Visione CIE Auth Stack

This folder contains deployable CIE auth services for Visione:

• federation-authority
• provider
• relying-party

It is now structured to work with Docker Compose and Dokploy without host networking.

Configuration

Copy .env.example to .env and set only what changes in real deploy:

• public domains / internal URLs
• Django secret keys
• shared secret between relying party and Visione backend

Main variables:

• CIE_AUTH_ALLOWED_HOSTS
• DJANGO_TRUST_ANCHOR
• DJANGO_PROVIDER_ISSUER
• DJANGO_RP_BACKEND_EXCHANGE_URL
• DJANGO_RP_SHARED_SECRET
• FEDERATION_AUTHORITY_SECRET_KEY
• PROVIDER_SECRET_KEY
• RELYING_PARTY_SECRET_KEY

Deploy with Dokploy

Use docker-compose.yml as compose source. Expose:

• federation-authority on port 8000
• provider on port 8002
• relying-party on port 8001

Each service persists its own SQLite DB in a named volume.

Local start

docker compose up --build -d

Visione backend

Visione backend must expose exchange endpoint configured in DJANGO_RP_BACKEND_EXCHANGE_URL. Shared secret must match backend cie_auth.shared_secret.

Bootstrap behavior

On first boot, each Django service:

1. runs migrations
2. loads dumps/example.json only if DB is empty

Disable fixture import per service with:

• FEDERATION_AUTHORITY_LOAD_FIXTURE_ON_EMPTY_DB=false
• PROVIDER_LOAD_FIXTURE_ON_EMPTY_DB=false
• RELYING_PARTY_LOAD_FIXTURE_ON_EMPTY_DB=false

Smoke test

curl -sS -X POST http://127.0.0.1:5555/api/v1/auth/cie/start \
  -H 'Content-Type: application/json' \
  -d '{"frontend_redirect_uri":"http://localhost:3000/auth/cie/callback"}'

Then complete login and poll:

curl -sS http://127.0.0.1:5555/api/v1/auth/cie/session/<state>

Reset data

docker compose down -v

If the stack was started before June 17, 2026 DB path fix, also remove legacy SQLite files that were created outside named volumes:

rm -f federation_authority/db.sqlite3 provider/db.sqlite3 relying_party/db.sqlite3

Logs

docker compose logs -f