WIP keycloak stack (gate probe)

platform/oauth2-proxy/httproute.yaml

@@ -0,0 +1,25 @@
+---
+# Ingress for oauth2-proxy's sign-in/callback endpoint at auth.home.keithjackson.dev (docs/09). This
+# is where forward-auth-protected UIs redirect unauthenticated users to log in against Keycloak. CR of
+# the Gateway API CRDs — carried by platform-config. Same-namespace backend (no ReferenceGrant); the
+# parentRef is allowed via the oauth2-proxy namespace's gateway-access=shared label.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: oauth2-proxy
+  namespace: oauth2-proxy
+spec:
+  parentRefs:
+    - name: shared
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - auth.home.keithjackson.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /oauth2
+      backendRefs:
+        - name: oauth2-proxy
+          port: 80