tomtervel/infrastructure
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

The login page says whose it is

Browse Source 
Kanidm out of the box presents itself: its own name, its own mark. A
neighbour landing on a login page that belongs to nobody in particular
is right to hesitate about typing a password into it.

The setup script now sets the vel's display name and logo on both the
instance and the portal client. The logo comes from the content repo -
the same images/logo.svg site.yaml already uses as the favicon - so
the login page and the site are branded from one place, and the
branding follows the content rather than this repo.

Left alone deliberately: account recovery by email, and easter eggs.
Both are decisions, not decoration, and the README says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
bl
2026-09-28 21:43:17 +02:00
co-authored by Claude Opus 5
parent 81233498d3
commit 0967b9973b
2 changed files with 47 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+26
View File
@@ -131,3 +131,29 @@ to send from and says so in its log.
Replies are not read yet: `JMAP_URL`, `JMAP_TOKEN` and `MAIL_REPLY_DOMAIN`
turn a reply into a note on the record it answers, and none of them are set
here.
## How the login page looks
Out of the box Kanidm presents itself: its own name, its own mark. A
neighbour arriving at a login page that belongs to nobody in particular
is right to hesitate, so `kanidm-setup.sh` sets the vel's name and mark
on both the instance and the portal client:
```sh
kanidm -D idm_admin -H https://$ID_HOST system domain set-displayname "Tomter Vel"
kanidm -D idm_admin -H https://$ID_HOST system domain set-image logo.svg svg
```
The logo is fetched from the content repo - the same `images/logo.svg`
that `site.yaml` uses as the favicon - so the login page and the site
are branded from one place. png, jpg, gif, svg and webp all work.
Two things the setup script deliberately leaves alone, because they are
decisions rather than branding:
- `system domain set-allow-account-recovery true` lets someone who has
lost their credentials get a reset link by proving one of their own
email addresses, instead of asking the board. Worth having for a vel;
it is still a door, so it is turned on knowingly or not at all.
- `system domain set-allow-easter-eggs` - seasonal icons and birthday
surprises. Off in production builds, and this is somebody's vel.