gate

Private lab SSO fork derived from VoidAuth. See NOTICE for attribution.

gate is an OpenID Connect provider with user management, passkeys, MFA, ProxyAuth, and LDAP support.

Prerequisites

• Node.js >= 24.11
• Docker Desktop (for container builds and compose)

Local development

npm ci
cd frontend; npm ci; cd ..
npx tsc
npm run server:build
cd frontend; npm run build; cd ..
node dist/index.mjs --help

Local test (compose Postgres)

copy .example.env .env
# Edit .env: set APP_URL, STORAGE_KEY, DB_PASSWORD
docker compose --profile local build
docker compose --profile local up -d

Uses bundled Postgres (gate-db service). Data volumes: ./gate/config, ./gate/db.

Deployment (external Postgres)

copy .example.env .env
# Edit .env:
#   DB_HOST=postgres.lab.internal
#   DB_USER=gate
#   DB_NAME=gate
#   DB_PASSWORD=<secret>
#   DB_SSL=true   # if required
#   APP_URL, STORAGE_KEY
docker compose up -d

Runs the gate app container only. DB_HOST must be reachable from the Docker network (use host IP or service hostname, not localhost unless using host networking).

Essential environment variables

Variable	Required	Description
APP_URL	yes	Public URL of gate (e.g. https://auth.lab.example)
STORAGE_KEY	yes	32-byte hex encryption key
DB_HOST	yes	Postgres hostname (gate-db for local profile, or external server)
DB_PASSWORD	yes	Postgres password
DB_USER	no	Postgres user (default: postgres)
DB_NAME	no	Postgres database (default: postgres)
DB_SSL	no	Enable TLS to Postgres (default: false)
APP_TITLE	no	Display name (default: gate)

Build verification

npx tsc
npx eslint ./
npm run server:build
cd frontend; npm run build; cd ..
docker build --target build -t gate:build-test .
docker build -t gate/gate:latest .

ProxyAuth

If using ProxyAuth with a reverse proxy, session header is x-gate-session (not x-voidauth-session).