deploy configuration

internal/config/config.go

@@ -1,6 +1,7 @@
-// Package config carries the runtime settings for the demo CMS. There is no
+// Package config carries the runtime settings for the CMS. There is no
 // database to configure: content is seeded in memory and optionally mirrored to
-// a single JSON file.
+// a single JSON file. Editing rights come from Go Loose, from the single-sign-on
+// proxy, or from the demo profile, depending on what is configured.
 package config
 
 import "os"
@@ -8,8 +9,26 @@ import "os"
 type Config struct {
 	HTTPAddr, Profile, ContentFile, PostgresURL    string
 	AllowedOrigins, SSOHeader, SSOToken, SSOCookie string
+	GoLoose                                        GoLooseConfig
 }
 
+// GoLooseConfig describes the Go Loose hosted-login integration. Go Tell is
+// served from a single host, so one client application covers every request:
+// Tenant picks the Go Loose tenant that owns the login, AuthDomain is the
+// identity domain shared by all tenants, and AppDomain is the public host of
+// the CMS, which also determines the registered redirect URI.
+type GoLooseConfig struct {
+	Tenant       string
+	AuthDomain   string
+	AppDomain    string
+	CAFile       string
+	ClientID     string
+	ClientSecret string
+}
+
+// Enabled reports whether Go Loose client credentials are configured.
+func (g GoLooseConfig) Enabled() bool { return g.ClientID != "" && g.ClientSecret != "" }
+
 func Load() Config {
 	return Config{
 		HTTPAddr:       get("CMS_HTTP_ADDR", ":8080"),
@@ -20,6 +39,14 @@ func Load() Config {
 		SSOHeader:      get("CMS_SSO_HEADER", "X-SSO-Token"),
 		SSOToken:       get("CMS_SSO_TOKEN", ""),
 		SSOCookie:      get("CMS_SSO_COOKIE", ""),
+		GoLoose: GoLooseConfig{
+			Tenant:       get("GO_LOOSE_TENANT", "tell"),
+			AuthDomain:   get("GO_LOOSE_AUTH_DOMAIN", "auth.dev"),
+			AppDomain:    get("GO_LOOSE_APP_DOMAIN", "tell.dev"),
+			CAFile:       os.Getenv("GO_LOOSE_CA_FILE"),
+			ClientID:     os.Getenv("GO_LOOSE_CLIENT_ID"),
+			ClientSecret: os.Getenv("GO_LOOSE_CLIENT_SECRET"),
+		},
 	}
 }