fix: resolve relative discovery URLs in Link header

parseLinkHeader now resolves relative URLs against the request's
base URL. Previously /discovery resolved to http://localhost/discovery
which broke clients behind a reverse proxy. The server can now use
relative Link headers and the client resolves them correctly.

Also fix sample config to use client-id instead of audience, create
log file in pre-install script so the epithet user can write to it.

Author: brianm

contrib/freebsd/+MANIFEST

@@ -18,5 +18,7 @@ EOD
 scripts: {
   pre-install: <<EOD
 pw usershow epithet >/dev/null 2>&1 || pw useradd epithet -d /nonexistent -s /usr/sbin/nologin -c "epithet CA"
+touch /var/log/epithet_server.log
+chown epithet /var/log/epithet_server.log
 EOD
 }

contrib/freebsd/server.yaml.sample

@@ -14,26 +14,5 @@ server:
 policy:
   oidc:
     issuer: "https://accounts.google.com"
-    audience: "YOUR_CLIENT_ID"
+    client-id: "YOUR_CLIENT_ID"
   default-expiration: "5m"
-
-  # Map users (by email) to tags
-  users:
-    admin@example.com: [admin, deploy]
-    dev@example.com: [deploy]
-
-  # Default principals granted by tag
-  defaults:
-    allow:
-      wheel: [admin]
-      deploy: [deploy]
-    extensions:
-      permit-pty: ""
-      permit-agent-forwarding: ""
-
-  # Per-host overrides
-  # hosts:
-  #   "*.prod.example.com":
-  #     expiration: "2m"
-  #     allow:
-  #       root: [admin]

pkg/caclient/caclient.go

@@ -9,6 +9,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -380,7 +381,7 @@ func (c *Client) doHello(ctx context.Context, caURL string, token string, body [
 	}
 
 	// Extract and cache discovery URL from Link header
-	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery")
+	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery", caURL)
 	if discoveryURL != "" {
 		c.discoveryMu.Lock()
 		c.discoveryURL = discoveryURL
@@ -463,7 +464,7 @@ func (c *Client) doGetPublicKey(ctx context.Context, caURL string) (string, erro
 	}
 
 	// Extract and cache discovery URL from Link header.
-	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery")
+	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery", caURL)
 	if discoveryURL != "" {
 		c.discoveryMu.Lock()
 		c.discoveryURL = discoveryURL
@@ -591,7 +592,7 @@ func (c *Client) doRequest(ctx context.Context, caURL string, token string, body
 	}
 
 	// Extract and cache discovery URL from Link header
-	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery")
+	discoveryURL := parseLinkHeader(res.Header.Get("Link"), "discovery", caURL)
 	if discoveryURL != "" {
 		c.discoveryMu.Lock()
 		c.discoveryURL = discoveryURL
@@ -650,8 +651,9 @@ func isSuccessfulForCircuitBreaker(err error) bool {
 
 // parseLinkHeader extracts the URL for a given rel from a Link header.
 // Link header format: <url>; rel="name"
+// Relative URLs are resolved against baseURL.
 // Returns empty string if not found or malformed.
-func parseLinkHeader(header, rel string) string {
+func parseLinkHeader(header, rel string, baseURL string) string {
 	if header == "" {
 		return ""
 	}
@@ -663,13 +665,25 @@ func parseLinkHeader(header, rel string) string {
 		return ""
 	}
 
-	url := header[start+1 : end]
+	linkURL := header[start+1 : end]
 
 	// Check for the rel parameter
 	relParam := `rel="` + rel + `"`
 	if !strings.Contains(header, relParam) {
 		return ""
 	}
 
-	return url
+	// Resolve relative URLs against the base URL.
+	parsed, err := url.Parse(linkURL)
+	if err != nil {
+		return linkURL
+	}
+	if !parsed.IsAbs() && baseURL != "" {
+		base, err := url.Parse(baseURL)
+		if err == nil {
+			return base.ResolveReference(parsed).String()
+		}
+	}
+
+	return linkURL
 }