IssuerURL    string `yaml:"issuer_url"` // Public-facing URL users reach (e.g., https://auth.sechpoint.app)
 	ClientID     string `yaml:"client_id"`
 	ClientSecret string `yaml:"client_secret"`
 	RedirectURL  string `yaml:"redirect_url"`

src/main.go

@@ -65,8 +65,15 @@ func main() {
 
 	// Initialize session store and OIDC auth
 	sessionStore := auth.NewSessionStore(database.DB)
+
+	// OIDC issuer: public-facing URL (via Zoraxy) for browser redirects
+	// Falls back to authelia.host if not configured
+	issuerURL := cfg.OIDC.IssuerURL
+	if issuerURL == "" {
+		issuerURL = cfg.Authelia.Host
+	}
 	oidcCfg := auth.OIDCConfig{
-		IssuerURL:    cfg.Authelia.Host,
+		IssuerURL:    issuerURL,
 		ClientID:     cfg.OIDC.ClientID,
 		ClientSecret: cfg.OIDC.ClientSecret,
 		RedirectURL:  cfg.OIDC.RedirectURL,