aios/baseline/diff_log/20260706-cnnetmkt-auth-primary.md

20260706 cnnetmkt auth primary route fix

Problem

https://cnnetmkt.top/ could be opened, but login redirected users to https://auth.h.imruyi.top:8443. Casdoor then rejected the OAuth request because https://cnnetmkt.top/casdoor/callback/ was not in the application allow-list.

*.h.imruyi.top:8443 is retained as a backup domain only and must not be exposed as the primary public login URL.

Runtime Changes

• Added auth.cnnetmkt.top Nginx server block on hw.imruyi.top using the wildcard cnnetmkt.top certificate.
• Proxied auth.cnnetmkt.top to the existing backup/home Casdoor upstream auth.h.imruyi.top:8443 while preserving the public host as auth.cnnetmkt.top.
• Recreated user-control-web, user-control-worker, and user-control-beat with:
  • CASDOOR_PUBLIC_BASE_URL=https://auth.cnnetmkt.top
  • CASDOOR_INTERNAL_BASE_URL=https://auth.cnnetmkt.top
  • CASDOOR_INVITE_SYNC_BASE_URL=https://auth.cnnetmkt.top
  • UCC_PUBLIC_BASE_URL=https://cnnetmkt.top
• Updated Casdoor application admin/aios-portal on aihost to include https://cnnetmkt.top/casdoor/callback/ and keep user/portal/backup callbacks.

Backups

• Casdoor DB application table backup: /data/aios/backups/casdoor-cnnetmkt-primary-20260706T085445Z/application-before.sql
• HW UCC/Nginx backup directory: /data/aios-gitops/backups/auth-cnnetmkt-primary-*

Verification

• https://cnnetmkt.top/ redirects to /portal/login/ and then to https://auth.cnnetmkt.top/login/oauth/authorize?...redirect_uri=https%3A%2F%2Fcnnetmkt.top%2Fcasdoor%2Fcallback%2F....
• https://auth.cnnetmkt.top/login/oauth/authorize?... returns HTTP 200 from the Casdoor SPA through the HW Nginx proxy.
• user-control-web health returned healthy after recreation.
• Casdoor DB readback contains https://cnnetmkt.top/casdoor/callback/ in application.redirect_uris.

Follow-up

Run ops/gitops-migration/check_cnnetmkt_auth_primary.sh after any domain, Nginx, or Casdoor application change.