infra(railway): federate api login to github oauth via better-auth

Author: markus-azer

infra/railway/auth.tf

@@ -0,0 +1,4 @@
+# Signs the JWTs.
+resource "random_password" "better_auth" {
+  length = 40
+}

infra/railway/locals.tf

@@ -10,12 +10,16 @@ locals {
   }
 
   api_env = {
-    PORT         = tostring(var.api.port)
-    METRICS_PORT = "9090"
-    LOG_LEVEL    = "info"
-    OTEL_ENABLED = "false"
-    CORS_ORIGINS = "https://$${{RAILWAY_PUBLIC_DOMAIN}}"
-    DATABASE_URL = "$${{Postgres.DATABASE_URL}}"
+    PORT                 = tostring(var.api.port)
+    METRICS_PORT         = "9090"
+    LOG_LEVEL            = "info"
+    OTEL_ENABLED         = "false"
+    CORS_ORIGINS         = "https://$${{RAILWAY_PUBLIC_DOMAIN}}"
+    DATABASE_URL         = "$${{Postgres.DATABASE_URL}}"
+    GITHUB_CLIENT_ID     = var.github.client_id
+    GITHUB_CLIENT_SECRET = var.github.client_secret
+    BETTER_AUTH_URL      = "https://$${{RAILWAY_PUBLIC_DOMAIN}}"
+    BETTER_AUTH_SECRET   = random_password.better_auth.result
   }
 
   # service name -> its SQL dir. Add a line to onboard another service.

infra/railway/terraform.tfvars.example

@@ -12,3 +12,9 @@ api = {
   port   = 3002
   domain = null # or "api.example.com"
 }
+
+# From the GitHub OAuth app. Callback: https://<domain>/api/auth/callback/github
+github = {
+  client_id     = ""
+  client_secret = ""
+}

infra/railway/variables.tf

@@ -18,3 +18,12 @@ variable "api" {
     domain = string # null for the free *.up.railway.app URL
   })
 }
+
+# The GitHub OAuth app thoth federates login to.
+variable "github" {
+  type = object({
+    client_id     = string
+    client_secret = string
+  })
+  sensitive = true
+}