deploy: one-command scripts to build+run from deploy/.env

2026-06-30 16:16:16 +02:00
parent a387d31f62
commit dcb939e4f2
9 changed files with 264 additions and 0 deletions
@@ -0,0 +1,62 @@
+# Google OAuth2 Setup
+
+InboxIntel logs users in with Google only. The `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` you create here identify the **application** to Google — every user (you or anyone else) signs in through this one credential pair. They are required; without them nobody can log in.
+
+## 1. Create the OAuth client
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and create (or pick) a project.
+2. **APIs & Services → Library →** enable the **Gmail API**.
+3. **APIs & Services → OAuth consent screen:**
+   - User type: **External**.
+   - Fill app name, support email, developer email.
+   - **Scopes:** add `openid`, `email`, `profile`, `.../auth/gmail.readonly`, `.../auth/gmail.modify`.
+4. **APIs & Services → Credentials → Create credentials → OAuth client ID:**
+   - Application type: **Web application**.
+   - **Authorized redirect URIs** — add the one(s) matching how you run it:
+
+     | How you run it | Redirect URI |
+     |---|---|
+     | Docker (frontend on :8081) | `http://localhost:8081/signin-google` |
+     | Docker + top-level nginx (`--profile proxy`, :80) | `http://localhost/signin-google` |
+     | Local dev (API via `dotnet run`, :5080) | `http://localhost:5080/signin-google` |
+     | Production | `https://your-domain/signin-google` |
+
+   - Copy the generated **Client ID** and **Client secret**.
+
+## 2. Put the credentials where the app reads them
+
+Docker — in `.env` at the repo root:
+
+```
+GOOGLE_CLIENT_ID=xxxxx.apps.googleusercontent.com
+GOOGLE_CLIENT_SECRET=xxxxx
+```
+
+Local dev — use user-secrets so they never touch source control:
+
+```bash
+cd src/InboxIntel.Api
+dotnet user-secrets init
+dotnet user-secrets set "GoogleOAuth:ClientId" "xxxxx.apps.googleusercontent.com"
+dotnet user-secrets set "GoogleOAuth:ClientSecret" "xxxxx"
+```
+
+## 3. Who is allowed to log in
+
+This is controlled by the **consent screen publishing status**, not the app code (the code already creates a new user row per Google account — it does not restrict to one person):
+
+- **Testing** (default): only Google accounts you add under *Test users* can sign in (max 100).
+- **In production** (click **Publish app**): any Google account can sign in.
+
+### Caveat for the Gmail scopes
+
+`gmail.readonly` and `gmail.modify` are **restricted scopes**. A published-but-unverified app still works, but:
+
+- users see a "Google hasn't verified this app" warning screen, and
+- you're capped at **100 users** until Google verifies the app.
+
+Removing the warning / going beyond 100 users requires Google's OAuth verification (a CASA security assessment for restricted scopes). For personal or small-team use, published-unverified (≤100 users) is usually fine.
+
+## 4. Redirect URI must match exactly
+
+The URI registered in the Console must character-for-character match what the app sends. The app builds it from the request's host + scheme; behind nginx, `UseForwardedHeaders` + the `X-Forwarded-Proto`/`Host` headers (already configured) make that the **external** URL, and nginx routes `/signin-google` to the API. If you get `redirect_uri_mismatch`, compare the URI in the browser's address bar during the error against what's registered.