59 lines
2.7 KiB
YAML
59 lines
2.7 KiB
YAML
---
|
|
# oauth2-proxy — forward-auth for apps WITHOUT usable OIDC (PiHole, *arr UIs, qBittorrent, Homepage,
|
|
# Prometheus, Alertmanager, Hubble UI — ADR-0014). Authenticates users against the Keycloak `homelab`
|
|
# realm, then the Gateway ext-auth lets the request through only for an authenticated session
|
|
# (R-IDP-02: no management UI unauthenticated). Chart image is quay.io/oauth2-proxy (not Bitnami).
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: oauth2-proxy
|
|
version: ">=7.0.0 <8.0.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: ${OAUTH2_PROXY_REPLICAS} # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
|
|
config:
|
|
# client-id / client-secret / cookie-secret from the SOPS secret (name only). client-id +
|
|
# client-secret MUST match the realm's `oauth2-proxy` client (keycloak-realm-clients secret).
|
|
existingSecret: oauth2-proxy-credentials
|
|
extraArgs:
|
|
provider: oidc
|
|
oidc-issuer-url: https://keycloak.home.keithjackson.dev/realms/homelab
|
|
# Forward-auth (ext-auth) mode: no upstream app; return 202 for an authenticated session so the
|
|
# Gateway ext-authz can allow/deny. Auth headers are surfaced to the backend.
|
|
reverse-proxy: "true"
|
|
upstream: static://202
|
|
set-xauthrequest: "true"
|
|
pass-access-token: "true"
|
|
email-domain: "*"
|
|
# Single sign-in/callback host for all forward-auth-protected services on the platform zone.
|
|
redirect-url: https://auth.home.keithjackson.dev/oauth2/callback
|
|
whitelist-domain: ".home.keithjackson.dev"
|
|
cookie-domain: ".home.keithjackson.dev"
|
|
cookie-secure: "true"
|
|
# Expose group membership so per-service group authorization (R-IDP-06) can be enforced. The
|
|
# baseline here is "authenticated"; per-service `--allowed-groups` is layered on at the Gateway
|
|
# ext-auth attachment (WS-NET contract) or via a dedicated oauth2-proxy instance per group.
|
|
oidc-groups-claim: groups
|
|
scope: "openid email profile"
|
|
# Metrics for the ServiceMonitor (../oauth2-proxy servicemonitor in platform-config).
|
|
metrics:
|
|
enabled: true
|
|
# TODO(WS-SEC/WS-NET, Phase 6): the Gateway ext-authz ATTACHMENT (which HTTPRoutes require this
|
|
# proxy, and each route's allowed groups) is a WS-NET Gateway contract — Cilium Gateway API
|
|
# ext-auth wiring. oauth2-proxy is the authenticator; the per-route enforcement is Gateway-side.
|