T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:31 -05:00
1 parent bd8de96456
commit af4f6c07ae
@@ -0,0 +1,28 @@
+# platform/oauth2-proxy
+
+**oauth2-proxy** — forward-auth at the Gateway for apps **without usable OIDC**, authenticating
+against Keycloak.
+
+- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
+- **Spec:** [docs/15 — Identity & Access](../../../home-network-k3s/docs/15-identity-and-access.md)
+- **Serves:** R-IDP-01..06 (esp. R-IDP-02: management UIs never unauthenticated)
+- **Owner:** WS-SEC (Gateway wiring shared with WS-NET)
+
+## What this stub is
+
+Flux `HelmRelease` for oauth2-proxy as the forward-auth provider for non-OIDC apps (PiHole, *arr UIs,
+qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI — ADR-0014). Replica count is an overlay
+knob (`${OAUTH2_PROXY_REPLICAS}`, R-ENV-02). Client/cookie secrets referenced **by name**,
+**SOPS-encrypted** (WS-SEC).
+
+## Contract (SSO/auth + Gateway)
+
+Pairs with [`../keycloak`](../keycloak) to realize the "SSO/auth contract": a ServiceDefinition `auth:
+forward-auth` service is protected by oauth2-proxy at the Gateway (ext-auth); `auth: oidc` services go
+native to Keycloak. Gateway ext-auth wiring is a **WS-NET** contract.
+
+## TODO (later phases — Phase 6)
+
+- OIDC issuer URL to the Keycloak realm; client registration.
+- Gateway forward-auth / ext-authz wiring (WS-NET); group-based authorization; MFA enforced in
+  Keycloak upstream.
@@ -0,0 +1,38 @@
+---
+# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
+# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
+# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: oauth2-proxy
+      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: oauth2-proxy
+        namespace: oauth2-proxy
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
+    config:
+      # OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
+      existingSecret: oauth2-proxy-credentials
+    extraArgs:
+      provider: oidc
+      # TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
+      oidc-issuer-url: "REPLACE-ME"
+      email-domain: "*"
+      # Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
+    # TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
+    #   MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+spec:
+  interval: 1h
+  url: https://oauth2-proxy.github.io/manifests
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
@@ -0,0 +1,7 @@
+# oauth2-proxy Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
+#
+# replicaCount: ${OAUTH2_PROXY_REPLICAS}       # overlay knob (dev 1 / prod 2 HA)
+# provider: oidc, oidc-issuer-url = Keycloak realm   (Phase 6)
+# config.existingSecret: oauth2-proxy-credentials    (client id/secret + cookie secret; SOPS — name only)
+# Forward-auth wired at the Gateway (ext-auth) for non-OIDC apps (ADR-0014) — contract with WS-NET.
+# Protects: PiHole, *arr UIs, qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI.