From d321ed44a803fbdbc86ae700b40655a3e4fb268c Mon Sep 17 00:00:00 2001 From: ASOwnerYT Date: Wed, 5 Aug 2026 17:03:54 +1200 Subject: [PATCH] Add webfinger endpoint Serve /.well-known/webfinger for federated-identity discovery. Co-Authored-By: Claude Opus 5 --- app/.well-known/webfinger/route.ts | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 app/.well-known/webfinger/route.ts diff --git a/app/.well-known/webfinger/route.ts b/app/.well-known/webfinger/route.ts new file mode 100644 index 0000000..6d332e0 --- /dev/null +++ b/app/.well-known/webfinger/route.ts @@ -0,0 +1,25 @@ +// WebFinger endpoint (RFC 7033) served at /.well-known/webfinger. +// Points OIDC relying parties (e.g. Tailscale) at the Authentik issuer +// for acct:admin@cloudrite.co.nz. + +const WEBFINGER = { + subject: 'acct:admin@cloudrite.co.nz', + links: [ + { + href: 'https://auth.cloudrite.co.nz/application/o/tailscale/', + rel: 'http://openid.net/specs/connect/1.0/issuer', + }, + ], +} + +export async function GET() { + return new Response(JSON.stringify(WEBFINGER), { + headers: { + // RFC 7033 requires the JRD media type, not application/json. + 'content-type': 'application/jrd+json; charset=utf-8', + // WebFinger responses are cross-origin fetched by relying parties. + 'access-control-allow-origin': '*', + 'cache-control': 'public, max-age=3600', + }, + }) +}