WIP keycloak stack (gate probe)

platform/oauth2-proxy/helmrelease.yaml

@@ -1,7 +1,8 @@
 ---
-# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
-# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
-# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
+# oauth2-proxy — forward-auth for apps WITHOUT usable OIDC (PiHole, *arr UIs, qBittorrent, Homepage,
+# Prometheus, Alertmanager, Hubble UI — ADR-0014). Authenticates users against the Keycloak `homelab`
+# realm, then the Gateway ext-auth lets the request through only for an authenticated session
+# (R-IDP-02: no management UI unauthenticated). Chart image is quay.io/oauth2-proxy (not Bitnami).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -26,13 +27,32 @@ spec:
   values:
     replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
     config:
-      # OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
+      # client-id / client-secret / cookie-secret from the SOPS secret (name only). client-id +
+      # client-secret MUST match the realm's `oauth2-proxy` client (keycloak-realm-clients secret).
       existingSecret: oauth2-proxy-credentials
     extraArgs:
       provider: oidc
-      # TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
-      oidc-issuer-url: "REPLACE-ME"
+      oidc-issuer-url: https://keycloak.home.keithjackson.dev/realms/homelab
+      # Forward-auth (ext-auth) mode: no upstream app; return 202 for an authenticated session so the
+      # Gateway ext-authz can allow/deny. Auth headers are surfaced to the backend.
+      reverse-proxy: "true"
+      upstream: static://202
+      set-xauthrequest: "true"
+      pass-access-token: "true"
       email-domain: "*"
-      # Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
-    # TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
-    #   MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).
+      # Single sign-in/callback host for all forward-auth-protected services on the platform zone.
+      redirect-url: https://auth.home.keithjackson.dev/oauth2/callback
+      whitelist-domain: ".home.keithjackson.dev"
+      cookie-domain: ".home.keithjackson.dev"
+      cookie-secure: "true"
+      # Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
+      # baseline here is "authenticated"; per-service `--allowed-groups` is layered on at the Gateway
+      # ext-auth attachment (WS-NET contract) or via a dedicated oauth2-proxy instance per group.
+      oidc-groups-claim: groups
+      scope: "openid email profile"
+    # Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
+    metrics:
+      enabled: true
+    # TODO(WS-SEC/WS-NET, Phase 6): the Gateway ext-authz ATTACHMENT (which HTTPRoutes require this
+    #   proxy, and each route's allowed groups) is a WS-NET Gateway contract — Cilium Gateway API
+    #   ext-auth wiring. oauth2-proxy is the authenticator; the per-route enforcement is Gateway-side.

platform/oauth2-proxy/httproute.yaml

@@ -0,0 +1,25 @@
+---
+# Ingress for oauth2-proxy's sign-in/callback endpoint at auth.home.keithjackson.dev (docs/09). This
+# is where forward-auth-protected UIs redirect unauthenticated users to log in against Keycloak. CR of
+# the Gateway API CRDs — carried by platform-config. Same-namespace backend (no ReferenceGrant); the
+# parentRef is allowed via the oauth2-proxy namespace's gateway-access=shared label.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - auth.home.keithjackson.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /oauth2
+      backendRefs:
+        - name: oauth2-proxy
+          port: 80

platform/oauth2-proxy/namespace.yaml

@@ -3,3 +3,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: oauth2-proxy
+  labels:
+    # Opt in to the shared Gateway so oauth2-proxy's sign-in/callback endpoint is reachable at
+    # auth.home.keithjackson.dev (docs/09). Platform component — NOT app-namespace (see keycloak ns note).
+    gateway-access: "shared"

platform/oauth2-proxy/servicemonitor.yaml

@@ -0,0 +1,23 @@
+---
+# ServiceMonitor for oauth2-proxy (R-OBS-01, docs/10). CR of monitoring.coreos.com — CARRIED BY
+# platform-config (F-MON1). The chart's metrics endpoint is enabled in the helmrelease (metrics.enabled).
+# TODO(WS-SEC, bring-up): confirm the metrics port NAME the pinned chart exposes on the Service
+#   (commonly `metrics`, :44180) and adjust `port` below if it differs.
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+  labels:
+    release: kube-prometheus-stack
+spec:
+  namespaceSelector:
+    matchNames:
+      - oauth2-proxy
+  selector:
+    matchLabels:
+      app: oauth2-proxy
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s