Flags

--config

string

Path to the YAML config ($GENROC_UI_CONFIG). Without it, --server alone runs a UI with no login: requests are proxied as they arrive, which is the local shape against a server without --auth, or a pasted token.

--http

string

Listen address; overrides the config.

--server

string · default http://localhost:8449

The genroc API to proxy to, when no --config is given ($GENROC_SERVER).

--version

boolean

Print the version and exit.

ui.yaml

The file --config or $GENROC_UI_CONFIG names. Without one there is no login.

Field	Type	Required	Description
server	string	yes	The genroc API to proxy to, e.g. http://genroc:8448.
listen	string		Address to listen on. --http overrides it. Default :8448.
login	Login		How people sign in. With neither providers nor passwords there is no login, and requests are proxied as they arrive.
redirect_url	string		The full URL of /auth/callback that providers redirect back to. Derived from the request when omitted; set it behind a proxy that rewrites Host.
roles	object		Group -> permissions. The key "*" matches anyone signed in.
secure_cookie	boolean		Forces the Secure attribute of the session cookie on or off. Omitted, it follows the request's scheme.
session_ttl	string		How long a sign-in lasts, as a duration ("30m", "12h"). Default 12h.
token	Token		The token minted for genroc. Required once login is configured.
users	object		Subject -> permissions, for a provider whose tokens carry no groups. Unioned with roles.

login

Field	Type	Required	Description
passwords	Password[]		Email and password logins kept in this file. genctl init password prints an entry.
providers	Provider[]		OpenID Connect providers, one sign-in button each.

login.providers

Each entry:

Field	Type	Required	Description
client_id	string	yes	The OAuth client registered with the provider.
client_secret	string	yes	That client's secret.
id	string	yes	Stable and unique; it appears in URLs and in the state cookie.
issuer	string	yes	The OIDC issuer URL, exactly as the provider's tokens name it.
discovery_url	string		Overrides where the discovery document is fetched, for an issuer this process reaches at a different address than the browser does (an IdP in Docker, split-horizon DNS).
groups_claim	string		ID-token claim listing the person's groups, matched against roles. Default groups.
jwks_url	string		Overrides the discovered key set, as discovery_url.
name	string		What the sign-in button says.
scopes	string[]		Scopes requested at login. Defaults to openid, email, profile and groups; set it for a provider that refuses groups, such as Google.
subject_claim	string		ID-token claim naming the person: the token's subject, and the key of users. Default email.
token_url	string		Overrides the discovered token endpoint, as discovery_url.

login.passwords

Each entry:

Field	Type	Required	Description
email	string	yes	The sign-in email, and the token's subject.
hash	string	yes	bcrypt hash of the password; plaintext is refused.
groups	string[]		Groups, matched against roles.

token

genroc verifies what genroc-ui mints, so these must match its --jwt-* flags.

Field	Type	Required	Description
audience	string		The aud of minted tokens. Must match genroc's --jwt-audience. Default genroc.
issuer	string		The iss of minted tokens. Must match genroc's --jwt-issuer. Default genroc-ui.
secret	string		The signing secret shared with genroc, at least 32 characters. Give this or secret_file.
secret_file	string		A file holding the secret, which must be the one genroc reads with --jwt-secret-file. Surrounding whitespace is trimmed.
ttl	string		Lifetime of a token minted for one request to genroc. Default 1m.