greenpau/caddy-security

coding-directives

Implement or review caddy-security Go code, Caddy modules, parsers, lifecycle, and HTTP delegation. Use for app/plugin boundaries, authcrunch integration, errors, logging, and code conventions.

Quellsprache: Englisch

testing-and-ci

Choose and run unit, E2E, Caddyfile fixture, automation, and CI checks for caddy-security. Use for coverage requirements, test evidence, failures, and report workflows; official OP conformance remains opt-in.

Quellsprache: Englisch

configuration-authentication

Configure authentication portals, backend selection, redirect trust, refresh, Documents storage, and portal wiring. Delegates cookies, UI, transforms, crypto, and OIDC provider details to focused skills.

Quellsprache: Englisch

configuration-authorization

Configure authorization policies, ACLs, static claims enrichment, required external decisions, bypasses, identity headers, JWT verification, remote Basic/API-key auth, SQLite API keys, and direct OAuth without a portal.

Quellsprache: Englisch

configuration-crypto

Configure portal/policy JWT keys, named access signers, strict access-token profiles, token names and lifetimes, discovery, rotation, and System API encryption keys.

Quellsprache: Englisch

configuration-identity-stores

Configure local, LDAP or SQLite password identity stores, trusted SQLite administration, realms, databases, binds, TLS trust and group mappings. Delegates static local entries to configuration-users.

Quellsprache: Englisch

configuration-messaging

Configure email, file and SQLite messaging providers, bounded delivery workers, SMTP transport, sender credentials and registration notifications.

Quellsprache: Englisch

configuration-registrations

Configure legacy signup and SQLite email-confirmed enrollment, portal selection, messaging, storage and recovery. OAuth client registration is separate.

Quellsprache: Englisch

configuration-secrets

Configure security.secrets plugins and secret lookup values for users, credentials, and crypto. Use for SQLite provisioning, static/AWS wiring, and lookup failures; runtime field support belongs to runtime resolution.

Quellsprache: Englisch

configuration

Build or review caddy-security Caddyfiles and select focused configuration skills. Use for security app declarations and authenticate/authorize route wiring.

Quellsprache: Englisch

configuration-ticket-providers

Configure SQLite single-use ticket login issued by a trusted application, browser binding, storage and recovery. OAuth/SAML providers have separate owners.

Quellsprache: Englisch

authentication-portal-api

Build or troubleshoot portal JSON/native login clients, refresh, Documents, profile and admin APIs, and public JWKS. Use for HTTP contracts; portal Caddyfile wiring belongs to configuration-authentication.

Quellsprache: Englisch

release-and-versioning

Maintain VERSION, release targets, versioned artifacts, GoReleaser packaging, and publication. Use for release preparation, version checks, and explicitly requested releases; dependency refresh is separate.

Quellsprache: Englisch

scripts-and-automation

Choose or maintain repository Make/script workflows, builds, dependency selection, generated artifacts, and security CLI tools. Routes release work and documents local administration and standalone login commands.

Quellsprache: Englisch

configuration-authentication-cross-device

Configure and verify optional cross-device portal login, QR activation, explicit approval, browser binding, cancellation, and lifecycle through Caddy. Native login and external provider configuration retain their own owners.

Quellsprache: Englisch

configuration-users

Configure static local accounts, required identity fields, trusted password imports, bcrypt API keys, roles, and stored challenge rules. Use for Caddyfile-owned users; online administration belongs to scripts-and-automation.

Quellsprache: Englisch

break-fix-troubleshooting

Diagnose caddy-security deployment and runtime failures from configs, logs, versions, and HTTP evidence. Use for focused fixes, unresolved support handoffs, or preparing break-fix issue reports.

Quellsprache: Englisch

configuration-oauth-applications

Register named OAuth clients, manage private registration storage, and configure portal OIDC providers. Owns security oauth/oidc provisioning commands; external login providers and security local are separate.

Quellsprache: Englisch

configuration-runtime-resolution

Configure and validate Caddy runtime placeholders, secret lookups, encoded instructions, and resolved fixtures. Use to determine which fields resolve and preserve exact values; manager blocks belong to secrets.

Quellsprache: Englisch

configuration-state

Configure durable AuthCrunch runtime state, exclusive storage ownership, stop/start persistence, reload rejection, and recovery. Use for root state blocks and process-level restart guarantees.

Quellsprache: Englisch

configuration-oauth-providers

Configure external OAuth/OIDC login providers, credentials, scopes, issuer/audience trust, JWKS, PKCE, portal enablement, and named pending-login storage. Named relying-party registrations and portal OPs belong to OAuth applications.

Quellsprache: Englisch

configuration-saml-providers

Configure external SAML login providers, ACS/IdP URLs, metadata, signing certificates, realms, and claims. Use for Azure or generic IdPs; portal SAML SSO app providers belong to configuration-sso-app.

Quellsprache: Englisch

configuration-http-integrations

Mount authenticate and authorize handlers, separate portal and protected routes, align auth URLs, and preserve trusted proxy metadata. Use for path conflicts, split hosts, public JWKS, and route ordering.

Quellsprache: Englisch

configuration-logging

Configure AuthCrunch diagnostic skip rules, Caddy credential redaction, and logger boundaries. Use for component/message filtering and safe credential diagnostics; authorization outcomes remain unchanged.

Quellsprache: Englisch

configuration-authentication-cookies

Configure portal cookie names, prefixes, domains, paths, attributes, and refresh overrides. Use for cookie precedence and coordination with authorization token discovery.

Quellsprache: Englisch

configuration-authentication-ui

Configure portal UI templates, static assets, themes, languages, links, and custom CSS/JS/HTML. Use for branding and refresh-aware templates; transform-generated links belong to user transforms.

Quellsprache: Englisch

source-code-management

Create or review caddy-security commit messages using repository indicators, required body sections, and timestamped message files. A message request does not create a commit.

Quellsprache: Englisch

configuration-authentication-user-transforms

Configure portal user transforms: matchers, typed claims, role actions, conditional challenges, MFA, and deny rules. Use for authentication-time policy; stored account rules belong to configuration-users.

Quellsprache: Englisch

configuration-credentials

Configure reusable named username/password credentials for messaging consumers, including optional domains and runtime values. LDAP bind credentials belong to identity stores.

Quellsprache: Englisch

configuration-sso-app

Configure portal-provided SAML SSO apps, AWS role names, metadata, certificates, and PKCS8 keys. Use for sso provider blocks and their runtime limits; external SAML login providers are separate.

Quellsprache: Englisch

skill-authoring

Create, port, revise, or audit repo-local skills and their metadata, engineering contracts, and task routes. Use for skill discovery, ownership, source grounding, and session-derived guidance; diagrams are optional.

Quellsprache: Englisch