jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
39 lines
1.5 KiB
YAML
39 lines
1.5 KiB
YAML
---
|
|
# oauth2-proxy — forward-auth at the Gateway for apps WITHOUT usable OIDC (PiHole, *arr UIs,
|
|
# qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI). Authenticates against Keycloak.
|
|
# ADR-0014. Phase 0 STUB. Replica count is an overlay knob (R-ENV-02).
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: oauth2-proxy
|
|
version: ">=7.0.0 <8.0.0" # TODO(WS-SEC): pin at bring-up; Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: oauth2-proxy
|
|
namespace: oauth2-proxy
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
replicaCount: ${OAUTH2_PROXY_REPLICAS} # overlay knob: dev 1 / prod 2 (HA) — R-ENV-02
|
|
config:
|
|
# OIDC provider = Keycloak. Client id/secret + cookie secret: SOPS-encrypted secret, name only.
|
|
existingSecret: oauth2-proxy-credentials
|
|
extraArgs:
|
|
provider: oidc
|
|
# TODO(WS-SEC, Phase 6): oidc-issuer-url = https://keycloak.home.keithjackson.dev/realms/<realm>
|
|
oidc-issuer-url: "REPLACE-ME"
|
|
email-domain: "*"
|
|
# Forward-auth integration wired at the Gateway (HTTPRoute + ext-auth). Contract with WS-NET.
|
|
# TODO(WS-SEC/WS-NET, Phase 6): Gateway forward-auth/ext-authz wiring; group-based authorization;
|
|
# MFA enforced upstream in Keycloak. Management UIs must never be unauthenticated (R-IDP-02).
|