95 lines
5 KiB
Markdown
95 lines
5 KiB
Markdown
# PeerTube Discord OIDC Bridge
|
|
|
|
A lightweight, containerized OIDC (OpenID Connect) provider that acts as a bridge between a PeerTube instance and Discord's OAuth2 authentication. This allows users to log in or register on a PeerTube instance using their Discord account, with access gated by membership in a specific Discord server.
|
|
|
|
## Overview
|
|
|
|
This project solves a specific problem: PeerTube has a robust, official plugin for OIDC authentication, but not for generic OAuth2 providers like Discord. This service fills that gap by presenting a fully compliant OIDC interface to PeerTube while handling the Discord OAuth2 flow on the backend.
|
|
|
|
The primary use case is for self-hosted PeerTube instances that are not fully public but need a simple way to grant access to a community of users, such as friends or server members, without manual account creation.
|
|
|
|
## Features
|
|
|
|
- **Discord Authentication:** Enables "Login with Discord" for any PeerTube instance.
|
|
- **Server Gating:** Restricts login/registration to members of a specific Discord server.
|
|
- **OIDC Compliant:** Works seamlessly with the official PeerTube `auth-openid-connect` plugin.
|
|
- **Automatic Account Creation:** New users who pass the server gate are automatically given a PeerTube account.
|
|
- **Existing Account Linking:** Users with an existing PeerTube account can link it by matching their Discord email.
|
|
- **Dockerized:** Runs as a single, lightweight Docker container orchestrated with Docker Compose.
|
|
- **Diagnostics Page:** Includes a `/status` page to check configuration and connectivity.
|
|
|
|
## How It Works
|
|
|
|
1. A user on PeerTube clicks "Login with OpenID Connect".
|
|
2. PeerTube redirects the user to this OIDC Bridge service.
|
|
3. The OIDC Bridge service redirects the user to Discord for authentication and authorization.
|
|
4. The user authorizes the application in Discord and is redirected back to the bridge.
|
|
5. The bridge uses the Discord authorization code to get an access token.
|
|
6. It then uses the access token to fetch the user's profile and their list of Discord servers (guilds).
|
|
7. The bridge creates a signed **ID Token (JWT)**, inserting the user's server IDs into a `groups` claim.
|
|
8. PeerTube receives the ID Token, validates it, and checks if the user's `groups` claim contains the required "Allowed Group" (your Discord Server ID).
|
|
9. If the check passes, the user is logged in or their account is created.
|
|
|
|
## Requirements
|
|
|
|
- [Docker](https://www.docker.com/get-started)
|
|
- [Docker Compose](https://docs.docker.com/compose/install/)
|
|
- A PeerTube instance with the `auth-openid-connect` plugin installed and enabled.
|
|
|
|
## Setup Instructions
|
|
|
|
### 1. Clone or Create Project Files
|
|
|
|
Place all the project files (`docker-compose.yml`, `Dockerfile`, `app.py`, `requirements.txt`, `.env`, `templates/status.html`) in a single directory on your server.
|
|
|
|
### 2. Configure Environment Variables
|
|
|
|
Create a `.env` file by copying the contents from the Canvas and fill in the following values:
|
|
|
|
- `OIDC_PROVIDER_URL`: The full, publicly accessible URL of this bridge service (e.g., `http://your-domain.com:5000` or `http://192.168.1.10:5000`). **This cannot be `localhost`** if PeerTube is running on a different machine or in a different Docker network.
|
|
- `DISCORD_CLIENT_ID`: Your Client ID from the Discord Developer Portal.
|
|
- `DISCORD_CLIENT_SECRET`: Your Client Secret from the Discord Developer Portal.
|
|
- `PEERTUBE_CALLBACK_URL`: The full callback URL provided by the PeerTube OIDC plugin settings page. It will look like `https://your-peertube.com/plugins/auth-openid-connect/router/code-cb`.
|
|
|
|
### 3. Configure Discord Application
|
|
|
|
In the [Discord Developer Portal](https://discord.com/developers/applications), under your application's "OAuth2" settings:
|
|
|
|
- Add a **Redirect URI** that matches the bridge's callback endpoint: `http://<your-domain-or-ip>:5000/discord/callback`.
|
|
|
|
### 4. Configure PeerTube Plugin
|
|
|
|
On your PeerTube instance, navigate to **Administration -> Plugins/Themes -> auth-openid-connect -> Settings** and configure it as follows:
|
|
|
|
- **Discover URL:** `http://<your-domain-or-ip>:5000/.well-known/openid-configuration`
|
|
- **Client ID:** `peertube`
|
|
- **Client secret:** `peertube-super-secret`
|
|
- **Scope:** `openid email profile groups`
|
|
- **Username property:** `preferred_username`
|
|
- **Email property:** `email`
|
|
- **Display name property:** `name`
|
|
- **Group property:** `groups`
|
|
- **Allowed group:** Your specific Discord Server ID.
|
|
|
|
## Running the Service
|
|
|
|
From the project directory, run the following command:
|
|
|
|
```bash
|
|
docker-compose up --build -d
|
|
```
|
|
|
|
The -d flag runs the container in detached mode (in the background).
|
|
Troubleshooting
|
|
|
|
You can check the health and configuration of the bridge service by navigating to its status page:
|
|
|
|
http://<your-domain-or-ip>:5000/status
|
|
|
|
This page will show the status of environment variables, connectivity to the Discord API, and a log of the most recent incoming requests from your PeerTube instance, which is invaluable for debugging the connection.
|
|
|
|
To view live logs from the container, run:
|
|
|
|
```bash
|
|
docker-compose logs -f
|
|
```
|