fix installer

docs/client-login.md

@@ -9,7 +9,7 @@ Go Loose can host login for browser-facing Go applications. Your application nev
 3. Save and copy the client secret. It is shown once.
 4. Open **Users**, invite the user by the email returned by the IdP, and choose **Manage** to grant access to the application.
 
-For database login, the invitation also requires an initial password. The same tenant login screen supports both database credentials and SSO.
+The invitation requires an initial password. Tenant login hosts accept database credentials only; SSO is reserved for system administration on the bare authentication domain.
 
 Saving client configuration rotates the secret. Callback URLs require HTTPS, except `localhost` and `127.0.0.1` while Go Loose development login is enabled.
 
@@ -80,16 +80,16 @@ Each tenant has its own login origin:
 https://<tenant-slug>.<GO_LOOSE_AUTH_DOMAIN>
 ```
 
-For tenant `nmbs` with `GO_LOOSE_AUTH_DOMAIN=auth.local`, configure the Go client with:
+For tenant `nmbs` with `GO_LOOSE_AUTH_DOMAIN=auth.dev`, configure the Go client with:
 
 ```go
-BaseURL: "http://nmbs.auth.local:18080"
+BaseURL: "http://nmbs.auth.dev:18080"
 ```
 
 For local development, add the tenant hostname to `/etc/hosts`:
 
 ```text
-127.0.0.1 nmbs.auth.local
+127.0.0.1 nmbs.auth.dev
 ```
 
 Production should configure wildcard DNS and TLS for `*.auth.example.com`, route those hosts to Go Loose, and use:

docs/installation.md

@@ -8,10 +8,15 @@ Start Go Loose with PostgreSQL and a stable `GO_LOOSE_SESSION_SECRET` of at leas
 docker compose up --build
 ```
 
-Open `http://localhost:8080/install`. The installer asks for a Google OAuth client ID and client secret. In Google Cloud Console, configure this authorized redirect URI before submitting:
+Start the shared Traefik and certificate setup documented in
+`/home/dnoulet/go/infrasctruture/docs/APPLICATIONS.md`, add
+`127.0.0.1 auth.dev nmbs.auth.dev ypto.auth.dev` to `/etc/hosts`, then open
+`https://auth.dev/install`. The installer asks for a Google OAuth client ID and
+client secret. In Google Cloud Console, configure this authorized redirect URI
+before submitting:
 
 ```text
-http://localhost:8080/auth/callback
+https://auth.dev/auth/callback
 ```
 
 The supplied **CMS Demo** client ID is prefilled:
@@ -44,10 +49,10 @@ The installer selects the demonstration seed by default. It creates the `nmbs` a
 
 | Tenant | Email | Password | Role |
 |---|---|---|---|
-| NMBS | `interview@nmbs.auth.local` | `admin123` | Tenant administrator |
-| YPTO | `interview@ypto.auth.local` | `admin123` | Tenant administrator |
-| NMBS | `reviewer@nmbs.auth.local` | `Demo-Nmbs-2026!` | Tenant administrator |
-| YPTO | `reviewer@ypto.auth.local` | `Demo-Ypto-2026!` | Tenant administrator |
+| NMBS | `interview@nmbs.auth.dev` | `admin123` | Tenant administrator |
+| YPTO | `interview@ypto.auth.dev` | `admin123` | Tenant administrator |
+| NMBS | `reviewer@nmbs.auth.dev` | `Demo-Nmbs-2026!` | Tenant administrator |
+| YPTO | `reviewer@ypto.auth.dev` | `Demo-Ypto-2026!` | Tenant administrator |
 
 All four users receive access only to their tenant's Guess application. Passwords are stored as Argon2id hashes; plaintext credentials are never written to PostgreSQL.
 
@@ -56,14 +61,14 @@ These accounts and especially `admin123` are intentionally non-production creden
 For local hosted-login testing, add:
 
 ```text
-127.0.0.1 nmbs.auth.local ypto.auth.local
+127.0.0.1 auth.dev nmbs.auth.dev ypto.auth.dev
 ```
 
 The tenant login origins are then:
 
 ```text
-http://nmbs.auth.local:8080
-http://ypto.auth.local:8080
+https://nmbs.auth.dev
+https://ypto.auth.dev
 ```
 
 An application must first have exact redirect URIs and a generated client secret configured in the management console before `/connect/authorize` can start its login flow.

docs/operations.md

@@ -17,17 +17,17 @@ https://<go-loose-host>/auth/callback
 The web installer is preferred. Environment configuration remains available for existing or fully automated deployments:
 
 ```dotenv
-GO_LOOSE_BASE_URL=https://nmbs.goloose.local
+GO_LOOSE_BASE_URL=https://auth.example.com
 GO_LOOSE_AUTH_DOMAIN=auth.example.com
 GO_LOOSE_OIDC_ISSUER=https://id.example.com/realms/platform
 GO_LOOSE_OIDC_CLIENT_ID=go-loose
 GO_LOOSE_OIDC_CLIENT_SECRET=<from-secret-manager>
-GO_LOOSE_OIDC_REDIRECT_URL=https://nmbs.goloose.local/auth/callback
+GO_LOOSE_OIDC_REDIRECT_URL=https://auth.example.com/auth/callback
 GO_LOOSE_ALLOWED_EMAIL_DOMAINS=example.com
 GO_LOOSE_DEV_LOGIN=false
 ```
 
-Client applications are served on `https://<tenant>.auth.example.com`; configure wildcard DNS and TLS for `*.auth.example.com`. The OIDC callback host and `GO_LOOSE_BASE_URL` must be inside the configured auth domain so the callback can issue the shared tenant-login cookie.
+System-administrator SSO is served on `https://auth.example.com`. Client applications and tenant password login use `https://<tenant>.auth.example.com`; configure wildcard DNS and TLS for `*.auth.example.com`.
 
 Database authentication is controlled by `GO_LOOSE_LOCAL_LOGIN`. It may remain enabled for seeded or invited users without creating a bootstrap account. Set `GO_LOOSE_LOCAL_ADMIN_PASSWORD` only when compatibility bootstrap behavior is explicitly required, and provide it through a secret manager.
 

docs/password-authentication.md

@@ -7,25 +7,19 @@ Go Loose supports local email/password accounts stored in PostgreSQL. Passwords
 On a fresh Compose deployment, use `/install` and keep **Seed NMBS and YPTO Guess demo data** selected. The complete credential table is in the [installation guide](installation.md). The two primary interview accounts are:
 
 ```text
-interview@nmbs.auth.local / admin123
-interview@ypto.auth.local / admin123
+interview@nmbs.auth.dev / admin123
+interview@ypto.auth.dev / admin123
 ```
 
-For tenant application login, add `127.0.0.1 nmbs.auth.local ypto.auth.local` to `/etc/hosts`.
+For system-administrator and tenant login, add `127.0.0.1 auth.dev nmbs.auth.dev ypto.auth.dev` to `/etc/hosts`.
 
 ```text
-http://nmbs.auth.local:8080
+https://nmbs.auth.dev
 ```
 
-If alternate ports are needed:
-
-```bash
-GO_LOOSE_PORT=18080 \
-GO_LOOSE_POSTGRES_PORT=15432 \
-docker compose up --build
-```
-
-Then use `http://localhost:18080/login` and `http://nmbs.auth.local:18080`.
+Use `https://auth.dev/login` for system-administrator SSO and
+`https://nmbs.auth.dev/login` for tenant database login. Browser TLS is
+terminated by the shared infrastructure Traefik using its local CA certificate.
 
 ## Configuration
 
@@ -35,7 +29,7 @@ GO_LOOSE_LOCAL_ADMIN_EMAIL=admin@example.com              # optional bootstrap
 GO_LOOSE_LOCAL_ADMIN_PASSWORD=<at-least-12-characters>    # optional bootstrap
 ```
 
-`GO_LOOSE_LOCAL_LOGIN=true` enables all database-backed users. A bootstrap account is created only when `GO_LOOSE_LOCAL_ADMIN_PASSWORD` is non-empty; its password is applied only when the account has no password hash. Changing the environment variable later does not silently overwrite an existing database password. If a bootstrap account is required, inject its password from a secret manager and never document a production credential.
+`GO_LOOSE_LOCAL_LOGIN=true` enables database-backed users on tenant hostnames. A bootstrap account is created only when `GO_LOOSE_LOCAL_ADMIN_PASSWORD` is non-empty; its password is applied only when the account has no password hash. Changing the environment variable later does not silently overwrite an existing database password. If a bootstrap account is required, inject its password from a secret manager and never document a production credential.
 
 ## Creating client users
 
@@ -45,7 +39,7 @@ GO_LOOSE_LOCAL_ADMIN_PASSWORD=<at-least-12-characters>    # optional bootstrap
 4. Choose **Manage** for that user and grant the required applications.
 5. Give the initial credential to the user through a secure channel.
 
-The user can then sign in on `<tenant>.auth.local` or the production tenant auth hostname. Re-inviting an existing email explicitly replaces its password and display name.
+The user can then sign in on `<tenant>.auth.dev` or the production tenant auth hostname. Re-inviting an existing email explicitly replaces its password and display name.
 
 ## Brute-force and audit behavior