# vnc-hybridauth2 (vnctalk-hybrid-authenticator2)

Hybrid authenticator for VNCtalk / VNCmail. An Express service that sits between the
auth-proxy's `hybridAuthURL` and the directory backends: it authenticates users against
**LDAP** and the **VNCdirectory** PostgreSQL DB, and issues/verifies the XMPP JWT
(`xmppToken`) that Prosody and the mail/talk APIs share for SSO.

Prosody's `mod_auth_http_async` points `hybridaAuthUrl` at this service's HTTP-basic
endpoint (default port `9544`).

## Build & image

Built by Gitea Actions (`.gitea/workflows/deploy.yml`) on every push to `master`, using
kaniko (no Docker daemon on the runner). The image is pushed to the Gitea registry:

- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:latest`
- `gitea.saas.vnc.biz/vnclagoon/vnc-hybridauth-api:sha-<short-sha>`

Registry auth uses the `REGISTRY_USER` / `REGISTRY_TOKEN` Actions secrets. The image runs
as the non-root `vncuser` (uid 1001) and starts `node /usr/share/vnctalk-hybrid-authenticator2/app/app.js`.

## Configuration

`config.js` (copied into the image as `config/vnc-hybrid-authenticator.js`) is env-driven;
the `development` profile reads `NODE_ENV`-scoped values from `process.env` (LDAP URI/bind,
Postgres host/port/name/user/pass, `xmppToken`, `domain`). Provide them via the deployment
(ArgoCD in the `vnc-iac-env` GitOps repo), sourced from Infisical — do **not** commit
secrets to this repo.

## Deploy

Deployed by the ArgoCD application in `vnc-iac-env` (the hybrid-auth service that Prosody
and the mail/talk APIs call). This repo has no live deploy manifest; the image tag is pinned
in that GitOps repo.

## Legacy removed

The GitLab CI (`.gitlab-ci.yml`), `Jenkinsfile.deprecated`, and the GCP dev bootstrap
(`startgcpdevapi.sh`) were removed during the GitLab → Gitea migration. The old
`eu.gcr.io/vnc-development/vnc-hybridauth-api` promotion flow (`prod-*` / `stable-*` tags)
is not carried over; the current build pushes a single `master` → `sha-*` + `latest`.