ulicraft-server-v1/plan/03-drasl.md

Drasl — self-hosted auth (Yggdrasil + skins)

Summary

Self-hosted, Yggdrasil-compatible auth + skin server. Drop-in Mojang replacement via authlib-injector. Image: unmojang/drasl:latest. Reached only through Caddy at auth.ulicraft.local; no host port.

OIDC/Keycloak is OUT for now — drasl runs in password-login mode (AllowPasswordLogin = true). Admin + guests register with a username/password on the drasl web UI. Re-introducing Keycloak OIDC later is a future task.

Config is TOML only (no env var support). So config.toml is rendered from config.toml.tmpl by tooling/render-config.sh to inject BASE_DOMAIN.

config.toml.tmpl (key fields)

BaseURL       = "http://auth.${BASE_DOMAIN}"
Domain        = "auth.${BASE_DOMAIN}"
ListenAddress = "0.0.0.0:25585"          # internal; Caddy proxies
DefaultAdminUsernames = ["admin"]

AllowPasswordLogin = true

[ApplicationOwner]
# ...

# OIDC block intentionally omitted for now (no Keycloak).
# [[RegistrationOIDC]]  ← future

Critical gotchas (carry-over)

• 1.21+ secure profile: drasl SignPublicKeys = false MUST pair with server ENFORCE_SECURE_PROFILE=FALSE. Linked — both or neither.
• authlib endpoint = BaseURL + /authlib-injector → http://auth.ulicraft.local/authlib-injector. Must match on server and client. Network alias makes this identical inside/outside the stack.
• Domain affects skins — if wrong, authlib clients may not see skins.

Tasks

• Create drasl/config/config.toml.tmpl (password-login, no OIDC block)
• Set BaseURL/Domain to auth.${BASE_DOMAIN}, ListenAddress 0.0.0.0:25585
• Set SignPublicKeys = false
• Wire render-config.sh → drasl/config/config.toml (gitignored)
• Remove drasl host port from compose (internal only)
• Update compose: drasl on mcnet, no 25585:25585 publish
• Bootstrap admin account on first run; create guest accounts
• Verify authlib endpoint responds through Caddy
• Future: re-add [[RegistrationOIDC]] Keycloak block + secret file