Hybrid authenticator for VNCtalk / VNCmail. An Express service that sits between the auth-proxy's hybridAuthURL and the directory backends: it authenticates users against LDAP and the VNCdirectory PostgreSQL DB, and issues/verifies the XMPP JWT (xmppToken) that Prosody and the mail/talk APIs share for SSO.

Prosody's mod_auth_http_async points hybridaAuthUrl at this service's HTTP-basic endpoint (default port 9544).

Build & image

Built by Gitea Actions (.gitea/workflows/deploy.yml) on every push to master, using kaniko (no Docker daemon on the runner). The image is pushed to the Gitea registry:

gitea.saas.vnc.biz/vnciac/vnc-hybridauth-api:latest
gitea.saas.vnc.biz/vnciac/vnc-hybridauth-api:sha-<short-sha>

Registry auth uses the REGISTRY_USER / REGISTRY_TOKEN Actions secrets. The image runs as the non-root vncuser (uid 1001) and starts node /usr/share/vnctalk-hybrid-authenticator2/app/app.js.

Configuration

config.js (copied into the image as config/vnc-hybrid-authenticator.js) is env-driven; the development profile reads NODE_ENV-scoped values from process.env (LDAP URI/bind, Postgres host/port/name/user/pass, xmppToken, domain). Provide them via the deployment (ArgoCD in the vnc-iac-env GitOps repo), sourced from Infisical — do not commit secrets to this repo.

Deploy

Deployed by the ArgoCD application in vnc-iac-env (the hybrid-auth service that Prosody and the mail/talk APIs call). This repo has no live deploy manifest; the image tag is pinned in that GitOps repo.

Legacy removed

The GitLab CI (.gitlab-ci.yml), Jenkinsfile.deprecated, and the GCP dev bootstrap (startgcpdevapi.sh) were removed during the GitLab → Gitea migration. The old eu.gcr.io/vnc-development/vnc-hybridauth-api promotion flow (prod-* / stable-* tags) is not carried over; the current build pushes a single master → sha-* + latest.