flux: re-enable oauth2-proxy now Keycloak is live and split-horizon DNS points at 192.168.1.53

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform-config/kustomization.yaml

@@ -49,12 +49,10 @@ resources:
   - ../platform/keycloak/keycloak-realm-import.yaml
   - ../platform/keycloak/httproute.yaml
   - ../platform/keycloak/servicemonitor.yaml
-  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
-  # TEMP-DISABLED (parallels platform/kustomization.yaml oauth2-proxy disable): these objects are
-  # in namespace `oauth2-proxy`, created only by the disabled platform/oauth2-proxy component, so
-  # leaving them here fails the platform-config dry-run atomically. Re-enable together with
-  # oauth2-proxy after Keycloak is live (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
-  # - ../platform/oauth2-proxy/httproute.yaml
-  # - ../platform/oauth2-proxy/servicemonitor.yaml
+  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs).
+  # Re-enabled together with the platform/oauth2-proxy component now Keycloak is live and split-horizon
+  # DNS resolves to the Proxmox Gateway VIP (192.168.1.53).
+  - ../platform/oauth2-proxy/httproute.yaml
+  - ../platform/oauth2-proxy/servicemonitor.yaml
   # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
   - ../platform/monitoring/grafana-httproute.yaml

platform/kustomization.yaml

@@ -29,13 +29,8 @@ resources:
   #      Cluster CRs + ServiceMonitors + HTTPRoutes are in platform-config (dependsOn platform). ----
   - cnpg               # CloudNativePG operator (DB backend for Keycloak) — ghcr.io images (not Bitnami)
   - keycloak           # Keycloak Operator (quay.io images) + SOPS admin credential
-  # - oauth2-proxy     # TEMP-DISABLED (cold-start deadlock): oauth2-proxy OIDC-discovers Keycloak,
-  #                    # which lives in platform-config (dependsOn platform) — so it crashloops and
-  #                    # gates platform Ready on a fresh cluster. Re-enable AFTER platform-config is
-  #                    # green (Keycloak live). Proper fix = move to a post-platform-config tier
-  #                    # (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
-  # FOLLOW-UP: move oauth2-proxy to a post-platform tier (dependsOn platform-config) so it can never
-  # block its own dependencies (cert-manager/gateway) from reconciling — see DECISIONS-LOG.
+  - oauth2-proxy       # forward-auth for non-OIDC apps (ADR-0014); OIDC-discovers Keycloak (now live)
+                       # via the split-horizon VIP (GATEWAY_VIP 192.168.1.53) — pre-verified in-cluster.
   # ---- Later phases: enabled when their phase opens ----
   # - velero           # Phase 4 (Backup/DR): BLOCKED on OQ-BKP (off-cluster backup target decision)
   # - image-automation # Phase 4 (Automated updates): Flux image-automation + Renovate