jlcox1970/magiclink-ui repository overview

⁠magiclink-ui

Management UI for magiclink-auth⁠ — a self-hosted, passwordless OIDC authentication server built on magic links.

This container provides a Vue 3 SPA for administering users, clients, roles, RBAC rules, and SSO configuration. It authenticates against your magiclink-auth instance using its own PKCE OIDC flow — no separate credentials required.

⁠Requirements

A running magiclink-auth instance. See → jlcox1970/magiclink-auth⁠

Register a PKCE public client against it before starting this container:

curl -X POST https://your-oidc-server/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "magic-auth-ui",
    "redirect_uris": ["https://your-ui-host/auth/callback"],
    "token_endpoint_auth_method": "none"
  }'

Save the returned client_id — you'll need it below.

⁠Quick Start

Create a config.js with your instance details:

window.MAGIC_AUTH_CONFIG = {
  ISSUER_URL:   "https://your-oidc-server",
  CLIENT_ID:    "your-registered-client-id",
  REDIRECT_URI: "",  // leave empty to auto-detect from window.location.origin
}

Run the container with it mounted:

docker run -d \
  -p 8080:8080 \
  -v ./config.js:/app/dist/config.js:ro \
  jlcox1970/magiclink-ui:latest

Then open http://localhost:8080.

⁠Configuration

All runtime configuration is injected via a mounted config.js file — nothing is baked into the image at build time.

If the container starts without a valid config.js, the UI displays setup instructions rather than looping or crashing.

⁠Kubernetes

apiVersion: v1
kind: ConfigMap
metadata:
  name: magic-auth-ui-config
data:
  config.js: |
    window.MAGIC_AUTH_CONFIG = {
      ISSUER_URL:   "https://your-oidc-server",
      CLIENT_ID:    "your-client-id",
      REDIRECT_URI: ""
    }
---
# In your Deployment, mount it:
volumes:
  - name: ui-config
    configMap:
      name: magic-auth-ui-config
containers:
  - name: magic-auth-ui
    image: jlcox1970/magiclink-ui:latest
    ports:
      - containerPort: 8080
    volumeMounts:
      - name: ui-config
        mountPath: /app/dist/config.js
        subPath: config.js
        readOnly: true

⁠Features

• User management — list, view, deactivate, and manage roles across all registered apps
• OIDC client management — register, delete, and configure custom roles per client
• RBAC rules — create domain and email-based role assignment rules with a live role resolver
• SSO configuration — per-client opt-in with global enable/disable
• Server settings — control open registration, allowed redirect domains, and SSO session TTL
• Role-scoped access — global_admin sees everything; app_admin sees only their own app's users and config

⁠Ports