@@ -1,51 +1,84 @@
 package publisher
 
 import (
+	"context"
 	"net/http"
 
 	"alin.ovh/x/log"
 	"github.com/Southclaws/fault"
 	"github.com/Southclaws/fault/fmsg"
+	"github.com/coreos/go-oidc/v3/oidc"
 	"go.hacdias.com/indielib/indieauth"
-	"tailscale.com/client/local"
+	"golang.org/x/oauth2"
 
-	"alin.ovh/homestead/domain/web/server"
 	"alin.ovh/homestead/domain/web/templates"
 	"alin.ovh/homestead/shared/config"
 	ihttp "alin.ovh/homestead/shared/http"
 )
 
+type OIDCOptions struct {
+	Host         config.URL
+	ClientID     string
+	ClientSecret string
+}
+
 type Options struct {
 	Development  bool `conf:"-"`
-	BaseURL      config.URL
-	VCSRemoteURL config.URL    `conf:"default:https://git.alin.ovh/website"`
-	LocalClient  *local.Client `conf:"-"`
+	OIDC         OIDCOptions
+	BaseURL      *config.URL
+	VCSRemoteURL *config.URL `conf:"default:https://git.alin.ovh/website"`
 }
 
-type App struct {
+type Service struct {
 	log             *log.Logger
 	indieauthServer *indieauth.Server
 	siteSettings    templates.SiteSettings
-	localClient     *local.Client
-	*server.App
+	baseURL         *config.URL
+	oauth2Config    oauth2.Config
+	oidcVerifier    *oidc.IDTokenVerifier
 }
 
-func New(opts *Options, log *log.Logger) (*App, error) {
-	var err error
-	app := &App{
+func New(opts *Options, log *log.Logger) (*Service, error) {
+	ctx := context.Background()
+	provider, err := oidc.NewProvider(ctx, opts.OIDC.Host.String())
+	if err != nil {
+		return nil, fault.Wrap(err, fmsg.With("failed to create OIDC provider"))
+	}
+
+	if opts.OIDC.ClientID == "" || opts.OIDC.ClientSecret == "" {
+		return nil, fault.New("OIDC client ID and secret are required")
+	}
+
+	oauth2Config := oauth2.Config{
+		ClientID:     opts.OIDC.ClientID,
+		ClientSecret: opts.OIDC.ClientSecret,
+		RedirectURL:  opts.BaseURL.JoinPath("/auth/callback").String(),
+
+		// Discovery returns the OAuth2 endpoints.
+		Endpoint: provider.Endpoint(),
+
+		// "openid" is a required scope for OpenID Connect flows.
+		Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	oidcConfig := &oidc.Config{
+		ClientID: opts.OIDC.ClientID,
+	}
+
+	verifier := provider.Verifier(oidcConfig)
+
+	service := &Service{
 		log:             log,
+		baseURL:         opts.BaseURL,
 		indieauthServer: indieauth.NewServer(true, &http.Client{}),
-		localClient:     opts.LocalClient,
 		siteSettings: templates.SiteSettings{
 			Title:            "Barkeep",
 			Language:         "en-GB",
 			Menu:             []config.MenuItem{},
 			InjectLiveReload: opts.Development,
 		},
-		App: &server.App{
-			Domain:   opts.BaseURL.Hostname(),
-			Shutdown: func() {},
-		},
+		oauth2Config: oauth2Config,
+		oidcVerifier: verifier,
 	}
 
 	if opts.BaseURL.Path == "" {
@@ -56,11 +89,13 @@ if err != nil {
 		return nil, fault.Wrap(err, fmsg.With("invalid base URL"))
 	}
 
-	mux := ihttp.NewServeMux(log.Named("http"))
-	mux.HandleFunc("/", app.WithUserContext(app.Index))
-	mux.HandleFunc("/style.css", app.Style)
+	return service, nil
+}
 
-	app.Handler = mux
-
-	return app, nil
+func (s *Service) RegisterHandlers(mux *ihttp.ServeMux) {
+	mux.HandleFunc("/admin/style.css", s.Style)
+	mux.HandleFunc("/admin/auth/login", s.Login)
+	mux.HandleFunc("/admin/auth/callback", s.Callback)
+	mux.HandleFunc("/admin/auth/logout", s.Logout)
+	mux.HandleFunc("/admin/{$}", s.Index)
 }