WIP keycloak stack (gate probe)

platform/oauth2-proxy/helmrelease.yaml

@@ -1,7 +1,8 @@
 ---
-# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
-# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
-# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
+# oauth2-proxy — forward-auth for apps WITHOUT usable OIDC (PiHole, *arr UIs, qBittorrent, Homepage,
+# Prometheus, Alertmanager, Hubble UI — ADR-0014). Authenticates users against the Keycloak `homelab`
+# realm, then the Gateway ext-auth lets the request through only for an authenticated session
+# (R-IDP-02: no management UI unauthenticated). Chart image is quay.io/oauth2-proxy (not Bitnami).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
@@ -26,13 +27,32 @@ spec:
   values:
     replicaCount: ${OAUTH2_PROXY_REPLICAS}    # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
     config:
-      # OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
+      # client-id / client-secret / cookie-secret from the SOPS secret (name only). client-id +
+      # client-secret MUST match the realm's `oauth2-proxy` client (keycloak-realm-clients secret).
       existingSecret: oauth2-proxy-credentials
     extraArgs:
       provider: oidc
-      # TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
-      oidc-issuer-url: "REPLACE-ME"
+      oidc-issuer-url: https://keycloak.home.keithjackson.dev/realms/homelab
+      # Forward-auth (ext-auth) mode: no upstream app; return 202 for an authenticated session so the
+      # Gateway ext-authz can allow/deny. Auth headers are surfaced to the backend.
+      reverse-proxy: "true"
+      upstream: static://202
+      set-xauthrequest: "true"
+      pass-access-token: "true"
       email-domain: "*"
-      # Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
-    # TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
-    #   MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).
+      # Single sign-in/callback host for all forward-auth-protected services on the platform zone.
+      redirect-url: https://auth.home.keithjackson.dev/oauth2/callback
+      whitelist-domain: ".home.keithjackson.dev"
+      cookie-domain: ".home.keithjackson.dev"
+      cookie-secure: "true"
+      # Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
+      # baseline here is "authenticated"; per-service `--allowed-groups` is layered on at the Gateway
+      # ext-auth attachment (WS-NET contract) or via a dedicated oauth2-proxy instance per group.
+      oidc-groups-claim: groups
+      scope: "openid email profile"
+    # Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
+    metrics:
+      enabled: true
+    # TODO(WS-SEC/WS-NET, Phase 6): the Gateway ext-authz ATTACHMENT (which HTTPRoutes require this
+    #   proxy, and each route's allowed groups) is a WS-NET Gateway contract — Cilium Gateway API
+    #   ext-auth wiring. oauth2-proxy is the authenticator; the per-route enforcement is Gateway-side.