Can Rex's HTTP listener sit behind an OIDC Ingress? #2

New issue

Closed

opened 2026-10-31 13:09:02 +00:00 by mikluko · 2 comments

mikluko commented

2026-10-31 13:09:02 +00:00

Owner

Map: #1

Question

Can Rex's HTTP listener (--extra-listen http, login-server) sit behind a Traefik Ingress with OIDC from pocketid? What auth modes does each listener support, how do clients (rex -S, the Mac and phone apps) authenticate to it, and do WebSockets pass through? The answer is a yes/no with the constraints that decide the exposure ticket.

Map: #1 ## Question Can Rex's HTTP listener (`--extra-listen http`, `login-server`) sit behind a Traefik Ingress with OIDC from pocketid? What auth modes does each listener support, how do clients (`rex -S`, the Mac and phone apps) authenticate to it, and do WebSockets pass through? The answer is a yes/no with the constraints that decide the exposure ticket.

mikluko added the

wayfinder:research

label

2026-10-31 13:09:14 +00:00

mikluko added a new dependency

2026-10-31 13:09:17 +00:00

#3 Exposure: joining the tailnet

mikluko self-assigned this

2026-10-31 13:11:20 +00:00

mikluko commented

2026-10-31 13:11:50 +00:00

Author

Owner

Answer: No. Rex has no OIDC, bearer-token or browser-login auth on any listener; the docs say callers are trusted only by how they connect (Tailscale identity, unix peer), with real auth "planned".

Plain http listener requires --allow-anonymous (full access to anyone who reaches it); an OIDC Ingress in front can't authenticate rex -S or the Mac app, which have no token/redirect support documented.
--websocket-origin-pattern is a browser origin check, not auth.
Decision: expose via tailnet (--tailscale, or tailnet-serve), not OIDC Ingress. Unverified: proxied WebSocket from the apps, phone app behaviour.

Details: https://sarak.sh/mikluko/machine-rex/src/branch/research/rex-http-listener-auth/docs/research/rex-http-listener-auth.md

**Answer: No.** Rex has no OIDC, bearer-token or browser-login auth on any listener; the docs say callers are trusted only by how they connect (Tailscale identity, unix peer), with real auth "planned". - Plain `http` listener requires `--allow-anonymous` (full access to anyone who reaches it); an OIDC Ingress in front can't authenticate `rex -S` or the Mac app, which have no token/redirect support documented. - `--websocket-origin-pattern` is a browser origin check, not auth. - Decision: expose via tailnet (`--tailscale`, or `tailnet-serve`), not OIDC Ingress. Unverified: proxied WebSocket from the apps, phone app behaviour. Details: https://sarak.sh/mikluko/machine-rex/src/branch/research/rex-http-listener-auth/docs/research/rex-http-listener-auth.md

mikluko commented

2026-10-31 13:12:17 +00:00

Author

Owner

Answer

No. Rex trusts callers only by how they connect (Tailscale identity, or the unix-socket peer); no listener accepts OIDC, bearer tokens or a browser login, and plain http needs --allow-anonymous (full access to every caller). An OIDC Ingress cannot authenticate rex -S or the Mac app. The supported remote exposure is the tailnet: --tailscale (embedded tsnet) or tailnet-serve.

Findings: https://sarak.sh/mikluko/machine-rex/src/branch/research/rex-http-listener-auth/docs/research/rex-http-listener-auth.md

## Answer No. Rex trusts callers only by how they connect (Tailscale identity, or the unix-socket peer); no listener accepts OIDC, bearer tokens or a browser login, and plain `http` needs `--allow-anonymous` (full access to every caller). An OIDC Ingress cannot authenticate `rex -S` or the Mac app. The supported remote exposure is the tailnet: `--tailscale` (embedded tsnet) or `tailnet-serve`. Findings: https://sarak.sh/mikluko/machine-rex/src/branch/research/rex-http-listener-auth/docs/research/rex-http-listener-auth.md

mikluko closed this issue

2026-10-31 13:12:17 +00:00

mikluko referenced this issue

2026-10-31 13:12:18 +00:00

Map: Rex server on saraksh #1