Initial import of verae-staff-session from zapier monorepo

README.md

@@ -0,0 +1,31 @@
+# verae-staff-session
+
+Shared cookie login for CS / sales / accounting / access-staff HTML.
+
+**Forgejo:** https://git.georgelambert.org/marchon/verae-staff-session
+
+Port `:3027`. Set `STAFF_AUTH=1` on the department servers and `STAFF_SESSION_URL=http://127.0.0.1:3027`. Cookie host is the browser host (ports share `127.0.0.1`). JSON APIs stay open unless you also send `x-staff-key`.
+
+Default key: `STAFF_KEY` or `ADMIN_KEY` or `admin-dev-key`.
+
+## Multiple hostnames
+
+Cookies are host-scoped. On one operator box (`127.0.0.1`) that is enough. For several DNS names, put one reverse proxy in front and set `STAFF_COOKIE_DOMAIN`:
+
+```nginx
+server {
+  server_name staff.example.com;
+  location /session/ { proxy_pass http://127.0.0.1:3027/; }
+  location /cs/      { proxy_pass http://127.0.0.1:3011/; }
+  location /sales/   { proxy_pass http://127.0.0.1:3012/; }
+  location /acct/    { proxy_pass http://127.0.0.1:3013/; }
+  location /staff/   { proxy_pass http://127.0.0.1:3025/; }
+}
+```
+
+```bash
+STAFF_COOKIE_DOMAIN=.example.com
+STAFF_COOKIE_SECURE=1
+STAFF_SESSION_URL=https://staff.example.com/session
+STAFF_AUTH=1
+```