OAuth issuer and DID-doc service endpoint disagree for a loopback http host · Issue #671 · ngerakines.me/atproto-crates

Pinned build e81213fe3d2b (ghcr.io/happyproto/pds-test/atproto-pds), local http stack:

PDS_SERVICE_DID=did:web:localhost
PDS_HOSTNAME=localhost:2590

/.well-known/oauth-authorization-server → "issuer":"https://localhost". issuer_url() is https:// + the host from the service DID (crates/atproto-pds/src/oauth/metadata.rs:228); PDS_HOSTNAME and the port are never consulted.
The account's PLC DID document #atproto_pds → "serviceEndpoint":"http://localhost:2590". service_endpoint_url() hardcodes http for localhost/127.* and appends PDS_HOSTNAME verbatim (crates/atproto-pds/src/bin/pds.rs, written into the operation by PlcService).

A client that reads the endpoint from the DID document and then fetches the AS metadata there gets an issuer that cannot equal the URL it fetched, so sign-in fails before any browser step. Omitting PDS_HOSTNAME only changes the endpoint, to http://localhost; the issuer is unchanged.

Nothing in pds --help or the PDS_* vars reconciles the two for a loopback http origin.

Is there a supported way to make them agree for a local stack - honor a scheme+port on PDS_HOSTNAME for the issuer, accept a full public URL, or allow an http issuer behind a dev flag?

(Aside, possibly just image age: com.atproto.space.createSpace returns 501 here while com.atproto.simplespace.createSpace is routed. main looks like it routes the canonical NSID — happy to retest.)