Added required keycloak config

platform/keycloak/client-urls.yaml

@@ -153,5 +153,13 @@ data:
         "webOrigins": [
           "https://sonarr.${BASE_DOMAIN}"
         ]
+      },
+      "vuln-scanner": {
+        "redirectUris": [
+          "https://cve.${BASE_DOMAIN}/oauth2/callback"
+        ],
+        "webOrigins": [
+          "https://cve.${BASE_DOMAIN}"
+        ]
       }
     }

platform/keycloak/keycloak-realm-clients.sops.yaml

@@ -17,6 +17,7 @@ stringData:
     qbittorrent-client-secret: ENC[AES256_GCM,data:jXNg4mF9Li0ilsV53iYeVJCGavVGFjvLk9jKBrRgcH6id1QCzsjs0bbMqJO5nALWfKhD8+CEmYJRrfABYTFKZA==,iv:XbLkX7/tfB/DLeMriHA3Oo2M6hgF1Z6RbHBXmdwUJoA=,tag:gikgdU0ajNKZxxYEUGc1aw==,type:str]
     radarr-client-secret: ENC[AES256_GCM,data:acsBXdewKB/gJNyoo1CsPLCvZe6fuJWbrKLim1/57OPnDHNoA+OvkQqt12Y4VMAXjzl7BWD2afFTIkIcaNGgaQ==,iv:VSvMaDZeuFyIAWpUoa++khvx07hY6g7X8PxORtjFTVI=,tag:jY5QSw6cMvUhCfX32RNgXA==,type:str]
     sonarr-client-secret: ENC[AES256_GCM,data:6cCVadKAKh5YbZIPocXG8pNY/AZbo3zCUP/19a0aHK0fIx6QzvBBl7v2vTsY/tq5tiVx8Uzr6oQNo/xt6pIgIA==,iv:EBXBZgpgdt7GiIS0w/Uj/vNE9EBgSgrbaMOKP346GKA=,tag:I2skAB+fdfQTsMgcywOrAg==,type:str]
+    vuln-scanner-client-secret: ENC[AES256_GCM,data:8LHIcFx42UzW3XMqgDe+lPJD6cdj8m/AWQa7tNPweIFZ7dZgvsDp5zjOUN8z+F+BnAVgMlt4fwHh6F/OyRy12w==,iv:BxdvgUWFyGPcFpWx+rYu2GDwc+cUEKqQGBxtBiuu/Lc=,tag:WQ322UyYtxSewyQBo5Ec1w==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -32,8 +33,8 @@ sops:
             YXJGUUJiTnFndFhDZDU1bmxXTENCbmsKuhb3RQ3LZmuTPAXEck8b6iuZ5vxLb9fV
             +fQELmU4kOTbZrPSxy+kpttLG5Cy5d6X2ieZXBf6opzpLTUhlBOkHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-31T13:42:49Z"
-    mac: ENC[AES256_GCM,data:/sOLb/XYQ2WB+mPgnTfYXD3y7xwDi926v0e2upBqgcCugtfKHg+Q1C9+XUiG2qE/iIBJyYVtOu9pmiMMNyT9hJ9vm7WFOC6gqukFMo42PjAI4I4PExfjVMKt76kKJ4OZZrKF2IKLjccZFuKDQhfADIR3zl6UNf/x5wz7XpXPEvI=,iv:iV4eOcRxsgTm1uNVMkMwsspj9glKCSZQlBciRY+MDJY=,tag:c72Pks1VJH+gmfP5FOQPSw==,type:str]
+    lastmodified: "2026-11-09T22:22:55Z"
+    mac: ENC[AES256_GCM,data:xZTYvTnXI/W5bKpa5orycFIK00+oZXtck9XASOulL9pvvZL+g3VR79mSN5bjmKHvA7LNcd8z2SJhNVqDxuEs1ciOiFHDgMq/ZNS4l0xmy3LJPFKKvgTYjKWgEfGJM9xxzr3SkrTtIFllydQ/7Q2RhHhb5m4pbr2HCLpANkp5bKo=,iv:tYOuIkS5oS2h623gIRUar5M75xd8E1TKTlkloHft3iU=,tag:/rYmgOs9Pz4D0kO53uaoTw==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4

platform/keycloak/keycloak-realm-clients.sops.yaml.example

@@ -40,3 +40,4 @@ stringData:
   headlamp-client-secret: REPLACE-ME
   # Mirror into platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml (key: client-secret).
   crafty-client-secret: REPLACE-ME
+  vuln-scanner-client-secret: REPLACE-ME

platform/keycloak/keycloak-realm-import.yaml

@@ -43,6 +43,10 @@ spec:
       secret:
         name: keycloak-realm-clients
         key: crafty-client-secret
+    VULN_SCANNER_CLIENT_SECRET:
+     secret:
+       name: keycloak-realm-clients
+       key: vuln-scanner-client-secret
     PIHOLE_CLIENT_SECRET:
       secret:
         name: keycloak-realm-clients
@@ -525,6 +529,29 @@ spec:
       # the SAME value is mirrored in apps/wave-0/pihole-oauth2-proxy-credentials.sops.yaml (cross-
       # namespace mirror). Provisioned live via kcadm at authoring time (2026-08-31) and captured here
       # as the durable GitOps source of truth (the operator imports the realm once; kcadm is authoritative).
+      - clientId: vuln-scanner
+        name: CVE report (oauth2-proxy)
+        protocol: openid-connect
+        enabled: true
+        publicClient: false
+        standardFlowEnabled: true
+        directAccessGrantsEnabled: false
+        secret: "$(env:VULN_SCANNER_CLIENT_SECRET)"
+        redirectUris:
+          - https://cve.${BASE_DOMAIN}/oauth2/callback
+        webOrigins:
+          - https://cve.${BASE_DOMAIN}
+        defaultClientScopes: [email, profile, roles]
+        protocolMappers:
+          - name: groups
+            protocol: openid-connect
+            protocolMapper: oidc-group-membership-mapper
+            config:
+              "full.path": "false"
+              "id.token.claim": "true"
+              "access.token.claim": "true"
+              "userinfo.token.claim": "true"
+              "claim.name": groups
       - clientId: pihole
         name: PiHole (oauth2-proxy)
         protocol: openid-connect

platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml

@@ -6,7 +6,7 @@ metadata:
 type: Opaque
 stringData:
     client-id: ENC[AES256_GCM,data:9n9fMQyIq+JmfgXy,iv:8FLkOTc6Rmck33ecd4A3DXP2CiGrAkxMJ8Q7nmI9naE=,tag:4wb8rAXx+KAIhWAviEKTJQ==,type:str]
-    client-secret: ENC[AES256_GCM,data:JQCSBroPwd1KxZhdOw9zYkA9krYdK79QpnP/WW3ZIYVoyvHGVKJ2OVPpvgtWy20Ex0yWCTtmpghn87r+4Kkrfw==,iv:RFuDweYB7z5fykB/Ued2Z7MdO9VVY2XoO4gwekxMo0U=,tag:UseTecg5dJMNR1SN6ZUZ7g==,type:str]
+    client-secret: ENC[AES256_GCM,data:LSfQvWKkIHzdn95JEsXihM4C6V2UVKYYo7O02Xlsc2F1gZknt7BWcv5MYMxlPBAe/tYbiNDdFwj1j7PhNi3DrA==,iv:k3sQ/AxUOh0Qx1WB5L7+JlVdTv+Hj8Ev+DJK+tFIvGU=,tag:be9SGyGa7tupjfLlpv4Rrw==,type:str]
     cookie-secret: ENC[AES256_GCM,data:F7McZBTr10fnpTEz8cYjXsvrwRgqiKrlcaL/mSZKjOjuPfaSvq4sV3YBuQc=,iv:2vDEqmUHFFpUsRkBSqj3X92eT2bP8VTj2BiAr/8+7ak=,tag:rdHVky9JmlcEEhsxV6OtnA==,type:str]
 sops:
     kms: []
@@ -23,8 +23,8 @@ sops:
             cUhWcGNGSThYTkRaV0NSOUZrM2ZmS1UKjFe6iGia0+QOZgWcSFoH0LLEp1f2M2ds
             V8bIBIFTtRDTKp6kgt0nee+Sgb7g5D5NIGTrRDGE256I8jdiNDcMpw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-11-09T15:43:11Z"
-    mac: ENC[AES256_GCM,data:jXBQdruY8yLD4k3iRHqn78Pq0iXzETDk/S8qyXSVFHsacqUvmtzdOw6ajJDg7hAkVGN9PXqH+lsz45wR3a3YVODbQZJyS0+cKuQ1cVWlV/wcWOlNSdeKSLRe8h658KjXGUPQubaDFB4rloBfUr5ebuGQGr4ZEj7g241xjrsjBic=,iv:asoMnTjsIIb1AgrgE9dERixbpw94TpQWCPRwAT3mXYM=,tag:uwCVmjDr3gDQAqWsmiF0tA==,type:str]
+    lastmodified: "2026-11-09T22:22:55Z"
+    mac: ENC[AES256_GCM,data:cC/ciBcVf6ORsjajmvGjiBdUemzP2/UKWRRAJI0I/yM5/XIlF32n/pnah2T2l6bXfCxkzohXgzGB6fc+d65jH27znr4iZ9ZWLsS3K6S6xTcJXaj0TFX+X5xZKhZyn45//4qae4AZa+2PlojaRNBytScj7HvfS62MA/Id2L1A3vA=,iv:IT8DM7Ebp8yjUYQ/FGZtA91rIRTIL62jlqsf9k2Fm6Y=,tag:HEX2gVJ80FM60TynRJME/A==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.4