T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

platform/oauth2-proxy/helmrelease.yaml

@@ -0,0 +1,38 @@
+---
+# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
+# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
+# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: oauth2-proxy
+      version: ">=7.0.0 <8.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: oauth2-proxy
+        namespace: oauth2-proxy
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
+    config:
+      # OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
+      existingSecret: oauth2-proxy-credentials
+    extraArgs:
+      provider: oidc
+      # TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
+      oidc-issuer-url: "REPLACE-ME"
+      email-domain: "*"
+      # Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
+    # TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
+    #   MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).