Self-hosted quickstart

docker run -d --name veriqa \
  -p 8080:8080 \
  -e ASPNETCORE_ENVIRONMENT=Production \
  -e Veriqa__OpenIddict__Database__Provider=PostgreSQL \
  -e Veriqa__OpenIddict__Database__ConnectionString="Host=postgres;Database=veriqa;Username=veriqa;Password=…" \
  -e Veriqa__TransactionEngine__Store__Provider=PostgreSQL \
  -e Veriqa__TransactionEngine__Store__ConnectionString="Host=postgres;Database=veriqa;Username=veriqa;Password=…" \
  -e Veriqa__Channels__Telegram__Enabled=true \
  -e Veriqa__Channels__Telegram__BotToken="YOUR_BOT_TOKEN" \
  -e Veriqa__Channels__Telegram__WebhookBaseUrl="https://auth.your-domain.com" \
  -e Veriqa__Channels__Telegram__WebhookSecretToken="YOUR_SECRET" \
  -e Veriqa__Channels__Telegram__InboundVerification=shared_secret \
  registry.gitlab.com/veriqa/veriqa

{
  "Veriqa": {
    "OpenIddict": {
      "Clients": [
        {
          "ClientId": "my-app",
          "DisplayName": "My Application",
          "AllowedRedirectUris": [ "https://app.your-domain.com/signin-oidc" ],
          "AllowedScopes": [ "openid", "profile", "offline_access" ],
          "AllowRefreshTokens": true
        }
      ]
    }
  }
}

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    })
    .AddCookie()
    .AddOpenIdConnect(options =>
    {
        options.Authority = "https://auth.your-domain.com";
        options.ClientId = "my-app";
        options.ResponseType = "code";
        options.Scope.Add("profile");
        options.CallbackPath = "/signin-oidc";

        // A user who presses "Cancel sign-in" on the Veriqa page
        // comes back with error=access_denied. That is an answer, not a fault: with the path set
        // the handler redirects to that route of your application. With no path set the refusal
        // would go to OnRemoteFailure below, like any other failed return.
        options.AccessDeniedPath = "/signin-cancelled";

        // Every other failed return — Veriqa answering error=server_error, say, because the channel
        // did not deliver the confirmation — raises OnRemoteFailure; with no handler for it the
        // return ends in an HTTP 500. The user is taken to a page of your application that offers
        // to start over. The error text is deliberately not shown to the user: it is written to
        // the log instead.
        options.Events.OnRemoteFailure = context =>
        {
            context.HttpContext.RequestServices.GetRequiredService<ILogger<Program>>()
                .LogWarning(context.Failure, "The sign-in return carried an error.");
            context.HandleResponse();
            context.Response.Redirect("/signin-failed");
            return Task.CompletedTask;
        };

        // Veriqa issues the user's name as the short OIDC `name` claim, while User.Identity.Name
        // looks up ClaimTypes.Name (the long WS-Federation URI) by default — without this line the
        // name stays empty after a successful sign-in.
        options.TokenValidationParameters.NameClaimType = "name";
    });

{
  "ForwardedHeaders": {
    "KnownProxies": [ "10.0.0.5" ],
    "KnownIPNetworks": [ "10.0.0.0/8" ]
  }
}