flux: re-enable oauth2-proxy now Keycloak is live and split-horizon DNS points at 192.168.1.53

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform-config/kustomization.yaml

@@ -49,12 +49,10 @@ resources:
   - ../platform/keycloak/keycloak-realm-import.yaml
   - ../platform/keycloak/httproute.yaml
   - ../platform/keycloak/servicemonitor.yaml
-  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs)
-  # TEMP-DISABLED (parallels platform/kustomization.yaml oauth2-proxy disable): these objects are
-  # in namespace `oauth2-proxy`, created only by the disabled platform/oauth2-proxy component, so
-  # leaving them here fails the platform-config dry-run atomically. Re-enable together with
-  # oauth2-proxy after Keycloak is live (DECISIONS-LOG oauth2-proxy FOLLOW-UP).
-  # - ../platform/oauth2-proxy/httproute.yaml
-  # - ../platform/oauth2-proxy/servicemonitor.yaml
+  # oauth2-proxy: forward-auth sign-in/callback ingress + ServiceMonitor (Gateway API / monitoring CRs).
+  # Re-enabled together with the platform/oauth2-proxy component now Keycloak is live and split-horizon
+  # DNS resolves to the Proxmox Gateway VIP (192.168.1.53).
+  - ../platform/oauth2-proxy/httproute.yaml
+  - ../platform/oauth2-proxy/servicemonitor.yaml
   # monitoring SSO proof: Grafana native-OIDC login ingress (Gateway API CR)
   - ../platform/monitoring/grafana-httproute.yaml