jakman85andClaude Opus 4.8
dfde5292d7
Enable monitoring in platform/kustomization.yaml (Phase 4). Grafana admin + Alertmanager SMTP secrets are provisioned (SOPS) and wired; Longhorn SC is up for Prometheus/Loki PVCs. Set the Alertmanager receiver 'to:' to a valid inbox ([email protected]) so the config loads (REPLACE-ME is not a valid address); operator can change it. NOTE: smtp_from ([email protected]) differs from the Gmail auth user — Gmail may reject/rewrite unless a send-as alias is configured; that only affects email delivery at alert time, not stack health. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
platform/oauth2-proxy
oauth2-proxy — forward-auth at the Gateway for apps without usable OIDC, authenticating against Keycloak.
- Governing ADR: ADR-0014 — IdP: Keycloak
- Spec: docs/15 — Identity & Access
- Serves: R-IDP-01..06 (esp. R-IDP-02: management UIs never unauthenticated)
- Owner: WS-SEC (Gateway wiring shared with WS-NET)
What this stub is
Flux HelmRelease for oauth2-proxy as the forward-auth provider for non-OIDC apps (PiHole, *arr UIs,
qBittorrent, Homepage, Prometheus, Alertmanager, Hubble UI — ADR-0014). Replica count is an overlay
knob (${OAUTH2_PROXY_REPLICAS}, R-ENV-02). Client/cookie secrets referenced by name,
SOPS-encrypted (WS-SEC).
Contract (SSO/auth + Gateway)
Pairs with ../keycloak to realize the "SSO/auth contract": a ServiceDefinition auth: forward-auth service is protected by oauth2-proxy at the Gateway (ext-auth); auth: oidc services go
native to Keycloak. Gateway ext-auth wiring is a WS-NET contract.
TODO (later phases — Phase 6)
- OIDC issuer URL to the Keycloak realm; client registration.
- Gateway forward-auth / ext-authz wiring (WS-NET); group-based authorization; MFA enforced in Keycloak upstream.