Skip to content
DiscVaultDiscVault Docs

Install: Reverse proxy and passkeys

Goal and result

Section titled “Goal and result”

Choose Passkeys on a stable HTTPS FQDN, or use the beta Legacy Authentication fallback when a valid FQDN is unavailable.

Applies to

Section titled “Applies to”

Passkeys require a stable fully qualified domain name over trusted HTTPS: RP_ID is the hostname without scheme or port and RP_ORIGINS is the exact HTTPS origin. The stable deployment uses host port 6080 and the canonical beta Compose deployment uses 6180. DiscVault 26 beta can instead expose optional Legacy Authentication for a direct private or loopback IP by setting LEGACY_AUTH_ENABLED=true and leaving RP_ID and RP_ORIGINS empty.

DiscVault v26 stable

Section titled “DiscVault v26 stable”
  • DiscVault v26 stable · ghcr.io/helmerznl/discvault:latest
  • Passkeys · RP_ID + RP_ORIGINS · proxy host port 6080
  • outside the localhost setup exception, passkeys require a stable fully qualified domain name over trusted HTTPS; a bare IP address or plain HTTP is unsupported

DiscVault v26 beta

Section titled “DiscVault v26 beta”
  • DiscVault v26 beta · ghcr.io/helmerznl/discvault:beta
  • Passkeys · RP_ID + RP_ORIGINS · proxy host port 6180
  • Legacy Authentication · LEGACY_AUTH_ENABLED=true · direct local IP fallback

Prerequisites

Section titled “Prerequisites”
  • running deployment
  • browser access
  • authentication route

Legacy Authentication fallback

Section titled “Legacy Authentication fallback”

Procedure

Section titled “Procedure”
  1. Choose: stable FQDN + Passkeys · outside the localhost setup exception, passkeys require a stable fully qualified domain name over trusted HTTPS; a bare IP address or plain HTTP is unsupported
  2. Choose: Install: Legacy Authentication · for a direct private or loopback IP without an FQDN, leave RP_ID and RP_ORIGINS empty
  3. Configure: RP_ID · hostname only
  4. Configure: RP_ORIGINS · exact public HTTPS origin
  5. Configure: proxy upstream · stable 6080 / beta 6180
  6. Test: GET /api/next/health · passkey registration · same origin
  7. Record: choose the hostname before registering passkeys; changing it later requires passkey registration again, while localhost remains only a local setup exception

Commands and settings

Section titled “Commands and settings”

DiscVault v26 stable

Section titled “DiscVault v26 stable”
RP_ID=discvault.example.com
RP_NAME=DiscVault
RP_ORIGINS=https://discvault.example.com
curl --fail https://discvault.example.com/api/next/health

DiscVault v26 beta

Section titled “DiscVault v26 beta”
RP_ID=discvault.example.com
RP_NAME=DiscVault
RP_ORIGINS=https://discvault.example.com
LEGACY_AUTH_ENABLED=true
curl --fail http://localhost:6180/api/next/health

Expected result

Section titled “Expected result”

The chosen origin reports healthy and either a passkey works on the exact HTTPS FQDN or the beta Legacy Authentication route reaches first-owner setup.

  • HTTPS health · HTTP 2xx
  • passkey · RP_ID + public origin
  • RP_ID is the hostname without scheme or port, while RP_ORIGINS is the exact full HTTPS origin; both must match the address opened in the browser

Safety and rollback

Section titled “Safety and rollback”

Next step

Section titled “Next step”

Install: First start and health check

Source and status

Section titled “Source and status”