jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
29 lines
1.3 KiB
Markdown
29 lines
1.3 KiB
Markdown
# platform/oauth2-proxy
|
|
|
|
**oauth2-proxy** — forward-auth at the Gateway for apps **without usable OIDC**, authenticating
|
|
against Keycloak.
|
|
|
|
- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
|
|
- **Spec:** [docs/15 — Identity & Access](../../../home-network-k3s/docs/15-identity-and-access.md)
|
|
- **Serves:** R-IDP-01..06 (esp. R-IDP-02: management UIs never unauthenticated)
|
|
- **Owner:** WS-SEC (Gateway wiring shared with WS-NET)
|
|
|
|
## What this stub is
|
|
|
|
Flux `HelmRelease` for oauth2-proxy as the forward-auth provider for non-OIDC apps (PiHole, *arr UIs,
|
|
qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI — ADR-0014). Replica count is an overlay
|
|
knob (`${OAUTH2_PROXY_REPLICAS}`, R-ENV-02). Client/cookie secrets referenced **by name**,
|
|
**SOPS-encrypted** (WS-SEC).
|
|
|
|
## Contract (SSO/auth + Gateway)
|
|
|
|
Pairs with [`../keycloak`](../keycloak) to realize the "SSO/auth contract": a ServiceDefinition `auth:
|
|
forward-auth` service is protected by oauth2-proxy at the Gateway (ext-auth); `auth: oidc` services go
|
|
native to Keycloak. Gateway ext-auth wiring is a **WS-NET** contract.
|
|
|
|
## TODO (later phases — Phase 6)
|
|
|
|
- OIDC issuer URL to the Keycloak realm; client registration.
|
|
- Gateway forward-auth / ext-authz wiring (WS-NET); group-based authorization; MFA enforced in
|
|
Keycloak upstream.
|