Server setup
Operator guide for running Ignis as a self-hosted server. Walks through the order of operations and links to detailed pages for each step.
[!IMPORTANT] Ignis is experimental and not intended for production use. Treat this guide as a reference for evaluation deployments.
What you are deploying
| Service | Role | Docs |
|---|---|---|
Ignis.Api | FHIR endpoint + OAuth 2.0 / OIDC authorization server (OpenIddict) | Ignis.Auth README |
Ignis.Web | Browser-facing BFF (React Router) that fronts the API for users | Ignis.Web README |
| MongoDB | Shared storage for FHIR resources and OpenIddict state | Infrastructure guide |
OAuth flow between API and Web: Authentication.
Setup checklist
Do the steps in order — later steps assume earlier ones are in place.
| # | Step | What | Reference |
|---|---|---|---|
| 1 | Provision MongoDB | Database used by API | Infrastructure guide |
| 2 | Decide public URLs | One hostname for API, one for Web — they cannot share an origin | Used by AllowedHosts, Issuer, IGNIS_WEB_APP_URL, OAuth redirect URIs |
| 3 | Configure the API | AllowedHosts, StoreSettings, AuthSettings:Issuer | API configuration |
| 4 | Generate certificates | PFX signing + encryption keys for OpenIddict (prod only) | Certificates |
| 5 | Register clients | authorization_code for the Web BFF; others as needed | Ignis.Auth README |
| 6 | Wire an external IdP | GitHub is the only built-in provider today | Authenticate with GitHub |
| 7 | Configure the Web BFF | IGNIS_WEB_* env vars (session, client creds, issuer, app URL) | Web configuration |
| 8 | Trust reverse proxy | Only if behind a proxy / load balancer / ingress | API config: ForwardedHeaders |
[!NOTE]
AuthSettings:ExternalProviders[].TypeacceptsOIDCin config, but it is unimplemented — selecting it throwsNotSupportedExceptionat startup.
Reference pages
| Page | Covers |
|---|---|
| API configuration | Every config key the API reads, with env var mapping |
| Web configuration | Every IGNIS_WEB_* env var the BFF reads |
| Local development setup | Local API/Web HTTPS, certs, OAuth, and imports |
| Authentication flow | OAuth / PAR / PKCE sequence diagram |
| Authenticate with GitHub | GitHub OAuth App setup |
| Ignis.Auth README | Client definitions and signing certificates |
| Infrastructure guide | Kubernetes / Helm, TLS, Argo CD |
| Admin UI | Enabling the maintenance pages |
| Scopes | Every OAuth scope and how user/client assignment works |