infra(railway): federate api login to github oauth via better-auth

[markus-azer]

What

Adds GitHub OAuth env vars to the api service and generates a random secret for signing better-auth JWTs.

Why

The api needs to authenticate users through GitHub instead of its own credential store.

How to verify

• [ ]

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31667698-c32f-4210-9f6f-9cc6f7444c87

📥 Commits

Reviewing files that changed from the base of the PR and between eea65e2 and 376809a.

📒 Files selected for processing (4)

• infra/railway/auth.tf
• infra/railway/locals.tf
• infra/railway/terraform.tfvars.example
• infra/railway/variables.tf

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

---

Walkthrough

Railway Terraform configuration now declares sensitive GitHub OAuth credentials and documents their callback URL. It generates a 40-character password without special characters for JWT signing. The API environment uses a configured API domain or Railway’s public domain, plus derived CORS and Better Auth URLs, GitHub credentials, and the generated secret.

Merge Risk: ⚪ Minimal · up to 37680

This PR adds GitHub OAuth and JWT signing configuration without any identified merge-blocking risk. It is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the GitHub OAuth and Better Auth changes in the API infrastructure.
Description check	✅ Passed	The description directly explains the GitHub OAuth environment variables and Better Auth JWT secret changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch infra/github-oauth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

The custom-domain OAuth path needs to be fixed before merging because Better Auth and the registered GitHub callback can use different origins.

BETTER_AUTH_URL is fixed to RAILWAY_PUBLIC_DOMAIN even though the deployment supports and documents a custom API domain, causing a concrete OAuth redirect URI mismatch for that supported configuration.

Files Needing Attention: infra/railway/locals.tf

Sequence Diagram

sequenceDiagram
  participant User
  participant API as API custom domain
  participant Auth as Better Auth
  participant GitHub
  User->>API: Start GitHub login
  API->>Auth: Use BETTER_AUTH_URL
  Auth->>GitHub: OAuth request with Railway-domain callback
  GitHub-->>Auth: Reject callback when registered for custom domain

Loading

_{Reviews (1): Last reviewed commit: "infra(railway): federate api login to gi..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR updates the Railway Terraform configuration to support federated login via GitHub OAuth for the API service by wiring OAuth client credentials and generating a Better Auth JWT signing secret.

Changes:

• Add a new github input variable (client ID/secret) and document it in terraform.tfvars.example.
• Inject GitHub OAuth and Better Auth configuration into the API service environment variables.
• Add a random_password resource to generate the Better Auth signing secret.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
infra/railway/variables.tf	Adds a new github object variable for OAuth credentials.
infra/railway/terraform.tfvars.example	Documents how to provide GitHub OAuth credentials in tfvars.
infra/railway/locals.tf	Adds OAuth + Better Auth env vars to local.api_env.
infra/railway/auth.tf	Generates a random secret for Better Auth JWT signing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Configures GitHub OAuth environment variables and generates a signing secret for better-auth on the API service, addressing the special characters issue in the auth secret. No issues found.

✅ 1 resolved

✅ Edge Case: better_auth password uses default special chars unlike postgres

📄 infra/railway/auth.tf:2-4 📄 infra/railway/locals.tf:22
random_password.better_auth uses the default special character set (includes $ { } < >), while the sibling random_password.postgres explicitly sets special = false because the value is embedded in a string Railway later interpolates. BETTER_AUTH_SECRET is injected as a Railway variable value; a generated secret containing a ${{...}}-like sequence could be misinterpreted by Railway's variable reference syntax and corrupt the secret. Add special = false (or a URL/interp-safe override) for consistency and to eliminate this rare breakage.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.